mkosi: bump fedora from 42 to 43

It seems - the address sanitizer on fedora 42 reports false-positive, or - probing partitions in libblkid 2.40.4 has a bug. Not sure which causes the issue, but anyway the address sanitizer kills udev-worker when sym_blkid_partition_get_name() is called in udev-builtin-blkid.c. ``` systemd-udevd[488]: ==488==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7ffdd716e020 at pc 0x563e3ca66fcb bp 0x7ffdd716d970 sp 0x7ffdd716d968 systemd-udevd[488]: READ of size 8 at 0x7ffdd716e020 thread T0 ((udev-worker)) (snip) systemd-udevd[488]: HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork systemd-udevd[488]: (longjmp and C++ exceptions *are* supported) systemd-udevd[488]: SUMMARY: AddressSanitizer: stack-buffer-underflow (/usr/bin/udevadm+0x187fca) (BuildId: 1fb56dbdf0447aba1185d6e34560b782b76098be) (snip) systemd-udevd[488]: Command: (udev-worker) systemd-udevd[488]: ==488==ABORTING ``` Let's bump fedora from 42 to 43. Fixes mkosi fedora 42 job failures after c349edfe49dc2c4b8a79e5d08ecf7c8e93c4c909. (cherry picked from commit 97940e77a9e347085a0b174bafa90a2823f43657)
mkosi: Add stress-ng to sanitizer wrapper programs
2025-11-21 01:34:44 +01:00 · 2025-10-13 10:04:47 +02:00 · 2025-10-13 10:04:47 +02:00 · 2025-10-13 10:04:47 +02:00 · 2025-10-13 10:04:47 +02:00 · 2025-10-13 10:04:47 +02:00
72 changed files with 4984 additions and 2026 deletions
--- a/.github/workflows/mkosi.yml
+++ b/.github/workflows/mkosi.yml
@ -87,7 +87,7 @@ jobs:
            relabel: no
            vm: 0
          - distro: fedora
-            release: "42"
+            release: "43"
            sanitizers: address,undefined
            llvm: 1
            cflags: "-Og"
--- a/LICENSE.GPL2
+++ b/LICENSE.GPL2
@ -2,7 +2,7 @@
 		       Version 2, June 1991
 Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
- 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 Everyone is permitted to copy and distribute verbatim copies
 of this license document, but changing it is not allowed.
@ -305,7 +305,7 @@ the "copyright" line and a pointer to where the full notice is found.
    You should have received a copy of the GNU General Public License along
    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+    59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
 Also add information on how to contact you by electronic and paper mail.
--- a/LICENSE.LGPL2.1
+++ b/LICENSE.LGPL2.1
@ -2,7 +2,7 @@
                       Version 2.1, February 1999
 Copyright (C) 1991, 1999 Free Software Foundation, Inc.
- 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ 59 Temple Place, Suite 330, Boston, MA 02111-1307  USA
 Everyone is permitted to copy and distribute verbatim copies
 of this license document, but changing it is not allowed.
@ -485,7 +485,7 @@ convey the exclusion of warranty; and each file should have at least the
    You should have received a copy of the GNU Lesser General Public
    License along with this library; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307  USA
 Also add information on how to contact you by electronic and paper mail.
--- a/LICENSES/LGPL-2.0-or-later.txt
+++ b/LICENSES/LGPL-2.0-or-later.txt
@ -3,7 +3,7 @@ GNU LIBRARY GENERAL PUBLIC LICENSE
 Version 2, June 1991
 Copyright (C) 1991 Free Software Foundation, Inc.
-51 Franklin St, Fifth Floor, Boston, MA  02110-1301, USA
+59 Temple Place, Suite 330, Boston, MA 02111-1307, USA
 Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
@ -158,7 +158,7 @@ To apply these terms, attach the following notices to the library. It is safest
     This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Library General Public License for more details.
-     You should have received a copy of the GNU Library General Public License along with this library; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301, USA.
+     You should have received a copy of the GNU Library General Public License along with this library; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307, USA.
 Also add information on how to contact you by electronic and paper mail.
--- a/hwdb.d/20-OUI.hwdb
+++ b/hwdb.d/20-OUI.hwdb
--- a/hwdb.d/20-acpi-vendor.hwdb
+++ b/hwdb.d/20-acpi-vendor.hwdb
@ -396,6 +396,9 @@ acpi:UBLX*:
 acpi:UBOO*:
 ID_VENDOR_FROM_DATABASE=Das U-Boot
 acpi:ULRV*:
 ID_VENDOR_FROM_DATABASE=UltraRISC Technology (Shanghai) Co., Ltd
 acpi:VAIO*:
 ID_VENDOR_FROM_DATABASE=VAIO Corporation
--- a/hwdb.d/20-acpi-vendor.hwdb.patch
+++ b/hwdb.d/20-acpi-vendor.hwdb.patch
@ -1,5 +1,5 @@
--- 20-acpi-vendor.hwdb.base	2025-08-20 13:04:02.003302877 +0100
+--- 20-acpi-vendor.hwdb.base	2025-09-17 09:39:11.942879943 +0100
-+++ 20-acpi-vendor.hwdb	2025-08-20 13:04:02.007302969 +0100
+++ 20-acpi-vendor.hwdb	2025-09-17 09:39:11.950880802 +0100
@@ -3,6 +3,8 @@
 # Data imported from:
 #     https://uefi.org/uefi-pnp-export
@ -19,7 +19,7 @@
 acpi:AMDI*:
  ID_VENDOR_FROM_DATABASE=AMD
-@@ -424,6 +423,9 @@
+@@ -427,6 +426,9 @@
 acpi:AAA*:
  ID_VENDOR_FROM_DATABASE=Avolites Ltd
@ -29,7 +29,7 @@
 acpi:AAE*:
  ID_VENDOR_FROM_DATABASE=Anatek Electronics Inc.
-@@ -451,6 +453,9 @@
+@@ -454,6 +456,9 @@
 acpi:ABO*:
  ID_VENDOR_FROM_DATABASE=D-Link Systems Inc
@ -39,7 +39,7 @@
 acpi:ABS*:
  ID_VENDOR_FROM_DATABASE=Abaco Systems, Inc.
-@@ -496,7 +501,7 @@
+@@ -499,7 +504,7 @@
 acpi:ACO*:
  ID_VENDOR_FROM_DATABASE=Allion Computer Inc.
@ -48,7 +48,7 @@
  ID_VENDOR_FROM_DATABASE=Aspen Tech Inc
 acpi:ACR*:
-@@ -775,6 +780,9 @@
+@@ -778,6 +783,9 @@
 acpi:AMT*:
  ID_VENDOR_FROM_DATABASE=AMT International Industry
@ -58,7 +58,7 @@
 acpi:AMX*:
  ID_VENDOR_FROM_DATABASE=AMX LLC
-@@ -823,6 +831,9 @@
+@@ -826,6 +834,9 @@
 acpi:AOA*:
  ID_VENDOR_FROM_DATABASE=AOpen Inc.
@ -68,7 +68,7 @@
 acpi:AOE*:
  ID_VENDOR_FROM_DATABASE=Advanced Optics Electronics, Inc.
-@@ -832,6 +843,9 @@
+@@ -835,6 +846,9 @@
 acpi:AOT*:
  ID_VENDOR_FROM_DATABASE=Alcatel
@ -78,7 +78,7 @@
 acpi:APC*:
  ID_VENDOR_FROM_DATABASE=American Power Conversion
-@@ -1013,7 +1027,7 @@
+@@ -1016,7 +1030,7 @@
  ID_VENDOR_FROM_DATABASE=ALPS ALPINE CO., LTD.
 acpi:AUO*:
@ -87,7 +87,7 @@
 acpi:AUR*:
  ID_VENDOR_FROM_DATABASE=Aureal Semiconductor
-@@ -1093,6 +1107,9 @@
+@@ -1096,6 +1110,9 @@
 acpi:AXE*:
  ID_VENDOR_FROM_DATABASE=Axell Corporation
@ -97,7 +97,7 @@
 acpi:AXI*:
  ID_VENDOR_FROM_DATABASE=American Magnetics
-@@ -1252,6 +1269,9 @@
+@@ -1255,6 +1272,9 @@
 acpi:BML*:
  ID_VENDOR_FROM_DATABASE=BIOMED Lab
@ -107,7 +107,7 @@
 acpi:BMS*:
  ID_VENDOR_FROM_DATABASE=BIOMEDISYS
-@@ -1264,6 +1284,9 @@
+@@ -1267,6 +1287,9 @@
 acpi:BNO*:
  ID_VENDOR_FROM_DATABASE=Bang & Olufsen
@ -117,7 +117,7 @@
 acpi:BNS*:
  ID_VENDOR_FROM_DATABASE=Boulder Nonlinear Systems
-@@ -1510,6 +1533,9 @@
+@@ -1513,6 +1536,9 @@
 acpi:CHA*:
  ID_VENDOR_FROM_DATABASE=Chase Research PLC
@ -127,7 +127,7 @@
 acpi:CHD*:
  ID_VENDOR_FROM_DATABASE=ChangHong Electric Co.,Ltd
-@@ -1675,6 +1701,9 @@
+@@ -1678,6 +1704,9 @@
 acpi:COD*:
  ID_VENDOR_FROM_DATABASE=CODAN Pty. Ltd.
@ -137,7 +137,7 @@
 acpi:COI*:
  ID_VENDOR_FROM_DATABASE=Codec Inc.
-@@ -2093,7 +2122,7 @@
+@@ -2096,7 +2125,7 @@
  ID_VENDOR_FROM_DATABASE=Dragon Information Technology
 acpi:DJE*:
@ -146,7 +146,7 @@
 acpi:DJP*:
  ID_VENDOR_FROM_DATABASE=Maygay Machines, Ltd
-@@ -2446,6 +2475,9 @@
+@@ -2449,6 +2478,9 @@
 acpi:EIN*:
  ID_VENDOR_FROM_DATABASE=Elegant Invention
@ -156,7 +156,7 @@
 acpi:EKA*:
  ID_VENDOR_FROM_DATABASE=MagTek Inc.
-@@ -2716,6 +2748,9 @@
+@@ -2719,6 +2751,9 @@
 acpi:FCG*:
  ID_VENDOR_FROM_DATABASE=First International Computer Ltd
@ -166,7 +166,7 @@
 acpi:FCS*:
  ID_VENDOR_FROM_DATABASE=Focus Enhancements, Inc.
-@@ -3092,7 +3127,7 @@
+@@ -3095,7 +3130,7 @@
  ID_VENDOR_FROM_DATABASE=General Standards Corporation
 acpi:GSM*:
@ -175,7 +175,7 @@
 acpi:GSN*:
  ID_VENDOR_FROM_DATABASE=Grandstream Networks, Inc.
-@@ -3202,6 +3237,9 @@
+@@ -3205,6 +3240,9 @@
 acpi:HEC*:
  ID_VENDOR_FROM_DATABASE=Hisense Electric Co., Ltd.
@ -185,7 +185,7 @@
 acpi:HEL*:
  ID_VENDOR_FROM_DATABASE=Hitachi Micro Systems Europe Ltd
-@@ -3337,6 +3375,9 @@
+@@ -3340,6 +3378,9 @@
 acpi:HSD*:
  ID_VENDOR_FROM_DATABASE=HannStar Display Corp
@ -195,7 +195,7 @@
 acpi:HSM*:
  ID_VENDOR_FROM_DATABASE=AT&T Microelectronics
-@@ -3463,6 +3504,9 @@
+@@ -3466,6 +3507,9 @@
 acpi:ICI*:
  ID_VENDOR_FROM_DATABASE=Infotek Communication Inc
@ -205,7 +205,7 @@
 acpi:ICM*:
  ID_VENDOR_FROM_DATABASE=Intracom SA
-@@ -3559,6 +3603,9 @@
+@@ -3562,6 +3606,9 @@
 acpi:IKE*:
  ID_VENDOR_FROM_DATABASE=Ikegami Tsushinki Co. Ltd.
@ -215,7 +215,7 @@
 acpi:IKS*:
  ID_VENDOR_FROM_DATABASE=Ikos Systems Inc
-@@ -3607,6 +3654,9 @@
+@@ -3610,6 +3657,9 @@
 acpi:IMX*:
  ID_VENDOR_FROM_DATABASE=arpara Technology Co., Ltd.
@ -225,7 +225,7 @@
 acpi:INA*:
  ID_VENDOR_FROM_DATABASE=Inventec Corporation
-@@ -4135,6 +4185,9 @@
+@@ -4138,6 +4188,9 @@
 acpi:LAN*:
  ID_VENDOR_FROM_DATABASE=Sodeman Lancom Inc
@ -235,7 +235,7 @@
 acpi:LAS*:
  ID_VENDOR_FROM_DATABASE=LASAT Comm. A/S
-@@ -4186,6 +4239,9 @@
+@@ -4189,6 +4242,9 @@
 acpi:LED*:
  ID_VENDOR_FROM_DATABASE=Long Engineering Design Inc
@ -245,7 +245,7 @@
 acpi:LEG*:
  ID_VENDOR_FROM_DATABASE=Legerity, Inc
-@@ -4204,6 +4260,9 @@
+@@ -4207,6 +4263,9 @@
 acpi:LGD*:
  ID_VENDOR_FROM_DATABASE=LG Display
@ -255,7 +255,7 @@
 acpi:LGI*:
  ID_VENDOR_FROM_DATABASE=Logitech Inc
-@@ -4270,6 +4329,9 @@
+@@ -4273,6 +4332,9 @@
 acpi:LND*:
  ID_VENDOR_FROM_DATABASE=Land Computer Company Ltd
@ -265,7 +265,7 @@
 acpi:LNK*:
  ID_VENDOR_FROM_DATABASE=Link Tech Inc
-@@ -4304,7 +4366,7 @@
+@@ -4307,7 +4369,7 @@
  ID_VENDOR_FROM_DATABASE=Design Technology
 acpi:LPL*:
@ -274,7 +274,7 @@
 acpi:LSC*:
  ID_VENDOR_FROM_DATABASE=LifeSize Communications
-@@ -4480,6 +4542,9 @@
+@@ -4483,6 +4545,9 @@
 acpi:MCX*:
  ID_VENDOR_FROM_DATABASE=Millson Custom Solutions Inc.
@ -284,7 +284,7 @@
 acpi:MDA*:
  ID_VENDOR_FROM_DATABASE=Media4 Inc
-@@ -4726,6 +4791,9 @@
+@@ -4729,6 +4794,9 @@
 acpi:MOM*:
  ID_VENDOR_FROM_DATABASE=Momentum Data Systems
@ -294,7 +294,7 @@
 acpi:MOS*:
  ID_VENDOR_FROM_DATABASE=Moses Corporation
-@@ -4966,6 +5034,9 @@
+@@ -4969,6 +5037,9 @@
 acpi:NAL*:
  ID_VENDOR_FROM_DATABASE=Network Alchemy
@ -304,7 +304,7 @@
 acpi:NAT*:
  ID_VENDOR_FROM_DATABASE=NaturalPoint Inc.
-@@ -5506,6 +5577,9 @@
+@@ -5509,6 +5580,9 @@
 acpi:PCX*:
  ID_VENDOR_FROM_DATABASE=PC Xperten
@ -314,7 +314,7 @@
 acpi:PDM*:
  ID_VENDOR_FROM_DATABASE=Psion Dacom Plc.
-@@ -5569,9 +5643,6 @@
+@@ -5572,9 +5646,6 @@
 acpi:PHE*:
  ID_VENDOR_FROM_DATABASE=Philips Medical Systems Boeblingen GmbH
@ -324,7 +324,7 @@
 acpi:PHL*:
  ID_VENDOR_FROM_DATABASE=Philips Consumer Electronics Company
-@@ -5662,9 +5733,6 @@
+@@ -5665,9 +5736,6 @@
 acpi:PNL*:
  ID_VENDOR_FROM_DATABASE=Panelview, Inc.
@ -334,7 +334,7 @@
 acpi:PNR*:
  ID_VENDOR_FROM_DATABASE=Planar Systems, Inc.
-@@ -6142,9 +6210,6 @@
+@@ -6145,9 +6213,6 @@
 acpi:RTI*:
  ID_VENDOR_FROM_DATABASE=Rancho Tech Inc
@ -344,7 +344,7 @@
 acpi:RTL*:
  ID_VENDOR_FROM_DATABASE=Realtek Semiconductor Company Ltd
-@@ -6319,9 +6384,6 @@
+@@ -6322,9 +6387,6 @@
 acpi:SEE*:
  ID_VENDOR_FROM_DATABASE=SeeColor Corporation
@ -354,7 +354,7 @@
 acpi:SEI*:
  ID_VENDOR_FROM_DATABASE=Seitz & Associates Inc
-@@ -6805,6 +6867,9 @@
+@@ -6808,6 +6870,9 @@
 acpi:SVD*:
  ID_VENDOR_FROM_DATABASE=SVD Computer
@ -364,7 +364,7 @@
 acpi:SVI*:
  ID_VENDOR_FROM_DATABASE=Sun Microsystems
-@@ -6889,6 +6954,9 @@
+@@ -6892,6 +6957,9 @@
 acpi:SZM*:
  ID_VENDOR_FROM_DATABASE=Shenzhen MTC Co., Ltd
@ -374,7 +374,7 @@
 acpi:TAA*:
  ID_VENDOR_FROM_DATABASE=Tandberg
-@@ -6979,6 +7047,9 @@
+@@ -6982,6 +7050,9 @@
 acpi:TDG*:
  ID_VENDOR_FROM_DATABASE=Six15 Technologies
@ -384,7 +384,7 @@
 acpi:TDM*:
  ID_VENDOR_FROM_DATABASE=Tandem Computer Europe Inc
-@@ -7021,6 +7092,9 @@
+@@ -7024,6 +7095,9 @@
 acpi:TEV*:
  ID_VENDOR_FROM_DATABASE=Televés, S.A.
@ -394,7 +394,7 @@
 acpi:TEZ*:
  ID_VENDOR_FROM_DATABASE=Tech Source Inc.
-@@ -7150,9 +7224,6 @@
+@@ -7153,9 +7227,6 @@
 acpi:TNC*:
  ID_VENDOR_FROM_DATABASE=TNC Industrial Company Ltd
@ -404,7 +404,7 @@
 acpi:TNM*:
  ID_VENDOR_FROM_DATABASE=TECNIMAGEN SA
-@@ -7465,14 +7536,14 @@
+@@ -7468,14 +7539,14 @@
 acpi:UNC*:
  ID_VENDOR_FROM_DATABASE=Unisys Corporation
@ -425,7 +425,7 @@
 acpi:UNI*:
  ID_VENDOR_FROM_DATABASE=Uniform Industry Corp.
-@@ -7507,6 +7578,9 @@
+@@ -7510,6 +7581,9 @@
 acpi:USA*:
  ID_VENDOR_FROM_DATABASE=Utimaco Safeware AG
@ -435,7 +435,7 @@
 acpi:USD*:
  ID_VENDOR_FROM_DATABASE=U.S. Digital Corporation
-@@ -7768,9 +7842,6 @@
+@@ -7771,9 +7845,6 @@
 acpi:WAL*:
  ID_VENDOR_FROM_DATABASE=Wave Access
@ -445,7 +445,7 @@
 acpi:WAV*:
  ID_VENDOR_FROM_DATABASE=Wavephore
-@@ -7898,7 +7969,7 @@
+@@ -7901,7 +7972,7 @@
  ID_VENDOR_FROM_DATABASE=WyreStorm Technologies LLC
 acpi:WYS*:
@ -454,7 +454,7 @@
 acpi:WYT*:
  ID_VENDOR_FROM_DATABASE=Wooyoung Image & Information Co.,Ltd.
-@@ -7912,9 +7983,6 @@
+@@ -7915,9 +7986,6 @@
 acpi:XDM*:
  ID_VENDOR_FROM_DATABASE=XDM Ltd.
@ -464,7 +464,7 @@
 acpi:XES*:
  ID_VENDOR_FROM_DATABASE=Extreme Engineering Solutions, Inc.
-@@ -7948,9 +8016,6 @@
+@@ -7951,9 +8019,6 @@
 acpi:XNT*:
  ID_VENDOR_FROM_DATABASE=XN Technologies, Inc.
@ -474,7 +474,7 @@
 acpi:XQU*:
  ID_VENDOR_FROM_DATABASE=SHANGHAI SVA-DAV ELECTRONICS CO., LTD
-@@ -8017,6 +8082,9 @@
+@@ -8020,6 +8085,9 @@
 acpi:ZBX*:
  ID_VENDOR_FROM_DATABASE=Zebax Technologies
--- a/hwdb.d/20-usb-vendor-model.hwdb
+++ b/hwdb.d/20-usb-vendor-model.hwdb
@ -40403,9 +40403,15 @@ usb:v0B0Dp0000*
 usb:v0B0E*
 ID_VENDOR_FROM_DATABASE=GN Netcom
 usb:v0B0Ep0301*
 ID_MODEL_FROM_DATABASE=Jabra EVOLVE 20
 usb:v0B0Ep0305*
 ID_MODEL_FROM_DATABASE=Jabra EVOLVE Link MS
 usb:v0B0Ep030C*
 ID_MODEL_FROM_DATABASE=Jabra EVOLVE 65
 usb:v0B0Ep0311*
 ID_MODEL_FROM_DATABASE=Jabra EVOLVE 65
@ -40460,6 +40466,21 @@ usb:v0B0Ep2456*
 usb:v0B0Ep245E*
 ID_MODEL_FROM_DATABASE=Jabra Link 370
 usb:v0B0Ep248A*
 ID_MODEL_FROM_DATABASE=Jabra Elite 85h
 usb:v0B0Ep24B8*
 ID_MODEL_FROM_DATABASE=Jabra Evolve2 65
 usb:v0B0Ep24BB*
 ID_MODEL_FROM_DATABASE=Jabra Evolve2 85
 usb:v0B0Ep24C9*
 ID_MODEL_FROM_DATABASE=Jabra Link 380
 usb:v0B0Ep24CA*
 ID_MODEL_FROM_DATABASE=Jabra Link 380
 usb:v0B0Ep620C*
 ID_MODEL_FROM_DATABASE=Jabra BT620s
--- a/hwdb.d/60-sensor.hwdb
+++ b/hwdb.d/60-sensor.hwdb
@ -778,6 +778,10 @@ sensor:modalias:acpi:*BOSC0200*:dmi:*:svnLENOVO*:pn80XE:*
 sensor:modalias:acpi:*BOSC0200*:dmi:*:svnLENOVO*:pn80U1:*
 ACCEL_MOUNT_MATRIX=0, -1, 0; -1, 0, 0; 0, 0, 1
 # Legion Go
 sensor:modalias:platform:HID-SENSOR-200073:dmi:*svnLENOVO:pn83E1:*
 ACCEL_MOUNT_MATRIX=0,1,0;-1,0,0;0,0,1
 # Yoga 300-11IBR, display sensor
 sensor:modalias:acpi:DUAL250E*:dmi:*:svnLENOVO:*:pvrLenovoYoga300-11IBR:*
 ACCEL_MOUNT_MATRIX=0, -1, 0; -1, 0, 0; 0, 0, 1
@ -1050,6 +1054,11 @@ sensor:modalias:acpi:KIOX010A*:dmi:bvn*:bvr*:svnPositivoTecnologiaSA:pn*:pvr*:rv
 ACCEL_MOUNT_MATRIX=-1, 0, 0; 0, 1, 0; 0, 0, 1
 ACCEL_LOCATION=display
 # Positivo Duo K116J
 sensor:modalias:acpi:MDA6655*:dmi:bvn*:bvr*:svnPositivoTecnologiaSA:pn*:pvr*:rvnPositivoTecnologiaSA:rnK116J*
 ACCEL_MOUNT_MATRIX=0, 1, 0; 1, 0, 0; 0, 0, 1
 ACCEL_LOCATION=display
 ########################################
 # Predia
 #########################################
--- a/hwdb.d/70-analyzers.hwdb
+++ b/hwdb.d/70-analyzers.hwdb
@ -16,6 +16,61 @@
 usb:v1209p4D69*
 ID_SIGNAL_ANALYZER=1
 ###########################################################
 # Hantek DSO-6022 oscilloscopes and compatible devices
 ###########################################################
 # Hantek DSO-6022BE w/o FW
 usb:v04B4p6022*
 ID_SIGNAL_ANALYZER=1
 # Hantek DSO-6022BE with FW
 usb:v04B5p6022*
 ID_SIGNAL_ANALYZER=1
 # Hantek DSO-6022BL w/o FW
 usb:v04B4p602A*
 ID_SIGNAL_ANALYZER=1
 # Hantek DSO-6022BL with FW
 usb:v04B5p602A*
 ID_SIGNAL_ANALYZER=1
 # Hantek DSO-6021 w/o FW
 usb:v04B4p6021*
 ID_SIGNAL_ANALYZER=1
 # Hantek DSO-6021 with FW
 usb:v04B5p6021*
 ID_SIGNAL_ANALYZER=1
 # Voltcraft DSO-2020, w/o FW, becomes DSO-6022BE with FW
 usb:v04B4p2020*
 ID_SIGNAL_ANALYZER=1
 # YiXingDianZiKeJi MDSO w/o FW
 usb:vD4A2p5660*
 ID_SIGNAL_ANALYZER=1
 # YiXingDianZiKeJi MDSO with FW
 usb:v1D50p608E*
 ID_SIGNAL_ANALYZER=1
 # BUUDAI DDS120 w/o FW
 usb:v8102p8102*
 ID_SIGNAL_ANALYZER=1
 # BUUDAI DDS120 with FW
 usb:v04B5p0120*
 ID_SIGNAL_ANALYZER=1
 # Instrustar isds-205b w/o FW
 usb:vD4A2p5661*
 ID_SIGNAL_ANALYZER=1
 # Instrustar isds-205b with FW
 usb:v1D50p1D50*
 ID_SIGNAL_ANALYZER=1
 ###########################################################
 # Total Phase
 ###########################################################
--- a/hwdb.d/70-mouse.hwdb
+++ b/hwdb.d/70-mouse.hwdb
@ -821,6 +821,20 @@ mouse:usb:v22d4p1308:name:Laview Technology Mionix Avior 7000:*
 mouse:usb:v0e8fp00a7:name:DaKai 2.4G RX:*
 MOUSE_DPI=*800@126 1600@126
 ##########################################
 # Nulea
 ##########################################
 # Note: it is possible that other devices may use the same wireless dongle,
 # as such this could require revisiting if it causes issues with other mice
 # Nulea M501 Wireless Trackball (USB Receiver)
 mouse:usb:v25a7pfa61:name:Compx 2.4G Receiver Mouse:*
 ID_INPUT_TRACKBALL=1
 # Nulea M501 Wireless Trackball (Bluetooth)
 mouse:bluetooth:v000ep3412:name:Nulea BT5.0 Mouse:*
 ID_INPUT_TRACKBALL=1
 ##########################################
 # Oklick
 ##########################################
--- a/hwdb.d/70-software-radio.hwdb
+++ b/hwdb.d/70-software-radio.hwdb
@ -21,6 +21,17 @@
 # Allowed properties are:
 #   ID_SOFTWARE_RADIO=0|1
 ##########################################
 # Airspy
 ##########################################
 # Airspy R2
 usb:v1D50p60A1*
 ID_SOFTWARE_RADIO=1
 # Airspy HF+
 usb:v03EBp800C*
 ID_SOFTWARE_RADIO=1
 ##########################################
 # Analog Devices
 ##########################################
@ -48,10 +59,54 @@ usb:v2500p0002*
 usb:v2500p0020*
 usb:v2500p0021*
 usb:v2500p0022*
 usb:v2500p0023*
 usb:v3923p7813*
 usb:v3923p7814*
 ID_SOFTWARE_RADIO=1
 ##########################################
 # FUNcube
 ##########################################
 # FUNcube Dongle Pro
 usb:v04D8pFB56*
 ID_SOFTWARE_RADIO=1
 # FUNcube Dongle Pro+
 usb:v04D8pFB31*
 ID_SOFTWARE_RADIO=1
 ##########################################
 # Great Scott Gadgets
 ##########################################
 # HackRF Jawbreaker
 usb:v1D50p604B*
 ID_SOFTWARE_RADIO=1
 # HackRF One
 usb:v1D50p6089*
 ID_SOFTWARE_RADIO=1
 ##########################################
 # HydraSDR
 ##########################################
 # HydraSDR RFOne
 usb:v38AFp0001*
 ID_SOFTWARE_RADIO=1
 ##########################################
 # LimeSDR
 ##########################################
 # XTRX (USB3380)
 usb:v0525p3380*
 ID_SOFTWARE_RADIO=1
 ##########################################
 # Microtelecom
 ##########################################
 # Perseus
 usb:v04B4p325C*
 ID_SOFTWARE_RADIO=1
 ##########################################
 # Nuand
 ##########################################
@ -237,3 +292,34 @@ usb:v1F4DpD286*
 # PROlectrix DV107669 (FC0012)
 usb:v1F4DpD803*
 ID_SOFTWARE_RADIO=1
 ##########################################
 # SDRplay
 ##########################################
 # RSP1
 usb:v1DF7p2500*
 ID_SOFTWARE_RADIO=1
 # RSP1A
 usb:v1DF7p3000*
 ID_SOFTWARE_RADIO=1
 # RSP2/RSP2pro
 usb:v1DF7p3010*
 ID_SOFTWARE_RADIO=1
 # RSPduo
 usb:v1DF7p3020*
 ID_SOFTWARE_RADIO=1
 # RSPdx
 usb:v1DF7p3030*
 ID_SOFTWARE_RADIO=1
 # RSP1B
 usb:v1DF7p3050*
 ID_SOFTWARE_RADIO=1
 # RSPdxR2
 usb:v1DF7p3060*
 ID_SOFTWARE_RADIO=1
--- a/hwdb.d/acpi_id_registry.csv
+++ b/hwdb.d/acpi_id_registry.csv
@ -138,3 +138,4 @@ IDEMIA,IDEM,06/26/2018
 "Fsas Technologies Inc.",FSAS,04/30/2025
 "JP Morgan Chase N.A.",JPMC,05/30/2025
 "Roku, Inc.",ROKU,07/15/2025
 "UltraRISC Technology (Shanghai) Co., Ltd",ULRV,09/15/2025
--- a/hwdb.d/ma-large.txt
+++ b/hwdb.d/ma-large.txt
--- a/hwdb.d/ma-medium.txt
+++ b/hwdb.d/ma-medium.txt
--- a/hwdb.d/ma-small.txt
+++ b/hwdb.d/ma-small.txt
--- a/hwdb.d/usb.ids
+++ b/hwdb.d/usb.ids
@ -9,8 +9,8 @@
 #	The latest version can be obtained from
 #		http://www.linux-usb.org/usb.ids
 #
-# Version: 2025.07.26
+# Version: 2025.09.15
-# Date:    2025-07-26 20:34:01
+# Date:    2025-09-15 20:34:02
 #
 # Vendors, devices and interfaces. Please keep sorted.
@ -13488,7 +13488,9 @@
 0b0d  ProjectLab
 	0000  CenturyCD
 0b0e  GN Netcom
 	0301  Jabra EVOLVE 20
 	0305  Jabra EVOLVE Link MS
 	030c  Jabra EVOLVE 65
 	0311  Jabra EVOLVE 65
 	0312  enc060:Buttons Volume up/down/mute + phone [Jabra]
 	0343  Jabra UC VOICE 150a
@ -13507,6 +13509,11 @@
 	2007  GN 2000 Stereo Corded Headset
 	2456  Jabra SPEAK 810
 	245e  Jabra Link 370
 	248a  Jabra Elite 85h
 	24b8  Jabra Evolve2 65
 	24bb  Jabra Evolve2 85
 	24c9  Jabra Link 380
 	24ca  Jabra Link 380
 	620c  Jabra BT620s
 	9330  Jabra GN9330 Headset
 	a346  Jabra Engage 75 Stereo
--- a/man/homectl.xml
+++ b/man/homectl.xml
@ -179,6 +179,16 @@
        <xi:include href="version-info.xml" xpointer="v256"/></listitem>
      </varlistentry>
      <varlistentry>
        <term><option>--prompt-new-user</option></term>
        <listitem><para>If used in conjunction with <command>firstboot</command> and no regular user account
        exists on the system so far the tool will interactively query for user information and create an
        account.</para>
        <xi:include href="version-info.xml" xpointer="v256"/></listitem>
      </varlistentry>
      <xi:include href="user-system-options.xml" xpointer="host" />
      <xi:include href="user-system-options.xml" xpointer="machine" />
@ -1212,9 +1222,10 @@
        <listitem><para>This command is supposed to be invoked during the initial boot of the system. It
        checks whether any regular home area exists so far, and if not queries the user interactively on the
-        console for user name and password and creates one. Alternatively, if one or more service credentials
+        console for user name and password and creates one (only if <option>--prompt-new-user</option> is
-        whose name starts with <literal>home.create.</literal> are passed to the command (containing a user
+        specified). Alternatively, if one or more service credentials whose name starts with
-        record in JSON format) these users are automatically created at boot.</para>
+        <literal>home.create.</literal> are passed to the command (containing a user record in JSON format)
        these users are automatically created at boot.</para>
        <para>This command is invoked by the <filename>systemd-homed-firstboot.service</filename> service
        unit.</para>
--- a/man/journalctl.xml
+++ b/man/journalctl.xml
@ -737,8 +737,8 @@
      <varlistentry>
        <term><option>--no-hostname</option></term>
-        <listitem><para>Do not show the hostname field of log messages originating from the local host. This
+        <listitem><para>Do not show the hostname field of log messages. This switch has an effect only on the
-        switch has an effect only on the <option>short</option> family of output modes (see above).</para>
+        <option>short</option> family of output modes (see above).</para>
        <para>Note: this option does not remove occurrences of the hostname from log entries themselves, so
        it does not prevent the hostname from being visible in the logs.</para>
--- a/man/sd-journal.xml
+++ b/man/sd-journal.xml
@ -75,13 +75,14 @@
  <refsect1>
    <title>Thread safety</title>
-    <para>Functions that operate on <structname>sd_journal</structname> objects are thread agnostic — given
+    <para>Functions that operate on <structname>sd_journal</structname> objects are thread agnostic — a given
-    <structname>sd_journal</structname> pointer may only be used from one specific thread at all times (and it has to
+    <structname>sd_journal</structname> pointer may only be used from one thread at a time, but multiple
-    be the very same one during the entire lifetime of the object), but multiple, independent threads may use multiple,
+    independent threads may use multiple objects concurrently. Some functions — those that are used to send
-    independent objects safely. Other functions — those that are used to send entries to the journal, like
+    entries to the journal, like
-    <citerefentry><refentrytitle>sd_journal_print</refentrytitle><manvolnum>3</manvolnum></citerefentry> and similar,
+    <citerefentry><refentrytitle>sd_journal_print</refentrytitle><manvolnum>3</manvolnum></citerefentry> and
-    or those that are used to retrieve global information like
+    similar, or those that are used to retrieve global information like
-    <citerefentry><refentrytitle>sd_journal_stream_fd</refentrytitle><manvolnum>3</manvolnum></citerefentry> and
+    <citerefentry><refentrytitle>sd_journal_stream_fd</refentrytitle><manvolnum>3</manvolnum></citerefentry>
    and
    <citerefentry><refentrytitle>sd_journal_get_catalog_for_message_id</refentrytitle><manvolnum>3</manvolnum></citerefentry>
    — are fully thread-safe and may be called from multiple threads in parallel.</para>
  </refsect1>
--- a/man/sd-login.xml
+++ b/man/sd-login.xml
@ -41,10 +41,10 @@
    system.</para>
    <para>Note that these APIs only allow purely passive access and
-    monitoring of seats, sessions and users. To actively make changes
+    monitoring of seats, sessions, and users. To actively make changes
    to the seat configuration, terminate login sessions, or switch
    session on a seat you need to utilize the D-Bus API of
-    systemd-logind, instead.</para>
+    systemd-logind instead.</para>
    <para>These functions synchronously access data in
    <filename>/proc/</filename>, <filename>/sys/fs/cgroup/</filename>
@ -62,7 +62,7 @@
    other.</para>
    <para>If the functions return string arrays, these are generally
-    <constant>NULL</constant> terminated and need to be freed by the
+    <constant>NULL</constant>-terminated and need to be freed by the
    caller with the libc
    <citerefentry project='man-pages'><refentrytitle>free</refentrytitle><manvolnum>3</manvolnum></citerefentry>
    call after use, including the strings referenced therein.
--- a/man/sd_bus_can_send.xml
+++ b/man/sd_bus_can_send.xml
@ -27,7 +27,7 @@
      <funcsynopsisinfo>#include &lt;systemd/sd-bus.h&gt;</funcsynopsisinfo>
      <funcprototype>
-        <funcdef>void <function>sd_bus_can_send</function></funcdef>
+        <funcdef>int <function>sd_bus_can_send</function></funcdef>
        <paramdef>sd_bus *<parameter>bus</parameter></paramdef>
        <paramdef>char <parameter>type</parameter></paramdef>
      </funcprototype>
--- a/man/sd_bus_track_new.xml
+++ b/man/sd_bus_track_new.xml
@ -33,6 +33,12 @@
    <funcsynopsis>
      <funcsynopsisinfo>#include &lt;systemd/sd-bus.h&gt;</funcsynopsisinfo>
      <funcprototype>
        <funcdef>typedef int (*<function>sd_bus_track_handler_t</function>)</funcdef>
        <paramdef>sd_bus_track *<parameter>track</parameter></paramdef>
        <paramdef>void *<parameter>userdata</parameter></paramdef>
      </funcprototype>
      <funcprototype>
        <funcdef>int <function>sd_bus_track_new</function></funcdef>
        <paramdef>sd_bus* <parameter>bus</parameter></paramdef>
@ -221,6 +227,7 @@
  <refsect1>
    <title>History</title>
    <para><function>sd_bus_track_new()</function>,
    <function>sd_bus_track_handler_t()</function>,
    <function>sd_bus_track_ref()</function>,
    <function>sd_bus_track_unref()</function>,
    <function>sd_bus_track_unrefp()</function>,
--- a/man/sd_journal_get_catalog.xml
+++ b/man/sd_journal_get_catalog.xml
@ -84,14 +84,12 @@
  <refsect1>
    <title>Notes</title>
-    <para>Function <function>sd_journal_get_catalog()</function> is thread-agnostic and only
+    <para>Function <function>sd_journal_get_catalog()</function> is thread-agnostic and only a single thread
-    a single specific thread may operate on a given object during its entire lifetime. It is safe to allocate multiple
+    may operate on a given object at any given time. Multiple independent objects may be used from different
-    independent objects and use each from a specific thread in parallel. However, it is not safe to allocate such an
+    threads in parallel.</para>
    object in one thread, and operate or free it from any other, even if locking is used to ensure these threads do not
    operate on it at the very same time.</para>
-    <para>Function <function>sd_journal_get_catalog_for_message_id()</function> is are thread-safe and may be called in
+    <para>Function <function>sd_journal_get_catalog_for_message_id()</function> is thread-safe and may be
-    parallel from multiple threads.</para>
+    called from multiple threads in parallel.</para>
    <xi:include href="libsystemd-pkgconfig.xml" xpointer="pkgconfig-text"/>
  </refsect1>
--- a/man/systemd-userdbd.service.xml
+++ b/man/systemd-userdbd.service.xml
@ -35,7 +35,9 @@
    compatibility. It may also pick up statically defined JSON user/group records from files in
    <filename>/etc/userdb/</filename>, <filename>/run/userdb/</filename>,
    <filename>/run/host/userdb/</filename> and <filename>/usr/lib/userdb/</filename> with the
-    <literal>.user</literal> or <literal>.group</literal> extension.</para>
+    <literal>.user</literal> or <literal>.group</literal> extension. For more details about the extensions
    read the <citerefentry><refentrytitle>nss-systemd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
    manpage.</para>
    <para>Most of <command>systemd-userdbd</command>'s functionality is accessible through the
    <citerefentry><refentrytitle>userdbctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
--- a/man/systemd.resource-control.xml
+++ b/man/systemd.resource-control.xml
@ -583,7 +583,7 @@ CPUWeight=20   DisableControllers=cpu              /          \
          an absolute number of tasks or a percentage value that is taken relative to the configured maximum
          number of tasks on the system. If assigned the special value <literal>infinity</literal>, no tasks
          limit is applied. This controls the <literal>pids.max</literal> control group attribute. For
-          details about this control group attribute, the
+          details about this control group attribute, see the
          <ulink url="https://docs.kernel.org/admin-guide/cgroup-v2.html#pid">pids controller
          </ulink>.
          The effective configuration is reported as <varname>EffectiveTasksMax=</varname>.</para>
--- a/man/threads-aware.xml
+++ b/man/threads-aware.xml
@ -6,10 +6,9 @@
 <refsect1>
  <title/>
-  <para id="strict">All functions listed here are thread-agnostic and only a single specific thread may operate on a
+  <para id="strict">All functions listed here are thread-agnostic and only a single thread may operate on a
-  given object during its entire lifetime. It is safe to allocate multiple independent objects and use each from a
+  given object at any given time. Different threads may access the same object at different times. Multiple
-  specific thread in parallel. However, it is not safe to allocate such an object in one thread, and operate or free it
+  independent objects may be used from different threads in parallel.</para>
  from any other, even if locking is used to ensure these threads do not operate on it at the very same time.</para>
  <para id="safe">All functions listed here are thread-safe and may be called in parallel from multiple threads.</para>
--- a/mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf
+++ b/mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf
@ -37,6 +37,7 @@ Packages=
        btrfs-progs
        apt
        bind9-dnsutils
        bsdutils
        cryptsetup-bin
        dbus-broker
        dbus-user-session
--- a/mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf.d/knot.conf
+++ b/mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf.d/knot.conf
@ -0,0 +1,26 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 # New package needed for TEST-75-RESOLVED
 [TriggerMatch]
 Distribution=debian
 Release=!bullseye
 Release=!bookworm
 Release=!trixie
 # TODO: drop once Duke ships
 Release=!oldstable
 # TODO: drop once Forky ships
 Release=!stable
 [TriggerMatch]
 Distribution=ubuntu
 Release=!jammy
 Release=!noble
 Release=!plucky
 Release=!questing
 [TriggerMatch]
 Distribution=kali
 [Content]
 Packages=knot-keymgr
--- a/mkosi/mkosi.sanitizers/mkosi.postinst
+++ b/mkosi/mkosi.sanitizers/mkosi.postinst
@ -75,6 +75,7 @@ wrap=(
    setpriv
    sshd
    stat
    stress-ng
    su
    tar
    tgtd
--- a/shell-completion/zsh/_journalctl
+++ b/shell-completion/zsh/_journalctl
@ -99,7 +99,7 @@ _arguments -s \
    '(- *)'{-h,--help}'[Show this help]' \
    '(- *)--version[Show package version]' \
    '--no-pager[Do not pipe output into a pager]' \
-    --no-hostname"[Don't show the hostname of local log messages]" \
+    --no-hostname"[Don't show the hostname of log messages]" \
    '(-l --full)'{-l,--full}'[Show long fields in full]' \
    '(-a --all)'{-a,--all}'[Show all fields, including long and unprintable]' \
    '(-f --follow)'{-f,--follow}'[Follow journal]' \
--- a/src/basic/efivars.c
+++ b/src/basic/efivars.c
@ -6,6 +6,7 @@
 #include <linux/fs.h>
 #include <stdlib.h>
 #include <sys/stat.h>
 #include <sys/uio.h>
 #include <unistd.h>
 #include "sd-id128.h"
@ -37,12 +38,7 @@ int efi_get_variable(
                void **ret_value,
                size_t *ret_size) {
        _cleanup_close_ int fd = -EBADF;
        _cleanup_free_ void *buf = NULL;
        struct stat st;
        usec_t begin = 0; /* Unnecessary initialization to appease gcc */
        uint32_t a;
        ssize_t n;
        assert(variable);
@ -62,79 +58,100 @@ int efi_get_variable(
                begin = now(CLOCK_MONOTONIC);
        }
-        fd = open(p, O_RDONLY|O_NOCTTY|O_CLOEXEC);
+        _cleanup_close_ int fd = open(p, O_RDONLY|O_NOCTTY|O_CLOEXEC);
        if (fd < 0)
                return log_debug_errno(errno, "open(\"%s\") failed: %m", p);
        uint32_t attr;
        _cleanup_free_ char *buf = NULL;
        ssize_t n;
        /* The kernel ratelimits reads from the efivarfs because EFI is inefficient, and we'll occasionally
         * fail with EINTR here. A slowdown is better than a failure for us, so retry a few times and
         * eventually fail with -EBUSY.
         *
         * See https://github.com/torvalds/linux/blob/master/fs/efivarfs/file.c#L75 and
         * https://github.com/torvalds/linux/commit/bef3efbeb897b56867e271cdbc5f8adaacaeb9cd.
         *
         * The variable may also be overwritten between the stat and read. If we find out that the new
         * contents are longer, try again.
         */
        for (unsigned try = 0;; try++) {
                struct stat st;
                if (fstat(fd, &st) < 0)
                        return log_debug_errno(errno, "fstat(\"%s\") failed: %m", p);
                if (st.st_size == 0)
                        return log_debug_errno(SYNTHETIC_ERRNO(ENOENT),
                                               "EFI variable %s is uncommitted", p);
                if (st.st_size < 4)
                        return log_debug_errno(SYNTHETIC_ERRNO(ENODATA), "EFI variable %s is shorter than 4 bytes, refusing.", p);
                if (st.st_size > 4*1024*1024 + 4)
                        return log_debug_errno(SYNTHETIC_ERRNO(E2BIG), "EFI variable %s is ridiculously large, refusing.", p);
-        if (ret_value || ret_attribute) {
+                if (!ret_attribute && !ret_value) {
-                /* The kernel ratelimits reads from the efivarfs because EFI is inefficient, and we'll
+                        /* No need to read anything, return the reported size. */
-                 * occasionally fail with EINTR here. A slowdown is better than a failure for us, so
+                        n = st.st_size;
-                 * retry a few times and eventually fail with -EBUSY.
+                        break;
-                 *
+                }
-                 * See https://github.com/torvalds/linux/blob/master/fs/efivarfs/file.c#L75
+
-                 * and
+                /* We want +1 for the read call, and +3 for the additional terminating bytes added below. */
-                 * https://github.com/torvalds/linux/commit/bef3efbeb897b56867e271cdbc5f8adaacaeb9cd.
+                char *t = realloc(buf, (size_t) st.st_size + MAX(1, 3));
-                 */
+                if (!t)
-                for (unsigned try = 0;; try++) {
+                        return -ENOMEM;
-                        n = read(fd, &a, sizeof(a));
+                buf = t;
                const struct iovec iov[] = {
                        { &attr, sizeof(attr) },
                        { buf, (size_t) st.st_size + 1 },
                };
                n = readv(fd, iov, 2);
                assert(n <= st.st_size + 1);
                if (n == st.st_size + 1)
                        /* We need to try again with a bigger buffer. */
                        continue;
                if (n >= 0)
                        break;
                log_debug_errno(errno, "Reading from \"%s\" failed: %m", p);
                if (errno != EINTR)
                        return -errno;
                if (try >= EFI_N_RETRIES_TOTAL)
                        return -EBUSY;
                if (try >= EFI_N_RETRIES_NO_DELAY)
                        (void) usleep_safe(EFI_RETRY_DELAY);
        }
-                /* Unfortunately kernel reports EOF if there's an inconsistency between efivarfs var list
+        /* Unfortunately kernel reports EOF if there's an inconsistency between efivarfs var list and
-                 * and what's actually stored in firmware, c.f. #34304. A zero size env var is not allowed in
+         * what's actually stored in firmware, c.f. #34304. A zero size env var is not allowed in EFI
-                 * efi and hence the variable doesn't really exist in the backing store as long as it is zero
+         * and hence the variable doesn't really exist in the backing store as long as it is zero
-                 * sized, and the kernel calls this "uncommitted". Hence we translate EOF back to ENOENT here,
+         * sized, and the kernel calls this "uncommitted". Hence we translate EOF back to ENOENT
-                 * as with kernel behavior before
+         * here, as with kernel behavior before
-                 * https://github.com/torvalds/linux/commit/3fab70c165795431f00ddf9be8b84ddd07bd1f8f
+         * https://github.com/torvalds/linux/commit/3fab70c165795431f00ddf9be8b84ddd07bd1f8f.
         *
-                 * If the kernel changes behaviour (to flush dentries on resume), we can drop
+         * If the kernel changes behaviour (to flush dentries on resume), we can drop this at some
-                 * this at some point in the future. But note that the commit is 11
+         * point in the future. But note that the commit is 11 years old at this point so we'll need
-                 * years old at this point so we'll need to deal with the current behaviour for
+         * to deal with the current behaviour for a long time.
                 * a long time.
         */
        if (n == 0)
                return log_debug_errno(SYNTHETIC_ERRNO(ENOENT),
                                       "EFI variable %s is uncommitted", p);
-
+        if (n < 4)
                if (n != sizeof(a))
                return log_debug_errno(SYNTHETIC_ERRNO(EIO),
-                                               "Read %zi bytes from EFI variable %s, expected %zu.",  n, p, sizeof(a));
+                                       "Read %zi bytes from EFI variable %s, expected >= 4", n, p);
        }
        if (ret_attribute)
                *ret_attribute = attr;
        if (ret_value) {
-                buf = malloc(st.st_size - 4 + 3);
+                assert(buf);
-                if (!buf)
+                /* Always NUL-terminate (3 bytes, to properly protect UTF-16, even if truncated in
-                        return -ENOMEM;
+                 * the middle of a character) */
-
+                buf[n - 4] = 0;
-                n = read(fd, buf, (size_t) st.st_size - 4);
+                buf[n - 4 + 1] = 0;
-                if (n < 0)
+                buf[n - 4 + 2] = 0;
-                        return log_debug_errno(errno, "Failed to read value of EFI variable %s: %m", p);
+                *ret_value = TAKE_PTR(buf);
-                assert(n <= st.st_size - 4);
+        }
                /* Always NUL-terminate (3 bytes, to properly protect UTF-16, even if truncated in the middle
                 * of a character) */
                ((char*) buf)[n] = 0;
                ((char*) buf)[n + 1] = 0;
                ((char*) buf)[n + 2] = 0;
        } else
                /* Assume that the reported size is accurate */
                n = st.st_size - 4;
        if (DEBUG_LOGGING) {
                usec_t end = now(CLOCK_MONOTONIC);
@ -146,14 +163,8 @@ int efi_get_variable(
        /* Note that efivarfs interestingly doesn't require ftruncate() to update an existing EFI variable
         * with a smaller value. */
        if (ret_attribute)
                *ret_attribute = a;
        if (ret_value)
                *ret_value = TAKE_PTR(buf);
        if (ret_size)
-                *ret_size = n;
+                *ret_size = n - 4;
        return 0;
 }
--- a/src/basic/fd-util.c
+++ b/src/basic/fd-util.c
@ -1058,10 +1058,9 @@ int fd_get_diskseq(int fd, uint64_t *ret) {
 }
 int path_is_root_at(int dir_fd, const char *path) {
        _cleanup_close_ int fd = -EBADF, pfd = -EBADF;
        assert(dir_fd >= 0 || dir_fd == AT_FDCWD);
        _cleanup_close_ int fd = -EBADF;
        if (!isempty(path)) {
                fd = openat(dir_fd, path, O_PATH|O_DIRECTORY|O_CLOEXEC);
                if (fd < 0)
@ -1070,19 +1069,19 @@ int path_is_root_at(int dir_fd, const char *path) {
                dir_fd = fd;
        }
-        pfd = openat(dir_fd, "..", O_PATH|O_DIRECTORY|O_CLOEXEC);
+        _cleanup_close_ int root_fd = openat(AT_FDCWD, "/", O_PATH|O_DIRECTORY|O_CLOEXEC);
-        if (pfd < 0)
+        if (root_fd < 0)
-                return errno == ENOTDIR ? false : -errno;
+                return -errno;
-        /* Even if the parent directory has the same inode, the fd may not point to the root directory "/",
+        /* Even if the root directory has the same inode as our fd, the fd may not point to the root
-         * and we also need to check that the mount ids are the same. Otherwise, a construct like the
+         * directory "/", and we also need to check that the mount ids are the same. Otherwise, a construct
-         * following could be used to trick us:
+         * like the following could be used to trick us:
         *
-         * $ mkdir /tmp/x /tmp/x/y
+         * $ mkdir /tmp/x
-         * $ mount --bind /tmp/x /tmp/x/y
+         * $ mount --bind / /tmp/x
         */
-        return fds_are_same_mount(dir_fd, pfd);
+        return fds_are_same_mount(dir_fd, root_fd);
 }
 int fds_are_same_mount(int fd1, int fd2) {
--- a/src/basic/fs-util.c
+++ b/src/basic/fs-util.c
@ -293,15 +293,20 @@ int fchmod_opath(int fd, mode_t m) {
         * - fchmod(2) only operates on open files (i. e., fds with an open file description);
         * - fchmodat(2) does not have a flag arg like fchownat(2) does, so no way to pass AT_EMPTY_PATH;
         *   + it should not be confused with the libc fchmodat(3) interface, which adds 4th flag argument,
-         *     but does not support AT_EMPTY_PATH (only supports AT_SYMLINK_NOFOLLOW);
+         *     and supports AT_EMPTY_PATH since v2.39 (previously only supported AT_SYMLINK_NOFOLLOW). So if
         *     the kernel has fchmodat2(2), since v2.39 glibc will call into it directly. If the kernel
         *     doesn't, or glibc is older than v2.39, glibc's internal fallback will return EINVAL if
         *     AT_EMPTY_PATH is passed.
         * - fchmodat2(2) supports all the AT_* flags, but is still very recent.
         *
-         * We try to use fchmodat2(), and, if it is not supported, resort
+         * We try to use fchmodat(3) first, and on EINVAL fall back to fchmodat2(), and, if that is also not
-         * to the /proc/self/fd dance. */
+         * supported, resort to the /proc/self/fd dance. */
        assert(fd >= 0);
-        if (fchmodat2(fd, "", m, AT_EMPTY_PATH) >= 0)
+        if (fchmodat(fd, "", m, AT_EMPTY_PATH) >= 0)
                return 0;
        if (errno == EINVAL && fchmodat2(fd, "", m, AT_EMPTY_PATH) >= 0) /* glibc too old? */
                return 0;
        if (!IN_SET(errno, ENOSYS, EPERM)) /* Some container managers block unknown syscalls with EPERM */
                return -errno;
--- a/src/basic/syscall-list.txt
+++ b/src/basic/syscall-list.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind
 bpf
 breakpoint
 brk
 cachectl
 cacheflush
@ -113,6 +114,7 @@ futimesat
 get_mempolicy
 get_robust_list
 get_thread_area
 get_tls
 getcpu
 getcwd
 getdents
@ -403,6 +405,7 @@ set_mempolicy_home_node
 set_robust_list
 set_thread_area
 set_tid_address
 set_tls
 setdomainname
 setfsgid
 setfsgid32
@ -511,6 +514,8 @@ unlinkat
 unshare
 uretprobe
 userfaultfd
 usr26
 usr32
 ustat
 utime
 utimensat
--- a/src/basic/syscalls-arm.txt
+++ b/src/basic/syscalls-arm.txt
@ -16,9 +16,10 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	282
 bpf	386
 breakpoint	983041
 brk	45
 cachectl
-cacheflush
+cacheflush	983042
 cachestat	451
 capget	184
 capset	185
@ -113,6 +114,7 @@ futimesat	326
 get_mempolicy	320
 get_robust_list	339
 get_thread_area
 get_tls	983046
 getcpu	345
 getcwd	183
 getdents	141
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	338
 set_thread_area
 set_tid_address	256
 set_tls	983045
 setdomainname	121
 setfsgid	139
 setfsgid32	216
@ -511,6 +514,8 @@ unlinkat	328
 unshare	337
 uretprobe
 userfaultfd	388
 usr26	983043
 usr32	983044
 ustat	62
 utime
 utimensat	348
--- a/src/basic/syscalls-arm64.txt
+++ b/src/basic/syscalls-arm64.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	200
 bpf	280
 breakpoint
 brk	214
 cachectl
 cacheflush
@ -113,6 +114,7 @@ futimesat
 get_mempolicy	236
 get_robust_list	100
 get_thread_area
 get_tls
 getcpu	168
 getcwd	17
 getdents
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	99
 set_thread_area
 set_tid_address	96
 set_tls
 setdomainname	162
 setfsgid	152
 setfsgid32
@ -511,6 +514,8 @@ unlinkat	35
 unshare	97
 uretprobe
 userfaultfd	282
 usr26
 usr32
 ustat
 utime
 utimensat	88
--- a/src/basic/syscalls-i386.txt
+++ b/src/basic/syscalls-i386.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	361
 bpf	357
 breakpoint
 brk	45
 cachectl
 cacheflush
@ -113,6 +114,7 @@ futimesat	299
 get_mempolicy	275
 get_robust_list	312
 get_thread_area	244
 get_tls
 getcpu	318
 getcwd	183
 getdents	141
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	311
 set_thread_area	243
 set_tid_address	258
 set_tls
 setdomainname	121
 setfsgid	139
 setfsgid32	216
@ -511,6 +514,8 @@ unlinkat	301
 unshare	310
 uretprobe
 userfaultfd	374
 usr26
 usr32
 ustat	62
 utime	30
 utimensat	320
--- a/src/basic/syscalls-loongarch64.txt
+++ b/src/basic/syscalls-loongarch64.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	200
 bpf	280
 breakpoint
 brk	214
 cachectl
 cacheflush
@ -113,6 +114,7 @@ futimesat
 get_mempolicy	236
 get_robust_list	100
 get_thread_area
 get_tls
 getcpu	168
 getcwd	17
 getdents
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	99
 set_thread_area
 set_tid_address	96
 set_tls
 setdomainname	162
 setfsgid	152
 setfsgid32
@ -511,6 +514,8 @@ unlinkat	35
 unshare	97
 uretprobe
 userfaultfd	282
 usr26
 usr32
 ustat
 utime
 utimensat	88
--- a/src/basic/syscalls-m68k.txt
+++ b/src/basic/syscalls-m68k.txt
@ -16,6 +16,7 @@ atomic_barrier	336
 atomic_cmpxchg_32	335
 bind	358
 bpf	354
 breakpoint
 brk	45
 cachectl
 cacheflush	123
@ -113,6 +114,7 @@ futimesat	292
 get_mempolicy	269
 get_robust_list	305
 get_thread_area	333
 get_tls
 getcpu	314
 getcwd	183
 getdents	141
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	304
 set_thread_area	334
 set_tid_address	253
 set_tls
 setdomainname	121
 setfsgid	139
 setfsgid32	216
@ -511,6 +514,8 @@ unlinkat	294
 unshare	303
 uretprobe
 userfaultfd	373
 usr26
 usr32
 ustat	62
 utime	30
 utimensat	316
--- a/src/basic/syscalls-mips64.txt
+++ b/src/basic/syscalls-mips64.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	5048
 bpf	5315
 breakpoint
 brk	5012
 cachectl	5198
 cacheflush	5197
@ -113,6 +114,7 @@ futimesat	5251
 get_mempolicy	5228
 get_robust_list	5269
 get_thread_area
 get_tls
 getcpu	5271
 getcwd	5077
 getdents	5076
@ -403,6 +405,7 @@ set_mempolicy_home_node	5450
 set_robust_list	5268
 set_thread_area	5242
 set_tid_address	5212
 set_tls
 setdomainname	5166
 setfsgid	5121
 setfsgid32
@ -511,6 +514,8 @@ unlinkat	5253
 unshare	5262
 uretprobe
 userfaultfd	5317
 usr26
 usr32
 ustat	5133
 utime	5130
 utimensat	5275
--- a/src/basic/syscalls-mips64n32.txt
+++ b/src/basic/syscalls-mips64n32.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	6048
 bpf	6319
 breakpoint
 brk	6012
 cachectl	6198
 cacheflush	6197
@ -113,6 +114,7 @@ futimesat	6255
 get_mempolicy	6232
 get_robust_list	6273
 get_thread_area
 get_tls
 getcpu	6275
 getcwd	6077
 getdents	6076
@ -403,6 +405,7 @@ set_mempolicy_home_node	6450
 set_robust_list	6272
 set_thread_area	6246
 set_tid_address	6213
 set_tls
 setdomainname	6166
 setfsgid	6121
 setfsgid32
@ -511,6 +514,8 @@ unlinkat	6257
 unshare	6266
 uretprobe
 userfaultfd	6321
 usr26
 usr32
 ustat	6133
 utime	6130
 utimensat	6279
--- a/src/basic/syscalls-mipso32.txt
+++ b/src/basic/syscalls-mipso32.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	4169
 bpf	4355
 breakpoint
 brk	4045
 cachectl	4148
 cacheflush	4147
@ -113,6 +114,7 @@ futimesat	4292
 get_mempolicy	4269
 get_robust_list	4310
 get_thread_area
 get_tls
 getcpu	4312
 getcwd	4203
 getdents	4141
@ -403,6 +405,7 @@ set_mempolicy_home_node	4450
 set_robust_list	4309
 set_thread_area	4283
 set_tid_address	4252
 set_tls
 setdomainname	4121
 setfsgid	4139
 setfsgid32
@ -511,6 +514,8 @@ unlinkat	4294
 unshare	4303
 uretprobe
 userfaultfd	4357
 usr26
 usr32
 ustat	4062
 utime	4030
 utimensat	4316
--- a/src/basic/syscalls-parisc.txt
+++ b/src/basic/syscalls-parisc.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	22
 bpf	341
 breakpoint
 brk	45
 cachectl
 cacheflush	356
@ -113,6 +114,7 @@ futimesat	279
 get_mempolicy	261
 get_robust_list	290
 get_thread_area
 get_tls
 getcpu	296
 getcwd	110
 getdents	141
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	289
 set_thread_area
 set_tid_address	237
 set_tls
 setdomainname	121
 setfsgid	139
 setfsgid32
@ -511,6 +514,8 @@ unlinkat	281
 unshare	288
 uretprobe
 userfaultfd	344
 usr26
 usr32
 ustat	62
 utime	30
 utimensat	301
--- a/src/basic/syscalls-powerpc.txt
+++ b/src/basic/syscalls-powerpc.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	327
 bpf	361
 breakpoint
 brk	45
 cachectl
 cacheflush
@ -113,6 +114,7 @@ futimesat	290
 get_mempolicy	260
 get_robust_list	299
 get_thread_area
 get_tls
 getcpu	302
 getcwd	182
 getdents	141
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	300
 set_thread_area
 set_tid_address	232
 set_tls
 setdomainname	121
 setfsgid	139
 setfsgid32
@ -511,6 +514,8 @@ unlinkat	292
 unshare	282
 uretprobe
 userfaultfd	364
 usr26
 usr32
 ustat	62
 utime	30
 utimensat	304
--- a/src/basic/syscalls-powerpc64.txt
+++ b/src/basic/syscalls-powerpc64.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	327
 bpf	361
 breakpoint
 brk	45
 cachectl
 cacheflush
@ -113,6 +114,7 @@ futimesat	290
 get_mempolicy	260
 get_robust_list	299
 get_thread_area
 get_tls
 getcpu	302
 getcwd	182
 getdents	141
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	300
 set_thread_area
 set_tid_address	232
 set_tls
 setdomainname	121
 setfsgid	139
 setfsgid32
@ -511,6 +514,8 @@ unlinkat	292
 unshare	282
 uretprobe
 userfaultfd	364
 usr26
 usr32
 ustat	62
 utime	30
 utimensat	304
--- a/src/basic/syscalls-riscv32.txt
+++ b/src/basic/syscalls-riscv32.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	200
 bpf	280
 breakpoint
 brk	214
 cachectl
 cacheflush
@ -113,6 +114,7 @@ futimesat
 get_mempolicy	236
 get_robust_list	100
 get_thread_area
 get_tls
 getcpu	168
 getcwd	17
 getdents
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	99
 set_thread_area
 set_tid_address	96
 set_tls
 setdomainname	162
 setfsgid	152
 setfsgid32
@ -511,6 +514,8 @@ unlinkat	35
 unshare	97
 uretprobe
 userfaultfd	282
 usr26
 usr32
 ustat
 utime
 utimensat
--- a/src/basic/syscalls-riscv64.txt
+++ b/src/basic/syscalls-riscv64.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	200
 bpf	280
 breakpoint
 brk	214
 cachectl
 cacheflush
@ -113,6 +114,7 @@ futimesat
 get_mempolicy	236
 get_robust_list	100
 get_thread_area
 get_tls
 getcpu	168
 getcwd	17
 getdents
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	99
 set_thread_area
 set_tid_address	96
 set_tls
 setdomainname	162
 setfsgid	152
 setfsgid32
@ -511,6 +514,8 @@ unlinkat	35
 unshare	97
 uretprobe
 userfaultfd	282
 usr26
 usr32
 ustat
 utime
 utimensat	88
--- a/src/basic/syscalls-s390.txt
+++ b/src/basic/syscalls-s390.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	361
 bpf	351
 breakpoint
 brk	45
 cachectl
 cacheflush
@ -113,6 +114,7 @@ futimesat	292
 get_mempolicy	269
 get_robust_list	305
 get_thread_area
 get_tls
 getcpu	311
 getcwd	183
 getdents	141
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	304
 set_thread_area
 set_tid_address	252
 set_tls
 setdomainname	121
 setfsgid	139
 setfsgid32	216
@ -511,6 +514,8 @@ unlinkat	294
 unshare	303
 uretprobe
 userfaultfd	355
 usr26
 usr32
 ustat	62
 utime	30
 utimensat	315
--- a/src/basic/syscalls-s390x.txt
+++ b/src/basic/syscalls-s390x.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	361
 bpf	351
 breakpoint
 brk	45
 cachectl
 cacheflush
@ -113,6 +114,7 @@ futimesat	292
 get_mempolicy	269
 get_robust_list	305
 get_thread_area
 get_tls
 getcpu	311
 getcwd	183
 getdents	141
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	304
 set_thread_area
 set_tid_address	252
 set_tls
 setdomainname	121
 setfsgid	216
 setfsgid32
@ -511,6 +514,8 @@ unlinkat	294
 unshare	303
 uretprobe
 userfaultfd	355
 usr26
 usr32
 ustat	62
 utime	30
 utimensat	315
--- a/src/basic/syscalls-sh.txt
+++ b/src/basic/syscalls-sh.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	341
 bpf	375
 breakpoint
 brk	45
 cachectl
 cacheflush	123
@ -113,6 +114,7 @@ futimesat	299
 get_mempolicy	275
 get_robust_list	312
 get_thread_area
 get_tls
 getcpu	318
 getcwd	183
 getdents	141
@ -404,6 +406,7 @@ set_mempolicy_home_node	450
 set_robust_list	311
 set_thread_area
 set_tid_address	258
 set_tls
 setdomainname	121
 setfsgid	139
 setfsgid32	216
@ -512,6 +515,8 @@ unlinkat	301
 unshare	310
 uretprobe
 userfaultfd	377
 usr26
 usr32
 ustat	62
 utime	30
 utimensat	320
--- a/src/basic/syscalls-sparc.txt
+++ b/src/basic/syscalls-sparc.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	353
 bpf	349
 breakpoint
 brk	17
 cachectl
 cacheflush
@ -113,6 +114,7 @@ futimesat	288
 get_mempolicy	304
 get_robust_list	301
 get_thread_area
 get_tls
 getcpu	308
 getcwd	119
 getdents	174
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	300
 set_thread_area
 set_tid_address	166
 set_tls
 setdomainname	163
 setfsgid	229
 setfsgid32	94
@ -511,6 +514,8 @@ unlinkat	290
 unshare	299
 uretprobe
 userfaultfd	352
 usr26
 usr32
 ustat	168
 utime	30
 utimensat	310
--- a/src/basic/syscalls-x86_64.txt
+++ b/src/basic/syscalls-x86_64.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	49
 bpf	321
 breakpoint
 brk	12
 cachectl
 cacheflush
@ -113,6 +114,7 @@ futimesat	261
 get_mempolicy	239
 get_robust_list	274
 get_thread_area	211
 get_tls
 getcpu	309
 getcwd	79
 getdents	78
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	273
 set_thread_area	205
 set_tid_address	218
 set_tls
 setdomainname	171
 setfsgid	123
 setfsgid32
@ -511,6 +514,8 @@ unlinkat	263
 unshare	272
 uretprobe	335
 userfaultfd	323
 usr26
 usr32
 ustat	136
 utime	132
 utimensat	280
--- a/src/boot/boot.c
+++ b/src/boot/boot.c
@ -1359,6 +1359,10 @@ static void boot_entry_parse_tries(
        if (!strcaseeq16(counter, suffix))
                return;
        entry->id = xasprintf("%.*ls%ls",
                        (int) prefix_len - 1,
                        file,
                        suffix);
        entry->tries_left = tries_left;
        entry->tries_done = tries_done;
        entry->path = xstrdup16(path);
@ -1531,6 +1535,8 @@ static void boot_entry_add_type1(
                return;
        entry->device = device;
        if (!entry->id)
                entry->id = xstrdup16(file);
        strtolower16(entry->id);
--- a/src/fundamental/macro-fundamental.h
+++ b/src/fundamental/macro-fundamental.h
@ -151,15 +151,15 @@
 #define UNIQ_T(x, uniq) CONCATENATE(__unique_prefix_, CONCATENATE(x, uniq))
 #define UNIQ __COUNTER__
-/* Note that this works differently from pthread_once(): this macro does
+/* The macro is true when the code block is called first time, and is false for the second and later times.
- * not synchronize code execution, i.e. code that is run conditionalized
+ * Note that this works differently from pthread_once(): this macro does not synchronize code execution, i.e.
- * on this macro will run concurrently to all other code conditionalized
+ * code that is run conditionalized on this macro will run concurrently to all other code conditionalized the
- * the same way, there's no ordering or completion enforced. */
+ * same way, there's no ordering or completion enforced. */
 #define ONCE __ONCE(UNIQ_T(_once_, UNIQ))
 #define __ONCE(o)                                                       \
        ({                                                              \
                static bool (o) = false;                                \
-                __atomic_exchange_n(&(o), true, __ATOMIC_SEQ_CST); \
+                !__atomic_exchange_n(&(o), true, __ATOMIC_SEQ_CST);     \
        })
 #define U64_KB UINT64_C(1024)
--- a/src/import/pull-job.c
+++ b/src/import/pull-job.c
@ -134,17 +134,37 @@ void pull_job_curl_on_finished(CurlGlue *g, CURL *curl, CURLcode result) {
        if (!j || IN_SET(j->state, PULL_JOB_DONE, PULL_JOB_FAILED))
                return;
        if (result != CURLE_OK) {
                r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Transfer failed: %s", curl_easy_strerror(result));
                goto finish;
        }
        code = curl_easy_getinfo(curl, CURLINFO_SCHEME, &scheme);
        if (code != CURLE_OK || !scheme) {
                r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to retrieve URL scheme.");
                goto finish;
        }
        if (strcaseeq(scheme, "FILE") && result == CURLE_FILE_COULDNT_READ_FILE && j->on_not_found) {
                _cleanup_free_ char *new_url = NULL;
                /* This resource wasn't found, but the implementor wants to maybe let us know a new URL, query for it. */
                r = j->on_not_found(j, &new_url);
                if (r < 0)
                        goto finish;
                if (r > 0) { /* A new url to use */
                        assert(new_url);
                        r = pull_job_restart(j, new_url);
                        if (r < 0)
                                goto finish;
                        return;
                }
                /* if this didn't work, handle like any other error below */
        }
        if (result != CURLE_OK) {
                r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Transfer failed: %s", curl_easy_strerror(result));
                goto finish;
        }
        if (STRCASE_IN_SET(scheme, "HTTP", "HTTPS")) {
                long status;
@ -773,7 +793,7 @@ int pull_job_begin(PullJob *j) {
        if (curl_easy_setopt(j->curl, CURLOPT_XFERINFODATA, j) != CURLE_OK)
                return -EIO;
-        if (curl_easy_setopt(j->curl, CURLOPT_NOPROGRESS, 0) != CURLE_OK)
+        if (curl_easy_setopt(j->curl, CURLOPT_NOPROGRESS, 0L) != CURLE_OK)
                return -EIO;
        r = curl_glue_add(j->glue, j->curl);
--- a/src/journal-remote/journal-upload.c
+++ b/src/journal-remote/journal-upload.c
@ -261,7 +261,7 @@ int start_upload(Uploader *u,
                }
                if (STRPTR_IN_SET(arg_trust, "-", "all"))
-                        easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0,
+                        easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L,
                                    LOG_ERR, return -EUCLEAN);
                else if (arg_trust || startswith(u->url, "https://"))
                        easy_setopt(curl, CURLOPT_CAINFO, arg_trust ?: TRUST_FILE,
--- a/src/libsystemd/sd-device/sd-device.c
+++ b/src/libsystemd/sd-device/sd-device.c
@ -153,8 +153,8 @@ int device_set_syspath(sd_device *device, const char *_syspath, bool verify) {
                r = chase(_syspath, NULL, 0, &syspath, &fd);
                if (r == -ENOENT)
                         /* the device does not exist (any more?) */
-                        return log_debug_errno(SYNTHETIC_ERRNO(ENODEV),
+                        return log_trace_errno(SYNTHETIC_ERRNO(ENODEV),
-                                               "sd-device: Failed to chase symlinks in \"%s\".", _syspath);
+                                               "sd-device: Device \"%s\" not found.", _syspath);
                if (r < 0)
                        return log_debug_errno(r, "sd-device: Failed to get target of '%s': %m", _syspath);
--- a/src/libsystemd/sd-varlink/varlink-org.varlink.service.c
+++ b/src/libsystemd/sd-varlink/varlink-org.varlink.service.c
@ -4,31 +4,42 @@
 static SD_VARLINK_DEFINE_METHOD(
                GetInfo,
                SD_VARLINK_FIELD_COMMENT("String identifying the vendor of this service"),
                SD_VARLINK_DEFINE_OUTPUT(vendor, SD_VARLINK_STRING, 0),
                SD_VARLINK_FIELD_COMMENT("String identifying the product implementing this service"),
                SD_VARLINK_DEFINE_OUTPUT(product, SD_VARLINK_STRING, 0),
                SD_VARLINK_FIELD_COMMENT("Version string of this product"),
                SD_VARLINK_DEFINE_OUTPUT(version, SD_VARLINK_STRING, 0),
                SD_VARLINK_FIELD_COMMENT("Web URL pointing to additional information about this service"),
                SD_VARLINK_DEFINE_OUTPUT(url, SD_VARLINK_STRING, 0),
                SD_VARLINK_FIELD_COMMENT("List of interfaces implemented by this service"),
                SD_VARLINK_DEFINE_OUTPUT(interfaces, SD_VARLINK_STRING, SD_VARLINK_ARRAY));
 static SD_VARLINK_DEFINE_METHOD(
                GetInterfaceDescription,
                SD_VARLINK_FIELD_COMMENT("Name of interface to query interface description of"),
                SD_VARLINK_DEFINE_INPUT(interface, SD_VARLINK_STRING, 0),
                SD_VARLINK_FIELD_COMMENT("Interface description in Varlink IDL format"),
                SD_VARLINK_DEFINE_OUTPUT(description, SD_VARLINK_STRING, 0));
 static SD_VARLINK_DEFINE_ERROR(
                InterfaceNotFound,
                SD_VARLINK_FIELD_COMMENT("Name of interface that was called but does not exist"),
                SD_VARLINK_DEFINE_FIELD(interface, SD_VARLINK_STRING, 0));
 static SD_VARLINK_DEFINE_ERROR(
                MethodNotFound,
                SD_VARLINK_FIELD_COMMENT("Name of method that was called but does not exist"),
                SD_VARLINK_DEFINE_FIELD(method, SD_VARLINK_STRING, 0));
 static SD_VARLINK_DEFINE_ERROR(
                MethodNotImplemented,
                SD_VARLINK_FIELD_COMMENT("Name of method that was called but is not implemented."),
                SD_VARLINK_DEFINE_FIELD(method, SD_VARLINK_STRING, 0));
 static SD_VARLINK_DEFINE_ERROR(
                InvalidParameter,
                SD_VARLINK_FIELD_COMMENT("Name of the invalid parameter"),
                SD_VARLINK_DEFINE_FIELD(parameter, SD_VARLINK_STRING, 0));
 static SD_VARLINK_DEFINE_ERROR(PermissionDenied);
@ -39,11 +50,20 @@ static SD_VARLINK_DEFINE_ERROR(ExpectedMore);
 SD_VARLINK_DEFINE_INTERFACE(
                org_varlink_service,
                "org.varlink.service",
                SD_VARLINK_INTERFACE_COMMENT("General Varlink service interface"),
                SD_VARLINK_SYMBOL_COMMENT("Get service meta information"),
                &vl_method_GetInfo,
                SD_VARLINK_SYMBOL_COMMENT("Get description of an implemented interface in Varlink IDL format"),
                &vl_method_GetInterfaceDescription,
                SD_VARLINK_SYMBOL_COMMENT("Error returned if a method is called on an unknown interface"),
                &vl_error_InterfaceNotFound,
                SD_VARLINK_SYMBOL_COMMENT("Error returned if an unknown method is called on an known interface"),
                &vl_error_MethodNotFound,
                SD_VARLINK_SYMBOL_COMMENT("Error returned if an method is called that is known but not implemented"),
                &vl_error_MethodNotImplemented,
                SD_VARLINK_SYMBOL_COMMENT("Error returned if a method is called with an invalid parameter"),
                &vl_error_InvalidParameter,
                SD_VARLINK_SYMBOL_COMMENT("General permission error"),
                &vl_error_PermissionDenied,
                SD_VARLINK_SYMBOL_COMMENT("A method was called with the 'more' flag off, but it may only be called with the flag turned on"),
                &vl_error_ExpectedMore);
--- a/src/network/generator/network-generator.c
+++ b/src/network/generator/network-generator.c
@ -21,7 +21,7 @@
  ip={dhcp|on|any|dhcp6|auto6|either6|link6|link-local}
  ip=<interface>:{dhcp|on|any|dhcp6|auto6|link6|link-local}[:[<mtu>][:<macaddr>]]
  ip=<client-IP>:[<peer>]:<gateway-IP>:<netmask>:<client_hostname>:<interface>:{none|off|dhcp|on|any|dhcp6|auto6|link6|ibft|link-local}[:[<mtu>][:<macaddr>]]
-  ip=<client-IP>:[<peer>]:<gateway-IP>:<netmask>:<client_hostname>:<interface>:{none|off|dhcp|on|any|dhcp6|auto6|link6|ibft|link-local}[:[<dns1>][:<dns2>]]
+  ip=<client-IP>:[<peer>]:<gateway-IP>:<netmask>:<client_hostname>:<interface>:{none|off|dhcp|on|any|dhcp6|auto6|link6|ibft|link-local}[:[<dns1>][:[<dns2>][:[<ntp>]]]]
  rd.route=<net>/<netmask>:<gateway>[:<interface>]
  nameserver=<IP> [nameserver=<IP> ...]
  rd.peerdns=0
@ -197,6 +197,7 @@ static Network* network_free(Network *network) {
        strv_free(network->vlan);
        free(network->bridge);
        free(network->bond);
        free(network->ntp);
        while ((address = network->addresses))
                address_free(address);
@ -635,6 +636,27 @@ static int network_set_bond(Context *context, const char *ifname, const char *va
        return free_and_strdup(&network->bond, value);
 }
 static int network_set_ntp(Context *context, const char *ifname, const char *value) {
        Network *network;
        int r;
        assert(context);
        assert(ifname);
        if (isempty(value))
                return 0;
        r = in_addr_from_string_auto(value, NULL, NULL);
        if (r < 0)
                return log_debug_errno(r, "Invalid NTP address '%s' for '%s'", value, ifname);
        r = network_acquire(context, ifname, &network);
        if (r < 0)
                return log_debug_errno(r, "Failed to acquire network for '%s': %m", ifname);
        return free_and_strdup(&network->ntp, value);
 }
 static int parse_cmdline_ip_mtu_mac(Context *context, const char *ifname, const char *value) {
        _cleanup_free_ char *mtu = NULL;
        int r;
@ -850,6 +872,18 @@ static int parse_cmdline_ip_address(Context *context, int family, const char *va
        if (r < 0)
                return r;
        /* Next, try [:<ntp>] */
        _cleanup_free_ char *ntp = NULL;
        r = extract_ip_address_str(AF_UNSPEC, &p, &ntp);
        if (r < 0)
                return log_debug_errno(r, "Failed to parse NTP address in ip=%s: %m", value);
        if (r == 0)
                return 0;
        r = network_set_ntp(context, ifname, ntp);
        if (r < 0)
                return r;
        /* refuse unexpected trailing strings */
        if (!isempty(p))
                return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Unexpected trailing string in 'ip=%s'.", value);
@ -1358,6 +1392,9 @@ void network_dump(Network *network, FILE *f) {
        if (network->bond)
                fprintf(f, "Bond=%s\n", network->bond);
        if (network->ntp)
                fprintf(f, "NTP=%s\n", network->ntp);
        fputs("\n[DHCP]\n", f);
        if (!isempty(network->hostname))
--- a/src/network/generator/network-generator.h
+++ b/src/network/generator/network-generator.h
@ -65,6 +65,7 @@ struct Network {
        char **vlan;
        char *bridge;
        char *bond;
        char *ntp;
        /* [DHCP] */
        char *hostname;
--- a/src/network/generator/test-network-generator.c
+++ b/src/network/generator/test-network-generator.c
@ -215,6 +215,51 @@ int main(int argc, char *argv[]) {
                         "Gateway=192.168.0.1\n"
                         );
        test_network_one("eth0", "ip", "192.168.0.10::192.168.0.1:255.255.255.0::eth0:on:10.10.10.10:10.10.10.11:10.10.10.161",
                         "[Match]\n"
                         "Name=eth0\n"
                         "\n[Link]\n"
                         "\n[Network]\n"
                         "DHCP=yes\n"
                         "DNS=10.10.10.10\n"
                         "DNS=10.10.10.11\n"
                         "NTP=10.10.10.161\n"
                         "\n[DHCP]\n"
                         "\n[Address]\n"
                         "Address=192.168.0.10/24\n"
                         "\n[Route]\n"
                         "Gateway=192.168.0.1\n"
                         );
        test_network_one("eth0", "ip", "192.168.0.10::192.168.0.1:255.255.255.0::eth0:on:10.10.10.10::10.10.10.161",
                         "[Match]\n"
                         "Name=eth0\n"
                         "\n[Link]\n"
                         "\n[Network]\n"
                         "DHCP=yes\n"
                         "DNS=10.10.10.10\n"
                         "NTP=10.10.10.161\n"
                         "\n[DHCP]\n"
                         "\n[Address]\n"
                         "Address=192.168.0.10/24\n"
                         "\n[Route]\n"
                         "Gateway=192.168.0.1\n"
                         );
        test_network_one("eth0", "ip", "192.168.0.10::192.168.0.1:255.255.255.0::eth0:on:::10.10.10.161",
                         "[Match]\n"
                         "Name=eth0\n"
                         "\n[Link]\n"
                         "\n[Network]\n"
                         "DHCP=yes\n"
                         "NTP=10.10.10.161\n"
                         "\n[DHCP]\n"
                         "\n[Address]\n"
                         "Address=192.168.0.10/24\n"
                         "\n[Route]\n"
                         "Gateway=192.168.0.1\n"
                         );
        test_network_one("eth0", "ip", "[2001:1234:56:8f63::10]::[2001:1234:56:8f63::1]:64:hogehoge:eth0:on",
                         "[Match]\n"
                         "Name=eth0\n"
--- a/src/network/networkctl-list.c
+++ b/src/network/networkctl-list.c
@ -11,7 +11,6 @@
 #include "networkctl-util.h"
 int list_links(int argc, char *argv[], void *userdata) {
        _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
        _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
        _cleanup_(link_info_array_freep) LinkInfo *links = NULL;
        _cleanup_(table_unrefp) Table *table = NULL;
@ -22,10 +21,6 @@ int list_links(int argc, char *argv[], void *userdata) {
        if (r != 0)
                return r;
        r = acquire_bus(&bus);
        if (r < 0)
                return r;
        r = sd_netlink_open(&rtnl);
        if (r < 0)
                return log_error_errno(r, "Failed to connect to netlink: %m");
--- a/src/network/networkctl-status-link.c
+++ b/src/network/networkctl-status-link.c
@ -757,7 +757,7 @@ static int link_status_one(
                if (r < 0)
                        return table_log_add_error(r);
-                r = table_add_cell_stringf(table, NULL, "%sbps/%sbps",
+                r = table_add_cell_stringf(table, NULL, "%sBps/%sBps",
                                           FORMAT_BYTES_FULL(info->tx_bitrate, 0),
                                           FORMAT_BYTES_FULL(info->rx_bitrate, 0));
                if (r < 0)
--- a/src/network/networkd-json.c
+++ b/src/network/networkd-json.c
@ -440,14 +440,15 @@ static int network_append_json(Network *network, sd_json_variant **v) {
                        v,
                        SD_JSON_BUILD_PAIR_STRING("NetworkFile", network->filename),
                        SD_JSON_BUILD_PAIR_STRV("NetworkFileDropins", network->dropins),
-                        SD_JSON_BUILD_PAIR_BOOLEAN("RequiredForOnline", network->required_for_online),
+                        SD_JSON_BUILD_PAIR_BOOLEAN("RequiredForOnline", network->required_for_online > 0),
-                        SD_JSON_BUILD_PAIR("RequiredOperationalStateForOnline",
+                        SD_JSON_BUILD_PAIR_CONDITION(
-                                           SD_JSON_BUILD_ARRAY(SD_JSON_BUILD_STRING(link_operstate_to_string(network->required_operstate_for_online.min)),
+                                        operational_state_range_is_valid(&network->required_operstate_for_online),
                                        "RequiredOperationalStateForOnline",
                                        SD_JSON_BUILD_ARRAY(
                                                SD_JSON_BUILD_STRING(link_operstate_to_string(network->required_operstate_for_online.min)),
                                                SD_JSON_BUILD_STRING(link_operstate_to_string(network->required_operstate_for_online.max)))),
-                        SD_JSON_BUILD_PAIR_STRING("RequiredFamilyForOnline",
+                        SD_JSON_BUILD_PAIR_STRING("RequiredFamilyForOnline", link_required_address_family_to_string(network->required_family_for_online)),
-                                                  link_required_address_family_to_string(network->required_family_for_online)),
+                        SD_JSON_BUILD_PAIR_STRING("ActivationPolicy", activation_policy_to_string(network->activation_policy)));
                        SD_JSON_BUILD_PAIR_STRING("ActivationPolicy",
                                                  activation_policy_to_string(network->activation_policy)));
 }
 static int device_append_json(sd_device *device, sd_json_variant **v) {
--- a/src/repart/repart.c
+++ b/src/repart/repart.c
@ -179,6 +179,7 @@ static char *arg_copy_source = NULL;
 static char *arg_make_ddi = NULL;
 static char *arg_generate_fstab = NULL;
 static char *arg_generate_crypttab = NULL;
 static bool arg_relax_copy_block_security = false;
 STATIC_DESTRUCTOR_REGISTER(arg_node, freep);
 STATIC_DESTRUCTOR_REGISTER(arg_root, freep);
@ -8114,6 +8115,9 @@ static int parse_argv(int argc, char *argv[], X509 **ret_certificate, EVP_PKEY *
                        r = parse_path_argument(optarg, /* suppress_root= */ false, &arg_image);
                        if (r < 0)
                                return r;
                        arg_relax_copy_block_security = false;
                        break;
                case ARG_IMAGE_POLICY:
@ -8515,6 +8519,8 @@ static int parse_argv(int argc, char *argv[], X509 **ret_certificate, EVP_PKEY *
                        arg_root = strdup("/sysusr");
                if (!arg_root)
                        return log_oom();
                arg_relax_copy_block_security = true;
        }
        if (argc > optind) {
@ -9189,7 +9195,9 @@ static int run(int argc, char *argv[]) {
        r = context_open_copy_block_paths(
                        context,
                        loop_device ? loop_device->devno :         /* if --image= is specified, only allow partitions on the loopback device */
-                                      arg_root && !arg_image ? 0 : /* if --root= is specified, don't accept any block device */
+                                      /* if --root= is specified, don't accept any block device, unless it
                                       * was set automatically because we are in the initrd  */
                                      arg_root && !arg_image && !arg_relax_copy_block_security ? 0 :
                                      (dev_t) -1);                 /* if neither is specified, make no restrictions */
        if (r < 0)
                return r;
--- a/src/sysctl/sysctl.c
+++ b/src/sysctl/sysctl.c
@ -353,6 +353,7 @@ static int help(void) {
               "     --tldr             Show non-comment parts of configuration\n"
               "     --prefix=PATH      Only apply rules with the specified prefix\n"
               "     --no-pager         Do not pipe output into a pager\n"
               "     --strict           Fail on any kind of failures\n"
               "\nSee the %s for details.\n",
               program_invocation_short_name,
               link);
--- a/src/sysext/sysext.c
+++ b/src/sysext/sysext.c
@ -1771,10 +1771,7 @@ static int merge_subprocess(
                        if (r < 0)
                                return r;
-                        r = dissected_image_decrypt_interactively(
+                        r = dissected_image_decrypt(m, /* passphrase= */ NULL, &verity_settings, flags);
                                        m, NULL,
                                        &verity_settings,
                                        flags);
                        if (r < 0)
                                return r;
--- a/src/test/test-fd-util.c
+++ b/src/test/test-fd-util.c
@ -681,6 +681,134 @@ TEST(dir_fd_is_root) {
        assert_se(dir_fd_is_root_or_cwd(fd) == 0);
 }
 static void test_path_is_root_at_one(bool expected) {
        ASSERT_OK_POSITIVE(path_is_root("/"));
        ASSERT_OK_POSITIVE(path_is_root("/."));
        ASSERT_OK_EQ(path_is_root("/./.."), expected);
        ASSERT_OK_EQ(path_is_root("/.."), expected);
        ASSERT_OK_EQ(path_is_root("/../"), expected);
        ASSERT_OK_EQ(path_is_root("/../."), expected);
        ASSERT_OK_EQ(path_is_root("/../.."), expected);
        ASSERT_OK_ZERO(path_is_root("/usr"));
        ASSERT_OK_ZERO(path_is_root("/./usr"));
        ASSERT_OK_ZERO(path_is_root("/../usr"));
        ASSERT_OK_ZERO(path_is_root("/.././usr"));
        ASSERT_OK_ZERO(path_is_root("/../../usr"));
        _cleanup_close_ int fd = -EBADF;
        ASSERT_OK_ERRNO(fd = open("/", O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW));
        ASSERT_OK_POSITIVE(path_is_root_at(fd, NULL));
        ASSERT_OK_POSITIVE(path_is_root_at(fd, ""));
        ASSERT_OK_POSITIVE(path_is_root_at(fd, "."));
        ASSERT_OK_EQ(path_is_root_at(fd, "./../"), expected);
        ASSERT_OK_EQ(path_is_root_at(fd, "../"), expected);
        ASSERT_OK_POSITIVE(path_is_root_at(fd, "/"));
        ASSERT_OK_POSITIVE(path_is_root_at(fd, "/."));
        ASSERT_OK_EQ(path_is_root_at(fd, "/./.."), expected);
        ASSERT_OK_EQ(path_is_root_at(fd, "/.."), expected);
        ASSERT_OK_EQ(path_is_root_at(fd, "/../"), expected);
        ASSERT_OK_EQ(path_is_root_at(fd, "/../."), expected);
        ASSERT_OK_EQ(path_is_root_at(fd, "/../.."), expected);
        ASSERT_OK_ZERO(path_is_root_at(fd, "usr"));
        ASSERT_OK_ZERO(path_is_root_at(fd, "./usr"));
        ASSERT_OK_ZERO(path_is_root_at(fd, "../usr"));
        ASSERT_OK_ZERO(path_is_root_at(fd, "/usr"));
        ASSERT_OK_ZERO(path_is_root_at(fd, "/./usr"));
        ASSERT_OK_ZERO(path_is_root_at(fd, "/../usr"));
        ASSERT_OK_ZERO(path_is_root_at(fd, "/.././usr"));
        ASSERT_OK_ZERO(path_is_root_at(fd, "/../../usr"));
        safe_close(fd);
        ASSERT_OK_ERRNO(fd = open("/../", O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW));
        ASSERT_OK_EQ(path_is_root_at(fd, NULL), expected);
        ASSERT_OK_EQ(path_is_root_at(fd, ""), expected);
        ASSERT_OK_EQ(path_is_root_at(fd, "."), expected);
        ASSERT_OK_EQ(path_is_root_at(fd, "./.."), expected);
        ASSERT_OK_EQ(path_is_root_at(fd, "../"), expected);
        ASSERT_OK_POSITIVE(path_is_root_at(fd, "/"));
        ASSERT_OK_POSITIVE(path_is_root_at(fd, "/."));
        ASSERT_OK_EQ(path_is_root_at(fd, "/./.."), expected);
        ASSERT_OK_EQ(path_is_root_at(fd, "/.."), expected);
        ASSERT_OK_EQ(path_is_root_at(fd, "/../"), expected);
        ASSERT_OK_EQ(path_is_root_at(fd, "/../."), expected);
        ASSERT_OK_EQ(path_is_root_at(fd, "/../.."), expected);
        ASSERT_OK_ZERO(path_is_root_at(fd, "usr"));
        ASSERT_OK_ZERO(path_is_root_at(fd, "./usr"));
        ASSERT_OK_ZERO(path_is_root_at(fd, "../usr"));
        ASSERT_OK_ZERO(path_is_root_at(fd, "/usr"));
        ASSERT_OK_ZERO(path_is_root_at(fd, "/./usr"));
        ASSERT_OK_ZERO(path_is_root_at(fd, "/../usr"));
        ASSERT_OK_ZERO(path_is_root_at(fd, "/.././usr"));
        ASSERT_OK_ZERO(path_is_root_at(fd, "/../../usr"));
 }
 TEST(path_is_root_at) {
        int r;
        test_path_is_root_at_one(true);
        r = detach_mount_namespace();
        if (r < 0)
                return (void) log_tests_skipped_errno(r, "Failed to detach mount namespace");
        /* Interestingly, even after bind mount a path on "/", still "/" points to the previous root
         * directory, but "/../" points to the new root directory. Hence, path_is_root("/") is true but
         * path_is_root("/../") is false. Such spurious situation is resolved after chroot()ing to the new
         * root directory. */
        ASSERT_OK(mount_nofollow_verbose(LOG_DEBUG, "/", "/", NULL, MS_BIND|MS_REC, NULL));
        log_debug("/* %s: bind mount(\"/\", \"/\") */", __func__);
        test_path_is_root_at_one(false);
        /* chroot("/") does not change anything. */
        ASSERT_OK_ERRNO(chroot("/"));
        log_debug("/* %s: chroot(\"/\") */", __func__);
        test_path_is_root_at_one(false);
        /* chdir("/") neither change anything. */
        ASSERT_OK_ERRNO(chdir("/"));
        log_debug("/* %s: chdir(\"/\") */", __func__);
        test_path_is_root_at_one(false);
        /* chdir("/../") neither change anything. */
        ASSERT_OK_ERRNO(chdir("/../"));
        log_debug("/* %s: chdir(\"/../\") */", __func__);
        test_path_is_root_at_one(false);
        /* After chroot("/../"), both "/" and "/../" point to the new root directory. */
        ASSERT_OK_ERRNO(chroot("/../"));
        log_debug("/* %s: chroot(\"/../\") */", __func__);
        test_path_is_root_at_one(true);
        /* chdir("/../") does not change anything. */
        ASSERT_OK_ERRNO(chdir("/../"));
        log_debug("/* %s: chdir(\"/../\") again */", __func__);
        test_path_is_root_at_one(true);
        /* bind mounting to non-root directory has no problem, of course. */
        _cleanup_(rm_rf_physical_and_freep) char *tmp = NULL;
        ASSERT_OK(mkdtemp_malloc("/tmp/test-path_is_root-XXXXXX", &tmp));
        ASSERT_OK(mount_nofollow_verbose(LOG_DEBUG, "/", tmp, NULL, MS_BIND|MS_REC, NULL));
        log_debug("/* %s: bind mount(\"/\", \"%s\") */", __func__, tmp);
        test_path_is_root_at_one(true);
        ASSERT_OK_ERRNO(chdir(tmp));
        log_debug("/* %s: chdir(\"%s\") */", __func__, tmp);
        test_path_is_root_at_one(true);
        ASSERT_OK_ERRNO(chroot(tmp));
        log_debug("/* %s: chroot(\"%s\") */", __func__, tmp);
        test_path_is_root_at_one(true);
        ASSERT_OK_ERRNO(chdir(tmp));
        log_debug("/* %s: chdir(\"%s\") again */", __func__, tmp);
        test_path_is_root_at_one(true);
 }
 TEST(fds_are_same_mount) {
        _cleanup_close_ int fd1 = -EBADF, fd2 = -EBADF, fd3 = -EBADF, fd4 = -EBADF;
--- a/src/test/test-log.c
+++ b/src/test/test-log.c
@ -45,6 +45,22 @@ static void test_file(void) {
        assert_se(startswith(__FILE__, RELATIVE_SOURCE_PATH "/"));
 }
 static void test_log_once_impl(void) {
        log_once(LOG_INFO, "This should be logged in LOG_INFO at first, then in LOG_DEBUG later.");
        log_once(LOG_DEBUG, "This should be logged only once in LOG_DEBUG.");
        ASSERT_ERROR(log_once_errno(LOG_INFO, SYNTHETIC_ERRNO(ENOANO),
                                 "This should be logged with errno in LOG_INFO at first, then in LOG_DEBUG later: %m"),
                     ENOANO);
        ASSERT_ERROR(log_once_errno(LOG_DEBUG, SYNTHETIC_ERRNO(EBADMSG),
                                    "This should be logged only once with errno in LOG_DEBUG: %m"),
                     EBADMSG);
 }
 static void test_log_once(void) {
        for (unsigned i = 0; i < 4; i++)
                test_log_once_impl();
 }
 static void test_log_struct(void) {
        log_struct(LOG_INFO,
                   "MESSAGE=Waldo PID="PID_FMT" (no errno)", getpid_cached(),
@ -236,6 +252,8 @@ int main(int argc, char* argv[]) {
        assert_se(log_info_errno(SYNTHETIC_ERRNO(EUCLEAN), "foo") == -EUCLEAN);
        test_log_once();
        for (int target = 0; target < _LOG_TARGET_MAX; target++) {
                log_set_target(target);
                log_open();
--- a/src/test/test-macro.c
+++ b/src/test/test-macro.c
@ -1228,4 +1228,20 @@ TEST(ASSERT) {
        ASSERT_SIGNAL(ASSERT_NE_ID128(SD_ID128_NULL, SD_ID128_NULL), SIGABRT);
 }
 static void test_once_impl(void) {
        static unsigned count = 0;
        if (ONCE) {
                log_info("This should be logged only once.");
                count++;
        }
        ASSERT_EQ(count, 1u);
 }
 TEST(once) {
        for (unsigned i = 0; i < 20; i++)
                test_once_impl();
 }
 DEFINE_TEST_MAIN(LOG_INFO);
--- a/src/udev/udev-manager.c
+++ b/src/udev/udev-manager.c
@ -335,7 +335,7 @@ static usec_t extra_timeout_usec(void) {
        parsed = true;
-        e = getenv("SYSTEMD_UDEV_EXTRA_TIMEOUT_SEC");
+        e = secure_getenv("SYSTEMD_UDEV_EXTRA_TIMEOUT_SEC");
        if (!e)
                return saved;