(cherry picked from commit b22ee1010d4ba2e0049b162483c0f185c367d0bb)
(cherry picked from commit 715d146a3acf6e0abf2f568bdc6313546783ee79)

This gets us a kernel with btrfs support.

(cherry picked from commit 6f1f13ca9f8db424c613332ec4739e53b2db6fdf)
(cherry picked from commit 1566c15fe42d6d80c80ffc152a7cb87fa5246ea9)

(cherry picked from commit 051d462b42fe6c27824046c15cd3c84fa5afe05b)
(cherry picked from commit 90b5cb35e9901947fca63d82e69b74b2df959258)

(cherry picked from commit 163bb43ceaa1e5bdcda27c4417339b3af9cf28af)
(cherry picked from commit 3e435e970d157271b2378400cbc9c84610d38f06)

(cherry picked from commit 111f9889927d75b82264fcaf59b99b879a4a8a26)
(cherry picked from commit a6906475be1357782bf60c4e5d2beff61f4e0c2a)

During cross-compilation of systemd, the compiler used to build the bpf's needs
to be pointed at the correct include searchpath. Which can be done by passing
the corresponding directory in through the cflags; for example in yocto/bitbake
this would work: CFLAGS += "--sysroot=${STAGING_DIR_TARGET}"

Signed-off-by: Johannes Schneider <[email protected]>
(cherry picked from commit b608bf5620765de20851eca55cbd6c42ce1af450)
(cherry picked from commit 3174fae67beeae49f71eda09c9fa844316440522)

(cherry picked from commit b9c5d812d5132ea1d6a7146be80d41ae2ccb288e)
(cherry picked from commit 0b909bf685c661027d1fdc59abcab77c06d62406)

description_good and description_bad are mixed up. Disabling CAP_BPF results in the inability to load BPF, not the other way around.

(cherry picked from commit 1750e30d237e6d9cdebc6b546d0a26342828dbd1)
(cherry picked from commit 8e775590f1b25d399fdffa0279a2e244d7afff23)

File offsets in UEFI are 64bit on all archs, hence let's use that typo
too, and not create artificial confusion around types.

(cherry picked from commit 9573ab8f5a1e2dfdb3542aa647868ff73ced7dd2)
(cherry picked from commit 57661f4ea9b3f13b7395ad594f20c0bae14b6e27)

Just a tiny change to fix an eyesore in cryptsetup luksDump display :)

(cherry picked from commit 0828c6a2bf9aa40a6cf5fcb3d5650130c483ac8a)
(cherry picked from commit 5911f1ec2568805fc820aa96560988f13a11e45e)

The kernel's sched_setattr interface allows for more control over a processes
scheduling attributes as the previously used sched_setscheduler interface.

Using sched_setattr is also the prerequisite for support of utilization
clamping (UCLAMP [1], see #26705) and allows to set sched_runtime. The latter,
sched_runtime, will probably become a relevant scheduling parameter of the
EEVDF scheduler [2, 3], and therefore will not only apply to processes
scheduled via SCHED_DEADLINE, but also for processes scheduled via
SCHED_OTHER/SCHED_BATCH (i.e., most processes).

1: https://docs.kernel.org/next/scheduler/sched-util-clamp.html
2: https://lwn.net/Articles/969062/
3: https://lwn.net/ml/linux-kernel/[email protected]/
(cherry picked from commit 016e9d8d08ce66f5e81b42e0a0db398afc17336a)
(cherry picked from commit fb7ec285c98d9eeaa69d1efda3e450e6f7207e57)

They very much can be with the new mount API.

(cherry picked from commit 36e48f22af102843b6cceeda5a2292e57434d2ee)
(cherry picked from commit 99cb4bdbbb15f3812de7f0fd161f91335000790d)

Update the man page of tmpfiles.d to remove outdated comments regarding the behavior of ownership with symlinks.
The behavior has been changed in this commit 51207ca

(cherry picked from commit d108198f395fde05d94fc75d8581af4aa0de7e4a)
(cherry picked from commit 2f455914f7bfe06fd6423ea054458db61d2cc2e1)

I expect the test output to be the second argument, so we're diffing "expected"
and "output", not the other way around.

I noticed this when working on systemd/systemd#33081.

(cherry picked from commit 6bb3ea655d08c0602c99ccd2a580ba102fd19114)
(cherry picked from commit 9663bb74100dd79c1e4e9c6b2377ea1b817ddee5)

We would say how *sources* are licensed, but actually most user care about the
resulting binaries. So say how the *binaries* are licensed. I used the word
"effectively" because the permissive licenses don't set any requirements on the
binaries, so the license of sources is a complex mix, but the resulting
binaries have a simple effective license.

Also, make it clear that the GPLv2 license applies to udev programs, but not
the shared library. Based on private correspondence, there's some confusion
about this.

(cherry picked from commit bd7236912f373e0a06a1b0395000ec67d96767af)
(cherry picked from commit fb747bd8cdcbeb55f9ef3c62289fff8ff5a25b68)

…generic

When running the test on aarch64 the symlinks look as follows:

"""
[root@H ~]# ls /dev/disk/by-path
platform-4010000000.pcie-pci-0000:00:04.0-scsi-0:0:0:0       platform-4010000000.pcie-pci-0000:00:04.0-scsi-0:0:0:0-part1  platform-4010000000.pcie-pci-0000:00:05.0-nvme-16
platform-4010000000.pcie-pci-0000:00:04.0-scsi-0:0:0:0-part  platform-4010000000.pcie-pci-0000:00:04.0-scsi-0:0:0:0-part2  platform-4010000000.pcie-pci-0000:00:05.0-nvme-17
"""

So let's make the PCI patterns a little more generic so they match
both the x86 and the aarch64 paths.

(cherry picked from commit 72d121b60174b825bf1390958eb1b55f34c5ff5b)
(cherry picked from commit dc0167b674bc6b555c25f374719c818bc6ad1416)

Whereas RFC 1035 says the TTL field takes the "positive values of a
signed 32 bit number", and RFC 2181 says "Implementations should treat
TTL values received with the most significant bit set as if the entire
value received was zero,", the dns_packet_read_rr() function sets
rr->ttl to zero if the MSB is set.

However, EDNS(0) as specified in RFC 6891 repurposes the TTL field's 4
octets to store other information, c.f.:

                  +0 (MSB)                            +1 (LSB)
       +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
    0: |         EXTENDED-RCODE        |            VERSION            |
       +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
    2: | DO|                           Z                               |
       +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+

The first octet extends the usual 4-bit RCODE from the packet header by
providing an additional 8 bits of space, extending the RCODE to 12 bits.
But, our handling of the TTL field means that the high bit in the first
octet is not actually usable, since setting it will mean these 4 octets
are replaced with 0. This may have the effect of making us believe a
server does not support DNSSEC when it actually set the DO bit in its
OPT record.

Here we change things so that the TTL is only set to zero for record
types other than OPT.

(cherry picked from commit 131787979c700becaf6ec24a810658d1313587cc)
(cherry picked from commit 6ead24fcac878b3623408ecb1a05d07f29c4c04c)

The DNS_PACKET_RCODE() function works out the full RCODE by taking the
first octet from the OPT record TTL field and bitwise-OR-ing this with
the basic RCODE from the packet header. This results in RCODE values
being lower than they should be.

For example, if the first TTL octet is 0x7a and the basic RCODE is 3,
this function currently returns `0x7a | 3` = 123, rather than 0x7a3 =
1955.

The first TTL octet is supposed to form the upper 8 bits of a 12-bit
value, whereas the current implementation constraints the value to 8
bits and results in mis-interpreted RCODEs.

This fixes things by shifting the TTL 20 places instead of 24 and
masking off the low nibble that comes from the upper bits of the version
octet.

Note that dns_packet_append_opt() correctly converts the input RCODE
into the high octet of the OPT TTL field; this problem only affects
parsing of incoming packets.

(cherry picked from commit c40f3714c9a4d1f2bcd308625c9c835892e3d41c)
(cherry picked from commit 7ee60a86140ebe3e60858ef3c4e749dcd2e7fd21)

Currently, we only follow merged units for unit_load_dropin() call.
But if the unit is an alias, we should always perform operations
on the "canonical" unit.

(cherry picked from commit 740cd1e0f2ae5cc1a10d2111d63cc4e975761091)
(cherry picked from commit 86d47d63b01c1910f8f186668948f0dc7b80db37)

(cherry picked from commit 0e445aaa8553ff4ddf8330913260e5f167b1690d)
(cherry picked from commit 3c88c94432128a167f61323f821dee277aba6171)

We want to use 4K as the default sector size for filesystems so they
don't have to be regenerated to work on 512, 2048 or 4096 sector sizes.

(cherry picked from commit d34361149f897eac5c6a41854fa4edca4804b49b)
(cherry picked from commit e34f436433cfce10d01d31569f74f0ad96d5a938)

btrfs used to default the sector size to the page size and didn't
support anything else. Since 6.7, it defaults to 4K and using 4K
makes the filesystem compatible with all page sizes. So let's make
sure we use minimum 4K as well (lower causes failures on systems with
a 4K page size) but still allow larger sector sizes if specified by
the user.

(cherry picked from commit 03c9e88fb7eb8973477c33aa63dc6bcf0cab52c9)
(cherry picked from commit 24987eb3cc175dd4e5cfaab5abe6da02b64104bc)

If the destination mount point is on a shared filesystem and is
missing on the first attempt, we try to create it, but then
fail with -EEXIST if something else created it in the meanwhile.
Enter the retry logic on EEXIST, as we can just use the mount
point if it was already created.

Fixes systemd/systemd#29690

(cherry picked from commit c3f0f6f8bd812fee4b2ab658a5cc9ac9167d387d)
(cherry picked from commit df990be91348f847f31da8d02d3ee2fbcb946c30)

cpu.pressure 'full' is undefined for system-wide checks since 5.13 but still reported with values set to 0 for backwards compatibility. Made changes to reflect this for system-wide checks so that the conditional comparison is not made against the 0 value and instead fall back to 'some'.

https://www.kernel.org/doc/html/latest/accounting/psi.html
(cherry picked from commit 98b1ecc9175a8bb241292f6f441a754b6759dd97)
(cherry picked from commit c2f74defaad3c2d0eb114d3f5aeded07890d9989)

Needed for resolving the "localhost" hostname.

(cherry picked from commit a09825ce9fb3bd315f35654b6e6ee4f92c675cde)
(cherry picked from commit 4f7d6885a12c0e5e27a9d29f9ef09fb2fa53d6ef)

/etc/systemd/journald.conf.d drop-in dir already exists on SUSE.

(cherry picked from commit 56a894e888002f44f3463b3188f9d5abdcca4bb0)
(cherry picked from commit 10b7e0a0afc31dc6a3cc30fca3a276449a60ec7d)

… func ret type

Addresses systemd/systemd#33567 (comment)

(cherry picked from commit 4b7249111a4c1d366f476bdbd6e03f7893eb9d42)
(cherry picked from commit 3c91ea49d249cda6e1fa84b53a42dee6d83339da)

(cherry picked from commit 17ef81a764995dfd0f43daf34dcf2ab04806e760)
(cherry picked from commit 0a97db87893e706011f0ed7e522a42fcd3767ac4)

We calculate the amount of uncompressed data we can write by taking the limits
into account and halving it to ensure there's room for switching to compression
on the fly when storing cores on a tmpfs (eg: due read-only rootfs).

But the logic is flawed, as taking into account the size of the tmpfs storage
was applied after the halving, so in practice when an uncompressed core file
was larger than the tmpfs, we fill it and then fail.

Rearrange the logic so that the halving is done after taking into account
the tmpfs size.

(cherry picked from commit e6b2508275aac2951aedfc842735d8ebc29850bb)
(cherry picked from commit a946258e9df627c675d13b2041ae186babf269dc)

These are required by the bpf_tracing.h header in libbpf, see
https://github.com/libbpf/libbpf/blob/master/src/bpf_tracing.h.

bpf_tracing.h does have a few fallbacks in case __TARGET_ARCH_XXX
is not defined but recommends using the __TARGET_ARCH macros instead
so let's do that.

(cherry picked from commit 48d6dad100d0b42c02aa21d897e913461f6b3cc3)
(cherry picked from commit 399e78855324b3424bbbbbe8e2a3b31e75570ec6)

Otherwise, busctl --user call ... SoftReboot results in
user manager broadcasting signal and initiating soft-reboot...

(cherry picked from commit 236cd4854657745e1a59b224a191a232a476527e)
(cherry picked from commit efc44e0c3eab9d502e472de484ddb8a29d559fab)

The patch is originally from Brenton Simpson, I (Lennart) just added some
comments and rebased it.

I didn't test this, but the patch looks so obviously right to me, that
I think we should just merge it, instead of delaying this further. In
the worst case noone notices, in the best case this makes sd-boot work
reasonably nicely on devices that only have a hadware power key + volume
rocker.

Fixes: #30598
Replaces: #31135
(cherry picked from commit 2fda6f5fffcc05adaa5a08d976e09ad7cc97c1b3)
(cherry picked from commit 71de25f2df501cd0ab8e639100ce23534d23a208)

We need to enable this otherwise systemd-oomd.service fails to start.

Fixes:
ConditionControlGroupController=memory was not met

(cherry picked from commit aa329b89223a79793cde8288b1bc6e93db174938)
(cherry picked from commit a50e6c5709f5fde269e6522bc6e6992180705fb1)

The previous commit tries to extract a substring from the
extension-release suffix, but that is not right, it's only the
images that need to be versioned and extracted, use the extension-release
suffix as-is. Otherwise if it happens to contain a prefix that
matches the wrong image, it will be taken into account.

Follow-up for 3754397

(cherry picked from commit 92d1fe3efac7b3a700317ec71b64cab5ebc17b42)
(cherry picked from commit 160b539a9de2c8adc400833d976165d6158fd944)

This file doesn't document features of systemd, but is more a of a
general description that generalizes/modernizes FHS. As such, the items
listed in it weren't "added" in systemd versions, they simply reflect
general concepts independent of any specific systemd version. hence
let's drop this misleading and confusing version info.

Or in other words, the man page currently claims under "/usr/": "Added
in version 215." – Which of course is rubbish, the directory existed
since time began.

This also rebreaks all paragaphs this touches.

No content changes.

(cherry picked from commit 26db8fe2478316825c5596e4b93b08176a8abddb)
(cherry picked from commit 8dbb7e2a72a73cd3f92b4891148d00c314cd8b67)

…ally about shared *ownership*

(cherry picked from commit 39aafbd42ac3d9675098c8212261fa56261d9066)
(cherry picked from commit 9d40e5c9c61276ca80ccdedacbfc51d8d466ab90)

The XDG base dir spec adopted ~/.local/state/ as a thing a while back,
and we updated our docs in b4d6bc6, but
forgot to to update the table at the bottom to fully reflect the update.
Fix that.

(cherry picked from commit 72a6296b16a75d4e26eec972f2999e69c9967b9d)
(cherry picked from commit df1ed3fbe2d03e9c1d0eed7d836c5aa541f4fb52)

If the io.systemd.DynamicUser or io.systemd.Machine files exist,
but nothing is listening on them, the nss-systemd module returns
ECONNREFUSED and systemd-sysusers fails to creat the user/group.

This is problematic when ran by packaging scripts, as the package
assumes that after this has run, the user/group exist and can
be used. adduser does not fail in the same situation.

Change sysusers to print a loud warning but otherwise continue
when NSS returns an error.

(cherry picked from commit fc9938d6f8e7081df5420bf88bf98f683b1391c0)
(cherry picked from commit abba1e6bc29b7e07354ca23906c6f485ba245a1a)

The newest kconfig enabling DB-verified dm-verity images is queued
for 6.11:

https://patchwork.kernel.org/project/dm-devel/patch/[email protected]/
(cherry picked from commit a79b6dc0706dd5fe76ec56b3308b402c133ead23)
(cherry picked from commit c32f71aa1420b05711fa0593ddcffbeb76f272ab)

An smbios object with no variable part is a special case, it's just
suffixed with two NUL btes. handle that properly.

This is inspired by a similar fix from systemd/systemd#29726

(cherry picked from commit 44ec70489f377d1fa9f4e19aed95a7e39da7d93d)
(cherry picked from commit 9a2f16e4edc490a289e3b22ab9f30e3e5bc73850)

It no longer builds due to packaging issues, drop it,
CentOS 9 is still covered