Sync changes to SLFO-1.2 branch

2025-08-20 09:18:05 +02:00
21 changed files with 2210 additions and 7419 deletions
--- a/2
+++ b/2
@@ -3,8 +3,6 @@
  <package>utils</package>
  <package>testsuite</package>
  <package>cross-aarch64</package>
-  <package>cross-hppa</package>
-  <package>cross-loongarch64</package>
  <package>cross-ppc64le</package>
  <package>cross-riscv64</package>
  <package>cross-s390x</package>
--- a/float128-sycl.patch
+++ b/float128-sycl.patch
@@ -1,48 +0,0 @@
-From a900dbaf70f0a957f56b52caa69173592ad7596e Mon Sep 17 00:00:00 2001
-From: "H.J. Lu" <hjl.tools@gmail.com>
-Date: Thu, 20 Feb 2025 07:08:26 +0800
-Subject: [PATCH] x86 (__HAVE_FLOAT128): Defined to 0 for Intel SYCL compiler
- [BZ #32723]
-
-Intel compiler always defines __INTEL_LLVM_COMPILER.  When SYCL is
-enabled by -fsycl, it also defines SYCL_LANGUAGE_VERSION.  Since Intel
-SYCL compiler doesn't support _Float128:
-
-https://github.com/intel/llvm/issues/16903
-
-define __HAVE_FLOAT128 to 0 for Intel SYCL compiler.
-
-This fixes BZ #32723.
-
-Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
-Reviewed-by: Sam James <sam@gentoo.org>
-(cherry picked from commit 5a4573be6f96ff49111bb6cae767676b5aafa7a8)
---
- sysdeps/x86/bits/floatn.h | 8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/sysdeps/x86/bits/floatn.h b/sysdeps/x86/bits/floatn.h
-index d197cb10dd..adc7ed2e9e 100644
--- a/sysdeps/x86/bits/floatn.h
-+++ b/sysdeps/x86/bits/floatn.h
-@@ -25,11 +25,15 @@
-    floating-point type with the IEEE 754 binary128 format, and this
-    glibc includes corresponding *f128 interfaces for it.  The required
-    libgcc support was added some time after the basic compiler
-   support, for x86_64 and x86.  */
-+   support, for x86_64 and x86.  Intel SYCL compiler doesn't support
-+   _Float128: https://github.com/intel/llvm/issues/16903
-+  */
- #if (defined __x86_64__							\
-      ? __GNUC_PREREQ (4, 3)						\
-      : (defined __GNU__ ? __GNUC_PREREQ (4, 5) : __GNUC_PREREQ (4, 4))) \
-    || __glibc_clang_prereq (3, 4)
-+    || (__glibc_clang_prereq (3, 4)					\
-+	&& (!defined __INTEL_LLVM_COMPILER				\
-+	    || !defined SYCL_LANGUAGE_VERSION))
- # define __HAVE_FLOAT128 1
- #else
- # define __HAVE_FLOAT128 0
-- 
-2.48.1
-
--- a/gen-tempname-randomness.patch
+++ b/gen-tempname-randomness.patch
@@ -0,0 +1,28 @@
+From 5f62cf88c4530c11904482775b7582bd7f6d80d2 Mon Sep 17 00:00:00 2001
+From: Andreas Schwab <schwab@suse.de>
+Date: Wed, 25 Sep 2024 11:49:30 +0200
+Subject: [PATCH] Fix missing randomness in __gen_tempname (bug 32214)
+
+Make sure to update the random value also if getrandom fails.
+
+Fixes: 686d542025 ("posix: Sync tempname with gnulib")
+---
+ sysdeps/posix/tempname.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sysdeps/posix/tempname.c b/sysdeps/posix/tempname.c
+index c00fe0c181..fc30958a0c 100644
+--- a/sysdeps/posix/tempname.c
+++ b/sysdeps/posix/tempname.c
+@@ -117,6 +117,8 @@ random_bits (random_value *r, random_value s)
+      succeed.  */
+ #if !_LIBC
+   *r = mix_random_values (v, clock ());
+#else
+  *r = v;
+ #endif
+   return false;
+ }
+-- 
+2.46.2
+
--- a/glibc-2.40.tar.xz
+++ b/glibc-2.40.tar.xz
--- a/glibc-2.40.tar.xz.sig
+++ b/glibc-2.40.tar.xz.sig
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCAAdFiEEcnNUKzmWLfeymZMUFnkrTqJTQPgFAmaeSXIACgkQFnkrTqJT
+QPhcfw/+LG5lo6bi7F8Kggp7rsxw1QpRsT76HUNdsoVZRbKvERYihexEQST8rNM/
+BvzWv+eAxE8h1XcBdYk3qKtyvsggVogaxnsfRq1+5yonrI0FGDdQZEjDhYVBEPma
+T1m8qmZywPingm37gT5RevQJP3vg2OBW9l5/nwGk9K33e+09RXCAyvZVrn7binTV
+27VESY5/6X7uC2Ga1WnZG2omu3W5+vAsGWoFnCNjJHfqyW6agaGLbGNSBJnSABv+
+mTy4v8S6zpRovWZOA2hi7FUVbtDyvyJrGZLnTNBA/DxqKiKc2ZQUljXy7Uv+piDt
+H0bwNsrC0mcRxdqsA8FNUv/gIpHcuBaLjUz37bA6d0iwkvqf8YCJ47O6KbMuuDeu
+DudKO+QIVTgs0ahUnbomW27Un46cvkM2JM7dU9Akt5Cja9hImOOn1cbotkaMfmsL
+c3Hq+O3LYwI76p3HUwsjg3xjgoLZy24+46PaXRncrYImgTif6yGq4uVjWXnaFsLs
+WtE16EU9fvU1zCBRbdcT6cI6TiNQvQdc8aBGxKs4oFTMROWiczfwKmcIrC6OROIJ
+kW5V0nI5t3Sk8XSubUxj4dZhk6E1e58RhKm/5pcdOVzwbd3H9sb5q/BhlWB7M49M
+i5n7p77a1YCjuhl/m43Q036uDCER7/JSbnekU6zsTYUDX/ZfWiA=
+=hPC5
+-----END PGP SIGNATURE-----
--- a/glibc-2.41.tar.xz
+++ b/glibc-2.41.tar.xz
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:a5a26b22f545d6b7d7b3dd828e11e428f24f4fac43c934fb071b6a7d0828e901
-size 19344868
--- a/glibc-2.41.tar.xz.sig
+++ b/glibc-2.41.tar.xz.sig
@@ -1,19 +0,0 @@
-----BEGIN PGP SIGNATURE-----
-Version: GnuPG v2
-
-iQKTBAABCgB9FiEE/Rnm0xsZLuTcY+rT3CsWIV7VQSoFAmea1xNfFIAAAAAALgAo
-aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZE
-MTlFNkQzMUIxOTJFRTREQzYzRUFEM0RDMkIxNjIxNUVENTQxMkEACgkQ3CsWIV7V
-QSq+Qg//VwaVsRXRHVHHAbbFyqjeYPQfkgIwzOfbrkVEe75L+PnVBF52cRJ8S2YK
-FopiiK+xBmS6rUyuzhOVtLSpGepPtOHJI5NzWz2radZmoRhW8ozoFL7iGmJxIYoX
-wz6zadwJeg5AFMY3VFNTAtkxRIn7zk25x6LYMj7cIF1dxoh6NbiGGq/5z5Ru+9l0
-zX1x1wPfDNqgjW0pZyZ4xt1O853EZjmY1kvsLrrHk+ruq3TGcEUjUlmw3F9LKwny
-H9GYwNIfcbnuK7ZDh2cIqxBVd/T8e1Eam+tyVlSaijIHptsF59roBvP3kFAdkDp9
-byHnmR8c/5M5KFFdOgURl17ST9yNyOEgMgzrknqk9Onfd24DBz2c/rv93IjrBNpy
-Tllw0yGgVElyKeXVSGDm6DOHJT50LB/ra2Pb82zf33rs5prw1yLL7VZ3Y58ysUJq
-fi7IGWEFK8uhxT/15jIyp19x2RpQvHJqVIpNQmx/SLbGCuh4lS+1poIng3M5ktMX
-R4KviCHrPGWCLQIveqffHiBr6kbKOmZL9NSYFI+o1aINL0pToqT9jw7gA4brYnzn
-9Uu9xN4YkSqCXWBXdJCj2rDJDVqOWarUaC7/datpFkdC/hCeN63CQ+cTj166CpdZ
-Cyqcai2WeyNJvcoLY3G5J/6BDBzVP78Ze42Ki/IsSo3YDK3NFGg=
-=KfhY
-----END PGP SIGNATURE-----
--- a/glibc-version.diff
+++ b/glibc-version.diff
@@ -8,7 +8,7 @@ Index: glibc-2.27/csu/version.c
 static const char banner[] =
 -"GNU C Library "PKGVERSION RELEASE" release version "VERSION".\n\
 +"GNU C Library "PKGVERSION RELEASE" release version "VERSION" (git "GITID").\n\
- Copyright (C) 2025 Free Software Foundation, Inc.\n\
+ Copyright (C) 2024 Free Software Foundation, Inc.\n\
 This is free software; see the source for copying conditions.\n\
 There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A\n\
 PARTICULAR PURPOSE.\n\
--- a/glibc.changes
+++ b/glibc.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Thu Jul 24 10:14:52 UTC 2025 - Andreas Schwab <schwab@suse.de>
+
+- regcomp-double-free.patch: posix: Fix double-free after allocation
+  failure in regcomp (CVE-2025-8058, bsc#1246965, BZ #33185)
+
 -------------------------------------------------------------------
 Tue Jun 17 09:11:26 UTC 2025 - Andreas Schwab <schwab@suse.de>

@@ -8,16 +14,27 @@ Tue Jun 17 09:11:26 UTC 2025 - Andreas Schwab <schwab@suse.de>
  implementation (BZ #33059)

 -------------------------------------------------------------------
-Mon Jun  2 10:54:37 UTC 2025 - Andreas Schwab <schwab@suse.de>
+Thu Jun  5 09:18:29 UTC 2025 - Andreas Schwab <schwab@suse.de>
+
+- Add support for userspace livepatching for ppc64le (jsc#PED-11850)
+
+-------------------------------------------------------------------
+Mon Jun  2 12:09:30 UTC 2025 - Andreas Schwab <schwab@suse.de>

 - Filter GLIBC_PRIVATE symbols again
 - Drop ngpt provides
- Refine libc_nonshared.a workaround
+- Compile functions in libc_nonshared.a as PIC

 -------------------------------------------------------------------
-Fri Apr 18 19:50:23 UTC 2025 - Giuliano Belinassi <giuliano.belinassi@suse.com>
+Thu Apr  3 14:43:21 UTC 2025 - Andreas Schwab <schwab@suse.de>

- Enable Userspace Livepatching on ppc64le (jsc#PED-7395)
+- pthread-wakeup.patch: pthreads NPTL: lost wakeup fix 2 (bsc#1234128, BZ
+  #25847)
+
+-------------------------------------------------------------------
+Mon Mar 24 15:24:22 UTC 2025 - Andreas Schwab <schwab@suse.de>
+
+- Mark functions in libc_nonshared.a as hidden (bsc#1239883)

 -------------------------------------------------------------------
 Wed Mar 12 10:28:15 UTC 2025 - Andreas Schwab <schwab@suse.de>
@@ -25,26 +42,11 @@ Wed Mar 12 10:28:15 UTC 2025 - Andreas Schwab <schwab@suse.de>
 - Do not build libnsl1 (bsc#1239459)

 -------------------------------------------------------------------
-Wed Feb 26 15:29:17 UTC 2025 - Andreas Schwab <schwab@suse.de>
+Wed Feb 26 15:32:06 UTC 2025 - Andreas Schwab <schwab@suse.de>

 - Bump minimal kernel version to 4.3 to enable use of direct socketcalls
  on x86-32 and s390x (bsc#1234713)

-------------------------------------------------------------------
-Thu Feb 20 09:53:20 UTC 2025 - Andreas Schwab <schwab@suse.de>
-
- Build cross-hppa and cross-loongarch64 only with gcc >= 14
- round-log10p1f.patch: math: Fix log10p1f internal table value (BZ
-  #32626)
- round-sinhf.patch: math: Fix sinhf for some inputs (BZ #32627)
- nptl-stack-size-up.patch: nptl: Correct stack size attribute when stack
-  grows up (BZ #32574)
- round-tanf.patch: math: Fix tanf for some inputs (BZ 32630)
- tst-aarch64-pkey.patch: Fix tst-aarch64-pkey to handle ENOSPC as not
-  supported
- float128-sycl.patch: x86 (__HAVE_FLOAT128): Defined to 0 for Intel SYCL
-  compiler (BZ #32723)
-
 -------------------------------------------------------------------
 Mon Feb 17 10:37:02 UTC 2025 - Andreas Schwab <schwab@suse.de>

@@ -55,66 +57,6 @@ Mon Feb 10 12:19:00 UTC 2025 - Andreas Schwab <schwab@suse.de>

 - Use rpm.execute when available (bsc#1236869)

-------------------------------------------------------------------
-Wed Jan 29 09:19:29 UTC 2025 - Andreas Schwab <schwab@suse.de>
-
- Update to glibc 2.41
-  * In /etc/resolv.conf and the RES_OPTIONS environment variable, option
-    flags can now be prefixed with “-” to clear previously set flags
-  * The DNS stub resolver now supports the strict-error option
-  * On Linux, the sched_setattr and sched_getattr functions have been
-    added
-  * The iconv program now supports converting files in place
-  * Character encoding, character type info, and transliteration tables
-    have been updated to Unicode 16.0.0
-  * The following ISO C23 function families (introduced in TS
-    18661-4:2015) are now supported in <math.h>:
-    - Trigonometric functions: acospi, asinpi, atan2pi, atanpi, cospi,
-      sinpi, tanpi.
-  * The GNU C Library now supports a feature test macro _ISOC2Y_SOURCE to
-    enable features from the draft ISO C2Y standard
-  * Optimized and correctly rounded exp10m1f, exp2m1f, expm1f, log10f,
-    log2p1f, log1pf, log10p1f, cbrtf, erff, erfcf, lgammaf, tgammaf,
-    tanf, acosf, acoshf, asinf, asinhf, atanf, atan2f, atanhf, coshf,
-    sinhf, and tanhf functions have been added from the CORE-MATH
-    project <https://core-math.gitlabpages.inria.fr/>
-  * A new tunable, glibc.rtld.execstack, can be used to control whether an
-    executable stack is allowed from the main program, either implicitly
-    due to a mising GNU_STACK ELF header or explicit explicitly because
-    of the executable bit in GNU_STACK
-  * Support for the extensible rseq ABI introduced in the Linux kernel
-    version 6.3 has been added
-  * The GNU C Library now supports the Guarded Control Stack extension
-    that allows to use shadow stacks on AArch64 systems that support this
-    extension
-  * Significant effort has been put into improving the code generation
-    and speed of mathematical functions in the vector mathematics library
-    on AArch64, with regard to the Scalable Vector Extension (SVE) and
-    Advanced SIMD (Neon) intrinsics
-  * Support for memory protection keys on AArch64 systems with enabled
-    Stage 1 permission overlays feature as introduced in Armv8.9 / 9.4
-    has been added
-  * On PowerPC64, support for the return-oriented programming protection
-    instructions added in ISA 3.1 (Power10) has been added, as well as
-    function optimizations for Power10
-  * A new architecture type has been introduced internally to better
-    support Hygon x86-64 processors
-  * abort is now async-signal-safe and its implementation makes longjmp
-    from the SIGABRT handler always abort if set up with setjmp
-  * dlopen and dlmopen no longer make the stack executable if a shared
-    library requires it, either implicitly because of a missing GNU_STACK
-    ELF header (and default ABI permission having the executable bit set)
-    or explicitly because of the executable bit in GNU_STACK, and the
-    stack is not already executable
-  * On recent Linux kernels with vDSO getrandom support, getrandom does
-    not act as a "shall occur" cancellation point, in which case it might
-    not issue a syscall or trigger a deferred cancellation event
-  * GLIBC-SA-2025-0001: assert: Buffer overflow when printing assertion
-    failure message (CVE-2025-0395)
- Add cross-hppa and cross-loongarch64 packages
- gen-tempname-randomness.patch: Removed
- ulp-prologue-into-asm-functions.patch: Rebase
-
 -------------------------------------------------------------------
 Mon Jan 20 13:33:58 UTC 2025 - Andreas Schwab <schwab@suse.de>

@@ -191,6 +133,7 @@ Mon Jul 29 07:50:31 UTC 2024 - Andreas Schwab <schwab@suse.de>
  s390-clone-error-clobber-r7.patch, sigisemptyset.patch,
  stdbit-builtins.patch, utmp-time-bits.patch: Removed
 - glibc-2.3.90-langpackdir.diff: Rediff
+- bsc#1228041

 -------------------------------------------------------------------
 Mon Jun  3 08:24:38 UTC 2024 - Dominique Leuenberger <dimstar@opensuse.org>
@@ -340,7 +283,6 @@ Thu Feb  1 09:25:37 UTC 2024 - Andreas Schwab <schwab@suse.de>
  sem-open-o-creat.patch, setxid-propagate-glibc-tunables.patch,
  syslog-buffer-overflow.patch, tls-modid-reuse.patch,
  tunables-string-parsing.patch: Removed
- CVE-2025-4802

 -------------------------------------------------------------------
 Wed Jan 31 09:25:16 UTC 2024 - Andreas Schwab <schwab@suse.de>
--- a/glibc.keyring
+++ b/glibc.keyring
--- a/glibc.spec
+++ b/glibc.spec
@@ -34,12 +34,6 @@
 %if "%flavor" == "cross-aarch64"
 %define cross_cpu aarch64
 %endif
-%if "%flavor" == "cross-hppa"
-%define cross_cpu hppa
-%endif
-%if "%flavor" == "cross-loongarch64"
-%define cross_cpu loongarch64
-%endif
 %if "%flavor" == "cross-riscv64"
 %define cross_cpu riscv64
 %endif
@@ -57,13 +51,13 @@
 %define sysroot %{_prefix}/%{binutils_os}/sys-root
 %endif

-%if %{suse_version} >= 1550
+%if 0%{?suse_version} >= 1550
 %bcond_without usrmerged
 %else
 %bcond_with usrmerged
 %endif

-%if %{suse_version} >= 1600
+%if 0%{?suse_version} >= 1600
 %bcond_with nscd
 %else
 %bcond_without nscd
@@ -102,7 +96,7 @@ ExclusiveArch:  do_not_build
 %undefine _build_create_debug
 %define _enable_debug_packages 0
 ExcludeArch:    %{cross_arch}
-%if %{suse_version} < 1600
+%if 0%{?suse_version} < 1600
 ExclusiveArch:  do_not_build
 %endif
 %endif
@@ -186,10 +180,10 @@ Name:           glibc%{name_suffix}
 Summary:        Standard Shared Libraries (from the GNU C Library)
 License:        GPL-2.0-or-later AND LGPL-2.1-or-later AND LGPL-2.1-or-later WITH GCC-exception-2.0
 Group:          System/Libraries
-Version:        2.41
+Version:        2.40
 Release:        0
 %if %{without snapshot}
-%define git_id 74f59e9271
+%define git_id ef321e23c2
 %define libversion %version
 %else
 %define git_id %(echo %version | sed 's/.*\.g//')
@@ -201,7 +195,7 @@ Source:         https://ftp.gnu.org/pub/gnu/glibc/glibc-%{version}.tar.xz
 %if %{without snapshot}
 Source1:        https://ftp.gnu.org/pub/gnu/glibc/glibc-%{version}.tar.xz.sig
 %endif
-Source2:        https://savannah.gnu.org/project/release-gpgkeys.php?group=libc&download=1&file=./glibc.keyring
+Source2:        http://savannah.gnu.org/project/memberlist-gpgkeys.php?group=libc&download=1#/glibc.keyring
 Source4:        manpages.tar.bz2
 Source5:        nsswitch.conf
 Source7:        bindresvport.blacklist
@@ -279,11 +273,6 @@ BuildArch:      i686
 # Sync only this build counter with the main build
 #!BcntSyncTag:  glibc
 %endif
-%if 0%{?gcc_version} < 14
-%if "%flavor" == "cross-loongarch64" || "%flavor" == "cross-hppa"
-ExclusiveArch:  do_not_build
-%endif
-%endif

 ###
 # Patches are ordered in the following groups:
@@ -336,22 +325,16 @@ Patch306:       glibc-fix-double-loopback.diff
 %if %{without snapshot}
 ###
 # Patches from upstream
-# PATCH-FIX-UPSTREAM math: Fix log10p1f internal table value (BZ #32626)
-Patch1000:      round-log10p1f.patch
-# PATCH-FIX-UPSTREAM math: Fix sinhf for some inputs (BZ #32627)
-Patch1001:      round-sinhf.patch
-# PATCH-FIX-UPSTREAM nptl: Correct stack size attribute when stack grows up (BZ #32574)
-Patch1002:      nptl-stack-size-up.patch
-# PATCH-FIX-UPSTREAM math: Fix tanf for some inputs (BZ 32630)
-Patch1003:      round-tanf.patch
-# PATCH-FIX-UPSTREAM Fix tst-aarch64-pkey to handle ENOSPC as not supported
-Patch1004:      tst-aarch64-pkey.patch
-# PATCH-FIX-UPSTREAM x86 (__HAVE_FLOAT128): Defined to 0 for Intel SYCL compiler (BZ #32723)
-Patch1005:      float128-sycl.patch
+# PATCH-FIX-UPSTREAM Fix missing randomness in __gen_tempname (BZ #32214)
+Patch1000:      gen-tempname-randomness.patch
+# PATCH-FIX-UPSTREAM pthreads NPTL: lost wakeup fix 2 (BZ #25847)
+Patch1001:      pthread-wakeup.patch
 # PATCH-FIX-UPSTREAM Revert optimized POWER10 strcmp, strncmp implementations (CVE-2025-5745, CVE-2025-5702, BZ #33060, BZ #33056)
 Patch1006:      ppc64le-revert-power10-strcmp.patch
 # PATCH-FIX-UPSTREAM Revert optimized POWER10 memcmp (BZ #33059)
 Patch1007:      ppc64le-revert-power10-memcmp.patch
+# PATCH-FIX-UPSTREAM posix: Fix double-free after allocation failure in regcomp (BZ #33185)
+Patch1008:      regcomp-double-free.patch
 ###
 %endif

@@ -570,7 +553,7 @@ Group:          System/Libraries
 Network Support Library for legacy architectures.  This library does not
 have support for IPv6.

-%if %{suse_version} >= 1500
+%if 0%{suse_version} >= 1500
 %define make_output_sync -Oline
 %endif

@@ -628,11 +611,6 @@ for opt in $tmp; do
 %endif
 %if %{build_cross}
    -m*) ;;  # remove all machine specific options for crosses
-%endif
-%if "%{cross_arch}" == "hppa"
-     # -fstack-clash-protection is not supported on targets where the
-     # stack grows from lower to higher addresses
-    -fstack-clash-protection) ;;
 %endif
    *) BuildFlags+=" $opt" ;;
  esac
@@ -722,7 +700,7 @@ profile="--disable-profile"
 %if %{build_cross}
 	--with-headers=%{sysroot}/usr/include \
 %else
-%ifarch armv7hl ppc ppc64 ppc64le i686 x86_64 sparc sparc64 s390 s390x riscv64
+%ifarch armv7hl ppc ppc64 ppc64le i686 x86_64 sparc sparc64 s390 s390x
 	--enable-multi-arch \
 %endif
 %ifarch aarch64
@@ -738,7 +716,7 @@ profile="--disable-profile"
 	--with-cpu=power7 \
 %endif
 %ifarch x86_64
-%if %{suse_version} > 1500
+%if %suse_version > 1500
 	--enable-cet \
 %endif
 %endif
@@ -1021,7 +999,7 @@ rm -rf %{buildroot}%{_datadir}/locale/*/
 # Miscelanna:

 install -m 644 %{SOURCE7} %{buildroot}/etc
-%if %{suse_version} > 1500
+%if %suse_version > 1500
 install -D -m 644 %{SOURCE5} %{buildroot}%{_prefix}/etc/nsswitch.conf
 %else
 install -m 644 %{SOURCE5} %{buildroot}/etc/nsswitch.conf
@@ -1308,7 +1286,7 @@ exit 0
 %config /etc/ld.so.conf
 %attr(0644,root,root) %verify(not md5 size mtime) %ghost %config(missingok,noreplace) /etc/ld.so.cache
 %config(noreplace) /etc/rpc
-%if %{suse_version} > 1500
+%if %suse_version > 1500
 %attr(0644,root,root) %verify(not md5 size mtime) %ghost %config(missingok,noreplace) /etc/nsswitch.conf
 %{_prefix}/etc/nsswitch.conf
 %else
--- a/nptl-stack-size-up.patch
+++ b/nptl-stack-size-up.patch
@@ -1,40 +0,0 @@
-From cb7f20653724029be89224ed3a35d627cc5b4163 Mon Sep 17 00:00:00 2001
-From: John David Anglin <danglin@gcc.gnu.org>
-Date: Wed, 29 Jan 2025 16:51:16 -0500
-Subject: [PATCH] nptl: Correct stack size attribute when stack grows up [BZ
- #32574]
-
-Set stack size attribute to the size of the mmap'd region only
-when the size of the remaining stack space is less than the size
-of the mmap'd region.
-
-This was reversed.  As a result, the initial stack size was only
-135168 bytes.  On architectures where the stack grows down, the
-initial stack size is approximately 8384512 bytes with the default
-rlimit settings.  The small main stack size on hppa broke
-applications like ruby that check for stack overflows.
-
-Signed-off-by: John David Anglin <dave.anglin@bell.net>
---
- nptl/pthread_getattr_np.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/nptl/pthread_getattr_np.c b/nptl/pthread_getattr_np.c
-index e98e2df152..43dd16d59c 100644
--- a/nptl/pthread_getattr_np.c
-+++ b/nptl/pthread_getattr_np.c
-@@ -145,9 +145,9 @@ __pthread_getattr_np (pthread_t thread_id, pthread_attr_t *attr)
- 			  > (size_t) iattr->stackaddr - last_to)
- 			iattr->stacksize = (size_t) iattr->stackaddr - last_to;
- #else
-		      /* The limit might be too high.  */
-+		      /* The limit might be too low.  */
- 		      if ((size_t) iattr->stacksize
-			  > to - (size_t) iattr->stackaddr)
-+			  < to - (size_t) iattr->stackaddr)
- 			iattr->stacksize = to - (size_t) iattr->stackaddr;
- #endif
- 		      /* We succeed and no need to look further.  */
-- 
-2.48.1
-
--- a/ppc64le-revert-power10-memcmp.patch
+++ b/ppc64le-revert-power10-memcmp.patch
@@ -1,10 +1,10 @@
-Index: glibc-2.41/sysdeps/powerpc/powerpc64/le/power10/memchr.S
+Index: glibc-2.40/sysdeps/powerpc/powerpc64/le/power10/memchr.S
 ===================================================================
--- glibc-2.41.orig/sysdeps/powerpc/powerpc64/le/power10/memchr.S
+--- glibc-2.40.orig/sysdeps/powerpc/powerpc64/le/power10/memchr.S
 +++ /dev/null
@@ -1,315 +0,0 @@
 -/* Optimized memchr implementation for POWER10 LE.
-   Copyright (C) 2021-2025 Free Software Foundation, Inc.
+-   Copyright (C) 2021-2024 Free Software Foundation, Inc.
 -   This file is part of the GNU C Library.
 -
 -   The GNU C Library is free software; you can redistribute it and/or
@@ -318,10 +318,10 @@ Index: glibc-2.41/sysdeps/powerpc/powerpc64/le/power10/memchr.S
 -
 -weak_alias (__memchr, memchr)
 -libc_hidden_builtin_def (memchr)
-Index: glibc-2.41/sysdeps/powerpc/powerpc64/multiarch/Makefile
+Index: glibc-2.40/sysdeps/powerpc/powerpc64/multiarch/Makefile
 ===================================================================
--- glibc-2.41.orig/sysdeps/powerpc/powerpc64/multiarch/Makefile
-+++ glibc-2.41/sysdeps/powerpc/powerpc64/multiarch/Makefile
+--- glibc-2.40.orig/sysdeps/powerpc/powerpc64/multiarch/Makefile
+++ glibc-2.40/sysdeps/powerpc/powerpc64/multiarch/Makefile
@@ -31,7 +31,7 @@ sysdep_routines += memcpy-power8-cached
 		   strncase-power8
 
@@ -330,11 +330,11 @@ Index: glibc-2.41/sysdeps/powerpc/powerpc64/multiarch/Makefile
 +sysdep_routines += memcmp-power10 memcpy-power10 \
 		   memmove-power10 memset-power10 rawmemchr-power9 \
 		   rawmemchr-power10 strcmp-power9 \
- 		   strncmp-power9 strcpy-power9 strcat-power10 \
-Index: glibc-2.41/sysdeps/powerpc/powerpc64/multiarch/ifunc-impl-list.c
+ 		   strncmp-power9 strcpy-power9 stpcpy-power9 \
+Index: glibc-2.40/sysdeps/powerpc/powerpc64/multiarch/ifunc-impl-list.c
 ===================================================================
--- glibc-2.41.orig/sysdeps/powerpc/powerpc64/multiarch/ifunc-impl-list.c
-+++ glibc-2.41/sysdeps/powerpc/powerpc64/multiarch/ifunc-impl-list.c
+--- glibc-2.40.orig/sysdeps/powerpc/powerpc64/multiarch/ifunc-impl-list.c
+++ glibc-2.40/sysdeps/powerpc/powerpc64/multiarch/ifunc-impl-list.c
@@ -226,12 +226,6 @@ __libc_ifunc_impl_list (const char *name
 
   /* Support sysdeps/powerpc/powerpc64/multiarch/memchr.c.  */
@@ -348,13 +348,13 @@ Index: glibc-2.41/sysdeps/powerpc/powerpc64/multiarch/ifunc-impl-list.c
 	      IFUNC_IMPL_ADD (array, i, memchr,
 			      hwcap2 & PPC_FEATURE2_ARCH_2_07
 			      && hwcap & PPC_FEATURE_HAS_ALTIVEC,
-Index: glibc-2.41/sysdeps/powerpc/powerpc64/multiarch/memchr-power10.S
+Index: glibc-2.40/sysdeps/powerpc/powerpc64/multiarch/memchr-power10.S
 ===================================================================
--- glibc-2.41.orig/sysdeps/powerpc/powerpc64/multiarch/memchr-power10.S
+--- glibc-2.40.orig/sysdeps/powerpc/powerpc64/multiarch/memchr-power10.S
 +++ /dev/null
@@ -1,28 +0,0 @@
 -/* Optimized memchr implementation for POWER10/PPC64.
-   Copyright (C) 2016-2025 Free Software Foundation, Inc.
+-   Copyright (C) 2016-2024 Free Software Foundation, Inc.
 -   This file is part of the GNU C Library.
 -
 -   The GNU C Library is free software; you can redistribute it and/or
@@ -381,10 +381,10 @@ Index: glibc-2.41/sysdeps/powerpc/powerpc64/multiarch/memchr-power10.S
 -
 -#include <sysdeps/powerpc/powerpc64/le/power10/memchr.S>
 -#endif
-Index: glibc-2.41/sysdeps/powerpc/powerpc64/multiarch/memchr.c
+Index: glibc-2.40/sysdeps/powerpc/powerpc64/multiarch/memchr.c
 ===================================================================
--- glibc-2.41.orig/sysdeps/powerpc/powerpc64/multiarch/memchr.c
-+++ glibc-2.41/sysdeps/powerpc/powerpc64/multiarch/memchr.c
+--- glibc-2.40.orig/sysdeps/powerpc/powerpc64/multiarch/memchr.c
+++ glibc-2.40/sysdeps/powerpc/powerpc64/multiarch/memchr.c
@@ -25,23 +25,15 @@ extern __typeof (__memchr) __memchr_ppc
 extern __typeof (__memchr) __memchr_power7 attribute_hidden;
 extern __typeof (__memchr) __memchr_power8 attribute_hidden;
--- a/ppc64le-revert-power10-strcmp.patch
+++ b/ppc64le-revert-power10-strcmp.patch
@@ -1,10 +1,10 @@
-Index: glibc-2.41/sysdeps/powerpc/powerpc64/le/power10/strcmp.S
+Index: glibc-2.40/sysdeps/powerpc/powerpc64/le/power10/strcmp.S
 ===================================================================
--- glibc-2.41.orig/sysdeps/powerpc/powerpc64/le/power10/strcmp.S
+--- glibc-2.40.orig/sysdeps/powerpc/powerpc64/le/power10/strcmp.S
 +++ /dev/null
@@ -1,233 +0,0 @@
 -/* Optimized strcmp implementation for PowerPC64/POWER10.
-   Copyright (C) 2021-2025 Free Software Foundation, Inc.
+-   Copyright (C) 2021-2024 Free Software Foundation, Inc.
 -   This file is part of the GNU C Library.
 -
 -   The GNU C Library is free software; you can redistribute it and/or
@@ -236,13 +236,13 @@ Index: glibc-2.41/sysdeps/powerpc/powerpc64/le/power10/strcmp.S
 -
 -END (STRCMP)
 -libc_hidden_builtin_def (strcmp)
-Index: glibc-2.41/sysdeps/powerpc/powerpc64/le/power10/strncmp.S
+Index: glibc-2.40/sysdeps/powerpc/powerpc64/le/power10/strncmp.S
 ===================================================================
--- glibc-2.41.orig/sysdeps/powerpc/powerpc64/le/power10/strncmp.S
+--- glibc-2.40.orig/sysdeps/powerpc/powerpc64/le/power10/strncmp.S
 +++ /dev/null
@@ -1,271 +0,0 @@
 -/* Optimized strncmp implementation for PowerPC64/POWER10.
-   Copyright (C) 2024-2025 Free Software Foundation, Inc.
+-   Copyright (C) 2024 Free Software Foundation, Inc.
 -   This file is part of the GNU C Library.
 -
 -   The GNU C Library is free software; you can redistribute it and/or
@@ -512,25 +512,25 @@ Index: glibc-2.41/sysdeps/powerpc/powerpc64/le/power10/strncmp.S
 -
 -END(STRNCMP)
 -libc_hidden_builtin_def(strncmp)
-Index: glibc-2.41/sysdeps/powerpc/powerpc64/multiarch/Makefile
+Index: glibc-2.40/sysdeps/powerpc/powerpc64/multiarch/Makefile
 ===================================================================
--- glibc-2.41.orig/sysdeps/powerpc/powerpc64/multiarch/Makefile
-+++ glibc-2.41/sysdeps/powerpc/powerpc64/multiarch/Makefile
+--- glibc-2.40.orig/sysdeps/powerpc/powerpc64/multiarch/Makefile
+++ glibc-2.40/sysdeps/powerpc/powerpc64/multiarch/Makefile
@@ -33,8 +33,8 @@ sysdep_routines += memcpy-power8-cached
 ifneq (,$(filter %le,$(config-machine)))
 sysdep_routines += memchr-power10 memcmp-power10 memcpy-power10 \
 		   memmove-power10 memset-power10 rawmemchr-power9 \
 -		   rawmemchr-power10 strcmp-power9 strcmp-power10 \
-		   strncmp-power9 strncmp-power10 strcpy-power9 strcat-power10 \
+-		   strncmp-power9 strncmp-power10 strcpy-power9 stpcpy-power9 \
 +		   rawmemchr-power10 strcmp-power9 \
-+		   strncmp-power9 strcpy-power9 strcat-power10 \
- 		   stpcpy-power9 strlen-power9 strncpy-power9 stpncpy-power9 \
- 		   strlen-power10
+		   strncmp-power9 strcpy-power9 stpcpy-power9 \
+ 		   strlen-power9 strncpy-power9 stpncpy-power9 strlen-power10
 endif
-Index: glibc-2.41/sysdeps/powerpc/powerpc64/multiarch/ifunc-impl-list.c
+ CFLAGS-strncase-power7.c += -mcpu=power7 -funroll-loops
+Index: glibc-2.40/sysdeps/powerpc/powerpc64/multiarch/ifunc-impl-list.c
 ===================================================================
--- glibc-2.41.orig/sysdeps/powerpc/powerpc64/multiarch/ifunc-impl-list.c
-+++ glibc-2.41/sysdeps/powerpc/powerpc64/multiarch/ifunc-impl-list.c
+--- glibc-2.40.orig/sysdeps/powerpc/powerpc64/multiarch/ifunc-impl-list.c
+++ glibc-2.40/sysdeps/powerpc/powerpc64/multiarch/ifunc-impl-list.c
@@ -164,9 +164,6 @@ __libc_ifunc_impl_list (const char *name
   /* Support sysdeps/powerpc/powerpc64/multiarch/strncmp.c.  */
   IFUNC_IMPL (i, name, strncmp,
@@ -552,13 +552,13 @@ Index: glibc-2.41/sysdeps/powerpc/powerpc64/multiarch/ifunc-impl-list.c
 			      hwcap2 & PPC_FEATURE2_ARCH_3_00
 			      && hwcap & PPC_FEATURE_HAS_ALTIVEC,
 			      __strcmp_power9)
-Index: glibc-2.41/sysdeps/powerpc/powerpc64/multiarch/strcmp-power10.S
+Index: glibc-2.40/sysdeps/powerpc/powerpc64/multiarch/strcmp-power10.S
 ===================================================================
--- glibc-2.41.orig/sysdeps/powerpc/powerpc64/multiarch/strcmp-power10.S
+--- glibc-2.40.orig/sysdeps/powerpc/powerpc64/multiarch/strcmp-power10.S
 +++ /dev/null
@@ -1,26 +0,0 @@
 -/* Optimized strcmp implementation for POWER10/PPC64.
-   Copyright (C) 2021-2025 Free Software Foundation, Inc.
+-   Copyright (C) 2021-2024 Free Software Foundation, Inc.
 -   This file is part of the GNU C Library.
 -
 -   The GNU C Library is free software; you can redistribute it and/or
@@ -583,10 +583,10 @@ Index: glibc-2.41/sysdeps/powerpc/powerpc64/multiarch/strcmp-power10.S
 -
 -#include <sysdeps/powerpc/powerpc64/le/power10/strcmp.S>
 -#endif /* __LITTLE_ENDIAN__ && IS_IN (libc) */
-Index: glibc-2.41/sysdeps/powerpc/powerpc64/multiarch/strcmp.c
+Index: glibc-2.40/sysdeps/powerpc/powerpc64/multiarch/strcmp.c
 ===================================================================
--- glibc-2.41.orig/sysdeps/powerpc/powerpc64/multiarch/strcmp.c
-+++ glibc-2.41/sysdeps/powerpc/powerpc64/multiarch/strcmp.c
+--- glibc-2.40.orig/sysdeps/powerpc/powerpc64/multiarch/strcmp.c
+++ glibc-2.40/sysdeps/powerpc/powerpc64/multiarch/strcmp.c
@@ -29,16 +29,12 @@ extern __typeof (strcmp) __strcmp_power7
 extern __typeof (strcmp) __strcmp_power8 attribute_hidden;
 # ifdef __LITTLE_ENDIAN__
@@ -604,12 +604,12 @@ Index: glibc-2.41/sysdeps/powerpc/powerpc64/multiarch/strcmp.c
 			(hwcap2 & PPC_FEATURE2_ARCH_3_00
 			 && hwcap & PPC_FEATURE_HAS_ALTIVEC)
 			? __strcmp_power9 :
-Index: glibc-2.41/sysdeps/powerpc/powerpc64/multiarch/strncmp-power10.S
+Index: glibc-2.40/sysdeps/powerpc/powerpc64/multiarch/strncmp-power10.S
 ===================================================================
--- glibc-2.41.orig/sysdeps/powerpc/powerpc64/multiarch/strncmp-power10.S
+--- glibc-2.40.orig/sysdeps/powerpc/powerpc64/multiarch/strncmp-power10.S
 +++ /dev/null
@@ -1,25 +0,0 @@
-/* Copyright (C) 2024-2025 Free Software Foundation, Inc.
+-/* Copyright (C) 2024 Free Software Foundation, Inc.
 -   This file is part of the GNU C Library.
 -
 -   The GNU C Library is free software; you can redistribute it and/or
@@ -634,10 +634,10 @@ Index: glibc-2.41/sysdeps/powerpc/powerpc64/multiarch/strncmp-power10.S
 -
 -#include <sysdeps/powerpc/powerpc64/le/power10/strncmp.S>
 -#endif
-Index: glibc-2.41/sysdeps/powerpc/powerpc64/multiarch/strncmp.c
+Index: glibc-2.40/sysdeps/powerpc/powerpc64/multiarch/strncmp.c
 ===================================================================
--- glibc-2.41.orig/sysdeps/powerpc/powerpc64/multiarch/strncmp.c
-+++ glibc-2.41/sysdeps/powerpc/powerpc64/multiarch/strncmp.c
+--- glibc-2.40.orig/sysdeps/powerpc/powerpc64/multiarch/strncmp.c
+++ glibc-2.40/sysdeps/powerpc/powerpc64/multiarch/strncmp.c
@@ -29,7 +29,6 @@ extern __typeof (strncmp) __strncmp_ppc
 extern __typeof (strncmp) __strncmp_power8 attribute_hidden;
 # ifdef __LITTLE_ENDIAN__
--- a/pthread-wakeup.patch
+++ b/pthread-wakeup.patch
@@ -0,0 +1,650 @@
+diff --git c/nptl/pthread_cond_broadcast.c w/nptl/pthread_cond_broadcast.c
+index 7409958394..f5793e715f 100644
+--- c/nptl/pthread_cond_broadcast.c
+++ w/nptl/pthread_cond_broadcast.c
+@@ -57,10 +57,10 @@ ___pthread_cond_broadcast (pthread_cond_t *cond)
+     {
+       /* Add as many signals as the remaining size of the group.  */
+       atomic_fetch_add_relaxed (cond->__data.__g_signals + g1,
+-				cond->__data.__g_size[g1] << 1);
+				cond->__data.__g_size[g1]);
+       cond->__data.__g_size[g1] = 0;
+ 
+-      /* We need to wake G1 waiters before we quiesce G1 below.  */
+      /* We need to wake G1 waiters before we switch G1 below.  */
+       /* TODO Only set it if there are indeed futex waiters.  We could
+ 	 also try to move this out of the critical section in cases when
+ 	 G2 is empty (and we don't need to quiesce).  */
+@@ -69,11 +69,11 @@ ___pthread_cond_broadcast (pthread_cond_t *cond)
+ 
+   /* G1 is complete.  Step (2) is next unless there are no waiters in G2, in
+      which case we can stop.  */
+-  if (__condvar_quiesce_and_switch_g1 (cond, wseq, &g1, private))
+  if (__condvar_switch_g1 (cond, wseq, &g1, private))
+     {
+       /* Step (3): Send signals to all waiters in the old G2 / new G1.  */
+       atomic_fetch_add_relaxed (cond->__data.__g_signals + g1,
+-				cond->__data.__g_size[g1] << 1);
+				cond->__data.__g_size[g1]);
+       cond->__data.__g_size[g1] = 0;
+       /* TODO Only set it if there are indeed futex waiters.  */
+       do_futex_wake = true;
+diff --git c/nptl/pthread_cond_common.c w/nptl/pthread_cond_common.c
+index 7440bb18e6..99640968f1 100644
+--- c/nptl/pthread_cond_common.c
+++ w/nptl/pthread_cond_common.c
+@@ -189,19 +189,17 @@ __condvar_get_private (int flags)
+     return FUTEX_SHARED;
+ }
+ 
+-/* This closes G1 (whose index is in G1INDEX), waits for all futex waiters to
+-   leave G1, converts G1 into a fresh G2, and then switches group roles so that
+-   the former G2 becomes the new G1 ending at the current __wseq value when we
+-   eventually make the switch (WSEQ is just an observation of __wseq by the
+-   signaler).
+/* This closes G1 (whose index is in G1INDEX), converts G1 into a fresh G2,
+   and then switches group roles so that the former G2 becomes the new G1
+   ending at the current __wseq value when we eventually make the switch
+   (WSEQ is just an observation of __wseq by the signaler).
+    If G2 is empty, it will not switch groups because then it would create an
+    empty G1 which would require switching groups again on the next signal.
+    Returns false iff groups were not switched because G2 was empty.  */
+ static bool __attribute__ ((unused))
+-__condvar_quiesce_and_switch_g1 (pthread_cond_t *cond, uint64_t wseq,
+__condvar_switch_g1 (pthread_cond_t *cond, uint64_t wseq,
+     unsigned int *g1index, int private)
+ {
+-  const unsigned int maxspin = 0;
+   unsigned int g1 = *g1index;
+ 
+   /* If there is no waiter in G2, we don't do anything.  The expression may
+@@ -210,96 +208,23 @@ __condvar_quiesce_and_switch_g1 (pthread_cond_t *cond, uint64_t wseq,
+      behavior.
+      Note that this works correctly for a zero-initialized condvar too.  */
+   unsigned int old_orig_size = __condvar_get_orig_size (cond);
+-  uint64_t old_g1_start = __condvar_load_g1_start_relaxed (cond) >> 1;
+-  if (((unsigned) (wseq - old_g1_start - old_orig_size)
+-	  + cond->__data.__g_size[g1 ^ 1]) == 0)
+  uint64_t old_g1_start = __condvar_load_g1_start_relaxed (cond);
+  uint64_t new_g1_start = old_g1_start + old_orig_size;
+  if (((unsigned) (wseq - new_g1_start) + cond->__data.__g_size[g1 ^ 1]) == 0)
+ 	return false;
+ 
+-  /* Now try to close and quiesce G1.  We have to consider the following kinds
+-     of waiters:
+  /* We have to consider the following kinds of waiters:
+      * Waiters from less recent groups than G1 are not affected because
+        nothing will change for them apart from __g1_start getting larger.
+      * New waiters arriving concurrently with the group switching will all go
+        into G2 until we atomically make the switch.  Waiters existing in G2
+        are not affected.
+-     * Waiters in G1 will be closed out immediately by setting a flag in
+-       __g_signals, which will prevent waiters from blocking using a futex on
+-       __g_signals and also notifies them that the group is closed.  As a
+-       result, they will eventually remove their group reference, allowing us
+-       to close switch group roles.  */
+     * Waiters in G1 have already received a signal and been woken.  */
+ 
+-  /* First, set the closed flag on __g_signals.  This tells waiters that are
+-     about to wait that they shouldn't do that anymore.  This basically
+-     serves as an advance notification of the upcoming change to __g1_start;
+-     waiters interpret it as if __g1_start was larger than their waiter
+-     sequence position.  This allows us to change __g1_start after waiting
+-     for all existing waiters with group references to leave, which in turn
+-     makes recovery after stealing a signal simpler because it then can be
+-     skipped if __g1_start indicates that the group is closed (otherwise,
+-     we would have to recover always because waiters don't know how big their
+-     groups are).  Relaxed MO is fine.  */
+-  atomic_fetch_or_relaxed (cond->__data.__g_signals + g1, 1);
+-
+-  /* Wait until there are no group references anymore.  The fetch-or operation
+-     injects us into the modification order of __g_refs; release MO ensures
+-     that waiters incrementing __g_refs after our fetch-or see the previous
+-     changes to __g_signals and to __g1_start that had to happen before we can
+-     switch this G1 and alias with an older group (we have two groups, so
+-     aliasing requires switching group roles twice).  Note that nobody else
+-     can have set the wake-request flag, so we do not have to act upon it.
+-
+-     Also note that it is harmless if older waiters or waiters from this G1
+-     get a group reference after we have quiesced the group because it will
+-     remain closed for them either because of the closed flag in __g_signals
+-     or the later update to __g1_start.  New waiters will never arrive here
+-     but instead continue to go into the still current G2.  */
+-  unsigned r = atomic_fetch_or_release (cond->__data.__g_refs + g1, 0);
+-  while ((r >> 1) > 0)
+-    {
+-      for (unsigned int spin = maxspin; ((r >> 1) > 0) && (spin > 0); spin--)
+-	{
+-	  /* TODO Back off.  */
+-	  r = atomic_load_relaxed (cond->__data.__g_refs + g1);
+-	}
+-      if ((r >> 1) > 0)
+-	{
+-	  /* There is still a waiter after spinning.  Set the wake-request
+-	     flag and block.  Relaxed MO is fine because this is just about
+-	     this futex word.
+-
+-	     Update r to include the set wake-request flag so that the upcoming
+-	     futex_wait only blocks if the flag is still set (otherwise, we'd
+-	     violate the basic client-side futex protocol).  */
+-	  r = atomic_fetch_or_relaxed (cond->__data.__g_refs + g1, 1) | 1;
+-
+-	  if ((r >> 1) > 0)
+-	    futex_wait_simple (cond->__data.__g_refs + g1, r, private);
+-	  /* Reload here so we eventually see the most recent value even if we
+-	     do not spin.   */
+-	  r = atomic_load_relaxed (cond->__data.__g_refs + g1);
+-	}
+-    }
+-  /* Acquire MO so that we synchronize with the release operation that waiters
+-     use to decrement __g_refs and thus happen after the waiters we waited
+-     for.  */
+-  atomic_thread_fence_acquire ();
+-
+-  /* Update __g1_start, which finishes closing this group.  The value we add
+-     will never be negative because old_orig_size can only be zero when we
+-     switch groups the first time after a condvar was initialized, in which
+-     case G1 will be at index 1 and we will add a value of 1.  See above for
+-     why this takes place after waiting for quiescence of the group.
+-     Relaxed MO is fine because the change comes with no additional
+-     constraints that others would have to observe.  */
+-  __condvar_add_g1_start_relaxed (cond,
+-      (old_orig_size << 1) + (g1 == 1 ? 1 : - 1));
+-
+-  /* Now reopen the group, thus enabling waiters to again block using the
+-     futex controlled by __g_signals.  Release MO so that observers that see
+-     no signals (and thus can block) also see the write __g1_start and thus
+-     that this is now a new group (see __pthread_cond_wait_common for the
+-     matching acquire MO loads).  */
+-  atomic_store_release (cond->__data.__g_signals + g1, 0);
+  /* Update __g1_start, which closes this group.  Relaxed MO is fine because
+     the change comes with no additional constraints that others would have
+     to observe.  */
+  __condvar_add_g1_start_relaxed (cond, old_orig_size);
+ 
+   /* At this point, the old G1 is now a valid new G2 (but not in use yet).
+      No old waiter can neither grab a signal nor acquire a reference without
+@@ -311,9 +236,13 @@ __condvar_quiesce_and_switch_g1 (pthread_cond_t *cond, uint64_t wseq,
+   g1 ^= 1;
+   *g1index ^= 1;
+ 
+  /* Now advance the new G1 g_signals to the new g1_start, giving it
+     an effective signal count of 0 to start.  */
+  atomic_store_release (cond->__data.__g_signals + g1, (unsigned)new_g1_start);
+
+   /* These values are just observed by signalers, and thus protected by the
+      lock.  */
+-  unsigned int orig_size = wseq - (old_g1_start + old_orig_size);
+  unsigned int orig_size = wseq - new_g1_start;
+   __condvar_set_orig_size (cond, orig_size);
+   /* Use and addition to not loose track of cancellations in what was
+      previously G2.  */
+diff --git c/nptl/pthread_cond_signal.c w/nptl/pthread_cond_signal.c
+index 9ac4bd9f75..bdc1e82466 100644
+--- c/nptl/pthread_cond_signal.c
+++ w/nptl/pthread_cond_signal.c
+@@ -69,19 +69,18 @@ ___pthread_cond_signal (pthread_cond_t *cond)
+   bool do_futex_wake = false;
+ 
+   /* If G1 is still receiving signals, we put the signal there.  If not, we
+-     check if G2 has waiters, and if so, quiesce and switch G1 to the former
+-     G2; if this results in a new G1 with waiters (G2 might have cancellations
+-     already, see __condvar_quiesce_and_switch_g1), we put the signal in the
+-     new G1.  */
+     check if G2 has waiters, and if so, switch G1 to the former G2; if this
+     results in a new G1 with waiters (G2 might have cancellations already,
+     see __condvar_switch_g1), we put the signal in the new G1. */
+   if ((cond->__data.__g_size[g1] != 0)
+-      || __condvar_quiesce_and_switch_g1 (cond, wseq, &g1, private))
+      || __condvar_switch_g1 (cond, wseq, &g1, private))
+     {
+       /* Add a signal.  Relaxed MO is fine because signaling does not need to
+-	 establish a happens-before relation (see above).  We do not mask the
+-	 release-MO store when initializing a group in
+-	 __condvar_quiesce_and_switch_g1 because we use an atomic
+-	 read-modify-write and thus extend that store's release sequence.  */
+-      atomic_fetch_add_relaxed (cond->__data.__g_signals + g1, 2);
+         establish a happens-before relation (see above).  We do not mask the
+         release-MO store when initializing a group in __condvar_switch_g1
+         because we use an atomic read-modify-write and thus extend that
+         store's release sequence.  */
+      atomic_fetch_add_relaxed (cond->__data.__g_signals + g1, 1);
+       cond->__data.__g_size[g1]--;
+       /* TODO Only set it if there are indeed futex waiters.  */
+       do_futex_wake = true;
+diff --git c/nptl/pthread_cond_wait.c w/nptl/pthread_cond_wait.c
+index 806c432d13..d919b3622a 100644
+--- c/nptl/pthread_cond_wait.c
+++ w/nptl/pthread_cond_wait.c
+@@ -84,7 +84,7 @@ __condvar_cancel_waiting (pthread_cond_t *cond, uint64_t seq, unsigned int g,
+      not hold a reference on the group.  */
+   __condvar_acquire_lock (cond, private);
+ 
+-  uint64_t g1_start = __condvar_load_g1_start_relaxed (cond) >> 1;
+  uint64_t g1_start = __condvar_load_g1_start_relaxed (cond);
+   if (g1_start > seq)
+     {
+       /* Our group is closed, so someone provided enough signals for it.
+@@ -143,23 +143,6 @@ __condvar_cancel_waiting (pthread_cond_t *cond, uint64_t seq, unsigned int g,
+     }
+ }
+ 
+-/* Wake up any signalers that might be waiting.  */
+-static void
+-__condvar_dec_grefs (pthread_cond_t *cond, unsigned int g, int private)
+-{
+-  /* Release MO to synchronize-with the acquire load in
+-     __condvar_quiesce_and_switch_g1.  */
+-  if (atomic_fetch_add_release (cond->__data.__g_refs + g, -2) == 3)
+-    {
+-      /* Clear the wake-up request flag before waking up.  We do not need more
+-	 than relaxed MO and it doesn't matter if we apply this for an aliased
+-	 group because we wake all futex waiters right after clearing the
+-	 flag.  */
+-      atomic_fetch_and_relaxed (cond->__data.__g_refs + g, ~(unsigned int) 1);
+-      futex_wake (cond->__data.__g_refs + g, INT_MAX, private);
+-    }
+-}
+-
+ /* Clean-up for cancellation of waiters waiting for normal signals.  We cancel
+    our registration as a waiter, confirm we have woken up, and re-acquire the
+    mutex.  */
+@@ -171,8 +154,6 @@ __condvar_cleanup_waiting (void *arg)
+   pthread_cond_t *cond = cbuffer->cond;
+   unsigned g = cbuffer->wseq & 1;
+ 
+-  __condvar_dec_grefs (cond, g, cbuffer->private);
+-
+   __condvar_cancel_waiting (cond, cbuffer->wseq >> 1, g, cbuffer->private);
+   /* FIXME With the current cancellation implementation, it is possible that
+      a thread is cancelled after it has returned from a syscall.  This could
+@@ -238,9 +219,7 @@ __condvar_cleanup_waiting (void *arg)
+    signaled), and a reference count.
+ 
+    The group reference count is used to maintain the number of waiters that
+-   are using the group's futex.  Before a group can change its role, the
+-   reference count must show that no waiters are using the futex anymore; this
+-   prevents ABA issues on the futex word.
+   are using the group's futex.
+ 
+    To represent which intervals in the waiter sequence the groups cover (and
+    thus also which group slot contains G1 or G2), we use a 64b counter to
+@@ -251,7 +230,7 @@ __condvar_cleanup_waiting (void *arg)
+    figure out whether they are in a group that has already been completely
+    signaled (i.e., if the current G1 starts at a later position that the
+    waiter's position).  Waiters cannot determine whether they are currently
+-   in G2 or G1 -- but they do not have too because all they are interested in
+   in G2 or G1 -- but they do not have to because all they are interested in
+    is whether there are available signals, and they always start in G2 (whose
+    group slot they know because of the bit in the waiter sequence.  Signalers
+    will simply fill the right group until it is completely signaled and can
+@@ -280,7 +259,6 @@ __condvar_cleanup_waiting (void *arg)
+      * Waiters fetch-add while having acquire the mutex associated with the
+        condvar.  Signalers load it and fetch-xor it concurrently.
+    __g1_start: Starting position of G1 (inclusive)
+-     * LSB is index of current G2.
+      * Modified by signalers while having acquired the condvar-internal lock
+        and observed concurrently by waiters.
+    __g1_orig_size: Initial size of G1
+@@ -300,11 +278,10 @@ __condvar_cleanup_waiting (void *arg)
+        last reference.
+      * Reference count used by waiters concurrently with signalers that have
+        acquired the condvar-internal lock.
+-   __g_signals: The number of signals that can still be consumed.
+   __g_signals: The number of signals that can still be consumed, relative to
+     the current g1_start.  (i.e. g1_start with the signal count added)
+      * Used as a futex word by waiters.  Used concurrently by waiters and
+        signalers.
+-     * LSB is true iff this group has been completely signaled (i.e., it is
+-       closed).
+    __g_size: Waiters remaining in this group (i.e., which have not been
+      signaled yet.
+      * Accessed by signalers and waiters that cancel waiting (both do so only
+@@ -328,27 +305,6 @@ __condvar_cleanup_waiting (void *arg)
+    sufficient because if a waiter can see a sufficiently large value, it could
+    have also consume a signal in the waiters group.
+ 
+-   Waiters try to grab a signal from __g_signals without holding a reference
+-   count, which can lead to stealing a signal from a more recent group after
+-   their own group was already closed.  They cannot always detect whether they
+-   in fact did because they do not know when they stole, but they can
+-   conservatively add a signal back to the group they stole from; if they
+-   did so unnecessarily, all that happens is a spurious wake-up.  To make this
+-   even less likely, __g1_start contains the index of the current g2 too,
+-   which allows waiters to check if there aliasing on the group slots; if
+-   there wasn't, they didn't steal from the current G1, which means that the
+-   G1 they stole from must have been already closed and they do not need to
+-   fix anything.
+-
+-   It is essential that the last field in pthread_cond_t is __g_signals[1]:
+-   The previous condvar used a pointer-sized field in pthread_cond_t, so a
+-   PTHREAD_COND_INITIALIZER from that condvar implementation might only
+-   initialize 4 bytes to zero instead of the 8 bytes we need (i.e., 44 bytes
+-   in total instead of the 48 we need).  __g_signals[1] is not accessed before
+-   the first group switch (G2 starts at index 0), which will set its value to
+-   zero after a harmless fetch-or whose return value is ignored.  This
+-   effectively completes initialization.
+-
+ 
+    Limitations:
+    * This condvar isn't designed to allow for more than
+@@ -379,7 +335,6 @@ static __always_inline int
+ __pthread_cond_wait_common (pthread_cond_t *cond, pthread_mutex_t *mutex,
+     clockid_t clockid, const struct __timespec64 *abstime)
+ {
+-  const int maxspin = 0;
+   int err;
+   int result = 0;
+ 
+@@ -396,8 +351,7 @@ __pthread_cond_wait_common (pthread_cond_t *cond, pthread_mutex_t *mutex,
+      because we do not need to establish any happens-before relation with
+      signalers (see __pthread_cond_signal); modification order alone
+      establishes a total order of waiters/signals.  We do need acquire MO
+-     to synchronize with group reinitialization in
+-     __condvar_quiesce_and_switch_g1.  */
+     to synchronize with group reinitialization in __condvar_switch_g1.  */
+   uint64_t wseq = __condvar_fetch_add_wseq_acquire (cond, 2);
+   /* Find our group's index.  We always go into what was G2 when we acquired
+      our position.  */
+@@ -424,178 +378,64 @@ __pthread_cond_wait_common (pthread_cond_t *cond, pthread_mutex_t *mutex,
+       return err;
+     }
+ 
+-  /* Now wait until a signal is available in our group or it is closed.
+-     Acquire MO so that if we observe a value of zero written after group
+-     switching in __condvar_quiesce_and_switch_g1, we synchronize with that
+-     store and will see the prior update of __g1_start done while switching
+-     groups too.  */
+-  unsigned int signals = atomic_load_acquire (cond->__data.__g_signals + g);
+ 
+-  do
+  while (1)
+     {
+-      while (1)
+-	{
+-	  /* Spin-wait first.
+-	     Note that spinning first without checking whether a timeout
+-	     passed might lead to what looks like a spurious wake-up even
+-	     though we should return ETIMEDOUT (e.g., if the caller provides
+-	     an absolute timeout that is clearly in the past).  However,
+-	     (1) spurious wake-ups are allowed, (2) it seems unlikely that a
+-	     user will (ab)use pthread_cond_wait as a check for whether a
+-	     point in time is in the past, and (3) spinning first without
+-	     having to compare against the current time seems to be the right
+-	     choice from a performance perspective for most use cases.  */
+-	  unsigned int spin = maxspin;
+-	  while (signals == 0 && spin > 0)
+-	    {
+-	      /* Check that we are not spinning on a group that's already
+-		 closed.  */
+-	      if (seq < (__condvar_load_g1_start_relaxed (cond) >> 1))
+-		goto done;
+-
+-	      /* TODO Back off.  */
+-
+-	      /* Reload signals.  See above for MO.  */
+-	      signals = atomic_load_acquire (cond->__data.__g_signals + g);
+-	      spin--;
+-	    }
+-
+-	  /* If our group will be closed as indicated by the flag on signals,
+-	     don't bother grabbing a signal.  */
+-	  if (signals & 1)
+-	    goto done;
+-
+-	  /* If there is an available signal, don't block.  */
+-	  if (signals != 0)
+-	    break;
+-
+-	  /* No signals available after spinning, so prepare to block.
+-	     We first acquire a group reference and use acquire MO for that so
+-	     that we synchronize with the dummy read-modify-write in
+-	     __condvar_quiesce_and_switch_g1 if we read from that.  In turn,
+-	     in this case this will make us see the closed flag on __g_signals
+-	     that designates a concurrent attempt to reuse the group's slot.
+-	     We use acquire MO for the __g_signals check to make the
+-	     __g1_start check work (see spinning above).
+-	     Note that the group reference acquisition will not mask the
+-	     release MO when decrementing the reference count because we use
+-	     an atomic read-modify-write operation and thus extend the release
+-	     sequence.  */
+-	  atomic_fetch_add_acquire (cond->__data.__g_refs + g, 2);
+-	  if (((atomic_load_acquire (cond->__data.__g_signals + g) & 1) != 0)
+-	      || (seq < (__condvar_load_g1_start_relaxed (cond) >> 1)))
+-	    {
+-	      /* Our group is closed.  Wake up any signalers that might be
+-		 waiting.  */
+-	      __condvar_dec_grefs (cond, g, private);
+-	      goto done;
+-	    }
+-
+-	  // Now block.
+-	  struct _pthread_cleanup_buffer buffer;
+-	  struct _condvar_cleanup_buffer cbuffer;
+-	  cbuffer.wseq = wseq;
+-	  cbuffer.cond = cond;
+-	  cbuffer.mutex = mutex;
+-	  cbuffer.private = private;
+-	  __pthread_cleanup_push (&buffer, __condvar_cleanup_waiting, &cbuffer);
+-
+-	  err = __futex_abstimed_wait_cancelable64 (
+-	    cond->__data.__g_signals + g, 0, clockid, abstime, private);
+-
+-	  __pthread_cleanup_pop (&buffer, 0);
+-
+-	  if (__glibc_unlikely (err == ETIMEDOUT || err == EOVERFLOW))
+-	    {
+-	      __condvar_dec_grefs (cond, g, private);
+-	      /* If we timed out, we effectively cancel waiting.  Note that
+-		 we have decremented __g_refs before cancellation, so that a
+-		 deadlock between waiting for quiescence of our group in
+-		 __condvar_quiesce_and_switch_g1 and us trying to acquire
+-		 the lock during cancellation is not possible.  */
+-	      __condvar_cancel_waiting (cond, seq, g, private);
+-	      result = err;
+-	      goto done;
+-	    }
+-	  else
+-	    __condvar_dec_grefs (cond, g, private);
+-
+-	  /* Reload signals.  See above for MO.  */
+-	  signals = atomic_load_acquire (cond->__data.__g_signals + g);
+      /* Now wait until a signal is available in our group or it is closed.
+         Acquire MO so that if we observe (signals == lowseq) after group
+         switching in __condvar_switch_g1, we synchronize with that store and
+         will see the prior update of __g1_start done while switching groups
+         too.  */
+      unsigned int signals = atomic_load_acquire (cond->__data.__g_signals + g);
+      uint64_t g1_start = __condvar_load_g1_start_relaxed (cond);
+
+      if (seq < g1_start)
+        {
+          /* If the group is closed already,
+             then this waiter originally had enough extra signals to
+             consume, up until the time its group was closed.  */
+           break;
+        }
+
+      /* If there is an available signal, don't block.
+         If __g1_start has advanced at all, then we must be in G1
+         by now, perhaps in the process of switching back to an older
+         G2, but in either case we're allowed to consume the available
+         signal and should not block anymore.  */
+      if ((int)(signals - (unsigned int)g1_start) > 0)
+        {
+	  /* Try to grab a signal.  See above for MO.  (if we do another loop
+	     iteration we need to see the correct value of g1_start)  */
+	    if (atomic_compare_exchange_weak_acquire (
+			cond->__data.__g_signals + g,
+			&signals, signals - 1))
+	      break;
+	    else
+	      continue;
+ 	}
+ 
+      // Now block.
+      struct _pthread_cleanup_buffer buffer;
+      struct _condvar_cleanup_buffer cbuffer;
+      cbuffer.wseq = wseq;
+      cbuffer.cond = cond;
+      cbuffer.mutex = mutex;
+      cbuffer.private = private;
+      __pthread_cleanup_push (&buffer, __condvar_cleanup_waiting, &cbuffer);
+
+      err = __futex_abstimed_wait_cancelable64 (
+        cond->__data.__g_signals + g, signals, clockid, abstime, private);
+
+      __pthread_cleanup_pop (&buffer, 0);
+
+      if (__glibc_unlikely (err == ETIMEDOUT || err == EOVERFLOW))
+        {
+          /* If we timed out, we effectively cancel waiting.  */
+          __condvar_cancel_waiting (cond, seq, g, private);
+          result = err;
+          break;
+        }
+     }
+-  /* Try to grab a signal.  Use acquire MO so that we see an up-to-date value
+-     of __g1_start below (see spinning above for a similar case).  In
+-     particular, if we steal from a more recent group, we will also see a
+-     more recent __g1_start below.  */
+-  while (!atomic_compare_exchange_weak_acquire (cond->__data.__g_signals + g,
+-						&signals, signals - 2));
+-
+-  /* We consumed a signal but we could have consumed from a more recent group
+-     that aliased with ours due to being in the same group slot.  If this
+-     might be the case our group must be closed as visible through
+-     __g1_start.  */
+-  uint64_t g1_start = __condvar_load_g1_start_relaxed (cond);
+-  if (seq < (g1_start >> 1))
+-    {
+-      /* We potentially stole a signal from a more recent group but we do not
+-	 know which group we really consumed from.
+-	 We do not care about groups older than current G1 because they are
+-	 closed; we could have stolen from these, but then we just add a
+-	 spurious wake-up for the current groups.
+-	 We will never steal a signal from current G2 that was really intended
+-	 for G2 because G2 never receives signals (until it becomes G1).  We
+-	 could have stolen a signal from G2 that was conservatively added by a
+-	 previous waiter that also thought it stole a signal -- but given that
+-	 that signal was added unnecessarily, it's not a problem if we steal
+-	 it.
+-	 Thus, the remaining case is that we could have stolen from the current
+-	 G1, where "current" means the __g1_start value we observed.  However,
+-	 if the current G1 does not have the same slot index as we do, we did
+-	 not steal from it and do not need to undo that.  This is the reason
+-	 for putting a bit with G2's index into__g1_start as well.  */
+-      if (((g1_start & 1) ^ 1) == g)
+-	{
+-	  /* We have to conservatively undo our potential mistake of stealing
+-	     a signal.  We can stop trying to do that when the current G1
+-	     changes because other spinning waiters will notice this too and
+-	     __condvar_quiesce_and_switch_g1 has checked that there are no
+-	     futex waiters anymore before switching G1.
+-	     Relaxed MO is fine for the __g1_start load because we need to
+-	     merely be able to observe this fact and not have to observe
+-	     something else as well.
+-	     ??? Would it help to spin for a little while to see whether the
+-	     current G1 gets closed?  This might be worthwhile if the group is
+-	     small or close to being closed.  */
+-	  unsigned int s = atomic_load_relaxed (cond->__data.__g_signals + g);
+-	  while (__condvar_load_g1_start_relaxed (cond) == g1_start)
+-	    {
+-	      /* Try to add a signal.  We don't need to acquire the lock
+-		 because at worst we can cause a spurious wake-up.  If the
+-		 group is in the process of being closed (LSB is true), this
+-		 has an effect similar to us adding a signal.  */
+-	      if (((s & 1) != 0)
+-		  || atomic_compare_exchange_weak_relaxed
+-		       (cond->__data.__g_signals + g, &s, s + 2))
+-		{
+-		  /* If we added a signal, we also need to add a wake-up on
+-		     the futex.  We also need to do that if we skipped adding
+-		     a signal because the group is being closed because
+-		     while __condvar_quiesce_and_switch_g1 could have closed
+-		     the group, it might still be waiting for futex waiters to
+-		     leave (and one of those waiters might be the one we stole
+-		     the signal from, which cause it to block using the
+-		     futex).  */
+-		  futex_wake (cond->__data.__g_signals + g, 1, private);
+-		  break;
+-		}
+-	      /* TODO Back off.  */
+-	    }
+-	}
+-    }
+-
+- done:
+ 
+   /* Confirm that we have been woken.  We do that before acquiring the mutex
+      to allow for execution of pthread_cond_destroy while having acquired the
+diff --git c/nptl/tst-cond22.c w/nptl/tst-cond22.c
+index 1336e9c79d..bdcb45c536 100644
+--- c/nptl/tst-cond22.c
+++ w/nptl/tst-cond22.c
+@@ -106,13 +106,13 @@ do_test (void)
+       status = 1;
+     }
+ 
+-  printf ("cond = { 0x%x:%x, 0x%x:%x, %u/%u/%u, %u/%u/%u, %u, %u }\n",
+  printf ("cond = { 0x%x:%x, 0x%x:%x, %u/%u, %u/%u, %u, %u }\n",
+ 	  c.__data.__wseq.__value32.__high,
+ 	  c.__data.__wseq.__value32.__low,
+ 	  c.__data.__g1_start.__value32.__high,
+ 	  c.__data.__g1_start.__value32.__low,
+-	  c.__data.__g_signals[0], c.__data.__g_refs[0], c.__data.__g_size[0],
+-	  c.__data.__g_signals[1], c.__data.__g_refs[1], c.__data.__g_size[1],
+	  c.__data.__g_signals[0], c.__data.__g_size[0],
+	  c.__data.__g_signals[1], c.__data.__g_size[1],
+ 	  c.__data.__g1_orig_size, c.__data.__wrefs);
+ 
+   if (pthread_create (&th, NULL, tf, (void *) 1l) != 0)
+@@ -152,13 +152,13 @@ do_test (void)
+       status = 1;
+     }
+ 
+-  printf ("cond = { 0x%x:%x, 0x%x:%x, %u/%u/%u, %u/%u/%u, %u, %u }\n",
+  printf ("cond = { 0x%x:%x, 0x%x:%x, %u/%u, %u/%u, %u, %u }\n",
+ 	  c.__data.__wseq.__value32.__high,
+ 	  c.__data.__wseq.__value32.__low,
+ 	  c.__data.__g1_start.__value32.__high,
+ 	  c.__data.__g1_start.__value32.__low,
+-	  c.__data.__g_signals[0], c.__data.__g_refs[0], c.__data.__g_size[0],
+-	  c.__data.__g_signals[1], c.__data.__g_refs[1], c.__data.__g_size[1],
+	  c.__data.__g_signals[0], c.__data.__g_size[0],
+	  c.__data.__g_signals[1], c.__data.__g_size[1],
+ 	  c.__data.__g1_orig_size, c.__data.__wrefs);
+ 
+   return status;
+diff --git c/sysdeps/nptl/bits/thread-shared-types.h w/sysdeps/nptl/bits/thread-shared-types.h
+index 2de6ff9caf..3fe5d4afc0 100644
+--- c/sysdeps/nptl/bits/thread-shared-types.h
+++ w/sysdeps/nptl/bits/thread-shared-types.h
+@@ -95,11 +95,12 @@ struct __pthread_cond_s
+ {
+   __atomic_wide_counter __wseq;
+   __atomic_wide_counter __g1_start;
+-  unsigned int __g_refs[2] __LOCK_ALIGNMENT;
+-  unsigned int __g_size[2];
+  unsigned int __g_size[2] __LOCK_ALIGNMENT;
+   unsigned int __g1_orig_size;
+   unsigned int __wrefs;
+   unsigned int __g_signals[2];
+  unsigned int __unused_initialized_1;
+  unsigned int __unused_initialized_2;
+ };
+ 
+ typedef unsigned int __tss_t;
+diff --git c/sysdeps/nptl/pthread.h w/sysdeps/nptl/pthread.h
+index 7f65483542..476cd0ed54 100644
+--- c/sysdeps/nptl/pthread.h
+++ w/sysdeps/nptl/pthread.h
+@@ -152,7 +152,7 @@ enum
+ 
+ 
+ /* Conditional variable handling.  */
+-#define PTHREAD_COND_INITIALIZER { { {0}, {0}, {0, 0}, {0, 0}, 0, 0, {0, 0} } }
+#define PTHREAD_COND_INITIALIZER { { {0}, {0}, {0, 0}, 0, 0, {0, 0}, 0, 0 } }
+ 
+ 
+ /* Cleanup buffers */
--- a/regcomp-double-free.patch
+++ b/regcomp-double-free.patch
@@ -0,0 +1,240 @@
+From 2eb180377b96771b8368b0915669c8c7b267e739 Mon Sep 17 00:00:00 2001
+From: Florian Weimer <fweimer@redhat.com>
+Date: Mon, 21 Jul 2025 21:43:49 +0200
+Subject: [PATCH] posix: Fix double-free after allocation failure in regcomp
+ (bug 33185)
+
+If a memory allocation failure occurs during bracket expression
+parsing in regcomp, a double-free error may result.
+
+Reported-by: Anastasia Belova <abelova@astralinux.ru>
+Co-authored-by: Paul Eggert <eggert@cs.ucla.edu>
+Reviewed-by: Andreas K. Huettel <dilfridge@gentoo.org>
+(cherry picked from commit 7ea06e994093fa0bcca0d0ee2c1db271d8d7885d)
+---
+ NEWS                             |   1 +
+ posix/Makefile                   |   1 +
+ posix/regcomp.c                  |   4 +-
+ posix/tst-regcomp-bracket-free.c | 176 +++++++++++++++++++++++++++++++
+ 4 files changed, 181 insertions(+), 1 deletion(-)
+ create mode 100644 posix/tst-regcomp-bracket-free.c
+
+diff --git a/posix/Makefile b/posix/Makefile
+index 2c598cd20a..830278a423 100644
+--- a/posix/Makefile
+++ b/posix/Makefile
+@@ -303,6 +303,7 @@ tests := \
+   tst-posix_spawn-setsid \
+   tst-preadwrite \
+   tst-preadwrite64 \
+  tst-regcomp-bracket-free \
+   tst-regcomp-truncated \
+   tst-regex \
+   tst-regex2 \
+diff --git a/posix/regcomp.c b/posix/regcomp.c
+index 5380d3c7b9..6595bb3c0d 100644
+--- a/posix/regcomp.c
+++ b/posix/regcomp.c
+@@ -3384,6 +3384,7 @@ parse_bracket_exp (re_string_t *regexp, re_dfa_t *dfa, re_token_t *token,
+     {
+ #ifdef RE_ENABLE_I18N
+       free_charset (mbcset);
+      mbcset = NULL;
+ #endif
+       /* Build a tree for simple bracket.  */
+       br_token.type = SIMPLE_BRACKET;
+@@ -3399,7 +3400,8 @@ parse_bracket_exp (re_string_t *regexp, re_dfa_t *dfa, re_token_t *token,
+  parse_bracket_exp_free_return:
+   re_free (sbcset);
+ #ifdef RE_ENABLE_I18N
+-  free_charset (mbcset);
+  if (__glibc_likely (mbcset != NULL))
+    free_charset (mbcset);
+ #endif /* RE_ENABLE_I18N */
+   return NULL;
+ }
+diff --git a/posix/tst-regcomp-bracket-free.c b/posix/tst-regcomp-bracket-free.c
+new file mode 100644
+index 0000000000..3c091d8c44
+--- /dev/null
+++ b/posix/tst-regcomp-bracket-free.c
+@@ -0,0 +1,176 @@
+/* Test regcomp bracket parsing with injected allocation failures (bug 33185).
+   Copyright (C) 2025 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+/* This test invokes regcomp multiple times, failing one memory
+   allocation in each call.  The function call should fail with
+   REG_ESPACE (or succeed if it can recover from the allocation
+   failure).  Previously, there was double-free bug.  */
+
+#include <errno.h>
+#include <regex.h>
+#include <stdio.h>
+#include <string.h>
+#include <support/check.h>
+#include <support/namespace.h>
+#include <support/support.h>
+
+/* Data structure allocated via MAP_SHARED, so that writes from the
+   subprocess are visible.  */
+struct shared_data
+{
+  /* Number of tracked allocations performed so far.  */
+  volatile unsigned int allocation_count;
+
+  /* If this number is reached, one allocation fails.  */
+  volatile unsigned int failing_allocation;
+
+  /* The subprocess stores the expected name here.  */
+  char name[100];
+};
+
+/* Allocation count in shared mapping.  */
+static struct shared_data *shared;
+
+/* Returns true if a failure should be injected for this allocation.  */
+static bool
+fail_this_allocation (void)
+{
+  if (shared != NULL)
+    {
+      unsigned int count = shared->allocation_count;
+      shared->allocation_count = count + 1;
+      return count == shared->failing_allocation;
+    }
+  else
+    return false;
+}
+
+/* Failure-injecting wrappers for allocation functions used by glibc.  */
+
+void *
+malloc (size_t size)
+{
+  if (fail_this_allocation ())
+    {
+      errno = ENOMEM;
+      return NULL;
+    }
+  extern __typeof (malloc) __libc_malloc;
+  return __libc_malloc (size);
+}
+
+void *
+calloc (size_t a, size_t b)
+{
+  if (fail_this_allocation ())
+    {
+      errno = ENOMEM;
+      return NULL;
+    }
+  extern __typeof (calloc) __libc_calloc;
+  return __libc_calloc (a, b);
+}
+
+void *
+realloc (void *ptr, size_t size)
+{
+  if (fail_this_allocation ())
+    {
+      errno = ENOMEM;
+      return NULL;
+    }
+  extern __typeof (realloc) __libc_realloc;
+  return __libc_realloc (ptr, size);
+}
+
+/* No-op subprocess to verify that support_isolate_in_subprocess does
+   not perform any heap allocations.  */
+static void
+no_op (void *ignored)
+{
+}
+
+/* Perform a regcomp call in a subprocess.  Used to count its
+   allocations.  */
+static void
+initialize (void *regexp1)
+{
+  const char *regexp = regexp1;
+
+  shared->allocation_count = 0;
+
+  regex_t reg;
+  TEST_COMPARE (regcomp (&reg, regexp, 0), 0);
+}
+
+/* Perform regcomp in a subprocess with fault injection.  */
+static void
+test_in_subprocess (void *regexp1)
+{
+  const char *regexp = regexp1;
+  unsigned int inject_at = shared->failing_allocation;
+
+  regex_t reg;
+  int ret = regcomp (&reg, regexp, 0);
+
+  if (ret != 0)
+    {
+      TEST_COMPARE (ret, REG_ESPACE);
+      printf ("info: allocation %u failure results in return value %d,"
+              " error %s (%d)\n",
+              inject_at, ret, strerrorname_np (errno), errno);
+    }
+}
+
+static int
+do_test (void)
+{
+  char regexp[] = "[:alpha:]";
+
+  shared = support_shared_allocate (sizeof (*shared));
+
+  /* Disable fault injection.  */
+  shared->failing_allocation = ~0U;
+
+  support_isolate_in_subprocess (no_op, NULL);
+  TEST_COMPARE (shared->allocation_count, 0);
+
+  support_isolate_in_subprocess (initialize, regexp);
+
+  /* The number of allocations in the successful case, plus some
+     slack.  Once the number of expected allocations is exceeded,
+     injecting further failures does not make a difference.  */
+  unsigned int maximum_allocation_count = shared->allocation_count;
+  printf ("info: successful call performs %u allocations\n",
+          maximum_allocation_count);
+  maximum_allocation_count += 10;
+
+  for (unsigned int inject_at = 0; inject_at <= maximum_allocation_count;
+       ++inject_at)
+    {
+      shared->allocation_count = 0;
+      shared->failing_allocation = inject_at;
+      support_isolate_in_subprocess (test_in_subprocess, regexp);
+    }
+
+  support_shared_free (shared);
+
+  return 0;
+}
+
+#include <support/test-driver.c>
+-- 
+2.50.1
+
--- a/round-log10p1f.patch
+++ b/round-log10p1f.patch
@@ -1,80 +0,0 @@
-From bdccbfbc52d3f6957768a0b9d5bd7bc4c90f2744 Mon Sep 17 00:00:00 2001
-From: Adhemerval Zanella <adhemerval.zanella@linaro.org>
-Date: Fri, 31 Jan 2025 10:27:39 -0300
-Subject: [PATCH] math: Fix log10p1f internal table value (BZ 32626)
-
-It was copied wrong from CORE-MATH.
-
-(cherry picked from commit c79277a16785c8ae96d821414f4d31d654a0177c)
---
- NEWS                                |  3 ++-
- math/auto-libm-test-in              |  2 ++
- math/auto-libm-test-out-log10p1     | 25 +++++++++++++++++++++++++
- sysdeps/ieee754/flt-32/s_log10p1f.c |  2 +-
- 4 files changed, 30 insertions(+), 2 deletions(-)
-
-diff --git a/math/auto-libm-test-in b/math/auto-libm-test-in
-index 01ba689aa8..c0627dc7eb 100644
--- a/math/auto-libm-test-in
-+++ b/math/auto-libm-test-in
-@@ -7291,6 +7291,8 @@ log10p1 -0x1p-125
- log10p1 -0x1p-1021
- log10p1 -0x1p-16381
- 
-+log10p1 0x1.27f7dap-17
-+
- log10p1 0x7.2a4368p-4
- log10p1 0x6.d3a118p-4
- log10p1 0x5.03f228p+0
-diff --git a/math/auto-libm-test-out-log10p1 b/math/auto-libm-test-out-log10p1
-index 87bdb0bcde..f5ce965720 100644
--- a/math/auto-libm-test-out-log10p1
-+++ b/math/auto-libm-test-out-log10p1
-@@ -1789,6 +1789,31 @@ log10p1 -0x1p-16381
- = log10p1 tonearest binary128 -0x8p-16384 : -0x3.796f62a4dca1c654d56eaabeb4dp-16384 : inexact-ok underflow errno-erange-ok
- = log10p1 towardzero binary128 -0x8p-16384 : -0x3.796f62a4dca1c654d56eaabeb4ccp-16384 : inexact-ok underflow errno-erange-ok
- = log10p1 upward binary128 -0x8p-16384 : -0x3.796f62a4dca1c654d56eaabeb4ccp-16384 : inexact-ok underflow errno-erange-ok
-+log10p1 0x1.27f7dap-17
-+= log10p1 downward binary32 0x9.3fbedp-20 : 0x4.044b5p-20 : inexact-ok
-+= log10p1 tonearest binary32 0x9.3fbedp-20 : 0x4.044b5p-20 : inexact-ok
-+= log10p1 towardzero binary32 0x9.3fbedp-20 : 0x4.044b5p-20 : inexact-ok
-+= log10p1 upward binary32 0x9.3fbedp-20 : 0x4.044b58p-20 : inexact-ok
-+= log10p1 downward binary64 0x9.3fbedp-20 : 0x4.044b5157872ep-20 : inexact-ok
-+= log10p1 tonearest binary64 0x9.3fbedp-20 : 0x4.044b5157872e4p-20 : inexact-ok
-+= log10p1 towardzero binary64 0x9.3fbedp-20 : 0x4.044b5157872ep-20 : inexact-ok
-+= log10p1 upward binary64 0x9.3fbedp-20 : 0x4.044b5157872e4p-20 : inexact-ok
-+= log10p1 downward intel96 0x9.3fbedp-20 : 0x4.044b5157872e2868p-20 : inexact-ok
-+= log10p1 tonearest intel96 0x9.3fbedp-20 : 0x4.044b5157872e2868p-20 : inexact-ok
-+= log10p1 towardzero intel96 0x9.3fbedp-20 : 0x4.044b5157872e2868p-20 : inexact-ok
-+= log10p1 upward intel96 0x9.3fbedp-20 : 0x4.044b5157872e287p-20 : inexact-ok
-+= log10p1 downward m68k96 0x9.3fbedp-20 : 0x4.044b5157872e2868p-20 : inexact-ok
-+= log10p1 tonearest m68k96 0x9.3fbedp-20 : 0x4.044b5157872e2868p-20 : inexact-ok
-+= log10p1 towardzero m68k96 0x9.3fbedp-20 : 0x4.044b5157872e2868p-20 : inexact-ok
-+= log10p1 upward m68k96 0x9.3fbedp-20 : 0x4.044b5157872e287p-20 : inexact-ok
-+= log10p1 downward binary128 0x9.3fbedp-20 : 0x4.044b5157872e2868f5c04287d808p-20 : inexact-ok
-+= log10p1 tonearest binary128 0x9.3fbedp-20 : 0x4.044b5157872e2868f5c04287d80cp-20 : inexact-ok
-+= log10p1 towardzero binary128 0x9.3fbedp-20 : 0x4.044b5157872e2868f5c04287d808p-20 : inexact-ok
-+= log10p1 upward binary128 0x9.3fbedp-20 : 0x4.044b5157872e2868f5c04287d80cp-20 : inexact-ok
-+= log10p1 downward ibm128 0x9.3fbedp-20 : 0x4.044b5157872e2868f5c04287d8p-20 : inexact-ok
-+= log10p1 tonearest ibm128 0x9.3fbedp-20 : 0x4.044b5157872e2868f5c04287d8p-20 : inexact-ok
-+= log10p1 towardzero ibm128 0x9.3fbedp-20 : 0x4.044b5157872e2868f5c04287d8p-20 : inexact-ok
-+= log10p1 upward ibm128 0x9.3fbedp-20 : 0x4.044b5157872e2868f5c04287dap-20 : inexact-ok
- log10p1 0x7.2a4368p-4
- = log10p1 downward binary32 0x7.2a4368p-4 : 0x2.9248dcp-4 : inexact-ok
- = log10p1 tonearest binary32 0x7.2a4368p-4 : 0x2.9248ep-4 : inexact-ok
-diff --git a/sysdeps/ieee754/flt-32/s_log10p1f.c b/sysdeps/ieee754/flt-32/s_log10p1f.c
-index 64deb1eeda..4e11d55d49 100644
--- a/sysdeps/ieee754/flt-32/s_log10p1f.c
-+++ b/sysdeps/ieee754/flt-32/s_log10p1f.c
-@@ -70,7 +70,7 @@ __log10p1f (float x)
-     };
-   static const double tl[] =
-     {
-      0x1.562ec497ef351p-43, 0x1.b9476892ea99cp-8, 0x1.b5e909c959eecp-7,
-+     -0x1.562ec497ef351p-43, 0x1.b9476892ea99cp-8, 0x1.b5e909c959eecp-7,
-       0x1.45f4f59ec84fp-6,   0x1.af5f92cbcf2aap-6, 0x1.0ba01a6069052p-5,
-       0x1.3ed119b99dd41p-5,  0x1.714834298a088p-5, 0x1.a30a9d98309c1p-5,
-       0x1.d41d51266b9d9p-5,  0x1.02428c0f62dfcp-4, 0x1.1a23444eea521p-4,
-- 
-2.48.1
-
--- a/round-sinhf.patch
+++ b/round-sinhf.patch
@@ -1,76 +0,0 @@
-From d85a7719536f4892f2b53d4594e18f6d096c2882 Mon Sep 17 00:00:00 2001
-From: Adhemerval Zanella <adhemerval.zanella@linaro.org>
-Date: Fri, 31 Jan 2025 10:34:32 -0300
-Subject: [PATCH] math: Fix sinhf for some inputs (BZ 32627)
-
-The logic was copied wrong from CORE-MATH.
---
- math/auto-libm-test-in           |  1 +
- math/auto-libm-test-out-sinh     | 25 +++++++++++++++++++++++++
- sysdeps/ieee754/flt-32/e_sinhf.c |  2 +-
- 3 files changed, 27 insertions(+), 1 deletion(-)
-
-diff --git a/math/auto-libm-test-in b/math/auto-libm-test-in
-index c0627dc7eb..5f465b31f1 100644
--- a/math/auto-libm-test-in
-+++ b/math/auto-libm-test-in
-@@ -8300,6 +8300,7 @@ sinh -0x1.3dda8ap+0
- sinh -0x5.ee9218p-4
- sinh -0x1.bcfc98p+0
- sinh -0x6.9bbb6df7c5d08p-4
-+sinh 0x1.250bfep-11
- # the next value generates larger error bounds on x86_64 (ldbl-96)
- sinh 0x2.c5d376167f4052f4p+12
- sinh max
-diff --git a/math/auto-libm-test-out-sinh b/math/auto-libm-test-out-sinh
-index 0b77a77eeb..3924e19d86 100644
--- a/math/auto-libm-test-out-sinh
-+++ b/math/auto-libm-test-out-sinh
-@@ -2115,6 +2115,31 @@ sinh -0x6.9bbb6df7c5d08p-4
- = sinh tonearest ibm128 -0x6.9bbb6df7c5d08p-4 : -0x6.cc3ddf003dcda77f8f9e892e36p-4 : inexact-ok
- = sinh towardzero ibm128 -0x6.9bbb6df7c5d08p-4 : -0x6.cc3ddf003dcda77f8f9e892e36p-4 : inexact-ok
- = sinh upward ibm128 -0x6.9bbb6df7c5d08p-4 : -0x6.cc3ddf003dcda77f8f9e892e36p-4 : inexact-ok
-+sinh 0x1.250bfep-11
-+= sinh downward binary32 0x2.4a17fcp-12 : 0x2.4a17fcp-12 : inexact-ok
-+= sinh tonearest binary32 0x2.4a17fcp-12 : 0x2.4a17fcp-12 : inexact-ok
-+= sinh towardzero binary32 0x2.4a17fcp-12 : 0x2.4a17fcp-12 : inexact-ok
-+= sinh upward binary32 0x2.4a17fcp-12 : 0x2.4a18p-12 : inexact-ok
-+= sinh downward binary64 0x2.4a17fcp-12 : 0x2.4a17fdffffffep-12 : inexact-ok
-+= sinh tonearest binary64 0x2.4a17fcp-12 : 0x2.4a17fep-12 : inexact-ok
-+= sinh towardzero binary64 0x2.4a17fcp-12 : 0x2.4a17fdffffffep-12 : inexact-ok
-+= sinh upward binary64 0x2.4a17fcp-12 : 0x2.4a17fep-12 : inexact-ok
-+= sinh downward intel96 0x2.4a17fcp-12 : 0x2.4a17fdfffffff87cp-12 : inexact-ok
-+= sinh tonearest intel96 0x2.4a17fcp-12 : 0x2.4a17fdfffffff88p-12 : inexact-ok
-+= sinh towardzero intel96 0x2.4a17fcp-12 : 0x2.4a17fdfffffff87cp-12 : inexact-ok
-+= sinh upward intel96 0x2.4a17fcp-12 : 0x2.4a17fdfffffff88p-12 : inexact-ok
-+= sinh downward m68k96 0x2.4a17fcp-12 : 0x2.4a17fdfffffff87cp-12 : inexact-ok
-+= sinh tonearest m68k96 0x2.4a17fcp-12 : 0x2.4a17fdfffffff88p-12 : inexact-ok
-+= sinh towardzero m68k96 0x2.4a17fcp-12 : 0x2.4a17fdfffffff87cp-12 : inexact-ok
-+= sinh upward m68k96 0x2.4a17fcp-12 : 0x2.4a17fdfffffff88p-12 : inexact-ok
-+= sinh downward binary128 0x2.4a17fcp-12 : 0x2.4a17fdfffffff87e8d322786ec88p-12 : inexact-ok
-+= sinh tonearest binary128 0x2.4a17fcp-12 : 0x2.4a17fdfffffff87e8d322786ec8ap-12 : inexact-ok
-+= sinh towardzero binary128 0x2.4a17fcp-12 : 0x2.4a17fdfffffff87e8d322786ec88p-12 : inexact-ok
-+= sinh upward binary128 0x2.4a17fcp-12 : 0x2.4a17fdfffffff87e8d322786ec8ap-12 : inexact-ok
-+= sinh downward ibm128 0x2.4a17fcp-12 : 0x2.4a17fdfffffff87e8d322786ecp-12 : inexact-ok
-+= sinh tonearest ibm128 0x2.4a17fcp-12 : 0x2.4a17fdfffffff87e8d322786edp-12 : inexact-ok
-+= sinh towardzero ibm128 0x2.4a17fcp-12 : 0x2.4a17fdfffffff87e8d322786ecp-12 : inexact-ok
-+= sinh upward ibm128 0x2.4a17fcp-12 : 0x2.4a17fdfffffff87e8d322786edp-12 : inexact-ok
- sinh 0x2.c5d376167f4052f4p+12
- = sinh downward binary32 0x2.c5d378p+12 : 0xf.fffffp+124 : inexact-ok overflow errno-erange-ok
- = sinh tonearest binary32 0x2.c5d378p+12 : plus_infty : inexact-ok overflow errno-erange
-diff --git a/sysdeps/ieee754/flt-32/e_sinhf.c b/sysdeps/ieee754/flt-32/e_sinhf.c
-index c007c7d174..dee96fc7cb 100644
--- a/sysdeps/ieee754/flt-32/e_sinhf.c
-+++ b/sysdeps/ieee754/flt-32/e_sinhf.c
-@@ -83,7 +83,7 @@ __ieee754_sinhf (float x)
- 	{					   /* |x| <= 0x1.250bfep-11 */
- 	  if (__glibc_unlikely (ux < 0x66000000u)) /* |x| < 0x1p-24 */
- 	    return fmaf (x, fabsf (x), x);
-	  if (__glibc_unlikely (st.uarg == asuint (ux)))
-+	  if (__glibc_unlikely (st.uarg == ux))
- 	    {
- 	      float sgn = copysignf (1.0f, x);
- 	      return sgn * st.rh + sgn * st.rl;
-- 
-2.48.1
-
--- a/round-tanf.patch
+++ b/round-tanf.patch
@@ -1,79 +0,0 @@
-From cf88351b685da86667e17d344414a70696ac82f1 Mon Sep 17 00:00:00 2001
-From: Adhemerval Zanella <adhemerval.zanella@linaro.org>
-Date: Sun, 2 Feb 2025 16:57:49 -0300
-Subject: [PATCH] math: Fix tanf for some inputs (BZ 32630)
-
-The logic was copied wrong from CORE-MATH.
-
-(cherry picked from commit 09e7f4d594b4308fbea18e3044148d67b59757c9)
---
- NEWS                            |  2 ++
- math/auto-libm-test-in          |  1 +
- math/auto-libm-test-out-tan     | 25 +++++++++++++++++++++++++
- sysdeps/ieee754/flt-32/s_tanf.c |  2 +-
- 4 files changed, 29 insertions(+), 1 deletion(-)
-
-diff --git a/math/auto-libm-test-in b/math/auto-libm-test-in
-index 5f465b31f1..4f194da19d 100644
--- a/math/auto-libm-test-in
-+++ b/math/auto-libm-test-in
-@@ -8664,6 +8664,7 @@ tan 0x1.1ad374p+0
- tan -0x1.0d55b8p+0
- tan 1.57079697
- tan -1.57079697
-+tan 0x1.ada6aap+27
- tan 0x1p-5
- tan 0x1p-10
- tan 0x1p-15
-diff --git a/math/auto-libm-test-out-tan b/math/auto-libm-test-out-tan
-index 7d00d03e1d..1d5999ab90 100644
--- a/math/auto-libm-test-out-tan
-+++ b/math/auto-libm-test-out-tan
-@@ -2532,6 +2532,31 @@ tan -1.57079697
- = tan tonearest ibm128 -0x1.921fc00ece4f02f278ade6ad9fp+0 : 0x1.7b91a0851bbbafa14cf21c2b5c8p+20 : inexact-ok
- = tan towardzero ibm128 -0x1.921fc00ece4f02f278ade6ad9fp+0 : 0x1.7b91a0851bbbafa14cf21c2b5cp+20 : inexact-ok
- = tan upward ibm128 -0x1.921fc00ece4f02f278ade6ad9fp+0 : 0x1.7b91a0851bbbafa14cf21c2b5c8p+20 : inexact-ok
-+tan 0x1.ada6aap+27
-+= tan downward binary32 0xd.6d355p+24 : 0x3.d00608p-4 : inexact-ok
-+= tan tonearest binary32 0xd.6d355p+24 : 0x3.d00608p-4 : inexact-ok
-+= tan towardzero binary32 0xd.6d355p+24 : 0x3.d00608p-4 : inexact-ok
-+= tan upward binary32 0xd.6d355p+24 : 0x3.d0060cp-4 : inexact-ok
-+= tan downward binary64 0xd.6d355p+24 : 0x3.d00608p-4 : inexact-ok
-+= tan tonearest binary64 0xd.6d355p+24 : 0x3.d00608p-4 : inexact-ok
-+= tan towardzero binary64 0xd.6d355p+24 : 0x3.d00608p-4 : inexact-ok
-+= tan upward binary64 0xd.6d355p+24 : 0x3.d006080000002p-4 : inexact-ok
-+= tan downward intel96 0xd.6d355p+24 : 0x3.d006080000000504p-4 : inexact-ok
-+= tan tonearest intel96 0xd.6d355p+24 : 0x3.d006080000000508p-4 : inexact-ok
-+= tan towardzero intel96 0xd.6d355p+24 : 0x3.d006080000000504p-4 : inexact-ok
-+= tan upward intel96 0xd.6d355p+24 : 0x3.d006080000000508p-4 : inexact-ok
-+= tan downward m68k96 0xd.6d355p+24 : 0x3.d006080000000504p-4 : inexact-ok
-+= tan tonearest m68k96 0xd.6d355p+24 : 0x3.d006080000000508p-4 : inexact-ok
-+= tan towardzero m68k96 0xd.6d355p+24 : 0x3.d006080000000504p-4 : inexact-ok
-+= tan upward m68k96 0xd.6d355p+24 : 0x3.d006080000000508p-4 : inexact-ok
-+= tan downward binary128 0xd.6d355p+24 : 0x3.d0060800000005067d16c1c9c15ap-4 : inexact-ok
-+= tan tonearest binary128 0xd.6d355p+24 : 0x3.d0060800000005067d16c1c9c15ap-4 : inexact-ok
-+= tan towardzero binary128 0xd.6d355p+24 : 0x3.d0060800000005067d16c1c9c15ap-4 : inexact-ok
-+= tan upward binary128 0xd.6d355p+24 : 0x3.d0060800000005067d16c1c9c15cp-4 : inexact-ok
-+= tan downward ibm128 0xd.6d355p+24 : 0x3.d0060800000005067d16c1c9c1p-4 : inexact-ok
-+= tan tonearest ibm128 0xd.6d355p+24 : 0x3.d0060800000005067d16c1c9c1p-4 : inexact-ok
-+= tan towardzero ibm128 0xd.6d355p+24 : 0x3.d0060800000005067d16c1c9c1p-4 : inexact-ok
-+= tan upward ibm128 0xd.6d355p+24 : 0x3.d0060800000005067d16c1c9c2p-4 : inexact-ok
- tan 0x1p-5
- = tan downward binary32 0x8p-8 : 0x8.00aabp-8 : inexact-ok
- = tan tonearest binary32 0x8p-8 : 0x8.00aacp-8 : inexact-ok
-diff --git a/sysdeps/ieee754/flt-32/s_tanf.c b/sysdeps/ieee754/flt-32/s_tanf.c
-index dfe56fc2a0..5ee1d6f35e 100644
--- a/sysdeps/ieee754/flt-32/s_tanf.c
-+++ b/sysdeps/ieee754/flt-32/s_tanf.c
-@@ -166,7 +166,7 @@ __tanf (float x)
-       uint32_t sgn = t >> 31;
-       for (int j = 0; j < array_length (st); j++)
- 	{
-	  if (__glibc_unlikely (asfloat (st[j].arg) == ax))
-+	  if (__glibc_unlikely (asuint (st[j].arg) == ax))
- 	    {
- 	      if (sgn)
- 		return -st[j].rh - st[j].rl;
-- 
-2.48.1
-
--- a/tst-aarch64-pkey.patch
+++ b/tst-aarch64-pkey.patch
@@ -1,37 +0,0 @@
-From 1e0e33e1b19a7634b364ac7b97c3c9612d5b776f Mon Sep 17 00:00:00 2001
-From: Aurelien Jarno <aurelien@aurel32.net>
-Date: Sat, 15 Feb 2025 11:08:33 +0100
-Subject: [PATCH] Fix tst-aarch64-pkey to handle ENOSPC as not supported
-
-The syscall pkey_alloc can return ENOSPC to indicate either that all
-keys are in use or that the system runs in a mode in which memory
-protection keys are disabled. In such case the test should not fail and
-just return unsupported.
-
-This matches the behaviour of the generic tst-pkey.
-
-Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
-Reviewed-by: Florian Weimer <fweimer@redhat.com>
-(cherry picked from commit 60f2d6be657aa8c663ee14bd266d343ae0f35afb)
---
- sysdeps/unix/sysv/linux/aarch64/tst-aarch64-pkey.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/sysdeps/unix/sysv/linux/aarch64/tst-aarch64-pkey.c b/sysdeps/unix/sysv/linux/aarch64/tst-aarch64-pkey.c
-index 3ff33ef72a..c884efc3b4 100644
--- a/sysdeps/unix/sysv/linux/aarch64/tst-aarch64-pkey.c
-+++ b/sysdeps/unix/sysv/linux/aarch64/tst-aarch64-pkey.c
-@@ -55,6 +55,10 @@ do_test (void)
-       if (errno == ENOSYS || errno == EINVAL)
-         FAIL_UNSUPPORTED
-           ("kernel or CPU does not support memory protection keys");
-+      if (errno == ENOSPC)
-+        FAIL_UNSUPPORTED
-+          ("no keys available or kernel does not support memory"
-+           " protection keys");
-       FAIL_EXIT1 ("pkey_alloc: %m");
-     }
- 
-- 
-2.48.1
-
--- a/ulp-prologue-into-asm-functions.patch
+++ b/ulp-prologue-into-asm-functions.patch
@@ -1,6 +1,6 @@
-From 43c311457caf71c02ea2857bcf4e1e0499dc221a Mon Sep 17 00:00:00 2001
+From 14848b3c532520e71ba2614eb23f173f83c541d2 Mon Sep 17 00:00:00 2001
 From: Giuliano Belinassi <gbelinassi@suse.de>
-Date: Fri, 18 Apr 2025 14:22:49 -0300
+Date: Thu, 2 Jan 2025 22:40:22 +0100
 Subject: [PATCH] Add Userspace Livepatch prologue into ASM functions

 Userspace Live Patching (ULP) refers to the process of applying
@@ -13,23 +13,23 @@ this have to be included manually. This patch does this.
 Signed-off-by: Giuliano Belinassi <gbelinassi@suse.de>
 ---
 config.h.in                              |  3 ++
- config.make.in                           |  2 +
- configure                                | 54 +++++++++++++++++++++++
- configure.ac                             | 29 +++++++++++++
- sysdeps/powerpc/powerpc64/le/Makefile    |  8 ++++
+ config.make.in                           |  1 +
+ configure                                | 22 ++++++++++
+ configure.ac                             | 13 ++++++
+ sysdeps/powerpc/powerpc64/le/Makefile    |  5 +++
 sysdeps/powerpc/powerpc64/sysdep.h       | 55 ++++++++++++++++++++++--
 sysdeps/x86_64/Makefile                  |  5 +++
 sysdeps/x86_64/multiarch/strcmp-avx2.S   |  5 +--
 sysdeps/x86_64/multiarch/strcmp-evex.S   |  5 +--
 sysdeps/x86_64/multiarch/strcmp-sse4_2.S |  5 +--
 sysdeps/x86_64/sysdep.h                  | 54 +++++++++++++++++++++--
- 11 files changed, 205 insertions(+), 20 deletions(-)
+ 11 files changed, 153 insertions(+), 20 deletions(-)

 diff --git a/config.h.in b/config.h.in
-index cdbd555366..2cd9838361 100644
+index f495f11244..6c46990c8d 100644
 --- a/config.h.in
 +++ b/config.h.in
-@@ -221,6 +221,9 @@
+@@ -214,6 +214,9 @@
 /* Define to 1 if libpthread actually resides in libc.  */
 #define PTHREAD_IN_LIBC 0
 
@@ -40,32 +40,30 @@ index cdbd555366..2cd9838361 100644
 #define TIMEOUTFACTOR 1
 
 diff --git a/config.make.in b/config.make.in
-index 59897eaec2..63f9b6ee58 100644
+index 36096881b7..04cf873fad 100644
 --- a/config.make.in
 +++ b/config.make.in
-@@ -82,6 +82,8 @@ mach-interface-list = @mach_interface_list@
+@@ -81,6 +81,7 @@ mach-interface-list = @mach_interface_list@
 memory-tagging = @memory_tagging@
 
 # Configuration options.
 +enable-userspace-livepatch = @enable_userspace_livepatch@
-+supports-msplit-patch-nops = @supports_msplit_patch_nops@
 build-shared = @shared@
 build-profile = @profile@
 build-static-nss = @static_nss@
 diff --git a/configure b/configure
-index 674d1d7e4a..51dbce3b34 100755
+index 1d543548cd..f6275d327e 100755
 --- a/configure
 +++ b/configure
-@@ -615,6 +615,8 @@ LIBOBJS
+@@ -615,6 +615,7 @@ LIBOBJS
 pthread_in_libc
 RELEASE
 VERSION
-+supports_msplit_patch_nops
 +enable_userspace_livepatch
 mach_interface_list
 DEFINES
 static_nss
-@@ -821,6 +823,7 @@ enable_cet
+@@ -809,6 +810,7 @@ enable_cet
 enable_scv
 enable_fortify_source
 with_cpu
@@ -73,7 +71,7 @@ index 674d1d7e4a..51dbce3b34 100755
 '
       ac_precious_vars='build_alias
 host_alias
-@@ -1505,6 +1508,8 @@ Optional Features:
+@@ -1491,6 +1493,8 @@ Optional Features:
                           Use -D_FORTIFY_SOURCE=[1|2|3] to control code
                           hardening, defaults to highest possible value
                           supported by the build compiler.
@@ -82,7 +80,7 @@ index 674d1d7e4a..51dbce3b34 100755
 
 Optional Packages:
   --with-PACKAGE[=ARG]    use PACKAGE [ARG=yes]
-@@ -9152,6 +9157,55 @@ libc_cv_multidir=`${CC-cc} $CFLAGS $CPPFLAGS -print-multi-directory`
+@@ -8096,6 +8100,24 @@ libc_cv_multidir=`${CC-cc} $CFLAGS $CPPFLAGS -print-multi-directory`
 
 
 
@@ -96,36 +94,6 @@ index 674d1d7e4a..51dbce3b34 100755
 +fi
 +
 +
-+# Check if compiler provides -msplit-patch-nops.  It may be required on
-+# some architectures for livepatching support.
-+if test "x$enable_userspace_livepatch" = xyes; then
-+  old_CFLAGS="$CFLAGS"
-+  CFLAGS="-msplit-patch-nops $CFLAGS"
-+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-+/* end confdefs.h.  */
-+extern void g(void);
-+      __attribute__((patchable_function_entry(14, 13)))
-+      void f(void) { g(); }
-+int
-+main (void)
-+{
-+
-+  ;
-+  return 0;
-+}
-+_ACEOF
-+if ac_fn_c_try_compile "$LINENO"
-+then :
-+  supports_msplit_patch_nops=yes
-+else case e in #(
-+  e) supports_msplit_patch_nops=no ;;
-+esac
-+fi
-+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
-+
-+  CFLAGS="$old_CFLAGS"
-+fi
-+
 +# Libpulp uses -fpatchable-function-entry to add padding NOPS to the
 +# prologue of all functions.
 +if test "x$enable_userspace_livepatch" = xyes; then
@@ -133,16 +101,15 @@ index 674d1d7e4a..51dbce3b34 100755
 +
 +fi
 +
-+
 +
 VERSION=`sed -n -e 's/^#define VERSION "\([^"]*\)"/\1/p' < $srcdir/version.h`
 RELEASE=`sed -n -e 's/^#define RELEASE "\([^"]*\)"/\1/p' < $srcdir/version.h`
 
 diff --git a/configure.ac b/configure.ac
-index 57cd24c87d..97c65dc6c5 100644
+index 9cbc0bf68f..4ba19209b7 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -2079,6 +2079,35 @@ AC_SUBST(DEFINES)
+@@ -1780,6 +1780,19 @@ AC_SUBST(DEFINES)
 dnl See sysdeps/mach/configure.ac for this variable.
 AC_SUBST(mach_interface_list)
 
@@ -152,53 +119,34 @@ index 57cd24c87d..97c65dc6c5 100644
 +	      [enable_userspace_livepatch=$enableval],
 +	      [enable_userspace_livepatch=no])
 +
-+# Check if compiler provides -msplit-patch-nops.  It may be required on
-+# some architectures for livepatching support.
-+if test "x$enable_userspace_livepatch" = xyes; then
-+  old_CFLAGS="$CFLAGS"
-+  CFLAGS="-msplit-patch-nops $CFLAGS"
-+  AC_COMPILE_IFELSE([AC_LANG_PROGRAM(
-+    [[extern void g(void);
-+      __attribute__((patchable_function_entry(14, 13)))
-+      void f(void) { g(); }]])],
-+    [supports_msplit_patch_nops=yes],
-+    [supports_msplit_patch_nops=no])
-+
-+  CFLAGS="$old_CFLAGS"
-+fi
-+
 +# Libpulp uses -fpatchable-function-entry to add padding NOPS to the
 +# prologue of all functions.
 +if test "x$enable_userspace_livepatch" = xyes; then
 +  AC_DEFINE(ENABLE_USERSPACE_LIVEPATCH)
 +fi
 +AC_SUBST(enable_userspace_livepatch)
-+AC_SUBST(supports_msplit_patch_nops)
 +
 VERSION=`sed -n -e 's/^#define VERSION "\([^"]*\)"/\1/p' < $srcdir/version.h`
 RELEASE=`sed -n -e 's/^#define RELEASE "\([^"]*\)"/\1/p' < $srcdir/version.h`
 AC_SUBST(VERSION)
 diff --git a/sysdeps/powerpc/powerpc64/le/Makefile b/sysdeps/powerpc/powerpc64/le/Makefile
-index b77775cf95..8340a8e02f 100644
+index b77775cf95..2f81e562db 100644
 --- a/sysdeps/powerpc/powerpc64/le/Makefile
 +++ b/sysdeps/powerpc/powerpc64/le/Makefile
-@@ -1,3 +1,11 @@
+@@ -1,3 +1,8 @@
 +# Add flags for Userspace Livepatching support.
 +ifeq (yes,$(enable-userspace-livepatch))
-++cflags += -fpatchable-function-entry=14,13
-+ifeq (yes,$(supports-msplit-patch-nops))
-++cflags += -msplit-patch-nops
-+endif
++cflags += -fpatchable-function-entry=14,13 -msplit-patch-nops
 +endif
 +
 # When building float128 we need to ensure -mfloat128 is
 # passed to all such object files.
 type-float128-CFLAGS := -mfloat128
 diff --git a/sysdeps/powerpc/powerpc64/sysdep.h b/sysdeps/powerpc/powerpc64/sysdep.h
-index f05dae71f6..55c6b9b45b 100644
+index c363939e1a..33ed236407 100644
 --- a/sysdeps/powerpc/powerpc64/sysdep.h
 +++ b/sysdeps/powerpc/powerpc64/sysdep.h
-@@ -163,6 +163,46 @@
+@@ -162,6 +162,46 @@
 BODY_LABEL(\name):
 	.endm
 
@@ -245,7 +193,7 @@ index f05dae71f6..55c6b9b45b 100644
 /* Use ENTRY_TOCLESS for functions that make no use of r2 and
    guarantee r2 is unchanged on exit.  Any function that has @toc or
    @got relocs uses r2.  Functions that call other functions via the
-@@ -175,19 +215,26 @@ BODY_LABEL(\name):
+@@ -174,19 +214,26 @@ BODY_LABEL(\name):
    before the start of the function's code.   */
 #ifndef PROF
 #define ENTRY_TOCLESS(name, ...)		\
@@ -277,7 +225,7 @@ index f05dae71f6..55c6b9b45b 100644
 #define ENTRY(name, ...)			\
 	ENTRY_TOCLESS(name, ## __VA_ARGS__)
 diff --git a/sysdeps/x86_64/Makefile b/sysdeps/x86_64/Makefile
-index 9d31685e02..d20287a050 100644
+index ce949dba27..44e9f38f4e 100644
 --- a/sysdeps/x86_64/Makefile
 +++ b/sysdeps/x86_64/Makefile
@@ -1,3 +1,8 @@
@@ -290,7 +238,7 @@ index 9d31685e02..d20287a050 100644
 long-double-fcts = yes
 
 diff --git a/sysdeps/x86_64/multiarch/strcmp-avx2.S b/sysdeps/x86_64/multiarch/strcmp-avx2.S
-index 4b46a8de17..8266f558d9 100644
+index 5bc1d90078..3ea96c0aa3 100644
 --- a/sysdeps/x86_64/multiarch/strcmp-avx2.S
 +++ b/sysdeps/x86_64/multiarch/strcmp-avx2.S
@@ -201,10 +201,7 @@ END (STRCASECMP)
@@ -306,10 +254,10 @@ index 4b46a8de17..8266f558d9 100644
 # if defined USE_AS_STRCASECMP_L
 	/* We have to fall back on the C implementation for locales with
 diff --git a/sysdeps/x86_64/multiarch/strcmp-evex.S b/sysdeps/x86_64/multiarch/strcmp-evex.S
-index 6316bb940e..91192f2d2e 100644
+index 06730ab2a1..d96b1c4824 100644
 --- a/sysdeps/x86_64/multiarch/strcmp-evex.S
 +++ b/sysdeps/x86_64/multiarch/strcmp-evex.S
-@@ -226,10 +226,7 @@ END (STRCASECMP)
+@@ -224,10 +224,7 @@ END (STRCASECMP)
 # endif
 
 	.p2align 4
@@ -322,7 +270,7 @@ index 6316bb940e..91192f2d2e 100644
 # if defined USE_AS_STRCASECMP_L
 	/* We have to fall back on the C implementation for locales with
 diff --git a/sysdeps/x86_64/multiarch/strcmp-sse4_2.S b/sysdeps/x86_64/multiarch/strcmp-sse4_2.S
-index 1b746c4b2f..01c8eb44e3 100644
+index 4e98da0246..2a2280c65f 100644
 --- a/sysdeps/x86_64/multiarch/strcmp-sse4_2.S
 +++ b/sysdeps/x86_64/multiarch/strcmp-sse4_2.S
@@ -103,10 +103,7 @@ END (STRCASECMP)
@@ -338,7 +286,7 @@ index 1b746c4b2f..01c8eb44e3 100644
 /*
  * This implementation uses SSE to compare up to 16 bytes at a time.
 diff --git a/sysdeps/x86_64/sysdep.h b/sysdeps/x86_64/sysdep.h
-index cb475bec98..2bb84c4c31 100644
+index db6e36b2dd..86a5d1b2be 100644
 --- a/sysdeps/x86_64/sysdep.h
 +++ b/sysdeps/x86_64/sysdep.h
@@ -49,6 +49,46 @@ enum cf_protection_level