+---
+ ...et-concurrent-resampler-crash-expected.txt | 1 +
+ ...dioworklet-concurrent-resampler-crash.html | 44 +++++++++++++++++++
+ .../platform/audio/MultiChannelResampler.cpp | 21 ++-------
+ .../platform/audio/MultiChannelResampler.h | 2 -
+ 4 files changed, 48 insertions(+), 20 deletions(-)
+ create mode 100644 LayoutTests/webaudio/crashtest/audioworklet-concurrent-resampler-crash-expected.txt
+ create mode 100644 LayoutTests/webaudio/crashtest/audioworklet-concurrent-resampler-crash.html
+
+diff --git a/LayoutTests/webaudio/crashtest/audioworklet-concurrent-resampler-crash-expected.txt b/LayoutTests/webaudio/crashtest/audioworklet-concurrent-resampler-crash-expected.txt
+new file mode 100644
+index 00000000..654ddf7f
+--- /dev/null
++++ b/LayoutTests/webaudio/crashtest/audioworklet-concurrent-resampler-crash-expected.txt
+@@ -0,0 +1 @@
++This test passes if it does not crash.
+diff --git a/LayoutTests/webaudio/crashtest/audioworklet-concurrent-resampler-crash.html b/LayoutTests/webaudio/crashtest/audioworklet-concurrent-resampler-crash.html
+new file mode 100644
+index 00000000..b3ab181d
+--- /dev/null
++++ b/LayoutTests/webaudio/crashtest/audioworklet-concurrent-resampler-crash.html
+@@ -0,0 +1,44 @@
++
++
++
++
++
++ This test passes if it does not crash.
++
++
++
+diff --git a/Source/WebCore/platform/audio/MultiChannelResampler.cpp b/Source/WebCore/platform/audio/MultiChannelResampler.cpp
+index 1dadc58c..13db6f26 100644
+--- a/Source/WebCore/platform/audio/MultiChannelResampler.cpp
++++ b/Source/WebCore/platform/audio/MultiChannelResampler.cpp
+@@ -41,18 +41,8 @@ namespace WebCore {
+ MultiChannelResampler::MultiChannelResampler(double scaleFactor, unsigned numberOfChannels, unsigned requestFrames, Function&& provideInput)
+ : m_numberOfChannels(numberOfChannels)
+ , m_provideInput(WTFMove(provideInput))
+- , m_multiChannelBus(AudioBus::create(numberOfChannels, requestFrames, false))
++ , m_multiChannelBus(AudioBus::create(numberOfChannels, requestFrames))
+ {
+- // As an optimization, we will use the buffer passed to provideInputForChannel() as channel memory for the first channel so we
+- // only need to allocate memory if there is more than one channel.
+- if (numberOfChannels > 1) {
+- m_channelsMemory.reserveInitialCapacity(numberOfChannels - 1);
+- for (unsigned channelIndex = 1; channelIndex < numberOfChannels; ++channelIndex) {
+- m_channelsMemory.uncheckedAppend(makeUnique(requestFrames));
+- m_multiChannelBus->setChannelMemory(channelIndex, m_channelsMemory.last()->data(), requestFrames);
+- }
+- }
+-
+ // Create each channel's resampler.
+ for (unsigned channelIndex = 0; channelIndex < numberOfChannels; ++channelIndex)
+ m_kernels.append(makeUnique(scaleFactor, requestFrames, std::bind(&MultiChannelResampler::provideInputForChannel, this, std::placeholders::_1, std::placeholders::_2, channelIndex)));
+@@ -89,15 +79,10 @@ void MultiChannelResampler::process(AudioBus* destination, size_t framesToProces
+ void MultiChannelResampler::provideInputForChannel(float* buffer, size_t framesToProcess, unsigned channelIndex)
+ {
+ ASSERT(channelIndex < m_multiChannelBus->numberOfChannels());
+- ASSERT(framesToProcess == m_multiChannelBus->length());
++ ASSERT(framesToProcess <= m_multiChannelBus->length());
+
+- if (!channelIndex) {
+- // As an optimization, we use the provided buffer as memory for the first channel in the AudioBus. This avoids
+- // having to memcpy() for the first channel.
+- m_multiChannelBus->setChannelMemory(0, buffer, framesToProcess);
++ if (!channelIndex)
+ m_provideInput(m_multiChannelBus.get(), framesToProcess);
+- return;
+- }
+
+ // Copy the channel data from what we received from m_multiChannelProvider.
+ memcpy(buffer, m_multiChannelBus->channel(channelIndex)->data(), sizeof(float) * framesToProcess);
+diff --git a/Source/WebCore/platform/audio/MultiChannelResampler.h b/Source/WebCore/platform/audio/MultiChannelResampler.h
+index e96cc56b..274fe364 100644
+--- a/Source/WebCore/platform/audio/MultiChannelResampler.h
++++ b/Source/WebCore/platform/audio/MultiChannelResampler.h
+@@ -29,7 +29,6 @@
+ #ifndef MultiChannelResampler_h
+ #define MultiChannelResampler_h
+
+-#include "AudioArray.h"
+ #include
+ #include
+ #include
+@@ -62,7 +61,6 @@ private:
+ size_t m_outputFramesReady { 0 };
+ Function m_provideInput;
+ RefPtr m_multiChannelBus;
+- Vector> m_channelsMemory;
+ };
+
+ } // namespace WebCore
+--
+2.35.7
+
diff --git a/meta-bsp/recipes-sato/webkit/webkitgtk/CVE-2024-40779.patch b/meta-bsp/recipes-sato/webkit/webkitgtk/CVE-2024-40779.patch
new file mode 100644
index 0000000000000000000000000000000000000000..6fac907256a1eba495b1be0007323272b1c3a56d
--- /dev/null
+++ b/meta-bsp/recipes-sato/webkit/webkitgtk/CVE-2024-40779.patch
@@ -0,0 +1,91 @@
+From 2fe5ae29a5f6434ef456afe9673a4f400ec63848 Mon Sep 17 00:00:00 2001
+From: Jean-Yves Avenard
+Date: Fri, 14 Jun 2024 16:08:19 -0700
+Subject: [PATCH] Cherry-pick 272448.1085@safari-7618.3.10-branch
+ (ff52ff7cb64e). https://bugs.webkit.org/show_bug.cgi?id=275431
+
+HeapBufferOverflow in computeSampleUsingLinearInterpolation
+https://bugs.webkit.org/show_bug.cgi?id=275431
+rdar://125617812
+
+Reviewed by Youenn Fablet.
+
+Add boundary check.
+This is a copy of blink code for that same function.
+https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/modules/webaudio/audio_buffer_source_handler.cc;l=336-341
+
+* LayoutTests/webaudio/crashtest/audiobuffer-sourcenode-resampler-crash-expected.txt: Added.
+* LayoutTests/webaudio/crashtest/audiobuffer-sourcenode-resampler-crash.html: Added.
+* Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp:
+(WebCore::AudioBufferSourceNode::renderFromBuffer):
+
+Canonical link: https://commits.webkit.org/274313.347@webkitglib/2.44
+
+Upstream-Status: Backport [https://github.com/WebKit/WebKit/commit/2fe5ae29a5f6434ef456afe9673a4f400ec63848]
+CVE: CVE-2024-40779
+Signed-off-by: Vivek Kumbhar
+---
+ ...er-sourcenode-resampler-crash-expected.txt | 1 +
+ ...udiobuffer-sourcenode-resampler-crash.html | 25 +++++++++++++++++++
+ .../webaudio/AudioBufferSourceNode.cpp | 6 +++++
+ 3 files changed, 32 insertions(+)
+ create mode 100644 LayoutTests/webaudio/crashtest/audiobuffer-sourcenode-resampler-crash-expected.txt
+ create mode 100644 LayoutTests/webaudio/crashtest/audiobuffer-sourcenode-resampler-crash.html
+
+diff --git a/LayoutTests/webaudio/crashtest/audiobuffer-sourcenode-resampler-crash-expected.txt b/LayoutTests/webaudio/crashtest/audiobuffer-sourcenode-resampler-crash-expected.txt
+new file mode 100644
+index 00000000..654ddf7f
+--- /dev/null
++++ b/LayoutTests/webaudio/crashtest/audiobuffer-sourcenode-resampler-crash-expected.txt
+@@ -0,0 +1 @@
++This test passes if it does not crash.
+diff --git a/LayoutTests/webaudio/crashtest/audiobuffer-sourcenode-resampler-crash.html b/LayoutTests/webaudio/crashtest/audiobuffer-sourcenode-resampler-crash.html
+new file mode 100644
+index 00000000..5fb2dd8c
+--- /dev/null
++++ b/LayoutTests/webaudio/crashtest/audiobuffer-sourcenode-resampler-crash.html
+@@ -0,0 +1,25 @@
++
++
++
++
++
++ This test passes if it does not crash.
++
++
++
+diff --git a/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp b/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp
+index 35b8c818..689d37a1 100644
+--- a/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp
++++ b/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp
+@@ -342,6 +342,12 @@ bool AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination
+ if (readIndex2 >= maxFrame)
+ readIndex2 = m_isLooping ? minFrame : readIndex;
+
++ // Final sanity check on buffer access.
++ // FIXME: as an optimization, try to get rid of this inner-loop check and
++ // put assertions and guards before the loop.
++ if (readIndex >= bufferLength || readIndex2 >= bufferLength)
++ break;
++
+ // Linear interpolation.
+ for (unsigned i = 0; i < numberOfChannels; ++i) {
+ float* destination = destinationChannels[i];
+--
+2.34.1
diff --git a/meta-bsp/recipes-sato/webkit/webkitgtk/CVE-2024-40780.patch b/meta-bsp/recipes-sato/webkit/webkitgtk/CVE-2024-40780.patch
new file mode 100644
index 0000000000000000000000000000000000000000..ab41213d7d6696cb4f83ddbfc2078a10a43b46f7
--- /dev/null
+++ b/meta-bsp/recipes-sato/webkit/webkitgtk/CVE-2024-40780.patch
@@ -0,0 +1,94 @@
+From e83e4c7460972898dc06a5f5ab36eed7c6b101b5 Mon Sep 17 00:00:00 2001
+From: Jer Noble
+Date: Tue, 11 Jun 2024 11:54:06 -0700
+Subject: [PATCH] CVE-2024-40780: Add check in AudioBufferSourceNode::renderFromBuffer()
+when detune is set to large negative value
+
+Upstream-Status: Backport from https://github.com/WebKit/WebKit/commit/e83e4c7460972898dc06a5f5ab36eed7c6b101b5
+CVE: CVE-2024-40780
+
+Signed-off-by: Rohini Sangam
+---
+ ...buffersourcenode-detune-crash-expected.txt | 10 +++++++
+ .../audiobuffersourcenode-detune-crash.html | 30 +++++++++++++++++++
+ .../webaudio/AudioBufferSourceNode.cpp | 7 +++++
+ 3 files changed, 47 insertions(+)
+ create mode 100644 LayoutTests/webaudio/audiobuffersourcenode-detune-crash-expected.txt
+ create mode 100644 LayoutTests/webaudio/audiobuffersourcenode-detune-crash.html
+
+diff --git a/LayoutTests/webaudio/audiobuffersourcenode-detune-crash-expected.txt b/LayoutTests/webaudio/audiobuffersourcenode-detune-crash-expected.txt
+new file mode 100644
+index 00000000..914ba0b1
+--- /dev/null
++++ b/LayoutTests/webaudio/audiobuffersourcenode-detune-crash-expected.txt
+@@ -0,0 +1,10 @@
++Attempting to create a AudioBufferSourceNode with a large negative detune value should not crash.
++
++On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
++
++
++PASS Test passed because it did not crash.
++PASS successfullyParsed is true
++
++TEST COMPLETE
++
+diff --git a/LayoutTests/webaudio/audiobuffersourcenode-detune-crash.html b/LayoutTests/webaudio/audiobuffersourcenode-detune-crash.html
+new file mode 100644
+index 00000000..e8af579d
+--- /dev/null
++++ b/LayoutTests/webaudio/audiobuffersourcenode-detune-crash.html
+@@ -0,0 +1,30 @@
++
++
++
++
++
++
++
++
++
++
++
++
+diff --git a/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp b/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp
+index 689d37a1..f68e7ff5 100644
+--- a/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp
++++ b/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp
+@@ -327,9 +327,16 @@ bool AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination
+ virtualReadIndex = readIndex;
+ } else if (!pitchRate) {
+ unsigned readIndex = static_cast(virtualReadIndex);
++ int deltaFrames = static_cast(virtualDeltaFrames);
++ maxFrame = static_cast(virtualMaxFrame);
++
++ if (readIndex >= maxFrame)
++ readIndex -= deltaFrames;
+
+ for (unsigned i = 0; i < numberOfChannels; ++i)
+ std::fill_n(destinationChannels[i] + writeIndex, framesToProcess, sourceChannels[i][readIndex]);
++
++ virtualReadIndex = readIndex;
+ } else if (reverse) {
+ unsigned maxFrame = static_cast(virtualMaxFrame);
+ unsigned minFrame = static_cast(floorf(virtualMinFrame));
+--
+2.35.7
+
diff --git a/meta-bsp/recipes-sato/webkit/webkitgtk/reproducibility.patch b/meta-bsp/recipes-sato/webkit/webkitgtk/reproducibility.patch
new file mode 100644
index 0000000000000000000000000000000000000000..e866a1a193a504e95800d83ee365aa35f85bae3b
--- /dev/null
+++ b/meta-bsp/recipes-sato/webkit/webkitgtk/reproducibility.patch
@@ -0,0 +1,22 @@
+Injection a year based on the current date isn't reproducible. Hack this
+to a specific year for now for reproducibilty and to avoid autobuilder failures.
+
+The correct fix would be to use SOURCE_DATE_EPOCH from the environment and
+then this could be submitted upstream, sadly my ruby isn't up to that.
+
+Upstream-Status: Pending [could be reworked]
+Signed-off-by: Richard Purdie
+
+Index: webkitgtk-2.34.2/Source/JavaScriptCore/generator/GeneratedFile.rb
+===================================================================
+--- webkitgtk-2.34.2.orig/Source/JavaScriptCore/generator/GeneratedFile.rb
++++ webkitgtk-2.34.2/Source/JavaScriptCore/generator/GeneratedFile.rb
+@@ -25,7 +25,7 @@ require 'date'
+ require 'digest'
+
+ $LICENSE = <<-EOF
+-Copyright (C) #{Date.today.year} Apple Inc. All rights reserved.
++Copyright (C) 2021 Apple Inc. All rights reserved.
+
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions
diff --git a/meta-bsp/recipes-sato/webkit/webkitgtk_%.bbappend b/meta-bsp/recipes-sato/webkit/webkitgtk_%.bbappend
new file mode 100644
index 0000000000000000000000000000000000000000..fba995c4af6654aa4cea376111f6b8dc3317cbe1
--- /dev/null
+++ b/meta-bsp/recipes-sato/webkit/webkitgtk_%.bbappend
@@ -0,0 +1,22 @@
+FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}:"
+SRC_URI = "https://www.webkitgtk.org/releases/${BP}.tar.xz \
+ file://0001-FindGObjectIntrospection.cmake-prefix-variables-obta.patch \
+ file://0001-Tweak-gtkdoc-settings-so-that-gtkdoc-generation-work.patch \
+ file://0001-Fix-build-without-opengl-or-es.patch \
+ file://reproducibility.patch \
+ file://0001-When-building-introspection-files-do-not-quote-CFLAG.patch \
+ file://CVE-2022-32888.patch \
+ file://CVE-2022-32923.patch \
+ file://CVE-2022-46691.patch \
+ file://CVE-2022-46699.patch \
+ file://CVE-2022-42867.patch \
+ file://CVE-2022-46700.patch \
+ file://CVE-2023-23529.patch \
+ file://CVE-2022-48503.patch \
+ file://CVE-2023-32439.patch \
+ file://CVE-2024-40779.patch \
+ file://0d3344e17d258106617b0e6d783d073b188a2548.patch \
+ file://CVE-2024-40776.patch \
+ file://CVE-2024-40780.patch \
+ "
+
diff --git a/meta-bsp/recipes-security/optee-phytium/optee-os-tadevkit_4.0.0.bb b/meta-bsp/recipes-security/optee-phytium/optee-os-tadevkit_4.6.0.bb
similarity index 94%
rename from meta-bsp/recipes-security/optee-phytium/optee-os-tadevkit_4.0.0.bb
rename to meta-bsp/recipes-security/optee-phytium/optee-os-tadevkit_4.6.0.bb
index 167a942efce8792c8763eea95e7040672f65a752..e882a783703ac6262a18bc6281651045f1770d6c 100644
--- a/meta-bsp/recipes-security/optee-phytium/optee-os-tadevkit_4.0.0.bb
+++ b/meta-bsp/recipes-security/optee-phytium/optee-os-tadevkit_4.6.0.bb
@@ -1,4 +1,4 @@
-require optee-phytium-os_4.0.0.bb
+require optee-phytium-os_4.6.0.bb
SUMMARY = "OP-TEE Trusted OS TA devkit"
DESCRIPTION = "OP-TEE TA devkit for build TAs"
diff --git a/meta-bsp/recipes-security/optee-phytium/optee-phytium-client_4.0.0.bb b/meta-bsp/recipes-security/optee-phytium/optee-phytium-client_4.6.0.bb
similarity index 89%
rename from meta-bsp/recipes-security/optee-phytium/optee-phytium-client_4.0.0.bb
rename to meta-bsp/recipes-security/optee-phytium/optee-phytium-client_4.6.0.bb
index c15a3abd47c4bea36cbc3fd2057b95a57cc15cc0..3215d86782e2c029e9561f1bdbf99f9c911ebee8 100644
--- a/meta-bsp/recipes-security/optee-phytium/optee-phytium-client_4.0.0.bb
+++ b/meta-bsp/recipes-security/optee-phytium/optee-phytium-client_4.6.0.bb
@@ -8,11 +8,11 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=69663ab153298557a59c67a60a743e5b"
inherit systemd update-rc.d cmake pkgconfig
SRC_URI = " \
- git://gitee.com/phytium_embedded/phytium-optee.git;protocol=https;nobranch=1 \
+ git://git@gitlab.phytium.com.cn:12022/embedded/optee/optee-4.0e.git;protocol=ssh;nobranch=1 \
file://tee-supplicant.service \
file://tee-supplicant.sh \
"
-SRCREV = "100060dd4bda6caf9230b277886bd19f796e6881"
+SRCREV = "583dba9b9e78e21cb63ea7003ffcafc3e6d94343"
DEPENDS += "util-linux"
EXTRA_OEMAKE += "PKG_CONFIG=pkg-config"
diff --git a/meta-bsp/recipes-security/optee-phytium/optee-phytium-examples_4.0.0.bb b/meta-bsp/recipes-security/optee-phytium/optee-phytium-examples_4.6.0.bb
similarity index 100%
rename from meta-bsp/recipes-security/optee-phytium/optee-phytium-examples_4.0.0.bb
rename to meta-bsp/recipes-security/optee-phytium/optee-phytium-examples_4.6.0.bb
diff --git a/meta-bsp/recipes-security/optee-phytium/optee-phytium-os_4.0.0.bb b/meta-bsp/recipes-security/optee-phytium/optee-phytium-os_4.6.0.bb
similarity index 100%
rename from meta-bsp/recipes-security/optee-phytium/optee-phytium-os_4.0.0.bb
rename to meta-bsp/recipes-security/optee-phytium/optee-phytium-os_4.6.0.bb
diff --git a/meta-bsp/recipes-security/optee-phytium/optee-phytium-test_4.0.0.bb b/meta-bsp/recipes-security/optee-phytium/optee-phytium-test_4.0.0.bb
deleted file mode 100644
index 71e7afe8d350cacfc2db70d3b302175267c80232..0000000000000000000000000000000000000000
--- a/meta-bsp/recipes-security/optee-phytium/optee-phytium-test_4.0.0.bb
+++ /dev/null
@@ -1,59 +0,0 @@
-SUMMARY = "OP-TEE sanity testsuite"
-DESCRIPTION = "Open Portable Trusted Execution Environment - Test suite"
-HOMEPAGE = "https://gitee.com/phytium_embedded/phytium-optee"
-
-LICENSE = "BSD-2-Clause & GPL-2.0-only"
-LIC_FILES_CHKSUM = "file://LICENSE.md;md5=daa2bcccc666345ab8940aab1315a4fa"
-
-inherit python3native ptest
-inherit deploy
-require optee.inc
-
-DEPENDS = "optee-phytium-client optee-os-tadevkit python3-cryptography-native"
-
-S = "${WORKDIR}/git/ext/optee_test"
-B = "${WORKDIR}/build"
-
-EXTRA_OEMAKE += "TA_DEV_KIT_DIR=${TA_DEV_KIT_DIR} \
- CROSS_COMPILE_HOST=${HOST_PREFIX} \
- CROSS_COMPILE_TA=${HOST_PREFIX} \
- O=${B} \
- "
-
-do_compile() {
- cd ${S}
- # Top level makefile doesn't seem to handle parallel make gracefully
- oe_runmake xtest
- oe_runmake ta
- oe_runmake test_plugin
-}
-do_compile[cleandirs] = "${B}"
-
-do_install () {
- install -D -p -m0755 ${B}/xtest/xtest ${D}${bindir}/xtest
-
- # install path should match the value set in optee-client/tee-supplicant
- # default TEEC_LOAD_PATH is /lib
- mkdir -p ${D}${nonarch_base_libdir}/optee_armtz/
- install -D -p -m0444 ${B}/ta/*/*.ta ${D}${nonarch_base_libdir}/optee_armtz/
- mkdir -p ${D}${libdir}/tee-supplicant/plugins
- install -D -p -m0444 ${B}/supp_plugin/*.plugin ${D}${libdir}/tee-supplicant/plugins/
-}
-
-do_deploy () {
- install -d ${DEPLOYDIR}/${MLPREFIX}optee/ta
- install -m 644 ${B}/ta/*/*.elf ${DEPLOYDIR}/${MLPREFIX}optee/ta
-}
-
-addtask deploy before do_build after do_install
-
-FILES:${PN} += "${nonarch_base_libdir}/optee_armtz/ \
- ${libdir}/tee-supplicant/plugins/ \
- "
-
-# Imports machine specific configs from staging to build
-PACKAGE_ARCH = "${MACHINE_ARCH}"
-
-EXTRA_OEMAKE:append = " OPTEE_OPENSSL_EXPORT=${STAGING_INCDIR}"
-DEPENDS:append = " openssl"
-CFLAGS:append = " -Wno-error=deprecated-declarations"
diff --git a/meta-bsp/recipes-security/optee-phytium/optee.inc b/meta-bsp/recipes-security/optee-phytium/optee.inc
index aad45058aed54969f3ed3b43d220eff017139a3e..f06ee680e4fd8558f2375ae7a6dcc74ee64d69dd 100644
--- a/meta-bsp/recipes-security/optee-phytium/optee.inc
+++ b/meta-bsp/recipes-security/optee-phytium/optee.inc
@@ -7,7 +7,7 @@ OPTEE_ARCH = "arm64"
TA_DEV_KIT_DIR = "${STAGING_INCDIR}/optee/export-user_ta"
SRC_URI = "git://gitee.com/phytium_embedded/phytium-optee.git;protocol=https;nobranch=1"
-SRCREV = "4d1942c7627a6a2ef0af0f379452496f740b2cdc"
+SRCREV = "f3c36a1d77d9f5cf402585b584c3a4b344711494"
EXTRA_OEMAKE += "V=1 \
LIBGCC_LOCATE_CFLAGS='${HOST_CC_ARCH}${TOOLCHAIN_OPTIONS}' \
diff --git a/meta-xenomai/recipes-kernel/linux/linux-xenomai-phytium_4.19.bb b/meta-xenomai/recipes-kernel/linux/linux-xenomai-phytium_4.19.bb
index ddd2f7087898f8ff79fe3eb16e52ae85b19058ba..bb420832e40235168d2a7dc40a1b052d70864cba 100644
--- a/meta-xenomai/recipes-kernel/linux/linux-xenomai-phytium_4.19.bb
+++ b/meta-xenomai/recipes-kernel/linux/linux-xenomai-phytium_4.19.bb
@@ -5,5 +5,5 @@ SRC_URI:append = " file://0001-perf-bench-Share-some-global-variables-to-fix-bui
file://0001-perf-tests-bp_account-Make-global-variable-static.patch \
file://0001-libtraceevent-Fix-build-with-binutils-2.35.patch \
"
-SRCREV = "c2c05b35b29f83444071e41eda6dc6ae6880fc21"
+SRCREV = "62e2da7f646fc9424f64c3138cf47ccbd43e5477"
KERNEL_DEVICETREE ?= "phytium/e2000d-chillipi-edu-board.dtb phytium/e2000d-demo-board.dtb phytium/e2000d-miniitx-board.dtb phytium/e2000d-power-board.dtb phytium/e2000q-come-board.dtb phytium/e2000q-demo-board-xenomai-uart2.dtb phytium/e2000q-demo-board.dtb phytium/e2000q-edu-board.dtb phytium/e2000q-hanwei-board.dtb phytium/e2000q-miniitx-board.dtb phytium/e2000q-vpx-board.dtb phytium/e2000s-demo-board.dtb phytium/pd1904-devboard-d4-dsk.dtb phytium/pd1904c-devboard-d4-dsk.dtb phytium/pd2008-devboard-dsk.dtb phytium/phytiumpi_firefly.dtb"
diff --git a/meta-xenomai/recipes-kernel/linux/linux-xenomai-phytium_5.10.bb b/meta-xenomai/recipes-kernel/linux/linux-xenomai-phytium_5.10.bb
index 5803f868e6175c69ec569e736a5400315f4c8a92..bea17f220bc0e9dab3cd050e55a8361171713099 100644
--- a/meta-xenomai/recipes-kernel/linux/linux-xenomai-phytium_5.10.bb
+++ b/meta-xenomai/recipes-kernel/linux/linux-xenomai-phytium_5.10.bb
@@ -1,6 +1,5 @@
require linux-xenomai.inc
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
-KERNEL_BRANCH ?= "master"
-SRCREV = "a3354e6d12ec4263315d0cd33dcabd95036fd2bf"
-SRC_URI:append = " file://0001-Makefile-fix-cannot-find-.h.patch"
+KERNEL_BRANCH ?= "5.10.209-dovetail1"
+SRCREV = "c326dd201ea3af77542370ca3c81e2791db14429"
KERNEL_DEVICETREE ?= "phytium/e2000d-chillipi-edu-board.dtb phytium/e2000d-demo-board.dtb phytium/e2000d-miniitx-board.dtb phytium/e2000d-power-board.dtb phytium/e2000q-come-board.dtb phytium/e2000q-demo-board.dtb phytium/e2000q-edu-board.dtb phytium/e2000q-hanwei-board.dtb phytium/e2000q-miniitx-board.dtb phytium/e2000q-vpx-board.dtb phytium/e2000s-demo-board.dtb phytium/pd1904-devboard-d4-dsk.dtb phytium/pd1904c-devboard-d4-dsk.dtb phytium/pd2008-devboard-dsk.dtb phytium/phytiumpi_firefly.dtb"
diff --git a/meta-xenomai/recipes-xenomai/xenomai/xenomai_3.1.3.bb b/meta-xenomai/recipes-xenomai/xenomai/xenomai_3.1.5.bb
similarity index 87%
rename from meta-xenomai/recipes-xenomai/xenomai/xenomai_3.1.3.bb
rename to meta-xenomai/recipes-xenomai/xenomai/xenomai_3.1.5.bb
index ecb16f2f0423269bcfb99c8c37f7c291c930db73..885a80c43f4ecbd74cfbe3b4f506d0a09af34e16 100644
--- a/meta-xenomai/recipes-xenomai/xenomai/xenomai_3.1.3.bb
+++ b/meta-xenomai/recipes-xenomai/xenomai/xenomai_3.1.5.bb
@@ -5,8 +5,8 @@ LIC_FILES_CHKSUM = "file://README;md5=d804868a35cdacf02fc7ec9fc0d016a7"
SECTION = "xenomai"
HOMEPAGE = "http://www.xenomai.org/"
-XENOMAI_SRC = "xenomai-v3.1.3"
-SRC_URI = "https://source.denx.de/Xenomai/xenomai/-/archive/v3.1.3/${XENOMAI_SRC}.tar.bz2"
+XENOMAI_SRC = "xenomai-v3.1.5"
+SRC_URI = "https://source.denx.de/Xenomai/xenomai/-/archive/v3.1.5/${XENOMAI_SRC}.tar.bz2"
S = "${WORKDIR}/xenomai-v${PV}"
@@ -14,7 +14,7 @@ inherit autotools pkgconfig
includedir = "/usr/include/xenomai"
-SRC_URI[md5sum] = "38ba82b70180c2c7a95cdae1767c6de2"
+SRC_URI[md5sum] = "7ed9b0bda5e72e04fc0164d37244dcfe"
PACKAGES += "${PN}-demos"
diff --git a/meta-xenomai/recipes-xenomai/xenomai/xenomai_3.2.4.bb b/meta-xenomai/recipes-xenomai/xenomai/xenomai_3.2.6.bb
similarity index 88%
rename from meta-xenomai/recipes-xenomai/xenomai/xenomai_3.2.4.bb
rename to meta-xenomai/recipes-xenomai/xenomai/xenomai_3.2.6.bb
index bffc868ef4847338c20527b434c254ea1ca6b7b5..d1fd64295fb5a43506bf6fb3b72e3e8c84272bc2 100644
--- a/meta-xenomai/recipes-xenomai/xenomai/xenomai_3.2.4.bb
+++ b/meta-xenomai/recipes-xenomai/xenomai/xenomai_3.2.6.bb
@@ -5,8 +5,8 @@ LIC_FILES_CHKSUM = "file://README;md5=d804868a35cdacf02fc7ec9fc0d016a7"
SECTION = "xenomai"
HOMEPAGE = "http://www.xenomai.org/"
-XENOMAI_SRC = "xenomai-v3.2.4"
-SRC_URI = "https://source.denx.de/Xenomai/xenomai/-/archive/v3.2.4/${XENOMAI_SRC}.tar.bz2"
+XENOMAI_SRC = "xenomai-v3.2.6"
+SRC_URI = "https://source.denx.de/Xenomai/xenomai/-/archive/v3.2.6/${XENOMAI_SRC}.tar.bz2"
S = "${WORKDIR}/xenomai-v${PV}"
@@ -14,7 +14,7 @@ inherit autotools pkgconfig
includedir = "/usr/xenomai"
-SRC_URI[md5sum] = "8a1be4adb61a937d80360675187879a9"
+SRC_URI[md5sum] = "90267599c58a84e372aae172338ec44c"
do_install:append() {
install -d ${D}/usr/xenomai/include/
diff --git a/phyt_yocto_setenv.sh b/phyt_yocto_setenv.sh
new file mode 100644
index 0000000000000000000000000000000000000000..6be531c2b09c9045263810862dd3767ca248ef12
--- /dev/null
+++ b/phyt_yocto_setenv.sh
@@ -0,0 +1,62 @@
+#!/bin/bash
+
+# Copyright 2025 PHYTIUM
+
+toolchain=phytium-glibc-x86_64-meta-toolchain-aarch64-toolchain-4.0.6.sh
+
+host_pkg="build-essential chrpath cpio debianutils diffstat file gawk gcc git iputils-ping libacl1 liblz4-tool locales python3 python3-git python3-jinja2 python3-pexpect python3-pip python3-subunit socat texinfo unzip wget xz-utils zstd \
+"
+
+check_host_env() {
+ for pkg in $host_pkg; do
+ if ! dpkg-query -l $pkg | grep -q ii; then
+ echo installing $pkg ... && sudo apt install -y $pkg
+ fi
+ done
+}
+
+
+if [ ! -f pre-toolchain/$toolchain ]; then
+ echo "Download pre-built toolchains for yocto "
+ git clone --depth=1 --branch=develop https://gitee.com/phytium_embedded/phytium-rogue-umlibs.git toolchain
+ cd toolchain && git archive --format=tar.gz HEAD pre-toolchain/phytium-glibc-x86_64-meta-toolchain-aarch64-toolchain-4.0.6.sh > ../output.tar.gz
+ cd ../ && tar zxvf output.tar.gz && rm -rf toolchain && rm -rf output.tar.gz
+fi
+
+check_host_env
+
+if [ -f /tmp/var.tmp ]; then
+ target_sdk_dir=$(cat /tmp/var.tmp)
+fi
+
+if [ -d $target_sdk_dir ] && [ -n "$target_sdk_dir" ]; then
+ echo "Toolchain toolchain is already installed "
+else
+ echo "Installing toolchain in host"
+ sh pre-toolchain/$toolchain
+ target_sdk_dir=$(cat /tmp/var.tmp)
+fi
+
+if [ ! -d $HOME/bin ]; then
+ mkdir -p $HOME/bin
+fi
+curl https://mirrors.tuna.tsinghua.edu.cn/git/git-repo > ~/bin/repo
+export REPO_URL='https://mirrors.tuna.tsinghua.edu.cn/git/git-repo'
+chmod a+x ~/bin/repo
+PATH=~/bin:${PATH}
+if [ ! -d yocto-sdk ]; then
+ mkdir yocto-sdk
+ cd yocto-sdk
+ repo init -u ssh://git@gitlab.phytium.com.cn:12022/embedded/linux/phytium-linux-yocto -m default.xml
+ repo sync --force-sync
+ . ./setup-env -m phytium
+
+ echo $target_sdk_dir
+ echo 'EXTERNAL_TOOLCHAIN = "'$target_sdk_dir'"' >>conf/local.conf
+ echo 'TCMODE = "external-oe-sdk"' >>conf/local.conf
+ echo 'PREFERRED_PROVIDER_virtual/crypt = "libxcrypt"' >>conf/local.conf
+ echo 'PREFERRED_PROVIDER_linux-libc-headers = "glibc-external"' >>conf/local.conf
+ echo 'PREFERRED_PROVIDER_linux-libc-headers-dev = "glibc-external"' >>conf/local.conf
+ echo 'PREFERRED_PROVIDER_virtual/linux-libc-headers = "glibc-external"' >>conf/local.conf
+ echo 'CONNECTIVITY_CHECK_URIS = "https://gitee.com/"' >>conf/local.conf
+fi
diff --git a/tools/setup-env b/tools/setup-env
index 2f6def605cb4342698efde7dc97dc34f5012c51f..b8eddeaa19a1738067171e82f38c4a1f175c29fa 100644
--- a/tools/setup-env
+++ b/tools/setup-env
@@ -170,8 +170,7 @@ LAYER_LIST=" \
meta-openembedded/meta-initramfs \
meta-anaconda \
meta-phytium/meta-xenomai \
- meta-clang \
- meta-virtualization \
+ meta-external-toolchain \
"
DISTRO="phytium"