127 files changed, 1781 insertions, 2455 deletions
diff --git a/meta-selftest/recipes-test/ext-dtb/bbb-dtbs-as-ext.bb b/meta-selftest/recipes-test/ext-dtb/bbb-dtbs-as-ext.bb
new file mode 100644
index 0000000000..5055d03e54
--- /dev/null
+++ b/meta-selftest/recipes-test/ext-dtb/bbb-dtbs-as-ext.bb
@@ -0,0 +1,29 @@
+SUMMARY = "Boeaglebone Devicetrees"
+DESCRIPTION = "Handle the dtc files of the beaglebone-yocto via devicetree.bbclass just for testing purpose"
+SECTION = "kernel"
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda2f7b4f302"
+inherit devicetree
+COMPATIBLE_MACHINE  = "^(beaglebone-yocto)$"
+# Take a copy of a small devicetree from the kernel's source directory for handling it externally
+# Borrowed an example DTB overlay from
+# https://raw.githubusercontent.com/beagleboard/linux/refs/heads/5.10/arch/arm/boot/dts/overlays/BBORG_RELAY-00A2.dts
+SRC_URI = "\
+    file://am335x-bonegreen-ext.dts \
+    file://BBORG_RELAY-00A2.dts \
+"
+# The am335x-bonegreen-ext.dts needs also the ti directories
+DT_INCLUDE:append = " ${STAGING_KERNEL_DIR}/arch/${ARCH}/boot/dts/ti/omap"
+# Sym-links are handled as extra configuration nodes in FIT images.
+do_install:append() {
+    ln -sf am335x-bonegreen-ext.dtb "${D}/boot/devicetree/am335x-bonegreen-ext-alias.dtb"
+}
+do_deploy:append() {
+    ln -sf am335x-bonegreen-ext.dtb "${DEPLOYDIR}/devicetree/am335x-bonegreen-ext-alias.dtb"
+}
diff --git a/meta-selftest/recipes-test/ext-dtb/files/BBORG_RELAY-00A2.dts b/meta-selftest/recipes-test/ext-dtb/files/BBORG_RELAY-00A2.dts
new file mode 100644
index 0000000000..9530fa50fe
--- /dev/null
+++ b/meta-selftest/recipes-test/ext-dtb/files/BBORG_RELAY-00A2.dts
@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2015 Robert Nelson <robertcnelson@gmail.com>
+ * Copyright (C) 2019 Amilcar Lucas <amilcar.lucas@iav.de>
+ */
+/dts-v1/;
+/plugin/;
+&{/chosen} {
+        overlays {
+                BBORG_RELAY-00A2.kernel = __TIMESTAMP__;
+        };
+};
+&ocp {
+        P9_41_pinmux { pinctrl-0 = <&P9_41_gpio_pin>;};
+        P9_42_pinmux { pinctrl-0 = <&P9_42_gpio_pin>;};
+        P9_30_pinmux { pinctrl-0 = <&P9_30_gpio_pin>;};
+        P9_27_pinmux { pinctrl-0 = <&P9_27_gpio_pin>;};
+};
+// relay1
+&bone_led_P9_41 {
+        status = "okay";
+        label = "relay1";
+        default-state = "keep";
+};
+// relay2
+&bone_led_P9_42 {
+        status = "okay";
+        label = "relay2";
+        default-state = "keep";
+};
+// realy3
+&bone_led_P9_30 {
+        status = "okay";
+        label = "relay3";
+        default-state = "keep";
+};
+// realy4
+&bone_led_P9_27 {
+        status = "okay";
+        label = "relay4";
+        default-state = "keep";
+};
diff --git a/meta-selftest/recipes-test/ext-dtb/files/am335x-bonegreen-ext.dts b/meta-selftest/recipes-test/ext-dtb/files/am335x-bonegreen-ext.dts
new file mode 100644
index 0000000000..a0b39337a9
--- /dev/null
+++ b/meta-selftest/recipes-test/ext-dtb/files/am335x-bonegreen-ext.dts
@@ -0,0 +1,14 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2012 Texas Instruments Incorporated - https://www.ti.com/
+ */
+/dts-v1/;
+#include "am33xx.dtsi"
+#include "am335x-bone-common.dtsi"
+#include "am335x-bonegreen-common.dtsi"
+/ {
+        model = "TI AM335x BeagleBone Green External";
+        compatible = "ti,am335x-bone-green", "ti,am335x-bone-black", "ti,am335x-bone", "ti,am33xx";
+};
diff --git a/meta/classes-recipe/barebox.bbclass b/meta/classes-recipe/barebox.bbclass
index 200ba08326..a562dce169 100644
--- a/meta/classes-recipe/barebox.bbclass
+++ b/meta/classes-recipe/barebox.bbclass
@@ -12,7 +12,7 @@ PROVIDES += "virtual/bootloader"
 PACKAGE_ARCH = "${MACHINE_ARCH}"
-DEPENDS += "bison-native flex-native"
+DEPENDS += "bison-native flex-native lz4-native"
 S = "${WORKDIR}/barebox-${PV}"
 B = "${WORKDIR}/build"
diff --git a/meta/classes-recipe/devicetree.bbclass b/meta/classes-recipe/devicetree.bbclass
index 1806cb62cb..2a2ac93e9b 100644
--- a/meta/classes-recipe/devicetree.bbclass
+++ b/meta/classes-recipe/devicetree.bbclass
@@ -109,7 +109,11 @@ def devicetree_compile(dtspath, includes, d):
        ppargs.append("-I{0}".format(i))
    ppargs += ["-o", "{0}.pp".format(dts), dtspath]
    bb.note("Running {0}".format(" ".join(ppargs)))
-    subprocess.run(ppargs, check = True)
+    try:
+        subprocess.run(ppargs, check=True, capture_output=True)
+    except subprocess.CalledProcessError as e:
+        bb.fatal(f"Command '{' '.join(ppargs)}' failed with return code {e.returncode}\nstdout: {e.stdout.decode()}\nstderr: {e.stderr.decode()}\ndtspath: {os.path.abspath(dtspath)}")
    # determine if the file is an overlay or not (using the preprocessed file)
    isoverlay = devicetree_source_is_overlay("{0}.pp".format(dts))
@@ -125,7 +129,11 @@ def devicetree_compile(dtspath, includes, d):
    dtcargs += ["-o", "{0}.{1}".format(dtname, "dtbo" if isoverlay else "dtb")]
    dtcargs += ["-I", "dts", "-O", "dtb", "{0}.pp".format(dts)]
    bb.note("Running {0}".format(" ".join(dtcargs)))
-    subprocess.run(dtcargs, check = True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+    try:
+        subprocess.run(dtcargs, check=True, capture_output=True)
+    except subprocess.CalledProcessError as e:
+        bb.fatal(f"Command '{' '.join(dtcargs)}' failed with return code {e.returncode}\nstdout: {e.stdout.decode()}\nstderr: {e.stderr.decode()}\ndtname: {dtname}")
 python devicetree_do_compile() {
    import re
@@ -144,14 +152,16 @@ python devicetree_do_compile() {
 }
 devicetree_do_install() {
-    for DTB_FILE in `ls *.dtb *.dtbo`; do
+    for dtb_file in *.dtb *.dtbo; do
-        install -Dm 0644 ${B}/${DTB_FILE} ${D}/boot/devicetree/${DTB_FILE}
+        [ -e "$dtb_file" ] || continue
+        install -Dm 0644 "${B}/$dtb_file" "${D}/boot/devicetree/$dtb_file"
    done
 }
 devicetree_do_deploy() {
-    for DTB_FILE in `ls *.dtb *.dtbo`; do
+    for dtb_file in *.dtb *.dtbo; do
-        install -Dm 0644 ${B}/${DTB_FILE} ${DEPLOYDIR}/devicetree/${DTB_FILE}
+        [ -e "$dtb_file" ] || continue
+        install -Dm 0644 "${B}/$dtb_file" "${DEPLOYDIR}/devicetree/$dtb_file"
    done
 }
 addtask deploy before do_build after do_install
diff --git a/meta/classes-recipe/kernel-fit-extra-artifacts.bbclass b/meta/classes-recipe/kernel-fit-extra-artifacts.bbclass
new file mode 100644
index 0000000000..385fe9895a
--- /dev/null
+++ b/meta/classes-recipe/kernel-fit-extra-artifacts.bbclass
@@ -0,0 +1,19 @@
+#
+# Copyright OpenEmbedded Contributors
+#
+# SPDX-License-Identifier: MIT
+#
+# Generate and deploy additional artifacts required for FIT image creation.
+# To use this class, add it to the KERNEL_CLASSES variable.
+inherit kernel-uboot
+kernel_do_deploy:append() {
+        # Provide the kernel artifacts to post processing recipes e.g. for creating a FIT image
+        uboot_prep_kimage "$deployDir"
+        # For x86 a setup.bin needs to be include"d in a fitImage as well
+        if [ -e ${KERNEL_OUTPUT_DIR}/setup.bin ]; then
+                install -D "${B}/${KERNEL_OUTPUT_DIR}/setup.bin" "$deployDir/"
+        fi
+}
diff --git a/meta/classes-recipe/kernel-fit-image.bbclass b/meta/classes-recipe/kernel-fit-image.bbclass
new file mode 100644
index 0000000000..d2eebb88bc
--- /dev/null
+++ b/meta/classes-recipe/kernel-fit-image.bbclass
@@ -0,0 +1,190 @@
+inherit kernel-arch kernel-artifact-names uboot-config deploy
+require conf/image-fitimage.conf
+S = "${WORKDIR}/sources"
+UNPACKDIR = "${S}"
+PACKAGE_ARCH = "${MACHINE_ARCH}"
+# This bbclass requires KERNEL_CLASSES += "kernel-fit-extra-artifacts"
+EXCLUDE_FROM_WORLD = "1"
+DEPENDS += "\
+    u-boot-tools-native dtc-native \
+    ${@'kernel-signing-keys-native' if d.getVar('FIT_GENERATE_KEYS') == '1' else ''} \
+"
+python () {
+    image = d.getVar('INITRAMFS_IMAGE')
+    if image and d.getVar('INITRAMFS_IMAGE_BUNDLE') != '1':
+        if d.getVar('INITRAMFS_MULTICONFIG'):
+            mc = d.getVar('BB_CURRENT_MC')
+            d.appendVarFlag('do_compile', 'mcdepends', ' mc:' + mc + ':${INITRAMFS_MULTICONFIG}:${INITRAMFS_IMAGE}:do_image_complete')
+        else:
+            d.appendVarFlag('do_compile', 'depends', ' ${INITRAMFS_IMAGE}:do_image_complete')
+    #check if there are any dtb providers
+    providerdtb = d.getVar("PREFERRED_PROVIDER_virtual/dtb")
+    if providerdtb:
+        d.appendVarFlag('do_compile', 'depends', ' virtual/dtb:do_populate_sysroot')
+        d.setVar('EXTERNAL_KERNEL_DEVICETREE', "${RECIPE_SYSROOT}/boot/devicetree")
+}
+do_configure[noexec] = "1"
+UBOOT_MKIMAGE_KERNEL_TYPE ?= "kernel"
+KERNEL_IMAGEDEST ?= "/boot"
+python do_compile() {
+    import shutil
+    import oe.fitimage
+    itsfile = "fit-image.its"
+    fitname = "fitImage"
+    kernel_deploydir = d.getVar('DEPLOY_DIR_IMAGE')
+    kernel_deploysubdir = d.getVar('KERNEL_DEPLOYSUBDIR')
+    if kernel_deploysubdir:
+        kernel_deploydir = os.path.join(kernel_deploydir, kernel_deploysubdir)
+    # Collect all the its nodes before the its file is generated and mkimage gets executed
+    root_node = oe.fitimage.ItsNodeRootKernel(
+        d.getVar("FIT_DESC"), d.getVar("FIT_ADDRESS_CELLS"),
+        d.getVar('HOST_PREFIX'), d.getVar('UBOOT_ARCH'),  d.getVar("FIT_CONF_PREFIX"),
+        oe.types.boolean(d.getVar('UBOOT_SIGN_ENABLE')), d.getVar("UBOOT_SIGN_KEYDIR"),
+        d.getVar("UBOOT_MKIMAGE"), d.getVar("UBOOT_MKIMAGE_DTCOPTS"),
+        d.getVar("UBOOT_MKIMAGE_SIGN"), d.getVar("UBOOT_MKIMAGE_SIGN_ARGS"),
+        d.getVar('FIT_HASH_ALG'), d.getVar('FIT_SIGN_ALG'), d.getVar('FIT_PAD_ALG'),
+        d.getVar('UBOOT_SIGN_KEYNAME'),
+        oe.types.boolean(d.getVar('FIT_SIGN_INDIVIDUAL')), d.getVar('UBOOT_SIGN_IMG_KEYNAME')
+    )
+    # Prepare a kernel image section.
+    shutil.copyfile(os.path.join(kernel_deploydir, "linux.bin"), "linux.bin")
+    with open(os.path.join(kernel_deploydir, "linux_comp")) as linux_comp_f:
+        linux_comp = linux_comp_f.read()
+    root_node.fitimage_emit_section_kernel("kernel-1", "linux.bin", linux_comp,
+        d.getVar('UBOOT_LOADADDRESS'), d.getVar('UBOOT_ENTRYPOINT'),
+        d.getVar('UBOOT_MKIMAGE_KERNEL_TYPE'), d.getVar("UBOOT_ENTRYSYMBOL"))
+    # Prepare a DTB image section
+    kernel_devicetree = d.getVar('KERNEL_DEVICETREE')
+    external_kernel_devicetree = d.getVar("EXTERNAL_KERNEL_DEVICETREE")
+    if kernel_devicetree:
+        for dtb in kernel_devicetree.split():
+            # In deploy_dir the DTBs are without sub-directories also with KERNEL_DTBVENDORED = "1"
+            dtb_name = os.path.basename(dtb)
+            # Skip DTB if it's also provided in EXTERNAL_KERNEL_DEVICETREE directory
+            if external_kernel_devicetree:
+                ext_dtb_path = os.path.join(external_kernel_devicetree, dtb_name)
+                if os.path.exists(ext_dtb_path) and os.path.getsize(ext_dtb_path) > 0:
+                    continue
+            # Copy the dtb or dtbo file into the FIT image assembly directory
+            shutil.copyfile(os.path.join(kernel_deploydir, dtb_name), dtb_name)
+            root_node.fitimage_emit_section_dtb(dtb_name, dtb_name,
+                d.getVar("UBOOT_DTB_LOADADDRESS"), d.getVar("UBOOT_DTBO_LOADADDRESS"))
+    if external_kernel_devicetree:
+        # iterate over all .dtb and .dtbo files in the external kernel devicetree directory
+        # and copy them to the FIT image assembly directory
+        for dtb_name in sorted(os.listdir(external_kernel_devicetree)):
+            if dtb_name.endswith('.dtb') or dtb_name.endswith('.dtbo'):
+                dtb_path = os.path.join(external_kernel_devicetree, dtb_name)
+                # For symlinks, add a configuration node that refers to the DTB image node to which the symlink points
+                symlink_target = oe.fitimage.symlink_points_below(dtb_name, external_kernel_devicetree)
+                if symlink_target:
+                    root_node.fitimage_emit_section_dtb_alias(dtb_name, symlink_target, True)
+                # For real DTB files add an image node and a configuration node
+                else:
+                    shutil.copyfile(dtb_path, dtb_name)
+                    root_node.fitimage_emit_section_dtb(dtb_name, dtb_name,
+                        d.getVar("UBOOT_DTB_LOADADDRESS"), d.getVar("UBOOT_DTBO_LOADADDRESS"), True)
+    # Prepare a u-boot script section
+    fit_uboot_env = d.getVar("FIT_UBOOT_ENV")
+    if fit_uboot_env:
+        root_node.fitimage_emit_section_boot_script("bootscr-"+fit_uboot_env , fit_uboot_env)
+    # Prepare a setup section (For x86)
+    setup_bin_path = os.path.join(kernel_deploydir, "setup.bin")
+    if os.path.exists(setup_bin_path):
+        shutil.copyfile(setup_bin_path, "setup.bin")
+        root_node.fitimage_emit_section_setup("setup-1", "setup.bin")
+    # Prepare a ramdisk section.
+    initramfs_image = d.getVar('INITRAMFS_IMAGE')
+    if initramfs_image and d.getVar("INITRAMFS_IMAGE_BUNDLE") != '1':
+        # Find and use the first initramfs image archive type we find
+        found = False
+        for img in d.getVar("FIT_SUPPORTED_INITRAMFS_FSTYPES").split():
+            initramfs_path = os.path.join(d.getVar("DEPLOY_DIR_IMAGE"), "%s.%s" % (d.getVar('INITRAMFS_IMAGE_NAME'), img))
+            if os.path.exists(initramfs_path):
+                bb.note("Found initramfs image: " + initramfs_path)
+                found = True
+                root_node.fitimage_emit_section_ramdisk("ramdisk-1", initramfs_path,
+                    initramfs_image,
+                    d.getVar("UBOOT_RD_LOADADDRESS"),
+                    d.getVar("UBOOT_RD_ENTRYPOINT"))
+                break
+            else:
+                bb.note("Did not find initramfs image: " + initramfs_path)
+        if not found:
+            bb.fatal("Could not find a valid initramfs type for %s, the supported types are: %s" % (d.getVar('INITRAMFS_IMAGE_NAME'), d.getVar('FIT_SUPPORTED_INITRAMFS_FSTYPES')))
+    # Generate the configuration section
+    root_node.fitimage_emit_section_config(d.getVar("FIT_CONF_DEFAULT_DTB"))
+    # Write the its file
+    root_node.write_its_file(itsfile)
+    # Assemble the FIT image
+    root_node.run_mkimage_assemble(itsfile, fitname)
+    # Sign the FIT image if required
+    root_node.run_mkimage_sign(fitname)
+}
+do_compile[depends] += "virtual/kernel:do_deploy"
+do_install() {
+    install -d "${D}/${KERNEL_IMAGEDEST}"
+    install -m 0644 "${B}/fitImage" "${D}/${KERNEL_IMAGEDEST}/fitImage"
+}
+FILES:${PN} = "${KERNEL_IMAGEDEST}"
+do_deploy() {
+    deploy_dir="${DEPLOYDIR}"
+    if [ -n "${KERNEL_DEPLOYSUBDIR}" ]; then
+        deploy_dir="${DEPLOYDIR}/${KERNEL_DEPLOYSUBDIR}"
+    fi
+    install -d "$deploy_dir"
+    install -m 0644 "${B}/fitImage" "$deploy_dir/fitImage"
+    install -m 0644 "${B}/fit-image.its" "$deploy_dir/fit-image.its"
+    if [ "${INITRAMFS_IMAGE_BUNDLE}" != "1" ]; then
+        ln -snf fit-image.its "$deploy_dir/fitImage-its-${KERNEL_FIT_NAME}.its"
+        if [ -n "${KERNEL_FIT_LINK_NAME}" ] ; then
+            ln -snf fit-image.its "$deploy_dir/fitImage-its-${KERNEL_FIT_LINK_NAME}"
+        fi
+    fi
+    if [ -n "${INITRAMFS_IMAGE}" ]; then
+        ln -snf fit-image-its "$deploy_dir/fitImage-its-${INITRAMFS_IMAGE_NAME}-${KERNEL_FIT_NAME}.its"
+        if [ -n "${KERNEL_FIT_LINK_NAME}" ]; then
+            ln -snf fit-image.its "$deploy_dir/fitImage-its-${INITRAMFS_IMAGE_NAME}-${KERNEL_FIT_LINK_NAME}"
+        fi
+        if [ "${INITRAMFS_IMAGE_BUNDLE}" != "1" ]; then
+            ln -snf fitImage "$deploy_dir/fitImage-${INITRAMFS_IMAGE_NAME}-${KERNEL_FIT_NAME}${KERNEL_FIT_BIN_EXT}"
+            if [ -n "${KERNEL_FIT_LINK_NAME}" ] ; then
+                ln -snf fitImage "$deploy_dir/fitImage-${INITRAMFS_IMAGE_NAME}-${KERNEL_FIT_LINK_NAME}"
+            fi
+        fi
+    fi
+}
+addtask deploy after do_compile before do_build
diff --git a/meta/classes-recipe/kernel-fitimage.bbclass b/meta/classes-recipe/kernel-fitimage.bbclass
deleted file mode 100644
index 07786647e1..0000000000
--- a/meta/classes-recipe/kernel-fitimage.bbclass
+++ /dev/null
@@ -1,839 +0,0 @@
-#
-# Copyright OpenEmbedded Contributors
-#
-# SPDX-License-Identifier: MIT
-#
-inherit kernel-uboot kernel-artifact-names uboot-config
-require conf/image-fitimage.conf
-def get_fit_replacement_type(d):
-    kerneltypes = d.getVar('KERNEL_IMAGETYPES') or ""
-    replacementtype = ""
-    if 'fitImage' in kerneltypes.split():
-        uarch = d.getVar("UBOOT_ARCH")
-        if uarch == "arm64":
-            replacementtype = "Image"
-        elif uarch == "riscv":
-            replacementtype = "Image"
-        elif uarch == "mips":
-            replacementtype = "vmlinuz.bin"
-        elif uarch == "x86":
-            replacementtype = "bzImage"
-        elif uarch == "microblaze":
-            replacementtype = "linux.bin"
-        else:
-            replacementtype = "zImage"
-    return replacementtype
-KERNEL_IMAGETYPE_REPLACEMENT ?= "${@get_fit_replacement_type(d)}"
-DEPENDS:append = " ${@'u-boot-tools-native dtc-native' if 'fitImage' in (d.getVar('KERNEL_IMAGETYPES') or '').split() else ''}"
-python __anonymous () {
-    # Override KERNEL_IMAGETYPE_FOR_MAKE variable, which is internal
-    # to kernel.bbclass . We have to override it, since we pack zImage
-    # (at least for now) into the fitImage .
-    typeformake = d.getVar("KERNEL_IMAGETYPE_FOR_MAKE") or ""
-    if 'fitImage' in typeformake.split():
-        d.setVar('KERNEL_IMAGETYPE_FOR_MAKE', typeformake.replace('fitImage', d.getVar('KERNEL_IMAGETYPE_REPLACEMENT')))
-    image = d.getVar('INITRAMFS_IMAGE')
-    if image and not bb.utils.to_boolean(d.getVar('INITRAMFS_IMAGE_BUNDLE')):
-        if d.getVar('INITRAMFS_MULTICONFIG'):
-            mc = d.getVar('BB_CURRENT_MC')
-            d.appendVarFlag('do_assemble_fitimage_initramfs', 'mcdepends', ' mc:' + mc + ':${INITRAMFS_MULTICONFIG}:${INITRAMFS_IMAGE}:do_image_complete')
-        else:
-            d.appendVarFlag('do_assemble_fitimage_initramfs', 'depends', ' ${INITRAMFS_IMAGE}:do_image_complete')
-    #check if there are any dtb providers
-    providerdtb = d.getVar("PREFERRED_PROVIDER_virtual/dtb")
-    if providerdtb:
-        d.appendVarFlag('do_assemble_fitimage', 'depends', ' virtual/dtb:do_populate_sysroot')
-        d.appendVarFlag('do_assemble_fitimage_initramfs', 'depends', ' virtual/dtb:do_populate_sysroot')
-        d.setVar('EXTERNAL_KERNEL_DEVICETREE', "${RECIPE_SYSROOT}/boot/devicetree")
-}
-#
-# Emit the fitImage ITS header
-#
-# $1 ... .its filename
-fitimage_emit_fit_header() {
-        cat << EOF >> $1
-/dts-v1/;
-/ {
-        description = "${FIT_DESC}";
-        #address-cells = <${FIT_ADDRESS_CELLS}>;
-EOF
-}
-#
-# Emit the fitImage section bits
-#
-# $1 ... .its filename
-# $2 ... Section bit type: imagestart - image section start
-#                          confstart  - configuration section start
-#                          sectend    - section end
-#                          fitend     - fitimage end
-#
-fitimage_emit_section_maint() {
-        case $2 in
-        imagestart)
-                cat << EOF >> $1
-        images {
-EOF
-        ;;
-        confstart)
-                cat << EOF >> $1
-        configurations {
-EOF
-        ;;
-        sectend)
-                cat << EOF >> $1
-        };
-EOF
-        ;;
-        fitend)
-                cat << EOF >> $1
-};
-EOF
-        ;;
-        esac
-}
-#
-# Emit the fitImage ITS kernel section
-#
-# $1 ... .its filename
-# $2 ... Image counter
-# $3 ... Path to kernel image
-# $4 ... Compression type
-fitimage_emit_section_kernel() {
-        kernel_csum="${FIT_HASH_ALG}"
-        kernel_sign_algo="${FIT_SIGN_ALG}"
-        kernel_sign_keyname="${UBOOT_SIGN_IMG_KEYNAME}"
-        ENTRYPOINT="${UBOOT_ENTRYPOINT}"
-        if [ -n "${UBOOT_ENTRYSYMBOL}" ]; then
-                ENTRYPOINT=`${HOST_PREFIX}nm vmlinux | \
-                        awk '$3=="${UBOOT_ENTRYSYMBOL}" {print "0x"$1;exit}'`
-        fi
-        cat << EOF >> $1
-                kernel-$2 {
-                        description = "Linux kernel";
-                        data = /incbin/("$3");
-                        type = "${UBOOT_MKIMAGE_KERNEL_TYPE}";
-                        arch = "${UBOOT_ARCH}";
-                        os = "linux";
-                        compression = "$4";
-                        load = <${UBOOT_LOADADDRESS}>;
-                        entry = <$ENTRYPOINT>;
-                        hash-1 {
-                                algo = "$kernel_csum";
-                        };
-                };
-EOF
-        if [ "${UBOOT_SIGN_ENABLE}" = "1" -a "${FIT_SIGN_INDIVIDUAL}" = "1" -a -n "$kernel_sign_keyname" ] ; then
-                sed -i '$ d' $1
-                cat << EOF >> $1
-                        signature-1 {
-                                algo = "$kernel_csum,$kernel_sign_algo";
-                                key-name-hint = "$kernel_sign_keyname";
-                        };
-                };
-EOF
-        fi
-}
-#
-# Emit the fitImage ITS DTB section
-#
-# $1 ... .its filename
-# $2 ... Image counter
-# $3 ... Path to DTB image
-fitimage_emit_section_dtb() {
-        dtb_csum="${FIT_HASH_ALG}"
-        dtb_sign_algo="${FIT_SIGN_ALG}"
-        dtb_sign_keyname="${UBOOT_SIGN_IMG_KEYNAME}"
-        dtb_loadline=""
-        dtb_ext=${DTB##*.}
-        if [ "${dtb_ext}" = "dtbo" ]; then
-                if [ -n "${UBOOT_DTBO_LOADADDRESS}" ]; then
-                        dtb_loadline="load = <${UBOOT_DTBO_LOADADDRESS}>;"
-                fi
-        elif [ -n "${UBOOT_DTB_LOADADDRESS}" ]; then
-                dtb_loadline="load = <${UBOOT_DTB_LOADADDRESS}>;"
-        fi
-        cat << EOF >> $1
-                fdt-$2 {
-                        description = "Flattened Device Tree blob";
-                        data = /incbin/("$3");
-                        type = "flat_dt";
-                        arch = "${UBOOT_ARCH}";
-                        compression = "none";
-                        $dtb_loadline
-                        hash-1 {
-                                algo = "$dtb_csum";
-                        };
-                };
-EOF
-        if [ "${UBOOT_SIGN_ENABLE}" = "1" -a "${FIT_SIGN_INDIVIDUAL}" = "1" -a -n "$dtb_sign_keyname" ] ; then
-                sed -i '$ d' $1
-                cat << EOF >> $1
-                        signature-1 {
-                                algo = "$dtb_csum,$dtb_sign_algo";
-                                key-name-hint = "$dtb_sign_keyname";
-                        };
-                };
-EOF
-        fi
-}
-#
-# Emit the fitImage ITS u-boot script section
-#
-# $1 ... .its filename
-# $2 ... Image counter
-# $3 ... Path to boot script image
-fitimage_emit_section_boot_script() {
-        bootscr_csum="${FIT_HASH_ALG}"
-        bootscr_sign_algo="${FIT_SIGN_ALG}"
-        bootscr_sign_keyname="${UBOOT_SIGN_IMG_KEYNAME}"
-        cat << EOF >> $1
-                bootscr-$2 {
-                        description = "U-boot script";
-                        data = /incbin/("$3");
-                        type = "script";
-                        arch = "${UBOOT_ARCH}";
-                        compression = "none";
-                        hash-1 {
-                                algo = "$bootscr_csum";
-                        };
-                };
-EOF
-        if [ "${UBOOT_SIGN_ENABLE}" = "1" -a "${FIT_SIGN_INDIVIDUAL}" = "1" -a -n "$bootscr_sign_keyname" ] ; then
-                sed -i '$ d' $1
-                cat << EOF >> $1
-                        signature-1 {
-                                algo = "$bootscr_csum,$bootscr_sign_algo";
-                                key-name-hint = "$bootscr_sign_keyname";
-                        };
-                };
-EOF
-        fi
-}
-#
-# Emit the fitImage ITS setup section
-#
-# $1 ... .its filename
-# $2 ... Image counter
-# $3 ... Path to setup image
-fitimage_emit_section_setup() {
-        setup_csum="${FIT_HASH_ALG}"
-        setup_sign_algo="${FIT_SIGN_ALG}"
-        setup_sign_keyname="${UBOOT_SIGN_IMG_KEYNAME}"
-        cat << EOF >> $1
-                setup-$2 {
-                        description = "Linux setup.bin";
-                        data = /incbin/("$3");
-                        type = "x86_setup";
-                        arch = "${UBOOT_ARCH}";
-                        os = "linux";
-                        compression = "none";
-                        load = <0x00090000>;
-                        entry = <0x00090000>;
-                        hash-1 {
-                                algo = "$setup_csum";
-                        };
-                };
-EOF
-        if [ "${UBOOT_SIGN_ENABLE}" = "1" -a "${FIT_SIGN_INDIVIDUAL}" = "1" -a -n "$setup_sign_keyname" ] ; then
-                sed -i '$ d' $1
-                cat << EOF >> $1
-                        signature-1 {
-                                algo = "$setup_csum,$setup_sign_algo";
-                                key-name-hint = "$setup_sign_keyname";
-                        };
-                };
-EOF
-        fi
-}
-#
-# Emit the fitImage ITS ramdisk section
-#
-# $1 ... .its filename
-# $2 ... Image counter
-# $3 ... Path to ramdisk image
-fitimage_emit_section_ramdisk() {
-        ramdisk_csum="${FIT_HASH_ALG}"
-        ramdisk_sign_algo="${FIT_SIGN_ALG}"
-        ramdisk_sign_keyname="${UBOOT_SIGN_IMG_KEYNAME}"
-        ramdisk_loadline=""
-        ramdisk_entryline=""
-        if [ -n "${UBOOT_RD_LOADADDRESS}" ]; then
-                ramdisk_loadline="load = <${UBOOT_RD_LOADADDRESS}>;"
-        fi
-        if [ -n "${UBOOT_RD_ENTRYPOINT}" ]; then
-                ramdisk_entryline="entry = <${UBOOT_RD_ENTRYPOINT}>;"
-        fi
-        cat << EOF >> $1
-                ramdisk-$2 {
-                        description = "${INITRAMFS_IMAGE}";
-                        data = /incbin/("$3");
-                        type = "ramdisk";
-                        arch = "${UBOOT_ARCH}";
-                        os = "linux";
-                        compression = "none";
-                        $ramdisk_loadline
-                        $ramdisk_entryline
-                        hash-1 {
-                                algo = "$ramdisk_csum";
-                        };
-                };
-EOF
-        if [ "${UBOOT_SIGN_ENABLE}" = "1" -a "${FIT_SIGN_INDIVIDUAL}" = "1" -a -n "$ramdisk_sign_keyname" ] ; then
-                sed -i '$ d' $1
-                cat << EOF >> $1
-                        signature-1 {
-                                algo = "$ramdisk_csum,$ramdisk_sign_algo";
-                                key-name-hint = "$ramdisk_sign_keyname";
-                        };
-                };
-EOF
-        fi
-}
-#
-# echoes symlink destination if it points below directory
-#
-# $1 ... file that's a potential symlink
-# $2 ... expected parent directory
-symlink_points_below() {
-        file="$2/$1"
-        dir=$2
-        if ! [ -L "$file" ]; then
-                return
-        fi
-        realpath="$(realpath --relative-to=$dir $file)"
-        if [ -z "${realpath%%../*}" ]; then
-                return
-        fi
-        echo "$realpath"
-}
-#
-# Emit the fitImage ITS configuration section
-#
-# $1 ... .its filename
-# $2 ... Linux kernel ID
-# $3 ... DTB image name
-# $4 ... ramdisk ID
-# $5 ... u-boot script ID
-# $6 ... config ID
-# $7 ... default flag
-# $8 ... default DTB image name
-fitimage_emit_section_config() {
-        conf_csum="${FIT_HASH_ALG}"
-        conf_sign_algo="${FIT_SIGN_ALG}"
-        conf_padding_algo="${FIT_PAD_ALG}"
-        if [ "${UBOOT_SIGN_ENABLE}" = "1" ] ; then
-                conf_sign_keyname="${UBOOT_SIGN_KEYNAME}"
-        fi
-        its_file="$1"
-        kernel_id="$2"
-        dtb_image="$3"
-        ramdisk_id="$4"
-        bootscr_id="$5"
-        config_id="$6"
-        default_flag="$7"
-        default_dtb_image="$8"
-        # Test if we have any DTBs at all
-        sep=""
-        conf_desc=""
-        conf_node="${FIT_CONF_PREFIX}"
-        kernel_line=""
-        fdt_line=""
-        ramdisk_line=""
-        bootscr_line=""
-        setup_line=""
-        default_line=""
-        compatible_line=""
-        dtb_image_sect=$(symlink_points_below $dtb_image "${EXTERNAL_KERNEL_DEVICETREE}")
-        if [ -z "$dtb_image_sect" ]; then
-                dtb_image_sect=$dtb_image
-        fi
-        dtb_path="${EXTERNAL_KERNEL_DEVICETREE}/${dtb_image_sect}"
-        if [ -f "$dtb_path" ] || [ -L "$dtb_path" ]; then
-                compat=$(fdtget -t s "$dtb_path" / compatible | sed 's/ /", "/g')
-                if [ -n "$compat" ]; then
-                        compatible_line="compatible = \"$compat\";"
-                fi
-        fi
-        dtb_image=$(echo $dtb_image | tr '/' '_')
-        dtb_image_sect=$(echo "${dtb_image_sect}" | tr '/' '_')
-        # conf node name is selected based on dtb ID if it is present,
-        # otherwise its selected based on kernel ID
-        if [ -n "$dtb_image" ]; then
-                conf_node=$conf_node$dtb_image
-        else
-                conf_node=$conf_node$kernel_id
-        fi
-        if [ -n "$kernel_id" ]; then
-                conf_desc="Linux kernel"
-                sep=", "
-                kernel_line="kernel = \"kernel-$kernel_id\";"
-        fi
-        if [ -n "$dtb_image" ]; then
-                conf_desc="$conf_desc${sep}FDT blob"
-                sep=", "
-                fdt_line="fdt = \"fdt-$dtb_image_sect\";"
-        fi
-        if [ -n "$ramdisk_id" ]; then
-                conf_desc="$conf_desc${sep}ramdisk"
-                sep=", "
-                ramdisk_line="ramdisk = \"ramdisk-$ramdisk_id\";"
-        fi
-        if [ -n "$bootscr_id" ]; then
-                conf_desc="$conf_desc${sep}u-boot script"
-                sep=", "
-                bootscr_line="bootscr = \"bootscr-$bootscr_id\";"
-        fi
-        if [ -n "$config_id" ]; then
-                conf_desc="$conf_desc${sep}setup"
-                setup_line="setup = \"setup-$config_id\";"
-        fi
-        if [ "$default_flag" = "1" ]; then
-                # default node is selected based on dtb ID if it is present,
-                # otherwise its selected based on kernel ID
-                if [ -n "$dtb_image" ]; then
-                        # Select default node as user specified dtb when
-                        # multiple dtb exists.
-                        if [ -n "$default_dtb_image" ]; then
-                                default_line="default = \"${FIT_CONF_PREFIX}$default_dtb_image\";"
-                        else
-                                default_line="default = \"${FIT_CONF_PREFIX}$dtb_image\";"
-                        fi
-                else
-                        default_line="default = \"${FIT_CONF_PREFIX}$kernel_id\";"
-                fi
-        fi
-        cat << EOF >> $its_file
-                $default_line
-                $conf_node {
-                        description = "$default_flag $conf_desc";
-                        $compatible_line
-                        $kernel_line
-                        $fdt_line
-                        $ramdisk_line
-                        $bootscr_line
-                        $setup_line
-                        hash-1 {
-                                algo = "$conf_csum";
-                        };
-EOF
-        if [ -n "$conf_sign_keyname" ] ; then
-                sign_line="sign-images = "
-                sep=""
-                if [ -n "$kernel_id" ]; then
-                        sign_line="$sign_line${sep}\"kernel\""
-                        sep=", "
-                fi
-                if [ -n "$dtb_image" ]; then
-                        sign_line="$sign_line${sep}\"fdt\""
-                        sep=", "
-                fi
-                if [ -n "$ramdisk_id" ]; then
-                        sign_line="$sign_line${sep}\"ramdisk\""
-                        sep=", "
-                fi
-                if [ -n "$bootscr_id" ]; then
-                        sign_line="$sign_line${sep}\"bootscr\""
-                        sep=", "
-                fi
-                if [ -n "$config_id" ]; then
-                        sign_line="$sign_line${sep}\"setup\""
-                fi
-                sign_line="$sign_line;"
-                cat << EOF >> $its_file
-                        signature-1 {
-                                algo = "$conf_csum,$conf_sign_algo";
-                                key-name-hint = "$conf_sign_keyname";
-                                padding = "$conf_padding_algo";
-                                $sign_line
-                        };
-EOF
-        fi
-        cat << EOF >> $its_file
-                };
-EOF
-}
-#
-# Assemble fitImage
-#
-# $1 ... .its filename
-# $2 ... fitImage name
-# $3 ... include ramdisk
-fitimage_assemble() {
-        kernelcount=1
-        dtbcount=""
-        DTBS=""
-        ramdiskcount=$3
-        setupcount=""
-        bootscr_id=""
-        default_dtb_image=""
-        rm -f $1 arch/${ARCH}/boot/$2
-        if [ -n "${UBOOT_SIGN_IMG_KEYNAME}" -a "${UBOOT_SIGN_KEYNAME}" = "${UBOOT_SIGN_IMG_KEYNAME}" ]; then
-                bbfatal "Keys used to sign images and configuration nodes must be different."
-        fi
-        fitimage_emit_fit_header $1
-        #
-        # Step 1: Prepare a kernel image section.
-        #
-        fitimage_emit_section_maint $1 imagestart
-        uboot_prep_kimage
-        fitimage_emit_section_kernel $1 $kernelcount linux.bin "$linux_comp"
-        #
-        # Step 2: Prepare a DTB image section
-        #
-        if [ -n "${KERNEL_DEVICETREE}" ]; then
-                dtbcount=1
-                for DTB in ${KERNEL_DEVICETREE}; do
-                        if echo $DTB | grep -q '/dts/'; then
-                                bbwarn "$DTB contains the full path to the the dts file, but only the dtb name should be used."
-                                DTB=`basename $DTB | sed 's,\.dts$,.dtb,g'`
-                        fi
-                        # Skip ${DTB} if it's also provided in ${EXTERNAL_KERNEL_DEVICETREE}
-                        if [ -n "${EXTERNAL_KERNEL_DEVICETREE}" ] && [ -s ${EXTERNAL_KERNEL_DEVICETREE}/${DTB} ]; then
-                                continue
-                        fi
-                        DTB_PATH="${KERNEL_OUTPUT_DIR}/dts/$DTB"
-                        if [ ! -e "$DTB_PATH" ]; then
-                                DTB_PATH="${KERNEL_OUTPUT_DIR}/$DTB"
-                        fi
-                        # Strip off the path component from the filename
-                        if "${@'false' if oe.types.boolean(d.getVar('KERNEL_DTBVENDORED')) else 'true'}"; then
-                                DTB=`basename $DTB`
-                        fi
-                        # Set the default dtb image if it exists in the devicetree.
-                        if [ "${FIT_CONF_DEFAULT_DTB}" = "$DTB" ];then
-                                default_dtb_image=$(echo "$DTB" | tr '/' '_')
-                        fi
-                        DTB=$(echo "$DTB" | tr '/' '_')
-                        # Skip DTB if we've picked it up previously
-                        echo "$DTBS" | tr ' ' '\n' | grep -xq "$DTB" && continue
-                        DTBS="$DTBS $DTB"
-                        DTB=$(echo $DTB | tr '/' '_')
-                        fitimage_emit_section_dtb $1 $DTB $DTB_PATH
-                done
-        fi
-        if [ -n "${EXTERNAL_KERNEL_DEVICETREE}" ]; then
-                dtbcount=1
-                for DTB in $(find "${EXTERNAL_KERNEL_DEVICETREE}" -name '*.dtb' -printf '%P\n' | sort) \
-                $(find "${EXTERNAL_KERNEL_DEVICETREE}" -name '*.dtbo' -printf '%P\n' | sort); do
-                        # Set the default dtb image if it exists in the devicetree.
-                        if [ ${FIT_CONF_DEFAULT_DTB} = $DTB ];then
-                                default_dtb_image=$(echo "$DTB" | tr '/' '_')
-                        fi
-                        DTB=$(echo "$DTB" | tr '/' '_')
-                        # Skip DTB/DTBO if we've picked it up previously
-                        echo "$DTBS" | tr ' ' '\n' | grep -xq "$DTB" && continue
-                        DTBS="$DTBS $DTB"
-                        # Also skip if a symlink. We'll later have each config section point at it
-                        [ $(symlink_points_below $DTB "${EXTERNAL_KERNEL_DEVICETREE}") ] && continue
-                        DTB=$(echo $DTB | tr '/' '_')
-                        fitimage_emit_section_dtb $1 $DTB "${EXTERNAL_KERNEL_DEVICETREE}/$DTB"
-                done
-        fi
-        if [ -n "${FIT_CONF_DEFAULT_DTB}" ] && [ -z $default_dtb_image ]; then 
-                bbwarn "${FIT_CONF_DEFAULT_DTB} is not available in the list of device trees."
-        fi
-        #
-        # Step 3: Prepare a u-boot script section
-        #
-        if [ -n "${FIT_UBOOT_ENV}" ]; then
-                cp ${UNPACKDIR}/${FIT_UBOOT_ENV} ${B}
-                bootscr_id="${FIT_UBOOT_ENV}"
-                fitimage_emit_section_boot_script $1 "$bootscr_id" ${FIT_UBOOT_ENV}
-        fi
-        #
-        # Step 4: Prepare a setup section. (For x86)
-        #
-        if [ -e ${KERNEL_OUTPUT_DIR}/setup.bin ]; then
-                setupcount=1
-                fitimage_emit_section_setup $1 $setupcount ${KERNEL_OUTPUT_DIR}/setup.bin
-        fi
-        #
-        # Step 5: Prepare a ramdisk section.
-        #
-        if [ "x${ramdiskcount}" = "x1" ] && [ "${INITRAMFS_IMAGE_BUNDLE}" != "1" ]; then
-                # Find and use the first initramfs image archive type we find
-                found=
-                for img in ${FIT_SUPPORTED_INITRAMFS_FSTYPES}; do
-                        initramfs_path="${INITRAMFS_DEPLOY_DIR_IMAGE}/${INITRAMFS_IMAGE_NAME}.$img"
-                        if [ -e "$initramfs_path" ]; then
-                                bbnote "Found initramfs image: $initramfs_path"
-                                found=true
-                                fitimage_emit_section_ramdisk $1 "$ramdiskcount" "$initramfs_path"
-                                break
-                        else
-                                bbnote "Did not find initramfs image: $initramfs_path"
-                        fi
-                done
-                if [ -z "$found" ]; then
-                        bbfatal "Could not find a valid initramfs type for ${INITRAMFS_IMAGE_NAME}, the supported types are: ${FIT_SUPPORTED_INITRAMFS_FSTYPES}"
-                fi
-        fi
-        fitimage_emit_section_maint $1 sectend
-        # Force the first Kernel and DTB in the default config
-        kernelcount=1
-        if [ -n "$dtbcount" ]; then
-                dtbcount=1
-        fi
-        #
-        # Step 6: Prepare a configurations section
-        #
-        fitimage_emit_section_maint $1 confstart
-        # kernel-fitimage.bbclass currently only supports a single kernel (no less or
-        # more) to be added to the FIT image along with 0 or more device trees and
-        # 0 or 1 ramdisk.
-        # It is also possible to include an initramfs bundle (kernel and rootfs in one binary)
-        # When the initramfs bundle is used ramdisk is disabled.
-        # If a device tree is to be part of the FIT image, then select
-        # the default configuration to be used is based on the dtbcount. If there is
-        # no dtb present than select the default configuation to be based on
-        # the kernelcount.
-        if [ -n "$DTBS" ]; then
-                i=1
-                for DTB in ${DTBS}; do
-                        dtb_ext=${DTB##*.}
-                        if [ "$dtb_ext" = "dtbo" ]; then
-                                fitimage_emit_section_config $1 "" "$DTB" "" "$bootscr_id" "" "`expr $i = $dtbcount`" "$default_dtb_image"
-                        else
-                                fitimage_emit_section_config $1 $kernelcount "$DTB" "$ramdiskcount" "$bootscr_id" "$setupcount" "`expr $i = $dtbcount`" "$default_dtb_image"
-                        fi
-                        i=`expr $i + 1`
-                done
-        else
-                defaultconfigcount=1
-                fitimage_emit_section_config $1 $kernelcount "" "$ramdiskcount" "$bootscr_id"  "$setupcount" $defaultconfigcount "$default_dtb_image"
-        fi
-        fitimage_emit_section_maint $1 sectend
-        fitimage_emit_section_maint $1 fitend
-        #
-        # Step 7: Assemble the image
-        #
-        ${UBOOT_MKIMAGE} \
-                ${@'-D "${UBOOT_MKIMAGE_DTCOPTS}"' if len('${UBOOT_MKIMAGE_DTCOPTS}') else ''} \
-                -f $1 \
-                ${KERNEL_OUTPUT_DIR}/$2
-        #
-        # Step 8: Sign the image
-        #
-        if [ "x${UBOOT_SIGN_ENABLE}" = "x1" ] ; then
-                ${UBOOT_MKIMAGE_SIGN} \
-                        ${@'-D "${UBOOT_MKIMAGE_DTCOPTS}"' if len('${UBOOT_MKIMAGE_DTCOPTS}') else ''} \
-                        -F -k "${UBOOT_SIGN_KEYDIR}" \
-                        -r ${KERNEL_OUTPUT_DIR}/$2 \
-                        ${UBOOT_MKIMAGE_SIGN_ARGS}
-        fi
-}
-do_assemble_fitimage() {
-        if echo ${KERNEL_IMAGETYPES} | grep -wq "fitImage"; then
-                cd ${B}
-                fitimage_assemble fit-image.its fitImage-none ""
-                if [ "${INITRAMFS_IMAGE_BUNDLE}" != "1" ]; then
-                        ln -sf fitImage-none ${B}/${KERNEL_OUTPUT_DIR}/fitImage
-                fi
-        fi
-}
-addtask assemble_fitimage before do_install after do_compile
-SYSROOT_DIRS:append = " /sysroot-only"
-do_install:append() {
-        if echo ${KERNEL_IMAGETYPES} | grep -wq "fitImage" && \
-                [ "${UBOOT_SIGN_ENABLE}" = "1" ]; then
-                install -D ${B}/${KERNEL_OUTPUT_DIR}/fitImage-none ${D}/sysroot-only/fitImage
-        fi
-}
-do_assemble_fitimage_initramfs() {
-        if echo ${KERNEL_IMAGETYPES} | grep -wq "fitImage" && \
-                test -n "${INITRAMFS_IMAGE}" ; then
-                cd ${B}
-                if [ "${INITRAMFS_IMAGE_BUNDLE}" = "1" ]; then
-                        fitimage_assemble fit-image-${INITRAMFS_IMAGE}.its fitImage-bundle ""
-                        ln -sf fitImage-bundle ${B}/${KERNEL_OUTPUT_DIR}/fitImage
-                else
-                        fitimage_assemble fit-image-${INITRAMFS_IMAGE}.its fitImage-${INITRAMFS_IMAGE} 1
-                fi
-        fi
-}
-addtask assemble_fitimage_initramfs before do_deploy after do_bundle_initramfs
-do_kernel_generate_rsa_keys() {
-        if [ "${UBOOT_SIGN_ENABLE}" = "0" ] && [ "${FIT_GENERATE_KEYS}" = "1" ]; then
-                bbwarn "FIT_GENERATE_KEYS is set to 1 even though UBOOT_SIGN_ENABLE is set to 0. The keys will not be generated as they won't be used."
-        fi
-        if [ "${UBOOT_SIGN_ENABLE}" = "1" ] && [ "${FIT_GENERATE_KEYS}" = "1" ]; then
-                # Generate keys to sign configuration nodes, only if they don't already exist
-                if [ ! -f "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_KEYNAME}".key ] || \
-                        [ ! -f "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_KEYNAME}".crt ]; then
-                        # make directory if it does not already exist
-                        mkdir -p "${UBOOT_SIGN_KEYDIR}"
-                        bbnote "Generating RSA private key for signing fitImage"
-                        openssl genrsa ${FIT_KEY_GENRSA_ARGS} -out \
-                                "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_KEYNAME}".key \
-                        "${FIT_SIGN_NUMBITS}"
-                        bbnote "Generating certificate for signing fitImage"
-                        openssl req ${FIT_KEY_REQ_ARGS} "${FIT_KEY_SIGN_PKCS}" \
-                                -key "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_KEYNAME}".key \
-                                -out "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_KEYNAME}".crt
-                fi
-                # Generate keys to sign image nodes, only if they don't already exist
-                if [ ! -f "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_IMG_KEYNAME}".key ] || \
-                        [ ! -f "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_IMG_KEYNAME}".crt ]; then
-                        # make directory if it does not already exist
-                        mkdir -p "${UBOOT_SIGN_KEYDIR}"
-                        bbnote "Generating RSA private key for signing fitImage"
-                        openssl genrsa ${FIT_KEY_GENRSA_ARGS} -out \
-                                "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_IMG_KEYNAME}".key \
-                        "${FIT_SIGN_NUMBITS}"
-                        bbnote "Generating certificate for signing fitImage"
-                        openssl req ${FIT_KEY_REQ_ARGS} "${FIT_KEY_SIGN_PKCS}" \
-                                -key "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_IMG_KEYNAME}".key \
-                                -out "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_IMG_KEYNAME}".crt
-                fi
-        fi
-}
-addtask kernel_generate_rsa_keys before do_assemble_fitimage after do_compile
-kernel_do_deploy[vardepsexclude] = "DATETIME"
-kernel_do_deploy:append() {
-        # Update deploy directory
-        if echo ${KERNEL_IMAGETYPES} | grep -wq "fitImage"; then
-                if [ "${INITRAMFS_IMAGE_BUNDLE}" != "1" ]; then
-                        bbnote "Copying fit-image.its source file..."
-                        install -m 0644 ${B}/fit-image.its "$deployDir/fitImage-its-${KERNEL_FIT_NAME}.its"
-                        if [ -n "${KERNEL_FIT_LINK_NAME}" ] ; then
-                                ln -snf fitImage-its-${KERNEL_FIT_NAME}.its "$deployDir/fitImage-its-${KERNEL_FIT_LINK_NAME}"
-                        fi
-                        bbnote "Copying linux.bin file..."
-                        install -m 0644 ${B}/linux.bin $deployDir/fitImage-linux.bin-${KERNEL_FIT_NAME}${KERNEL_FIT_BIN_EXT}
-                        if [ -n "${KERNEL_FIT_LINK_NAME}" ] ; then
-                                ln -snf fitImage-linux.bin-${KERNEL_FIT_NAME}${KERNEL_FIT_BIN_EXT} "$deployDir/fitImage-linux.bin-${KERNEL_FIT_LINK_NAME}"
-                        fi
-                fi
-                if [ -n "${INITRAMFS_IMAGE}" ]; then
-                        bbnote "Copying fit-image-${INITRAMFS_IMAGE}.its source file..."
-                        install -m 0644 ${B}/fit-image-${INITRAMFS_IMAGE}.its "$deployDir/fitImage-its-${INITRAMFS_IMAGE_NAME}-${KERNEL_FIT_NAME}.its"
-                        if [ -n "${KERNEL_FIT_LINK_NAME}" ] ; then
-                                ln -snf fitImage-its-${INITRAMFS_IMAGE_NAME}-${KERNEL_FIT_NAME}.its "$deployDir/fitImage-its-${INITRAMFS_IMAGE_NAME}-${KERNEL_FIT_LINK_NAME}"
-                        fi
-                        if [ "${INITRAMFS_IMAGE_BUNDLE}" != "1" ]; then
-                                bbnote "Copying fitImage-${INITRAMFS_IMAGE} file..."
-                                install -m 0644 ${B}/${KERNEL_OUTPUT_DIR}/fitImage-${INITRAMFS_IMAGE} "$deployDir/fitImage-${INITRAMFS_IMAGE_NAME}-${KERNEL_FIT_NAME}${KERNEL_FIT_BIN_EXT}"
-                                if [ -n "${KERNEL_FIT_LINK_NAME}" ] ; then
-                                        ln -snf fitImage-${INITRAMFS_IMAGE_NAME}-${KERNEL_FIT_NAME}${KERNEL_FIT_BIN_EXT} "$deployDir/fitImage-${INITRAMFS_IMAGE_NAME}-${KERNEL_FIT_LINK_NAME}"
-                                fi
-                        fi
-                fi
-        fi
-}
diff --git a/meta/classes-recipe/kernel-uboot.bbclass b/meta/classes-recipe/kernel-uboot.bbclass
index 6d4aff6b11..62974baaf0 100644
--- a/meta/classes-recipe/kernel-uboot.bbclass
+++ b/meta/classes-recipe/kernel-uboot.bbclass
@@ -12,19 +12,27 @@ FIT_KERNEL_COMP_ALG_EXTENSION ?= ".gz"
 UBOOT_MKIMAGE_KERNEL_TYPE ?= "kernel"
 uboot_prep_kimage() {
-        if [ -e arch/${ARCH}/boot/compressed/vmlinux ]; then
+        output_dir=$1
+        # For backward compatibility with kernel-fitimage.bbclass and kernel-uboot.bbclass
+        # support calling without parameter as well
+        if [ -z "$output_dir" ]; then
+                output_dir='.'
+        fi
+        linux_bin=$output_dir/linux.bin
+        if [ -e "arch/${ARCH}/boot/compressed/vmlinux" ]; then
                vmlinux_path="arch/${ARCH}/boot/compressed/vmlinux"
                linux_suffix=""
                linux_comp="none"
-        elif [ -e arch/${ARCH}/boot/vmlinuz.bin ]; then
+        elif [ -e "arch/${ARCH}/boot/vmlinuz.bin" ]; then
-                rm -f linux.bin
+                rm -f "$linux_bin"
-                cp -l arch/${ARCH}/boot/vmlinuz.bin linux.bin
+                cp -l "arch/${ARCH}/boot/vmlinuz.bin" "$linux_bin"
                vmlinux_path=""
                linux_suffix=""
                linux_comp="none"
        else
                vmlinux_path="vmlinux"
-                # Use vmlinux.initramfs for linux.bin when INITRAMFS_IMAGE_BUNDLE set
+                # Use vmlinux.initramfs for $linux_bin when INITRAMFS_IMAGE_BUNDLE set
                # As per the implementation in kernel.bbclass.
                # See do_bundle_initramfs function
                if [ "${INITRAMFS_IMAGE_BUNDLE}" = "1" ] && [ -e vmlinux.initramfs ]; then
@@ -34,18 +42,18 @@ uboot_prep_kimage() {
                linux_comp="${FIT_KERNEL_COMP_ALG}"
        fi
-        [ -n "${vmlinux_path}" ] && ${KERNEL_OBJCOPY} -O binary -R .note -R .comment -S "${vmlinux_path}" linux.bin
+        [ -n "$vmlinux_path" ] && ${KERNEL_OBJCOPY} -O binary -R .note -R .comment -S "$vmlinux_path" "$linux_bin"
-        if [ "${linux_comp}" != "none" ] ; then
+        if [ "$linux_comp" != "none" ] ; then
-                if [ "${linux_comp}" = "gzip" ] ; then
+                if [ "$linux_comp" = "gzip" ] ; then
-                        gzip -9 linux.bin
+                        gzip -9 "$linux_bin"
-                elif [ "${linux_comp}" = "lzo" ] ; then
+                elif [ "$linux_comp" = "lzo" ] ; then
-                        lzop -9 linux.bin
+                        lzop -9 "$linux_bin"
-                elif [ "${linux_comp}" = "lzma" ] ; then
+                elif [ "$linux_comp" = "lzma" ] ; then
-                        xz --format=lzma -f -6 linux.bin
+                        xz --format=lzma -f -6 "$linux_bin"
                fi
-                mv -f "linux.bin${linux_suffix}" linux.bin
+                mv -f "$linux_bin$linux_suffix" "$linux_bin"
        fi
-        echo "${linux_comp}"
+        printf "$linux_comp" > "$output_dir/linux_comp"
 }
diff --git a/meta/classes-recipe/kernel-uimage.bbclass b/meta/classes-recipe/kernel-uimage.bbclass
index 1a599e656c..e353232a0e 100644
--- a/meta/classes-recipe/kernel-uimage.bbclass
+++ b/meta/classes-recipe/kernel-uimage.bbclass
@@ -29,6 +29,7 @@ python __anonymous () {
 do_uboot_mkimage[dirs] += "${B}"
 do_uboot_mkimage() {
        uboot_prep_kimage
+        linux_comp="$(cat linux_comp)"
        ENTRYPOINT=${UBOOT_ENTRYPOINT}
        if [ -n "${UBOOT_ENTRYSYMBOL}" ]; then
@@ -36,6 +37,6 @@ do_uboot_mkimage() {
                        awk '$3=="${UBOOT_ENTRYSYMBOL}" {print "0x"$1;exit}'`
        fi
-        uboot-mkimage -A ${UBOOT_ARCH} -O linux -T ${UBOOT_MKIMAGE_KERNEL_TYPE} -C "${linux_comp}" -a ${UBOOT_LOADADDRESS} -e $ENTRYPOINT -n "${DISTRO_NAME}/${PV}/${MACHINE}" -d linux.bin ${B}/arch/${ARCH}/boot/uImage
+        uboot-mkimage -A ${UBOOT_ARCH} -O linux -T ${UBOOT_MKIMAGE_KERNEL_TYPE} -C "$linux_comp" -a ${UBOOT_LOADADDRESS} -e $ENTRYPOINT -n "${DISTRO_NAME}/${PV}/${MACHINE}" -d linux.bin ${B}/arch/${ARCH}/boot/uImage
        rm -f linux.bin
 }
diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass
index 36ce659762..2d9943c8a0 100644
--- a/meta/classes-recipe/kernel.bbclass
+++ b/meta/classes-recipe/kernel.bbclass
@@ -84,6 +84,10 @@ python __anonymous () {
        types = (alttype + ' ' + types).strip()
    d.setVar('KERNEL_IMAGETYPES', types)
+    # Since kernel-fitimage.bbclass got replaced by kernel-fit-image.bbclass
+    if "fitImage" in types:
+        bb.error("fitImage is no longer supported as a KERNEL_IMAGETYPE(S). FIT images are built by the linux-yocto-fitimage recipe.")
    # KERNEL_IMAGETYPES may contain a mixture of image types supported directly
    # by the kernel build system and types which are created by post-processing
    # the output of the kernel build system (e.g. compressing vmlinux ->
@@ -477,17 +481,10 @@ kernel_do_install() {
        install -d ${D}/${KERNEL_IMAGEDEST}
        #
-        # When including an initramfs bundle inside a FIT image, the fitImage is created after the install task
+        # bundle_initramfs runs after do_install before do_deploy. do_deploy does what's needed therefore.
-        # by do_assemble_fitimage_initramfs.
-        # This happens after the generation of the initramfs bundle (done by do_bundle_initramfs).
-        # So, at the level of the install task we should not try to install the fitImage. fitImage is still not
-        # generated yet.
-        # After the generation of the fitImage, the deploy task copies the fitImage from the build directory to
-        # the deploy folder.
        #
        for imageType in ${KERNEL_IMAGETYPES} ; do
-                if [ $imageType != "fitImage" ] || [ "${INITRAMFS_IMAGE_BUNDLE}" != "1" ] ; then
+                if [ "${INITRAMFS_IMAGE_BUNDLE}" != "1" ] ; then
                        install -m 0644 ${KERNEL_OUTPUT_DIR}/$imageType ${D}/${KERNEL_IMAGEDEST}/$imageType-${KERNEL_VERSION}
                fi
        done
@@ -845,9 +842,6 @@ kernel_do_deploy() {
        if [ ! -z "${INITRAMFS_IMAGE}" -a x"${INITRAMFS_IMAGE_BUNDLE}" = x1 ]; then
                for imageType in ${KERNEL_IMAGETYPES} ; do
-                        if [ "$imageType" = "fitImage" ] ; then
-                                continue
-                        fi
                        initramfsBaseName=$imageType-${INITRAMFS_NAME}
                        install -m 0644 ${KERNEL_OUTPUT_DIR}/$imageType.initramfs $deployDir/$initramfsBaseName${KERNEL_IMAGE_BIN_EXT}
                        if [ -n "${INITRAMFS_LINK_NAME}" ] ; then
diff --git a/meta/classes-recipe/populate_sdk_ext.bbclass b/meta/classes-recipe/populate_sdk_ext.bbclass
index de4799f013..2d7d661d25 100644
--- a/meta/classes-recipe/populate_sdk_ext.bbclass
+++ b/meta/classes-recipe/populate_sdk_ext.bbclass
@@ -40,7 +40,7 @@ ESDK_LOCALCONF_REMOVE ?= "CONF_VERSION \
                             TMPDIR \
                             BB_SERVER_TIMEOUT \
                            "
-ESDK_CLASS_INHERIT_DISABLE ?= "buildhistory icecc"
+ESDK_CLASS_INHERIT_DISABLE ?= "buildhistory"
 SDK_UPDATE_URL ?= ""
 SDK_TARGETS ?= "${PN}"
diff --git a/meta/classes-recipe/uboot-sign.bbclass b/meta/classes-recipe/uboot-sign.bbclass
index 796c040e8b..73e9ce3f11 100644
--- a/meta/classes-recipe/uboot-sign.bbclass
+++ b/meta/classes-recipe/uboot-sign.bbclass
@@ -112,13 +112,14 @@ UBOOT_FIT_CONF_USER_LOADABLES ?= ''
 UBOOT_FIT_UBOOT_LOADADDRESS ?= "${UBOOT_LOADADDRESS}"
 UBOOT_FIT_UBOOT_ENTRYPOINT ?= "${UBOOT_ENTRYPOINT}"
+DEPENDS:append = " ${@'kernel-signing-keys-native' if d.getVar('FIT_GENERATE_KEYS') == '1' else ''}"
 python() {
    # We need u-boot-tools-native if we're creating a U-Boot fitImage
    sign = d.getVar('UBOOT_SIGN_ENABLE') == '1'
    if d.getVar('UBOOT_FITIMAGE_ENABLE') == '1' or sign:
        d.appendVar('DEPENDS', " u-boot-tools-native dtc-native")
-    if d.getVar('FIT_GENERATE_KEYS') == '1' and sign:
-        d.appendVarFlag('do_uboot_assemble_fitimage', 'depends', ' virtual/kernel:do_kernel_generate_rsa_keys')
 }
 concat_dtb() {
diff --git a/meta/classes-recipe/update-alternatives.bbclass b/meta/classes-recipe/update-alternatives.bbclass
index b153e1b297..5f40dc23ea 100644
--- a/meta/classes-recipe/update-alternatives.bbclass
+++ b/meta/classes-recipe/update-alternatives.bbclass
@@ -73,24 +73,6 @@ UPDALTVARS  = "ALTERNATIVE ALTERNATIVE_LINK_NAME ALTERNATIVE_TARGET ALTERNATIVE_
 PACKAGE_WRITE_DEPS += "virtual/update-alternatives-native"
-def gen_updatealternativesvardeps(d):
-    pkgs = (d.getVar("PACKAGES") or "").split()
-    vars = (d.getVar("UPDALTVARS") or "").split()
-    # First compute them for non_pkg versions
-    for v in vars:
-        for flag in sorted((d.getVarFlags(v) or {}).keys()):
-            if flag == "doc" or flag == "vardeps" or flag == "vardepsexp":
-                continue
-            d.appendVar('%s_VARDEPS' % (v), ' %s:%s' % (flag, d.getVarFlag(v, flag, False)))
-    for p in pkgs:
-        for v in vars:
-            for flag in sorted((d.getVarFlags("%s:%s" % (v,p)) or {}).keys()):
-                if flag == "doc" or flag == "vardeps" or flag == "vardepsexp":
-                    continue
-                d.appendVar('%s_VARDEPS_%s' % (v,p), ' %s:%s' % (flag, d.getVarFlag('%s:%s' % (v,p), flag, False)))
 def ua_extend_depends(d):
    if not 'virtual/update-alternatives' in d.getVar('PROVIDES'):
        d.appendVar('DEPENDS', ' virtual/${MLPREFIX}update-alternatives')
@@ -112,9 +94,6 @@ python __anonymous() {
    if not update_alternatives_enabled(d):
        return
-    # compute special vardeps
-    gen_updatealternativesvardeps(d)
    # extend the depends to include virtual/update-alternatives
    ua_extend_depends(d)
 }
@@ -124,13 +103,20 @@ def gen_updatealternativesvars(d):
    pkgs = (d.getVar("PACKAGES") or "").split()
    vars = (d.getVar("UPDALTVARS") or "").split()
+    # First compute them for non_pkg versions
    for v in vars:
-        ret.append(v + "_VARDEPS")
+        for flag in sorted((d.getVarFlags(v) or {}).keys()):
+            if flag == "doc" or flag == "vardeps" or flag == "vardepsexp":
+                continue
+            ret.append(v + "[" + flag + "]")
    for p in pkgs:
        for v in vars:
-            ret.append(v + ":" + p)
+            for flag in sorted((d.getVarFlags("%s:%s" % (v,p)) or {}).keys()):
-            ret.append(v + "_VARDEPS_" + p)
+                if flag == "doc" or flag == "vardeps" or flag == "vardepsexp":
+                    continue
+                ret.append('%s:%s' % (v,p) + "[" + flag + "]")
    return " ".join(ret)
 # Now the new stuff, we use a custom function to generate the right values
diff --git a/meta/classes/icecc.bbclass b/meta/classes/icecc.bbclass
deleted file mode 100644
index 8a48f2ad63..0000000000
--- a/meta/classes/icecc.bbclass
+++ /dev/null
@@ -1,443 +0,0 @@
-#
-# Copyright OpenEmbedded Contributors
-#
-# SPDX-License-Identifier: MIT
-#
-# Icecream distributed compiling support
-#
-# Stages directories with symlinks from gcc/g++ to icecc, for both
-# native and cross compilers. Depending on each configure or compile,
-# the directories are added at the head of the PATH list and ICECC_CXX
-# and ICECC_CC are set.
-#
-# For the cross compiler, creates a tar.gz of our toolchain and sets
-# ICECC_VERSION accordingly.
-#
-# The class now handles all 3 different compile 'stages' (i.e native ,cross-kernel and target) creating the
-# necessary environment tar.gz file to be used by the remote machines.
-# It also supports meta-toolchain generation.
-#
-# If ICECC_PATH is not set in local.conf then the class will try to locate it using 'bb.utils.which'
-# but nothing is sure. ;)
-#
-# If ICECC_ENV_EXEC is set in local.conf, then it should point to the icecc-create-env script provided by the user
-# or the default one provided by icecc-create-env_0.1.bb will be used.
-# (NOTE that this is a modified version of the needed script and *not the one that comes with icecream*).
-#
-# User can specify if specific recipes or recipes inheriting specific classes should not use icecc to distribute
-# compile jobs to remote machines, but handle them locally by defining ICECC_CLASS_DISABLE and ICECC_RECIPE_DISABLE
-# with the appropriate values in local.conf. In addition the user can force to enable icecc for recipes
-# which set an empty PARALLEL_MAKE variable by defining ICECC_RECIPE_ENABLE.
-#
-#########################################################################################
-# Error checking is kept to minimum so double check any parameters you pass to the class
-#########################################################################################
-BB_BASEHASH_IGNORE_VARS += "ICECC_PARALLEL_MAKE ICECC_DISABLED ICECC_RECIPE_DISABLE \
-    ICECC_CLASS_DISABLE ICECC_RECIPE_ENABLE ICECC_PATH ICECC_ENV_EXEC \
-    ICECC_CARET_WORKAROUND ICECC_CFLAGS ICECC_ENV_VERSION \
-    ICECC_DEBUG ICECC_LOGFILE ICECC_REPEAT_RATE ICECC_PREFERRED_HOST \
-    ICECC_CLANG_REMOTE_CPP ICECC_IGNORE_UNVERIFIED ICECC_TEST_SOCKET \
-    ICECC_ENV_DEBUG ICECC_REMOTE_CPP \
-    "
-ICECC_ENV_EXEC ?= "${STAGING_BINDIR_NATIVE}/icecc-create-env"
-HOSTTOOLS_NONFATAL += "icecc patchelf"
-# This version can be incremented when changes are made to the environment that
-# invalidate the version on the compile nodes. Changing it will cause a new
-# environment to be created.
-#
-# A useful thing to do for testing icecream changes locally is to add a
-# subversion in local.conf:
-#  ICECC_ENV_VERSION:append = "-my-ver-1"
-ICECC_ENV_VERSION = "2"
-# Default to disabling the caret workaround, If set to "1" in local.conf, icecc
-# will locally recompile any files that have warnings, which can adversely
-# affect performance.
-#
-# See: https://github.com/icecc/icecream/issues/190
-export ICECC_CARET_WORKAROUND ??= "0"
-export ICECC_REMOTE_CPP ??= "0"
-ICECC_CFLAGS = ""
-CFLAGS += "${ICECC_CFLAGS}"
-CXXFLAGS += "${ICECC_CFLAGS}"
-# Debug flags when generating environments
-ICECC_ENV_DEBUG ??= ""
-# Disable recipe list contains a list of recipes that can not distribute
-# compile tasks for one reason or the other. When adding a new entry, please
-# document why (how it failed) so that we can re-evaluate it later e.g. when
-# there is a new version.
-#
-# libgcc-initial - fails with CPP sanity check error if host sysroot contains
-#                  cross gcc built for another target tune/variant.
-# pixman - prng_state: TLS reference mismatches non-TLS reference, possibly due to
-#          pragma omp threadprivate(prng_state).
-# systemtap - _HelperSDT.c undefs macros and uses the identifiers in macros emitting
-#             inline assembly.
-# target-sdk-provides-dummy - ${HOST_PREFIX} is empty which triggers the "NULL
-#                             prefix" error.
-ICECC_RECIPE_DISABLE += "\
-    libgcc-initial \
-    pixman \
-    systemtap \
-    target-sdk-provides-dummy \
-    "
-# Classes that should not use icecc. When adding a new entry, please
-# document why (how it failed) so that we can re-evaluate it later.
-#
-# image - images aren't compiling, but the testing framework for images captures
-#         PARALLEL_MAKE as part of the test environment. Many tests won't use
-#         icecream, but leaving the high level of parallelism can cause them to
-#         consume an unnecessary amount of resources.
-ICECC_CLASS_DISABLE += "\
-    image \
-    "
-def get_icecc_dep(d):
-    # INHIBIT_DEFAULT_DEPS doesn't apply to the patch command. Whether or not
-    # we need that built is the responsibility of the patch function / class, not
-    # the application.
-    if not d.getVar('INHIBIT_DEFAULT_DEPS'):
-        return "icecc-create-env-native"
-    return ""
-DEPENDS:prepend = "${@get_icecc_dep(d)} "
-get_cross_kernel_cc[vardepsexclude] += "KERNEL_CC"
-def get_cross_kernel_cc(bb,d):
-    if not icecc_is_kernel(bb, d):
-        return None
-    # evaluate the expression by the shell if necessary
-    kernel_cc = d.getVar('KERNEL_CC')
-    if '`' in kernel_cc or '$(' in kernel_cc:
-        import subprocess
-        kernel_cc = subprocess.check_output("echo %s" % kernel_cc, shell=True).decode("utf-8")[:-1]
-    kernel_cc = kernel_cc.replace('ccache', '').strip()
-    kernel_cc = kernel_cc.split(' ')[0]
-    kernel_cc = kernel_cc.strip()
-    return kernel_cc
-def get_icecc(d):
-    return d.getVar('ICECC_PATH') or bb.utils.which(os.getenv("PATH"), "icecc")
-def use_icecc(bb,d):
-    if d.getVar('ICECC_DISABLED') == "1":
-        # don't even try it, when explicitly disabled
-        return "no"
-    # allarch recipes don't use compiler
-    if icecc_is_allarch(bb, d):
-        return "no"
-    if icecc_is_cross_canadian(bb, d):
-        return "no"
-    pn = d.getVar('PN')
-    bpn = d.getVar('BPN')
-    # Enable/disable checks are made against BPN, because there is a good
-    # chance that if icecc should be skipped for a recipe, it should be skipped
-    # for all the variants of that recipe. PN is still checked in case a user
-    # specified a more specific recipe.
-    check_pn = set([pn, bpn])
-    class_disable = (d.getVar('ICECC_CLASS_DISABLE') or "").split()
-    for bbclass in class_disable:
-        if bb.data.inherits_class(bbclass, d):
-            bb.debug(1, "%s: bbclass %s found in disable, disable icecc" % (pn, bbclass))
-            return "no"
-    disabled_recipes = (d.getVar('ICECC_RECIPE_DISABLE') or "").split()
-    enabled_recipes = (d.getVar('ICECC_RECIPE_ENABLE') or "").split()
-    if check_pn & set(disabled_recipes):
-        bb.debug(1, "%s: found in disable list, disable icecc" % pn)
-        return "no"
-    if check_pn & set(enabled_recipes):
-        bb.debug(1, "%s: found in enabled recipes list, enable icecc" % pn)
-        return "yes"
-    if d.getVar('PARALLEL_MAKE') == "":
-        bb.debug(1, "%s: has empty PARALLEL_MAKE, disable icecc" % pn)
-        return "no"
-    return "yes"
-def icecc_is_allarch(bb, d):
-    return d.getVar("PACKAGE_ARCH") == "all"
-def icecc_is_kernel(bb, d):
-    return \
-        bb.data.inherits_class("kernel", d);
-def icecc_is_native(bb, d):
-    return \
-        bb.data.inherits_class("cross", d) or \
-        bb.data.inherits_class("native", d);
-def icecc_is_cross_canadian(bb, d):
-    return bb.data.inherits_class("cross-canadian", d)
-def icecc_dir(bb, d):
-    return d.expand('${TMPDIR}/work-shared/ice')
-# Don't pollute allarch signatures with TARGET_FPU
-icecc_version[vardepsexclude] += "TARGET_FPU"
-def icecc_version(bb, d):
-    if use_icecc(bb, d) == "no":
-        return ""
-    parallel = d.getVar('ICECC_PARALLEL_MAKE') or ""
-    if not d.getVar('PARALLEL_MAKE') == "" and parallel:
-        d.setVar("PARALLEL_MAKE", parallel)
-    # Disable showing the caret in the GCC compiler output if the workaround is
-    # disabled
-    if d.getVar('ICECC_CARET_WORKAROUND') == '0':
-        d.setVar('ICECC_CFLAGS', '-fno-diagnostics-show-caret')
-    if icecc_is_native(bb, d):
-        archive_name = "local-host-env"
-    elif d.expand('${HOST_PREFIX}') == "":
-        bb.fatal(d.expand("${PN}"), " NULL prefix")
-    else:
-        prefix = d.expand('${HOST_PREFIX}' )
-        distro = d.expand('${DISTRO}')
-        target_sys = d.expand('${TARGET_SYS}')
-        float = d.getVar('TARGET_FPU') or "hard"
-        archive_name = prefix + distro + "-"        + target_sys + "-" + float
-        if icecc_is_kernel(bb, d):
-            archive_name += "-kernel"
-    import socket
-    ice_dir = icecc_dir(bb, d)
-    tar_file = os.path.join(ice_dir, "{archive}-{version}-@VERSION@-{hostname}.tar.gz".format(
-        archive=archive_name,
-        version=d.getVar('ICECC_ENV_VERSION'),
-        hostname=socket.gethostname()
-        ))
-    return tar_file
-def icecc_path(bb,d):
-    if use_icecc(bb, d) == "no":
-        # don't create unnecessary directories when icecc is disabled
-        return
-    staging = os.path.join(d.expand('${STAGING_BINDIR}'), "ice")
-    if icecc_is_kernel(bb, d):
-        staging += "-kernel"
-    return staging
-def icecc_get_external_tool(bb, d, tool):
-    external_toolchain_bindir = d.expand('${EXTERNAL_TOOLCHAIN}${bindir_cross}')
-    target_prefix = d.expand('${TARGET_PREFIX}')
-    return os.path.join(external_toolchain_bindir, '%s%s' % (target_prefix, tool))
-def icecc_get_tool_link(tool, d):
-    import subprocess
-    try:
-        return subprocess.check_output("readlink -f %s" % tool, shell=True).decode("utf-8")[:-1]
-    except subprocess.CalledProcessError as e:
-        bb.note("icecc: one of the tools probably disappeared during recipe parsing, cmd readlink -f %s returned %d:\n%s" % (tool, e.returncode, e.output.decode("utf-8")))
-        return tool
-def icecc_get_path_tool(tool, d):
-    # This is a little ugly, but we want to make sure we add an actual
-    # compiler to the toolchain, not ccache. Some distros (e.g. Fedora)
-    # have ccache enabled by default using symlinks in PATH, meaning ccache
-    # would be found first when looking for the compiler.
-    paths = os.getenv("PATH").split(':')
-    while True:
-        p, hist = bb.utils.which(':'.join(paths), tool, history=True)
-        if not p or os.path.basename(icecc_get_tool_link(p, d)) != 'ccache':
-            return p
-        paths = paths[len(hist):]
-    return ""
-# Don't pollute native signatures with target TUNE_PKGARCH through STAGING_BINDIR_TOOLCHAIN
-icecc_get_tool[vardepsexclude] += "STAGING_BINDIR_TOOLCHAIN"
-def icecc_get_tool(bb, d, tool):
-    if icecc_is_native(bb, d):
-        return icecc_get_path_tool(tool, d)
-    elif icecc_is_kernel(bb, d):
-        return icecc_get_path_tool(get_cross_kernel_cc(bb, d), d)
-    else:
-        ice_dir = d.expand('${STAGING_BINDIR_TOOLCHAIN}')
-        target_sys = d.expand('${TARGET_SYS}')
-        for p in ice_dir.split(':'):
-            tool_bin = os.path.join(p, "%s-%s" % (target_sys, tool))
-            if os.path.isfile(tool_bin):
-                return tool_bin
-        external_tool_bin = icecc_get_external_tool(bb, d, tool)
-        if os.path.isfile(external_tool_bin):
-            return external_tool_bin
-        return ""
-def icecc_get_and_check_tool(bb, d, tool):
-    # Check that g++ or gcc is not a symbolic link to icecc binary in
-    # PATH or icecc-create-env script will silently create an invalid
-    # compiler environment package.
-    t = icecc_get_tool(bb, d, tool)
-    if t:
-        link_path = icecc_get_tool_link(t, d)
-        if link_path == get_icecc(d):
-            bb.error("%s is a symlink to %s in PATH and this prevents icecc from working" % (t, link_path))
-            return ""
-        else:
-            return t
-    else:
-        return t
-set_icecc_env[vardepsexclude] += "KERNEL_CC"
-python set_icecc_env() {
-    import os
-    import subprocess
-    if use_icecc(bb, d) == "no":
-        return
-    ICECC_VERSION = icecc_version(bb, d)
-    if not ICECC_VERSION:
-        bb.warn("Cannot use icecc: could not get ICECC_VERSION")
-        return
-    ICE_PATH = icecc_path(bb, d)
-    if not ICE_PATH:
-        bb.warn("Cannot use icecc: could not get ICE_PATH")
-        return
-    ICECC_BIN = get_icecc(d)
-    if not ICECC_BIN:
-        bb.warn("Cannot use icecc: icecc binary not found")
-        return
-    if (not bb.utils.which(os.getenv("PATH"), "patchelf") and
-        not bb.utils.which(os.getenv("PATH"), "patchelf-uninative")):
-        bb.warn("Cannot use icecc: patchelf not found")
-        return
-    ICECC_CC = icecc_get_and_check_tool(bb, d, "gcc")
-    ICECC_CXX = icecc_get_and_check_tool(bb, d, "g++")
-    # cannot use icecc_get_and_check_tool here because it assumes as without target_sys prefix
-    ICECC_WHICH_AS = bb.utils.which(os.getenv('PATH'), 'as')
-    if (not os.access(ICECC_CC, os.X_OK) or
-        not os.access(ICECC_CXX, os.X_OK)):
-        bb.note("Cannot use icecc: could not get ICECC_CC or ICECC_CXX")
-        return
-    cmd = []
-    try:
-        cmd = [ICECC_CC, '-dumpversion']
-        ICE_VERSION = subprocess.check_output(cmd).decode("utf-8").strip()
-    except subprocess.CalledProcessError as e:
-        bb.warn("icecc: '{}' returned {}:\n{}".format(cmd, e.returncode, e.output.decode("utf-8")))
-        return
-    ICECC_VERSION = ICECC_VERSION.replace("@VERSION@", ICE_VERSION)
-    if not os.access(d.getVar('ICECC_ENV_EXEC'), os.X_OK):
-        bb.warn("Cannot use icecc: invalid ICECC_ENV_EXEC")
-        return
-    # Create symlinks to icecc and wrapper-scripts in the recipe-sysroot directory
-    symlink_path = os.path.join(ICE_PATH, "symlinks")
-    bb.utils.mkdirhier(symlink_path)
-    compilers = []
-    if icecc_is_kernel(bb, d):
-        compilers.append(get_cross_kernel_cc(bb,d))
-    else:
-        host_prefix = d.getVar('HOST_PREFIX')
-        compilers.extend([host_prefix + 'gcc', host_prefix + 'g++'])
-    for compiler in compilers:
-        try:
-            os.symlink(ICECC_BIN, symlink_path + '/' + compiler)
-        except FileExistsError:
-            pass
-        wrapper_script = os.path.join(ICE_PATH, compiler)
-        with open(wrapper_script, 'w') as fd:
-            fd.write("#!/bin/sh -e\n")
-            fd.write("export ICECC_VERSION={}\n".format(ICECC_VERSION))
-            fd.write("export ICECC_CC={}\n".format(ICECC_CC))
-            fd.write("export ICECC_CXX={}\n".format(ICECC_CXX))
-            fd.write("{} \"$@\"\n".format(os.path.join(ICE_PATH, "symlinks", compiler)))
-        os.chmod(wrapper_script, 0o755)
-    try:
-        cmd = [ICECC_CC, '-print-prog-name=as']
-        ICECC_AS = subprocess.check_output(cmd).decode("utf-8").strip()
-    except subprocess.CalledProcessError as e:
-        bb.warn("icecc: '{}' returned {}:\n{}".format(cmd, e.returncode, e.output.decode("utf-8")))
-        return
-    # for target recipes should return something like:
-    # /OE/tmp-eglibc/sysroots/x86_64-linux/usr/libexec/arm920tt-oe-linux-gnueabi/gcc/arm-oe-linux-gnueabi/4.8.2/as
-    # and just "as" for native, if it returns "as" in current directory (for whatever reason) use "as" from PATH
-    if not os.path.dirname(ICECC_AS):
-        ICECC_AS = ICECC_WHICH_AS
-    if not os.path.isfile(ICECC_VERSION + ".done"):
-        bb.utils.mkdirhier(os.path.dirname(ICECC_VERSION))
-        # the ICECC_VERSION generation step must be locked by a mutex
-        # in order to prevent race conditions
-        lock = bb.utils.lockfile(ICECC_VERSION + '.lock')
-        try:
-            cmd = [d.getVar('ICECC_ENV_EXEC')]
-            if d.getVar('ICECC_ENV_DEBUG'):
-                cmd.append(d.getVar('ICECC_ENV_DEBUG'))
-            cmd.extend([ICECC_CC, ICECC_CXX, ICECC_AS, ICECC_VERSION])
-            subprocess.check_output(cmd)
-            cmd = ['touch', ICECC_VERSION + '.done']
-            subprocess.check_output(cmd)
-        except subprocess.CalledProcessError as e:
-            bb.warn("icecc: '{}' returned {}:\n{}".format(cmd, e.returncode, e.output.decode("utf-8")))
-            bb.utils.unlockfile(lock)
-            return
-        bb.utils.unlockfile(lock)
-    # Don't let ccache find the icecream compiler links that have been created, otherwise
-    # it can end up invoking icecream recursively.
-    d.setVar('CCACHE_PATH', d.getVar('PATH'))
-    d.setVar('CCACHE_DISABLE', '1')
-    d.prependVar('PATH', ICE_PATH + ':')
-    bb.note("Using icecc path: {}".format(ICE_PATH))
-    bb.note("Using icecc tarball: {}".format(ICECC_VERSION))
-}
-do_configure[prefuncs] += "set_icecc_env"
-do_compile[prefuncs] += "set_icecc_env"
-do_compile_kernelmodules[prefuncs] += "set_icecc_env"
-do_install[prefuncs] += "set_icecc_env"
-# Icecream is not (currently) supported in the extensible SDK
-ICECC_SDK_HOST_TASK = "nativesdk-icecc-toolchain"
-ICECC_SDK_HOST_TASK:task-populate-sdk-ext = ""
-# Don't include icecream in uninative tarball
-ICECC_SDK_HOST_TASK:pn-uninative-tarball = ""
-# Add the toolchain scripts to the SDK
-TOOLCHAIN_HOST_TASK:append = " ${ICECC_SDK_HOST_TASK}"
-python () {
-    if d.getVar('ICECC_DISABLED') != "1":
-        for task in ['do_configure', 'do_compile', 'do_compile_kernelmodules', 'do_install']:
-                d.setVarFlag(task, 'network', '1')
-}
diff --git a/meta/classes/multilib.bbclass b/meta/classes/multilib.bbclass
index a4151658a6..b959bbd93c 100644
--- a/meta/classes/multilib.bbclass
+++ b/meta/classes/multilib.bbclass
@@ -21,6 +21,7 @@ python multilib_virtclass_handler () {
    bpn = d.getVar("BPN")
    if ("virtual/kernel" in provides
            or bb.data.inherits_class('module-base', d)
+            or bb.data.inherits_class('kernel-fit-image', d)
            or bpn in non_ml_recipes):
        raise bb.parse.SkipRecipe("We shouldn't have multilib variants for %s" % bpn)
diff --git a/meta/conf/bitbake.conf b/meta/conf/bitbake.conf
index 13d55923b7..52e74a6879 100644
--- a/meta/conf/bitbake.conf
+++ b/meta/conf/bitbake.conf
@@ -518,7 +518,7 @@ HOSTTOOLS += " \
    [ ar as awk basename bash bunzip2 bzip2 cat chgrp chmod chown chrpath cmp comm cp cpio \
    cpp cut date dd diff diffstat dirname du echo egrep env expand expr false \
    fgrep file find flock g++ gawk gcc getconf getopt git grep gunzip gzip \
-    head hostname iconv id install ld ldd ln ls lz4 make md5sum mkdir mkfifo mknod \
+    head hostname iconv id install ld ldd ln ls make md5sum mkdir mkfifo mknod \
    mktemp mv nm objcopy objdump od patch perl pr printf pwd \
    python3 pzstd ranlib readelf readlink realpath rm rmdir rpcgen sed seq sh \
    sha1sum sha224sum sha256sum sha384sum sha512sum \
diff --git a/meta/conf/distro/include/distro_alias.inc b/meta/conf/distro/include/distro_alias.inc
index 8052464f1d..20882523c2 100644
--- a/meta/conf/distro/include/distro_alias.inc
+++ b/meta/conf/distro/include/distro_alias.inc
@@ -105,7 +105,6 @@ DISTRO_PN_ALIAS:pn-gtk-icon-utils-native = "OSPDT"
 DISTRO_PN_ALIAS:pn-systemd-boot = "Ubuntu=systemd-boot Fedora=systemd-boot"
 DISTRO_PN_ALIAS:pn-hello-mod = "OE-Core"
 DISTRO_PN_ALIAS:pn-hwlatdetect = "OSPDT"
-DISTRO_PN_ALIAS:pn-icecc-create-env = "OE-Core"
 DISTRO_PN_ALIAS:pn-init-ifupdown = "Debian=ifupdown Ubuntu=ifupdown"
 DISTRO_PN_ALIAS:pn-initramfs-boot = "OE-Core"
 DISTRO_PN_ALIAS:pn-initramfs-framework = "OE-Core"
diff --git a/meta/conf/distro/include/maintainers.inc b/meta/conf/distro/include/maintainers.inc
index e5d24ac2c8..5c315d58cf 100644
--- a/meta/conf/distro/include/maintainers.inc
+++ b/meta/conf/distro/include/maintainers.inc
@@ -272,7 +272,6 @@ RECIPE_MAINTAINER:pn-hicolor-icon-theme = "Anuj Mittal <anuj.mittal@intel.com>"
 RECIPE_MAINTAINER:pn-hwdata = "Hiago De Franco <hiago.franco@toradex.com>"
 RECIPE_MAINTAINER:pn-hwlatdetect = "Unassigned <unassigned@yoctoproject.org>"
 RECIPE_MAINTAINER:pn-i2c-tools = "Anuj Mittal <anuj.mittal@intel.com>"
-RECIPE_MAINTAINER:pn-icecc-create-env = "Joshua Watt <JPEWhacker@gmail.com>"
 RECIPE_MAINTAINER:pn-icon-naming-utils = "Richard Purdie <richard.purdie@linuxfoundation.org>"
 RECIPE_MAINTAINER:pn-icu = "Unassigned <unassigned@yoctoproject.org>"
 RECIPE_MAINTAINER:pn-ifupdown = "Anuj Mittal <anuj.mittal@intel.com>"
@@ -307,6 +306,7 @@ RECIPE_MAINTAINER:pn-kbd = "Unassigned <unassigned@yoctoproject.org>"
 RECIPE_MAINTAINER:pn-kea = "Unassigned <unassigned@yoctoproject.org>"
 RECIPE_MAINTAINER:pn-kern-tools-native = "Bruce Ashfield <bruce.ashfield@gmail.com>"
 RECIPE_MAINTAINER:pn-kernel-devsrc = "Bruce Ashfield <bruce.ashfield@gmail.com>"
+RECIPE_MAINTAINER:pn-kernel-signing-keys-native = "Adrian Freihofer <adrian.freihofer@siemens.com>"
 RECIPE_MAINTAINER:pn-kexec-tools = "Unassigned <unassigned@yoctoproject.org>"
 RECIPE_MAINTAINER:pn-keymaps = "Unassigned <unassigned@yoctoproject.org>"
 RECIPE_MAINTAINER:pn-kmod = "Chen Qi <Qi.Chen@windriver.com>"
@@ -471,6 +471,7 @@ RECIPE_MAINTAINER:pn-libxxf86vm = "Unassigned <unassigned@yoctoproject.org>"
 RECIPE_MAINTAINER:pn-libyaml = "Wang Mingyu <wangmy@fujitsu.com>"
 RECIPE_MAINTAINER:pn-lighttpd = "Unassigned <unassigned@yoctoproject.org>"
 RECIPE_MAINTAINER:pn-linux-dummy = "Unassigned <unassigned@yoctoproject.org>"
+RECIPE_MAINTAINER:pn-linux-yocto-fitimage = "Adrian Freihofer <adrian.freihofer@siemens.com>"
 RECIPE_MAINTAINER:pn-linux-firmware = "Otavio Salvador <otavio.salvador@ossystems.com.br>"
 RECIPE_MAINTAINER:pn-linux-libc-headers = "Bruce Ashfield <bruce.ashfield@gmail.com>"
 RECIPE_MAINTAINER:pn-linux-yocto = "Bruce Ashfield <bruce.ashfield@gmail.com>"
@@ -546,7 +547,6 @@ RECIPE_MAINTAINER:pn-musl-utils = "Khem Raj <raj.khem@gmail.com>"
 RECIPE_MAINTAINER:pn-nasm = "Richard Purdie <richard.purdie@linuxfoundation.org>"
 RECIPE_MAINTAINER:pn-nativesdk-buildtools-perl-dummy = "Richard Purdie <richard.purdie@linuxfoundation.org>"
 RECIPE_MAINTAINER:pn-nativesdk-clang-glue = "Khem Raj <raj.khem@gmail.com>"
-RECIPE_MAINTAINER:pn-nativesdk-icecc-toolchain = "Joshua Watt <JPEWhacker@gmail.com>"
 RECIPE_MAINTAINER:pn-nativesdk-libtool = "Richard Purdie <richard.purdie@linuxfoundation.org>"
 RECIPE_MAINTAINER:pn-nativesdk-packagegroup-sdk-host = "Ross Burton <ross.burton@arm.com>"
 RECIPE_MAINTAINER:pn-nativesdk-qemu-helper = "Richard Purdie <richard.purdie@linuxfoundation.org>"
diff --git a/meta/conf/documentation.conf b/meta/conf/documentation.conf
index 570a604494..2710485227 100644
--- a/meta/conf/documentation.conf
+++ b/meta/conf/documentation.conf
@@ -201,11 +201,6 @@ HOST_VENDOR[doc] = "The name of the vendor. Normally same as the TARGET_VENDOR."
 #I
-ICECC_ENV_EXEC[doc] = "Points to the icecc-create-env script that you provide."
-ICECC_PATH[doc] = "The location of the icecc binary."
-ICECC_CLASS_DISABLE[doc] = "Identifies user classes that you do not want the Icecream distributed compile support to consider."
-ICECC_RECIPE_DISABLE[doc] = "Identifies user recipes that you do not want the Icecream distributed compile support to consider."
-ICECC_RECIPE_ENABLE[doc] = "Identifies user recipes that use an empty PARALLEL_MAKE variable that you want to force remote distributed compilation on using the Icecream distributed compile support."
 IMAGE_BASENAME[doc] = "The base name of image output files."
 IMAGE_BOOT_FILES[doc] = "Whitespace separated list of files from ${DEPLOY_DIR_IMAGE} to place in boot partition. Entries will be installed under a same name as the source file. To change the destination file name, pass a desired name after a semicolon (eg. u-boot.img;uboot)."
 IMAGE_CLASSES[doc] = "A list of classes that all images should inherit."
diff --git a/meta/conf/fragments/yocto/sstate-mirror-cdn.conf b/meta/conf/fragments/yocto/sstate-mirror-cdn.conf
new file mode 100644
index 0000000000..e204975ce3
--- /dev/null
+++ b/meta/conf/fragments/yocto/sstate-mirror-cdn.conf
@@ -0,0 +1,12 @@
+BB_CONF_FRAGMENT_SUMMARY = "Use prebuilt sstate artifacts for standard Yocto build configurations."
+BB_CONF_FRAGMENT_DESCRIPTION = "The Yocto Project has prebuilt artefacts available for standard build configurations. \
+This fragment enables their use. This will mean the build will query the \
+the network to check for artefacts at the start of builds, which does slow it down \
+initially but it will then speed up the builds by not having to build things if they are \
+present in the cache. It assumes you can download something faster than you can build it \
+which will depend on your network. \
+Note: For this to work you also need hash-equivalence passthrough to the matching server \
+"
+BB_HASHSERVE_UPSTREAM = 'wss://hashserv.yoctoproject.org/ws'
+SSTATE_MIRRORS ?= "file://.* http://sstate.yoctoproject.org/all/PATH;downloadfilename=PATH"
diff --git a/meta/conf/layer.conf b/meta/conf/layer.conf
index e19431e724..44267ce8e2 100644
--- a/meta/conf/layer.conf
+++ b/meta/conf/layer.conf
@@ -53,7 +53,6 @@ SIGGEN_EXCLUDE_SAFE_RECIPE_DEPS += " \
  *->quilt-native \
  *->subversion-native \
  *->git-native \
-  *->icecc-create-env-native \
  gcc-cross-${TARGET_ARCH}->linux-libc-headers \
  ppp-dialin->ppp \
  resolvconf->bash \
diff --git a/meta/lib/oe/fitimage.py b/meta/lib/oe/fitimage.py
new file mode 100644
index 0000000000..f303799155
--- /dev/null
+++ b/meta/lib/oe/fitimage.py
@@ -0,0 +1,547 @@
+#
+# Copyright OpenEmbedded Contributors
+#
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# This file contains common functions for the fitimage generation
+import os
+import shlex
+import subprocess
+import bb
+from oeqa.utils.commands import runCmd
+class ItsNode:
+    INDENT_SIZE = 8
+    def __init__(self, name, parent_node, sub_nodes=None, properties=None):
+        self.name = name
+        self.parent_node = parent_node
+        self.sub_nodes = []
+        if sub_nodes:
+            self.sub_nodes = sub_nodes
+        self.properties = {}
+        if properties:
+            self.properties = properties
+        if parent_node:
+            parent_node.add_sub_node(self)
+    def add_sub_node(self, sub_node):
+        self.sub_nodes.append(sub_node)
+    def add_property(self, key, value):
+        self.properties[key] = value
+    def emit(self, f, indent):
+        indent_str_name = " " * indent
+        indent_str_props = " " * (indent + self.INDENT_SIZE)
+        f.write("%s%s {\n" % (indent_str_name, self.name))
+        for key, value in self.properties.items():
+            bb.debug(1, "key: %s, value: %s" % (key, str(value)))
+            # Single integer: <0x12ab>
+            if isinstance(value, int):
+                f.write(indent_str_props + key + ' = <0x%x>;\n' % value)
+            # list of strings: "string1", "string2" or integers: <0x12ab 0x34cd>
+            elif isinstance(value, list):
+                if len(value) == 0:
+                    f.write(indent_str_props + key + ' = "";\n')
+                elif isinstance(value[0], int):
+                    list_entries = ' '.join('0x%x' % entry for entry in value)
+                    f.write(indent_str_props + key + ' = <%s>;\n' % list_entries)
+                else:
+                    list_entries = ', '.join('"%s"' % entry for entry in value)
+                    f.write(indent_str_props + key + ' = %s;\n' % list_entries)
+            elif isinstance(value, str):
+                # path: /incbin/("path/to/file")
+                if key in ["data"] and value.startswith('/incbin/('):
+                    f.write(indent_str_props + key + ' = %s;\n' % value)
+                # Integers which are already string formatted
+                elif value.startswith("<") and value.endswith(">"):
+                    f.write(indent_str_props + key + ' = %s;\n' % value)
+                else:
+                    f.write(indent_str_props + key + ' = "%s";\n' % value)
+            else:
+                bb.fatal("%s has unexpexted data type." % str(value))
+        for sub_node in self.sub_nodes:
+            sub_node.emit(f, indent + self.INDENT_SIZE)
+        f.write(indent_str_name + '};\n')
+class ItsNodeImages(ItsNode):
+    def __init__(self, parent_node):
+        super().__init__("images", parent_node)
+class ItsNodeConfigurations(ItsNode):
+    def __init__(self, parent_node):
+        super().__init__("configurations", parent_node)
+class ItsNodeHash(ItsNode):
+    def __init__(self, name, parent_node, algo, opt_props=None):
+        properties = {
+            "algo": algo
+        }
+        if opt_props:
+            properties.update(opt_props)
+        super().__init__(name, parent_node, None, properties)
+class ItsImageSignature(ItsNode):
+    def __init__(self, name, parent_node, algo, keyname, opt_props=None):
+        properties = {
+            "algo": algo,
+            "key-name-hint": keyname
+        }
+        if opt_props:
+            properties.update(opt_props)
+        super().__init__(name, parent_node, None, properties)
+class ItsNodeImage(ItsNode):
+    def __init__(self, name, parent_node, description, type, compression, sub_nodes=None, opt_props=None):
+        properties = {
+            "description": description,
+            "type": type,
+            "compression": compression,
+        }
+        if opt_props:
+            properties.update(opt_props)
+        super().__init__(name, parent_node, sub_nodes, properties)
+class ItsNodeDtb(ItsNodeImage):
+    def __init__(self, name, parent_node, description, type, compression,
+                 sub_nodes=None, opt_props=None, compatible=None):
+        super().__init__(name, parent_node, description, type, compression, sub_nodes, opt_props)
+        self.compatible = compatible
+class ItsNodeDtbAlias(ItsNode):
+    """Additional Configuration Node for a DTB
+    Symlinks pointing to a DTB file are handled by an addtitional
+    configuration node referring to another DTB image node.
+    """
+    def __init__(self, name, alias_name, compatible=None):
+        super().__init__(name, parent_node=None, sub_nodes=None, properties=None)
+        self.alias_name = alias_name
+        self.compatible = compatible
+class ItsNodeConfigurationSignature(ItsNode):
+    def __init__(self, name, parent_node, algo, keyname, opt_props=None):
+        properties = {
+            "algo": algo,
+            "key-name-hint": keyname
+        }
+        if opt_props:
+            properties.update(opt_props)
+        super().__init__(name, parent_node, None, properties)
+class ItsNodeConfiguration(ItsNode):
+    def __init__(self, name, parent_node, description, sub_nodes=None, opt_props=None):
+        properties = {
+            "description": description,
+        }
+        if opt_props:
+            properties.update(opt_props)
+        super().__init__(name, parent_node, sub_nodes, properties)
+class ItsNodeRootKernel(ItsNode):
+    """Create FIT images for the kernel
+    Currently only a single kernel (no less or more) can be added to the FIT
+    image along with 0 or more device trees and 0 or 1 ramdisk.
+    If a device tree included in the FIT image, the default configuration is the
+    firt DTB. If there is no dtb present than the default configuation the kernel.
+    """
+    def __init__(self, description, address_cells, host_prefix, arch, conf_prefix,
+                 sign_enable=False, sign_keydir=None,
+                 mkimage=None, mkimage_dtcopts=None,
+                 mkimage_sign=None, mkimage_sign_args=None,
+                 hash_algo=None, sign_algo=None, pad_algo=None,
+                 sign_keyname_conf=None,
+                 sign_individual=False, sign_keyname_img=None):
+        props = {
+            "description": description,
+            "#address-cells": f"<{address_cells}>"
+        }
+        super().__init__("/", None, None, props)
+        self.images = ItsNodeImages(self)
+        self.configurations = ItsNodeConfigurations(self)
+        self._host_prefix = host_prefix
+        self._arch = arch
+        self._conf_prefix = conf_prefix
+        # Signature related properties
+        self._sign_enable = sign_enable
+        self._sign_keydir = sign_keydir
+        self._mkimage = mkimage
+        self._mkimage_dtcopts = mkimage_dtcopts
+        self._mkimage_sign = mkimage_sign
+        self._mkimage_sign_args = mkimage_sign_args
+        self._hash_algo = hash_algo
+        self._sign_algo = sign_algo
+        self._pad_algo = pad_algo
+        self._sign_keyname_conf = sign_keyname_conf
+        self._sign_individual = sign_individual
+        self._sign_keyname_img = sign_keyname_img
+        self._sanitize_sign_config()
+        self._dtbs = []
+        self._dtb_alias = []
+        self._kernel = None
+        self._ramdisk = None
+        self._bootscr = None
+        self._setup = None
+    def _sanitize_sign_config(self):
+        if self._sign_enable:
+            if not self._hash_algo:
+                bb.fatal("FIT image signing is enabled but no hash algorithm is provided.")
+            if not self._sign_algo:
+                bb.fatal("FIT image signing is enabled but no signature algorithm is provided.")
+            if not self._pad_algo:
+                bb.fatal("FIT image signing is enabled but no padding algorithm is provided.")
+            if not self._sign_keyname_conf:
+                bb.fatal("FIT image signing is enabled but no configuration key name is provided.")
+            if self._sign_individual and not self._sign_keyname_img:
+                bb.fatal("FIT image signing is enabled for individual images but no image key name is provided.")
+    def write_its_file(self, itsfile):
+        with open(itsfile, 'w') as f:
+            f.write("/dts-v1/;\n\n")
+            self.emit(f, 0)
+    def its_add_node_image(self, image_id, description, image_type, compression, opt_props):
+        image_node = ItsNodeImage(
+            image_id,
+            self.images,
+            description,
+            image_type,
+            compression,
+            opt_props=opt_props
+        )
+        if self._hash_algo:
+            ItsNodeHash(
+                "hash-1",
+                image_node,
+                self._hash_algo
+            )
+        if self._sign_individual:
+            ItsImageSignature(
+                "signature-1",
+                image_node,
+                f"{self._hash_algo},{self._sign_algo}",
+                self._sign_keyname_img
+            )
+        return image_node
+    def its_add_node_dtb(self, image_id, description, image_type, compression, opt_props, compatible):
+        dtb_node = ItsNodeDtb(
+            image_id,
+            self.images,
+            description,
+            image_type,
+            compression,
+            opt_props=opt_props,
+            compatible=compatible
+        )
+        if self._hash_algo:
+            ItsNodeHash(
+                "hash-1",
+                dtb_node,
+                self._hash_algo
+            )
+        if self._sign_individual:
+            ItsImageSignature(
+                "signature-1",
+                dtb_node,
+                f"{self._hash_algo},{self._sign_algo}",
+                self._sign_keyname_img
+            )
+        return dtb_node
+    def fitimage_emit_section_kernel(self, kernel_id, kernel_path, compression,
+        load, entrypoint, mkimage_kernel_type, entrysymbol=None):
+        """Emit the fitImage ITS kernel section"""
+        if self._kernel:
+            bb.fatal("Kernel section already exists in the ITS file.")
+        if entrysymbol:
+            result = subprocess.run([self._host_prefix + "nm", "vmlinux"], capture_output=True, text=True)
+            for line in result.stdout.splitlines():
+                parts = line.split()
+                if len(parts) == 3 and parts[2] == entrysymbol:
+                    entrypoint = "<0x%s>" % parts[0]
+                    break
+        kernel_node = self.its_add_node_image(
+            kernel_id,
+            "Linux kernel",
+            mkimage_kernel_type,
+            compression,
+            {
+                "data": '/incbin/("' + kernel_path + '")',
+                "arch": self._arch,
+                "os": "linux",
+                "load": f"<{load}>",
+                "entry": f"<{entrypoint}>"
+            }
+        )
+        self._kernel = kernel_node
+    def fitimage_emit_section_dtb(self, dtb_id, dtb_path, dtb_loadaddress=None,
+                                  dtbo_loadaddress=None, add_compatible=False):
+        """Emit the fitImage ITS DTB section"""
+        load=None
+        dtb_ext = os.path.splitext(dtb_path)[1]
+        if dtb_ext == ".dtbo":
+            if dtbo_loadaddress:
+                load = dtbo_loadaddress
+        elif dtb_loadaddress:
+            load = dtb_loadaddress
+        opt_props = {
+            "data": '/incbin/("' + dtb_path + '")',
+            "arch": self._arch
+        }
+        if load:
+            opt_props["load"] = f"<{load}>"
+        # Preserve the DTB's compatible string to be added to the configuration node
+        compatible = None
+        if add_compatible:
+            compatible = get_compatible_from_dtb(dtb_path)
+        dtb_node = self.its_add_node_dtb(
+            "fdt-" + dtb_id,
+            "Flattened Device Tree blob",
+            "flat_dt",
+            "none",
+            opt_props,
+            compatible
+        )
+        self._dtbs.append(dtb_node)
+    def fitimage_emit_section_dtb_alias(self, dtb_alias_id, dtb_path, add_compatible=False):
+        """Add a configuration node referring to another DTB"""
+        # Preserve the DTB's compatible string to be added to the configuration node
+        compatible = None
+        if add_compatible:
+            compatible = get_compatible_from_dtb(dtb_path)
+        dtb_id = os.path.basename(dtb_path)
+        dtb_alias_node = ItsNodeDtbAlias("fdt-" + dtb_id, dtb_alias_id, compatible)
+        self._dtb_alias.append(dtb_alias_node)
+        bb.warn(f"compatible: {compatible}, dtb_alias_id: {dtb_alias_id}, dtb_id: {dtb_id}, dtb_path: {dtb_path}")
+    def fitimage_emit_section_boot_script(self, bootscr_id, bootscr_path):
+        """Emit the fitImage ITS u-boot script section"""
+        if self._bootscr:
+            bb.fatal("U-boot script section already exists in the ITS file.")
+        bootscr_node = self.its_add_node_image(
+            bootscr_id,
+            "U-boot script",
+            "script",
+            "none",
+            {
+                "data": '/incbin/("' + bootscr_path + '")',
+                "arch": self._arch,
+                "type": "script"
+            }
+        )
+        self._bootscr = bootscr_node
+    def fitimage_emit_section_setup(self, setup_id, setup_path):
+        """Emit the fitImage ITS setup section"""
+        if self._setup:
+            bb.fatal("Setup section already exists in the ITS file.")
+        load = "<0x00090000>"
+        entry = "<0x00090000>"
+        setup_node = self.its_add_node_image(
+            setup_id,
+            "Linux setup.bin",
+            "x86_setup",
+            "none",
+            {
+                "data": '/incbin/("' + setup_path + '")',
+                "arch": self._arch,
+                "os": "linux",
+                "load": load,
+                "entry": entry
+            }
+        )
+        self._setup = setup_node
+    def fitimage_emit_section_ramdisk(self, ramdisk_id, ramdisk_path, description="ramdisk", load=None, entry=None):
+        """Emit the fitImage ITS ramdisk section"""
+        if self._ramdisk:
+            bb.fatal("Ramdisk section already exists in the ITS file.")
+        opt_props = {
+            "data": '/incbin/("' + ramdisk_path + '")',
+            "type": "ramdisk",
+            "arch": self._arch,
+            "os": "linux"
+        }
+        if load:
+            opt_props["load"] = f"<{load}>"
+        if entry:
+            opt_props["entry"] = f"<{entry}>"
+        ramdisk_node = self.its_add_node_image(
+            ramdisk_id,
+            description,
+            "ramdisk",
+            "none",
+            opt_props
+        )
+        self._ramdisk = ramdisk_node
+    def _fitimage_emit_one_section_config(self, conf_node_name, dtb=None):
+        """Emit the fitImage ITS configuration section"""
+        opt_props = {}
+        conf_desc = []
+        sign_entries = []
+        if self._kernel:
+            conf_desc.append("Linux kernel")
+            opt_props["kernel"] = self._kernel.name
+            if self._sign_enable:
+                sign_entries.append("kernel")
+        if dtb:
+            conf_desc.append("FDT blob")
+            opt_props["fdt"] = dtb.name
+            if dtb.compatible:
+                opt_props["compatible"] = dtb.compatible
+            if self._sign_enable:
+                sign_entries.append("fdt")
+        if self._ramdisk:
+            conf_desc.append("ramdisk")
+            opt_props["ramdisk"] = self._ramdisk.name
+            if self._sign_enable:
+                sign_entries.append("ramdisk")
+        if self._bootscr:
+            conf_desc.append("u-boot script")
+            opt_props["bootscr"] = self._bootscr.name
+            if self._sign_enable:
+                sign_entries.append("bootscr")
+        if self._setup:
+            conf_desc.append("setup")
+            opt_props["setup"] = self._setup.name
+            if self._sign_enable:
+                sign_entries.append("setup")
+        # First added configuration is the default configuration
+        default_flag = "0"
+        if len(self.configurations.sub_nodes) == 0:
+            default_flag = "1"
+        conf_node = ItsNodeConfiguration(
+            conf_node_name,
+            self.configurations,
+            f"{default_flag} {', '.join(conf_desc)}",
+            opt_props=opt_props
+        )
+        if self._hash_algo:
+            ItsNodeHash(
+                "hash-1",
+                conf_node,
+                self._hash_algo
+            )
+        if self._sign_enable:
+            ItsNodeConfigurationSignature(
+                "signature-1",
+                conf_node,
+                f"{self._hash_algo},{self._sign_algo}",
+                self._sign_keyname_conf,
+                opt_props={
+                    "padding": self._pad_algo,
+                    "sign-images": sign_entries
+                }
+            )
+    def fitimage_emit_section_config(self, default_dtb_image=None):
+        if self._dtbs:
+            for dtb in self._dtbs:
+                dtb_name = dtb.name
+                if dtb.name.startswith("fdt-"):
+                    dtb_name = dtb.name[len("fdt-"):]
+                self._fitimage_emit_one_section_config(self._conf_prefix + dtb_name, dtb)
+            for dtb in self._dtb_alias:
+                self._fitimage_emit_one_section_config(self._conf_prefix + dtb.alias_name, dtb)
+        else:
+            # Currently exactly one kernel is supported.
+            self._fitimage_emit_one_section_config(self._conf_prefix + "1")
+        default_conf = self.configurations.sub_nodes[0].name
+        if default_dtb_image and self._dtbs:
+            default_conf = self._conf_prefix + default_dtb_image
+        self.configurations.add_property('default', default_conf)
+    def run_mkimage_assemble(self, itsfile, fitfile):
+        cmd = [
+            self._mkimage,
+            '-f', itsfile,
+            fitfile
+        ]
+        if self._mkimage_dtcopts:
+            cmd.insert(1, '-D')
+            cmd.insert(2, self._mkimage_dtcopts)
+        try:
+            subprocess.run(cmd, check=True, capture_output=True)
+        except subprocess.CalledProcessError as e:
+            bb.fatal(f"Command '{' '.join(cmd)}' failed with return code {e.returncode}\nstdout: {e.stdout.decode()}\nstderr: {e.stderr.decode()}\nitsflile: {os.path.abspath(itsfile)}")
+    def run_mkimage_sign(self, fitfile):
+        if not self._sign_enable:
+            bb.debug(1, "FIT image signing is disabled. Skipping signing.")
+            return
+        # Some sanity checks because mkimage exits with 0 also without needed keys
+        sign_key_path = os.path.join(self._sign_keydir, self._sign_keyname_conf)
+        if not os.path.exists(sign_key_path + '.key') or not os.path.exists(sign_key_path + '.crt'):
+            bb.fatal("%s.key or .crt does not exist" % sign_key_path)
+        if self._sign_individual:
+            sign_key_img_path = os.path.join(self._sign_keydir, self._sign_keyname_img)
+            if not os.path.exists(sign_key_img_path + '.key') or not os.path.exists(sign_key_img_path + '.crt'):
+                bb.fatal("%s.key or .crt does not exist" % sign_key_img_path)
+        cmd = [
+            self._mkimage_sign,
+            '-F',
+            '-k', self._sign_keydir,
+            '-r', fitfile
+        ]
+        if self._mkimage_dtcopts:
+            cmd.extend(['-D', self._mkimage_dtcopts])
+        if self._mkimage_sign_args:
+            cmd.extend(shlex.split(self._mkimage_sign_args))
+        try:
+            subprocess.run(cmd, check=True, capture_output=True)
+        except subprocess.CalledProcessError as e:
+            bb.fatal(f"Command '{' '.join(cmd)}' failed with return code {e.returncode}\nstdout: {e.stdout.decode()}\nstderr: {e.stderr.decode()}")
+def symlink_points_below(file_or_symlink, expected_parent_dir):
+    """returns symlink destination if it points below directory"""
+    file_path = os.path.join(expected_parent_dir, file_or_symlink)
+    if not os.path.islink(file_path):
+        return None
+    realpath = os.path.relpath(os.path.realpath(file_path), expected_parent_dir)
+    if realpath.startswith(".."):
+        return None
+    return realpath
+def get_compatible_from_dtb(dtb_path, fdtget_path="fdtget"):
+    compatible = None
+    cmd = [fdtget_path, "-t", "s", dtb_path, "/", "compatible"]
+    try:
+        ret = subprocess.run(cmd, check=True, capture_output=True, text=True)
+        compatible = ret.stdout.strip().split()
+    except subprocess.CalledProcessError:
+        compatible = None
+    return compatible
diff --git a/meta/lib/oeqa/core/decorator/data.py b/meta/lib/oeqa/core/decorator/data.py
index 5444b2cb75..0daf46334f 100644
--- a/meta/lib/oeqa/core/decorator/data.py
+++ b/meta/lib/oeqa/core/decorator/data.py
@@ -228,3 +228,15 @@ class skipIfNotArch(OETestDecorator):
        arch = self.case.td['HOST_ARCH']
        if arch not in self.archs:
             self.case.skipTest('Test skipped on %s' % arch)
+@registerDecorator
+class skipIfNotBuildArch(OETestDecorator):
+    """
+    Skip test if BUILD_ARCH is not present in the tuple specified.
+    """
+    attrs = ('archs',)
+    def setUpDecorator(self):
+        arch = self.case.td['BUILD_ARCH']
+        if arch not in self.archs:
+             self.case.skipTest('Test skipped on %s' % arch)
diff --git a/meta/lib/oeqa/files/maturin/guessing-game/Cargo.toml b/meta/lib/oeqa/files/maturin/guessing-game/Cargo.toml
index de95025e86..a78ada2593 100644
--- a/meta/lib/oeqa/files/maturin/guessing-game/Cargo.toml
+++ b/meta/lib/oeqa/files/maturin/guessing-game/Cargo.toml
@@ -14,7 +14,7 @@ crate-type = ["cdylib"]
 rand = "0.8.4"
 [dependencies.pyo3]
-version = "0.19.0"
+version = "0.24.1"
 # "abi3-py38" tells pyo3 (and maturin) to build using the stable ABI with minimum Python version 3.8
 features = ["abi3-py38"]
diff --git a/meta/lib/oeqa/selftest/cases/fitimage.py b/meta/lib/oeqa/selftest/cases/fitimage.py
index b39f2622df..be291e4b0f 100644
--- a/meta/lib/oeqa/selftest/cases/fitimage.py
+++ b/meta/lib/oeqa/selftest/cases/fitimage.py
@@ -4,13 +4,36 @@
 # SPDX-License-Identifier: MIT
 #
-from oeqa.selftest.case import OESelftestTestCase
-from oeqa.utils.commands import runCmd, bitbake, get_bb_vars
 import os
 import re
 import shlex
 import logging
 import pprint
+import tempfile
+import oe.fitimage
+from oeqa.selftest.case import OESelftestTestCase
+from oeqa.utils.commands import runCmd, bitbake, get_bb_vars, get_bb_var
+class BbVarsMockGenKeys:
+    def __init__(self, keydir, gen_keys="0", sign_enabled="0", keyname="", sign_ind="0", img_keyname=""):
+        self.bb_vars = {
+            'FIT_GENERATE_KEYS': gen_keys,
+            'FIT_KEY_GENRSA_ARGS': "-F4",
+            'FIT_KEY_REQ_ARGS': "-batch -new",
+            'FIT_KEY_SIGN_PKCS': "-x509",
+            'FIT_SIGN_INDIVIDUAL': sign_ind,
+            'FIT_SIGN_NUMBITS': "2048",
+            'UBOOT_SIGN_ENABLE': sign_enabled,
+            'UBOOT_SIGN_IMG_KEYNAME': img_keyname,
+            'UBOOT_SIGN_KEYDIR': keydir,
+            'UBOOT_SIGN_KEYNAME': keyname,
+        }
+    def getVar(self, var):
+        return self.bb_vars[var]
 class FitImageTestCase(OESelftestTestCase):
    """Test functions usable for testing kernel-fitimage.bbclass and uboot-sign.bbclass
@@ -161,10 +184,23 @@ class FitImageTestCase(OESelftestTestCase):
    @staticmethod
    def _get_dtb_files(bb_vars):
+        """Return a list of devicetree names
+        The list should be used to check the dtb and conf nodes in the FIT image or its file.
+        In addition to the entries from KERNEL_DEVICETREE, the external devicetree and the
+        external devicetree overlay added by the test recipe bbb-dtbs-as-ext are handled as well.
+        """
        kernel_devicetree = bb_vars.get('KERNEL_DEVICETREE')
+        all_dtbs = []
+        dtb_symlinks = []
        if kernel_devicetree:
-            return [os.path.basename(dtb) for dtb in kernel_devicetree.split()]
+            all_dtbs += [os.path.basename(dtb) for dtb in kernel_devicetree.split()]
-        return []
+        # Support only the test recipe which provides 1 devicetree and 1 devicetree overlay
+        pref_prov_dtb = bb_vars.get('PREFERRED_PROVIDER_virtual/dtb')
+        if pref_prov_dtb == "bbb-dtbs-as-ext":
+            all_dtbs += ["am335x-bonegreen-ext.dtb", "BBORG_RELAY-00A2.dtbo"]
+            dtb_symlinks.append("am335x-bonegreen-ext-alias.dtb")
+        return (all_dtbs, dtb_symlinks)
    def _is_req_dict_in_dict(self, found_dict, req_dict):
        """
@@ -243,7 +279,7 @@ class FitImageTestCase(OESelftestTestCase):
        self.logger.debug("sigs:\n%s\n" % pprint.pformat(sigs, indent=4))
        if req_sigvalues_config or req_sigvalues_image:
            for its_path, values in sigs.items():
-                if 'conf-' in its_path:
+                if bb_vars.get('FIT_CONF_PREFIX', "conf-") in its_path:
                    reqsigvalues = req_sigvalues_config
                else:
                    reqsigvalues = req_sigvalues_image
@@ -356,9 +392,8 @@ class FitImageTestCase(OESelftestTestCase):
        # Verify the FIT image
        self._check_fitimage(bb_vars, fitimage_path, uboot_tools_bindir)
+class KernelFitImageBase(FitImageTestCase):
-class KernelFitImageTests(FitImageTestCase):
+    """Test cases for the linux-yocto-fitimage recipe"""
-    """Test cases for the kernel-fitimage bbclass"""
    def _fit_get_bb_vars(self, additional_vars=[]):
        """Retrieve BitBake variables specific to the test case.
@@ -367,6 +402,8 @@ class KernelFitImageTests(FitImageTestCase):
        """
        internal_used = {
            'DEPLOY_DIR_IMAGE',
+            'FIT_CONF_DEFAULT_DTB',
+            'FIT_CONF_PREFIX',
            'FIT_DESC',
            'FIT_HASH_ALG',
            'FIT_KERNEL_COMP_ALG',
@@ -376,9 +413,11 @@ class KernelFitImageTests(FitImageTestCase):
            'INITRAMFS_IMAGE_BUNDLE',
            'INITRAMFS_IMAGE_NAME',
            'INITRAMFS_IMAGE',
+            'KERNEL_DEPLOYSUBDIR',
            'KERNEL_DEVICETREE',
            'KERNEL_FIT_LINK_NAME',
            'MACHINE',
+            'PREFERRED_PROVIDER_virtual/dtb',
            'UBOOT_ARCH',
            'UBOOT_ENTRYPOINT',
            'UBOOT_LOADADDRESS',
@@ -391,10 +430,19 @@ class KernelFitImageTests(FitImageTestCase):
            'UBOOT_SIGN_KEYDIR',
            'UBOOT_SIGN_KEYNAME',
        }
-        bb_vars = get_bb_vars(list(internal_used | set(additional_vars)), "virtual/kernel")
+        bb_vars = get_bb_vars(list(internal_used | set(additional_vars)), self.kernel_recipe)
        self.logger.debug("bb_vars: %s" % pprint.pformat(bb_vars, indent=4))
        return bb_vars
+    def _config_add_kernel_classes(self, config):
+        config += '# Use kernel-fit-extra-artifacts.bbclass for the creation of the vmlinux artifact' + os.linesep
+        config += 'KERNEL_CLASSES = "kernel-fit-extra-artifacts"' + os.linesep
+        return config
+    @property
+    def kernel_recipe(self):
+        return "linux-yocto-fitimage"
    def _config_add_uboot_env(self, config):
        """Generate an u-boot environment
@@ -408,7 +456,7 @@ class KernelFitImageTests(FitImageTestCase):
        config += '# Add an u-boot script to the fitImage' + os.linesep
        config += 'FIT_UBOOT_ENV = "%s"' % fit_uenv_file + os.linesep
        config += 'FILESEXTRAPATHS:prepend := "${TOPDIR}/%s:"' % test_files_dir + os.linesep
-        config += 'SRC_URI:append:pn-linux-yocto = " file://${FIT_UBOOT_ENV}"' + os.linesep
+        config += 'SRC_URI:append:pn-%s = " file://${FIT_UBOOT_ENV}"' % self.kernel_recipe + os.linesep
        if not os.path.isdir(test_files_dir):
            os.makedirs(test_files_dir)
@@ -420,7 +468,7 @@ class KernelFitImageTests(FitImageTestCase):
    def _bitbake_fit_image(self, bb_vars):
        """Bitbake the kernel and return the paths to the its file and the FIT image"""
-        bitbake("virtual/kernel")
+        bitbake(self.kernel_recipe)
        # Find the right its file and the final fitImage and check if both files are available
        deploy_dir_image = bb_vars['DEPLOY_DIR_IMAGE']
@@ -439,8 +487,13 @@ class KernelFitImageTests(FitImageTestCase):
            fitimage_name = "fitImage"  # or fitImage-${KERNEL_IMAGE_LINK_NAME}${KERNEL_IMAGE_BIN_EXT}
        else:
            self.fail('Invalid configuration: INITRAMFS_IMAGE_BUNDLE = "1" and not INITRAMFS_IMAGE')
-        fitimage_its_path = os.path.realpath(os.path.join(deploy_dir_image, fitimage_its_name))
+        kernel_deploysubdir = bb_vars['KERNEL_DEPLOYSUBDIR']
-        fitimage_path = os.path.realpath(os.path.join(deploy_dir_image, fitimage_name))
+        if kernel_deploysubdir:
+            fitimage_its_path = os.path.realpath(os.path.join(deploy_dir_image, kernel_deploysubdir, fitimage_its_name))
+            fitimage_path = os.path.realpath(os.path.join(deploy_dir_image, kernel_deploysubdir, fitimage_name))
+        else:
+            fitimage_its_path = os.path.realpath(os.path.join(deploy_dir_image, fitimage_its_name))
+            fitimage_path = os.path.realpath(os.path.join(deploy_dir_image, fitimage_name))
        return (fitimage_its_path, fitimage_path)
    def _get_req_its_paths(self, bb_vars):
@@ -452,7 +505,7 @@ class KernelFitImageTests(FitImageTestCase):
                ['/', 'images', 'kernel-1', 'signature-1'],
            ]
        """
-        dtb_files = FitImageTestCase._get_dtb_files(bb_vars)
+        dtb_files, dtb_symlinks = FitImageTestCase._get_dtb_files(bb_vars)
        fit_sign_individual = bb_vars['FIT_SIGN_INDIVIDUAL']
        fit_uboot_env = bb_vars['FIT_UBOOT_ENV']
        initramfs_image = bb_vars['INITRAMFS_IMAGE']
@@ -470,11 +523,11 @@ class KernelFitImageTests(FitImageTestCase):
        if initramfs_image and initramfs_image_bundle != "1":
            images.append('ramdisk-1')
-        # configuration nodes
+        # configuration nodes (one per DTB and also one per symlink)
        if dtb_files:
-            configurations = [ 'conf-' + conf for conf in dtb_files ]
+            configurations = [bb_vars['FIT_CONF_PREFIX'] + conf for conf in dtb_files + dtb_symlinks]
        else:
-            configurations = [ 'conf-1' ]
+            configurations = [bb_vars['FIT_CONF_PREFIX'] + '1']
        # Create a list of paths for all image and configuration nodes
        req_its_paths = []
@@ -497,11 +550,11 @@ class KernelFitImageTests(FitImageTestCase):
        its_field_check = [
            'description = "%s";' % bb_vars['FIT_DESC'],
            'description = "Linux kernel";',
-            'data = /incbin/("linux.bin");',
            'type = "' + str(bb_vars['UBOOT_MKIMAGE_KERNEL_TYPE']) + '";',
+            # 'compression = "' + str(bb_vars['FIT_KERNEL_COMP_ALG']) + '";', defined based on files in TMPDIR, not ideal...
+            'data = /incbin/("linux.bin");',
            'arch = "' + str(bb_vars['UBOOT_ARCH']) + '";',
            'os = "linux";',
-            # 'compression = "' + str(bb_vars['FIT_KERNEL_COMP_ALG']) + '";', defined based on files in TMPDIR, not ideal...
            'load = <' + str(bb_vars['UBOOT_LOADADDRESS']) + '>;',
            'entry = <' + str(bb_vars['UBOOT_ENTRYPOINT']) + '>;',
        ]
@@ -511,10 +564,14 @@ class KernelFitImageTests(FitImageTestCase):
                its_field_check.append("load = <%s>;" % uboot_rd_loadaddress)
            if uboot_rd_entrypoint:
                its_field_check.append("entry = <%s>;" % uboot_rd_entrypoint)
-        its_field_check += [
-            # 'default = "conf-1";', needs more work
+        fit_conf_default_dtb = bb_vars.get('FIT_CONF_DEFAULT_DTB')
-            'kernel = "kernel-1";',
+        if fit_conf_default_dtb:
-        ]
+            fit_conf_prefix = bb_vars.get('FIT_CONF_PREFIX', "conf-")
+            its_field_check.append('default = "' + fit_conf_prefix + fit_conf_default_dtb + '";')
+        its_field_check.append('kernel = "kernel-1";')
        if initramfs_image and initramfs_image_bundle != "1":
            its_field_check.append('ramdisk = "ramdisk-1";')
@@ -548,7 +605,7 @@ class KernelFitImageTests(FitImageTestCase):
    def _get_req_sections(self, bb_vars):
        """Generate a dictionary of expected sections in the output of dumpimage"""
-        dtb_files = FitImageTestCase._get_dtb_files(bb_vars)
+        dtb_files, dtb_symlinks = FitImageTestCase._get_dtb_files(bb_vars)
        fit_hash_alg = bb_vars['FIT_HASH_ALG']
        fit_sign_alg = bb_vars['FIT_SIGN_ALG']
        fit_sign_individual = bb_vars['FIT_SIGN_INDIVIDUAL']
@@ -584,25 +641,36 @@ class KernelFitImageTests(FitImageTestCase):
            }
        # Create a configuration section for each DTB
        if dtb_files:
-            for dtb in dtb_files:
+            for dtb in dtb_files + dtb_symlinks:
-                req_sections['conf-' + dtb] = {
+                conf_name = bb_vars['FIT_CONF_PREFIX'] + dtb
-                    "Kernel": "kernel-1",
+                # Assume that DTBs with an "-alias" in its name are symlink DTBs created e.g. by the
-                    "FDT": 'fdt-' + dtb,
+                # bbb-dtbs-as-ext test recipe. Make the configuration node pointing to the real DTB.
-                }
+                real_dtb = dtb.replace("-alias", "")
+                # dtb overlays do not refer to a kernel (yet?)
+                if dtb.endswith('.dtbo'):
+                    req_sections[conf_name] = {
+                        "FDT": 'fdt-' + real_dtb,
+                    }
+                else:
+                    req_sections[conf_name] = {
+                        "Kernel": "kernel-1",
+                        "FDT": 'fdt-' + real_dtb,
+                    }
                if initramfs_image and initramfs_image_bundle != "1":
-                    req_sections['conf-' + dtb]['Init Ramdisk'] = "ramdisk-1"
+                    req_sections[conf_name]['Init Ramdisk'] = "ramdisk-1"
        else:
-            req_sections['conf-1'] = {
+            conf_name = bb_vars['FIT_CONF_PREFIX'] +  '1'
+            req_sections[conf_name] = {
                "Kernel": "kernel-1"
            }
            if initramfs_image and initramfs_image_bundle != "1":
-                req_sections['conf-1']['Init Ramdisk'] = "ramdisk-1"
+                req_sections[conf_name]['Init Ramdisk'] = "ramdisk-1"
        # Add signing related properties if needed
        if uboot_sign_enable == "1":
            for section in req_sections:
                req_sections[section]['Hash algo'] = fit_hash_alg
-                if section.startswith('conf-'):
+                if section.startswith(bb_vars['FIT_CONF_PREFIX']):
                    req_sections[section]['Hash value'] = "unavailable"
                    req_sections[section]['Sign algo'] = "%s,%s:%s" % (fit_hash_alg, fit_sign_alg, uboot_sign_keyname)
                    num_signatures += 1
@@ -624,18 +692,26 @@ class KernelFitImageTests(FitImageTestCase):
        uboot_sign_keyname = bb_vars['UBOOT_SIGN_KEYNAME']
        uboot_sign_img_keyname = bb_vars['UBOOT_SIGN_IMG_KEYNAME']
        deploy_dir_image = bb_vars['DEPLOY_DIR_IMAGE']
+        kernel_deploysubdir = bb_vars['KERNEL_DEPLOYSUBDIR']
        fit_sign_individual = bb_vars['FIT_SIGN_INDIVIDUAL']
        fit_hash_alg_len = FitImageTestCase.MKIMAGE_HASH_LENGTHS[fit_hash_alg]
        fit_sign_alg_len = FitImageTestCase.MKIMAGE_SIGNATURE_LENGTHS[fit_sign_alg]
        for section, values in sections.items():
            # Configuration nodes are always signed with UBOOT_SIGN_KEYNAME (if UBOOT_SIGN_ENABLE = "1")
-            if section.startswith("conf"):
+            if section.startswith(bb_vars['FIT_CONF_PREFIX']):
                sign_algo = values.get('Sign algo', None)
                req_sign_algo = "%s,%s:%s" % (fit_hash_alg, fit_sign_alg, uboot_sign_keyname)
                self.assertEqual(sign_algo, req_sign_algo, 'Signature algorithm for %s not expected value' % section)
                sign_value = values.get('Sign value', None)
                self.assertEqual(len(sign_value), fit_sign_alg_len, 'Signature value for section %s not expected length' % section)
-                dtb_path = os.path.join(deploy_dir_image, section.replace('conf-', ''))
+                dtb_file_name = section.replace(bb_vars['FIT_CONF_PREFIX'], '')
+                dtb_path = os.path.join(deploy_dir_image, dtb_file_name)
+                if kernel_deploysubdir:
+                    dtb_path = os.path.join(deploy_dir_image, kernel_deploysubdir, dtb_file_name)
+                # External devicetrees created by devicetree.bbclass are in a subfolder and have priority
+                dtb_path_ext = os.path.join(deploy_dir_image, "devicetree", dtb_file_name)
+                if os.path.exists(dtb_path_ext):
+                    dtb_path = dtb_path_ext
                self._verify_fit_image_signature(uboot_tools_bindir, fitimage_path, dtb_path, section)
            else:
                # Image nodes always need a hash which gets indirectly signed by the config signature
@@ -660,6 +736,8 @@ class KernelFitImageTests(FitImageTestCase):
            self.assertEqual(found_comments, num_signatures, "Expected %d signed and commented (%s) sections in the fitImage." %
                             (num_signatures, a_comment))
+class KernelFitImageRecipeTests(KernelFitImageBase):
+    """Test cases for the kernel-fitimage bbclass"""
    def test_fit_image(self):
        """
@@ -675,10 +753,7 @@ class KernelFitImageTests(FitImageTestCase):
        Author:      Usama Arif <usama.arif@arm.com>
        """
        config = """
-# Enable creation of fitImage
 KERNEL_IMAGETYPE = "Image"
-KERNEL_IMAGETYPES += " fitImage "
-KERNEL_CLASSES = " kernel-fitimage "
 # RAM disk variables including load address and entrypoint for kernel and RAM disk
 IMAGE_FSTYPES += "cpio.gz"
@@ -690,8 +765,76 @@ UBOOT_RD_ENTRYPOINT = "0x88000000"
 UBOOT_LOADADDRESS = "0x80080000"
 UBOOT_ENTRYPOINT = "0x80080000"
 FIT_DESC = "A model description"
+FIT_CONF_PREFIX = "foo-"
+"""
+        config = self._config_add_kernel_classes(config)
+        self.write_config(config)
+        bb_vars = self._fit_get_bb_vars()
+        self._test_fitimage(bb_vars)
+    def test_get_compatible_from_dtb(self):
+        """Test the oe.fitimage.get_compatible_from_dtb function
+        1. bitbake bbb-dtbs-as-ext
+        2. Check if symlink_points_below returns the path to the DTB
+        3. Check if the expected compatible string is found by get_compatible_from_dtb()
+        """
+        DTB_RECIPE = "bbb-dtbs-as-ext"
+        DTB_FILE = "am335x-bonegreen-ext.dtb"
+        DTB_SYMLINK = "am335x-bonegreen-ext-alias.dtb"
+        DTBO_FILE = "BBORG_RELAY-00A2.dtbo"
+        EXPECTED_COMP = ["ti,am335x-bone-green", "ti,am335x-bone-black", "ti,am335x-bone", "ti,am33xx"]
+        config = """
+DISTRO="poky"
+MACHINE = "beaglebone-yocto"
 """
        self.write_config(config)
+        # Provide the fdtget command called by get_compatible_from_dtb
+        dtc_bindir = FitImageTestCase._setup_native('dtc-native')
+        fdtget_path = os.path.join(dtc_bindir, "fdtget")
+        self.assertExists(fdtget_path)
+        # bitbake an external DTB with a symlink to it and a DTB overlay
+        bitbake(DTB_RECIPE)
+        deploy_dir_image = get_bb_var("DEPLOY_DIR_IMAGE", DTB_RECIPE)
+        devicetree_dir = os.path.join(deploy_dir_image, "devicetree")
+        dtb_path = os.path.join(devicetree_dir, DTB_FILE)
+        dtb_alias_path = os.path.join(devicetree_dir, DTB_SYMLINK)
+        dtbo_file = os.path.join(devicetree_dir, DTBO_FILE)
+        self.assertExists(dtb_path)
+        self.assertExists(dtb_alias_path)
+        self.assertExists(dtbo_file)
+        # Test symlink_points_below
+        linked_dtb = oe.fitimage.symlink_points_below(dtb_alias_path, devicetree_dir)
+        self.assertEqual(linked_dtb, DTB_FILE)
+        # Check if get_compatible_from_dtb finds the expected compatible string in the DTBs
+        comp = oe.fitimage.get_compatible_from_dtb(dtb_path, fdtget_path)
+        self.assertEqual(comp, EXPECTED_COMP)
+        comp_alias = oe.fitimage.get_compatible_from_dtb(dtb_alias_path, fdtget_path)
+        self.assertEqual(comp_alias, EXPECTED_COMP)
+        # The alias is a symlink, therefore the compatible string is equal
+        self.assertEqual(comp_alias, comp)
+    def test_fit_image_ext_dtb_dtbo(self):
+        """
+        Summary:     Check if FIT image and Image Tree Source (its) are created correctly.
+        Expected:    1) its and FIT image are built successfully
+                     2) The its file contains also the external devicetree overlay
+                     3) Dumping the FIT image indicates the devicetree overlay
+        """
+        config = """
+# Enable creation of fitImage
+MACHINE = "beaglebone-yocto"
+# Add a devicetree overlay which does not need kernel sources
+PREFERRED_PROVIDER_virtual/dtb = "bbb-dtbs-as-ext"
+"""
+        config = self._config_add_kernel_classes(config)
+        config = self._config_add_uboot_env(config)
+        self.write_config(config)
        bb_vars = self._fit_get_bb_vars()
        self._test_fitimage(bb_vars)
@@ -702,8 +845,7 @@ FIT_DESC = "A model description"
                     and the configuration nodes are signed correctly.
        Expected:    1) its and FIT image are built successfully
                     2) Scanning the its file indicates signing is enabled
-                        as requested by UBOOT_SIGN_ENABLE (using 1 key
+                        as requested by UBOOT_SIGN_ENABLE
-                        generated by the test not via FIT_GENERATE_KEYS)
                     3) Dumping the FIT image indicates signature values
                        are present (only for the configuration nodes as
                        FIT_SIGN_INDIVIDUAL is disabled)
@@ -714,13 +856,13 @@ FIT_DESC = "A model description"
        config = """
 # Enable creation of fitImage
 MACHINE = "beaglebone-yocto"
-KERNEL_IMAGETYPES += " fitImage "
-KERNEL_CLASSES = " kernel-fitimage "
 UBOOT_SIGN_ENABLE = "1"
 UBOOT_SIGN_KEYDIR = "${TOPDIR}/signing-keys"
 UBOOT_SIGN_KEYNAME = "dev"
 UBOOT_MKIMAGE_SIGN_ARGS = "-c 'a smart comment'"
+FIT_CONF_DEFAULT_DTB = "am335x-bonegreen.dtb"
 """
+        config = self._config_add_kernel_classes(config)
        config = self._config_add_uboot_env(config)
        self.write_config(config)
@@ -733,10 +875,7 @@ UBOOT_MKIMAGE_SIGN_ARGS = "-c 'a smart comment'"
            'UBOOT_SIGN_KEYDIR',
        ])
-        # Do not use the random keys generated by FIT_GENERATE_KEYS.
-        # Using a static key is probably a more realistic scenario.
        self._gen_signing_key(bb_vars)
        self._test_fitimage(bb_vars)
    def test_sign_fit_image_individual(self):
@@ -745,11 +884,11 @@ UBOOT_MKIMAGE_SIGN_ARGS = "-c 'a smart comment'"
                     and all nodes are signed correctly.
        Expected:    1) its and FIT image are built successfully
                     2) Scanning the its file indicates signing is enabled
-                        as requested by UBOOT_SIGN_ENABLE (using 2 keys
+                        as requested by UBOOT_SIGN_ENABLE
-                        generated via FIT_GENERATE_KEYS)
                     3) Dumping the FIT image indicates signature values
                        are present (including for images as enabled via
                        FIT_SIGN_INDIVIDUAL)
+                        This also implies that FIT_GENERATE_KEYS = "1" works.
                     4) Verify the FIT image contains the comments passed via
                        UBOOT_MKIMAGE_SIGN_ARGS once per image and per
                        configuration node.
@@ -765,8 +904,6 @@ UBOOT_MKIMAGE_SIGN_ARGS = "-c 'a smart comment'"
        config = """
 # Enable creation of fitImage
 MACHINE = "beaglebone-yocto"
-KERNEL_IMAGETYPES += " fitImage "
-KERNEL_CLASSES = " kernel-fitimage "
 UBOOT_SIGN_ENABLE = "1"
 FIT_GENERATE_KEYS = "1"
 UBOOT_SIGN_KEYDIR = "${TOPDIR}/signing-keys"
@@ -775,9 +912,14 @@ UBOOT_SIGN_KEYNAME = "cfg-oe-selftest"
 FIT_SIGN_INDIVIDUAL = "1"
 UBOOT_MKIMAGE_SIGN_ARGS = "-c 'a smart comment'"
 """
+        config = self._config_add_kernel_classes(config)
        config = self._config_add_uboot_env(config)
        self.write_config(config)
        bb_vars = self._fit_get_bb_vars()
+        # Ensure new keys are generated and FIT_GENERATE_KEYS = "1" is tested
+        bitbake("kernel-signing-keys-native -c cleansstate")
        self._test_fitimage(bb_vars)
    def test_fit_image_sign_initramfs(self):
@@ -801,8 +943,6 @@ MACHINE = "beaglebone-yocto"
 INITRAMFS_IMAGE = "core-image-minimal-initramfs"
 INITRAMFS_SCRIPTS = ""
 UBOOT_MACHINE = "am335x_evm_defconfig"
-KERNEL_CLASSES = " kernel-fitimage "
-KERNEL_IMAGETYPES = "fitImage"
 UBOOT_SIGN_ENABLE = "1"
 UBOOT_SIGN_KEYNAME = "beaglebonekey"
 UBOOT_SIGN_KEYDIR ?= "${DEPLOY_DIR_IMAGE}"
@@ -816,11 +956,11 @@ UBOOT_ARCH = "arm"
 UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000"
 UBOOT_MKIMAGE_KERNEL_TYPE = "kernel"
 UBOOT_EXTLINUX = "0"
-FIT_GENERATE_KEYS = "1"
 KERNEL_IMAGETYPE_REPLACEMENT = "zImage"
 FIT_KERNEL_COMP_ALG = "none"
 FIT_HASH_ALG = "sha256"
 """
+        config = self._config_add_kernel_classes(config)
        config = self._config_add_uboot_env(config)
        self.write_config(config)
@@ -833,10 +973,7 @@ FIT_HASH_ALG = "sha256"
            'UBOOT_SIGN_KEYDIR',
        ])
-        # Do not use the random keys generated by FIT_GENERATE_KEYS.
-        # Using a static key is probably a more realistic scenario.
        self._gen_signing_key(bb_vars)
        self._test_fitimage(bb_vars)
    def test_fit_image_sign_initramfs_bundle(self):
@@ -861,8 +998,6 @@ INITRAMFS_IMAGE_BUNDLE = "1"
 INITRAMFS_IMAGE = "core-image-minimal-initramfs"
 INITRAMFS_SCRIPTS = ""
 UBOOT_MACHINE = "am335x_evm_defconfig"
-KERNEL_CLASSES = " kernel-fitimage "
-KERNEL_IMAGETYPES = "fitImage"
 UBOOT_SIGN_ENABLE = "1"
 UBOOT_SIGN_KEYNAME = "beaglebonekey"
 UBOOT_SIGN_KEYDIR ?= "${DEPLOY_DIR_IMAGE}"
@@ -874,20 +1009,124 @@ UBOOT_ARCH = "arm"
 UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000"
 UBOOT_MKIMAGE_KERNEL_TYPE = "kernel"
 UBOOT_EXTLINUX = "0"
-FIT_GENERATE_KEYS = "1"
 KERNEL_IMAGETYPE_REPLACEMENT = "zImage"
 FIT_KERNEL_COMP_ALG = "none"
 FIT_HASH_ALG = "sha256"
 """
+        config = self._config_add_kernel_classes(config)
        config = self._config_add_uboot_env(config)
        self.write_config(config)
        bb_vars = self._fit_get_bb_vars()
+        self._gen_signing_key(bb_vars)
        self._test_fitimage(bb_vars)
+class FitImagePyTests(KernelFitImageBase):
+    """Test cases for the fitimage.py module without calling bitbake"""
+    def _test_fitimage_py(self, bb_vars_overrides=None):
+        topdir = os.path.join(os.environ['BUILDDIR'])
+        fitimage_its_path = os.path.join(topdir, self._testMethodName + '.its')
+        # Provide variables without calling bitbake
+        bb_vars = {
+            # image-fitimage.conf
+            'FIT_DESC': "Kernel fitImage for a dummy distro",
+            'FIT_HASH_ALG': "sha256",
+            'FIT_SIGN_ALG': "rsa2048",
+            'FIT_PAD_ALG': "pkcs-1.5",
+            'FIT_GENERATE_KEYS': "0",
+            'FIT_SIGN_NUMBITS': "2048",
+            'FIT_KEY_GENRSA_ARGS': "-F4",
+            'FIT_KEY_REQ_ARGS': "-batch -new",
+            'FIT_KEY_SIGN_PKCS': "-x509",
+            'FIT_SIGN_INDIVIDUAL': "0",
+            'FIT_CONF_PREFIX': "conf-",
+            'FIT_SUPPORTED_INITRAMFS_FSTYPES': "cpio.lz4 cpio.lzo cpio.lzma cpio.xz cpio.zst cpio.gz ext2.gz cpio",
+            'FIT_CONF_DEFAULT_DTB': "",
+            'FIT_ADDRESS_CELLS': "1",
+            'FIT_UBOOT_ENV': "",
+            # kernel.bbclass
+            'UBOOT_ENTRYPOINT': "0x20008000",
+            'UBOOT_LOADADDRESS': "0x20008000",
+            'INITRAMFS_IMAGE': "",
+            'INITRAMFS_IMAGE_BUNDLE': "",
+            # kernel-uboot.bbclass
+            'FIT_KERNEL_COMP_ALG': "gzip",
+            'FIT_KERNEL_COMP_ALG_EXTENSION': ".gz",
+            'UBOOT_MKIMAGE_KERNEL_TYPE': "kernel",
+            # uboot-config.bbclass
+            'UBOOT_MKIMAGE_DTCOPTS': "",
+            'UBOOT_MKIMAGE': "uboot-mkimage",
+            'UBOOT_MKIMAGE_SIGN': "uboot-mkimage",
+            'UBOOT_MKIMAGE_SIGN_ARGS': "",
+            'UBOOT_SIGN_ENABLE': "0",
+            'UBOOT_SIGN_KEYDIR': None,
+            'UBOOT_SIGN_KEYNAME': None,
+            'UBOOT_SIGN_IMG_KEYNAME': None,
+            # others
+            'MACHINE': "qemux86-64",
+            'UBOOT_ARCH': "x86",
+            'HOST_PREFIX': "x86_64-poky-linux-"
+        }
+        if bb_vars_overrides:
+            bb_vars.update(bb_vars_overrides)
+        root_node = oe.fitimage.ItsNodeRootKernel(
+            bb_vars["FIT_DESC"], bb_vars["FIT_ADDRESS_CELLS"],
+            bb_vars['HOST_PREFIX'], bb_vars['UBOOT_ARCH'],  bb_vars["FIT_CONF_PREFIX"],
+            oe.types.boolean(bb_vars['UBOOT_SIGN_ENABLE']), bb_vars["UBOOT_SIGN_KEYDIR"],
+            bb_vars["UBOOT_MKIMAGE"], bb_vars["UBOOT_MKIMAGE_DTCOPTS"],
+            bb_vars["UBOOT_MKIMAGE_SIGN"], bb_vars["UBOOT_MKIMAGE_SIGN_ARGS"],
+            bb_vars['FIT_HASH_ALG'], bb_vars['FIT_SIGN_ALG'], bb_vars['FIT_PAD_ALG'],
+            bb_vars['UBOOT_SIGN_KEYNAME'],
+            oe.types.boolean(bb_vars['FIT_SIGN_INDIVIDUAL']), bb_vars['UBOOT_SIGN_IMG_KEYNAME']
+        )
+        root_node.fitimage_emit_section_kernel("kernel-1", "linux.bin", "none",
+            bb_vars.get('UBOOT_LOADADDRESS'), bb_vars.get('UBOOT_ENTRYPOINT'),
+            bb_vars.get('UBOOT_MKIMAGE_KERNEL_TYPE'), bb_vars.get("UBOOT_ENTRYSYMBOL")
+        )
+        dtb_files, _ = FitImageTestCase._get_dtb_files(bb_vars)
+        for dtb in dtb_files:
+            root_node.fitimage_emit_section_dtb(dtb, os.path.join("a-dir", dtb),
+                bb_vars.get("UBOOT_DTB_LOADADDRESS"), bb_vars.get("UBOOT_DTBO_LOADADDRESS"))
+        if bb_vars.get('FIT_UBOOT_ENV'):
+            root_node.fitimage_emit_section_boot_script(
+                "bootscr-" + bb_vars['FIT_UBOOT_ENV'], bb_vars['FIT_UBOOT_ENV'])
+        if bb_vars['MACHINE'] == "qemux86-64": # Not really the right if
+            root_node.fitimage_emit_section_setup("setup-1", "setup1.bin")
+        if bb_vars.get('INITRAMFS_IMAGE') and bb_vars.get("INITRAMFS_IMAGE_BUNDLE") != "1":
+            root_node.fitimage_emit_section_ramdisk("ramdisk-1", "a-dir/a-initramfs-1",
+                "core-image-minimal-initramfs",
+                bb_vars.get("UBOOT_RD_LOADADDRESS"), bb_vars.get("UBOOT_RD_ENTRYPOINT"))
+        root_node.fitimage_emit_section_config(bb_vars['FIT_CONF_DEFAULT_DTB'])
+        root_node.write_its_file(fitimage_its_path)
+        self.assertExists(fitimage_its_path, "%s image tree source doesn't exist" % (fitimage_its_path))
+        self.logger.debug("Checking its: %s" % fitimage_its_path)
+        self._check_its_file(bb_vars, fitimage_its_path)
+    def test_fitimage_py_default(self):
+        self._test_fitimage_py()
+    def test_fitimage_py_default_dtb(self):
+        bb_vars_overrides = {
+            'KERNEL_DEVICETREE': "one.dtb two.dtb three.dtb",
+            'FIT_CONF_DEFAULT_DTB': "two.dtb"
+        }
+        self._test_fitimage_py(bb_vars_overrides)
 class UBootFitImageTests(FitImageTestCase):
    """Test cases for the uboot-sign bbclass"""
+    BOOTLOADER_RECIPE = "virtual/bootloader"
    def _fit_get_bb_vars(self, additional_vars=[]):
        """Get bb_vars as needed by _test_sign_fit_image
@@ -929,13 +1168,13 @@ class UBootFitImageTests(FitImageTestCase):
            'UBOOT_SIGN_KEYDIR',
            'UBOOT_SIGN_KEYNAME',
        }
-        bb_vars = get_bb_vars(list(internal_used | set(additional_vars)), "virtual/bootloader")
+        bb_vars = get_bb_vars(list(internal_used | set(additional_vars)), UBootFitImageTests.BOOTLOADER_RECIPE)
        self.logger.debug("bb_vars: %s" % pprint.pformat(bb_vars, indent=4))
        return bb_vars
    def _bitbake_fit_image(self, bb_vars):
        """Bitbake the bootloader and return the paths to the its file and the FIT image"""
-        bitbake("virtual/bootloader")
+        bitbake(UBootFitImageTests.BOOTLOADER_RECIPE)
        deploy_dir_image = bb_vars['DEPLOY_DIR_IMAGE']
        machine = bb_vars['MACHINE']
@@ -1286,9 +1525,7 @@ UBOOT_SIGN_KEYNAME = "cfg-oe-selftest"
        self.write_config(config)
        bb_vars = self._fit_get_bb_vars()
-        # Using a static key. FIT_GENERATE_KEYS = "1" does not work without kernel-fitimage.bbclass
        self._gen_signing_key(bb_vars)
        self._test_fitimage(bb_vars)
        self._check_kernel_dtb(bb_vars)
@@ -1449,11 +1686,9 @@ FIT_SIGN_INDIVIDUAL = "1"
 """
        self.write_config(config)
        bb_vars = self._fit_get_bb_vars()
-        # Using a static key. FIT_GENERATE_KEYS = "1" does not work without kernel-fitimage.bbclass
        self._gen_signing_key(bb_vars)
-        bitbake("virtual/bootloader")
+        bitbake(UBootFitImageTests.BOOTLOADER_RECIPE)
        # Just check the DTB of u-boot since there is no u-boot FIT image
        self._check_kernel_dtb(bb_vars)
diff --git a/meta/lib/oeqa/selftest/cases/uboot.py b/meta/lib/oeqa/selftest/cases/uboot.py
index 96da4efb06..980ea327f0 100644
--- a/meta/lib/oeqa/selftest/cases/uboot.py
+++ b/meta/lib/oeqa/selftest/cases/uboot.py
@@ -6,8 +6,8 @@
 #
 from oeqa.selftest.case import OESelftestTestCase
-from oeqa.utils.commands import bitbake, runqemu
+from oeqa.utils.commands import bitbake, runqemu, get_bb_var, get_bb_vars, runCmd
-from oeqa.core.decorator.data import skipIfNotArch
+from oeqa.core.decorator.data import skipIfNotArch, skipIfNotBuildArch
 from oeqa.core.decorator import OETestTag
 uboot_boot_patterns = {
@@ -41,3 +41,58 @@ QEMU_USE_KVM = "False"
            status, output = qemu.run_serial(cmd)
            self.assertEqual(status, 1, msg=output)
            self.assertTrue("U-Boot" in output, msg=output)
+    @skipIfNotArch(['aarch64'])
+    @skipIfNotBuildArch(['aarch64'])
+    @OETestTag("runqemu")
+    def test_boot_uboot_kvm_to_full_target(self):
+        """
+        Tests building u-boot and booting it with QEMU and KVM.
+        Requires working KVM on build host. See "kvm-ok" output.
+        """
+        runCmd("kvm-ok")
+        image = "core-image-minimal"
+        vars = get_bb_vars(['HOST_ARCH', 'BUILD_ARCH'], image)
+        host_arch = vars['HOST_ARCH']
+        build_arch = vars['BUILD_ARCH']
+        self.assertEqual(host_arch, build_arch, 'HOST_ARCH %s and BUILD_ARCH %s must match for KVM' % (host_arch, build_arch))
+        self.write_config("""
+QEMU_USE_KVM = "1"
+# Using u-boot in EFI mode, need ESP partition for grub/systemd-boot/kernel etc
+IMAGE_FSTYPES:pn-core-image-minimal:append = " wic"
+# easiest to follow genericarm64 setup with wks file, initrd and EFI loader
+INITRAMFS_IMAGE = "core-image-initramfs-boot"
+EFI_PROVIDER = "${@bb.utils.contains("DISTRO_FEATURES", "systemd", "systemd-boot", "grub-efi", d)}"
+WKS_FILE = "genericarm64.wks.in"
+# use wic image with ESP for u-boot, not ext4
+QB_DEFAULT_FSTYPE = "wic"
+PREFERRED_PROVIDER_virtual/bootloader = "u-boot"
+QB_DEFAULT_BIOS = "u-boot.bin"
+# let u-boot or EFI loader load kernel from ESP
+QB_DEFAULT_KERNEL = "none"
+# virt pci, not scsi because support not in u-boot to find ESP
+QB_DRIVE_TYPE = "/dev/vd"
+""")
+        bitbake("virtual/bootloader %s" % image)
+        runqemu_params = get_bb_var('TEST_RUNQEMUPARAMS', image) or ""
+        with runqemu(image, ssh=False, runqemuparams='nographic kvm %s' % runqemu_params) as qemu:
+            # boot to target and login worked, should have been fast with kvm
+            cmd = "dmesg"
+            status, output = qemu.run_serial(cmd)
+            self.assertEqual(status, 1, msg=output)
+            # Machine is qemu
+            self.assertTrue("Machine model: linux,dummy-virt" in output, msg=output)
+            # with KVM enabled
+            self.assertTrue("KVM: hypervisor services detected" in output, msg=output)
diff --git a/meta/lib/oeqa/utils/subprocesstweak.py b/meta/lib/oeqa/utils/subprocesstweak.py
index 3e43ed547b..1774513023 100644
--- a/meta/lib/oeqa/utils/subprocesstweak.py
+++ b/meta/lib/oeqa/utils/subprocesstweak.py
@@ -8,16 +8,11 @@ import subprocess
 class OETestCalledProcessError(subprocess.CalledProcessError):
    def __str__(self):
        def strify(o):
-            if isinstance(o, bytes):
+            return o.decode("utf-8", errors="replace") if isinstance(o, bytes) else o
-                return o.decode("utf-8", errors="replace")
-            else:
-                return o
-        s = "Command '%s' returned non-zero exit status %d" % (self.cmd, self.returncode)
+        s = super().__str__()
-        if hasattr(self, "output") and self.output:
+        s = s + "\nStandard Output: " + strify(self.output)
-            s = s + "\nStandard Output: " + strify(self.output)
+        s = s + "\nStandard Error: " + strify(self.stderr)
-        if hasattr(self, "stderr") and self.stderr:
-            s = s + "\nStandard Error: " + strify(self.stderr)
        return s
 def errors_have_output():
diff --git a/meta/recipes-bsp/u-boot/files/disable-CONFIG_BLOBLIST.cfg b/meta/recipes-bsp/u-boot/files/disable-CONFIG_BLOBLIST.cfg
new file mode 100644
index 0000000000..d01d3d12d8
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/disable-CONFIG_BLOBLIST.cfg
@@ -0,0 +1 @@
+# CONFIG_BLOBLIST is not set
diff --git a/meta/recipes-bsp/u-boot/files/disable_CONFIG_USB.cfg b/meta/recipes-bsp/u-boot/files/disable_CONFIG_USB.cfg
new file mode 100644
index 0000000000..1d2509982b
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/disable_CONFIG_USB.cfg
@@ -0,0 +1 @@
+# CONFIG_USB is not set
diff --git a/meta/recipes-bsp/u-boot/u-boot-common.inc b/meta/recipes-bsp/u-boot/u-boot-common.inc
index fd1eab5cdd..6cd9c39430 100644
--- a/meta/recipes-bsp/u-boot/u-boot-common.inc
+++ b/meta/recipes-bsp/u-boot/u-boot-common.inc
@@ -16,6 +16,10 @@ SRCREV = "34820924edbc4ec7803eb89d9852f4b870fa760a"
 SRC_URI = "git://source.denx.de/u-boot/u-boot.git;protocol=https;branch=master;tag=v${PV}"
+# workarounds for aarch64 kvm qemu boot regressions
+SRC_URI:append:qemuarm64 = " file://disable-CONFIG_BLOBLIST.cfg file://disable_CONFIG_USB.cfg"
+SRC_URI:append:genericarm64 = " file://disable-CONFIG_BLOBLIST.cfg file://disable_CONFIG_USB.cfg"
 S = "${WORKDIR}/git"
 B = "${WORKDIR}/build"
diff --git a/meta/recipes-connectivity/dhcpcd/dhcpcd_10.2.2.bb b/meta/recipes-connectivity/dhcpcd/dhcpcd_10.2.4.bb
index f9dfd2e245..dee921d21c 100644
--- a/meta/recipes-connectivity/dhcpcd/dhcpcd_10.2.2.bb
+++ b/meta/recipes-connectivity/dhcpcd/dhcpcd_10.2.4.bb
@@ -17,7 +17,7 @@ SRC_URI = "git://github.com/NetworkConfiguration/dhcpcd;protocol=https;branch=ma
           file://0001-dhcpcd.8-Fix-conflict-error-when-enable-multilib.patch \
           "
-SRCREV = "f6983c18dbf7989f43a2838beeaf62a54c53ff1d"
+SRCREV = "93df2b254caf9639f9ffb66e0fe2b584eeba6220"
 S = "${WORKDIR}/git"
 # Doesn't use automake so we can't do out-of-tree builds
diff --git a/meta/recipes-connectivity/dhcpcd/files/0001-20-resolv.conf-improve-the-sitation-of-working-with-.patch b/meta/recipes-connectivity/dhcpcd/files/0001-20-resolv.conf-improve-the-sitation-of-working-with-.patch
index 4f687b0292..512e33aebf 100644
--- a/meta/recipes-connectivity/dhcpcd/files/0001-20-resolv.conf-improve-the-sitation-of-working-with-.patch
+++ b/meta/recipes-connectivity/dhcpcd/files/0001-20-resolv.conf-improve-the-sitation-of-working-with-.patch
@@ -1,4 +1,4 @@
-From 33710a648a805d96abf49d5adf6ca55b89f9c858 Mon Sep 17 00:00:00 2001
+From d1581ce103db0a5db0b1761907fff9ddd6b55a8a Mon Sep 17 00:00:00 2001
 From: Chen Qi <Qi.Chen@windriver.com>
 Date: Wed, 9 Nov 2022 16:33:18 +0800
 Subject: [PATCH] 20-resolv.conf: improve the sitation of working with systemd
@@ -27,7 +27,7 @@ Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
 1 file changed, 13 insertions(+), 4 deletions(-)
 diff --git a/hooks/20-resolv.conf b/hooks/20-resolv.conf
-index 7c29e276..becc019f 100644
+index bd0b0df5..9c7721de 100644
 --- a/hooks/20-resolv.conf
 +++ b/hooks/20-resolv.conf
 @@ -11,8 +11,12 @@ nocarrier_roaming_dir="$state_dir/roaming"
@@ -59,7 +59,7 @@ index 7c29e276..becc019f 100644
        fi
        rm -f "$cf"
 }
-@@ -170,7 +179,7 @@ add_resolv_conf()
+@@ -179,7 +188,7 @@ add_resolv_conf()
        for x in ${new_domain_name_servers}; do
                conf="${conf}nameserver $x$NL"
        done
@@ -68,7 +68,7 @@ index 7c29e276..becc019f 100644
                [ -n "$ifmetric" ] && export IF_METRIC="$ifmetric"
                printf %s "$conf" | "$resolvconf" -a "$ifname"
                return $?
-@@ -186,7 +195,7 @@ add_resolv_conf()
+@@ -195,7 +204,7 @@ add_resolv_conf()
 
 remove_resolv_conf()
 {
diff --git a/meta/recipes-connectivity/iproute2/iproute2_6.14.0.bb b/meta/recipes-connectivity/iproute2/iproute2_6.15.0.bb
index a32ac34245..592e3e15af 100644
--- a/meta/recipes-connectivity/iproute2/iproute2_6.14.0.bb
+++ b/meta/recipes-connectivity/iproute2/iproute2_6.15.0.bb
@@ -15,7 +15,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/net/${BPN}/${BP}.tar.xz \
           file://0001-include-libnetlink.h-add-missing-include-for-htobe64.patch \
           "
-SRC_URI[sha256sum] = "a6d23588150096591c3d00fc27a324a82ee71d7a1a9eea78df5df17ad9b8461f"
+SRC_URI[sha256sum] = "8041854a882583ad5263466736c9c8c68c74b1a35754ab770d23343f947528fb"
 inherit update-alternatives bash-completion pkgconfig
diff --git a/meta/recipes-connectivity/nfs-utils/nfs-utils/0001-Fix-typecast-warning-with-clang.patch b/meta/recipes-connectivity/nfs-utils/nfs-utils/0001-Fix-typecast-warning-with-clang.patch
deleted file mode 100644
index f493a3051e..0000000000
--- a/meta/recipes-connectivity/nfs-utils/nfs-utils/0001-Fix-typecast-warning-with-clang.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 0a64c5ad17786796d84390e480a38b4f762229ae Mon Sep 17 00:00:00 2001
-From: Khem Raj <raj.khem@gmail.com>
-Date: Wed, 18 Dec 2024 19:20:39 -0800
-Subject: [PATCH v2] Fix typecast warning with clang
-Fixes
-file.c:200:8: error: assigning to 'char *' from 'const char *' discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers]
-Upstream-Status: Submitted [https://marc.info/?l=linux-nfs&m=173463533411103&w=2]
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
-Cc: Benjamin Coddington <bcodding@redhat.com>
-Cc: Steve Dickson <steved@redhat.com>
---
-v2: Make base as const char pointer insread of trying type punning
- support/nsm/file.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/support/nsm/file.c b/support/nsm/file.c
-index de122b0f..68f99bf0 100644
--- a/support/nsm/file.c
-+++ b/support/nsm/file.c
-@@ -184,7 +184,8 @@ static char *
- nsm_make_temp_pathname(const char *pathname)
- {
-        size_t size;
-       char *path, *base;
-+       char *path;
-+       const char *base;
-        int len;
- 
-        size = strlen(pathname) + sizeof(".new") + 1;
diff --git a/meta/recipes-connectivity/nfs-utils/nfs-utils/0003-support-nfs-xcommon.c-fix-a-formatting-error-with-cl.patch b/meta/recipes-connectivity/nfs-utils/nfs-utils/0003-support-nfs-xcommon.c-fix-a-formatting-error-with-cl.patch
deleted file mode 100644
index a99ba284e0..0000000000
--- a/meta/recipes-connectivity/nfs-utils/nfs-utils/0003-support-nfs-xcommon.c-fix-a-formatting-error-with-cl.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From cc59a7fe15b6ca2ee43cba0dc1d699323b36ffcc Mon Sep 17 00:00:00 2001
-From: Alexander Kanavin <alex@linutronix.de>
-Date: Fri, 21 Mar 2025 10:42:56 +0100
-Subject: [PATCH] support/nfs/xcommon.c: fix a formatting error with clang
-Specifically, this happens:
-| xcommon.c:101:24: error: format string is not a string literal [-Werror,-Wformat-nonliteral]
-|   101 |      vfprintf (stderr, fmt2, args);
-|       |                        ^~~~
-A similar approach (print \n seprately) is already used elsewhere in
-the same file.
-Upstream-Status: Submitted [via email to steved@redhat.com,linux-nfs@vger.kernel.org]
-Signed-off-by: Alexander Kanavin <alex@linutronix.de>
---
- support/nfs/xcommon.c | 6 ++----
- 1 file changed, 2 insertions(+), 4 deletions(-)
-diff --git a/support/nfs/xcommon.c b/support/nfs/xcommon.c
-index 3989f0b..1d04dd1 100644
--- a/support/nfs/xcommon.c
-+++ b/support/nfs/xcommon.c
-@@ -94,13 +94,11 @@ xstrconcat4 (const char *s, const char *t, const char *u, const char *v) {
- void
- nfs_error (const char *fmt, ...) {
-      va_list args;
-     char *fmt2;
- 
-     fmt2 = xstrconcat2 (fmt, "\n");
-      va_start (args, fmt);
-     vfprintf (stderr, fmt2, args);
-+     vfprintf (stderr, fmt, args);
-+     fprintf (stderr, "\n");
-      va_end (args);
-     free (fmt2);
- }
- 
- /* Make a canonical pathname from PATH.  Returns a freshly malloced string.
diff --git a/meta/recipes-connectivity/nfs-utils/nfs-utils_2.8.2.bb b/meta/recipes-connectivity/nfs-utils/nfs-utils_2.8.3.bb
index 1f3afa0560..9668ac0e86 100644
--- a/meta/recipes-connectivity/nfs-utils/nfs-utils_2.8.2.bb
+++ b/meta/recipes-connectivity/nfs-utils/nfs-utils_2.8.3.bb
@@ -22,13 +22,11 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/nfs-utils/${PV}/nfs-utils-${PV}.tar.x
           file://nfsserver \
           file://nfscommon \
           file://0001-locktest-Makefile.am-Do-not-use-build-flags.patch \
-           file://0001-Fix-typecast-warning-with-clang.patch \
           file://0004-Use-nogroup-for-nobody-group.patch \
           file://0005-find-OE-provided-Kerberos.patch \
-           file://0003-support-nfs-xcommon.c-fix-a-formatting-error-with-cl.patch \
           "
-SRC_URI[sha256sum] = "a39bbea76ac0ab9e6e8699caf3c308b6b310c20d458e8fa8606196d358e7fb15"
+SRC_URI[sha256sum] = "11e7c5847a8423a72931c865bd9296e7fd56ff270a795a849183900961711725"
 # Only kernel-module-nfsd is required here (but can be built-in)  - the nfsd module will
 # pull in the remainder of the dependencies.
diff --git a/meta/recipes-connectivity/ofono/ofono_2.16.bb b/meta/recipes-connectivity/ofono/ofono_2.17.bb
index ea3120974c..36bbe9439a 100644
--- a/meta/recipes-connectivity/ofono/ofono_2.16.bb
+++ b/meta/recipes-connectivity/ofono/ofono_2.17.bb
@@ -10,7 +10,7 @@ DEPENDS = "dbus glib-2.0 udev mobile-broadband-provider-info ell"
 SRC_URI = "${KERNELORG_MIRROR}/linux/network/${BPN}/${BP}.tar.xz \
           file://ofono \
           "
-SRC_URI[sha256sum] = "6fa2e168e74e1d1879008806537eff2f0b3c86eb5412fbc093f4236e2a15c9ef"
+SRC_URI[sha256sum] = "70bb50997d3a7657edf133355677f8e04b2158bcb031118a67b296107f6ea73e"
 inherit autotools pkgconfig update-rc.d systemd gobject-introspection-data
diff --git a/meta/recipes-connectivity/slirp/libslirp_4.9.0.bb b/meta/recipes-connectivity/slirp/libslirp_4.9.1.bb
index a159ed7c67..568bac389f 100644
--- a/meta/recipes-connectivity/slirp/libslirp_4.9.0.bb
+++ b/meta/recipes-connectivity/slirp/libslirp_4.9.1.bb
@@ -5,7 +5,7 @@ LICENSE = "BSD-3-Clause & MIT"
 LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=bca0186b14e6b05e338e729f106db727"
 SRC_URI = "git://gitlab.freedesktop.org/slirp/libslirp.git;protocol=https;branch=master"
-SRCREV = "c32a8a1ccaae8490142e67e078336a95c5ffc956"
+SRCREV = "9c744e1e52aa0d9646ed91d789d588696292c21e"
 S = "${WORKDIR}/git"
diff --git a/meta/recipes-core/kbd/kbd_2.7.1.bb b/meta/recipes-core/kbd/kbd_2.8.0.bb
index 9b9066e7b0..ababa09918 100644
--- a/meta/recipes-core/kbd/kbd_2.7.1.bb
+++ b/meta/recipes-core/kbd/kbd_2.8.0.bb
@@ -26,7 +26,7 @@ RCONFLICTS:${PN} = "console-tools"
 SRC_URI = "${KERNELORG_MIRROR}/linux/utils/${BPN}/${BP}.tar.xz \
           "
-SRC_URI[sha256sum] = "f167d899d92b56ccf12f6f49355173f93870a95f15d8aeebf5fdcd28a621aca8"
+SRC_URI[sha256sum] = "01f5806da7d1d34f594b7b2a6ae1ab23215344cf1064e8edcd3a90fef9776a11"
 # 'gzip -n' is set due to https://github.com/legionus/kbd/issues/124
 EXTRA_OECONF = "--disable-tests --enable-compress='gzip -n'"
diff --git a/meta/recipes-core/musl/libucontext_1.2.bb b/meta/recipes-core/musl/libucontext_1.3.2.bb
index 4e34df1439..65ee77d06e 100644
--- a/meta/recipes-core/musl/libucontext_1.2.bb
+++ b/meta/recipes-core/musl/libucontext_1.3.2.bb
@@ -8,7 +8,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=ebea527af0602d509b7f4c49533fb1bd"
 SECTION = "libs"
 DEPENDS = ""
-SRCREV = "4dde3417b4bb4b1b1545bd913be337680b5e28c3"
+SRCREV = "a0323579ac50b9a9d4033754d089f1fed0f59a00"
 SRC_URI = "git://github.com/kaniini/libucontext;branch=master;protocol=https \
           "
diff --git a/meta/recipes-core/musl/musl-locales_git.bb b/meta/recipes-core/musl/musl-locales_git.bb
index 1373c60daf..2815e2ddf0 100644
--- a/meta/recipes-core/musl/musl-locales_git.bb
+++ b/meta/recipes-core/musl/musl-locales_git.bb
@@ -82,4 +82,21 @@ FILES:locale-base-ru-ru += "${datadir}/i18n/locales/musl/ru_RU.UTF-8"
 FILES:locale-base-sr-rs += "${datadir}/i18n/locales/musl/sr_RS.UTF-8"
 FILES:locale-base-sv-se += "${datadir}/i18n/locales/musl/sv_SE.UTF-8"
+RRECOMMENDS:locale-base-cs-cz += "${PN}"
+RRECOMMENDS:locale-base-de-ch += "${PN}"
+RRECOMMENDS:locale-base-de-de += "${PN}"
+RRECOMMENDS:locale-base-en-gb += "${PN}"
+RRECOMMENDS:locale-base-en-us += "${PN}"
+RRECOMMENDS:locale-base-es-es += "${PN}"
+RRECOMMENDS:locale-base-fi-fi += "${PN}"
+RRECOMMENDS:locale-base-fr-ca += "${PN}"
+RRECOMMENDS:locale-base-fr-fr += "${PN}"
+RRECOMMENDS:locale-base-it-it += "${PN}"
+RRECOMMENDS:locale-base-nb-no += "${PN}"
+RRECOMMENDS:locale-base-nl-nl += "${PN}"
+RRECOMMENDS:locale-base-pt-br += "${PN}"
+RRECOMMENDS:locale-base-ru-ru += "${PN}"
+RRECOMMENDS:locale-base-sr-sr += "${PN}"
+RRECOMMENDS:locale-base-sv-se += "${PN}"
 UPSTREAM_CHECK_COMMITS = "1"
diff --git a/meta/recipes-devtools/icecc-create-env/icecc-create-env/icecc-create-env b/meta/recipes-devtools/icecc-create-env/icecc-create-env/icecc-create-env
deleted file mode 100755
index 64b5e20785..0000000000
--- a/meta/recipes-devtools/icecc-create-env/icecc-create-env/icecc-create-env
+++ /dev/null
@@ -1,382 +0,0 @@
-#! /usr/bin/env bash
-# icecc -- A simple distributed compiler system
-#
-# Copyright (C) 2004 by the Icecream Authors
-# GPL
-target_paths=
-target_aliases=
-# Always prints, optionally to a log file
-print_output ()
-{
-    if test -n "$log_path"; then
-        echo "$@" | tee -a "$log_path"
-    else
-        echo "$@"
-    fi
-}
-# Only prints if the debug flag is specified
-print_debug ()
-{
-    if test -n "$debug"; then
-        print_output "$@"
-    fi
-}
-is_dynamic_elf ()
-{
-    # Is the file an dynamically linked ELF executable?
-    (file -L "$1" | grep 'ELF' > /dev/null 2>&1) && (! file -L "$1" | grep 'static' > /dev/null 2>&1)
-}
-fix_rpath ()
-{
-    # Patches the RPATH for a file. When the program is executed in the chroot
-    # be iceccd, /proc is not mounted. As such, $ORIGIN can't be resolved. To
-    # work around this, replace all instances of $ORIGIN in RPATH with the
-    # known chroot path to the executables directory
-    local path="$1"
-    local origin="$2"
-    if ! is_dynamic_elf "$path"; then
-        return
-    fi
-    local old_rpath="`$PATCHELF --print-rpath "$path"`"
-    local new_rpath="`echo "$old_rpath" | \
-        sed 's/.*\[\(.*\)\]/\1/g' | \
-        sed "s,\\\$ORIGIN,/$origin,g"`"
-    if test -n "$new_rpath"; then
-        print_debug "Converting RPATH '$old_rpath' -> '$new_rpath'"
-        $PATCHELF --set-rpath "$new_rpath" "$path"
-    fi
-}
-add_path ()
-{
-    case " $target_paths " in
-        *" $1 "*)
-            return 1
-            ;;
-        *)
-            target_paths="$target_paths $1"
-            return 0
-            ;;
-    esac
-}
-add_alias ()
-{
-    if test "$1" != "$2"; then
-        local alias="$1=$2"
-        case " $target_aliases " in
-            *" $alias "*)
-                ;;
-            *)
-                print_debug "Adding alias '$2' -> '$1'"
-                target_aliases="$target_aliases $alias"
-                ;;
-        esac
-    fi
-}
-normalize_path ()
-{
-    # Normalizes the path to a file or directory, removing all "." and ".."
-    # entries. Use pwd -L to explicitly prevent symlink expansion
-    local path=$1
-    if test -f "$path"; then
-        pushd $(dirname $path) > /dev/null 2>&1
-        dir_path=$(pwd -L)
-        path=$dir_path/$(basename $path)
-        popd > /dev/null 2>&1
-    elif test -d "$path"; then
-        pushd $path > /dev/null 2>&1
-        path=$(pwd -L)
-        popd > /dev/null 2>&1
-    fi
-    echo $path
-}
-add_file_common()
-{
-    local p="$1"
-    local path="$2"
-    local alias="$3"
-    add_alias "$path" "$p"
-    if test -n "$alias"; then
-        add_alias "$path" "$alias"
-    fi
-    add_path "$path" || return 1
-    print_debug "Adding file '$path'"
-    return 0
-}
-add_deps()
-{
-    local path="$1"
-    local interp="$2"
-    if test -n "$interp" && test -x "$interp"; then
-        # Use the dynamic loaders --list argument to list the
-        # dependencies. The program may have a different program
-        # interpreter (typical when using uninative tarballs), which is
-        # why we can't just call ldd.
-        deps="`$interp --list "$path"`"
-    else
-        deps="`ldd "$path"`"
-    fi
-    print_debug "Dependencies are:"
-    print_debug "$deps"
-    if test -n "$deps"; then
-        for lib in $deps; do
-            # ldd now outputs ld as /lib/ld-linux.so.xx on current nptl
-            # based glibc this regexp parse the outputs like:
-            # ldd /usr/bin/gcc
-            #         linux-gate.so.1 =>  (0xffffe000)
-            #         libc.so.6 => /lib/tls/libc.so.6 (0xb7e81000)
-            #         /lib/ld-linux.so.2 (0xb7fe8000)
-            # covering both situations ( with => and without )
-            lib="`echo "$lib" | sed -n 's,^[^/]*\(/[^ ]*\).*,\1,p'`"
-            test -f "$lib" || continue
-            # Check whether the same library also exists in the parent
-            # directory, and prefer that on the assumption that it is a
-            # more generic one.
-            local baselib=`echo "$lib" | sed 's,\(/[^/]*\)/.*\(/[^/]*\)$,\1\2,'`
-            test -f "$baselib" && lib=$baselib
-            add_dependency "$lib" "$interp"
-        done
-    fi
-}
-add_dependency()
-{
-    local p=`normalize_path $1`
-    # readlink is required for Yocto, so we can use it
-    local path=`readlink -f "$p"`
-    local interp="$2"
-    add_file_common "$p" "$path" || return
-    if test -x "$path" && is_dynamic_elf "$path"; then
-        add_deps "$path" "$interp"
-    fi
-}
-add_file ()
-{
-    local p=`normalize_path $1`
-    # readlink is required for Yocto, so we can use it
-    local path=`readlink -f "$p"`
-    add_file_common "$p" "$path" "$2" || return
-    if test -x "$path" && is_dynamic_elf "$path"; then
-        # Request the program interpeter (dynamic loader)
-        interp=`readelf -W -l "$path" | grep "Requesting program interpreter:" | sed "s/\s*\[Requesting program interpreter:\s*\(.*\)\]/\1/g"`
-        print_debug "Interpreter is '$interp'"
-        add_deps "$path" "$interp"
-    fi
-}
-while test -n "$1"; do
-    case "$1" in
-        --respect-path)
-            # Ignore for backward compatability
-            ;;
-        --debug)
-            debug=1
-            ;;
-        --log)
-            do_log=1
-            ;;
-        --extra=*)
-            extra_tools="$extra_tools ${1#--extra=}"
-            ;;
-        *)
-            break
-            ;;
-    esac
-    shift
-done
-added_gcc=$1
-shift
-added_gxx=$1
-shift
-added_as=$1
-shift
-archive_name=$1
-if test -n "$do_log"; then
-    log_path="$archive_name.log"
-    rm -f "$log_path"
-fi
-if test -z "$PATCHELF"; then
-    PATCHELF=`which patchelf 2> /dev/null`
-fi
-if test -z "$PATCHELF"; then
-    PATCHELF=`which patchelf-uninative 2> /dev/null`
-fi
-if test -z "$PATCHELF"; then
-    print_output "patchelf is required"
-    exit 1
-fi
-if test -z "$added_gcc" || test -z "$added_gxx" ; then
-    print_output "usage: $0 <gcc_path> <g++_path>"
-    exit 1
-fi
-if ! test -x "$added_gcc" ; then
-    print_output "'$added_gcc' is not executable."
-    exit 1
-fi
-if ! test -x "$added_gxx" ; then
-    print_output "'$added_gcc' is not executable."
-    exit 1
-fi
-add_file $added_gcc /usr/bin/gcc
-add_file $added_gxx /usr/bin/g++
-if test -z "$added_as" ; then
-    add_file /usr/bin/as /usr/bin/as
-else
-    if ! test -x "$added_as" ; then
-        print_output "'$added_as' is not executable."
-        exit 1
-    fi
-    add_file $added_as  /usr/bin/as
-fi
-add_file `$added_gcc -print-prog-name=cc1` /usr/bin/cc1
-add_file `$added_gxx -print-prog-name=cc1plus` /usr/bin/cc1plus
-specfile=`$added_gcc -print-file-name=specs`
-if test -n "$specfile" && test -e "$specfile"; then
-    add_file "$specfile"
-fi
-ltofile=`$added_gcc -print-prog-name=lto1`
-pluginfile=`normalize_path "${ltofile%lto1}liblto_plugin.so"`
-if test -r "$pluginfile"
-then
-    add_file $pluginfile  ${pluginfile#*usr}
-    add_file $pluginfile  /usr${pluginfile#*usr}
-fi
-# for testing the environment is usable at all
-if test -x /bin/true; then
-    add_file /bin/true
-elif test -x /usr/bin/true; then
-    add_file /usr/bin/true /bin/true
-else
-    print_output "'true' not found"
-    exit 1
-fi
-for extra in $extra_tools; do
-    if test -x "$extra"; then
-        add_file "$extra"
-    else
-        print_output "'$extra' not found"
-        exit 1
-    fi
-done
-link_rel ()
-{
-    local target="$1"
-    local name="$2"
-    local base="$3"
-    local prefix=`dirname $name`
-    prefix=`echo $prefix | sed 's,[^/]\+,..,g' | sed 's,^/*,,g'`
-    ln -s $prefix/$target $base/$name
-}
-tempdir=`mktemp -d /tmp/iceccenvXXXXXX`
-target_files=
-for path in $target_paths; do
-    mkdir -p $tempdir/`dirname $path`
-    cp -pH $path $tempdir/$path
-    if test -f $tempdir/$path -a -x $tempdir/$path; then
-        strip -s $tempdir/$path 2>/dev/null
-    fi
-    fix_rpath $tempdir/$path `dirname $path`
-    target_files="$target_files $path"
-done
-for i in $target_aliases; do
-    target=`echo $i | cut -d= -f1`
-    link_name=`echo $i | cut -d= -f2`
-    mkdir -p $tempdir/`dirname $link_name`
-    # Relative links are used because the files are checked for being
-    # executable outside the chroot
-    link_rel $target $link_name $tempdir
-    link_name=`echo $link_name | cut -b2-`
-    target_files="$target_files $link_name"
-done
-#sort the files
-target_files=`for i in $target_files; do echo $i; done | sort`
-#test if an archive name was supplied
-#if not use the md5 of all files as the archive name
-if test -z "$archive_name"; then
-    md5sum=NONE
-    for file in /usr/bin/md5sum /bin/md5 /usr/bin/md5; do
-        if test -x $file; then
-            md5sum=$file
-            break
-        fi
-    done
-    #calculate md5 and use it as the archive name
-    archive_name=`for i in $target_files; do test -f $tempdir/$i && $md5sum $tempdir/$i; done | sed -e 's/ .*$//' | $md5sum | sed -e 's/ .*$//'`.tar.gz || {
-        print_output "Couldn't compute MD5 sum."
-        exit 2
-    }
-    mydir=`pwd`
-else
-    mydir="`dirname "$archive_name"`"
-    #check if we have a full path or only a filename
-    if test "$mydir" = "." ; then
-        mydir=`pwd`
-    else
-        mydir=""
-    fi
-fi
-print_output "creating $archive_name"
-cd $tempdir
-# Add everything in the temp directory. Tar doesn't like to be given files with
-# ".." in them, which frequently happens in $target_files, and will strip off
-# the path prefix past the offending "..". This makes the archive generate
-# incorrectly
-tar -czf "$mydir/$archive_name" . || {
-    print_output "Couldn't create archive"
-    exit 3
-}
-cd ..
-rm -rf $tempdir
diff --git a/meta/recipes-devtools/icecc-create-env/icecc-create-env_0.1.bb b/meta/recipes-devtools/icecc-create-env/icecc-create-env_0.1.bb
deleted file mode 100644
index dd1b257b10..0000000000
--- a/meta/recipes-devtools/icecc-create-env/icecc-create-env_0.1.bb
+++ /dev/null
@@ -1,39 +0,0 @@
-SUMMARY = "icecc environment setup script"
-DESCRIPTION = "This is a version of the icecc-create-env script that has \
-been modified in order to make it work with OE."
-SECTION = "base"
-# source file has just a "GPL" word, but upstream is GPL-2.0-or-later.
-# most probably just GPL would be a mistake
-LICENSE = "GPL-2.0-or-later"
-LIC_FILES_CHKSUM = "file://icecc-create-env;beginline=2;endline=5;md5=ae1df3d6a058bfda40b66094c5f6065f"
-DEPENDS = ""
-INHIBIT_DEFAULT_DEPS = "1"
-ICECC_DISABLED = "1"
-# This is needed, because otherwise there is dependency loop from quilt-native
-# Dependency loop #1 found:
-#  Task 10907 (meta/recipes-devtools/quilt/quilt-native_0.60.bb, do_install) (dependent Tasks ['quilt-native, do_compile'])
-#  Task 10908 (meta/recipes-devtools/quilt/quilt-native_0.60.bb, do_populate_sysroot) (dependent Tasks ['quilt-native, do_install'])
-#  Task 10997 (meta/recipes-devtools/icecc-create-env/icecc-create-env-native_0.1.bb, do_patch) (dependent Tasks ['icecc-create-env-native, do_unpack', 'quilt-native, do_populate_sysroot'])
-#  Task 11001 (meta/recipes-devtools/icecc-create-env/icecc-create-env-native_0.1.bb, do_configure) (dependent Tasks ['icecc-create-env-native, do_patch'])
-#  Task 11002 (meta/recipes-devtools/icecc-create-env/icecc-create-env-native_0.1.bb, do_compile) (dependent Tasks ['icecc-create-env-native, do_configure'])
-#  Task 10998 (meta/recipes-devtools/icecc-create-env/icecc-create-env-native_0.1.bb, do_install) (dependent Tasks ['icecc-create-env-native, do_compile'])
-#  Task 10999 (meta/recipes-devtools/icecc-create-env/icecc-create-env-native_0.1.bb, do_populate_sysroot) (dependent Tasks ['icecc-create-env-native, do_install'])
-#  Task 10910 (meta/recipes-devtools/quilt/quilt-native_0.60.bb, do_configure) (dependent Tasks ['quilt-native, do_patch', 'icecc-create-env-native, do_populate_sysroot'])
-#  Task 10911 (meta/recipes-devtools/quilt/quilt-native_0.60.bb, do_compile) (dependent Tasks ['quilt-native, do_configure'])
-PATCHTOOL = "patch"
-SRC_URI = "file://icecc-create-env"
-S = "${WORKDIR}/sources"
-UNPACKDIR = "${S}"
-do_install() {
-    install -d ${D}/${bindir}
-    install -m 0755 ${S}/icecc-create-env ${D}/${bindir}
-}
-BBCLASSEXTEND = "native nativesdk"
-RDEPENDS:${PN}:class-nativesdk = "patchelf"
diff --git a/meta/recipes-devtools/icecc-toolchain/icecc-toolchain/icecc-env.sh b/meta/recipes-devtools/icecc-toolchain/icecc-toolchain/icecc-env.sh
deleted file mode 100644
index 0dccc41c8a..0000000000
--- a/meta/recipes-devtools/icecc-toolchain/icecc-toolchain/icecc-env.sh
+++ /dev/null
@@ -1,49 +0,0 @@
-#! /bin/sh
-# Copyright (c) 2018 Joshua Watt, Garmin International,Inc.
-#
-# Permission is hereby granted, free of charge, to any person obtaining a copy
-# of this software and associated documentation files (the "Software"), to deal
-# in the Software without restriction, including without limitation the rights
-# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-# copies of the Software, and to permit persons to whom the Software is
-# furnished to do so, subject to the following conditions:
-#
-# The above copyright notice and this permission notice shall be included in
-# all copies or substantial portions of the Software.
-#
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-# SOFTWARE.
-#
-if [ -z "$ICECC_PATH" ]; then
-    ICECC_PATH=$(which icecc 2> /dev/null || true)
-fi
-if [ -n "$ICECC_PATH" ]; then
-    # Default to disabling the caret workaround. If set to "1", icecc will
-    # locally recompile any files that have warnings, which can adversely
-    # affect performance.
-    #
-    # See: https://github.com/icecc/icecream/issues/190
-    if [ -z "$ICECC_CARET_WORKAROUND" ]; then
-        ICECC_CARET_WORKAROUND="0"
-    fi
-    if [ "$ICECC_CARET_WORKAROUND" != "1" ]; then
-        CFLAGS="$CFLAGS -fno-diagnostics-show-caret"
-        CXXFLAGS="$CXXFLAGS -fno-diagnostics-show-caret"
-    fi
-    export ICECC_PATH ICECC_CARET_WORKAROUND
-    export ICECC_VERSION="$(echo "$OECORE_NATIVE_SYSROOT/usr/share/${TARGET_PREFIX}icecream/@TOOLCHAIN_ENV@" | sed "s,@TARGET_PREFIX@,$TARGET_PREFIX,g")"
-    export ICECC="$(which ${CROSS_COMPILE}gcc)"
-    export ICECXX="$(which ${CROSS_COMPILE}g++)"
-    export ICEAS="$(which ${CROSS_COMPILE}as)"
-    export PATH="$OECORE_NATIVE_SYSROOT/usr/share/${TARGET_PREFIX}icecream/bin:$PATH"
-else
-    echo "Icecc not found. Disabling distributed compiling"
-fi
diff --git a/meta/recipes-devtools/icecc-toolchain/icecc-toolchain/icecc-setup.sh b/meta/recipes-devtools/icecc-toolchain/icecc-toolchain/icecc-setup.sh
deleted file mode 100644
index fbd9f038b8..0000000000
--- a/meta/recipes-devtools/icecc-toolchain/icecc-toolchain/icecc-setup.sh
+++ /dev/null
@@ -1,38 +0,0 @@
-#! /bin/sh
-# Copyright (c) 2018 Joshua Watt, Garmin International,Inc.
-#
-# Permission is hereby granted, free of charge, to any person obtaining a copy
-# of this software and associated documentation files (the "Software"), to deal
-# in the Software without restriction, including without limitation the rights
-# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-# copies of the Software, and to permit persons to whom the Software is
-# furnished to do so, subject to the following conditions:
-#
-# The above copyright notice and this permission notice shall be included in
-# all copies or substantial portions of the Software.
-#
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-# SOFTWARE.
-#
-# ICECC_PATH will have been found icecc-env.sh
-if [ -z "$ICECC_PATH" ]; then
-    exit 0
-fi
-echo "Setting up IceCream distributed compiling..."
-# Create the environment
-mkdir -p "`dirname $ICECC_VERSION`"
-icecc-create-env $ICECC $ICECXX $ICEAS $ICECC_VERSION || exit $?
-# Create symbolic links
-d="$OECORE_NATIVE_SYSROOT/usr/share/${TARGET_PREFIX}icecream/bin"
-mkdir -p "$d"
-ln -sf "$ICECC_PATH" "$d/${CROSS_COMPILE}gcc"
-ln -sf "$ICECC_PATH" "$d/${CROSS_COMPILE}g++"
diff --git a/meta/recipes-devtools/icecc-toolchain/nativesdk-icecc-toolchain_0.1.bb b/meta/recipes-devtools/icecc-toolchain/nativesdk-icecc-toolchain_0.1.bb
deleted file mode 100644
index a7f5fc4cb4..0000000000
--- a/meta/recipes-devtools/icecc-toolchain/nativesdk-icecc-toolchain_0.1.bb
+++ /dev/null
@@ -1,39 +0,0 @@
-# Copyright (c) 2018 Joshua Watt, Garmin International,Inc.
-# Released under the MIT license (see COPYING.MIT for the terms)
-SUMMARY = "Generates Icecream toolchain for SDK"
-DESCRIPTION = "${SUMMARY}"
-LICENSE = "MIT"
-LIC_FILES_CHKSUM = "file://${UNPACKDIR}/icecc-env.sh;beginline=2;endline=20;md5=dd6b68c1efed8a9fb04e409b3b287d47"
-INHIBIT_DEFAULT_DEPS = "1"
-SRC_URI = "\
-    file://icecc-env.sh \
-    file://icecc-setup.sh \
-    "
-inherit nativesdk
-ENV_NAME = "${DISTRO}-${TCLIBC}-${SDK_ARCH}-@TARGET_PREFIX@${DISTRO_VERSION}.tar.gz"
-do_compile() {
-}
-do_install() {
-    install -d ${D}${SDKPATHNATIVE}${datadir}/icecream/bin
-    install -d ${D}${SDKPATHNATIVE}/environment-setup.d/
-    install -m 0644 ${UNPACKDIR}/icecc-env.sh ${D}${SDKPATHNATIVE}/environment-setup.d/
-    sed -i ${D}${SDKPATHNATIVE}/environment-setup.d/icecc-env.sh \
-        -e 's,@TOOLCHAIN_ENV@,${ENV_NAME},g'
-    install -d ${D}${SDKPATHNATIVE}/post-relocate-setup.d/
-    install -m 0755 ${UNPACKDIR}/icecc-setup.sh ${D}${SDKPATHNATIVE}/post-relocate-setup.d/
-    sed -i ${D}${SDKPATHNATIVE}/post-relocate-setup.d/icecc-setup.sh \
-        -e 's,@TOOLCHAIN_ENV@,${ENV_NAME},g'
-}
-PACKAGES = "${PN}"
-FILES:${PN} = "${SDKPATHNATIVE}"
-RDEPENDS:${PN} += "nativesdk-icecc-create-env"
diff --git a/meta/recipes-devtools/libmodulemd/libmodulemd_git.bb b/meta/recipes-devtools/libmodulemd/libmodulemd_git.bb
index d3bef83306..0c73032923 100644
--- a/meta/recipes-devtools/libmodulemd/libmodulemd_git.bb
+++ b/meta/recipes-devtools/libmodulemd/libmodulemd_git.bb
@@ -6,8 +6,8 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=25a3927bff3ee4f5b21bcb0ed3fcd6bb"
 SRC_URI = "git://github.com/fedora-modularity/libmodulemd;protocol=https;branch=main"
-PV = "2.15.0"
+PV = "2.15.1"
-SRCREV = "bfde7f2d04fbb22e26c9eb843e4ccc478762dd8d"
+SRCREV = "e7f179eeeb6eee1403f090fc43a3c80bb08b5bfd"
 S = "${WORKDIR}/git"
diff --git a/meta/recipes-devtools/m4/m4-1.4.20.inc b/meta/recipes-devtools/m4/m4-1.4.20.inc
index 2ea3a9bace..a31335f173 100644
--- a/meta/recipes-devtools/m4/m4-1.4.20.inc
+++ b/meta/recipes-devtools/m4/m4-1.4.20.inc
@@ -7,6 +7,7 @@ GNU M4 also has built-in functions for including files, running shell commands,
 inherit autotools texinfo ptest gettext
 SRC_URI = "${GNU_MIRROR}/m4/m4-${PV}.tar.gz \
+           file://0001-gettext-h-Avoid-gcc-Wformat-security-warnings-with-d.patch \
           "
 SRC_URI:append:class-target = " file://run-ptest \
                                file://serial-tests-config.patch \
@@ -48,9 +49,9 @@ do_install_ptest:append:libc-glibc() {
                       -e  "s;LOCALE_FR_UTF8='none';LOCALE_FR_UTF8='fr_FR.utf8';g" ${D}${PTEST_PATH}/tests/Makefile
 }
-RDEPENDS:${PN}-ptest += "make coreutils diffutils bash"
+RDEPENDS:${PN}-ptest += "make coreutils diffutils bash locale-base-fr-fr"
 RDEPENDS:${PN}-ptest:append:libc-glibc = "\
-     locale-base-fr-fr \
     locale-base-fr-fr.iso-8859-1 \
     glibc-gconv-iso8859-1 \
 "
diff --git a/meta/recipes-devtools/m4/m4/0001-gettext-h-Avoid-gcc-Wformat-security-warnings-with-d.patch b/meta/recipes-devtools/m4/m4/0001-gettext-h-Avoid-gcc-Wformat-security-warnings-with-d.patch
new file mode 100644
index 0000000000..6fad05041f
--- /dev/null
+++ b/meta/recipes-devtools/m4/m4/0001-gettext-h-Avoid-gcc-Wformat-security-warnings-with-d.patch
@@ -0,0 +1,133 @@
+From c4dc0ab4424fca31635b7837b1c180f7d3df8ede Mon Sep 17 00:00:00 2001
+From: Bruno Haible <bruno@clisp.org>
+Date: Wed, 28 May 2025 15:14:07 +0200
+Subject: [PATCH] gettext-h: Avoid gcc -Wformat-security warnings with
+ --disable-nls.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Reported by Holger Hoffstätte <holger@applied-asynchrony.com> in
+<https://lists.gnu.org/archive/html/bug-gnulib/2025-05/msg00225.html>.
+* lib/gettext.h (gettext, dgettext, dcgettext): With gcc in C mode,
+define these as inline functions.
+* lib/sigpipe-die.c (sigpipe_die): Use translated string as a format
+string, relying on the format string checking done by 'msgfmt -c'.
+* lib/xmemcoll.c (collate_error): Revert commit from 2025-01-17.
+* lib/xprintf.c (xvprintf, xvfprintf): Likewise.
+* lib/openat-die.c (openat_save_fail, openat_restore_fail): Revert
+commit from 2024-12-10.
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/gnulib.git/commit/?id=6e5015dd557b20ae4a0829c4bf78480ce2f4cb04]
+Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
+---
+ lib/gettext.h    | 49 ++++++++++++++++++++++++++++++++++++------------
+ lib/openat-die.c |  4 ++--
+ lib/xprintf.c    |  4 ++--
+ 3 files changed, 41 insertions(+), 16 deletions(-)
+diff --git a/lib/gettext.h b/lib/gettext.h
+index ea0c27e..bb3d975 100644
+--- a/lib/gettext.h
+++ b/lib/gettext.h
+@@ -59,18 +59,43 @@
+ #  endif
+ # endif
+ 
+-/* Disabled NLS.
+-   The casts to 'const char *' serve the purpose of producing warnings
+-   for invalid uses of the value returned from these functions.
+-   On pre-ANSI systems without 'const', the config.h file is supposed to
+-   contain "#define const".  */
+-# undef gettext
+-# define gettext(Msgid) ((const char *) (Msgid))
+-# undef dgettext
+-# define dgettext(Domainname, Msgid) ((void) (Domainname), gettext (Msgid))
+-# undef dcgettext
+-# define dcgettext(Domainname, Msgid, Category) \
+-    ((void) (Category), dgettext (Domainname, Msgid))
+/* Disabled NLS.  */
+# if defined __GNUC__ && !defined __clang__ && !defined __cplusplus
+/* Use inline functions, to avoid warnings
+     warning: format not a string literal and no format arguments
+   that don't occur with enabled NLS.  */
+__attribute__ ((__always_inline__, __gnu_inline__)) extern inline
+const char *
+gettext (const char *msgid)
+{
+  return msgid;
+}
+__attribute__ ((__always_inline__, __gnu_inline__)) extern inline
+const char *
+dgettext (const char *domain, const char *msgid)
+{
+  (void) domain;
+  return msgid;
+}
+__attribute__ ((__always_inline__, __gnu_inline__)) extern inline
+const char *
+dcgettext (const char *domain, const char *msgid, int category)
+{
+  (void) domain;
+  (void) category;
+  return msgid;
+}
+# else
+/* The casts to 'const char *' serve the purpose of producing warnings
+   for invalid uses of the value returned from these functions.  */
+#  undef gettext
+#  define gettext(Msgid) ((const char *) (Msgid))
+#  undef dgettext
+#  define dgettext(Domainname, Msgid) ((void) (Domainname), gettext (Msgid))
+#  undef dcgettext
+#  define dcgettext(Domainname, Msgid, Category) \
+     ((void) (Category), dgettext (Domainname, Msgid))
+# endif
+ # undef ngettext
+ # define ngettext(Msgid1, Msgid2, N) \
+     ((N) == 1 \
+diff --git a/lib/openat-die.c b/lib/openat-die.c
+index 3fbb5d8..79a5b23 100644
+--- a/lib/openat-die.c
+++ b/lib/openat-die.c
+@@ -34,7 +34,7 @@ _Noreturn void
+ openat_save_fail (int errnum)
+ {
+ #ifndef GNULIB_LIBPOSIX
+-  error (exit_failure, errnum, "%s",
+  error (exit_failure, errnum,
+          _("unable to record current working directory"));
+ #endif
+   /* _Noreturn cannot be applied to error, since it returns
+@@ -53,7 +53,7 @@ _Noreturn void
+ openat_restore_fail (int errnum)
+ {
+ #ifndef GNULIB_LIBPOSIX
+-  error (exit_failure, errnum, "%s",
+  error (exit_failure, errnum,
+          _("failed to return to initial working directory"));
+ #endif
+ 
+diff --git a/lib/xprintf.c b/lib/xprintf.c
+index 4d9a3e5..790af53 100644
+--- a/lib/xprintf.c
+++ b/lib/xprintf.c
+@@ -45,7 +45,7 @@ xvprintf (char const *restrict format, va_list args)
+ {
+   off64_t retval = vzprintf (format, args);
+   if (retval < 0 && ! ferror (stdout))
+-    error (exit_failure, errno, "%s", _("cannot perform formatted output"));
+    error (exit_failure, errno, _("cannot perform formatted output"));
+ 
+   return retval;
+ }
+@@ -67,7 +67,7 @@ xvfprintf (FILE *restrict stream, char const *restrict format, va_list args)
+ {
+   off64_t retval = vfzprintf (stream, format, args);
+   if (retval < 0 && ! ferror (stream))
+-    error (exit_failure, errno, "%s", _("cannot perform formatted output"));
+    error (exit_failure, errno, _("cannot perform formatted output"));
+ 
+   return retval;
+ }
diff --git a/meta/recipes-devtools/meson/meson/0001-Make-CPU-family-warnings-fatal.patch b/meta/recipes-devtools/meson/meson/0001-Make-CPU-family-warnings-fatal.patch
index b5d0546967..98ca08c2ca 100644
--- a/meta/recipes-devtools/meson/meson/0001-Make-CPU-family-warnings-fatal.patch
+++ b/meta/recipes-devtools/meson/meson/0001-Make-CPU-family-warnings-fatal.patch
@@ -1,4 +1,4 @@
-From a503c007d3db87acf711d110c01e11c2d087f99c Mon Sep 17 00:00:00 2001
+From c01e5e29953e0302988f2d60adc50ebfa0e5d670 Mon Sep 17 00:00:00 2001
 From: Ross Burton <ross.burton@intel.com>
 Date: Tue, 3 Jul 2018 13:59:09 +0100
 Subject: [PATCH] Make CPU family warnings fatal
@@ -26,10 +26,10 @@ index 43fad0c..27be871 100644
         endian = literal['endian']
         if endian not in ('little', 'big'):
 diff --git a/mesonbuild/environment.py b/mesonbuild/environment.py
-index f322cda..53a0ac0 100644
+index 2a9cf16..6b2bd6b 100644
 --- a/mesonbuild/environment.py
 +++ b/mesonbuild/environment.py
-@@ -429,10 +429,8 @@ def detect_cpu_family(compilers: CompilersDict) -> str:
+@@ -436,10 +436,8 @@ def detect_cpu_family(compilers: CompilersDict) -> str:
         if compilers and not any_compiler_has_define(compilers, '__mips64'):
             trial = 'mips'
 
diff --git a/meta/recipes-devtools/meson/meson/0001-python-module-do-not-manipulate-the-environment-when.patch b/meta/recipes-devtools/meson/meson/0001-python-module-do-not-manipulate-the-environment-when.patch
index 85a93c8e7a..f654447013 100644
--- a/meta/recipes-devtools/meson/meson/0001-python-module-do-not-manipulate-the-environment-when.patch
+++ b/meta/recipes-devtools/meson/meson/0001-python-module-do-not-manipulate-the-environment-when.patch
@@ -1,4 +1,4 @@
-From 859711f99ea9b183a1dffb9b97de09ad0fe9803b Mon Sep 17 00:00:00 2001
+From 6c3734f533ee7ad493188c8fc17bb1c65b65f0bd Mon Sep 17 00:00:00 2001
 From: Alexander Kanavin <alex.kanavin@gmail.com>
 Date: Mon, 19 Nov 2018 14:24:26 +0100
 Subject: [PATCH] python module: do not manipulate the environment when calling
@@ -12,10 +12,10 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
 1 file changed, 1 insertion(+), 5 deletions(-)
 diff --git a/mesonbuild/dependencies/python.py b/mesonbuild/dependencies/python.py
-index 3dab31c..b9307fc 100644
+index ab040b5..a34b271 100644
 --- a/mesonbuild/dependencies/python.py
 +++ b/mesonbuild/dependencies/python.py
-@@ -410,9 +410,6 @@ def python_factory(env: 'Environment', for_machine: 'MachineChoice',
+@@ -412,9 +412,6 @@ def python_factory(env: 'Environment', for_machine: 'MachineChoice',
                     empty.name = 'python'
                     return empty
 
@@ -25,7 +25,7 @@ index 3dab31c..b9307fc 100644
                 try:
                     return PythonPkgConfigDependency(name, env, kwargs, installation, True)
                 finally:
-@@ -421,8 +418,7 @@ def python_factory(env: 'Environment', for_machine: 'MachineChoice',
+@@ -423,8 +420,7 @@ def python_factory(env: 'Environment', for_machine: 'MachineChoice',
                             os.environ[name] = value
                         elif name in os.environ:
                             del os.environ[name]
diff --git a/meta/recipes-devtools/meson/meson_1.8.0.bb b/meta/recipes-devtools/meson/meson_1.8.1.bb
index 78e0a0ed80..af4bc9fecd 100644
--- a/meta/recipes-devtools/meson/meson_1.8.0.bb
+++ b/meta/recipes-devtools/meson/meson_1.8.1.bb
@@ -15,7 +15,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/${PV}/meson-${PV}.tar.gz \
           file://0001-Make-CPU-family-warnings-fatal.patch \
           file://0002-Support-building-allarch-recipes-again.patch \
           "
-SRC_URI[sha256sum] = "0a9b23311271519bd03dca12d7d8b0eab582c3a2c5da433d465b6e519dc88e2f"
+SRC_URI[sha256sum] = "b4e3b80e8fa633555abf447a95a700aba1585419467b2710d5e5bf88df0a7011"
 UPSTREAM_CHECK_REGEX = "(?P<pver>\d+(\.\d+)+)$"
 inherit python_setuptools_build_meta github-releases
diff --git a/meta/recipes-devtools/mtd/files/0001-Improve-check-for-GCC-compiler-version.patch b/meta/recipes-devtools/mtd/files/0001-Improve-check-for-GCC-compiler-version.patch
index 3cd58e053d..2329dfece3 100644
--- a/meta/recipes-devtools/mtd/files/0001-Improve-check-for-GCC-compiler-version.patch
+++ b/meta/recipes-devtools/mtd/files/0001-Improve-check-for-GCC-compiler-version.patch
@@ -8,7 +8,7 @@ When using unreleased compiler has version like
 becomes true, therefore check for full version string
 which is more rubust.
-Upstream-Status: Submitted [https://lists.infradead.org/pipermail/linux-mtd/2025-March/108860.html]
+Upstream-Status: Backport [https://github.com/sigma-star/mtd-utils/commit/ac0ab65ebcd7b11739986b81343457469fbb43b0]
 Signed-off-by: Khem Raj <raj.khem@gmail.com>
 ---
 ubifs-utils/common/atomic.h | 6 +++++-
diff --git a/meta/recipes-devtools/mtd/files/0001-ubifs-utils-ubifs.h-Include-fcntl.h.patch b/meta/recipes-devtools/mtd/files/0001-ubifs-utils-ubifs.h-Include-fcntl.h.patch
index a9ececc14c..b603ac8fd6 100644
--- a/meta/recipes-devtools/mtd/files/0001-ubifs-utils-ubifs.h-Include-fcntl.h.patch
+++ b/meta/recipes-devtools/mtd/files/0001-ubifs-utils-ubifs.h-Include-fcntl.h.patch
@@ -25,7 +25,7 @@ when building with musl:
 |       |                                            off_t
 | make: *** [Makefile:4878: ubifs-utils/common/mkfs_ubifs-compr.o] Error 1
-Upstream-Status: Submitted [https://lore.kernel.org/linux-mtd/20250219130244.2119582-1-festevam@gmail.com/T/#t]
+Upstream-Status: Backport [https://github.com/sigma-star/mtd-utils/commit/12bc9ad824bd8f18a5ec9c7154ad2374cf8c7ae3]
 Signed-off-by: Fabio Estevam <festevam@gmail.com>
 Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
 Reviewed-by: Khem Raj <raj.khem@gmail.com>
diff --git a/meta/recipes-devtools/mtd/files/0002-ubifs-utils-journal-Include-sys-stat.h.patch b/meta/recipes-devtools/mtd/files/0002-ubifs-utils-journal-Include-sys-stat.h.patch
index ea376437df..d92a3fb4b6 100644
--- a/meta/recipes-devtools/mtd/files/0002-ubifs-utils-journal-Include-sys-stat.h.patch
+++ b/meta/recipes-devtools/mtd/files/0002-ubifs-utils-journal-Include-sys-stat.h.patch
@@ -14,7 +14,7 @@ when building with musl:
 | ../git/ubifs-utils/libubifs/journal.c:415:14: error: 'S_IFREG' undeclared (first use in this function)
 |   415 |         case S_IFREG:
-Upstream-Status: Submitted [https://lore.kernel.org/linux-mtd/20250219130244.2119582-2-festevam@gmail.com/T/#t]
+Upstream-Status: Backport [https://github.com/sigma-star/mtd-utils/commit/173f9714c8da1d685bfa951d43b9310d16bbab3c]
 Signed-off-by: Fabio Estevam <festevam@gmail.com>
 Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
 ---
diff --git a/meta/recipes-devtools/mtd/files/0003-ubifs-utils-link-libmissing.a-in-case-execinfo.h-isn.patch b/meta/recipes-devtools/mtd/files/0003-ubifs-utils-link-libmissing.a-in-case-execinfo.h-isn.patch
index b4c190d554..efaedad70b 100644
--- a/meta/recipes-devtools/mtd/files/0003-ubifs-utils-link-libmissing.a-in-case-execinfo.h-isn.patch
+++ b/meta/recipes-devtools/mtd/files/0003-ubifs-utils-link-libmissing.a-in-case-execinfo.h-isn.patch
@@ -13,7 +13,7 @@ backtrace().
 Guard the execinfo.h include and if it isn't available instead include
 libmissing.h, and link to libmissing.a to provide backtrace() if needed.
-Upstream-Status: Submitted [https://lore.kernel.org/linux-mtd/20250226182400.1723418-1-ross.burton@arm.com/]
+Upstream-Status: Backport [https://github.com/sigma-star/mtd-utils/commit/8a83b306db64d6f60186d4396b0b770163b85b6e]
 Signed-off-by: Ross Burton <ross.burton@arm.com>
 Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
 Signed-off-by: Fabio Estevam <festevam@gmail.com>
diff --git a/meta/recipes-devtools/mtd/files/0004-ubifs-utils-extract_files-Include-linux-limits.h.patch b/meta/recipes-devtools/mtd/files/0004-ubifs-utils-extract_files-Include-linux-limits.h.patch
index 87806af27d..3444f330dc 100644
--- a/meta/recipes-devtools/mtd/files/0004-ubifs-utils-extract_files-Include-linux-limits.h.patch
+++ b/meta/recipes-devtools/mtd/files/0004-ubifs-utils-extract_files-Include-linux-limits.h.patch
@@ -13,7 +13,7 @@ with musl:
 | ../git/ubifs-utils/fsck.ubifs/extract_files.c:144:47: note: each undeclared identifier is reported only once for each function it appears in
 | make: *** [Makefile:4374: ubifs-utils/fsck.ubifs/fsck_ubifs-extract_files.o] Error 1
-Upstream-Status: Submitted [https://lore.kernel.org/linux-mtd/20250219130244.2119582-4-festevam@gmail.com/T/#t]
+Upstream-Status: Backport [https://github.com/sigma-star/mtd-utils/commit/77981a2888c711268b0e7f32af6af159c2288e23]
 Signed-off-by: Fabio Estevam <festevam@gmail.com>
 Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
 ---
diff --git a/meta/recipes-devtools/python/python3-beartype_0.20.2.bb b/meta/recipes-devtools/python/python3-beartype_0.21.0.bb
index 9941b28fd8..43427c1472 100644
--- a/meta/recipes-devtools/python/python3-beartype_0.20.2.bb
+++ b/meta/recipes-devtools/python/python3-beartype_0.21.0.bb
@@ -4,7 +4,7 @@ HOMEPAGE = "https://beartype.readthedocs.io"
 LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=3a5bc05a109d235912da97a053cd7a58"
-SRC_URI[sha256sum] = "38c60c065ad99364a8c767e8a0e71ba8263d467b91414ed5dcffb7758a2e8079"
+SRC_URI[sha256sum] = "f9a5078f5ce87261c2d22851d19b050b64f6a805439e8793aecf01ce660d3244"
 inherit pypi python_hatchling
diff --git a/meta/recipes-devtools/python/python3-cython_3.1.0.bb b/meta/recipes-devtools/python/python3-cython_3.1.1.bb
index f93135b94b..1bc6eda4ac 100644
--- a/meta/recipes-devtools/python/python3-cython_3.1.0.bb
+++ b/meta/recipes-devtools/python/python3-cython_3.1.1.bb
@@ -7,7 +7,7 @@ SECTION = "devel/python"
 LICENSE = "Apache-2.0"
 LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=61c3ee8961575861fa86c7e62bc9f69c"
-SRC_URI[sha256sum] = "1097dd60d43ad0fff614a57524bfd531b35c13a907d13bee2cc2ec152e6bf4a1"
+SRC_URI[sha256sum] = "505ccd413669d5132a53834d792c707974248088c4f60c497deb1b416e366397"
 inherit pypi setuptools3 cython
diff --git a/meta/recipes-devtools/python/python3-hypothesis_6.131.14.bb b/meta/recipes-devtools/python/python3-hypothesis_6.132.0.bb
index 269ed936b6..52688b8765 100644
--- a/meta/recipes-devtools/python/python3-hypothesis_6.131.14.bb
+++ b/meta/recipes-devtools/python/python3-hypothesis_6.132.0.bb
@@ -13,7 +13,7 @@ SRC_URI += " \
    file://test_rle.py \
    "
-SRC_URI[sha256sum] = "347edc46cfe9bfcfb0598c4c927ed8fd573edfc8bacd2162023c4cf16accb702"
+SRC_URI[sha256sum] = "55868060add41baa6176ed9c3456655678d140c74e3514bdf03381dae6391403"
 RDEPENDS:${PN} += " \
    python3-attrs \
diff --git a/meta/recipes-devtools/python/python3-jsonschema/d71f96a6523875c9694fcdf468c9f458323d07f2.patch b/meta/recipes-devtools/python/python3-jsonschema/d71f96a6523875c9694fcdf468c9f458323d07f2.patch
deleted file mode 100644
index 65cc2b4cf0..0000000000
--- a/meta/recipes-devtools/python/python3-jsonschema/d71f96a6523875c9694fcdf468c9f458323d07f2.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From d71f96a6523875c9694fcdf468c9f458323d07f2 Mon Sep 17 00:00:00 2001
-From: Julian Berman <Julian@GrayVines.com>
-Date: Thu, 17 Oct 2024 09:36:35 -0400
-Subject: [PATCH] Fix the annotation for validator_for's default.
-This still doesn't seem to satisfy mypy, so tell it to be quiet.
-Upstream-Status: Backport [https://github.com/python-jsonschema/jsonschema/commit/d71f96a6523875c9694fcdf468c9f458323d07f2]
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
- jsonschema/validators.py | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-diff --git a/jsonschema/validators.py b/jsonschema/validators.py
-index 85c39160..b8ca3bd4 100644
--- a/jsonschema/validators.py
-+++ b/jsonschema/validators.py
-@@ -857,7 +857,7 @@ def extend(
-     version="draft2020-12",
- )
- 
-_LATEST_VERSION = Draft202012Validator
-+_LATEST_VERSION: type[Validator] = Draft202012Validator
- 
- 
- class _RefResolver:
-@@ -1334,7 +1334,7 @@ def validate(instance, schema, cls=None, *args, **kwargs):  # noqa: D417
- 
- def validator_for(
-     schema,
-    default: Validator | _utils.Unset = _UNSET,
-+    default: type[Validator] | _utils.Unset = _UNSET,
- ) -> type[Validator]:
-     """
-     Retrieve the validator class appropriate for validating the given schema.
-@@ -1396,7 +1396,7 @@ class is returned:
-     DefaultValidator = _LATEST_VERSION if default is _UNSET else default
- 
-     if schema is True or schema is False or "$schema" not in schema:
-        return DefaultValidator
-+        return DefaultValidator  # type: ignore[return-value]
-     if schema["$schema"] not in _META_SCHEMAS and default is _UNSET:
-         warn(
-             (
diff --git a/meta/recipes-devtools/python/python3-jsonschema_4.23.0.bb b/meta/recipes-devtools/python/python3-jsonschema_4.24.0.bb
index 82b7bb23ed..7a5f4a09a6 100644
--- a/meta/recipes-devtools/python/python3-jsonschema_4.23.0.bb
+++ b/meta/recipes-devtools/python/python3-jsonschema_4.24.0.bb
@@ -4,9 +4,7 @@ LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://COPYING;md5=7a60a81c146ec25599a3e1dabb8610a8 \
                    file://json/LICENSE;md5=9d4de43111d33570c8fe49b4cb0e01af"
-SRC_URI += "file://d71f96a6523875c9694fcdf468c9f458323d07f2.patch"
+SRC_URI[sha256sum] = "0b4e8069eb12aedfa881333004bccaec24ecef5a8a6a4b6df142b2cc9599d196"
-SRC_URI[sha256sum] = "d71497fef26351a33265337fa77ffeb82423f3ea21283cd9467bb03999266bc4"
 inherit pypi python_hatchling
diff --git a/meta/recipes-devtools/python/python3-maturin-crates.inc b/meta/recipes-devtools/python/python3-maturin-crates.inc
index 2f196f5657..5c939a09a8 100644
--- a/meta/recipes-devtools/python/python3-maturin-crates.inc
+++ b/meta/recipes-devtools/python/python3-maturin-crates.inc
@@ -34,7 +34,7 @@ SRC_URI += " \
    crate://crates.io/cargo-options/0.7.4 \
    crate://crates.io/cargo-platform/0.1.8 \
    crate://crates.io/cargo-xwin/0.18.4 \
-    crate://crates.io/cargo-zigbuild/0.19.7 \
+    crate://crates.io/cargo-zigbuild/0.20.0 \
    crate://crates.io/cargo_metadata/0.19.0 \
    crate://crates.io/cbindgen/0.28.0 \
    crate://crates.io/cc/1.2.16 \
@@ -60,7 +60,7 @@ SRC_URI += " \
    crate://crates.io/crc/3.2.1 \
    crate://crates.io/crc-catalog/2.4.0 \
    crate://crates.io/crc32fast/1.4.2 \
-    crate://crates.io/crossbeam-channel/0.5.13 \
+    crate://crates.io/crossbeam-channel/0.5.15 \
    crate://crates.io/crossbeam-deque/0.8.5 \
    crate://crates.io/crossbeam-epoch/0.9.18 \
    crate://crates.io/crossbeam-utils/0.8.20 \
@@ -169,10 +169,10 @@ SRC_URI += " \
    crate://crates.io/num-conv/0.1.0 \
    crate://crates.io/number_prefix/0.4.0 \
    crate://crates.io/once_cell/1.20.2 \
-    crate://crates.io/openssl/0.10.70 \
+    crate://crates.io/openssl/0.10.72 \
    crate://crates.io/openssl-macros/0.1.1 \
    crate://crates.io/openssl-probe/0.1.5 \
-    crate://crates.io/openssl-sys/0.9.105 \
+    crate://crates.io/openssl-sys/0.9.107 \
    crate://crates.io/option-ext/0.2.0 \
    crate://crates.io/os_pipe/1.2.0 \
    crate://crates.io/overload/0.1.1 \
@@ -362,7 +362,7 @@ SRC_URI += " \
    crate://crates.io/zeroize/1.8.1 \
    crate://crates.io/zerovec/0.10.4 \
    crate://crates.io/zerovec-derive/0.10.3 \
-    crate://crates.io/zip/2.2.3 \
+    crate://crates.io/zip/2.3.0 \
    crate://crates.io/zopfli/0.8.1 \
 "
@@ -398,7 +398,7 @@ SRC_URI[cargo-config2-0.1.26.sha256sum] = "d83ce0be8bd1479e5de6202def660e6c7e27e
 SRC_URI[cargo-options-0.7.4.sha256sum] = "f3540247c0a37a76eb324acc238dc617786ea22c43b95da560c82a8f2714321f"
 SRC_URI[cargo-platform-0.1.8.sha256sum] = "24b1f0365a6c6bb4020cd05806fd0d33c44d38046b8bd7f0e40814b9763cabfc"
 SRC_URI[cargo-xwin-0.18.4.sha256sum] = "60f1954e4ffa0f4c47b3df5e6e9508706d8dcaa56152cd672dcee02930ba0326"
-SRC_URI[cargo-zigbuild-0.19.7.sha256sum] = "04cc649328f39bbf1ef92ef753406e1785ff1074941c398e5214b6c74d318a9e"
+SRC_URI[cargo-zigbuild-0.20.0.sha256sum] = "3f6e9e856390d5b0a859acaeda16528f8a61c964bdb894c3216c254908f1c2ea"
 SRC_URI[cargo_metadata-0.19.0.sha256sum] = "afc309ed89476c8957c50fb818f56fe894db857866c3e163335faa91dc34eb85"
 SRC_URI[cbindgen-0.28.0.sha256sum] = "eadd868a2ce9ca38de7eeafdcec9c7065ef89b42b32f0839278d55f35c54d1ff"
 SRC_URI[cc-1.2.16.sha256sum] = "be714c154be609ec7f5dad223a33bf1482fff90472de28f7362806e6d4832b8c"
@@ -424,7 +424,7 @@ SRC_URI[cpufeatures-0.2.12.sha256sum] = "53fe5e26ff1b7aef8bca9c6080520cfb8d9333c
 SRC_URI[crc-3.2.1.sha256sum] = "69e6e4d7b33a94f0991c26729976b10ebde1d34c3ee82408fb536164fa10d636"
 SRC_URI[crc-catalog-2.4.0.sha256sum] = "19d374276b40fb8bbdee95aef7c7fa6b5316ec764510eb64b8dd0e2ed0d7e7f5"
 SRC_URI[crc32fast-1.4.2.sha256sum] = "a97769d94ddab943e4510d138150169a2758b5ef3eb191a9ee688de3e23ef7b3"
-SRC_URI[crossbeam-channel-0.5.13.sha256sum] = "33480d6946193aa8033910124896ca395333cae7e2d1113d1fef6c3272217df2"
+SRC_URI[crossbeam-channel-0.5.15.sha256sum] = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2"
 SRC_URI[crossbeam-deque-0.8.5.sha256sum] = "613f8cc01fe9cf1a3eb3d7f488fd2fa8388403e97039e2f73692932e291a770d"
 SRC_URI[crossbeam-epoch-0.9.18.sha256sum] = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
 SRC_URI[crossbeam-utils-0.8.20.sha256sum] = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80"
@@ -533,10 +533,10 @@ SRC_URI[nu-ansi-term-0.46.0.sha256sum] = "77a8165726e8236064dbb45459242600304b42
 SRC_URI[num-conv-0.1.0.sha256sum] = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
 SRC_URI[number_prefix-0.4.0.sha256sum] = "830b246a0e5f20af87141b25c173cd1b609bd7779a4617d6ec582abaf90870f3"
 SRC_URI[once_cell-1.20.2.sha256sum] = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
-SRC_URI[openssl-0.10.70.sha256sum] = "61cfb4e166a8bb8c9b55c500bc2308550148ece889be90f609377e58140f42c6"
+SRC_URI[openssl-0.10.72.sha256sum] = "fedfea7d58a1f73118430a55da6a286e7b044961736ce96a16a17068ea25e5da"
 SRC_URI[openssl-macros-0.1.1.sha256sum] = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 SRC_URI[openssl-probe-0.1.5.sha256sum] = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
-SRC_URI[openssl-sys-0.9.105.sha256sum] = "8b22d5b84be05a8d6947c7cb71f7c849aa0f112acd4bf51c2a7c1c988ac0a9dc"
+SRC_URI[openssl-sys-0.9.107.sha256sum] = "8288979acd84749c744a9014b4382d42b8f7b2592847b5afb2ed29e5d16ede07"
 SRC_URI[option-ext-0.2.0.sha256sum] = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
 SRC_URI[os_pipe-1.2.0.sha256sum] = "29d73ba8daf8fac13b0501d1abeddcfe21ba7401ada61a819144b6c2a4f32209"
 SRC_URI[overload-0.1.1.sha256sum] = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
@@ -726,5 +726,5 @@ SRC_URI[zerofrom-derive-0.1.5.sha256sum] = "595eed982f7d355beb85837f651fa22e90b3
 SRC_URI[zeroize-1.8.1.sha256sum] = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
 SRC_URI[zerovec-0.10.4.sha256sum] = "aa2b893d79df23bfb12d5461018d408ea19dfafe76c2c7ef6d4eba614f8ff079"
 SRC_URI[zerovec-derive-0.10.3.sha256sum] = "6eafa6dfb17584ea3e2bd6e76e0cc15ad7af12b09abdd1ca55961bed9b1063c6"
-SRC_URI[zip-2.2.3.sha256sum] = "b280484c454e74e5fff658bbf7df8fdbe7a07c6b2de4a53def232c15ef138f3a"
+SRC_URI[zip-2.3.0.sha256sum] = "84e9a772a54b54236b9b744aaaf8d7be01b4d6e99725523cb82cb32d1c81b1d7"
 SRC_URI[zopfli-0.8.1.sha256sum] = "e5019f391bac5cf252e93bbcc53d039ffd62c7bfb7c150414d61369afe57e946"
diff --git a/meta/recipes-devtools/python/python3-maturin_1.8.3.bb b/meta/recipes-devtools/python/python3-maturin_1.8.6.bb
index 08975e177f..ab509331c3 100644
--- a/meta/recipes-devtools/python/python3-maturin_1.8.3.bb
+++ b/meta/recipes-devtools/python/python3-maturin_1.8.6.bb
@@ -5,8 +5,9 @@ LICENSE = "MIT | Apache-2.0"
 LIC_FILES_CHKSUM = "file://license-apache;md5=1836efb2eb779966696f473ee8540542 \
                    file://license-mit;md5=85fd3b67069cff784d98ebfc7d5c0797"
+# This is needed until Cargo.lock has libc-0.2.172+
 SRC_URI += "file://0001-Define-more-ioctl-codes-on-riscv32gc-unknown-linux-g.patch;patchdir=${CARGO_VENDORING_DIRECTORY}/libc-0.2.167"
-SRC_URI[sha256sum] = "304762f86fd53a8031b1bf006d12572a2aa0a5235485031113195cc0152e1e12"
+SRC_URI[sha256sum] = "0e0dc2e0bfaa2e1bd238e0236cf8a2b7e2250ccaa29c1aa8d0e61fa664b0289d"
 S = "${WORKDIR}/maturin-${PV}"
diff --git a/meta/recipes-devtools/python/python3-pdm_2.24.1.bb b/meta/recipes-devtools/python/python3-pdm_2.24.2.bb
index 3f251c7f0f..d24e03d650 100644
--- a/meta/recipes-devtools/python/python3-pdm_2.24.1.bb
+++ b/meta/recipes-devtools/python/python3-pdm_2.24.2.bb
@@ -4,7 +4,7 @@ LICENSE = "MIT"
 SECTION = "devel/python"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=2eb31a2cc1a758c34b499f287dd04ef2"
-SRC_URI[sha256sum] = "fc8adf011caa4ee2b0f25dabf890152aa4153cc21599ea67fe0c14e533dcd6d9"
+SRC_URI[sha256sum] = "ce0d5e9005fe26238b8ba5cf0e37ac00acab2fb90f904bf0219a5e8445849dfb"
 inherit pypi python_setuptools_build_meta
diff --git a/meta/recipes-devtools/python/python3-pycryptodome_3.22.0.bb b/meta/recipes-devtools/python/python3-pycryptodome_3.22.0.bb
deleted file mode 100644
index c65b2a71fc..0000000000
--- a/meta/recipes-devtools/python/python3-pycryptodome_3.22.0.bb
+++ /dev/null
@@ -1,5 +0,0 @@
-require python-pycryptodome.inc
-inherit python_setuptools_build_meta
-SRC_URI[sha256sum] = "fd7ab568b3ad7b77c908d7c3f7e167ec5a8f035c64ff74f10d47a4edd043d723"
diff --git a/meta/recipes-devtools/python/python3-pycryptodome_3.23.0.bb b/meta/recipes-devtools/python/python3-pycryptodome_3.23.0.bb
new file mode 100644
index 0000000000..2528162ff8
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-pycryptodome_3.23.0.bb
@@ -0,0 +1,5 @@
+require python-pycryptodome.inc
+inherit python_setuptools_build_meta
+SRC_URI[sha256sum] = "447700a657182d60338bab09fdb27518f8856aecd80ae4c6bdddb67ff5da44ef"
diff --git a/meta/recipes-devtools/python/python3-pycryptodomex_3.22.0.bb b/meta/recipes-devtools/python/python3-pycryptodomex_3.23.0.bb
index 5cc37d81c2..43dba3faa3 100644
--- a/meta/recipes-devtools/python/python3-pycryptodomex_3.22.0.bb
+++ b/meta/recipes-devtools/python/python3-pycryptodomex_3.23.0.bb
@@ -1,7 +1,7 @@
 require python-pycryptodome.inc
 inherit python_setuptools_build_meta
-SRC_URI[sha256sum] = "a1da61bacc22f93a91cbe690e3eb2022a03ab4123690ab16c46abb693a9df63d"
+SRC_URI[sha256sum] = "71909758f010c82bc99b0abf4ea12012c98962fbf0583c2164f8b84533c2e4da"
 FILES:${PN}-tests = " \
    ${PYTHON_SITEPACKAGES_DIR}/Cryptodome/SelfTest/ \
diff --git a/meta/recipes-devtools/python/python3-ruamel-yaml_0.18.10.bb b/meta/recipes-devtools/python/python3-ruamel-yaml_0.18.12.bb
index 02b04e3c0c..3b136b3b58 100644
--- a/meta/recipes-devtools/python/python3-ruamel-yaml_0.18.10.bb
+++ b/meta/recipes-devtools/python/python3-ruamel-yaml_0.18.12.bb
@@ -9,7 +9,7 @@ UPSTREAM_CHECK_PYPI_PACKAGE = "${PYPI_PACKAGE}"
 inherit pypi python_setuptools_build_meta
-SRC_URI[sha256sum] = "20c86ab29ac2153f80a428e1254a8adf686d3383df04490514ca3b79a362db58"
+SRC_URI[sha256sum] = "5a38fd5ce39d223bebb9e3a6779e86b9427a03fb0bf9f270060f8b149cffe5e2"
 RDEPENDS:${PN} += "\
    python3-shell \
diff --git a/meta/recipes-devtools/python/python3-setuptools/0001-_distutils-sysconfig.py-make-it-possible-to-substite.patch b/meta/recipes-devtools/python/python3-setuptools/0001-_distutils-sysconfig.py-make-it-possible-to-substite.patch
index 8ccffeef1d..39153883b0 100644
--- a/meta/recipes-devtools/python/python3-setuptools/0001-_distutils-sysconfig.py-make-it-possible-to-substite.patch
+++ b/meta/recipes-devtools/python/python3-setuptools/0001-_distutils-sysconfig.py-make-it-possible-to-substite.patch
@@ -1,4 +1,4 @@
-From c3d2c40e10f24724ab2e3d5f236823f3076c7aec Mon Sep 17 00:00:00 2001
+From e2eab8c254f16c461de25123f6859b8a18db5cd8 Mon Sep 17 00:00:00 2001
 From: Alexander Kanavin <alex@linutronix.de>
 Date: Wed, 11 May 2022 21:41:14 +0200
 Subject: [PATCH] _distutils/sysconfig.py: make it possible to substite the
@@ -20,7 +20,7 @@ Signed-off-by: Alexander Kanavin <alex@linutronix.de>
 1 file changed, 10 insertions(+), 2 deletions(-)
 diff --git a/setuptools/_distutils/sysconfig.py b/setuptools/_distutils/sysconfig.py
-index e5facae..0932f6f 100644
+index 7ddc869..01a06af 100644
 --- a/setuptools/_distutils/sysconfig.py
 +++ b/setuptools/_distutils/sysconfig.py
 @@ -134,6 +134,8 @@ def get_python_inc(plat_specific: bool = False, prefix: str | None = None) -> st
@@ -32,7 +32,7 @@ index e5facae..0932f6f 100644
     resolved_prefix = prefix if prefix is not None else default_prefix
     # MinGW imitates posix like layout, but os.name != posix
     os_name = "posix" if is_mingw() else os.name
-@@ -256,7 +258,13 @@ def get_python_lib(
+@@ -246,7 +248,13 @@ def get_python_lib(
 
     early_prefix = prefix
 
@@ -47,7 +47,7 @@ index e5facae..0932f6f 100644
         if standard_lib:
             prefix = plat_specific and BASE_EXEC_PREFIX or BASE_PREFIX
         else:
-@@ -271,7 +279,7 @@ def get_python_lib(
+@@ -261,7 +269,7 @@ def get_python_lib(
             # Pure Python
             libdir = "lib"
         implementation = 'pypy' if IS_PYPY else 'python'
diff --git a/meta/recipes-devtools/python/python3-setuptools_80.8.0.bb b/meta/recipes-devtools/python/python3-setuptools_80.9.0.bb
index 327eff5700..533d8ce3d4 100644
--- a/meta/recipes-devtools/python/python3-setuptools_80.8.0.bb
+++ b/meta/recipes-devtools/python/python3-setuptools_80.9.0.bb
@@ -11,7 +11,7 @@ CVE_PRODUCT = "python3-setuptools python:setuptools"
 SRC_URI += " \
            file://0001-_distutils-sysconfig.py-make-it-possible-to-substite.patch"
-SRC_URI[sha256sum] = "49f7af965996f26d43c8ae34539c8d99c5042fbff34302ea151eaa9c207cd257"
+SRC_URI[sha256sum] = "f36b47402ecde768dbfafc46e8e4207b4360c654f1f3bb84475f0a28628fb19c"
 DEPENDS += "python3"
diff --git a/meta/recipes-devtools/python/python3-trove-classifiers_2025.3.19.19.bb b/meta/recipes-devtools/python/python3-trove-classifiers_2025.5.9.12.bb
index 39fb997e88..68b09537bc 100644
--- a/meta/recipes-devtools/python/python3-trove-classifiers_2025.3.19.19.bb
+++ b/meta/recipes-devtools/python/python3-trove-classifiers_2025.5.9.12.bb
@@ -3,7 +3,7 @@ HOMEPAGE = "https://github.com/pypa/trove-classifiers"
 LICENSE = "Apache-2.0"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=86d3f3a95c324c9479bd8986968f4327"
-SRC_URI[sha256sum] = "98e9d396fe908d5f43b7454fa4c43d17cd0fdadf046f45fb38a5e3af8d959ecd"
+SRC_URI[sha256sum] = "7ca7c8a7a76e2cd314468c677c69d12cc2357711fcab4a60f87994c1589e5cb5"
 PYPI_PACKAGE = "trove_classifiers"
 UPSTREAM_CHECK_PYPI_PACKAGE = "${PYPI_PACKAGE}"
diff --git a/meta/recipes-devtools/python/python3-uritools_4.0.3.bb b/meta/recipes-devtools/python/python3-uritools_5.0.0.bb
index 4210407e00..35a8f2a0d9 100644
--- a/meta/recipes-devtools/python/python3-uritools_4.0.3.bb
+++ b/meta/recipes-devtools/python/python3-uritools_5.0.0.bb
@@ -2,9 +2,9 @@ SUMMARY = "URI parsing, classification and composition"
 HOMEPAGE = "https://github.com/tkem/uritools/"
 LICENSE = "MIT"
-LIC_FILES_CHKSUM = "file://LICENSE;md5=539275e657c6b7af026bb908356f7541"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=e21bbe53b2730bfe1911cf381b81821e"
-SRC_URI[sha256sum] = "ee06a182a9c849464ce9d5fa917539aacc8edd2a4924d1b7aabeeecabcae3bc2"
+SRC_URI[sha256sum] = "68180cad154062bd5b5d9ffcdd464f8de6934414b25462ae807b00b8df9345de"
 inherit pypi python_setuptools_build_meta ptest-python-pytest
diff --git a/meta/recipes-devtools/quilt/quilt-native_0.68.bb b/meta/recipes-devtools/quilt/quilt-native_0.69.bb
index 22374425fa..22374425fa 100644
--- a/meta/recipes-devtools/quilt/quilt-native_0.68.bb
+++ b/meta/recipes-devtools/quilt/quilt-native_0.69.bb
diff --git a/meta/recipes-devtools/quilt/quilt.inc b/meta/recipes-devtools/quilt/quilt.inc
index 4bae5c6c19..59d13237e2 100644
--- a/meta/recipes-devtools/quilt/quilt.inc
+++ b/meta/recipes-devtools/quilt/quilt.inc
@@ -11,11 +11,12 @@ SRC_URI = "${SAVANNAH_GNU_MIRROR}/quilt/quilt-${PV}.tar.gz \
        file://run-ptest \
        file://test.sh \
        file://0001-tests-Allow-different-output-from-mv.patch \
+        file://0001-contrib-spec-filters-obs-usr-bin-sh-bin-sh.patch \
 "
 SRC_URI:append:class-target = " file://gnu_patch_test_fix_target.patch"
-SRC_URI[sha256sum] = "fe8c09de03c106e85b3737c8f03ade147c956b79ed7af485a1c8a3858db38426"
+SRC_URI[sha256sum] = "555ddffde22da3c86d1caf5a9c1fb8a152ac2b84730437bd39cc08849c9f4852"
 inherit autotools-brokensep ptest
diff --git a/meta/recipes-devtools/quilt/quilt/0001-contrib-spec-filters-obs-usr-bin-sh-bin-sh.patch b/meta/recipes-devtools/quilt/quilt/0001-contrib-spec-filters-obs-usr-bin-sh-bin-sh.patch
new file mode 100644
index 0000000000..219deab0d6
--- /dev/null
+++ b/meta/recipes-devtools/quilt/quilt/0001-contrib-spec-filters-obs-usr-bin-sh-bin-sh.patch
@@ -0,0 +1,28 @@
+From 0e00d22182c4cce3b242dd8f4166d3df238b3a0b Mon Sep 17 00:00:00 2001
+From: Robert Yang <liezhi.yang@windriver.com>
+Date: Wed, 4 Jun 2025 00:21:40 -0700
+Subject: [PATCH] contrib/spec-filters/obs: /usr/bin/sh -> /bin/sh
+The /bin/sh is more common than /usr/bin/sh, the later one doesn't exist on
+distributions such as Ubuntu 22.04.
+Upstream-Status: Submitted [https://lists.nongnu.org/archive/html/quilt-dev/2025-06/msg00002.html]
+Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
+---
+ contrib/spec-filters/obs | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/contrib/spec-filters/obs b/contrib/spec-filters/obs
+index 2f5b169..b675230 100755
+--- a/contrib/spec-filters/obs
+++ b/contrib/spec-filters/obs
+@@ -1,4 +1,4 @@
+-#!/usr/bin/sh
+#!/bin/sh
+ # Basic spec file filter for OBS packages
+ # https://build.opensuse.org/
+ 
+-- 
+2.49.0
diff --git a/meta/recipes-devtools/quilt/quilt_0.68.bb b/meta/recipes-devtools/quilt/quilt_0.69.bb
index bf9e3c720f..bf9e3c720f 100644
--- a/meta/recipes-devtools/quilt/quilt_0.68.bb
+++ b/meta/recipes-devtools/quilt/quilt_0.69.bb
diff --git a/meta/recipes-devtools/repo/repo_2.54.bb b/meta/recipes-devtools/repo/repo_2.55.bb
index 07ee583172..5fea49abb3 100644
--- a/meta/recipes-devtools/repo/repo_2.54.bb
+++ b/meta/recipes-devtools/repo/repo_2.55.bb
@@ -11,7 +11,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
 SRC_URI = "git://gerrit.googlesource.com/git-repo.git;protocol=https;branch=main;tag=v${PV} \
           "
-SRCREV = "97dc5c1bd9527c2abe2183b16a4b7ef037dc34a7"
+SRCREV = "08815ad3eb245872700201e03c47cb504d1dc3f9"
 MIRRORS += "git://gerrit.googlesource.com/git-repo.git git://github.com/GerritCodeReview/git-repo.git"
diff --git a/meta/recipes-devtools/ruby/ruby/0002-Obey-LDFLAGS-for-the-link-of-libruby.patch b/meta/recipes-devtools/ruby/ruby/0002-Obey-LDFLAGS-for-the-link-of-libruby.patch
index bb67df0f40..84fe9aee3d 100644
--- a/meta/recipes-devtools/ruby/ruby/0002-Obey-LDFLAGS-for-the-link-of-libruby.patch
+++ b/meta/recipes-devtools/ruby/ruby/0002-Obey-LDFLAGS-for-the-link-of-libruby.patch
@@ -1,4 +1,4 @@
-From 7e2337d8b0daf264785cb06d1d6c7d61e428a11b Mon Sep 17 00:00:00 2001
+From 2625f6c155105d352d6a1ff3a722e7896431ff91 Mon Sep 17 00:00:00 2001
 From: Christopher Larson <chris_larson@mentor.com>
 Date: Thu, 5 May 2016 10:59:07 -0700
 Subject: [PATCH] Obey LDFLAGS for the link of libruby
@@ -10,10 +10,10 @@ Upstream-Status: Pending
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/template/Makefile.in b/template/Makefile.in
-index 05432cd..41a05bb 100644
+index 8f996b8..c708b64 100644
 --- a/template/Makefile.in
 +++ b/template/Makefile.in
-@@ -119,7 +119,7 @@ ENABLE_SHARED = @ENABLE_SHARED@
+@@ -120,7 +120,7 @@ ENABLE_SHARED = @ENABLE_SHARED@
 LDSHARED = @LIBRUBY_LDSHARED@
 DLDSHARED = @DLDSHARED@
 XDLDFLAGS = @DLDFLAGS@
diff --git a/meta/recipes-devtools/ruby/ruby/0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch b/meta/recipes-devtools/ruby/ruby/0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch
index eda45dd862..190eb7d728 100644
--- a/meta/recipes-devtools/ruby/ruby/0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch
+++ b/meta/recipes-devtools/ruby/ruby/0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch
@@ -1,4 +1,4 @@
-From ff25f6dddcfbbb7b0464485bb5132458866ab51a Mon Sep 17 00:00:00 2001
+From 97051be9cb9317d2c4d61a82d6d953809e962f13 Mon Sep 17 00:00:00 2001
 From: Lucas Kanashiro <kanashiro@debian.org>
 Date: Fri, 1 Nov 2019 15:25:17 -0300
 Subject: [PATCH] Make gemspecs reproducible
@@ -12,10 +12,10 @@ Upstream-Status: Backport [debian]
 1 file changed, 3 insertions(+), 1 deletion(-)
 diff --git a/lib/rubygems/specification.rb b/lib/rubygems/specification.rb
-index 8f353ae..095125f 100644
+index 0b905a7..a102e3c 100644
 --- a/lib/rubygems/specification.rb
 +++ b/lib/rubygems/specification.rb
-@@ -1711,7 +1711,9 @@ class Gem::Specification < Gem::BasicSpecification
+@@ -1709,7 +1709,9 @@ class Gem::Specification < Gem::BasicSpecification
                 raise(Gem::InvalidSpecificationException,
                       "invalid date format in specification: #{date.inspect}")
               end
diff --git a/meta/recipes-devtools/ruby/ruby_3.4.3.bb b/meta/recipes-devtools/ruby/ruby_3.4.4.bb
index 45047b8859..39e86fdd28 100644
--- a/meta/recipes-devtools/ruby/ruby_3.4.3.bb
+++ b/meta/recipes-devtools/ruby/ruby_3.4.4.bb
@@ -48,7 +48,7 @@ do_configure:prepend() {
 DEPENDS:append:libc-musl = " libucontext"
-SRC_URI[sha256sum] = "55a4cd1dcbe5ca27cf65e89a935a482c2bb2284832939266551c0ec68b437f46"
+SRC_URI[sha256sum] = "a0597bfdf312e010efd1effaa8d7f1d7833146fdc17950caa8158ffa3dcbfa85"
 PACKAGECONFIG ??= ""
 PACKAGECONFIG += "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)}"
diff --git a/meta/recipes-devtools/strace/strace/Makefile-ptest.patch b/meta/recipes-devtools/strace/strace/Makefile-ptest.patch
index a78c86f6a1..9520aa8842 100644
--- a/meta/recipes-devtools/strace/strace/Makefile-ptest.patch
+++ b/meta/recipes-devtools/strace/strace/Makefile-ptest.patch
@@ -12,8 +12,9 @@ Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
 tests/Makefile.am | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 diff --git a/tests/Makefile.am b/tests/Makefile.am
-index e1254c3..149570d 100644
+index b29471f..b8b66f0 100644
 --- a/tests/Makefile.am
 +++ b/tests/Makefile.am
 @@ -18,6 +18,7 @@ SIZEOF_LONG = @SIZEOF_LONG@
@@ -21,10 +22,10 @@ index e1254c3..149570d 100644
 MPERS_CC_FLAGS =
 ARCH_MFLAGS =
 +TEST_SUITE_LOG = test-suite.log
- AM_CFLAGS = $(WARN_CFLAGS)
+ AM_CFLAGS = $(WARN_CFLAGS) $(TEST_WARN_CFLAGS)
 bundled_CPPFLAGS =
 if USE_BUNDLED_HEADERS
-@@ -903,3 +904,22 @@ BUILT_SOURCES = ksysent.h
+@@ -932,3 +933,22 @@ BUILT_SOURCES = ksysent.h
 CLEANFILES = ksysent.h
 
 include ../src/scno.am
diff --git a/meta/recipes-devtools/strace/strace_6.12.bb b/meta/recipes-devtools/strace/strace_6.15.bb
index c16e5dc478..d8ac2a53d0 100644
--- a/meta/recipes-devtools/strace/strace_6.12.bb
+++ b/meta/recipes-devtools/strace/strace_6.15.bb
@@ -3,7 +3,7 @@ HOMEPAGE = "http://strace.io"
 DESCRIPTION = "strace is a diagnostic, debugging and instructional userspace utility for Linux. It is used to monitor and tamper with interactions between processes and the Linux kernel, which include system calls, signal deliveries, and changes of process state."
 SECTION = "console/utils"
 LICENSE = "LGPL-2.1-or-later & GPL-2.0-or-later"
-LIC_FILES_CHKSUM = "file://COPYING;md5=2433d82e1432a76dc3eadd9002bfe304"
+LIC_FILES_CHKSUM = "file://COPYING;md5=1efaf30bb0084b4a17a6f55f9cbcd25b"
 SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/strace-${PV}.tar.xz \
           file://update-gawk-paths.patch \
@@ -15,7 +15,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/strace-${PV}.tar.xz \
           file://0001-configure-Use-autoconf-macro-to-detect-largefile-sup.patch \
           file://0002-tests-Replace-off64_t-with-off_t.patch \
           "
-SRC_URI[sha256sum] = "c47da93be45b6055f4dc741d7f20efaf50ca10160a5b100c109b294fd9c0bdfe"
+SRC_URI[sha256sum] = "8552dfab08abc22a0f2048c98fd9541fd4d71b6882507952780dab7c7c512f51"
 inherit autotools github-releases ptest
diff --git a/meta/recipes-extended/msmtp/msmtp_1.8.28.bb b/meta/recipes-extended/msmtp/msmtp_1.8.30.bb
index 48c597de24..83ec83f326 100644
--- a/meta/recipes-extended/msmtp/msmtp_1.8.28.bb
+++ b/meta/recipes-extended/msmtp/msmtp_1.8.30.bb
@@ -11,7 +11,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504"
 UPSTREAM_CHECK_URI = "https://marlam.de/msmtp/download/"
 SRC_URI = "https://marlam.de/${BPN}/releases/${BP}.tar.xz"
-SRC_URI[sha256sum] = "3a57f155f54e4860f7dd42138d9bea1af615b99dfab5ab4cd728fc8c09a647a4"
+SRC_URI[sha256sum] = "f826a3c500c4dfeed814685097cead9b2b3dca5a2ec3897967cb9032570fa9ab"
 inherit gettext autotools update-alternatives pkgconfig
diff --git a/meta/recipes-gnome/libadwaita/libadwaita_1.7.2.bb b/meta/recipes-gnome/libadwaita/libadwaita_1.7.4.bb
index 4dc583ab39..e2bfb0984e 100644
--- a/meta/recipes-gnome/libadwaita/libadwaita_1.7.2.bb
+++ b/meta/recipes-gnome/libadwaita/libadwaita_1.7.4.bb
@@ -11,7 +11,7 @@ DEPENDS = " \
 inherit gnomebase gobject-introspection gi-docgen vala features_check
-SRC_URI[archive.sha256sum] = "28ee2ff589c6debe47af9da7a56e37c97d6849e003918a4b223f690d25f960be"
+SRC_URI[archive.sha256sum] = "a012bef97ac0d726b969b18099f75fc5eee9e92c012af9672b827350d53ae970"
 ANY_OF_DISTRO_FEATURES = "${GTK3DISTROFEATURES}"
 REQUIRED_DISTRO_FEATURES = "opengl"
diff --git a/meta/recipes-graphics/harfbuzz/harfbuzz/0001-Use-Os-to-compile-hb-subset-plan-layout.cc.patch b/meta/recipes-graphics/harfbuzz/harfbuzz/0001-Use-Os-to-compile-hb-subset-plan-layout.cc.patch
index 299843797b..38ff58fce5 100644
--- a/meta/recipes-graphics/harfbuzz/harfbuzz/0001-Use-Os-to-compile-hb-subset-plan-layout.cc.patch
+++ b/meta/recipes-graphics/harfbuzz/harfbuzz/0001-Use-Os-to-compile-hb-subset-plan-layout.cc.patch
@@ -1,4 +1,4 @@
-From 8d876ea19579ee6b687668921c17be423cf7d6c2 Mon Sep 17 00:00:00 2001
+From a4325b6f6ddbebf3ecaee8f3825a2f03096adb6d Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Sun, 27 Apr 2025 15:26:09 -0700
 Subject: [PATCH] Use -Os to compile hb-subset-plan-layout.cc
@@ -17,10 +17,10 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
 1 file changed, 12 insertions(+), 3 deletions(-)
 diff --git a/src/meson.build b/src/meson.build
-index 3d1c00d..fded728 100644
+index cbe5d9e..d7fc764 100644
 --- a/src/meson.build
 +++ b/src/meson.build
-@@ -393,7 +393,6 @@ hb_subset_sources = files(
+@@ -398,7 +398,6 @@ hb_subset_sources = files(
   'hb-subset-instancer-solver.hh',
   'hb-subset-instancer-solver.cc',
   'hb-subset-plan.cc',
@@ -28,7 +28,7 @@ index 3d1c00d..fded728 100644
   'hb-subset-plan-var.cc',
   'hb-subset-plan.hh',
   'hb-subset-plan-member-list.hh',
-@@ -410,6 +409,10 @@ hb_subset_sources = files(
+@@ -415,6 +414,10 @@ hb_subset_sources = files(
   'hb-subset.hh',
 )
 
@@ -39,7 +39,7 @@ index 3d1c00d..fded728 100644
 hb_subset_headers = files(
   'hb-subset.h',
   'hb-subset-serialize.h'
-@@ -618,6 +621,12 @@ endif
+@@ -629,6 +632,12 @@ endif
 
 darwin_versions = [hb_version_int, '@0@.0.0'.format(hb_version_int)]
 
@@ -52,7 +52,7 @@ index 3d1c00d..fded728 100644
 libharfbuzz = library('harfbuzz', hb_sources,
   include_directories: incconfig,
   dependencies: harfbuzz_deps,
-@@ -645,7 +654,7 @@ defs_list += [harfbuzz_subset_def]
+@@ -656,7 +665,7 @@ defs_list += [harfbuzz_subset_def]
 libharfbuzz_subset = library('harfbuzz-subset', hb_subset_sources,
   include_directories: incconfig,
   dependencies: [m_dep],
@@ -61,7 +61,7 @@ index 3d1c00d..fded728 100644
   cpp_args: cpp_args + extra_hb_cpp_args,
   soversion: hb_so_version,
   version: version,
-@@ -657,7 +666,7 @@ libharfbuzz_subset = library('harfbuzz-subset', hb_subset_sources,
+@@ -668,7 +677,7 @@ libharfbuzz_subset = library('harfbuzz-subset', hb_subset_sources,
 custom_target('harfbuzz-subset.cc',
   build_by_default: true,
   output: 'harfbuzz-subset.cc',
diff --git a/meta/recipes-graphics/harfbuzz/harfbuzz_11.2.0.bb b/meta/recipes-graphics/harfbuzz/harfbuzz_11.2.1.bb
index db5a04486c..71eada7f28 100644
--- a/meta/recipes-graphics/harfbuzz/harfbuzz_11.2.0.bb
+++ b/meta/recipes-graphics/harfbuzz/harfbuzz_11.2.1.bb
@@ -10,7 +10,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b98429b8e8e3c2a67cfef01e99e4893d \
 SRC_URI = "${GITHUB_BASE_URI}/download/${PV}/${BPN}-${PV}.tar.xz"
 SRC_URI += "file://0001-Use-Os-to-compile-hb-subset-plan-layout.cc.patch"
-SRC_URI[sha256sum] = "50f7d0a208367e606dbf6eecc5cfbecc01a47be6ee837ae7aff2787e24b09b45"
+SRC_URI[sha256sum] = "093714c8548a285094685f0bdc999e202d666b59eeb3df2ff921ab68b8336a49"
 DEPENDS += "glib-2.0-native"
diff --git a/meta/recipes-graphics/vulkan/vulkan-samples_git.bb b/meta/recipes-graphics/vulkan/vulkan-samples_git.bb
index 1caff12a5b..844e0e6b68 100644
--- a/meta/recipes-graphics/vulkan/vulkan-samples_git.bb
+++ b/meta/recipes-graphics/vulkan/vulkan-samples_git.bb
@@ -10,7 +10,7 @@ SRC_URI = "gitsm://github.com/KhronosGroup/Vulkan-Samples.git;branch=main;protoc
           "
 UPSTREAM_CHECK_COMMITS = "1"
-SRCREV = "eca122602a5d7a9f63686411dcef1b62feb36a9a"
+SRCREV = "d27205d14d01ea7d33efc8ba2862478612370182"
 UPSTREAM_CHECK_GITTAGREGEX = "These are not the releases you're looking for"
 S = "${WORKDIR}/git"
diff --git a/meta/recipes-graphics/xorg-lib/libxkbcommon_1.9.2.bb b/meta/recipes-graphics/xorg-lib/libxkbcommon_1.10.0.bb
index 77ee8ce500..e10bbf7af0 100644
--- a/meta/recipes-graphics/xorg-lib/libxkbcommon_1.9.2.bb
+++ b/meta/recipes-graphics/xorg-lib/libxkbcommon_1.10.0.bb
@@ -9,7 +9,7 @@ DEPENDS = "flex-native bison-native"
 SRC_URI = "git://github.com/xkbcommon/libxkbcommon;protocol=https;branch=master;tag=xkbcommon-${PV}"
-SRCREV = "dd642359f8d43c09968e34ca7f1eb1121b2dfd70"
+SRCREV = "7888474d0296dcad50c9ba4adfdfdf2be02d35e1"
 S = "${WORKDIR}/git"
 inherit meson pkgconfig bash-completion
diff --git a/meta/recipes-kernel/kernel-signing-keys/kernel-signing-keys-native.bb b/meta/recipes-kernel/kernel-signing-keys/kernel-signing-keys-native.bb
new file mode 100644
index 0000000000..704973dffb
--- /dev/null
+++ b/meta/recipes-kernel/kernel-signing-keys/kernel-signing-keys-native.bb
@@ -0,0 +1,75 @@
+# Automatically generate key pairs in UBOOT_SIGN_KEYDIR if they do not exist.
+# The key pair is generated by the kernel-signing-keys-native recipe and is not
+# stored in the sstate cache. This can be beneficial from a security standpoint,
+# as it avoids unintentionally caching and distributing private keys.
+# However, this behavior can lead to non-reproducible builds. For example, if
+# the keys are deleted, they must be manually restored, or you must run:
+#   bitbake -c cleanall kernel-signing-keys-native
+# before new key pairs are generated.
+#
+# However, this approach is only suitable for simple or local development use
+# cases. For more advanced or production-grade scenarios, a more robust solution
+# is usually required—such as external signing or re-signing using e.g a HSM.
+SUMMARY = "Signing keys for the kernel FIT image"
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
+require conf/image-fitimage.conf
+DEPENDS += "openssl-native"
+inherit native
+do_fetch[noexec] = "1"
+do_unpack[noexec] = "1"
+do_patch[noexec] = "1"
+do_configure[noexec] = "1"
+do_install[noexec] = "1"
+do_compile() {
+        if [ "${UBOOT_SIGN_ENABLE}" = "0" ] && [ "${FIT_GENERATE_KEYS}" = "1" ]; then
+                bbwarn "FIT_GENERATE_KEYS is set to 1 even though UBOOT_SIGN_ENABLE is set to 0. The keys will not be generated as they won't be used."
+        fi
+        if [ "${UBOOT_SIGN_ENABLE}" = "1" ] && [ "${FIT_GENERATE_KEYS}" = "1" ]; then
+                # Generate keys to sign configuration nodes, only if they don't already exist
+                if [ ! -f "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_KEYNAME}".key ] || \
+                        [ ! -f "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_KEYNAME}".crt ]; then
+                        # make directory if it does not already exist
+                        mkdir -p "${UBOOT_SIGN_KEYDIR}"
+                        bbnote "Generating RSA private key for signing fitImage"
+                        openssl genrsa ${FIT_KEY_GENRSA_ARGS} -out \
+                                "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_KEYNAME}".key \
+                        "${FIT_SIGN_NUMBITS}"
+                        bbnote "Generating certificate for signing fitImage"
+                        openssl req ${FIT_KEY_REQ_ARGS} "${FIT_KEY_SIGN_PKCS}" \
+                                -key "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_KEYNAME}".key \
+                                -out "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_KEYNAME}".crt
+                fi
+                # Generate keys to sign image nodes, only if they don't already exist
+                if [ ! -f "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_IMG_KEYNAME}".key ] || \
+                        [ ! -f "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_IMG_KEYNAME}".crt ]; then
+                        # make directory if it does not already exist
+                        mkdir -p "${UBOOT_SIGN_KEYDIR}"
+                        bbnote "Generating RSA private key for signing fitImage"
+                        openssl genrsa ${FIT_KEY_GENRSA_ARGS} -out \
+                                "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_IMG_KEYNAME}".key \
+                        "${FIT_SIGN_NUMBITS}"
+                        bbnote "Generating certificate for signing fitImage"
+                        openssl req ${FIT_KEY_REQ_ARGS} "${FIT_KEY_SIGN_PKCS}" \
+                                -key "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_IMG_KEYNAME}".key \
+                                -out "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_IMG_KEYNAME}".crt
+                fi
+        fi
+}
diff --git a/meta/recipes-kernel/linux/cve-exclusion_6.12.inc b/meta/recipes-kernel/linux/cve-exclusion_6.12.inc
index d33880eae0..199ea019d5 100644
--- a/meta/recipes-kernel/linux/cve-exclusion_6.12.inc
+++ b/meta/recipes-kernel/linux/cve-exclusion_6.12.inc
@@ -1,11 +1,11 @@
 # Auto-generated CVE metadata, DO NOT EDIT BY HAND.
-# Generated at 2025-05-29 10:54:43.823437+00:00 for kernel version 6.12.30
+# Generated at 2025-06-05 16:29:20.725105+00:00 for kernel version 6.12.31
-# From cvelistV5 cve_2025-05-29_1000Z-1-g4f2590b715f
+# From cvelistV5 cve_2025-06-05_1600Z
 python check_kernel_cve_status_version() {
-    this_version = "6.12.30"
+    this_version = "6.12.31"
    kernel_version = d.getVar("LINUX_VERSION")
    if kernel_version != this_version:
        bb.warn("Kernel CVE status needs updating: generated for %s but kernel is %s" % (this_version, kernel_version))
@@ -5054,8 +5054,6 @@ CVE_STATUS[CVE-2023-53023] = "fixed-version: Fixed from version 6.2"
 CVE_STATUS[CVE-2023-53024] = "fixed-version: Fixed from version 6.2"
-CVE_STATUS[CVE-2023-53025] = "fixed-version: Fixed from version 6.2"
 CVE_STATUS[CVE-2023-53026] = "fixed-version: Fixed from version 6.2"
 CVE_STATUS[CVE-2023-53028] = "fixed-version: Fixed from version 6.1.8"
@@ -12564,8 +12562,6 @@ CVE_STATUS[CVE-2025-37780] = "cpe-stable-backport: Backported in 6.12.25"
 CVE_STATUS[CVE-2025-37781] = "cpe-stable-backport: Backported in 6.12.25"
-CVE_STATUS[CVE-2025-37782] = "cpe-stable-backport: Backported in 6.12.25"
 CVE_STATUS[CVE-2025-37783] = "fixed-version: only affects 6.14 onwards"
 CVE_STATUS[CVE-2025-37784] = "cpe-stable-backport: Backported in 6.12.25"
@@ -12660,8 +12656,6 @@ CVE_STATUS[CVE-2025-37830] = "cpe-stable-backport: Backported in 6.12.26"
 CVE_STATUS[CVE-2025-37831] = "cpe-stable-backport: Backported in 6.12.26"
-CVE_STATUS[CVE-2025-37832] = "cpe-stable-backport: Backported in 6.12.26"
 CVE_STATUS[CVE-2025-37833] = "cpe-stable-backport: Backported in 6.12.26"
 CVE_STATUS[CVE-2025-37834] = "cpe-stable-backport: Backported in 6.12.26"
@@ -12978,6 +12972,20 @@ CVE_STATUS[CVE-2025-37991] = "cpe-stable-backport: Backported in 6.12.28"
 CVE_STATUS[CVE-2025-37992] = "cpe-stable-backport: Backported in 6.12.30"
+CVE_STATUS[CVE-2025-37993] = "cpe-stable-backport: Backported in 6.12.29"
+CVE_STATUS[CVE-2025-37994] = "cpe-stable-backport: Backported in 6.12.29"
+CVE_STATUS[CVE-2025-37995] = "cpe-stable-backport: Backported in 6.12.29"
+CVE_STATUS[CVE-2025-37996] = "fixed-version: only affects 6.14 onwards"
+CVE_STATUS[CVE-2025-37997] = "cpe-stable-backport: Backported in 6.12.29"
+CVE_STATUS[CVE-2025-37998] = "cpe-stable-backport: Backported in 6.12.29"
+CVE_STATUS[CVE-2025-37999] = "cpe-stable-backport: Backported in 6.12.29"
 CVE_STATUS[CVE-2025-38049] = "cpe-stable-backport: Backported in 6.12.23"
 # CVE-2025-38104 needs backporting (fixed from 6.15)
diff --git a/meta/recipes-kernel/linux/linux-yocto-fitimage.bb b/meta/recipes-kernel/linux/linux-yocto-fitimage.bb
new file mode 100644
index 0000000000..6ce1960a87
--- /dev/null
+++ b/meta/recipes-kernel/linux/linux-yocto-fitimage.bb
@@ -0,0 +1,13 @@
+SUMMARY = "The Linux kernel as a FIT image (optionally with initramfs)"
+SECTION = "kernel"
+# If an initramfs is included in the FIT image more licenses apply.
+# But also the kernel uses more than one license (see Documentation/process/license-rules.rst)
+LICENSE = "GPL-2.0-with-Linux-syscall-note"
+LIC_FILES_CHKSUM = "file://${COREBASE}/meta/files/common-licenses/GPL-2.0-with-Linux-syscall-note;md5=0bad96c422c41c3a94009dcfe1bff992"
+inherit linux-kernel-base kernel-fit-image
+# Set the version of this recipe to the version of the included kernel
+# (without taking the long way around via PV)
+PKGV = "${@get_kernelversion_file("${STAGING_KERNEL_BUILDDIR}")}"
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.12.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.12.bb
index 24d93645ca..1f61008bd6 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_6.12.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.12.bb
@@ -14,13 +14,13 @@ python () {
        raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
 }
-SRCREV_machine ?= "3d3d56a846c993611859096016322dccea1317cd"
+SRCREV_machine ?= "4127c6137af28c2c91ec79acee60fe4d4d70db9b"
-SRCREV_meta ?= "60484dda26122958e5f4d8f813424fa637770bf6"
+SRCREV_meta ?= "f2f3b6cbd91743920e2cb55998c53326855b2e9c"
 SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \
           git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.12;destsuffix=${KMETA};protocol=https"
-LINUX_VERSION ?= "6.12.30"
+LINUX_VERSION ?= "6.12.31"
 LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.12.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.12.bb
index 042adf94d0..d92862a426 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.12.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.12.bb
@@ -8,7 +8,7 @@ require recipes-kernel/linux/linux-yocto.inc
 # CVE exclusions
 include recipes-kernel/linux/cve-exclusion_6.12.inc
-LINUX_VERSION ?= "6.12.30"
+LINUX_VERSION ?= "6.12.31"
 LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
 DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
@@ -17,8 +17,8 @@ DEPENDS += "openssl-native util-linux-native"
 KMETA = "kernel-meta"
 KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine ?= "0898369ce44f92eba60ae9bf0013bc4338ce840e"
+SRCREV_machine ?= "fee8195f8412ff8f1bfc50ba86cdb8f20de22750"
-SRCREV_meta ?= "60484dda26122958e5f4d8f813424fa637770bf6"
+SRCREV_meta ?= "f2f3b6cbd91743920e2cb55998c53326855b2e9c"
 PV = "${LINUX_VERSION}+git"
diff --git a/meta/recipes-kernel/linux/linux-yocto_6.12.bb b/meta/recipes-kernel/linux/linux-yocto_6.12.bb
index e282a89983..c5cab3432c 100644
--- a/meta/recipes-kernel/linux/linux-yocto_6.12.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_6.12.bb
@@ -18,25 +18,25 @@ KBRANCH:qemux86.104 ?= "v6.12/standard/base"
 KBRANCH:qemuloongarch64  ?= "v6.12/standard/base"
 KBRANCH:qemumips64 ?= "v6.12/standard/mti-malta64"
-SRCREV_machine:qemuarm ?= "5c1cc01b780f83de6f9c0bacf45ffa2de68be95c"
+SRCREV_machine:qemuarm ?= "4260a7bd706072e6bec438cdc29f44845d380b21"
-SRCREV_machine:qemuarm64 ?= "0898369ce44f92eba60ae9bf0013bc4338ce840e"
+SRCREV_machine:qemuarm64 ?= "fee8195f8412ff8f1bfc50ba86cdb8f20de22750"
-SRCREV_machine:qemuloongarch64 ?= "0898369ce44f92eba60ae9bf0013bc4338ce840e"
+SRCREV_machine:qemuloongarch64 ?= "fee8195f8412ff8f1bfc50ba86cdb8f20de22750"
-SRCREV_machine:qemumips ?= "87d7d289ec3d56a1bd1d7a7c7cb46af8cf6c0f27"
+SRCREV_machine:qemumips ?= "681fad27d382f2e0eb53d1b46f9d35aa2332248f"
-SRCREV_machine:qemuppc ?= "0898369ce44f92eba60ae9bf0013bc4338ce840e"
+SRCREV_machine:qemuppc ?= "fee8195f8412ff8f1bfc50ba86cdb8f20de22750"
-SRCREV_machine:qemuriscv64 ?= "0898369ce44f92eba60ae9bf0013bc4338ce840e"
+SRCREV_machine:qemuriscv64 ?= "fee8195f8412ff8f1bfc50ba86cdb8f20de22750"
-SRCREV_machine:qemuriscv32 ?= "0898369ce44f92eba60ae9bf0013bc4338ce840e"
+SRCREV_machine:qemuriscv32 ?= "fee8195f8412ff8f1bfc50ba86cdb8f20de22750"
-SRCREV_machine:qemux86 ?= "0898369ce44f92eba60ae9bf0013bc4338ce840e"
+SRCREV_machine:qemux86 ?= "fee8195f8412ff8f1bfc50ba86cdb8f20de22750"
-SRCREV_machine:qemux86-64 ?= "0898369ce44f92eba60ae9bf0013bc4338ce840e"
+SRCREV_machine:qemux86-64 ?= "fee8195f8412ff8f1bfc50ba86cdb8f20de22750"
-SRCREV_machine:qemumips64 ?= "98a85ed93bd5eaefe30c4aa3f7c15549be2bd032"
+SRCREV_machine:qemumips64 ?= "c32033ad8eac09b074c44a42e7d34d398df9d172"
-SRCREV_machine ?= "0898369ce44f92eba60ae9bf0013bc4338ce840e"
+SRCREV_machine ?= "fee8195f8412ff8f1bfc50ba86cdb8f20de22750"
-SRCREV_meta ?= "60484dda26122958e5f4d8f813424fa637770bf6"
+SRCREV_meta ?= "f2f3b6cbd91743920e2cb55998c53326855b2e9c"
 # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll
 # get the <version>/base branch, which is pure upstream -stable, and the same
 # meta SRCREV as the linux-yocto-standard builds. Select your version using the
 # normal PREFERRED_VERSION settings.
 BBCLASSEXTEND = "devupstream:target"
-SRCREV_machine:class-devupstream ?= "e0e2f78243385e7188a57fcfceb6a19f723f1dff"
+SRCREV_machine:class-devupstream ?= "df3f6d10f353de274cc7c87f52dba5d26f185393"
 PN:class-devupstream = "linux-yocto-upstream"
 KBRANCH:class-devupstream = "v6.12/base"
@@ -44,7 +44,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA
           git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.12;destsuffix=${KMETA};protocol=https"
 LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
-LINUX_VERSION ?= "6.12.30"
+LINUX_VERSION ?= "6.12.31"
 PV = "${LINUX_VERSION}+git"
diff --git a/meta/recipes-multimedia/gstreamer/gst-devtools_1.26.1.bb b/meta/recipes-multimedia/gstreamer/gst-devtools_1.26.2.bb
index cbad470d26..f898db80e7 100644
--- a/meta/recipes-multimedia/gstreamer/gst-devtools_1.26.1.bb
+++ b/meta/recipes-multimedia/gstreamer/gst-devtools_1.26.2.bb
@@ -12,7 +12,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-devtools/gst-devtools-${PV}
           file://0001-connect-has-a-different-signature-on-musl.patch \
           "
-SRC_URI[sha256sum] = "32e15cb9d2dd6a07532f92745b62f1c72c8038b1a10d34b64e91c4557f689632"
+SRC_URI[sha256sum] = "400ff79fe371367deb8ad1adf8b4643d6e558a433bf83136c2dd496fe8210f37"
 DEPENDS = "json-glib glib-2.0 glib-2.0-native gstreamer1.0 gstreamer1.0-plugins-base"
 RRECOMMENDS:${PN} = "git"
diff --git a/meta/recipes-multimedia/gstreamer/gst-examples_1.26.1.bb b/meta/recipes-multimedia/gstreamer/gst-examples_1.26.2.bb
index 59c7a4ade1..bc043f81c7 100644
--- a/meta/recipes-multimedia/gstreamer/gst-examples_1.26.1.bb
+++ b/meta/recipes-multimedia/gstreamer/gst-examples_1.26.2.bb
@@ -12,7 +12,7 @@ SRC_URI = "git://gitlab.freedesktop.org/gstreamer/gstreamer.git;protocol=https;b
           file://gst-player.desktop \
           "
-SRCREV = "7174e955ec066fb8d1fb683cc82713e0615826b6"
+SRCREV = "100c21e1faf68efe7f3830b6e9f856760697ab48"
 S = "${WORKDIR}/git/subprojects/gst-examples"
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.26.1.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.26.2.bb
index 96cf5a6925..88cc0b530d 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.26.1.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.26.2.bb
@@ -12,7 +12,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=69333daa044cb77e486cc36129f7a770 \
                    "
 SRC_URI = "https://gstreamer.freedesktop.org/src/gst-libav/gst-libav-${PV}.tar.xz"
-SRC_URI[sha256sum] = "350a20b45b6655b6e10265430bdfbb3c436a96e9611b79caabef8f10abe570ea"
+SRC_URI[sha256sum] = "2eceba9cae4c495bb4ea134c27f010356036f1fa1972db5f54833f5f6c9f8db0"
 S = "${WORKDIR}/gst-libav-${PV}"
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.26.1.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.26.2.bb
index a68e9306a5..e0329cd004 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.26.1.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.26.2.bb
@@ -10,7 +10,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-bad/gst-plugins-bad
           file://0002-avoid-including-sys-poll.h-directly.patch \
           file://0004-opencv-resolve-missing-opencv-data-dir-in-yocto-buil.patch \
           "
-SRC_URI[sha256sum] = "9b8415b1bb3726a499578fb39907952981716643f660215fe68628fbd8629197"
+SRC_URI[sha256sum] = "cb116bfc3722c2de53838899006cafdb3c7c0bc69cd769b33c992a8421a9d844"
 S = "${WORKDIR}/gst-plugins-bad-${PV}"
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.26.1.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.26.2.bb
index c872c3bcfb..dc70356940 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.26.1.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.26.2.bb
@@ -11,7 +11,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-base/gst-plugins-ba
           file://0003-viv-fb-Make-sure-config.h-is-included.patch \
           file://0002-ssaparse-enhance-SSA-text-lines-parsing.patch \
           "
-SRC_URI[sha256sum] = "659553636f84dcf388cad5cf6530e02b0b2d3dc450e76199287ba9db6a6c5226"
+SRC_URI[sha256sum] = "f4b9fc0be852fe5f65401d18ae6218e4aea3ff7a3c9f8d265939b9c4704915f7"
 S = "${WORKDIR}/gst-plugins-base-${PV}"
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.26.1.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.26.2.bb
index ea1322a5e3..467ccd9893 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.26.1.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.26.2.bb
@@ -6,7 +6,7 @@ BUGTRACKER = "https://gitlab.freedesktop.org/gstreamer/gst-plugins-good/-/issues
 SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugins-good-${PV}.tar.xz"
-SRC_URI[sha256sum] = "fcdcb2f77620a599557b2843d1c6c55c2b660f5fc28222b542847d11d9ca982f"
+SRC_URI[sha256sum] = "d864b9aec28c3a80895468c909dd303e5f22f92d6e2b1137f80e2a1454584339"
 S = "${WORKDIR}/gst-plugins-good-${PV}"
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.26.1.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.26.2.bb
index 0d35abf2c6..106fea361c 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.26.1.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.26.2.bb
@@ -15,7 +15,7 @@ SRC_URI = " \
            https://gstreamer.freedesktop.org/src/gst-plugins-ugly/gst-plugins-ugly-${PV}.tar.xz \
            "
-SRC_URI[sha256sum] = "34d9bcec8e88b008839d8de33fb043ae75eb04e466df74066fd66ee487a8ec4f"
+SRC_URI[sha256sum] = "ec2d7556c6b8c2694f9b918ab9c4c6c998fb908c6b6a6ad57441702dad14ce73"
 S = "${WORKDIR}/gst-plugins-ugly-${PV}"
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.26.1.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.26.2.bb
index 6afd286d38..50ff21c1ef 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.26.1.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.26.2.bb
@@ -8,7 +8,7 @@ LICENSE = "LGPL-2.1-or-later"
 LIC_FILES_CHKSUM = "file://COPYING;md5=c34deae4e395ca07e725ab0076a5f740"
 SRC_URI = "https://gstreamer.freedesktop.org/src/${PNREAL}/${PNREAL}-${PV}.tar.xz"
-SRC_URI[sha256sum] = "2dce1ecc8a80ce8e0b6f0e0cb3fad3bcd5d65ebe0622ed28eaae97b4559a6a85"
+SRC_URI[sha256sum] = "757ae964c16a542d60708bcb8a67c56c5be83785c0d1c534b9b9366bf676746e"
 DEPENDS = "gstreamer1.0 gstreamer1.0-plugins-base python3-pygobject gstreamer1.0-plugins-bad"
 RDEPENDS:${PN} += "gstreamer1.0 gstreamer1.0-plugins-base python3-pygobject"
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.26.1.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.26.2.bb
index 76f6dac25d..85b5615550 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.26.1.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.26.2.bb
@@ -10,7 +10,7 @@ PNREAL = "gst-rtsp-server"
 SRC_URI = "https://gstreamer.freedesktop.org/src/${PNREAL}/${PNREAL}-${PV}.tar.xz"
-SRC_URI[sha256sum] = "253fdfec78320c2f67486cd3797a0253c06982c3a8d5160f795b4257fadab301"
+SRC_URI[sha256sum] = "f942b2a499ed6d161222868db0e80de45297b4777ff189c6fb890bde698c2dc3"
 S = "${WORKDIR}/${PNREAL}-${PV}"
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-vaapi_1.26.1.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-vaapi_1.26.2.bb
index e922815162..7079641bc4 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-vaapi_1.26.1.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-vaapi_1.26.2.bb
@@ -11,7 +11,7 @@ LIC_FILES_CHKSUM = "file://COPYING.LIB;md5=4fbd65380cdd255951079008b364516c"
 SRC_URI = "https://gstreamer.freedesktop.org/src/${REALPN}/${REALPN}-${PV}.tar.xz"
-SRC_URI[sha256sum] = "1fc779690cd8d6c5ef3cd84e5a552f864815ea8d9c269370c8d21e0b6d5337c9"
+SRC_URI[sha256sum] = "0e24194236ed3b7f06f90e90efdf17f3f5ee39132e20081189a6c7690601051a"
 S = "${WORKDIR}/${REALPN}-${PV}"
 DEPENDS = "libva gstreamer1.0 gstreamer1.0-plugins-base gstreamer1.0-plugins-bad"
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.26.1.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.26.2.bb
index e4579d7342..d288236abc 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.26.1.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.26.2.bb
@@ -22,7 +22,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gstreamer/gstreamer-${PV}.tar.x
           file://0003-tests-use-a-dictionaries-for-environment.patch \
           file://0004-tests-add-helper-script-to-run-the-installed_tests.patch \
           "
-SRC_URI[sha256sum] = "30a4c4a5e48345583eb596aa265d0f53c0feb93011d93a6aaa70dd6e3c519dc4"
+SRC_URI[sha256sum] = "f75334a3dff497c240844304a60015145792ecc3b6b213ac19841ccbd6fdf0ad"
 PACKAGECONFIG ??= "${@bb.utils.contains('PTEST_ENABLED', '1', 'tests', '', d)} \
                   check \
diff --git a/meta/recipes-support/apr/apr/0001-Add-option-to-disable-timed-dependant-tests.patch b/meta/recipes-support/apr/apr/0001-Add-option-to-disable-timed-dependant-tests.patch
index b46dc76a86..72a2ab777e 100644
--- a/meta/recipes-support/apr/apr/0001-Add-option-to-disable-timed-dependant-tests.patch
+++ b/meta/recipes-support/apr/apr/0001-Add-option-to-disable-timed-dependant-tests.patch
@@ -1,4 +1,4 @@
-From 225abf37cd0b49960664b59f08e515a4c4ea5ad0 Mon Sep 17 00:00:00 2001
+From dc02ac2f43e47178a9b1f35ef6906d7835dc121b Mon Sep 17 00:00:00 2001
 From: Jeremy Puhlman <jpuhlman@mvista.com>
 Date: Thu, 26 Mar 2020 18:30:36 +0000
 Subject: [PATCH] Add option to disable timed dependant tests
@@ -9,7 +9,6 @@ a timer or other timing related issues.
 Upstream-Status: Submitted [https://github.com/apache/apr/pull/54]
 Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com>
 ---
 configure.in     | 6 ++++++
 include/apr.h.in | 1 +
@@ -17,10 +16,10 @@ Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com>
 3 files changed, 9 insertions(+), 2 deletions(-)
 diff --git a/configure.in b/configure.in
-index bfd488b..3663220 100644
+index 0ce20ab..3d42953 100644
 --- a/configure.in
 +++ b/configure.in
-@@ -3023,6 +3023,12 @@ AC_ARG_ENABLE(timedlocks,
+@@ -3119,6 +3119,12 @@ AC_ARG_ENABLE(timedlocks,
 )
 AC_SUBST(apr_has_timedlocks)
 
@@ -34,10 +33,10 @@ index bfd488b..3663220 100644
 # so getaddrinfo/gai_strerror are not used.
 if test $have_ipv6 = 0; then
 diff --git a/include/apr.h.in b/include/apr.h.in
-index ee99def..c46a5f4 100644
+index 637ed38..e7cb9b9 100644
 --- a/include/apr.h.in
 +++ b/include/apr.h.in
-@@ -298,6 +298,7 @@ extern "C" {
+@@ -307,6 +307,7 @@ extern "C" {
 #define APR_HAS_XTHREAD_FILES     @apr_has_xthread_files@
 #define APR_HAS_OS_UUID           @osuuid@
 #define APR_HAS_TIMEDLOCKS        @apr_has_timedlocks@
diff --git a/meta/recipes-support/apr/apr/0001-configure-Remove-runtime-test-for-mmap-that-can-map-.patch b/meta/recipes-support/apr/apr/0001-configure-Remove-runtime-test-for-mmap-that-can-map-.patch
index 3480deaa4d..7e22270b88 100644
--- a/meta/recipes-support/apr/apr/0001-configure-Remove-runtime-test-for-mmap-that-can-map-.patch
+++ b/meta/recipes-support/apr/apr/0001-configure-Remove-runtime-test-for-mmap-that-can-map-.patch
@@ -1,4 +1,4 @@
-From 316b81c462f065927d7fec56aadd5c8cb94d1cf0 Mon Sep 17 00:00:00 2001
+From 84990901ba642238779c74a003c1f5e572ab8d38 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Fri, 26 Aug 2022 00:28:08 -0700
 Subject: [PATCH] configure: Remove runtime test for mmap that can map
@@ -10,16 +10,15 @@ mutexes
 Upstream-Status: Inappropriate [Cross-compile specific]
 Signed-off-by: Khem Raj <raj.khem@gmail.com>
 ---
 configure.in | 30 ------------------------------
 1 file changed, 30 deletions(-)
 diff --git a/configure.in b/configure.in
-index 3663220..dce9789 100644
+index 3d42953..7e43b0f 100644
 --- a/configure.in
 +++ b/configure.in
-@@ -1303,36 +1303,6 @@ AC_CHECK_FUNCS([mmap munmap shm_open shm_unlink shmget shmat shmdt shmctl \
+@@ -1391,36 +1391,6 @@ AC_CHECK_FUNCS([mmap munmap shm_open shm_unlink shmget shmat shmdt shmctl \
 APR_CHECK_DEFINE(MAP_ANON, sys/mman.h)
 AC_CHECK_FILE(/dev/zero)
 
diff --git a/meta/recipes-support/apr/apr/0002-apr-Remove-workdir-path-references-from-installed-ap.patch b/meta/recipes-support/apr/apr/0002-apr-Remove-workdir-path-references-from-installed-ap.patch
index d63423f3a1..2a9cfb0f3d 100644
--- a/meta/recipes-support/apr/apr/0002-apr-Remove-workdir-path-references-from-installed-ap.patch
+++ b/meta/recipes-support/apr/apr/0002-apr-Remove-workdir-path-references-from-installed-ap.patch
@@ -1,4 +1,4 @@
-From 689a8db96a6d1e1cae9cbfb35d05ac82140a6555 Mon Sep 17 00:00:00 2001
+From 5050645e626a8ee91a7f45070ef2d3911e1870d7 Mon Sep 17 00:00:00 2001
 From: Hongxu Jia <hongxu.jia@windriver.com>
 Date: Tue, 30 Jan 2018 09:39:06 +0800
 Subject: [PATCH] apr: Remove workdir path references from installed apr files
@@ -13,16 +13,15 @@ packages at target run time, the workdir path caused confusion.
 Rebase to 1.6.3
 Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
 ---
 apr-config.in | 32 ++------------------------------
 1 file changed, 2 insertions(+), 30 deletions(-)
 diff --git a/apr-config.in b/apr-config.in
-index bed47ca..47874e5 100644
+index 626d3b0..42be269 100644
 --- a/apr-config.in
 +++ b/apr-config.in
-@@ -164,16 +164,7 @@ while test $# -gt 0; do
+@@ -179,16 +179,7 @@ while test $# -gt 0; do
     flags="$flags $LDFLAGS"
     ;;
     --includes)
@@ -39,7 +38,7 @@ index bed47ca..47874e5 100644
     ;;
     --srcdir)
     echo $APR_SOURCE_DIR
-@@ -197,33 +188,14 @@ while test $# -gt 0; do
+@@ -212,33 +203,14 @@ while test $# -gt 0; do
     exit 0
     ;;
     --link-ld)
diff --git a/meta/recipes-support/apr/apr/0005-configure.in-fix-LTFLAGS-to-make-it-work-with-ccache.patch b/meta/recipes-support/apr/apr/0005-configure.in-fix-LTFLAGS-to-make-it-work-with-ccache.patch
index 02634e6fde..bd8e7786ba 100644
--- a/meta/recipes-support/apr/apr/0005-configure.in-fix-LTFLAGS-to-make-it-work-with-ccache.patch
+++ b/meta/recipes-support/apr/apr/0005-configure.in-fix-LTFLAGS-to-make-it-work-with-ccache.patch
@@ -1,7 +1,7 @@
-From 2e66cece0c3adff92733332111204ddc1d730a07 Mon Sep 17 00:00:00 2001
+From 2f5db35d6c6b4d40e04591c98d297ef764777aa3 Mon Sep 17 00:00:00 2001
 From: Robert Yang <liezhi.yang@windriver.com>
 Date: Thu, 19 Nov 2015 18:25:38 -0800
-Subject: [PATCH 5/7] configure.in: fix LTFLAGS to make it work with ccache
+Subject: [PATCH] configure.in: fix LTFLAGS to make it work with ccache
 When ccache is enabled, libtool requires --tag=CC when use ccache,
 otherwise when building apr-util with ccache enabled:
@@ -19,10 +19,10 @@ Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/configure.in b/configure.in
-index 361120f..3b10422 100644
+index b0457e2..0ce20ab 100644
 --- a/configure.in
 +++ b/configure.in
-@@ -249,7 +249,7 @@ case $host in
+@@ -266,7 +266,7 @@ case $host in
     ;;
 *)
     if test "x$LTFLAGS" = "x"; then
@@ -31,6 +31,3 @@ index 361120f..3b10422 100644
     fi
     if test "$experimental_libtool" = "yes"; then
         # Use a custom-made libtool replacement
-- 
-1.8.3.1
diff --git a/meta/recipes-support/apr/apr_1.7.5.bb b/meta/recipes-support/apr/apr_1.7.6.bb
index 83d84bfdb6..13fa5daa3c 100644
--- a/meta/recipes-support/apr/apr_1.7.5.bb
+++ b/meta/recipes-support/apr/apr_1.7.6.bb
@@ -24,7 +24,7 @@ SRC_URI = "${APACHE_MIRROR}/apr/${BPN}-${PV}.tar.bz2 \
           file://0001-dso-Check-for-NULL-handle-in-apr_dso_sym.patch \
           "
-SRC_URI[sha256sum] = "cd0f5d52b9ab1704c72160c5ee3ed5d3d4ca2df4a7f8ab564e3cb352b67232f2"
+SRC_URI[sha256sum] = "49030d92d2575da735791b496dc322f3ce5cff9494779ba8cc28c7f46c5deb32"
 inherit autotools-brokensep lib_package binconfig multilib_header ptest multilib_script
diff --git a/meta/recipes-support/enchant/enchant2_2.8.4.bb b/meta/recipes-support/enchant/enchant2_2.8.6.bb
index a5479a0e7d..66de313d9d 100644
--- a/meta/recipes-support/enchant/enchant2_2.8.4.bb
+++ b/meta/recipes-support/enchant/enchant2_2.8.6.bb
@@ -12,7 +12,7 @@ DEPENDS = "glib-2.0 groff-native"
 inherit autotools pkgconfig github-releases
 SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/enchant-${PV}.tar.gz"
-SRC_URI[sha256sum] = "e28f98208df5f99320d6a05cd49f83420bf71e69052debe3b343c9bb15c833ed"
+SRC_URI[sha256sum] = "c4cd0889d8aff8248fc3913de5a83907013962f0e1895030a3836468cd40af5b"
 GITHUB_BASE_URI = "https://github.com/rrthomas/enchant/releases"
diff --git a/meta/recipes-support/gpgme/gpgme_1.24.2.bb b/meta/recipes-support/gpgme/gpgme_1.24.3.bb
index bc661429e7..64e3c6635a 100644
--- a/meta/recipes-support/gpgme/gpgme_1.24.2.bb
+++ b/meta/recipes-support/gpgme/gpgme_1.24.3.bb
@@ -29,7 +29,7 @@ SRC_URI = "${GNUPG_MIRROR}/gpgme/${BP}.tar.bz2 \
           file://0001-autogen.sh-remove-unknown-in-version.patch \
           "
-SRC_URI[sha256sum] = "e11b1a0e361777e9e55f48a03d89096e2abf08c63d84b7017cfe1dce06639581"
+SRC_URI[sha256sum] = "bfc17f5bd1b178c8649fdd918956d277080f33df006a2dc40acdecdce68c50dd"
 PYTHON_DEPS = "${@bb.utils.contains('LANGUAGES', 'python', 'swig-native', '', d)}"
diff --git a/meta/recipes-support/hwdata/hwdata_0.394.bb b/meta/recipes-support/hwdata/hwdata_0.395.bb
index 54edcecc2c..73b846b181 100644
--- a/meta/recipes-support/hwdata/hwdata_0.394.bb
+++ b/meta/recipes-support/hwdata/hwdata_0.395.bb
@@ -8,7 +8,7 @@ LICENSE = "GPL-2.0-or-later | X11"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=1556547711e8246992b999edd9445a57"
 SRC_URI = "git://github.com/vcrhonek/${BPN}.git;branch=master;protocol=https;tag=v${PV}"
-SRCREV = "fa1ccf4e4944bdb4110025c5c40e4fee8c8de29b"
+SRCREV = "95c1de6c4a0d40415867b29c0791480fb8ad3cdb"
 S = "${WORKDIR}/git"
diff --git a/meta/recipes-support/libgcrypt/files/0001-tests-Fix-link-errors-for-t-thread-local.patch b/meta/recipes-support/libgcrypt/files/0001-tests-Fix-link-errors-for-t-thread-local.patch
new file mode 100644
index 0000000000..5ebc3831d4
--- /dev/null
+++ b/meta/recipes-support/libgcrypt/files/0001-tests-Fix-link-errors-for-t-thread-local.patch
@@ -0,0 +1,34 @@
+From 746dc1c3837546c1085102e546a83da8d1c773e1 Mon Sep 17 00:00:00 2001
+From: Collin Funk <collin.funk1@gmail.com>
+Date: Thu, 1 May 2025 22:20:58 -0700
+Subject: [PATCH] tests: Fix link errors for t-thread-local.
+On platforms where pthread_create is not in libc t-thread-local fails to
+link.  Issue found on NetBSD 10.0.
+* tests/Makefile.am (t_thread_local_LDADD): Add $(standard_ldadd),
+$(GPG_ERROR_MT_LIBS), and @LDADD_FOR_TESTS_KLUDGE@.
+(t_thread_local_CFLAGS): Add $(GPG_ERROR_MT_CFLAGS).
+--
+Upstream-Status: Backport [793eda7b258a562757b51c96044b103b638f1a63]
+GnuPG-bug-id: 7634
+Signed-off-by: Collin Funk <collin.funk1@gmail.com>
+Signed-off-by: Hiago De Franco <hiago.franco@toradex.com>
+---
+ tests/Makefile.am | 2 ++
+ 1 file changed, 2 insertions(+)
+diff --git a/tests/Makefile.am b/tests/Makefile.am
+index 9a9e1c2c264a..b80f266f97c2 100644
+--- a/tests/Makefile.am
+++ b/tests/Makefile.am
+@@ -94,6 +94,8 @@ t_secmem_LDADD = $(standard_ldadd) @LDADD_FOR_TESTS_KLUDGE@
+ testapi_LDADD = $(standard_ldadd) @LDADD_FOR_TESTS_KLUDGE@
+ t_lock_LDADD = $(standard_ldadd) $(GPG_ERROR_MT_LIBS) @LDADD_FOR_TESTS_KLUDGE@
+ t_lock_CFLAGS = $(GPG_ERROR_MT_CFLAGS) -lpthread
+t_thread_local_LDADD = $(standard_ldadd) $(GPG_ERROR_MT_LIBS) @LDADD_FOR_TESTS_KLUDGE@
+t_thread_local_CFLAGS = $(GPG_ERROR_MT_CFLAGS) -lpthread
+ testdrv_LDADD = $(LDADD_FOR_TESTS_KLUDGE)
+ 
+ # Build a version of the test driver for the build platform.
diff --git a/meta/recipes-support/libgcrypt/libgcrypt_1.11.1.bb b/meta/recipes-support/libgcrypt/libgcrypt_1.11.1.bb
index e51a20e5bf..5574e8c821 100644
--- a/meta/recipes-support/libgcrypt/libgcrypt_1.11.1.bb
+++ b/meta/recipes-support/libgcrypt/libgcrypt_1.11.1.bb
@@ -21,6 +21,7 @@ UPSTREAM_CHECK_URI = "https://gnupg.org/download/index.html"
 SRC_URI = "${GNUPG_MIRROR}/libgcrypt/libgcrypt-${PV}.tar.bz2 \
           file://0001-libgcrypt-fix-m4-file-for-oe-core.patch \
           file://0004-tests-Makefile.am-fix-undefined-reference-to-pthread.patch \
+           file://0001-tests-Fix-link-errors-for-t-thread-local.patch \
           file://no-native-gpg-error.patch \
           file://no-bench-slope.patch \
           file://run-ptest \
diff --git a/meta/recipes-support/libunwind/libunwind/0003-Fixed-miscompilation-of-unw_getcontext-on-ARM.patch b/meta/recipes-support/libunwind/libunwind/0003-Fixed-miscompilation-of-unw_getcontext-on-ARM.patch
deleted file mode 100644
index 19bdd858f7..0000000000
--- a/meta/recipes-support/libunwind/libunwind/0003-Fixed-miscompilation-of-unw_getcontext-on-ARM.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From e5216c3fb1fa8d60a18c68e4749a3ff902f6678b Mon Sep 17 00:00:00 2001
-From: Ian Zborovsky <ian@veego.io>
-Date: Mon, 6 May 2024 02:01:19 +0300
-Subject: [PATCH 3/4] Fixed miscompilation of unw_getcontext() on ARM
-Upstream-Status: Backport
-Signed-off-by: Ross Burton <ross.burton@arm.com>
---
- include/libunwind-arm.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/include/libunwind-arm.h b/include/libunwind-arm.h
-index 6cfa577d..6643a185 100644
--- a/include/libunwind-arm.h
-+++ b/include/libunwind-arm.h
-@@ -288,7 +288,7 @@ unw_tdep_context_t;
-     "mov r0, #0\n\t"                                                                            \
-     "stmia %[base]!, {r0-r15}\n\t"                                                              \
-     VSTMIA                                                                                      \
-    : [r0] "=r" (r0) : [base] "r" (unw_base) : "memory");                                       \
-+    : [r0] "=r" (r0), [base] "+r" (unw_base) : : "memory");                                     \
-   (int)r0; })
- #else /* __thumb__ */
- #define unw_tdep_getcontext(uc) ({                                        \
-- 
-2.34.1
diff --git a/meta/recipes-support/libunwind/libunwind/0004-Rework-inline-aarch64-as-for-setcontext.patch b/meta/recipes-support/libunwind/libunwind/0004-Rework-inline-aarch64-as-for-setcontext.patch
deleted file mode 100644
index 005a077028..0000000000
--- a/meta/recipes-support/libunwind/libunwind/0004-Rework-inline-aarch64-as-for-setcontext.patch
+++ /dev/null
@@ -1,163 +0,0 @@
-From a832070f3665d29a8a06652c15f94d144c24ac69 Mon Sep 17 00:00:00 2001
-From: Stephen Webb <swebb@blackberry.com>
-Date: Mon, 22 Apr 2024 15:56:54 -0400
-Subject: [PATCH 4/5] Rework inline aarch64 as for setcontext
-Modern GC and clang were barfing on the inline asm constraints for the
-aarch64-linux setcontext() replacement. Reformulated the asm code to
-reduce the required constraints.
-Upstream-Status: Backport
-Signed-off-by: Ross Burton <ross.burton@arm.com>
---
- src/aarch64/Gos-linux.c | 115 +++++++++++++++++++++-------------------
- 1 file changed, 61 insertions(+), 54 deletions(-)
-diff --git a/src/aarch64/Gos-linux.c b/src/aarch64/Gos-linux.c
-index 7cd8c879..1e494962 100644
--- a/src/aarch64/Gos-linux.c
-+++ b/src/aarch64/Gos-linux.c
-@@ -2,6 +2,7 @@
-    Copyright (C) 2008 CodeSourcery
-    Copyright (C) 2011-2013 Linaro Limited
-    Copyright (C) 2012 Tommi Rantala <tt.rantala@gmail.com>
-+   Copyright 2024 Stephen M. Webb  <swebb@blackberry.com>
- 
- This file is part of libunwind.
- 
-@@ -28,6 +29,28 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.  */
- 
- #ifndef UNW_REMOTE_ONLY
- 
-+/* Magic constants generated from gen-offsets.c */
-+#define SC_R0_OFF   "8"
-+#define SC_R2_OFF   "24"
-+#define SC_R18_OFF  "152"
-+#define SC_R20_OFF  "168"
-+#define SC_R22_OFF  "184"
-+#define SC_R24_OFF  "200"
-+#define SC_R26_OFF  "216"
-+#define SC_R28_OFF  "232"
-+#define SC_R30_OFF  "248"
-+
-+#define FP_R08_OFF "80"
-+#define FP_R09_OFF "88"
-+#define FP_R10_OFF "96"
-+#define FP_R11_OFF "104"
-+#define FP_R12_OFF "112"
-+#define FP_R13_OFF "120"
-+#define FP_R14_OFF "128"
-+#define FP_R15_OFF "136"
-+
-+#define SC_SP_OFF   "0x100"
-+
- HIDDEN int
- aarch64_local_resume (unw_addr_space_t as, unw_cursor_t *cursor, void *arg)
- {
-@@ -36,65 +59,49 @@ aarch64_local_resume (unw_addr_space_t as, unw_cursor_t *cursor, void *arg)
- 
-   if (c->sigcontext_format == AARCH64_SCF_NONE)
-     {
-+
-+      /*
-+       * This is effectively the old POSIX setcontext().
-+       *
-+       * This inline asm is broken up to use local scratch registers for the
-+       * uc_mcontext.regs and FPCTX base addresses because newer versions of GCC
-+       * and clang barf on too many constraints (gh-702) when the C array
-+       * elements are used directly.
-+       *
-+       * Clobbers aren't required for the inline asm because they just convince
-+       * the compiler to save those registers and they never get restored
-+       * becauise the asm ends with a plain ol' ret.
-+       */
-+      register void* uc_mcontext __asm__ ("x5") = (void*) &uc->uc_mcontext;
-+      register void* fpctx __asm__ ("x4") = (void*) GET_FPCTX(uc);
-+
-       /* Since there are no signals involved here we restore EH and non scratch
-          registers only.  */
-       __asm__ __volatile__ (
-        "ldr x0,  %[x0]\n\t"
-        "ldr x1,  %[x1]\n\t"
-        "ldr x2,  %[x2]\n\t"
-        "ldr x3,  %[x3]\n\t"
-        "ldr x19, %[x19]\n\t"
-        "ldr x20, %[x20]\n\t"
-        "ldr x21, %[x21]\n\t"
-        "ldr x22, %[x22]\n\t"
-        "ldr x23, %[x23]\n\t"
-        "ldr x24, %[x24]\n\t"
-        "ldr x25, %[x25]\n\t"
-        "ldr x26, %[x26]\n\t"
-        "ldr x27, %[x27]\n\t"
-        "ldr x28, %[x28]\n\t"
-        "ldr x29, %[x29]\n\t"
-        "ldr x30, %[x30]\n\t"
-        "ldr d8,  %[d8]\n\t"
-        "ldr d9,  %[d9]\n\t"
-        "ldr d10, %[d10]\n\t"
-        "ldr d11, %[d11]\n\t"
-        "ldr d12, %[d12]\n\t"
-        "ldr d13, %[d13]\n\t"
-        "ldr d14, %[d14]\n\t"
-        "ldr d15, %[d15]\n\t"
-        "ldr x5,  %[sp]\n\t"
-+        "ldp x0,  x1,  [x5, " SC_R0_OFF  "]\n\t"
-+        "ldp x2,  x3,  [x5, " SC_R2_OFF  "]\n\t"
-+        "ldp x18, x19, [x5, " SC_R18_OFF "]\n\t"
-+        "ldp x20, x21, [x5, " SC_R20_OFF "]\n\t"
-+        "ldp x22, x23, [x5, " SC_R22_OFF "]\n\t"
-+        "ldp x24, x25, [x5, " SC_R24_OFF "]\n\t"
-+        "ldp x26, x27, [x5, " SC_R26_OFF "]\n\t"
-+        "ldp x28, x29, [x5, " SC_R28_OFF "]\n\t"
-+        "ldr x30, [x5, " SC_R30_OFF "]\n\t"
-+        "ldr d8,  [x4, " FP_R08_OFF "]\n\t"
-+        "ldr d9,  [x4, " FP_R09_OFF "]\n\t"
-+        "ldr d10, [x4, " FP_R10_OFF "]\n\t"
-+        "ldr d11, [x4, " FP_R11_OFF "]\n\t"
-+        "ldr d12, [x4, " FP_R12_OFF "]\n\t"
-+        "ldr d13, [x4, " FP_R13_OFF "]\n\t"
-+        "ldr d14, [x4, " FP_R14_OFF "]\n\t"
-+        "ldr d15, [x4, " FP_R15_OFF "]\n\t"
-+        "ldr x5,  [x5, " SC_SP_OFF "]\n\t"
-         "mov sp, x5\n\t"
-         "ret\n"
-        :
-        : [x0]  "m"(uc->uc_mcontext.regs[0]),
-                 [x1]  "m"(uc->uc_mcontext.regs[1]),
-                 [x2]  "m"(uc->uc_mcontext.regs[2]),
-                 [x3]  "m"(uc->uc_mcontext.regs[3]),
-                 [x19] "m"(uc->uc_mcontext.regs[19]),
-                 [x20] "m"(uc->uc_mcontext.regs[20]),
-                 [x21] "m"(uc->uc_mcontext.regs[21]),
-                 [x22] "m"(uc->uc_mcontext.regs[22]),
-                 [x23] "m"(uc->uc_mcontext.regs[23]),
-                 [x24] "m"(uc->uc_mcontext.regs[24]),
-                 [x25] "m"(uc->uc_mcontext.regs[25]),
-                 [x26] "m"(uc->uc_mcontext.regs[26]),
-                 [x27] "m"(uc->uc_mcontext.regs[27]),
-                 [x28] "m"(uc->uc_mcontext.regs[28]),
-                 [x29] "m"(uc->uc_mcontext.regs[29]), /* FP */
-                 [x30] "m"(uc->uc_mcontext.regs[30]), /* LR */
-                 [d8]  "m"(GET_FPCTX(uc)->vregs[8]),
-                 [d9]  "m"(GET_FPCTX(uc)->vregs[9]),
-                 [d10] "m"(GET_FPCTX(uc)->vregs[10]),
-                 [d11] "m"(GET_FPCTX(uc)->vregs[11]),
-                 [d12] "m"(GET_FPCTX(uc)->vregs[12]),
-                 [d13] "m"(GET_FPCTX(uc)->vregs[13]),
-                 [d14] "m"(GET_FPCTX(uc)->vregs[14]),
-                 [d15] "m"(GET_FPCTX(uc)->vregs[15]),
-          [sp]  "m"(uc->uc_mcontext.sp)
-               : "x0",   "x1",  "x2",  "x3", "x19", "x20", "x21", "x22", "x23", "x24",
-                 "x25", "x26", "x27", "x28", "x29", "x30"
-         );
-+        : 
-+        : [uc_mcontext] "r"(uc_mcontext),
-+          [fpctx] "r"(fpctx)
-+      );
-     }
-   else
-     {
-- 
-2.34.1
diff --git a/meta/recipes-support/libunwind/libunwind/libatomic.patch b/meta/recipes-support/libunwind/libunwind/libatomic.patch
index f39e92f2ee..e783128e2c 100644
--- a/meta/recipes-support/libunwind/libunwind/libatomic.patch
+++ b/meta/recipes-support/libunwind/libunwind/libatomic.patch
@@ -1,4 +1,4 @@
-From d6a0d8ce07c761e51b9dc7c5d16a9b06c3e93560 Mon Sep 17 00:00:00 2001
+From a331e3a63981427724d2d9cfdcb4a456153299b5 Mon Sep 17 00:00:00 2001
 From: Stephen Webb <swebb@blackberry.com>
 Date: Mon, 18 Mar 2024 10:22:26 -0400
 Subject: [PATCH] configure.ac: detect if -latomic is required
@@ -14,10 +14,10 @@ Signed-off-by: Ross Burton <ross.burton@arm.com>
 1 file changed, 12 insertions(+)
 diff --git a/configure.ac b/configure.ac
-index 758a27d19..d0ef5f3d9 100644
+index eaa0ddc..d5f1d4a 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -94,6 +94,18 @@ dnl Checks for library functions.
+@@ -93,6 +93,18 @@ dnl Checks for library functions.
 AC_CHECK_FUNCS(dl_iterate_phdr dl_phdr_removals_counter dlmodinfo getunwind \
                ttrace mincore pipe2 sigaltstack execvpe)
 
diff --git a/meta/recipes-support/libunwind/libunwind/malloc.patch b/meta/recipes-support/libunwind/libunwind/malloc.patch
index 026a56f155..cfcef1ccdc 100644
--- a/meta/recipes-support/libunwind/libunwind/malloc.patch
+++ b/meta/recipes-support/libunwind/libunwind/malloc.patch
@@ -1,4 +1,4 @@
-From b67d508a93bf1ba231c18dce3894cfee25c16e0d Mon Sep 17 00:00:00 2001
+From 8fd3e0c24fdfed64e0642ec0334548f16a2a9390 Mon Sep 17 00:00:00 2001
 From: Stephen Webb <swebb@blackberry.com>
 Date: Wed, 12 Feb 2025 12:08:07 -0500
 Subject: [PATCH] Fix bad prototype for malloc() in test
@@ -23,7 +23,7 @@ Signed-off-by: Ross Burton <ross.burton@arm.com>
 create mode 100644 tests/unw_test.h
 diff --git a/tests/Gtest-nomalloc.c b/tests/Gtest-nomalloc.c
-index 5b97fc709..e770ff614 100644
+index 5b97fc7..e770ff6 100644
 --- a/tests/Gtest-nomalloc.c
 +++ b/tests/Gtest-nomalloc.c
 @@ -1,78 +1,92 @@
@@ -188,10 +188,10 @@ index 5b97fc709..e770ff614 100644
 +  exit (UNW_TEST_EXIT_PASS);
 }
 diff --git a/tests/Makefile.am b/tests/Makefile.am
-index adc34ac63..60f3f3adc 100644
+index e2b07bc..844105a 100644
 --- a/tests/Makefile.am
 +++ b/tests/Makefile.am
-@@ -214,7 +214,7 @@ endif
+@@ -200,7 +200,7 @@ endif
 
 noinst_PROGRAMS = $(noinst_PROGRAMS_common) $(noinst_PROGRAMS_cdep) \
        $(noinst_PROGRAMS_arch)
@@ -202,7 +202,7 @@ index adc34ac63..60f3f3adc 100644
                     -e 's,[@]XFAIL_TESTS[@],$(XFAIL_TESTS),g' \
 diff --git a/tests/unw_test.h b/tests/unw_test.h
 new file mode 100644
-index 000000000..9ae86dce1
+index 0000000..9ae86dc
 --- /dev/null
 +++ b/tests/unw_test.h
 @@ -0,0 +1,47 @@
diff --git a/meta/recipes-support/libunwind/libunwind_1.8.1.bb b/meta/recipes-support/libunwind/libunwind_1.8.2.bb
index 10714ea247..6f7168b5df 100644
--- a/meta/recipes-support/libunwind/libunwind_1.8.1.bb
+++ b/meta/recipes-support/libunwind/libunwind_1.8.2.bb
@@ -10,14 +10,12 @@ SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/${BP}.tar.gz \
           file://mips-byte-order.patch \
           file://0001-tests-Garm64-test-sve-signal-check-that-SVE-is-prese.patch \
           file://0002-coredump-use-glibc-or-musl-register-names-as-appropr.patch \
-           file://0003-Fixed-miscompilation-of-unw_getcontext-on-ARM.patch \
-           file://0004-Rework-inline-aarch64-as-for-setcontext.patch \
           file://0005-Handle-musl-on-PPC32.patch \
           file://libatomic.patch \
           file://malloc.patch \
           "
-SRC_URI[sha256sum] = "ddf0e32dd5fafe5283198d37e4bf9decf7ba1770b6e7e006c33e6df79e6a6157"
+SRC_URI[sha256sum] = "7f262f1a1224f437ede0f96a6932b582c8f5421ff207c04e3d9504dfa04c8b82"
 inherit autotools multilib_header github-releases
diff --git a/meta/recipes-support/liburcu/liburcu_0.15.2.bb b/meta/recipes-support/liburcu/liburcu_0.15.3.bb
index 93d6a6551f..fb4e457719 100644
--- a/meta/recipes-support/liburcu/liburcu_0.15.2.bb
+++ b/meta/recipes-support/liburcu/liburcu_0.15.3.bb
@@ -14,7 +14,7 @@ LIC_FILES_CHKSUM = "file://LICENSE.md;md5=c2a92498b6e88e276f986877995425b8 \
 SRC_URI = "http://lttng.org/files/urcu/userspace-rcu-${PV}.tar.bz2"
-SRC_URI[sha256sum] = "59f36f2b8bda1b7620a7eced2634f26c549444818a8313025a3bb09c0766a61d"
+SRC_URI[sha256sum] = "26687ec84e3e114759454c884a08abeaf79dec09b041895ddf4c45ec150acb6d"
 S = "${WORKDIR}/userspace-rcu-${PV}"
 inherit autotools multilib_header
diff --git a/meta/recipes-support/libusb/libusb1_1.0.28.bb b/meta/recipes-support/libusb/libusb1_1.0.29.bb
index 51287499b7..bae5e2c09f 100644
--- a/meta/recipes-support/libusb/libusb1_1.0.28.bb
+++ b/meta/recipes-support/libusb/libusb1_1.0.29.bb
@@ -19,7 +19,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/libusb-${PV}.tar.bz2 \
 GITHUB_BASE_URI = "https://github.com/libusb/libusb/releases"
 UPSTREAM_CHECK_REGEX = "releases/tag/v?(?P<pver>\d+(\.\d+)+)$"
-SRC_URI[sha256sum] = "966bb0d231f94a474eaae2e67da5ec844d3527a1f386456394ff432580634b29"
+SRC_URI[sha256sum] = "5977fc950f8d1395ccea9bd48c06b3f808fd3c2c961b44b0c2e6e29fc3a70a85"
 S = "${WORKDIR}/libusb-${PV}"
diff --git a/meta/recipes-support/taglib/taglib_2.0.2.bb b/meta/recipes-support/taglib/taglib_2.1.bb
index 254119268c..a337af74d0 100644
--- a/meta/recipes-support/taglib/taglib_2.0.2.bb
+++ b/meta/recipes-support/taglib/taglib_2.1.bb
@@ -11,7 +11,7 @@ DEPENDS = "zlib utfcpp"
 SRC_URI = "http://taglib.github.io/releases/${BP}.tar.gz"
-SRC_URI[sha256sum] = "0de288d7fe34ba133199fd8512f19cc1100196826eafcb67a33b224ec3a59737"
+SRC_URI[sha256sum] = "95b788b39eaebab41f7e6d1c1d05ceee01a5d1225e4b6d11ed8976e96ba90b0c"
 UPSTREAM_CHECK_URI = "https://taglib.org/"
 UPSTREAM_CHECK_REGEX = "taglib-(?P<pver>\d+(\.\d+)+)\.tar"
diff --git a/scripts/lib/recipetool/create.py b/scripts/lib/recipetool/create.py
index ea2ef5be63..94d52d6077 100644
--- a/scripts/lib/recipetool/create.py
+++ b/scripts/lib/recipetool/create.py
@@ -1250,7 +1250,7 @@ def match_licenses(licfiles, srctree, d):
                license = 'Unknown'
                logger.info("Please add the following line for '%s' to a 'lib/recipetool/licenses.csv' " \
                    "and replace `Unknown` with the license:\n" \
-                    "%s,Unknown" % (os.path.relpath(licfile, srctree), md5value))
+                    "%s,Unknown" % (os.path.relpath(licfile, srctree + "/.."), md5value))
        if license:
            licenses.append((license, os.path.relpath(licfile, srctree), md5value))
diff --git a/scripts/lib/scriptutils.py b/scripts/lib/scriptutils.py
index 81f0b01fa5..32e749dbb1 100644
--- a/scripts/lib/scriptutils.py
+++ b/scripts/lib/scriptutils.py
@@ -182,7 +182,10 @@ def fetch_url(tinfoil, srcuri, srcrev, destdir, logger, preserve_tmp=False, mirr
                f.write('UNPACKDIR = "%s"\n' % destdir)
                # Set S out of the way so it doesn't get created under the workdir
-                f.write('S = "%s"\n' % os.path.join(tmpdir, 'emptysrc'))
+                s_dir = os.path.join(tmpdir, 'emptysrc')
+                bb.utils.mkdirhier(s_dir)
+                f.write('S = "%s"\n' % s_dir)
                if not mirrors:
                    # We do not need PREMIRRORS since we are almost certainly
                    # fetching new source rather than something that has already