diff --git a/meson.build b/meson.build
index 22ab16c3a4..8145a587b0 100644
--- a/meson.build
+++ b/meson.build
@@ -283,7 +283,7 @@ subdir('python')
 subdir('tools')
 
 if get_option('libc') == 'glibc'
-    subproject('glibc-2.38-1')
+    subproject('glibc-2.39-1')
 elif get_option('libc') == 'musl'
     subproject('musl-1.2.4')
 endif
diff --git a/subprojects/glibc-2.38-1.wrap b/subprojects/glibc-2.39-1.wrap
similarity index 52%
rename from subprojects/glibc-2.38-1.wrap
rename to subprojects/glibc-2.39-1.wrap
index 2cdc9bc745..2fd7f1c5cc 100644
--- a/subprojects/glibc-2.38-1.wrap
+++ b/subprojects/glibc-2.39-1.wrap
@@ -1,15 +1,15 @@
 # NOTE: We use a custom version number (the `-1` suffix) to force Meson to rebuild when there is a
 # breaking change to the interface between Glibc and Gramine. The important part is that the
-# directory in `subprojects` has to change (`subprojects/glibc-2.38-1`, `subprojects/glibc-2.38-2`
+# directory in `subprojects` has to change (`subprojects/glibc-2.39-1`, `subprojects/glibc-2.39-2`
 # etc.)
 
 [wrap-file]
-directory = glibc-2.38-1
-source_url = https://ftp.gnu.org/gnu/glibc/glibc-2.38.tar.gz
-source_fallback_url = https://packages.gramineproject.io/distfiles/glibc-2.38.tar.gz
-source_filename = glibc-2.38.tar.gz
-source_hash = 16e51e0455e288f03380b436e41d5927c60945abd86d0c9852b84be57dd6ed5e
-patch_directory = glibc-2.38
+directory = glibc-2.39-1
+source_url = https://ftp.gnu.org/gnu/glibc/glibc-2.39.tar.gz
+source_fallback_url = https://packages.gramineproject.io/distfiles/glibc-2.39.tar.gz
+source_filename = glibc-2.39.tar.gz
+source_hash = 97f84f3b7588cd54093a6f6389b0c1a81e70d99708d74963a2e3eab7c7dc942d
+patch_directory = glibc-2.39
 
-# this unpacks the sources to `glibc-2.38-1/glibc-2.38`
+# this unpacks the sources to `glibc-2.39-1/glibc-2.39`
 lead_directory_missing = true
diff --git a/subprojects/packagefiles/glibc-2.38/fix-CVE-2023-4527.patch b/subprojects/packagefiles/glibc-2.38/fix-CVE-2023-4527.patch
deleted file mode 100644
index 2b97b97652..0000000000
--- a/subprojects/packagefiles/glibc-2.38/fix-CVE-2023-4527.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/resolv/nss_dns/dns-host.c b/resolv/nss_dns/dns-host.c
-index 1d60c51f5e0ec1aa146872e3af5a4909a7660f57..5d0ab30de6e9da6b1d08b8e7d85bdbfc0e8fa567 100644 (file)
---- a/resolv/nss_dns/dns-host.c
-+++ b/resolv/nss_dns/dns-host.c
-@@ -427,7 +427,7 @@ _nss_dns_gethostbyname4_r (const char *name, struct gaih_addrtuple **pat,
-     {
-       n = __res_context_search (ctx, name, C_IN, T_A,
- 				dns_packet_buffer, sizeof (dns_packet_buffer),
--				NULL, NULL, NULL, NULL, NULL);
-+				&alt_dns_packet_buffer, NULL, NULL, NULL, NULL);
-       if (n >= 0)
- 	status = gaih_getanswer_noaaaa (alt_dns_packet_buffer, n,
- 					&abuf, pat, errnop, herrnop, ttlp);
diff --git a/subprojects/packagefiles/glibc-2.38/fix-CVE-2023-4806.patch b/subprojects/packagefiles/glibc-2.38/fix-CVE-2023-4806.patch
deleted file mode 100644
index 7404bc4166..0000000000
--- a/subprojects/packagefiles/glibc-2.38/fix-CVE-2023-4806.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
-index 0356b622be6dda5e6ac9bf70c9813cc1351a0b81..b2236b105c1651201bdfe0e80b5a4995c90acd84 100644 (file)
---- a/sysdeps/posix/getaddrinfo.c
-+++ b/sysdeps/posix/getaddrinfo.c
-@@ -120,6 +120,7 @@ struct gaih_result
- {
-   struct gaih_addrtuple *at;
-   char *canon;
-+  char *h_name;
-   bool free_at;
-   bool got_ipv6;
- };
-@@ -165,6 +166,7 @@ gaih_result_reset (struct gaih_result *res)
-   if (res->free_at)
-     free (res->at);
-   free (res->canon);
-+  free (res->h_name);
-   memset (res, 0, sizeof (*res));
- }
- 
-@@ -203,9 +205,8 @@ gaih_inet_serv (const char *servicename, const struct gaih_typeproto *tp,
-   return 0;
- }
- 
--/* Convert struct hostent to a list of struct gaih_addrtuple objects.  h_name
--   is not copied, and the struct hostent object must not be deallocated
--   prematurely.  The new addresses are appended to the tuple array in RES.  */
-+/* Convert struct hostent to a list of struct gaih_addrtuple objects.  The new
-+   addresses are appended to the tuple array in RES.  */
- static bool
- convert_hostent_to_gaih_addrtuple (const struct addrinfo *req, int family,
- 				   struct hostent *h, struct gaih_result *res)
-@@ -238,6 +239,15 @@ convert_hostent_to_gaih_addrtuple (const struct addrinfo *req, int family,
-   res->at = array;
-   res->free_at = true;
- 
-+  /* Duplicate h_name because it may get reclaimed when the underlying storage
-+     is freed.  */
-+  if (res->h_name == NULL)
-+    {
-+      res->h_name = __strdup (h->h_name);
-+      if (res->h_name == NULL)
-+	return false;
-+    }
-+
-   /* Update the next pointers on reallocation.  */
-   for (size_t i = 0; i < old; i++)
-     array[i].next = array + i + 1;
-@@ -262,7 +272,6 @@ convert_hostent_to_gaih_addrtuple (const struct addrinfo *req, int family,
- 	}
-       array[i].next = array + i + 1;
-     }
--  array[0].name = h->h_name;
-   array[count - 1].next = NULL;
- 
-   return true;
-@@ -324,15 +333,15 @@ gethosts (nss_gethostbyname3_r fct, int family, const char *name,
-    memory allocation failure.  The returned string is allocated on the
-    heap; the caller has to free it.  */
- static char *
--getcanonname (nss_action_list nip, struct gaih_addrtuple *at, const char *name)
-+getcanonname (nss_action_list nip, const char *hname, const char *name)
- {
-   nss_getcanonname_r *cfct = __nss_lookup_function (nip, "getcanonname_r");
-   char *s = (char *) name;
-   if (cfct != NULL)
-     {
-       char buf[256];
--      if (DL_CALL_FCT (cfct, (at->name ?: name, buf, sizeof (buf),
--			      &s, &errno, &h_errno)) != NSS_STATUS_SUCCESS)
-+      if (DL_CALL_FCT (cfct, (hname ?: name, buf, sizeof (buf), &s, &errno,
-+			      &h_errno)) != NSS_STATUS_SUCCESS)
- 	/* If the canonical name cannot be determined, use the passed
- 	   string.  */
- 	s = (char *) name;
-@@ -771,7 +780,7 @@ get_nss_addresses (const char *name, const struct addrinfo *req,
- 		  if ((req->ai_flags & AI_CANONNAME) != 0
- 		      && res->canon == NULL)
- 		    {
--		      char *canonbuf = getcanonname (nip, res->at, name);
-+		      char *canonbuf = getcanonname (nip, res->h_name, name);
- 		      if (canonbuf == NULL)
- 			{
- 			  __resolv_context_put (res_ctx);
diff --git a/subprojects/packagefiles/glibc-2.38/fix-CVE-2023-4911.patch b/subprojects/packagefiles/glibc-2.38/fix-CVE-2023-4911.patch
deleted file mode 100644
index 46e8e4eeb1..0000000000
--- a/subprojects/packagefiles/glibc-2.38/fix-CVE-2023-4911.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-diff --git a/elf/dl-tunables.c b/elf/dl-tunables.c
-index 62b7332d95b61ce3428040522271f6e93e9d53ed..cae67efa0aacb9984c49874dcb95f170ecd1d86d 100644 (file)
---- a/elf/dl-tunables.c
-+++ b/elf/dl-tunables.c
-@@ -180,11 +180,7 @@ parse_tunables (char *tunestr, char *valstring)
-       /* If we reach the end of the string before getting a valid name-value
- 	 pair, bail out.  */
-       if (p[len] == '\0')
--	{
--	  if (__libc_enable_secure)
--	    tunestr[off] = '\0';
--	  return;
--	}
-+	break;
- 
-       /* We did not find a valid name-value pair before encountering the
- 	 colon.  */
-@@ -244,9 +240,16 @@ parse_tunables (char *tunestr, char *valstring)
- 	    }
- 	}
- 
--      if (p[len] != '\0')
--	p += len + 1;
-+      /* We reached the end while processing the tunable string.  */
-+      if (p[len] == '\0')
-+	break;
-+
-+      p += len + 1;
-     }
-+
-+  /* Terminate tunestr before we leave.  */
-+  if (__libc_enable_secure)
-+    tunestr[off] = '\0';
- }
- 
- /* Enable the glibc.malloc.check tunable in SETUID/SETGID programs only when
diff --git a/subprojects/packagefiles/glibc-2.38/fix-CVE-2023-5156.patch b/subprojects/packagefiles/glibc-2.38/fix-CVE-2023-5156.patch
deleted file mode 100644
index 0bbed93155..0000000000
--- a/subprojects/packagefiles/glibc-2.38/fix-CVE-2023-5156.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
-index b2236b105c1651201bdfe0e80b5a4995c90acd84..13082305d3f89316ae9d685857470835c747f895 100644 (file)
---- a/sysdeps/posix/getaddrinfo.c
-+++ b/sysdeps/posix/getaddrinfo.c
-@@ -1196,9 +1196,7 @@ free_and_return:
-   if (malloc_name)
-     free ((char *) name);
-   free (addrmem);
--  if (res.free_at)
--    free (res.at);
--  free (res.canon);
-+  gaih_result_reset (&res);
- 
-   return result;
- }
diff --git a/subprojects/packagefiles/glibc-2.38/fix-bug-30723.patch b/subprojects/packagefiles/glibc-2.38/fix-bug-30723.patch
deleted file mode 100644
index f145e3b35a..0000000000
--- a/subprojects/packagefiles/glibc-2.38/fix-bug-30723.patch
+++ /dev/null
@@ -1,468 +0,0 @@
-diff --git a/malloc/malloc.c b/malloc/malloc.c
-index e2f1a615a4fc7b036e188a28de9cfb132b2351df..d0bbbf371048ee8aa8a30c03b189cb268b8ad9e4 100644 (file)
---- a/malloc/malloc.c
-+++ b/malloc/malloc.c
-@@ -1086,6 +1086,11 @@ typedef struct malloc_chunk* mchunkptr;
- 
- static void*  _int_malloc(mstate, size_t);
- static void     _int_free(mstate, mchunkptr, int);
-+static void _int_free_merge_chunk (mstate, mchunkptr, INTERNAL_SIZE_T);
-+static INTERNAL_SIZE_T _int_free_create_chunk (mstate,
-+					       mchunkptr, INTERNAL_SIZE_T,
-+					       mchunkptr, INTERNAL_SIZE_T);
-+static void _int_free_maybe_consolidate (mstate, INTERNAL_SIZE_T);
- static void*  _int_realloc(mstate, mchunkptr, INTERNAL_SIZE_T,
- 			   INTERNAL_SIZE_T);
- static void*  _int_memalign(mstate, size_t, size_t);
-@@ -4483,12 +4488,6 @@ _int_free (mstate av, mchunkptr p, int have_lock)
- {
-   INTERNAL_SIZE_T size;        /* its size */
-   mfastbinptr *fb;             /* associated fastbin */
--  mchunkptr nextchunk;         /* next contiguous chunk */
--  INTERNAL_SIZE_T nextsize;    /* its size */
--  int nextinuse;               /* true if nextchunk is used */
--  INTERNAL_SIZE_T prevsize;    /* size of previous contiguous chunk */
--  mchunkptr bck;               /* misc temp for linking */
--  mchunkptr fwd;               /* misc temp for linking */
- 
-   size = chunksize (p);
- 
-@@ -4637,31 +4636,52 @@ _int_free (mstate av, mchunkptr p, int have_lock)
-     if (!have_lock)
-       __libc_lock_lock (av->mutex);
- 
--    nextchunk = chunk_at_offset(p, size);
--
--    /* Lightweight tests: check whether the block is already the
--       top block.  */
--    if (__glibc_unlikely (p == av->top))
--      malloc_printerr ("double free or corruption (top)");
--    /* Or whether the next chunk is beyond the boundaries of the arena.  */
--    if (__builtin_expect (contiguous (av)
--			  && (char *) nextchunk
--			  >= ((char *) av->top + chunksize(av->top)), 0))
--	malloc_printerr ("double free or corruption (out)");
--    /* Or whether the block is actually not marked used.  */
--    if (__glibc_unlikely (!prev_inuse(nextchunk)))
--      malloc_printerr ("double free or corruption (!prev)");
--
--    nextsize = chunksize(nextchunk);
--    if (__builtin_expect (chunksize_nomask (nextchunk) <= CHUNK_HDR_SZ, 0)
--	|| __builtin_expect (nextsize >= av->system_mem, 0))
--      malloc_printerr ("free(): invalid next size (normal)");
-+    _int_free_merge_chunk (av, p, size);
- 
--    free_perturb (chunk2mem(p), size - CHUNK_HDR_SZ);
-+    if (!have_lock)
-+      __libc_lock_unlock (av->mutex);
-+  }
-+  /*
-+    If the chunk was allocated via mmap, release via munmap().
-+  */
- 
--    /* consolidate backward */
--    if (!prev_inuse(p)) {
--      prevsize = prev_size (p);
-+  else {
-+    munmap_chunk (p);
-+  }
-+}
-+
-+/* Try to merge chunk P of SIZE bytes with its neighbors.  Put the
-+   resulting chunk on the appropriate bin list.  P must not be on a
-+   bin list yet, and it can be in use.  */
-+static void
-+_int_free_merge_chunk (mstate av, mchunkptr p, INTERNAL_SIZE_T size)
-+{
-+  mchunkptr nextchunk = chunk_at_offset(p, size);
-+
-+  /* Lightweight tests: check whether the block is already the
-+     top block.  */
-+  if (__glibc_unlikely (p == av->top))
-+    malloc_printerr ("double free or corruption (top)");
-+  /* Or whether the next chunk is beyond the boundaries of the arena.  */
-+  if (__builtin_expect (contiguous (av)
-+			&& (char *) nextchunk
-+			>= ((char *) av->top + chunksize(av->top)), 0))
-+    malloc_printerr ("double free or corruption (out)");
-+  /* Or whether the block is actually not marked used.  */
-+  if (__glibc_unlikely (!prev_inuse(nextchunk)))
-+    malloc_printerr ("double free or corruption (!prev)");
-+
-+  INTERNAL_SIZE_T nextsize = chunksize(nextchunk);
-+  if (__builtin_expect (chunksize_nomask (nextchunk) <= CHUNK_HDR_SZ, 0)
-+      || __builtin_expect (nextsize >= av->system_mem, 0))
-+    malloc_printerr ("free(): invalid next size (normal)");
-+
-+  free_perturb (chunk2mem(p), size - CHUNK_HDR_SZ);
-+
-+  /* Consolidate backward.  */
-+  if (!prev_inuse(p))
-+    {
-+      INTERNAL_SIZE_T prevsize = prev_size (p);
-       size += prevsize;
-       p = chunk_at_offset(p, -((long) prevsize));
-       if (__glibc_unlikely (chunksize(p) != prevsize))
-@@ -4669,9 +4689,25 @@ _int_free (mstate av, mchunkptr p, int have_lock)
-       unlink_chunk (av, p);
-     }
- 
--    if (nextchunk != av->top) {
-+  /* Write the chunk header, maybe after merging with the following chunk.  */
-+  size = _int_free_create_chunk (av, p, size, nextchunk, nextsize);
-+  _int_free_maybe_consolidate (av, size);
-+}
-+
-+/* Create a chunk at P of SIZE bytes, with SIZE potentially increased
-+   to cover the immediately following chunk NEXTCHUNK of NEXTSIZE
-+   bytes (if NEXTCHUNK is unused).  The chunk at P is not actually
-+   read and does not have to be initialized.  After creation, it is
-+   placed on the appropriate bin list.  The function returns the size
-+   of the new chunk.  */
-+static INTERNAL_SIZE_T
-+_int_free_create_chunk (mstate av, mchunkptr p, INTERNAL_SIZE_T size,
-+			mchunkptr nextchunk, INTERNAL_SIZE_T nextsize)
-+{
-+  if (nextchunk != av->top)
-+    {
-       /* get and clear inuse bit */
--      nextinuse = inuse_bit_at_offset(nextchunk, nextsize);
-+      bool nextinuse = inuse_bit_at_offset (nextchunk, nextsize);
- 
-       /* consolidate forward */
-       if (!nextinuse) {
-@@ -4686,8 +4722,8 @@ _int_free (mstate av, mchunkptr p, int have_lock)
- 	been given one chance to be used in malloc.
-       */
- 
--      bck = unsorted_chunks(av);
--      fwd = bck->fd;
-+      mchunkptr bck = unsorted_chunks (av);
-+      mchunkptr fwd = bck->fd;
-       if (__glibc_unlikely (fwd->bk != bck))
- 	malloc_printerr ("free(): corrupted unsorted chunks");
-       p->fd = fwd;
-@@ -4706,61 +4742,52 @@ _int_free (mstate av, mchunkptr p, int have_lock)
-       check_free_chunk(av, p);
-     }
- 
--    /*
--      If the chunk borders the current high end of memory,
--      consolidate into top
--    */
--
--    else {
-+  else
-+    {
-+      /* If the chunk borders the current high end of memory,
-+	 consolidate into top.  */
-       size += nextsize;
-       set_head(p, size | PREV_INUSE);
-       av->top = p;
-       check_chunk(av, p);
-     }
- 
--    /*
--      If freeing a large space, consolidate possibly-surrounding
--      chunks. Then, if the total unused topmost memory exceeds trim
--      threshold, ask malloc_trim to reduce top.
--
--      Unless max_fast is 0, we don't know if there are fastbins
--      bordering top, so we cannot tell for sure whether threshold
--      has been reached unless fastbins are consolidated.  But we
--      don't want to consolidate on each free.  As a compromise,
--      consolidation is performed if FASTBIN_CONSOLIDATION_THRESHOLD
--      is reached.
--    */
-+  return size;
-+}
- 
--    if ((unsigned long)(size) >= FASTBIN_CONSOLIDATION_THRESHOLD) {
-+/* If freeing a large space, consolidate possibly-surrounding
-+   chunks.  Then, if the total unused topmost memory exceeds trim
-+   threshold, ask malloc_trim to reduce top.  */
-+static void
-+_int_free_maybe_consolidate (mstate av, INTERNAL_SIZE_T size)
-+{
-+  /* Unless max_fast is 0, we don't know if there are fastbins
-+     bordering top, so we cannot tell for sure whether threshold has
-+     been reached unless fastbins are consolidated.  But we don't want
-+     to consolidate on each free.  As a compromise, consolidation is
-+     performed if FASTBIN_CONSOLIDATION_THRESHOLD is reached.  */
-+  if (size >= FASTBIN_CONSOLIDATION_THRESHOLD)
-+    {
-       if (atomic_load_relaxed (&av->have_fastchunks))
- 	malloc_consolidate(av);
- 
--      if (av == &main_arena) {
-+      if (av == &main_arena)
-+	{
- #ifndef MORECORE_CANNOT_TRIM
--	if ((unsigned long)(chunksize(av->top)) >=
--	    (unsigned long)(mp_.trim_threshold))
--	  systrim(mp_.top_pad, av);
-+	  if (chunksize (av->top) >= mp_.trim_threshold)
-+	    systrim (mp_.top_pad, av);
- #endif
--      } else {
--	/* Always try heap_trim(), even if the top chunk is not
--	   large, because the corresponding heap might go away.  */
--	heap_info *heap = heap_for_ptr(top(av));
-+	}
-+      else
-+	{
-+	  /* Always try heap_trim, even if the top chunk is not large,
-+	     because the corresponding heap might go away.  */
-+	  heap_info *heap = heap_for_ptr (top (av));
- 
--	assert(heap->ar_ptr == av);
--	heap_trim(heap, mp_.top_pad);
--      }
-+	  assert (heap->ar_ptr == av);
-+	  heap_trim (heap, mp_.top_pad);
-+	}
-     }
--
--    if (!have_lock)
--      __libc_lock_unlock (av->mutex);
--  }
--  /*
--    If the chunk was allocated via mmap, release via munmap().
--  */
--
--  else {
--    munmap_chunk (p);
--  }
- }
- 
- /*
-@@ -4999,42 +5026,6 @@ _int_realloc (mstate av, mchunkptr oldp, INTERNAL_SIZE_T oldsize,
-    ------------------------------ memalign ------------------------------
-  */
- 
--/* Returns 0 if the chunk is not and does not contain the requested
--   aligned sub-chunk, else returns the amount of "waste" from
--   trimming.  NB is the *chunk* byte size, not the user byte
--   size.  */
--static size_t
--chunk_ok_for_memalign (mchunkptr p, size_t alignment, size_t nb)
--{
--  void *m = chunk2mem (p);
--  INTERNAL_SIZE_T size = chunksize (p);
--  void *aligned_m = m;
--
--  if (__glibc_unlikely (misaligned_chunk (p)))
--    malloc_printerr ("_int_memalign(): unaligned chunk detected");
--
--  aligned_m = PTR_ALIGN_UP (m, alignment);
--
--  INTERNAL_SIZE_T front_extra = (intptr_t) aligned_m - (intptr_t) m;
--
--  /* We can't trim off the front as it's too small.  */
--  if (front_extra > 0 && front_extra < MINSIZE)
--    return 0;
--
--  /* If it's a perfect fit, it's an exception to the return value rule
--     (we would return zero waste, which looks like "not usable"), so
--     handle it here by returning a small non-zero value instead.  */
--  if (size == nb && front_extra == 0)
--    return 1;
--
--  /* If the block we need fits in the chunk, calculate total waste.  */
--  if (size > nb + front_extra)
--    return size - nb;
--
--  /* Can't use this chunk.  */
--  return 0;
--}
--
- /* BYTES is user requested bytes, not requested chunksize bytes.  */
- static void *
- _int_memalign (mstate av, size_t alignment, size_t bytes)
-@@ -5049,7 +5040,6 @@ _int_memalign (mstate av, size_t alignment, size_t bytes)
-   mchunkptr remainder;            /* spare room at end to split off */
-   unsigned long remainder_size;   /* its size */
-   INTERNAL_SIZE_T size;
--  mchunkptr victim;
- 
-   nb = checked_request2size (bytes);
-   if (nb == 0)
-@@ -5068,129 +5058,13 @@ _int_memalign (mstate av, size_t alignment, size_t bytes)
-      we don't find anything in those bins, the common malloc code will
-      scan starting at 2x.  */
- 
--  /* This will be set if we found a candidate chunk.  */
--  victim = NULL;
-+  /* Call malloc with worst case padding to hit alignment. */
-+  m = (char *) (_int_malloc (av, nb + alignment + MINSIZE));
- 
--  /* Fast bins are singly-linked, hard to remove a chunk from the middle
--     and unlikely to meet our alignment requirements.  We have not done
--     any experimentation with searching for aligned fastbins.  */
--
--  if (av != NULL)
--    {
--      int first_bin_index;
--      int first_largebin_index;
--      int last_bin_index;
--
--      if (in_smallbin_range (nb))
--	first_bin_index = smallbin_index (nb);
--      else
--	first_bin_index = largebin_index (nb);
-+  if (m == 0)
-+    return 0;           /* propagate failure */
- 
--      if (in_smallbin_range (nb * 2))
--	last_bin_index = smallbin_index (nb * 2);
--      else
--	last_bin_index = largebin_index (nb * 2);
--
--      first_largebin_index = largebin_index (MIN_LARGE_SIZE);
--
--      int victim_index;                 /* its bin index */
--
--      for (victim_index = first_bin_index;
--	   victim_index < last_bin_index;
--	   victim_index ++)
--	{
--	  victim = NULL;
--
--	  if (victim_index < first_largebin_index)
--	    {
--	      /* Check small bins.  Small bin chunks are doubly-linked despite
--		 being the same size.  */
--
--	      mchunkptr fwd;                    /* misc temp for linking */
--	      mchunkptr bck;                    /* misc temp for linking */
--
--	      bck = bin_at (av, victim_index);
--	      fwd = bck->fd;
--	      while (fwd != bck)
--		{
--		  if (chunk_ok_for_memalign (fwd, alignment, nb) > 0)
--		    {
--		      victim = fwd;
--
--		      /* Unlink it */
--		      victim->fd->bk = victim->bk;
--		      victim->bk->fd = victim->fd;
--		      break;
--		    }
--
--		  fwd = fwd->fd;
--		}
--	    }
--	  else
--	    {
--	      /* Check large bins.  */
--	      mchunkptr fwd;                    /* misc temp for linking */
--	      mchunkptr bck;                    /* misc temp for linking */
--	      mchunkptr best = NULL;
--	      size_t best_size = 0;
--
--	      bck = bin_at (av, victim_index);
--	      fwd = bck->fd;
--
--	      while (fwd != bck)
--		{
--		  int extra;
--
--		  if (chunksize (fwd) < nb)
--		    break;
--		  extra = chunk_ok_for_memalign (fwd, alignment, nb);
--		  if (extra > 0
--		      && (extra <= best_size || best == NULL))
--		    {
--		      best = fwd;
--		      best_size = extra;
--		    }
--
--		  fwd = fwd->fd;
--		}
--	      victim = best;
--
--	      if (victim != NULL)
--		{
--		  unlink_chunk (av, victim);
--		  break;
--		}
--	    }
--
--	  if (victim != NULL)
--	    break;
--	}
--    }
--
--  /* Strategy: find a spot within that chunk that meets the alignment
--     request, and then possibly free the leading and trailing space.
--     This strategy is incredibly costly and can lead to external
--     fragmentation if header and footer chunks are unused.  */
--
--  if (victim != NULL)
--    {
--      p = victim;
--      m = chunk2mem (p);
--      set_inuse (p);
--      if (av != &main_arena)
--	set_non_main_arena (p);
--    }
--  else
--    {
--      /* Call malloc with worst case padding to hit alignment. */
--
--      m = (char *) (_int_malloc (av, nb + alignment + MINSIZE));
--
--      if (m == 0)
--	return 0;           /* propagate failure */
--
--      p = mem2chunk (m);
--    }
-+  p = mem2chunk (m);
- 
-   if ((((unsigned long) (m)) % alignment) != 0)   /* misaligned */
-     {
-@@ -5221,7 +5095,7 @@ _int_memalign (mstate av, size_t alignment, size_t bytes)
-                 (av != &main_arena ? NON_MAIN_ARENA : 0));
-       set_inuse_bit_at_offset (newp, newsize);
-       set_head_size (p, leadsize | (av != &main_arena ? NON_MAIN_ARENA : 0));
--      _int_free (av, p, 1);
-+      _int_free_merge_chunk (av, p, leadsize);
-       p = newp;
- 
-       assert (newsize >= nb &&
-@@ -5232,15 +5106,27 @@ _int_memalign (mstate av, size_t alignment, size_t bytes)
-   if (!chunk_is_mmapped (p))
-     {
-       size = chunksize (p);
--      if ((unsigned long) (size) > (unsigned long) (nb + MINSIZE))
-+      mchunkptr nextchunk = chunk_at_offset(p, size);
-+      INTERNAL_SIZE_T nextsize = chunksize(nextchunk);
-+      if (size > nb)
-         {
-           remainder_size = size - nb;
--          remainder = chunk_at_offset (p, nb);
--          set_head (remainder, remainder_size | PREV_INUSE |
--                    (av != &main_arena ? NON_MAIN_ARENA : 0));
--          set_head_size (p, nb);
--          _int_free (av, remainder, 1);
--        }
-+	  if (remainder_size >= MINSIZE
-+	      || nextchunk == av->top
-+	      || !inuse_bit_at_offset (nextchunk, nextsize))
-+	    {
-+	      /* We can only give back the tail if it is larger than
-+		 MINSIZE, or if the following chunk is unused (top
-+		 chunk or unused in-heap chunk).  Otherwise we would
-+		 create a chunk that is smaller than MINSIZE.  */
-+	      remainder = chunk_at_offset (p, nb);
-+	      set_head_size (p, nb);
-+	      remainder_size = _int_free_create_chunk (av, remainder,
-+						       remainder_size,
-+						       nextchunk, nextsize);
-+	      _int_free_maybe_consolidate (av, remainder_size);
-+	    }
-+	}
-     }
- 
-   check_inuse_chunk (av, p);
diff --git a/subprojects/packagefiles/glibc-2.38/meson.build b/subprojects/packagefiles/glibc-2.38/meson.build
deleted file mode 100644
index cf3bf26b1e..0000000000
--- a/subprojects/packagefiles/glibc-2.38/meson.build
+++ /dev/null
@@ -1,113 +0,0 @@
-project('glibc', 'c', version: '2.38')
-
-fs = import('fs')
-
-glibc_output_paths = [
-    'csu/crt1.o',
-    'csu/crti.o',
-    'csu/crtn.o',
-    'dlfcn/libdl.so',
-    'dlfcn/libdl.so.2',
-    'libc.so',
-    'libc.so.6',
-    'login/libutil.so',
-    'login/libutil.so.1',
-    'math/libm.so',
-    'math/libm.so.6',
-    'nis/libnsl.so',
-    'nis/libnsl.so.1',
-    'nptl/libpthread.so',
-    'nptl/libpthread.so.0',
-    'nptl_db/libthread_db.so',
-    'nptl_db/libthread_db.so.1',
-    'nss/libnss_compat.so',
-    'nss/libnss_compat.so.2',
-    'nss/libnss_db.so',
-    'nss/libnss_db.so.2',
-    'nss/libnss_files.so',
-    'nss/libnss_files.so.2',
-    'resolv/libanl.so',
-    'resolv/libanl.so.1',
-    'resolv/libnss_dns.so',
-    'resolv/libnss_dns.so.2',
-    'resolv/libresolv.so',
-    'resolv/libresolv.so.2',
-    'rt/librt.so',
-    'rt/librt.so.1',
-]
-
-if host_machine.cpu_family() == 'x86_64'
-    glibc_output_paths += [
-        'elf/ld-linux-x86-64.so.2',
-        'elf/ld.so',
-        'mathvec/libmvec.so',
-        'mathvec/libmvec.so.1',
-    ]
-endif
-
-glibc_output = []
-foreach path : glibc_output_paths
-    glibc_output += fs.name(path)
-endforeach
-
-extra_cflags = ''
-if get_option('buildtype') == 'debug' or get_option('buildtype') == 'debugoptimized'
-    extra_cflags += '-g'
-endif
-
-glibc = custom_target('glibc',
-    command: [
-        find_program('compile.sh'),
-        host_machine.cpu_family(),
-        '@CURRENT_SOURCE_DIR@',
-        '@CURRENT_SOURCE_DIR@/glibc-2.38',
-        meson.current_build_dir(),
-        '@PRIVATE_DIR@',
-        get_option('prefix'),
-        get_option('libdir'),
-        extra_cflags,
-        glibc_output_paths,
-    ],
-
-    input: [
-        'glibc-2.38/configure',
-        'gramine-syscall.patch',
-        'hp-timing.patch',
-        # backporting the fix for `posix_memalign()` perf regression; drop when we update to glibc 2.39;
-        # see the following:
-        #  - https://sourceware.org/bugzilla/show_bug.cgi?id=30723
-        #  - https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=542b1105852568c3ebc712225ae78b8c8ba31a78
-        #  - https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=0dc7fc1cf094406a138e4d1bcf9553e59edcf89d
-        'fix-bug-30723.patch',
-        # backporting the fix for CVE-2023-4527; drop when we update to glibc 2.39;
-        # see the following:
-        #  - https://nvd.nist.gov/vuln/detail/CVE-2023-4527
-        #  - https://sourceware.org/bugzilla/show_bug.cgi?id=30842
-        #  - https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=b25508dd774b617f99419bdc3cf2ace4560cd2d6
-        'fix-CVE-2023-4527.patch',
-        # backporting the fix for CVE-2023-4806; drop when we update to glibc 2.39;
-        # see the following:
-        #  - https://nvd.nist.gov/vuln/detail/CVE-2023-4806
-        #  - https://sourceware.org/bugzilla/show_bug.cgi?id=30843
-        #  - https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=00ae4f10b504bc4564e9f22f00907093f1ab9338
-        'fix-CVE-2023-4806.patch',
-        # backporting the fix for CVE-2023-4911; drop when we update to glibc 2.39;
-        # see the following:
-        #  - https://nvd.nist.gov/vuln/detail/CVE-2023-4911
-        #  - https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=750a45a783906a19591fb8ff6b7841470f1f5701
-        'fix-CVE-2023-4911.patch',
-        # backporting the fix for CVE-2023-5156; drop when we update to glibc 2.39;
-        # see the following:
-        #  - https://nvd.nist.gov/vuln/detail/CVE-2023-5156
-        #  - https://sourceware.org/bugzilla/show_bug.cgi?id=30884
-        #  - https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=5ee59ca371b99984232d7584fe2b1a758b4421d3
-        'fix-CVE-2023-5156.patch',
-    ],
-
-    output: glibc_output,
-
-    console: true,
-
-    install: true,
-    install_dir: get_option('libdir') / 'gramine/runtime/glibc',
-)
diff --git a/subprojects/packagefiles/glibc-2.38/compile.sh b/subprojects/packagefiles/glibc-2.39/compile.sh
similarity index 100%
rename from subprojects/packagefiles/glibc-2.38/compile.sh
rename to subprojects/packagefiles/glibc-2.39/compile.sh
diff --git a/subprojects/packagefiles/glibc-2.38/gramine-syscall.patch b/subprojects/packagefiles/glibc-2.39/gramine-syscall.patch
similarity index 78%
rename from subprojects/packagefiles/glibc-2.38/gramine-syscall.patch
rename to subprojects/packagefiles/glibc-2.39/gramine-syscall.patch
index c7875379ae..8538cc1731 100644
--- a/subprojects/packagefiles/glibc-2.38/gramine-syscall.patch
+++ b/subprojects/packagefiles/glibc-2.39/gramine-syscall.patch
@@ -1,8 +1,8 @@
 diff --git a/Makerules b/Makerules
-index d1e139d03c1c448e14aee35af3e54ee7abe2180c..3f3d8739d3419804b35d00a69cab5538ec60f74e 100644
+index 00365bc58be119bb0fec9cf2cfa51780c27fae8c..1995396ae885a75575eebb96254528d80d6686ab 100644
 --- a/Makerules
 +++ b/Makerules
-@@ -818,7 +818,7 @@ verbose	:=
+@@ -777,7 +777,7 @@ verbose	:=
  endif						# not -s
  
  ARFLAGS := r$(verbose)
@@ -12,10 +12,10 @@ index d1e139d03c1c448e14aee35af3e54ee7abe2180c..3f3d8739d3419804b35d00a69cab5538
  # This makes all the object files in the parent library archive.
  
 diff --git a/elf/Makefile b/elf/Makefile
-index fd77d0c7c8799c336c65278f6f8e939ed8707633..6fc16b46d041f2c80f3995be183644d276e8a294 100644
+index 5d78b659ce813ff973e499043154e5b1fc8a639b..ac86ce8f81ac89ae4a9a958503fdc160516856b9 100644
 --- a/elf/Makefile
 +++ b/elf/Makefile
-@@ -1310,7 +1310,7 @@ $(objpfx)librtld.map: $(objpfx)dl-allobjs.os $(common-objpfx)libc_pic.a
+@@ -1296,7 +1296,7 @@ $(objpfx)librtld.map: $(objpfx)dl-allobjs.os $(common-objpfx)libc_pic.a
  # For lld, skip preceding addresses and values before matching the archive and the member.
  $(objpfx)librtld.mk: $(objpfx)librtld.map Makefile
  	LC_ALL=C \
@@ -24,7 +24,7 @@ index fd77d0c7c8799c336c65278f6f8e939ed8707633..6fc16b46d041f2c80f3995be183644d2
  	    $< | \
  	while read lib file; do \
  	  case $$lib in \
-@@ -1318,7 +1318,7 @@ $(objpfx)librtld.mk: $(objpfx)librtld.map Makefile
+@@ -1304,7 +1304,7 @@ $(objpfx)librtld.mk: $(objpfx)librtld.map Makefile
  	    LC_ALL=C grep -F -l /$$file \
  		  $(common-objpfx)stamp.os $(common-objpfx)*/stamp.os | \
  	    LC_ALL=C \
@@ -34,7 +34,7 @@ index fd77d0c7c8799c336c65278f6f8e939ed8707633..6fc16b46d041f2c80f3995be183644d2
  	  */*.a) \
  	    echo rtld-$${lib%%/*} += $$file ;; \
 diff --git a/elf/dl-load.c b/elf/dl-load.c
-index 1ad0868dad809d56c7ecced65ce482af4982abc9..8c4eae155754d7d9b140fcb838b8b74df6db0368 100644
+index ce8fdea3024359b0d4f4aea90a49796003aeaa1d..58392a372fdb3ebb66b85b8963ccdb01024dc616 100644
 --- a/elf/dl-load.c
 +++ b/elf/dl-load.c
 @@ -76,6 +76,8 @@ struct filebuf
@@ -46,7 +46,7 @@ index 1ad0868dad809d56c7ecced65ce482af4982abc9..8c4eae155754d7d9b140fcb838b8b74d
  #include <endian.h>
  #if BYTE_ORDER == BIG_ENDIAN
  # define byteorder ELFDATA2MSB
-@@ -1490,6 +1492,8 @@ cannot enable executable stack as shared object requires");
+@@ -1480,6 +1482,8 @@ cannot enable executable stack as shared object requires");
    DL_AFTER_LOAD (l);
  #endif
  
@@ -56,33 +56,20 @@ index 1ad0868dad809d56c7ecced65ce482af4982abc9..8c4eae155754d7d9b140fcb838b8b74d
    _dl_add_to_namespace_list (l, nsid);
  
 diff --git a/sysdeps/unix/sysv/linux/x86_64/____longjmp_chk.S b/sysdeps/unix/sysv/linux/x86_64/____longjmp_chk.S
-index ffdf4624bf98648e4bc423cbdf1ce9b46ebf5fd2..d8c40f016f1659d64de1e642b665e9b7c8af00b1 100644
+index 9d9732afdcef471c7e6852f1cebe025296da4d62..af732ed758698fd13d0400024d2427f496a33541 100644
 --- a/sysdeps/unix/sysv/linux/x86_64/____longjmp_chk.S
 +++ b/sysdeps/unix/sysv/linux/x86_64/____longjmp_chk.S
-@@ -89,7 +89,7 @@ ENTRY(____longjmp_chk)
- 	xorl	%edi, %edi
- 	lea	-sizeSS(%rsp), %RSI_LP
- 	movl	$__NR_sigaltstack, %eax
--	syscall
-+	GRAMINE_SYSCALL
- 	/* Without working sigaltstack we cannot perform the test.  */
- 	testl	%eax, %eax
- 	jne	.Lok2
-diff --git a/sysdeps/unix/sysv/linux/x86_64/__start_context.S b/sysdeps/unix/sysv/linux/x86_64/__start_context.S
-index a524c4d7b7f96008c2d38146418449c71cbe678a..a1a3f5f0803f23474960cd1413bb59adb5acaffe 100644
---- a/sysdeps/unix/sysv/linux/x86_64/__start_context.S
-+++ b/sysdeps/unix/sysv/linux/x86_64/__start_context.S
-@@ -51,7 +51,7 @@ ENTRY(__push___start_context)
- 	movl	$ARCH_CET_ALLOC_SHSTK, %edi
- 	movl	$__NR_arch_prctl, %eax
- 	/* The new shadow stack base is returned in __ssp[1].  */
--	syscall
-+	GRAMINE_SYSCALL
- 	testq	%rax, %rax
- 	jne	L(hlt)		/* This should never happen.  */
- 
+@@ -40,7 +40,7 @@ longjmp_msg:
+ 	xorl	%edi, %edi;						\
+ 	lea	-sizeSS(%rsp), %RSI_LP;					\
+ 	movl	$__NR_sigaltstack, %eax;				\
+-	syscall;							\
++	GRAMINE_SYSCALL;							\
+ 	/* Without working sigaltstack we cannot perform the test.  */	\
+ 	testl	%eax, %eax;						\
+ 	jne	.Lok2;							\
 diff --git a/sysdeps/unix/sysv/linux/x86_64/clone.S b/sysdeps/unix/sysv/linux/x86_64/clone.S
-index b6b5cd497ac85be6e84e84da8cec4ec645f605ce..89195e4abe4353a94e5a4086dd2f2aea1947e98f 100644
+index d0adc21c850632aea23aab6a0ce9426ea303334d..9bbf4e08e549d98c32d4dbdbcab0f39222d2a81a 100644
 --- a/sysdeps/unix/sysv/linux/x86_64/clone.S
 +++ b/sysdeps/unix/sysv/linux/x86_64/clone.S
 @@ -78,7 +78,7 @@ ENTRY (__clone)
@@ -104,7 +91,7 @@ index b6b5cd497ac85be6e84e84da8cec4ec645f605ce..89195e4abe4353a94e5a4086dd2f2aea
  
  	cfi_startproc;
 diff --git a/sysdeps/unix/sysv/linux/x86_64/clone3.S b/sysdeps/unix/sysv/linux/x86_64/clone3.S
-index 18fc2ee966a1b748c9234013cc9c3b70c5701b78..9152ef6f0ea145c0d368d3834f0077cef167c005 100644
+index 5a2d42234e0cb16c56fe4a16e81a95ebd7b0c176..b9b65be33f37a77a951967fa50c3284b73a94580 100644
 --- a/sysdeps/unix/sysv/linux/x86_64/clone3.S
 +++ b/sysdeps/unix/sysv/linux/x86_64/clone3.S
 @@ -57,7 +57,7 @@ ENTRY (__clone3)
@@ -116,7 +103,7 @@ index 18fc2ee966a1b748c9234013cc9c3b70c5701b78..9152ef6f0ea145c0d368d3834f0077ce
  
  	test	%RAX_LP, %RAX_LP
  	jl	SYSCALL_ERROR_LABEL
-@@ -82,7 +82,7 @@ L(thread_start):
+@@ -79,7 +79,7 @@ L(thread_start):
  	/* Call exit with return value from function call. */
  	movq	%rax, %rdi
  	movl	$SYS_ify(exit), %eax
@@ -126,19 +113,10 @@ index 18fc2ee966a1b748c9234013cc9c3b70c5701b78..9152ef6f0ea145c0d368d3834f0077ce
  
  	cfi_startproc
 diff --git a/sysdeps/unix/sysv/linux/x86_64/getcontext.S b/sysdeps/unix/sysv/linux/x86_64/getcontext.S
-index 3fab8de49c5e13240477b19d3e661442d313f01f..14ec8dbe1fb94fbacf0f58e20906b467897c7bbd 100644
+index e588a8cc0764064377e3cbac1058254abf190a2d..477d21ecccc894dc8faad1051737ebdab0e71094 100644
 --- a/sysdeps/unix/sysv/linux/x86_64/getcontext.S
 +++ b/sysdeps/unix/sysv/linux/x86_64/getcontext.S
-@@ -72,7 +72,7 @@ ENTRY(__getcontext)
- 	mov	%RSP_LP, %RSI_LP
- 	movl	$ARCH_CET_STATUS, %edi
- 	movl	$__NR_arch_prctl, %eax
--	syscall
-+	GRAMINE_SYSCALL
- 	testq	%rax, %rax
- 	jz	L(continue_no_err)
- 
-@@ -124,7 +124,7 @@ L(no_shstk):
+@@ -104,7 +104,7 @@ L(no_shstk):
  #endif
  	movl	$_NSIG8,%r10d
  	movl	$__NR_rt_sigprocmask, %eax
@@ -148,7 +126,7 @@ index 3fab8de49c5e13240477b19d3e661442d313f01f..14ec8dbe1fb94fbacf0f58e20906b467
  	jae	SYSCALL_ERROR_LABEL	/* Jump to error handler if error.  */
  
 diff --git a/sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c b/sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c
-index e6f9e27247698f8350730de19f58fccca267ee82..a87cbc14aa1d6314722d4b32ef22b8f6f2571e91 100644
+index b39812f81d179878249d73920765d1ac2c6b8315..31c4af1e681ad4e416da9e843a619f84fd53b7b2 100644
 --- a/sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c
 +++ b/sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c
 @@ -78,7 +78,7 @@ asm									\
@@ -161,7 +139,7 @@ index e6f9e27247698f8350730de19f58fccca267ee82..a87cbc14aa1d6314722d4b32ef22b8f6
     ".section .eh_frame,\"a\",@progbits\n"				\
     ".LSTARTFRAME_" #name ":\n"						\
 diff --git a/sysdeps/unix/sysv/linux/x86_64/setcontext.S b/sysdeps/unix/sysv/linux/x86_64/setcontext.S
-index 282c5266e6d00323e02a5472685f836742effedc..9acf0522e7a66fc6c2f1a68f3da9fe4e5c7d84f0 100644
+index d0bcd794e89eebb5d81f676d7090925e96cac524..3befe350309c89188dc6a3030337bc6aaf7f1e04 100644
 --- a/sysdeps/unix/sysv/linux/x86_64/setcontext.S
 +++ b/sysdeps/unix/sysv/linux/x86_64/setcontext.S
 @@ -43,7 +43,7 @@ ENTRY(__setcontext)
@@ -174,7 +152,7 @@ index 282c5266e6d00323e02a5472685f836742effedc..9acf0522e7a66fc6c2f1a68f3da9fe4e
  	   leaving RDI and RSI available for use later can avoid
  	   shuffling values.  */
 diff --git a/sysdeps/unix/sysv/linux/x86_64/swapcontext.S b/sysdeps/unix/sysv/linux/x86_64/swapcontext.S
-index b101c70ac806e18f5bcaefabca572ff6e6246d5a..44bd713daf4108efd23f210624d258ee85448b51 100644
+index b2e0f19a9d57e5007b094037b4cf59868029fc36..94f1eb7ce4ae2746db49282761d2e08c25770ab1 100644
 --- a/sysdeps/unix/sysv/linux/x86_64/swapcontext.S
 +++ b/sysdeps/unix/sysv/linux/x86_64/swapcontext.S
 @@ -76,7 +76,7 @@ ENTRY(__swapcontext)
@@ -186,17 +164,8 @@ index b101c70ac806e18f5bcaefabca572ff6e6246d5a..44bd713daf4108efd23f210624d258ee
  	cmpq	$-4095, %rax		/* Check %rax for error.  */
  	jae	SYSCALL_ERROR_LABEL	/* Jump to error handler if error.  */
  
-@@ -116,7 +116,7 @@ ENTRY(__swapcontext)
- 	mov	%RSP_LP, %RSI_LP
- 	movl	$ARCH_CET_STATUS, %edi
- 	movl	$__NR_arch_prctl, %eax
--	syscall
-+	GRAMINE_SYSCALL
- 	testq	%rax, %rax
- 	jz	L(continue_no_err)
- 
 diff --git a/sysdeps/unix/sysv/linux/x86_64/syscall.S b/sysdeps/unix/sysv/linux/x86_64/syscall.S
-index 192455a89883fc815ecb58677c0da6a7bb4583fa..4041fb7d9b73fc9743666f19ed33bb748ce499a0 100644
+index 43af8087b657fd9954cb1d4368624affa6c53af0..5c0cc9294aa082ab5ffe39b6c524ebbace6ee9c8 100644
 --- a/sysdeps/unix/sysv/linux/x86_64/syscall.S
 +++ b/sysdeps/unix/sysv/linux/x86_64/syscall.S
 @@ -34,7 +34,7 @@ ENTRY (syscall)
@@ -209,7 +178,7 @@ index 192455a89883fc815ecb58677c0da6a7bb4583fa..4041fb7d9b73fc9743666f19ed33bb74
  	jae SYSCALL_ERROR_LABEL	/* Jump to error handler if error.  */
  	ret			/* Return to caller.  */
 diff --git a/sysdeps/unix/sysv/linux/x86_64/sysdep.h b/sysdeps/unix/sysv/linux/x86_64/sysdep.h
-index 740abefcfd3612928bdd42c605ebdcf341d76667..4a675bd1ed886fa0b0c585356a4fb6194c07d2ed 100644
+index a2b021bd86f5d47284958eed11d6024a4027b698..690362d270c90a46968a9bcfc3afb294e39090a3 100644
 --- a/sysdeps/unix/sysv/linux/x86_64/sysdep.h
 +++ b/sysdeps/unix/sysv/linux/x86_64/sysdep.h
 @@ -26,6 +26,8 @@
@@ -294,7 +263,7 @@ index 740abefcfd3612928bdd42c605ebdcf341d76667..4a675bd1ed886fa0b0c585356a4fb619
      : "0" (number), "r" (_a1), "r" (_a2), "r" (_a3), "r" (_a4),		\
        "r" (_a5), "r" (_a6)						\
 diff --git a/sysdeps/unix/sysv/linux/x86_64/vfork.S b/sysdeps/unix/sysv/linux/x86_64/vfork.S
-index 1a1e3039c72dc2ec66a56f2ad0961bbd83de13dd..ae5b208ab88e0a898ca7fb49361d82846c21f4dc 100644
+index 0d8732e37421d2ae003424ca94b7136c0a90469a..0cbfbb0307ca460ecbdbc5fec0dd6c132304f15a 100644
 --- a/sysdeps/unix/sysv/linux/x86_64/vfork.S
 +++ b/sysdeps/unix/sysv/linux/x86_64/vfork.S
 @@ -35,7 +35,7 @@ ENTRY (__vfork)
@@ -307,7 +276,7 @@ index 1a1e3039c72dc2ec66a56f2ad0961bbd83de13dd..ae5b208ab88e0a898ca7fb49361d8284
  	/* Push back the return PC.  */
  	pushq	%rdi
 diff --git a/sysdeps/unix/sysv/linux/x86_64/x32/times.c b/sysdeps/unix/sysv/linux/x86_64/x32/times.c
-index aea8e8c94989d3686b131866798d7bde4cc69f1f..246e2ae4c749f15af848a9c53bd7810f6dc1c89f 100644
+index 67b6fc1da183e8f8affb0a37f7d269847752e686..f98471a4fadf775dc072b342fb2eff72dea4adcb 100644
 --- a/sysdeps/unix/sysv/linux/x86_64/x32/times.c
 +++ b/sysdeps/unix/sysv/linux/x86_64/x32/times.c
 @@ -26,7 +26,7 @@
@@ -320,7 +289,7 @@ index aea8e8c94989d3686b131866798d7bde4cc69f1f..246e2ae4c749f15af848a9c53bd7810f
      : "0" (number), "r" (_a1)						\
      : "memory", REGISTERS_CLOBBERED_BY_SYSCALL);			\
 diff --git a/sysdeps/unix/x86_64/sysdep.h b/sysdeps/unix/x86_64/sysdep.h
-index 0ec37c62aac020d3cc6b37fb38cb333aae6991a9..f5e6975b364eccb3f57b88a2682e785b54489094 100644
+index 6cbb4d867b4f92a7af3d69c41264683911aefe1b..bf861504960263ac6eaa48b003588a4f1f3c3d6f 100644
 --- a/sysdeps/unix/x86_64/sysdep.h
 +++ b/sysdeps/unix/x86_64/sysdep.h
 @@ -25,7 +25,7 @@
@@ -333,7 +302,7 @@ index 0ec37c62aac020d3cc6b37fb38cb333aae6991a9..f5e6975b364eccb3f57b88a2682e785b
  #define	r0		%rax	/* Normal return-value register.  */
  #define	r1		%rbx	/* Secondary return-value register.  */
 diff --git a/sysdeps/x86_64/nptl/tls.h b/sysdeps/x86_64/nptl/tls.h
-index 75f80209758aa19cc59c413e4bbd1a565e5b9696..bb72d936679ff73b378c1b8dc2b894e43226fd91 100644
+index 876889bed4bf2bc97779f1ab0593403d33648aeb..25f5aa07ab24bc22aab66d1065d1027537c9d3a7 100644
 --- a/sysdeps/x86_64/nptl/tls.h
 +++ b/sysdeps/x86_64/nptl/tls.h
 @@ -30,6 +30,8 @@
diff --git a/subprojects/packagefiles/glibc-2.38/hp-timing.patch b/subprojects/packagefiles/glibc-2.39/hp-timing.patch
similarity index 94%
rename from subprojects/packagefiles/glibc-2.38/hp-timing.patch
rename to subprojects/packagefiles/glibc-2.39/hp-timing.patch
index cbf47c0a8f..e1f9b051d4 100644
--- a/subprojects/packagefiles/glibc-2.38/hp-timing.patch
+++ b/subprojects/packagefiles/glibc-2.39/hp-timing.patch
@@ -1,5 +1,5 @@
 diff --git a/sysdeps/x86/hp-timing.h b/sysdeps/x86/hp-timing.h
-index 15e9106105dab9e3f283d320d56ab3283022c2fa..ad0b2360896f00e87c585a4cfd9412b84569d8bf 100644
+index 699baa34725ae7e1f8a52f9c9f7e57a3c8ade414..bdf6463445ed8c43468be514b91fc0516feb37d7 100644
 --- a/sysdeps/x86/hp-timing.h
 +++ b/sysdeps/x86/hp-timing.h
 @@ -17,45 +17,7 @@
diff --git a/subprojects/packagefiles/glibc-2.39/meson.build b/subprojects/packagefiles/glibc-2.39/meson.build
new file mode 100644
index 0000000000..f6033777fe
--- /dev/null
+++ b/subprojects/packagefiles/glibc-2.39/meson.build
@@ -0,0 +1,84 @@
+project('glibc', 'c', version: '2.39')
+
+fs = import('fs')
+
+glibc_output_paths = [
+    'csu/crt1.o',
+    'csu/crti.o',
+    'csu/crtn.o',
+    'dlfcn/libdl.so',
+    'dlfcn/libdl.so.2',
+    'libc.so',
+    'libc.so.6',
+    'login/libutil.so',
+    'login/libutil.so.1',
+    'math/libm.so',
+    'math/libm.so.6',
+    'nis/libnsl.so',
+    'nis/libnsl.so.1',
+    'nptl/libpthread.so',
+    'nptl/libpthread.so.0',
+    'nptl_db/libthread_db.so',
+    'nptl_db/libthread_db.so.1',
+    'nss/libnss_compat.so',
+    'nss/libnss_compat.so.2',
+    'nss/libnss_db.so',
+    'nss/libnss_db.so.2',
+    'nss/libnss_files.so',
+    'nss/libnss_files.so.2',
+    'resolv/libanl.so',
+    'resolv/libanl.so.1',
+    'resolv/libnss_dns.so',
+    'resolv/libnss_dns.so.2',
+    'resolv/libresolv.so',
+    'resolv/libresolv.so.2',
+    'rt/librt.so',
+    'rt/librt.so.1',
+]
+
+if host_machine.cpu_family() == 'x86_64'
+    glibc_output_paths += [
+        'elf/ld-linux-x86-64.so.2',
+        'elf/ld.so',
+        'mathvec/libmvec.so',
+        'mathvec/libmvec.so.1',
+    ]
+endif
+
+glibc_output = []
+foreach path : glibc_output_paths
+    glibc_output += fs.name(path)
+endforeach
+
+extra_cflags = ''
+if get_option('buildtype') == 'debug' or get_option('buildtype') == 'debugoptimized'
+    extra_cflags += '-g'
+endif
+
+glibc = custom_target('glibc',
+    command: [
+        find_program('compile.sh'),
+        host_machine.cpu_family(),
+        '@CURRENT_SOURCE_DIR@',
+        '@CURRENT_SOURCE_DIR@/glibc-2.39',
+        meson.current_build_dir(),
+        '@PRIVATE_DIR@',
+        get_option('prefix'),
+        get_option('libdir'),
+        extra_cflags,
+        glibc_output_paths,
+    ],
+
+    input: [
+        'glibc-2.39/configure',
+        'gramine-syscall.patch',
+        'hp-timing.patch',
+    ],
+
+    output: glibc_output,
+
+    console: true,
+
+    install: true,
+    install_dir: get_option('libdir') / 'gramine/runtime/glibc',
+)