diff --git a/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc-2.0.4/0001-klibc-Kbuild-Accept-EXTRA_KLIBCAFLAGS.patch b/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc-2.0.4/0001-klibc-Kbuild-Accept-EXTRA_KLIBCAFLAGS.patch
new file mode 100644
index 0000000..94818e3
--- /dev/null
+++ b/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc-2.0.4/0001-klibc-Kbuild-Accept-EXTRA_KLIBCAFLAGS.patch
@@ -0,0 +1,28 @@
+From cdc6edc2cfcd0ce88d6e66654d605dad303b1a75 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Tue, 11 Sep 2018 17:03:36 -0700
+Subject: [PATCH] klibc/Kbuild: Accept EXTRA_KLIBCAFLAGS
+
+For passing additional assembler flags
+
+Upstream-Status: Pending
+
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ usr/klibc/Kbuild | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/usr/klibc/Kbuild b/usr/klibc/Kbuild
+index 98caf2e9..b34521e0 100644
+--- a/usr/klibc/Kbuild
++++ b/usr/klibc/Kbuild
+@@ -168,7 +168,8 @@ $(SOHASH): $(SOLIB) $(SOLIB).hash
+ targets += interp.o
+ 
+ quiet_cmd_interp = BUILD   $@
+-      cmd_interp = $(KLIBCCC) $(klibccflags) -D__ASSEMBLY__     \
++      cmd_interp = $(KLIBCCC) $(klibccflags) $(EXTRA_KLIBCAFLAGS) \
++                             -D__ASSEMBLY__     \
+                              -DLIBDIR=\"$(SHLIBDIR)\"         \
+ 			     -DSOHASH=\"$(SOLIBHASH)\" \
+ 			     -c -o $@ $<
diff --git a/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc-2.0.4/0001-klibc-add-getrandom-syscall.patch b/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc-2.0.4/0001-klibc-add-getrandom-syscall.patch
new file mode 100644
index 0000000..0768f6d
--- /dev/null
+++ b/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc-2.0.4/0001-klibc-add-getrandom-syscall.patch
@@ -0,0 +1,27 @@
+From e4d5d5224609d7d5c824dd231f5baec868befdfa Mon Sep 17 00:00:00 2001
+From: Andrea Adami <andrea.adami@gmail.com>
+Date: Tue, 4 Sep 2018 23:56:00 +0200
+Subject: [PATCH 1/1] klibc: add getrandom() syscall
+
+needed by latest kexec-tools for qemuarm64 (kashan)
+
+Signed-off-by: Andrea Adami <andrea.adami@gmail.com>
+---
+ usr/klibc/SYSCALLS.def | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/usr/klibc/SYSCALLS.def b/usr/klibc/SYSCALLS.def
+index 6b3bf4c..d4184ba 100644
+--- a/usr/klibc/SYSCALLS.def
++++ b/usr/klibc/SYSCALLS.def
+@@ -274,6 +274,7 @@ int syslog::klogctl(int, char *, int);
+ int sysinfo(struct sysinfo *);
+ long kexec_load(void *, unsigned long, struct kexec_segment *, unsigned long);
+ <x86_64,ppc64,s390x> long kexec_file_load(int, int, unsigned long, const char *, unsigned long);
++ssize_t getrandom(void *, size_t, unsigned int);
+ 
+ /*
+  * Low-level I/O (generally architecture-specific);
+-- 
+2.7.4
+
diff --git a/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc-2.0.4/0001-klibc-static-utils-do-not-build-shared-binaries.patch b/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc-2.0.4/0001-klibc-static-utils-do-not-build-shared-binaries.patch
new file mode 100644
index 0000000..2f7cd35
--- /dev/null
+++ b/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc-2.0.4/0001-klibc-static-utils-do-not-build-shared-binaries.patch
@@ -0,0 +1,213 @@
+From c034dceae17b7d8d437871afe5eba55a55434222 Mon Sep 17 00:00:00 2001
+From: Andrea Adami <andrea.adami@gmail.com>
+Date: Wed, 10 Oct 2018 00:48:31 +0200
+Subject: [PATCH] klibc-static-utils: do not build shared binaries
+
+We were building some shared utilities and this was leading to linker errors
+for x86 with security flags enabled.
+
+Fix
+ i586-oe-linux-musl-ld.bfd: discarded output section: `.got.plt'
+
+Upstream-Status: Inappropriate [Embedded Specific]
+
+Signed-off-by: Andrea Adami <andrea.adami@gmail.com>
+---
+ usr/dash/Kbuild           | 6 +-----
+ usr/kinit/Kbuild          | 4 +---
+ usr/kinit/fstype/Kbuild   | 4 +---
+ usr/kinit/ipconfig/Kbuild | 4 +---
+ usr/kinit/nfsmount/Kbuild | 4 +---
+ usr/kinit/resume/Kbuild   | 5 +----
+ usr/kinit/run-init/Kbuild | 5 +----
+ usr/utils/Kbuild          | 7 ++-----
+ 8 files changed, 9 insertions(+), 30 deletions(-)
+
+diff --git a/usr/dash/Kbuild b/usr/dash/Kbuild
+index 1a6920a..b3a4e64 100644
+--- a/usr/dash/Kbuild
++++ b/usr/dash/Kbuild
+@@ -25,12 +25,8 @@ gen-h-files := builtins.h nodes.h syntax.h token.h
+ 
+ static-y := sh
+ 
+-# The shared binary
+-shared-y    := sh.shared
+-sh.shared-y := $(sh-y)
+-
+ # For cleaning
+-targets := sh sh.g sh.shared sh.shared.g $(gen-o-files)
++targets := sh sh.g $(gen-o-files)
+ 
+ # explicit dependency for all generated files
+ $(addprefix $(obj)/, $(sh-y)): $(addprefix $(obj)/, $(gen-h-files))
+diff --git a/usr/kinit/Kbuild b/usr/kinit/Kbuild
+index f7fdccd..8db06ab 100644
+--- a/usr/kinit/Kbuild
++++ b/usr/kinit/Kbuild
+@@ -18,8 +18,6 @@ kinit-y  += fstype/
+ kinit-y  += resume/
+ 
+ static-y := kinit
+-shared-y := kinit.shared
+-kinit.shared-y := $(kinit-y)
+ 
+ # Additional include paths files
+ KLIBCCFLAGS += -I$(srctree)/$(src)/fstype \
+@@ -29,7 +27,7 @@ KLIBCCFLAGS += -I$(srctree)/$(src)/fstype \
+  	       -I$(srctree)/$(src)/run-init
+ 
+ # Cleaning
+-targets += kinit kinit.g kinit.shared kinit.shared.g
++targets += kinit kinit.g
+ subdir- := fstype ipconfig nfsmount resume run-init
+ 
+ 
+diff --git a/usr/kinit/fstype/Kbuild b/usr/kinit/fstype/Kbuild
+index 367611d..8d453ea 100644
+--- a/usr/kinit/fstype/Kbuild
++++ b/usr/kinit/fstype/Kbuild
+@@ -3,7 +3,6 @@
+ #
+ 
+ static-y := static/fstype
+-shared-y := shared/fstype
+ 
+ # common .o files
+ objs := main.o fstype.o
+@@ -16,8 +15,7 @@ lib-y := $(objs)
+ 
+ # .o files used to built executables
+ static/fstype-y := $(objs)
+-shared/fstype-y := $(objs)
+ 
+ # Cleaning
+-clean-dirs := static shared
++clean-dirs := static
+ 
+diff --git a/usr/kinit/ipconfig/Kbuild b/usr/kinit/ipconfig/Kbuild
+index eb1d472..ef87e7e 100644
+--- a/usr/kinit/ipconfig/Kbuild
++++ b/usr/kinit/ipconfig/Kbuild
+@@ -3,7 +3,6 @@
+ #
+ 
+ static-y := static/ipconfig
+-shared-y := shared/ipconfig
+ 
+ # common .o files
+ objs := main.o netdev.o packet.o
+@@ -22,8 +21,7 @@ lib-y := $(objs)
+ 
+ # .o files used to built executables
+ static/ipconfig-y := $(objs)
+-shared/ipconfig-y := $(objs)
+ 
+ # Cleaning
+-clean-dirs := static shared
++clean-dirs := static
+ 
+diff --git a/usr/kinit/nfsmount/Kbuild b/usr/kinit/nfsmount/Kbuild
+index ba31708..01bedce 100644
+--- a/usr/kinit/nfsmount/Kbuild
++++ b/usr/kinit/nfsmount/Kbuild
+@@ -4,7 +4,6 @@
+ 
+ static-y := static/nfsmount
+ #FIXME - build is broken static-y := dummypmap
+-shared-y := shared/nfsmount
+ 
+ objs := main.o mount.o portmap.o dummypmap.o sunrpc.o
+ 
+@@ -13,7 +12,6 @@ lib-y := $(objs)
+ 
+ # .o files used for executables
+ static/nfsmount-y := $(objs)
+-shared/nfsmount-y := $(objs)
+ 
+ # dummypmap uses a single .o file (rename src file?)
+ dummypmap-y := dummypmap_test.o
+@@ -21,5 +19,5 @@ dummypmap-y := dummypmap_test.o
+ # TODO - do we want a stripped version
+ # TODO - do we want the static.g + shared.g directories?
+ 
+-clean-dirs := static shared
++clean-dirs := static
+ 
+diff --git a/usr/kinit/resume/Kbuild b/usr/kinit/resume/Kbuild
+index c1342e1..15b9590 100644
+--- a/usr/kinit/resume/Kbuild
++++ b/usr/kinit/resume/Kbuild
+@@ -3,7 +3,6 @@
+ #
+ 
+ static-y := static/resume
+-shared-y := shared/resume
+ 
+ # common .o files
+ objs := resume.o resumelib.o
+@@ -20,9 +19,7 @@ KLIBCCFLAGS += -I$(srctree)/$(src)/..
+ # .o files used to built executables
+ static/resume-y   := $(objs)
+ static/resume-lib := ../lib.a
+-shared/resume-y   := $(objs)
+-shared/resume-lib := ../lib.a
+ 
+ # Cleaning
+-clean-dirs := static shared
++clean-dirs := static
+ 
+diff --git a/usr/kinit/run-init/Kbuild b/usr/kinit/run-init/Kbuild
+index c153b0a..a1ea834 100644
+--- a/usr/kinit/run-init/Kbuild
++++ b/usr/kinit/run-init/Kbuild
+@@ -3,7 +3,6 @@
+ #
+ 
+ static-y := static/run-init
+-shared-y := shared/run-init
+ 
+ # common .o files
+ objs := run-init.o runinitlib.o
+@@ -24,9 +23,7 @@ KLIBCCFLAGS += -I$(srctree)/$(src)/..
+ # .o files used to built executables
+ static/run-init-y   := $(objs)
+ static/run-init-lib := ../lib.a
+-shared/run-init-y   := $(objs)
+-shared/run-init-lib := ../lib.a
+ 
+ # Cleaning
+-clean-dirs := static shared
++clean-dirs := static
+ 
+diff --git a/usr/utils/Kbuild b/usr/utils/Kbuild
+index 67d9486..1573363 100644
+--- a/usr/utils/Kbuild
++++ b/usr/utils/Kbuild
+@@ -7,7 +7,6 @@ progs += true false sleep ln mv nuke minips cat ls losetup
+ progs += uname halt kill readlink cpio sync dmesg
+ 
+ static-y := $(addprefix static/, $(progs))
+-shared-y := $(addprefix shared/, $(progs))
+ 
+ # The binary is placed in a subdir, so we need to tell kbuild this
+ static/chroot-y     := chroot.o
+@@ -62,13 +61,11 @@ static/losetup-y    := losetup.o
+ shared/losetup-y    := losetup.o
+ 
+ # Additionally linked targets
+-always := static/reboot static/poweroff shared/reboot shared/poweroff
++always := static/reboot static/poweroff
+ 
+ $(obj)/static/reboot $(obj)/static/poweroff: $(obj)/static/halt
+ 	$(call cmd,ln)
+-$(obj)/shared/reboot $(obj)/shared/poweroff: $(obj)/shared/halt
+-	$(call cmd,ln)
+ 
+ # Clean deletes the static and shared dir
+-clean-dirs := static shared
++clean-dirs := static
+ 
+-- 
+2.7.4
+
diff --git a/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc-2.0.4/0001-klibc_2.0.4-add-kexec_file_load-syscall.patch b/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc-2.0.4/0001-klibc_2.0.4-add-kexec_file_load-syscall.patch
new file mode 100644
index 0000000..3d8d987
--- /dev/null
+++ b/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc-2.0.4/0001-klibc_2.0.4-add-kexec_file_load-syscall.patch
@@ -0,0 +1,27 @@
+From 90683d5eaabfa684a71411d6e3262153ac191ad8 Mon Sep 17 00:00:00 2001
+From: Andrea Adami <andrea.adami@gmail.com>
+Date: Tue, 4 Sep 2018 23:44:30 +0200
+Subject: [PATCH 1/1] klibc_2.0.4: add kexec_file_load syscall
+
+for supported archs only (matched in kexec-tools)
+
+Signed-off-by: Andrea Adami <andrea.adami@gmail.com>
+---
+ usr/klibc/SYSCALLS.def | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/usr/klibc/SYSCALLS.def b/usr/klibc/SYSCALLS.def
+index c56e8f9..6b3bf4c 100644
+--- a/usr/klibc/SYSCALLS.def
++++ b/usr/klibc/SYSCALLS.def
+@@ -273,6 +273,7 @@ int reboot::__reboot(int, int, int, void *);
+ int syslog::klogctl(int, char *, int);
+ int sysinfo(struct sysinfo *);
+ long kexec_load(void *, unsigned long, struct kexec_segment *, unsigned long);
++<x86_64,ppc64,s390x> long kexec_file_load(int, int, unsigned long, const char *, unsigned long);
+ 
+ /*
+  * Low-level I/O (generally architecture-specific);
+-- 
+2.7.4
+
diff --git a/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc-2.0.4/klcc-cross-accept-clang-options.patch b/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc-2.0.4/klcc-cross-accept-clang-options.patch
new file mode 100644
index 0000000..07703aa
--- /dev/null
+++ b/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc-2.0.4/klcc-cross-accept-clang-options.patch
@@ -0,0 +1,19 @@
+meta-clang passes this option to compiler defaults
+
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+
+Index: git/klcc/klcc.in
+===================================================================
+--- git.orig/klcc/klcc.in
++++ git/klcc/klcc.in
+@@ -207,6 +207,9 @@ while ( defined($a = shift(@ARGV)) ) {
+     } elsif ( $a =~ /^--([sysroot=])(.*)$/ ) {
+ 	# Override gcc encoded sysroot
+ 	push(@ccopt, $a);
++    } elsif ( $a eq '-no-integrated-as' ) {
++	# Allow clang options
++	push(@ccopt, $a);
+     } else {
+ 	die "$0: unknown option: $a\n";
+     }
diff --git a/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc-static-utils_2.0.4.bb b/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc-static-utils_2.0.4.bb
index c835fd6..1677863 100644
--- a/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc-static-utils_2.0.4.bb
+++ b/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc-static-utils_2.0.4.bb
@@ -10,3 +10,9 @@
 
 require klibc-utils.inc
 require klibc.inc
+
+SRC_URI += "file://0001-klibc-static-utils-do-not-build-shared-binaries.patch"
+
+# avoid textrel if linking with -pie
+SECURITY_CFLAGS = ""
+SECURITY_LDFLAGS = ""
diff --git a/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc-utils.inc b/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc-utils.inc
index 7df33d6..2aac9e6 100644
--- a/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc-utils.inc
+++ b/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc-utils.inc
@@ -1,16 +1,16 @@
 do_install() {
     install -d ${D}${base_bindir}
     install -d ${D}${base_sbindir}
-    # debian packages kinit + kinit.shared but only sh.shared
     if [ "${KLIBC_UTILS_VARIANT}" = "shared" ]; then
-        install -m 755 usr/kinit/kinit ${D}${base_bindir}/kinit
         install -m 755 usr/kinit/kinit.shared ${D}${base_bindir}/kinit.shared
         install -m 755 usr/dash/sh.shared ${D}${base_bindir}/sh.shared
     else
         install -m 755 usr/dash/sh ${D}${base_bindir}/sh
         install -m 755 usr/kinit/kinit ${D}${base_bindir}/kinit
+        install -m 755 usr/gzip/gzip ${D}${base_bindir}
+        ln -s gzip ${D}${base_bindir}/gunzip
+        ln -s gzip ${D}${base_bindir}/zcat
     fi
-    install -m 755 usr/gzip/gzip ${D}${base_bindir}
     install -m 755 usr/kinit/fstype/${KLIBC_UTILS_VARIANT}/fstype ${D}${base_bindir}
     install -m 755 usr/kinit/ipconfig/${KLIBC_UTILS_VARIANT}/ipconfig ${D}${base_bindir}
     install -m 755 usr/kinit/nfsmount/${KLIBC_UTILS_VARIANT}/nfsmount ${D}${base_bindir}
@@ -44,8 +44,6 @@
     install -m 755 usr/utils/${KLIBC_UTILS_VARIANT}/true ${D}${base_bindir}
     install -m 755 usr/utils/${KLIBC_UTILS_VARIANT}/umount ${D}${base_bindir}
     install -m 755 usr/utils/${KLIBC_UTILS_VARIANT}/uname ${D}${base_bindir}
-    ln -s gzip ${D}${base_bindir}/gunzip
-    ln -s gzip ${D}${base_bindir}/zcat
 }
 
 EXTRA_KLIBC_DEPS = "${@oe.utils.conditional('KLIBC_UTILS_VARIANT', 'shared', '${THIS_LIBKLIBC}', '', d)}"
diff --git a/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc.inc b/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc.inc
index 30294b1..be01c2f 100644
--- a/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc.inc
+++ b/meta-openembedded/meta-initramfs/recipes-devtools/klibc/klibc.inc
@@ -12,6 +12,7 @@
            file://klibc-linux-libc-dev.patch \
            file://staging.patch \
            file://klcc-consider-sysroot.patch \
+           file://klcc-cross-accept-clang-options.patch \
            file://0001-dash-Specify-format-string-in-fmtstr.patch \
            file://0001-Define-in_-structs-for-non-glibc-system-libs.patch \
            file://0001-include-linux-sysinfo.h-directly.patch \
@@ -20,7 +21,10 @@
            file://0001-Kbuild.klibc-Use-print-libgcc-file-name-instead-of-p.patch \
            file://0001-Kbuild.klibc-Add-path-to-compiler-headers-via-isyste.patch \
            file://0001-arm-Do-not-set-a-fallback-march-and-mtune.patch \
-"
+           file://0001-klibc_2.0.4-add-kexec_file_load-syscall.patch \
+           file://0001-klibc-add-getrandom-syscall.patch \
+           file://0001-klibc-Kbuild-Accept-EXTRA_KLIBCAFLAGS.patch \
+           "
 
 ARMPATCHES ?= ""
 
@@ -28,7 +32,6 @@
                   file://armv4-fix-v4bx.patch \
                  "
 
-
 S = "${WORKDIR}/git"
 
 PARALLEL_MAKE = ""
@@ -44,6 +47,8 @@
                 'KLIBCOPTFLAGS=${TUNE_CCARGS} -Os' \
                  V=1 \
                 "
+EXTRA_OEMAKE += "'EXTRA_KLIBCAFLAGS=${SECURITY_CFLAGS} -Wa,--noexecstack' \
+                 'EXTRA_KLIBCLDFLAGS=${SECURITY_LDFLAGS} -z noexecstack'"
 
 export FIX_ARMV4_EABI_BX = "${FIX_V4BX}"
 KLIBCTHUMB = "${@['CONFIG_KLIBC_THUMB=n', 'CONFIG_KLIBC_THUMB=y'][(d.getVar('ARM_INSTRUCTION_SET') == 'thumb')]}"
@@ -70,5 +75,7 @@
 KLIBC_ARCH_powerpc64 = "ppc64"
 THIS_LIBKLIBC = "libklibc (= ${PV}-${PR})"
 
-SECURITY_CFLAGS = "-fno-PIE -no-pie"
-SECURITY_LDFLAGS = "-no-pie"
+GCCPIE ?= ""
+SECURITY_LDFLAGS = "${@'-z relro -z now -pie' if '${GCCPIE}' else ''}"
+SECURITY_LDFLAGS_mips = ""
+SECURITY_LDFLAGS_mips64 = ""