Update for 2024.02.9

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
{linux, linux-headers}: bump 4.19.x / 6.11.x series
2024-12-08 21:51:20 +01:00 · 2024-12-08 15:46:55 +01:00 · 2024-12-08 15:44:50 +01:00 · 2024-12-08 15:44:01 +01:00 · 2024-12-08 15:43:37 +01:00 · 2024-12-08 15:43:22 +01:00
98 changed files with 1629 additions and 482 deletions
@@ -131,12 +131,11 @@ package/am33x-cm3/0004-Makefile-add-fno-builtin.patch Upstream
 package/am33x-cm3/S93-am335x-pm-firmware-load Variables
 package/android-tools/0001-Fix-makefiles-for-out-of-tree-build.patch Upstream
 package/android-tools/0002-Fix-adbd-for-non-Ubuntu-systems.patch Upstream
-package/android-tools/0003-Fix-build-issue-with-uclibc.patch Upstream
 package/android-tools/0004-Fix-build-issue-with-musl.patch Upstream
-package/android-tools/0005-Use-pkgconf-to-get-libs-deps.patch Upstream
-package/android-tools/0006-fix-big-endian-build.patch Upstream
-package/android-tools/0007-include-cdefs-h-when-needed.patch Upstream
-package/android-tools/0008-Include-sysmacros.h-to-compile-with-glibc-2.28.patch Sob Upstream
+package/android-tools/0005-makefiles-use-pkgconf-to-get-libs-deps.patch Upstream
+package/android-tools/0006-Fix-build-on-big-endian-systems.patch Upstream
+package/android-tools/0007-Include-cdefs.h-wherever-it-is-needed.patch Upstream
+package/android-tools/0008-usb_linux.c-fix-minor-major-build-failure-due-to-gli.patch Upstream
 package/android-tools/0009-Fix-makefiles-for-out-of-tree-ext4_utils-build.patch Upstream
 package/android-tools/0010-adb-added-patch-for-openssl-1.1.0-compatibility.patch Upstream
 package/aoetools/0001-Change-shell-script-interpreter-from-bin-bash-to-bin.patch Upstream
@@ -329,8 +328,6 @@ package/dvdrw-tools/0002-Include-sysmacros.h-to-compile-with-newer-gcc.patch Ups
 package/earlyoom/0001-main.c-fix-build-with-kernel-4.3.patch Upstream
 package/earlyoom/S02earlyoom Indent Shellcheck
 package/ebtables/0001-replace-ebtables-save-perl-script-with-bash.patch Upstream
-package/ebtables/0002-ebtables.h-restore-KERNEL_64_USERSPACE_32-checks.patch Upstream
-package/ebtables/0003-configure.ac-add-option-enable-kernel-64-userland-32.patch Upstream
 package/ecryptfs-utils/0001-musl.patch Upstream
 package/ecryptfs-utils/0002-openssl110.patch Upstream
 package/ecryptfs-utils/0003-fix-parallel-build-issue.patch Upstream
@@ -1377,8 +1374,6 @@ package/x11r7/xdriver_xf86-video-nouveau/0001-nouveau-fixup-driver-for-new-X-ser
 package/x11r7/xdriver_xf86-video-tdfx/0001-cross.patch Sob Upstream
 package/x11r7/xserver_xorg-server/0001-include-misc.h-fix-uClibc-build.patch Upstream
 package/x11r7/xserver_xorg-server/S40xorg Shellcheck Variables
-package/x11vnc/0001-Fix-build-on-32bit-arches-with-64bit-time_t.patch Upstream
-package/x11vnc/0002-scan-limit-access-to-shared-memory-segments-to-current-user.patch Upstream
 package/xen/0001-9pfs-include-linux-limits.h-for-XATTR_SIZE_MAX.patch Upstream
 package/xen/0002-Fix-build-with-64-bits-time_t.patch Upstream
 package/xen/0003-libs-light-fix-tv_sec-printf-format.patch Upstream
@@ -1,3 +1,21 @@
+2024.02.9, released December 8th, 2024
+
+	Important / security related fixes.
+
+	Updated/fixed packages: alsa-lib, android-tools, babeld,
+	bmap-tools, boost, ebtables, expat, fbv, foot, frr, gamin,
+	gnutls, intel-microcode, irssi, libcurl, libkrb5, libmodbus,
+	libvpl, linux-tools, lmbench, mbedtls, mosquitto, musl,
+	musl-compat-headers, nfs-utils, ntp, php, postgresql,
+	procps-ng, python-psycopg2, python-sip, qt6base, quagga,
+	rt-tests, sshguard, systemd, tiff, x11vnc
+
+	Issues resolved:
+	- procps-ng: builderror in 2024.08
+	  https://gitlab.com/buildroot.org/buildroot/-/issues/38
+	- fbv package download link is broken in long term support branch
+	  https://gitlab.com/buildroot.org/buildroot/-/issues/73
+
 2024.02.8, released November 14th, 2024

 	Important / security related fixes.
@@ -948,7 +948,7 @@ config BR2_FORTIFY_SOURCE_2
 	# gcc bug https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61164
 	depends on !BR2_TOOLCHAIN_BUILDROOT || BR2_TOOLCHAIN_GCC_AT_LEAST_6
 	help
-	  This option sets _FORTIFY_SOURCES to 2 and some more
+	  This option sets _FORTIFY_SOURCE to 2 and some more
 	  checking is added, but some conforming programs might fail.
 	  Also adds checks at run-time (detected buffer overflow
 	  terminates the program)
@@ -957,7 +957,7 @@ config BR2_FORTIFY_SOURCE_3
 	bool "Extended"
 	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_12
 	help
-	  This option sets _FORTIFY_SOURCES to 3 and even more
+	  This option sets _FORTIFY_SOURCE to 3 and even more
 	  checking is added compared to level 2. Extends checks at
 	  run-time that can introduce an additional performance
 	  overhead.
@@ -262,18 +262,6 @@ F:	package/python-bottle/
 F:	package/sqlcipher/
 F:	package/stress/

-N:	Asaf Kahlon <asafka7@gmail.com>
-F:	package/collectd/
-F:	package/libfuse3/
-F:	package/libuv/
-F:	package/python*
-F:	package/snmpclitools/
-F:	package/spdlog/
-F:	package/uftp/
-F:	package/uftrace/
-F:	package/uvw/
-F:	package/zeromq/
-
 N:	Ash Charles <ashcharles@gmail.com>
 F:	package/pru-software-support/
 F:	package/ti-cgt-pru/
@@ -1750,6 +1738,7 @@ F:	support/testing/tests/package/test_acpica.py
 F:	support/testing/tests/package/test_acpica/
 F:	support/testing/tests/package/test_apache.py
 F:	support/testing/tests/package/test_attr.py
+F:	support/testing/tests/package/test_audit.py
 F:	support/testing/tests/package/test_bc.py
 F:	support/testing/tests/package/test_bitcoin.py
 F:	support/testing/tests/package/test_brotli.py
@@ -1864,6 +1853,7 @@ F:	support/testing/tests/package/test_python_pyqt5/
 F:	support/testing/tests/package/test_python_spake2.py
 F:	support/testing/tests/package/test_rdma_core.py
 F:	support/testing/tests/package/test_rdma_core/
+F:	support/testing/tests/package/test_rrdtool.py
 F:	support/testing/tests/package/test_screen.py
 F:	support/testing/tests/package/test_sed.py
 F:	support/testing/tests/package/test_socat.py
@@ -1997,11 +1987,6 @@ F:	package/python-huepy/
 F:	package/python-tqdm/
 F:	package/rtl8189es/

-N:	Louis-Paul Cordier <lpdev@cordier.org>
-F:	package/intel-gmmlib/
-F:	package/intel-mediadriver/
-F:	package/intel-mediasdk/
-
 N:	Luca Ceresoli <luca.ceresoli@bootlin.com>
 F:	board/olimex/a20_olinuxino/
 F:	board/zynq/
@@ -2381,7 +2366,7 @@ F:	package/dbus-broker/
 F:	package/systemd/
 F:	package/tcf-agent/

-N:	Yu Chien Peter Lin <peterlin@andestech.com>
+N:	Leo Yu-Chi Liang <ycliang@andestech.com>
 F:	board/andes
 F:	configs/andes_ae350_45_defconfig

@@ -3185,55 +3170,6 @@ F:	package/casync/
 F:	package/gloox/
 F:	package/tpm2-pkcs11/

-N:	Yann E. MORIN <yann.morin.1998@free.fr>
-F:	fs/squashfs/
-F:	package/asterisk/
-F:	package/cegui/
-F:	package/dahdi-linux/
-F:	package/dahdi-tools/
-F:	package/dbus-broker/
-F:	package/dtc/
-F:	package/dtv-scan-tables/
-F:	package/dvb-apps/
-F:	package/freerdp/
-F:	package/keyutils/
-F:	package/libbsd/
-F:	package/libedit/
-F:	package/libgsm/
-F:	package/libiberty/
-F:	package/libinput/
-F:	package/libiscsi/
-F:	package/libpri/
-F:	package/libseccomp/
-F:	package/libss7/
-F:	package/linux-firmware/
-F:	package/linux-tools/
-F:	package/matchbox*
-F:	package/mesa3d-headers/
-F:	package/nbd/
-F:	package/nut/
-F:	package/nvidia-driver/
-F:	package/omxplayer/
-F:	package/python-pyparsing/
-F:	package/pkg-download.mk
-F:	package/pkg-waf.mk
-F:	package/slirp/
-F:	package/snappy/
-F:	package/spice/
-F:	package/spice-protocol/
-F:	package/systemd/
-F:	package/systemd-bootchart/
-F:	package/tmux/
-F:	package/tvheadend/
-F:	package/usbredir/
-F:	package/vde2/
-F:	package/w_scan/
-F:	package/wayland/
-F:	package/weston/
-F:	package/wtfutil/
-F:	package/zisofs-tools/
-F:	support/download/
-
 N:	Yann E. MORIN <yann.morin@orange.com>
 F:	.editorconfig
 F:	package/gpsd/
@@ -90,9 +90,9 @@ all:
 .PHONY: all

 # Set and export the version string
-export BR2_VERSION := 2024.02.8
+export BR2_VERSION := 2024.02.9
 # Actual time the release is cut (for reproducible builds)
-BR2_VERSION_EPOCH = 1731601000
+BR2_VERSION_EPOCH = 1733691000

 # Save running make version since it's clobbered by the make package
 RUNNING_MAKE_VERSION := $(MAKE_VERSION)
@@ -42,8 +42,8 @@ Emulation in qemu (BIOS)
 1. Edit grub-bios.cfg

  Since the driver will show up in the virtual machine as /dev/vda,
-  change board/pc/grub-bios.cfg to use root=/dev/vda2 instead of
-  root=/dev/sda2. Then rebuild grub2 and the image.
+  change board/pc/grub-bios.cfg to use root=/dev/vda1 instead of
+  root=/dev/sda1. Then rebuild grub2 and the image.

 2. Run the emulation with:

@@ -101,12 +101,14 @@ Flashing boot.bin:

 KD240 / KR260 Flashing Instructions:
 Flashing u-boot.itb:
+    $ usb start
    $ sf probe
    $ fatload usb 0 0x1000000 u-boot.itb
    $ sf erase 0xf80000 +$filesize
    $ sf write 0x1000000 0xf80000 $filesize

 Flashing boot.bin:
+    $ usb start
    $ sf probe
    $ fatload usb 0 0x1000000 boot.bin
    $ sf erase 0x200000 +$filesize
@@ -10,20 +10,20 @@ Notes on using Grub2 for BIOS-based platforms
      is enough free space *before* the first partition to
      store Grub2. Leaving 1 MB of free space is safe.
 3. Setup loop device and loop partitions
-   sudo losetup -f disk.img
-   sudo partx -a /dev/loop0
+   loop_dev=$(sudo losetup -f disk.img)
+   sudo partx -a "$loop_dev"
 4. Prepare the root partition
-   sudo mkfs.ext3 -L root /dev/loop0p1
-   sudo mount /dev/loop0p1 /mnt
+   sudo mkfs.ext3 -L root "${loop_dev}p1"
+   sudo mount "${loop_dev}p1" /mnt
   sudo tar -C /mnt -xf output/images/rootfs.tar
   sudo umount /mnt
 5. Install Grub2
   sudo ./output/host/sbin/grub-bios-setup \
        -b ./output/host/lib/grub/i386-pc/boot.img \
-        -c ./output/images/grub.img -d . /dev/loop0
+        -c ./output/images/grub.img -d . "$loop_dev"
 6. Cleanup loop device
-   sudo partx -d /dev/loop0
-   sudo losetup -d /dev/loop0
+   sudo partx -d "$loop_dev"
+   sudo losetup -d "$loop_dev"
 7. Your disk.img is ready!

 Using genimage
@@ -65,22 +65,22 @@ Notes on using Grub2 for x86/x86_64 EFI-based platforms
    - Create a second partition, type 8300, for the root
      filesystem.
 3. Setup loop device and loop partitions
-   sudo losetup -f disk.img
-   sudo partx -a /dev/loop0
+   loop_dev=$(sudo losetup -f disk.img)
+   sudo partx -a "$loop_dev"
 4. Prepare the boot partition
-   sudo mkfs.vfat -n boot /dev/loop0p1
-   sudo mount /dev/loop0p1 /mnt
+   sudo mkfs.vfat -n boot "${loop_dev}p1"
+   sudo mount "${loop_dev}p1" /mnt
   sudo cp -a output/images/efi-part/* /mnt/
   sudo cp output/images/bzImage /mnt/
   sudo umount /mnt
 5. Prepare the root partition
-   sudo mkfs.ext3 -L root /dev/loop0p2
-   sudo mount /dev/loop0p2 /mnt
+   sudo mkfs.ext3 -L root "${loop_dev}p2"
+   sudo mount "${loop_dev}p2" /mnt
   sudo tar -C /mnt -xf output/images/rootfs.tar
   sudo umount /mnt
 6  Cleanup loop device
-   sudo partx -d /dev/loop0
-   sudo losetup -d /dev/loop0
+   sudo partx -d "$loop_dev"
+   sudo losetup -d "$loop_dev"
 7. Your disk.img is ready!

 To test your i386/x86-64 EFI image in Qemu
@@ -128,7 +128,7 @@ endif

 config BR2_LINUX_KERNEL_VERSION
 	string
-	default "6.6.58" if BR2_LINUX_KERNEL_LATEST_VERSION
+	default "6.6.63" if BR2_LINUX_KERNEL_LATEST_VERSION
 	default "5.10.162-cip24" if BR2_LINUX_KERNEL_LATEST_CIP_VERSION
 	default "5.10.162-cip24-rt10" if BR2_LINUX_KERNEL_LATEST_CIP_RT_VERSION
 	default BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE \
@@ -1,12 +1,12 @@
 # From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
-sha256  e7df81e588d70fab5ec3ec3bb04ac53d51f0860fc3b1ec45e0a4167a026899db  linux-6.6.58.tar.xz
-sha256  2286e4a02ea2fbe65023dbf779f20aa994ba2b8d37ed559049378089451aa256  linux-6.1.114.tar.xz
+sha256  d1054ab4803413efe2850f50f1a84349c091631ec50a1cf9e891d1b1f9061835  linux-6.6.63.tar.xz
+sha256  aecdaf39d0a844a81ce4c67d9daff8979e938bb690df4f679fbbb494fe423278  linux-6.1.119.tar.xz
 # From https://www.kernel.org/pub/linux/kernel/v5.x/sha256sums.asc
-sha256  e618c6d845fd1bc89477508e8d084bbe791fc88bf7623adee2deb6ecb2275370  linux-5.15.169.tar.xz
-sha256  76cc8d7f1528f87902e38697229661d0617a7d6ab86166be9f3ef9a613b17b72  linux-5.10.228.tar.xz
-sha256  77221ab9aebeac746915c755ec3b7d320f85cd219c63d9c501820fbca1e3b32b  linux-5.4.284.tar.xz
+sha256  8a4b2a47ccc9b208b2b6ed9a216ea1a5eb12852c723bec1a04de9e671a1d7da8  linux-5.15.173.tar.xz
+sha256  cd1850ef3b771886df4e0b4c4eb07033864abab2bb553a20fd9e3cdc23584b47  linux-5.10.230.tar.xz
+sha256  180754f3df0e8d7f206625255b3f5a6e1f441feec83336df42613ca8f6b1887c  linux-5.4.286.tar.xz
 # From https://www.kernel.org/pub/linux/kernel/v4.x/sha256sums.asc
-sha256  4e27cdf999359876a0ff489bff6ece7ba5798ff37c2289db0c9e9422a9014162  linux-4.19.322.tar.xz
+sha256  607bed7de5cda31a443df4c8a78dbe5e8a9ad31afde2a4d28fe99ab4730e8de1  linux-4.19.325.tar.xz
 # Locally computed
 sha256  fb0edc3c18e47d2b6974cb0880a0afb5c3fa08f50ee87dfdf24349405ea5f8ae  linux-cip-5.10.162-cip24.tar.gz
 sha256  b5539243f187e3d478d76d44ae13aab83952c94b885ad889df6fa9997e16a441  linux-cip-5.10.162-cip24-rt10.tar.gz
@@ -69,6 +69,7 @@ config BR2_PACKAGE_ALSA_LIB_SEQ
 config BR2_PACKAGE_ALSA_LIB_UCM
 	bool "ucm"
 	default y
+	depends on BR2_USE_MMU # fork()
 	select BR2_PACKAGE_ALSA_LIB_MIXER

 config BR2_PACKAGE_ALSA_LIB_ALISP
@@ -1,4 +1,7 @@
-[PATCH] Fix makefiles for out-of-tree build
+From 1fe49c34aa3e32e801af5c56293ec71ff6e7e2bc Mon Sep 17 00:00:00 2001
+From: Gary Bisson <gary.bisson@boundarydevices.com>
+Date: Sun, 1 Dec 2024 15:43:17 +0100
+Subject: [PATCH] Fix makefiles for out-of-tree build

 Signed-off-by: Gary Bisson <gary.bisson@boundarydevices.com>
 ---
@@ -158,5 +161,5 @@ index 9e8b751..94a069b 100644
 LIBS+= -lz -lselinux
 
 -- 
-2.5.1
+2.47.0

@@ -1,4 +1,7 @@
-[PATCH] Fix adbd for non-Ubuntu systems
+From d433d5c340f3b36de58ea8550fd140dbdaea13b4 Mon Sep 17 00:00:00 2001
+From: Gary Bisson <gary.bisson@boundarydevices.com>
+Date: Sun, 1 Dec 2024 15:43:33 +0100
+Subject: [PATCH] Fix adbd for non-Ubuntu systems

 Remove glib/dbus dependencies and partially restore services.c to be
 closer to the original source code in order to run on systems without
@@ -7,7 +10,7 @@ sudo.
 Signed-off-by: Gary Bisson <gary.bisson@boundarydevices.com>
 ---
 core/adbd/adb.c          |   1 -
- core/adbd/services.c     | 160 ++++-------------------------------------------
+ core/adbd/services.c     | 160 +++------------------------------------
 debian/makefiles/adbd.mk |   4 +-
 3 files changed, 14 insertions(+), 151 deletions(-)

@@ -260,5 +263,5 @@ index 49dab8c..22c1816 100644
 OBJS= $(patsubst %, %.o, $(basename $(SRCS)))
 
 -- 
-2.5.1
+2.47.0

@@ -0,0 +1,96 @@
+From 946dbb00fe4b2a75c688a470fc0c3924aa018a24 Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Date: Sun, 14 Jul 2024 11:39:49 +0200
+Subject: [PATCH] Adjust base64 function handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+In order to support libcs that do not provide b64_pton(), one of the
+Debian patches adds a copy of b64_pton() and b64_ntop(). However, no
+prototype is added for those functions, causing an "implicit
+declaration" warning... or error depending on the compiler version
+used:
+
+core/adbd/adb_auth_client.c:75:15: error: implicit declaration of function ‘b64_pton’ [-Wimplicit-function-declaration]
+
+This patch adds appropriate prototypes, but while at it, also renames
+the internal copy of b64_*() functions to have an adb_ prefix in order
+to clarify things and not clash with definitions potentially coming
+from the C library.
+
+Upstream: N/A, we're too far from upstream
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+---
+ core/adb/adb_auth_client.c  | 3 ++-
+ core/adbd/adb_auth_client.c | 3 ++-
+ core/adbd/base64.c          | 4 ++--
+ 3 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/core/adb/adb_auth_client.c b/core/adb/adb_auth_client.c
+index 0b4913e..25b9828 100644
+--- a/core/adb/adb_auth_client.c
+++ b/core/adb/adb_auth_client.c
+@@ -45,6 +45,7 @@ static char *key_paths[] = {
+ static fdevent listener_fde;
+ static int framework_fd = -1;
+ 
+extern int adb_b64_pton(char const *src, u_char *target, size_t targsize);
+ 
+ static void read_keys(const char *file, struct listnode *list)
+ {
+@@ -72,7 +73,7 @@ static void read_keys(const char *file, struct listnode *list)
+         if (sep)
+             *sep = '\0';
+ 
+-        ret = __b64_pton(buf, (u_char *)&key->key, sizeof(key->key) + 4);
+        ret = adb_b64_pton(buf, (u_char *)&key->key, sizeof(key->key) + 4);
+         if (ret != sizeof(key->key)) {
+             D("%s: Invalid base64 data ret=%d\n", file, ret);
+             free(key);
+diff --git a/core/adbd/adb_auth_client.c b/core/adbd/adb_auth_client.c
+index 0b4913e..25b9828 100644
+--- a/core/adbd/adb_auth_client.c
+++ b/core/adbd/adb_auth_client.c
+@@ -45,6 +45,7 @@ static char *key_paths[] = {
+ static fdevent listener_fde;
+ static int framework_fd = -1;
+ 
+extern int adb_b64_pton(char const *src, u_char *target, size_t targsize);
+ 
+ static void read_keys(const char *file, struct listnode *list)
+ {
+@@ -72,7 +73,7 @@ static void read_keys(const char *file, struct listnode *list)
+         if (sep)
+             *sep = '\0';
+ 
+-        ret = __b64_pton(buf, (u_char *)&key->key, sizeof(key->key) + 4);
+        ret = adb_b64_pton(buf, (u_char *)&key->key, sizeof(key->key) + 4);
+         if (ret != sizeof(key->key)) {
+             D("%s: Invalid base64 data ret=%d\n", file, ret);
+             free(key);
+diff --git a/core/adbd/base64.c b/core/adbd/base64.c
+index 7270703..91fc1b2 100644
+--- a/core/adbd/base64.c
+++ b/core/adbd/base64.c
+@@ -134,7 +134,7 @@ static const char Pad64 = '=';
+    */
+ 
+ int
+-b64_ntop(src, srclength, target, targsize)
+adb_b64_ntop(src, srclength, target, targsize)
+ 	u_char const *src;
+ 	size_t srclength;
+ 	char *target;
+@@ -212,7 +212,7 @@ b64_ntop(src, srclength, target, targsize)
+  */
+ 
+ int
+-b64_pton(src, target, targsize)
+adb_b64_pton(src, target, targsize)
+ 	char const *src;
+ 	u_char *target;
+ 	size_t targsize;
+-- 
+2.47.0
+
@@ -1,36 +0,0 @@
-[PATCH] Fix build issue with uclibc
-
-Signed-off-by: Gary Bisson <gary.bisson@boundarydevices.com>
---
- core/adbd/adb_auth_client.c | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/core/adb/adb_auth_client.c b/core/adb/adb_auth_client.c
-index 0b4913e..068d837 100644
--- a/core/adb/adb_auth_client.c
-+++ b/core/adb/adb_auth_client.c
-@@ -72,7 +72,7 @@ static void read_keys(const char *file, struct listnode *list)
-         if (sep)
-             *sep = '\0';
- 
-        ret = __b64_pton(buf, (u_char *)&key->key, sizeof(key->key) + 4);
-+        ret = b64_pton(buf, (u_char *)&key->key, sizeof(key->key) + 4);
-         if (ret != sizeof(key->key)) {
-             D("%s: Invalid base64 data ret=%d\n", file, ret);
-             free(key);
-diff --git a/core/adbd/adb_auth_client.c b/core/adbd/adb_auth_client.c
-index 0b4913e..068d837 100644
--- a/core/adbd/adb_auth_client.c
-+++ b/core/adbd/adb_auth_client.c
-@@ -72,7 +72,7 @@ static void read_keys(const char *file, struct listnode *list)
-         if (sep)
-             *sep = '\0';
- 
-        ret = __b64_pton(buf, (u_char *)&key->key, sizeof(key->key) + 4);
-+        ret = b64_pton(buf, (u_char *)&key->key, sizeof(key->key) + 4);
-         if (ret != sizeof(key->key)) {
-             D("%s: Invalid base64 data ret=%d\n", file, ret);
-             free(key);
-- 
-2.6.1
-
@@ -1,4 +1,7 @@
-[PATCH] Fix build issue with musl
+From d14ca3e3362448590adaebacb76d4d8046f9b556 Mon Sep 17 00:00:00 2001
+From: Gary Bisson <gary.bisson@boundarydevices.com>
+Date: Sun, 1 Dec 2024 15:44:16 +0100
+Subject: [PATCH] Fix build issue with musl

 arpa/nameser.h doesn't use the same macro name to avoid several
 inclusions.
@@ -8,19 +11,12 @@ TEMP_FAILURE_RETRY macro.

 Signed-off-by: Gary Bisson <gary.bisson@boundarydevices.com>
 ---
- core/adbd/arpa_nameser.h              | 12 +++++++++---
- core/adbd/base64.c                    |  1 -
- core/adbd/framebuffer_service.c       |  1 +
- core/adbd/qemu_pipe.h                 |  1 -
- core/include/cutils/android_reboot.h  |  8 ++++++--
- core/include/cutils/bitops.h          | 10 ++++++----
- core/include/cutils/partition_utils.h |  8 ++++++--
- extras/ext4_utils/sha1.c              |  3 ---
- extras/ext4_utils/sha1.h              | 13 ++++++-------
- 9 files changed, 34 insertions(+), 23 deletions(-)
+ core/adbd/arpa_nameser.h        | 3 +++
+ core/adbd/framebuffer_service.c | 1 +
+ 2 files changed, 4 insertions(+)

 diff --git a/core/adbd/arpa_nameser.h b/core/adbd/arpa_nameser.h
-index 438dc04..b2a28d6 100644
+index 438dc04..f3d2fee 100644
 --- a/core/adbd/arpa_nameser.h
 +++ b/core/adbd/arpa_nameser.h
@@ -52,6 +52,8 @@
@@ -32,7 +28,7 @@ index 438dc04..b2a28d6 100644
 
 #define BIND_4_COMPAT
 
-@@ -574,4 +579,5 @@ __END_DECLS
+@@ -574,4 +576,5 @@ __END_DECLS
 #define  XLOG(...)   do {} while (0)
 #endif
 
@@ -51,4 +47,5 @@ index 20c08d2..48e0241 100644
 #include <sys/ioctl.h>
 #include <sys/mman.h>
 -- 
-2.6.1
+2.47.0
+
@@ -1,4 +1,7 @@
-makefiles: use pkgconf to get libs deps
+From 10f3f6fb75da72f155e72794d6647e4fa21a87d0 Mon Sep 17 00:00:00 2001
+From: Giulio Benetti <giulio.benetti@micronovasrl.com>
+Date: Sun, 1 Dec 2024 15:45:01 +0100
+Subject: [PATCH] makefiles: use pkgconf to get libs deps

 LIBS lists library dependencies without taking into account static linking
 that need ordered listing and more libraries listed since differently from
@@ -10,26 +13,36 @@ needed libraries are listed during linking.

 Signed-off-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
 ---
-diff -urpN android-tools-4.2.2+git20130218.orig/debian/makefiles/adbd.mk android-tools-4.2.2+git20130218/debian/makefiles/adbd.mk
--- android-tools-4.2.2+git20130218.orig/debian/makefiles/adbd.mk	2019-04-08 16:05:02.967710428 +0200
-+++ android-tools-4.2.2+git20130218/debian/makefiles/adbd.mk	2019-04-08 16:30:42.463084426 +0200
-@@ -44,7 +44,7 @@ CPPFLAGS+= -DADBD_NON_ANDROID
- CPPFLAGS+= -I$(SRCDIR)/core/adbd
- CPPFLAGS+= -I$(SRCDIR)/core/include
+ debian/makefiles/adb.mk  | 2 +-
+ debian/makefiles/adbd.mk | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)

-LIBS+= -lc -lpthread -lz -lcrypto -lcrypt
-+LIBS+= -lc -lpthread -lz `pkg-config --libs libcrypto` -lcrypt
-
- OBJS= $(patsubst %, %.o, $(basename $(SRCS)))
-
-diff -urpN android-tools-4.2.2+git20130218.orig/debian/makefiles/adb.mk android-tools-4.2.2+git20130218/debian/makefiles/adb.mk
--- android-tools-4.2.2+git20130218.orig/debian/makefiles/adb.mk	2019-04-08 16:05:02.959701400 +0200
-+++ android-tools-4.2.2+git20130218/debian/makefiles/adb.mk	2019-04-08 16:31:06.529426250 +0200
+diff --git a/debian/makefiles/adb.mk b/debian/makefiles/adb.mk
+index 654b9f1..a03c93a 100644
+--- a/debian/makefiles/adb.mk
+++ b/debian/makefiles/adb.mk
@@ -41,7 +41,7 @@ CPPFLAGS+= -DHAVE_TERMIO_H
 CPPFLAGS+= -I$(SRCDIR)/core/adb
 CPPFLAGS+= -I$(SRCDIR)/core/include
-
+ 
 -LIBS+= -lc -lpthread -lz -lcrypto
 +LIBS+= -lc -lpthread -lz `pkg-config --libs libcrypto`
-
+ 
 OBJS= $(SRCS:.c=.o)
+ 
+diff --git a/debian/makefiles/adbd.mk b/debian/makefiles/adbd.mk
+index 22c1816..a8eee3a 100644
+--- a/debian/makefiles/adbd.mk
+++ b/debian/makefiles/adbd.mk
+@@ -44,7 +44,7 @@ CPPFLAGS+= -DADBD_NON_ANDROID
+ CPPFLAGS+= -I$(SRCDIR)/core/adbd
+ CPPFLAGS+= -I$(SRCDIR)/core/include
+ 
+-LIBS+= -lc -lpthread -lz -lcrypto -lcrypt
+LIBS+= -lc -lpthread -lz `pkg-config --libs libcrypto` -lcrypt
+ 
+ OBJS= $(patsubst %, %.o, $(basename $(SRCS)))
+ 
+-- 
+2.47.0
+
@@ -1,4 +1,7 @@
-Fix build on big endian systems
+From 8f7e9458dbfca969d3edc9cf409b3439e98f4c5a Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Date: Sun, 1 Dec 2024 15:45:26 +0100
+Subject: [PATCH] Fix build on big endian systems

 The usb_linux_client.c file defines cpu_to_le16/32 by using the C
 library htole16/32 function calls. However, cpu_to_le16/32 are used
@@ -14,9 +17,13 @@ To solve this, we simply open-code cpu_to_le16/32 in a way that allows
 them to be used when initializing structures.

 Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+---
+ core/adb/usb_linux_client.c  | 11 +++++++++--
+ core/adbd/usb_linux_client.c | 11 +++++++++--
+ 2 files changed, 18 insertions(+), 4 deletions(-)

-Index: b/core/adb/usb_linux_client.c
-===================================================================
+diff --git a/core/adb/usb_linux_client.c b/core/adb/usb_linux_client.c
+index fb1dad0..a981e96 100644
 --- a/core/adb/usb_linux_client.c
 +++ b/core/adb/usb_linux_client.c
@@ -34,8 +34,15 @@
@@ -37,8 +44,8 @@ Index: b/core/adb/usb_linux_client.c
 
 struct usb_handle
 {
-Index: b/core/adbd/usb_linux_client.c
-===================================================================
+diff --git a/core/adbd/usb_linux_client.c b/core/adbd/usb_linux_client.c
+index 33875a8..0e4d200 100644
 --- a/core/adbd/usb_linux_client.c
 +++ b/core/adbd/usb_linux_client.c
@@ -34,8 +34,15 @@
@@ -59,3 +66,6 @@ Index: b/core/adbd/usb_linux_client.c
 
 struct usb_handle
 {
+-- 
+2.47.0
+
@@ -1,4 +1,7 @@
-Include cdefs.h wherever it is needed
+From d3f0157bf2ac1afc9a810ccbe188110df724129d Mon Sep 17 00:00:00 2001
+From: "Yann E. MORIN" <yann.morin.1998@free.fr>
+Date: Sun, 1 Dec 2024 15:46:15 +0100
+Subject: [PATCH] Include cdefs.h wherever it is needed

 cdefs.h is included from within a lot of glibc headers, so it almost
 invariably and automagically gets pulled in with glibc.
@@ -11,12 +14,12 @@ So we must include it when we are going to use macros it provides.

 Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
 ---
- core/adbd/services.c                  |  1 +
- core/libcutils/android_reboot.c       |  1 +
- 2 files changed, 2 insertions(+), 0 deletion(-)
+ core/adbd/services.c            | 1 +
+ core/libcutils/android_reboot.c | 1 +
+ 2 files changed, 2 insertions(+)

 diff --git a/core/adbd/services.c b/core/adbd/services.c
-index 20c08d2..48e0241 100644
+index 5adcefe..6de1951 100644
 --- a/core/adbd/services.c
 +++ b/core/adbd/services.c
@@ -20,6 +20,7 @@
@@ -28,7 +31,7 @@ index 20c08d2..48e0241 100644
 #include "sysdeps.h"
 
 diff --git a/core/libcutils/android_reboot.c b/core/libcutils/android_reboot.c
-index 20c08d2..48e0241 100644
+index 79c05f8..9386006 100644
 --- a/core/libcutils/android_reboot.c
 +++ b/core/libcutils/android_reboot.c
@@ -23,6 +23,7 @@
@@ -39,3 +42,6 @@ index 20c08d2..48e0241 100644
 
 #include <cutils/android_reboot.h>
 
+-- 
+2.47.0
+
@@ -1,42 +0,0 @@
-usb_linux.c: fix minor()/major() build failure due to glibc 2.28
-
-glibc 2.28 no longer includes <sys/sysmacros.h> from <sys/types.h>,
-and therefore <sys/sysmacros.h> must be included explicitly when
-major()/minor() are used.
-
-This commit adds a patch to directly include <sys/sysmacros.h> into
-all usb_linux.c files where minor() and major() macros are used.
-
-diff -urpN host-android-tools-4.2.2+git20130218.orig/core/adb/usb_linux.c host-android-tools-4.2.2+git20130218/core/adb/usb_linux.c
--- host-android-tools-4.2.2+git20130218.orig/core/adb/usb_linux.c	2013-02-18 15:49:03.000000000 +0100
-+++ host-android-tools-4.2.2+git20130218/core/adb/usb_linux.c	2018-09-09 11:47:16.476292546 +0200
-@@ -20,6 +20,7 @@
- #include <string.h>
- 
- #include <sys/ioctl.h>
-+#include <sys/sysmacros.h>
- #include <sys/types.h>
- #include <sys/time.h>
- #include <dirent.h>
-diff -urpN host-android-tools-4.2.2+git20130218.orig/core/adbd/usb_linux.c host-android-tools-4.2.2+git20130218/core/adbd/usb_linux.c
--- host-android-tools-4.2.2+git20130218.orig/core/adbd/usb_linux.c	2018-09-09 02:32:57.154503866 +0200
-+++ host-android-tools-4.2.2+git20130218/core/adbd/usb_linux.c	2018-09-09 11:47:28.148353880 +0200
-@@ -20,6 +20,7 @@
- #include <string.h>
- 
- #include <sys/ioctl.h>
-+#include <sys/sysmacros.h>
- #include <sys/types.h>
- #include <sys/time.h>
- #include <dirent.h>
-diff -urpN host-android-tools-4.2.2+git20130218.orig/core/fastboot/usb_linux.c host-android-tools-4.2.2+git20130218/core/fastboot/usb_linux.c
--- host-android-tools-4.2.2+git20130218.orig/core/fastboot/usb_linux.c	2013-02-18 15:49:03.000000000 +0100
-+++ host-android-tools-4.2.2+git20130218/core/fastboot/usb_linux.c	2018-09-09 11:46:53.028169154 +0200
-@@ -33,6 +33,7 @@
- 
- #include <sys/ioctl.h>
- #include <sys/stat.h>
-+#include <sys/sysmacros.h>
- #include <sys/types.h>
- #include <dirent.h>
- #include <fcntl.h>
@@ -0,0 +1,59 @@
+From 99c20bd08065d9c78d81ba7aa48a2a113ab28c26 Mon Sep 17 00:00:00 2001
+From: Giulio Benetti <giulio.benetti@micronovasrl.com>
+Date: Sun, 1 Dec 2024 15:46:50 +0100
+Subject: [PATCH] usb_linux.c: fix minor()/major() build failure due to glibc
+ 2.28
+
+glibc 2.28 no longer includes <sys/sysmacros.h> from <sys/types.h>,
+and therefore <sys/sysmacros.h> must be included explicitly when
+major()/minor() are used.
+
+This commit adds a patch to directly include <sys/sysmacros.h> into
+all usb_linux.c files where minor() and major() macros are used.
+
+Signed-off-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
+---
+ core/adb/usb_linux.c      | 1 +
+ core/adbd/usb_linux.c     | 1 +
+ core/fastboot/usb_linux.c | 1 +
+ 3 files changed, 3 insertions(+)
+
+diff --git a/core/adb/usb_linux.c b/core/adb/usb_linux.c
+index 7bf2057..f748267 100644
+--- a/core/adb/usb_linux.c
+++ b/core/adb/usb_linux.c
+@@ -20,6 +20,7 @@
+ #include <string.h>
+ 
+ #include <sys/ioctl.h>
+#include <sys/sysmacros.h>
+ #include <sys/types.h>
+ #include <sys/time.h>
+ #include <dirent.h>
+diff --git a/core/adbd/usb_linux.c b/core/adbd/usb_linux.c
+index 7bf2057..f748267 100644
+--- a/core/adbd/usb_linux.c
+++ b/core/adbd/usb_linux.c
+@@ -20,6 +20,7 @@
+ #include <string.h>
+ 
+ #include <sys/ioctl.h>
+#include <sys/sysmacros.h>
+ #include <sys/types.h>
+ #include <sys/time.h>
+ #include <dirent.h>
+diff --git a/core/fastboot/usb_linux.c b/core/fastboot/usb_linux.c
+index b7a9ca3..2dac62b 100644
+--- a/core/fastboot/usb_linux.c
+++ b/core/fastboot/usb_linux.c
+@@ -33,6 +33,7 @@
+ 
+ #include <sys/ioctl.h>
+ #include <sys/stat.h>
+#include <sys/sysmacros.h>
+ #include <sys/types.h>
+ #include <dirent.h>
+ #include <fcntl.h>
+-- 
+2.47.0
+
@@ -1,4 +1,4 @@
-From d24abbec201975a5eb7f8589614cfb424b8c80b6 Mon Sep 17 00:00:00 2001
+From 3c4319da20fab4e48ec02e28f5b013b4a33b5fe4 Mon Sep 17 00:00:00 2001
 From: Alex Kaplan <kaplan2539@gmail.com>
 Date: Sat, 10 Nov 2018 19:50:51 -0800
 Subject: [PATCH] Fix makefiles for out-of-tree ext4_utils build
@@ -44,5 +44,5 @@ index cb64916..c5904bf 100644
 LIBS+= -lz -lselinux
 
 -- 
-2.7.4
+2.47.0

@@ -1,4 +1,4 @@
-From bb3da0e32be4f2260940edf3ee0f88103dfd0dcc Mon Sep 17 00:00:00 2001
+From 79bf5cdee607241434e0d1c5b72e724eb1d20102 Mon Sep 17 00:00:00 2001
 From: Eneas U de Queiroz <cote2004-github@yahoo.com>
 Date: Tue, 5 Feb 2019 01:12:19 +0200
 Subject: [PATCH] adb: added patch for openssl 1.1.0 compatibility
@@ -43,5 +43,5 @@ index 9039d42..debd2ef 100644
 out:
     BN_free(n0inv);
 -- 
-2.14.1
+2.47.0

@@ -0,0 +1,54 @@
+From 6919b6619a9c744d2220f7af6e211c50662ba94b Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Date: Sun, 14 Jul 2024 11:41:10 +0200
+Subject: [PATCH] core/fastboot/fastboot.c: reorder functions to avoid implicit
+ definition
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The match_fastboot() function uses match_fastboot_with_serial() but is
+implemented before it, causing an implicit definition. Re-order the
+functions to avoid this.
+
+Fixes:
+
+core/fastboot/fastboot.c:191:12: error: implicit declaration of function ‘match_fastboot_with_serial’ [-Wimplicit-function-declaration]
+
+Upstream: N/A, we're too far from upstream
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+---
+ core/fastboot/fastboot.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/core/fastboot/fastboot.c b/core/fastboot/fastboot.c
+index 3de6d7d..9b2c86f 100644
+--- a/core/fastboot/fastboot.c
+++ b/core/fastboot/fastboot.c
+@@ -186,11 +186,6 @@ oops:
+ }
+ #endif
+ 
+-int match_fastboot(usb_ifc_info *info)
+-{
+-    return match_fastboot_with_serial(info, serial);
+-}
+-
+ int match_fastboot_with_serial(usb_ifc_info *info, const char *local_serial)
+ {
+     if(!(vendor_id && (info->dev_vendor == vendor_id)) &&
+@@ -217,6 +212,11 @@ int match_fastboot_with_serial(usb_ifc_info *info, const char *local_serial)
+     return 0;
+ }
+ 
+int match_fastboot(usb_ifc_info *info)
+{
+    return match_fastboot_with_serial(info, serial);
+}
+
+ int list_devices_callback(usb_ifc_info *info)
+ {
+     if (match_fastboot_with_serial(info, NULL) == 0) {
+-- 
+2.47.0
+
@@ -0,0 +1,37 @@
+From 72b9e79c81a237f1839afb4fdee680eafdd180d9 Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Date: Sun, 14 Jul 2024 11:41:56 +0200
+Subject: [PATCH] core/libsparse/sparse_read.c: add missing output_file.h
+ include
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+sparse_read.c uses read_all() without including the header file
+containing its prototype, causing:
+
+core/libsparse/sparse_read.c:122:31: error: implicit declaration of function ‘read_all’ [-Wimplicit-function-declaration]
+
+Fix this by including output_file.h.
+
+Upstream: N/A, we're too far from upstream
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+---
+ core/libsparse/sparse_read.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/core/libsparse/sparse_read.c b/core/libsparse/sparse_read.c
+index 704bcfa..0a8f838 100644
+--- a/core/libsparse/sparse_read.c
+++ b/core/libsparse/sparse_read.c
+@@ -32,6 +32,7 @@
+ #include "sparse_crc32.h"
+ #include "sparse_file.h"
+ #include "sparse_format.h"
+#include "output_file.h"
+ 
+ #if defined(__APPLE__) && defined(__MACH__)
+ #define lseek64 lseek
+-- 
+2.47.0
+
@@ -0,0 +1,54 @@
+From 01e86db8460d873aec15d658bfc717b026c0545f Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Date: Sun, 14 Jul 2024 11:46:51 +0200
+Subject: [PATCH] extras/ext4_utils/make_ext4fs_main.c: disable
+ Android-specific code
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Since we are not building with the Android code, we do not have the
+implementation of the selinux_android_file_context_handle(). However,
+its only call site is when 'mountpoint' is set, and 'mountpoint'
+cannot be non-NULL in non-Android cases due to how the -a option is
+parsed:
+
+		case 'a':
+ #ifdef ANDROID
+			fs_config_func = fs_config;
+			mountpoint = optarg;
+ #else
+			fprintf(stderr, "can't set android permissions - built without android support\n");
+			usage(argv[0]);
+			exit(EXIT_FAILURE);
+ #endif
+
+So also compile out the code calling
+selinux_android_file_context_handle() when ANDROID is not set.
+
+Fixes:
+
+make_ext4fs_main.c:155:25: error: implicit declaration of function ‘selinux_android_file_context_handle’ [-Wimplicit-function-declaration]
+
+Upstream: N/A, we're too far from upstream
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+---
+ extras/ext4_utils/make_ext4fs_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/extras/ext4_utils/make_ext4fs_main.c b/extras/ext4_utils/make_ext4fs_main.c
+index 17d3735..cb58011 100644
+--- a/extras/ext4_utils/make_ext4fs_main.c
+++ b/extras/ext4_utils/make_ext4fs_main.c
+@@ -149,7 +149,7 @@ int main(int argc, char **argv)
+ 		}
+ 	}
+ 
+-#if !defined(HOST)
+#if !defined(HOST) && defined(ANDROID)
+ 	// Use only if -S option not requested
+ 	if (!sehnd && mountpoint) {
+ 		sehnd = selinux_android_file_context_handle();
+-- 
+2.47.0
+
@@ -0,0 +1,52 @@
+From 850fd3f4a0384ebe492a466a9b1149060619aacb Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Date: Sun, 14 Jul 2024 12:57:22 +0200
+Subject: [PATCH] core/adbd/adb.c: open code capset()
+
+capset() is apparently implemented by C libraries (at least glibc and
+musl), but not exposed through a header as an official public API.
+
+In addition capset(2) says:
+
+  Note: glibc provides no wrappers for these system calls,
+  necessitating the use of syscall(2)
+
+The lack of a header with a prototype for capset() was not causing any
+problem so far, but GCC 14.x has become stricter on implicit
+declarations, causing the build to fail with:
+
+core/adbd/adb.c:1296:9: error: implicit declaration of function 'capset' [-Wimplicit-function-declaration]
+
+So fix that by open-coding it using syscall() as suggested by the man
+page.
+
+Upstream: N/A, we're too far from upstream
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+---
+ core/adbd/adb.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/core/adbd/adb.c b/core/adbd/adb.c
+index 7fe6445..98b1de1 100644
+--- a/core/adbd/adb.c
+++ b/core/adbd/adb.c
+@@ -41,6 +41,7 @@
+ #if !ADB_HOST
+ #include "android_filesystem_config.h"
+ #include <linux/capability.h>
+#include <sys/syscall.h>
+ #include <linux/prctl.h>
+ #include <sys/mount.h>
+ #else
+@@ -1293,7 +1294,7 @@ int adb_main(int is_daemon, int server_port)
+         header.pid = 0;
+         cap[CAP_TO_INDEX(CAP_SYS_BOOT)].effective |= CAP_TO_MASK(CAP_SYS_BOOT);
+         cap[CAP_TO_INDEX(CAP_SYS_BOOT)].permitted |= CAP_TO_MASK(CAP_SYS_BOOT);
+-        capset(&header, cap);
+        syscall(SYS_capset, &header, cap);
+ 
+         D("Local port disabled\n");
+     } else {
+-- 
+2.47.0
+
@@ -0,0 +1,34 @@
+From 8f351150de38641c8ce2e9b7f9a5cba29ccd8f7e Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Date: Sun, 14 Jul 2024 13:00:02 +0200
+Subject: [PATCH] core/adbd/adb.c: include correct header for prctl()
+
+As documented by prctl(2), the correct header to include for prctl()
+is <sys/prctl.h>, not <linux/prctl.h>.
+
+Fixes:
+
+core/adbd/adb.c:1256:13: error: implicit declaration of function 'prctl' [-Wimplicit-function-declaration]
+
+Upstream: N/A, we're too far from upstream
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+---
+ core/adbd/adb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/core/adbd/adb.c b/core/adbd/adb.c
+index 98b1de1..10f420b 100644
+--- a/core/adbd/adb.c
+++ b/core/adbd/adb.c
+@@ -42,7 +42,7 @@
+ #include "android_filesystem_config.h"
+ #include <linux/capability.h>
+ #include <sys/syscall.h>
+-#include <linux/prctl.h>
+#include <sys/prctl.h>
+ #include <sys/mount.h>
+ #else
+ #include "usb_vendors.h"
+-- 
+2.47.0
+
@@ -0,0 +1,68 @@
+From 5db9529436f13b8c073a0310da3a1107f84645da Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Date: Wed, 4 Dec 2024 20:51:22 +0100
+Subject: [PATCH] extras/ext4_utils/make_ext4fs.c: define
+ __SANE_USERSPACE_TYPES__
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The Debian patch ppc64el-ftbfs.patch is already defining
+__SANE_USERSPACE_TYPES__ in a few files to solve a conflict between
+kernel header definitions and local definition of some types, on
+powerpc64 and mips64.
+
+However, the Debian patch lacks an update to ext4_utils.c, and has the
+definition too late in make_ext4fs.c. This commit therefore fixes
+those two remaining issues, fixing:
+
+error: conflicting types for ‘u64’; have ‘long unsigned int’
+
+Upstream: N/A, we're too far from upstream
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+---
+ extras/ext4_utils/ext4_utils.c  | 5 ++++-
+ extras/ext4_utils/make_ext4fs.c | 4 ++++
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/extras/ext4_utils/ext4_utils.c b/extras/ext4_utils/ext4_utils.c
+index e95f5cc..9f6836f 100644
+--- a/extras/ext4_utils/ext4_utils.c
+++ b/extras/ext4_utils/ext4_utils.c
+@@ -14,6 +14,10 @@
+  * limitations under the License.
+  */
+ 
+#if defined(__linux__)
+#define __SANE_USERSPACE_TYPES__
+#endif
+
+ #include "ext4_utils.h"
+ #include "uuid.h"
+ #include "allocate.h"
+@@ -36,7 +40,6 @@
+ #endif
+ 
+ #if defined(__linux__)
+-#define __SANE_USERSPACE_TYPES__
+ #include <linux/fs.h>
+ #elif defined(__APPLE__) && defined(__MACH__)
+ #include <sys/disk.h>
+diff --git a/extras/ext4_utils/make_ext4fs.c b/extras/ext4_utils/make_ext4fs.c
+index 3124aed..332a213 100644
+--- a/extras/ext4_utils/make_ext4fs.c
+++ b/extras/ext4_utils/make_ext4fs.c
+@@ -14,6 +14,10 @@
+  * limitations under the License.
+  */
+ 
+#if defined(__linux__)
+#define __SANE_USERSPACE_TYPES__
+#endif
+
+ #include "make_ext4fs.h"
+ #include "ext4_utils.h"
+ #include "allocate.h"
+-- 
+2.47.0
+
@@ -1,3 +1,3 @@
 # Locally computed
-sha256  41a99b340b568a12ba58486cf07a63ab01b8dbbc8da1c4e833c30dc251340aaa  babeld-babeld-1.9.2-br1.tar.gz
+sha256  d1b41f246a437bdafa5551fb16ca957fc9402de1c53f3647ead9466d67fe3fe0  babeld-babeld-1.9.2-br1.tar.gz
 sha256  b415c41292cedef6c97b243609e50552887c29343566c639f23282d31efd2afd  LICENCE
@@ -1,5 +1,6 @@
 config BR2_PACKAGE_HOST_BMAP_TOOLS
 	bool "host bmap-tools"
+	select BR2_PACKAGE_HOST_PYTHON3 # runtime
 	select BR2_PACKAGE_HOST_PYTHON_SIX # runtime
 	help
 	  Tool to flash image files to block devices using the block map
@@ -6,7 +6,7 @@

 BOOST_VERSION = 1.83.0
 BOOST_SOURCE = boost_$(subst .,_,$(BOOST_VERSION)).tar.bz2
-BOOST_SITE = https://boostorg.jfrog.io/artifactory/main/release/$(BOOST_VERSION)/source
+BOOST_SITE = https://archives.boost.io/release/$(BOOST_VERSION)/source
 BOOST_INSTALL_STAGING = YES
 BOOST_LICENSE = BSL-1.0
 BOOST_LICENSE_FILES = LICENSE_1_0.txt
@@ -1,105 +0,0 @@
-From 7297a8ef3cab3b0faf1426622ee902a2144e2e89 Mon Sep 17 00:00:00 2001
-From: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
-Date: Wed, 24 Mar 2021 11:27:14 +0100
-Subject: [PATCH] ebtables.h: restore KERNEL_64_USERSPACE_32 checks
-
-Commit e6359eedfbf497e52d52451072aea4713ed80a88 replaced the file ebtables.h
-but removed the usage of KERNEL_64_USERSPACE_32. This breaks boards where
-such flag is relevant, with following messages:
-
-[ 6364.971346] kernel msg: ebtables bug: please report to author: Standard target size too big
-
-Unable to update the kernel. Two possible causes:
-1. Multiple ebtables programs were executing simultaneously. The ebtables
-   userspace tool doesn't by default support multiple ebtables programs running
-   concurrently. The ebtables option --concurrent or a tool like flock can be
-   used to support concurrent scripts that update the ebtables kernel tables.
-2. The kernel doesn't support a certain ebtables extension, consider
-   recompiling your kernel or insmod the extension.
-
-Analysis shows that the structure 'ebt_replace' passed from userspace
-ebtables to the kernel, is too small, i.e 80 bytes instead of 120 in case of
-64-bit kernel.
-
-Note that the ebtables build system seems to assume that 'sparc64' is the
-only case where KERNEL_64_USERSPACE_32 is relevant, but this is not true.
-This situation can happen on many architectures, especially in embedded
-systems. For example, an Aarch64 processor with kernel in 64-bit but
-userland build for 32-bit Arm. Or a 64-bit MIPS Octeon III processor, with
-userland running in the 'n32' ABI.
-
-Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
-Upstream-Status: http://patchwork.ozlabs.org/project/netfilter-devel/patch/20210518181730.13436-1-patrickdepinguin@gmail.com/
---
- include/linux/netfilter_bridge/ebtables.h | 21 +++++++++++++++++++++
- 1 file changed, 21 insertions(+)
-
-diff --git a/include/linux/netfilter_bridge/ebtables.h b/include/linux/netfilter_bridge/ebtables.h
-index 5be75f2..3c2b61e 100644
--- a/include/linux/netfilter_bridge/ebtables.h
-+++ b/include/linux/netfilter_bridge/ebtables.h
-@@ -49,12 +49,21 @@ struct ebt_replace {
- 	/* total size of the entries */
- 	unsigned int entries_size;
- 	/* start of the chains */
-+#ifdef KERNEL_64_USERSPACE_32
-+	uint64_t hook_entry[NF_BR_NUMHOOKS];
-+#else
- 	struct ebt_entries *hook_entry[NF_BR_NUMHOOKS];
-+#endif
- 	/* nr of counters userspace expects back */
- 	unsigned int num_counters;
- 	/* where the kernel will put the old counters */
-+#ifdef KERNEL_64_USERSPACE_32
-+	uint64_t counters;
-+	uint64_t entries;
-+#else
- 	struct ebt_counter *counters;
- 	char *entries;
-+#endif
- };
- 
- struct ebt_replace_kernel {
-@@ -129,6 +138,9 @@ struct ebt_entry_match {
- 	} u;
- 	/* size of data */
- 	unsigned int match_size;
-+#ifdef KERNEL_64_USERSPACE_32
-+	unsigned int pad;
-+#endif
- 	unsigned char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
- };
- 
-@@ -142,6 +154,9 @@ struct ebt_entry_watcher {
- 	} u;
- 	/* size of data */
- 	unsigned int watcher_size;
-+#ifdef KERNEL_64_USERSPACE_32
-+	unsigned int pad;
-+#endif
- 	unsigned char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
- };
- 
-@@ -155,6 +170,9 @@ struct ebt_entry_target {
- 	} u;
- 	/* size of data */
- 	unsigned int target_size;
-+#ifdef KERNEL_64_USERSPACE_32
-+	unsigned int pad;
-+#endif
- 	unsigned char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
- };
- 
-@@ -162,6 +180,9 @@ struct ebt_entry_target {
- struct ebt_standard_target {
- 	struct ebt_entry_target target;
- 	int verdict;
-+#ifdef KERNEL_64_USERSPACE_32
-+	unsigned int pad;
-+#endif
- };
- 
- /* one entry */
-- 
-2.26.2
-
@@ -1,51 +0,0 @@
-From ebf0236270b977a62c522bc32810bc9f8edc72d1 Mon Sep 17 00:00:00 2001
-From: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
-Date: Wed, 24 Mar 2021 13:40:14 +0100
-Subject: [PATCH] configure.ac: add option --enable-kernel-64-userland-32
-
-The ebtables build system seems to assume that 'sparc64' is the
-only case where KERNEL_64_USERSPACE_32 is relevant, but this is not true.
-This situation can happen on many architectures, especially in embedded
-systems. For example, an Aarch64 processor with kernel in 64-bit but
-userland build for 32-bit Arm. Or a 64-bit MIPS Octeon III processor, with
-userland running in the 'n32' ABI.
-
-While it is possible to set CFLAGS in the environment when calling the
-configure script, the caller would need to know to not only specify
-KERNEL_64_USERSPACE_32 but also the EBT_MIN_ALIGN value.
-
-Instead, add a configure option. All internal details can then be handled by
-the configure script.
-
-Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
-Upstream-Status: http://patchwork.ozlabs.org/project/netfilter-devel/patch/20210518181730.13436-2-patrickdepinguin@gmail.com/
---
- configure.ac | 9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/configure.ac b/configure.ac
-index c24ede3..3e89c0c 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -15,10 +15,17 @@ AS_IF([test "x$LOCKFILE" = x], [LOCKFILE="/var/lib/ebtables/lock"])
- 
- regular_CFLAGS="-Wall -Wunused"
- regular_CPPFLAGS=""
-+
- case "$host" in
- 	sparc64-*)
-		regular_CPPFLAGS="$regular_CPPFLAGS -DEBT_MIN_ALIGN=8 -DKERNEL_64_USERSPACE_32";;
-+		enable_kernel_64_userland_32=yes ;;
- esac
-+AC_ARG_ENABLE([kernel-64-userland-32],
-+    AC_HELP_STRING([--enable-kernel-64-userland-32], [indicate that ebtables will be built as a 32-bit application but run under a 64-bit kernel])
-+)
-+AS_IF([test "x$enable_kernel_64_userland_32" = xyes],
-+    [regular_CPPFLAGS="$regular_CPPFLAGS -DEBT_MIN_ALIGN=8 -DKERNEL_64_USERSPACE_32"]
-+)
- 
- AC_SUBST([regular_CFLAGS])
- AC_SUBST([regular_CPPFLAGS])
-- 
-2.26.2
-
@@ -1,6 +1,8 @@
 config BR2_PACKAGE_EBTABLES
 	bool "ebtables"
 	depends on BR2_USE_MMU # fork()
+	# https://lore.kernel.org/all/20210518181730.13436-1-patrickdepinguin@gmail.com/
+	depends on !BR2_KERNEL_64_USERLAND_32
 	help
 	  Ethernet bridge frame table administration

@@ -11,12 +11,6 @@ EBTABLES_LICENSE_FILES = COPYING
 EBTABLES_CPE_ID_VENDOR = netfilter
 EBTABLES_SELINUX_MODULES = iptables

-# for 0003-configure.ac-add-option-enable-kernel-64-userland-32.patch
-EBTABLES_AUTORECONF = YES
-ifeq ($(BR2_KERNEL_64_USERLAND_32),y)
-EBTABLES_CONF_OPTS += --enable-kernel-64-userland-32
-endif
-
 ifeq ($(BR2_PACKAGE_EBTABLES_UTILS_SAVE),y)
 define EBTABLES_INSTALL_TARGET_UTILS_SAVE
 	$(INSTALL) -m 0755 -D $(@D)/ebtables-save.sh $(TARGET_DIR)/usr/sbin/ebtables-legacy-save
@@ -1,3 +1,3 @@
 # Locally calculated
-sha256  274db254a6979bde5aad404763a704956940e465843f2a9bd9ed7af22e2c0efc  expat-2.6.3.tar.xz
+sha256  a695629dae047055b37d50a0ff4776d1d45d0a4c842cf4ccee158441f55ff7ee  expat-2.6.4.tar.xz
 sha256  122f2c27000472a201d337b9b31f7eb2b52d091b02857061a8880371612d9534  COPYING
@@ -4,7 +4,7 @@
 #
 ################################################################################

-EXPAT_VERSION = 2.6.3
+EXPAT_VERSION = 2.6.4
 EXPAT_SITE = https://github.com/libexpat/libexpat/releases/download/R_$(subst .,_,$(EXPAT_VERSION))
 EXPAT_SOURCE = expat-$(EXPAT_VERSION).tar.xz
 EXPAT_INSTALL_STAGING = YES
@@ -5,8 +5,8 @@
 ################################################################################

 FBV_VERSION = 1.0b
-FBV_SITE = http://s-tech.elsat.net.pl/fbv
-
+# upstream (http://s-tech.elsat.net.pl/fbv) dead
+FBV_SITE = http://sources.buildroot.net/fbv
 FBV_LICENSE = GPL-2.0
 FBV_LICENSE_FILES = COPYING

@@ -1,3 +1,3 @@
 # Locally computed
-sha256  8060ec28cbf6e2e3d408665330da4bc48fd094d4f1265d7c58dc75c767463c29  1.16.2.tar.gz
+sha256  ff81bca86178ef326588176f8bdf817bb3e0fbc891d026960144f69c8a74eb4d  foot-1.16.2-git4.tar.gz
 sha256  d534a23a31500a0ac958d9634b84f532bd73ff1aca1bb8f7debbcbebc16ff39a  LICENSE
@@ -5,8 +5,8 @@
 ################################################################################

 FOOT_VERSION = 1.16.2
-FOOT_SOURCE = $(FOOT_VERSION).tar.gz
-FOOT_SITE = https://codeberg.org/dnkl/foot/archive
+FOOT_SITE = https://codeberg.org/dnkl/foot.git
+FOOT_SITE_METHOD = git
 FOOT_LICENSE = MIT
 FOOT_LICENSE_FILES = LICENSE
 FOOT_DEPENDENCIES = \
@@ -1,3 +1,3 @@
 # Locally calculated
-sha256  7ae9d8bafc65bb5d0f21061ac61dbc6cf93b2b05a5dae9e5eec72ed42388551e  frr-8.5.4.tar.gz
+sha256  5f3a32e66efdf2628548165d10327688847443c342788b31c4ea98368cfacbf8  frr-8.5.6.tar.gz
 sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  COPYING
@@ -4,7 +4,7 @@
 #
 ################################################################################

-FRR_VERSION = 8.5.4
+FRR_VERSION = 8.5.6
 FRR_SITE = $(call github,FRRouting,frr,frr-$(FRR_VERSION))
 FRR_LICENSE = GPL-2.0
 FRR_LICENSE_FILES = COPYING
@@ -5,7 +5,8 @@
 ################################################################################

 GAMIN_VERSION = 0.1.10
-GAMIN_SITE = http://www.gnome.org/~veillard/gamin/sources
+# upstream (http://www.gnome.org/~veillard/gamin/sources) dead
+GAMIN_SITE = http://sources.buildroot.net/gamin
 GAMIN_AUTORECONF = YES
 GAMIN_INSTALL_STAGING = YES
 GAMIN_LICENSE = LGPL-2.0+
@@ -1,6 +1,6 @@
 # Locally calculated after checking pgp signature
-# https://www.gnupg.org/ftp/gcrypt/gnutls/v3.8/gnutls-3.8.7.tar.xz.sig
-sha256  fe302f2b6ad5a564bcb3678eb61616413ed5277aaf8e7bf7cdb9a95a18d9f477  gnutls-3.8.7.tar.xz
+# https://www.gnupg.org/ftp/gcrypt/gnutls/v3.8/gnutls-3.8.8.tar.xz.sig
+sha256  ac4f020e583880b51380ed226e59033244bc536cad2623f2e26f5afa2939d8fb  gnutls-3.8.8.tar.xz
 # Locally calculated
 sha256  3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986  doc/COPYING
 sha256  dc626520dcd53a22f727af3ee42c770e56c97a64fe3adb063799d8ab032fe551  doc/COPYING.LESSER
@@ -6,7 +6,7 @@

 # When bumping, make sure *all* --without-libfoo-prefix options are in GNUTLS_CONF_OPTS
 GNUTLS_VERSION_MAJOR = 3.8
-GNUTLS_VERSION = $(GNUTLS_VERSION_MAJOR).7
+GNUTLS_VERSION = $(GNUTLS_VERSION_MAJOR).8
 GNUTLS_SOURCE = gnutls-$(GNUTLS_VERSION).tar.xz
 GNUTLS_SITE = https://www.gnupg.org/ftp/gcrypt/gnutls/v$(GNUTLS_VERSION_MAJOR)
 GNUTLS_LICENSE = LGPL-2.1+ (core library)
@@ -58,11 +58,11 @@ HOST_GNUTLS_CONF_OPTS = \
 	--without-libz-prefix \
 	--without-tpm \
 	--disable-openssl-compatibility \
-	--without-libbrotli \
+	--without-brotli \
 	--without-idn \
 	--without-p11-kit \
 	--without-zlib \
-	--without-libzstd
+	--without-zstd

 ifeq ($(BR2_PACKAGE_GNUTLS_OPENSSL),y)
 GNUTLS_LICENSE += , GPL-3.0+ (gnutls-openssl library)
@@ -73,10 +73,10 @@ GNUTLS_CONF_OPTS += --disable-openssl-compatibility
 endif

 ifeq ($(BR2_PACKAGE_BROTLI),y)
-GNUTLS_CONF_OPTS += --with-libbrotli
+GNUTLS_CONF_OPTS += --with-brotli
 GNUTLS_DEPENDENCIES += brotli
 else
-GNUTLS_CONF_OPTS += --without-libbrotli
+GNUTLS_CONF_OPTS += --without-brotli
 endif

 ifeq ($(BR2_PACKAGE_CRYPTODEV_LINUX),y)
@@ -106,10 +106,10 @@ GNUTLS_CONF_OPTS += --without-zlib
 endif

 ifeq ($(BR2_PACKAGE_ZSTD),y)
-GNUTLS_CONF_OPTS += --with-libzstd
+GNUTLS_CONF_OPTS += --with-zstd
 GNUTLS_DEPENDENCIES += zstd
 else
-GNUTLS_CONF_OPTS += --without-libzstd
+GNUTLS_CONF_OPTS += --without-zstd
 endif

 # Provide a default CA cert location
@@ -36,7 +36,7 @@ config BR2_PACKAGE_GOBJECT_INTROSPECTION
 	  language bindings can read this metadata and automatically
 	  provide bindings to call into the C library.

-	  https://wiki.gnome.org/action/show/Projects/GObjectIntrospection
+	  https://gi.readthedocs.io/

 comment "gobject-introspection needs python3"
 	depends on !BR2_PACKAGE_PYTHON3
@@ -1,3 +1,3 @@
 # Locally computed
-sha256  8b7582eac7e9a691356e18b3bdcbc7b2db09494e040ec980a4a5fb6d0da261bf  intel-microcode-20240910.tar.gz
+sha256  37246208ef68039be752438c72400a688a2238df13a7f5282497c80be2d8366d  intel-microcode-20241112.tar.gz
 sha256  03efb1491c7e899feb2665fa299363e64035e5444c1b8bc1f6ebed30de964e12  license
@@ -4,7 +4,7 @@
 #
 ################################################################################

-INTEL_MICROCODE_VERSION = 20240910
+INTEL_MICROCODE_VERSION = 20241112
 INTEL_MICROCODE_SITE = $(call github,intel,Intel-Linux-Processor-Microcode-Data-Files,microcode-$(INTEL_MICROCODE_VERSION))
 INTEL_MICROCODE_LICENSE = PROPRIETARY
 INTEL_MICROCODE_LICENSE_FILES = license
@@ -1,4 +1,5 @@
-# Locally calculated after checking pgp signature
-sha256  fefe9ec8c7b1475449945c934a2360ab12693454892be47a6d288c63eb107ead  irssi-1.4.4.tar.xz
+# Locally calculated after checking pgp signature with key
+# 7EE65E3082A5FB06AC7C368D00CCB587DDBEF0E1
+sha256  72a951cb0ad622785a8962801f005a3a412736c7e7e3ce152f176287c52fe062  irssi-1.4.5.tar.xz
 # Locally calculated
 sha256  a1a27cb2ecee8d5378fbb3562f577104a445d6d66fee89286e16758305e63e2b  COPYING
@@ -4,7 +4,7 @@
 #
 ################################################################################

-IRSSI_VERSION = 1.4.4
+IRSSI_VERSION = 1.4.5
 IRSSI_SOURCE = irssi-$(IRSSI_VERSION).tar.xz
 IRSSI_SITE = https://codeberg.org/irssi/irssi/releases/download/$(IRSSI_VERSION)
 IRSSI_LICENSE = GPL-2.0+
@@ -1,5 +1,5 @@
 # Locally calculated after checking pgp signature
-# https://curl.se/download/curl-8.10.1.tar.xz.asc
+# https://curl.se/download/curl-8.11.0.tar.xz.asc
 # signed with key 27EDEAF22F3ABCEB50DB9A125CC908FDB71E12C2
-sha256  73a4b0e99596a09fa5924a4fb7e4b995a85fda0d18a2c02ab9cf134bebce04ee  curl-8.10.1.tar.xz
+sha256  db59cf0d671ca6e7f5c2c5ec177084a33a79e04c97e71cf183a5cdea235054eb  curl-8.11.0.tar.xz
 sha256  adb1fc06547fd136244179809f7b7c2d2ae6c4534f160aa513af9b6a12866a32  COPYING
@@ -4,7 +4,7 @@
 #
 ################################################################################

-LIBCURL_VERSION = 8.10.1
+LIBCURL_VERSION = 8.11.0
 LIBCURL_SOURCE = curl-$(LIBCURL_VERSION).tar.xz
 LIBCURL_SITE = https://curl.se/download
 LIBCURL_DEPENDENCIES = host-pkgconf \
@@ -1,5 +1,7 @@
 # Locally calculated after checking pgp signature
-sha256  9560941a9d843c0243a71b17a7ac6fe31c7cebb5bce3983db79e52ae7e850491  krb5-1.21.2.tar.gz
+# from https://web.mit.edu/kerberos/dist/krb5/1.21/krb5-1.21.3.tar.gz.asc
+# with key C4493CB739F4A89F9852CBC20CBA08575F8372DF
+sha256  b7a4cd5ead67fb08b980b21abd150ff7217e85ea320c9ed0c6dadd304840ad35  krb5-1.21.3.tar.gz

 # Hash for license file:
-sha256  0d5373486138cb176c063db98274b4c4ab6ef3518c4191360736384b780306c2  NOTICE
+sha256  7601361a275aadbe35c90185519323c28730d60c553683e56fd06cf9c5f749a6  NOTICE
@@ -5,7 +5,7 @@
 ################################################################################

 LIBKRB5_VERSION_MAJOR = 1.21
-LIBKRB5_VERSION = $(LIBKRB5_VERSION_MAJOR).2
+LIBKRB5_VERSION = $(LIBKRB5_VERSION_MAJOR).3
 LIBKRB5_SITE = https://web.mit.edu/kerberos/dist/krb5/$(LIBKRB5_VERSION_MAJOR)
 LIBKRB5_SOURCE = krb5-$(LIBKRB5_VERSION).tar.gz
 LIBKRB5_SUBDIR = src
@@ -1,3 +1,3 @@
 # Locally computed
-sha256  899be4e25ab7fe5799d43f9567510d6f063d2e8f56136dd726b6fd976f9b2253  libmodbus-3.1.10.tar.gz
+sha256  15b4b2e0f68122c2da9b195de5c330489a9c97d40b4a95d2822378dc14d780e7  libmodbus-3.1.11.tar.gz
 sha256  dc626520dcd53a22f727af3ee42c770e56c97a64fe3adb063799d8ab032fe551  COPYING.LESSER
@@ -4,7 +4,7 @@
 #
 ################################################################################

-LIBMODBUS_VERSION = 3.1.10
+LIBMODBUS_VERSION = 3.1.11
 LIBMODBUS_SITE = https://github.com/stephane/libmodbus/releases/download/v$(LIBMODBUS_VERSION)
 LIBMODBUS_LICENSE = LGPL-2.1+
 LIBMODBUS_LICENSE_FILES = COPYING.LESSER
@@ -45,6 +45,7 @@ config BR2_PACKAGE_LIBVIRT_DAEMON
 	bool "libvirtd"
 	default y
 	depends on BR2_INSTALL_LIBSTDCPP # nmap
+	depends on !BR2_KERNEL_64_USERLAND_32 # ebtables
 	select BR2_PACKAGE_BUSYBOX_SHOW_OTHERS
 	select BR2_PACKAGE_DNSMASQ
 	select BR2_PACKAGE_EBTABLES
@@ -1,6 +1,6 @@
 config BR2_PACKAGE_LIBVPL_ARCH_SUPPORTS
 	bool
-	default y if BR2_ARCH_IS_64
+	default y if BR2_ARCH_IS_64 && !BR2_mips64 && !BR2_mips64el
 	default y if BR2_arm

 config BR2_PACKAGE_LIBVPL
@@ -403,12 +403,12 @@ endchoice

 config BR2_DEFAULT_KERNEL_HEADERS
 	string
-	default "4.19.322"	if BR2_KERNEL_HEADERS_4_19
-	default "5.4.284"	if BR2_KERNEL_HEADERS_5_4
-	default "5.10.228"	if BR2_KERNEL_HEADERS_5_10
-	default "5.15.169"	if BR2_KERNEL_HEADERS_5_15
-	default "6.1.114"	if BR2_KERNEL_HEADERS_6_1
-	default "6.6.58"	if BR2_KERNEL_HEADERS_6_6
+	default "4.19.325"	if BR2_KERNEL_HEADERS_4_19
+	default "5.4.286"	if BR2_KERNEL_HEADERS_5_4
+	default "5.10.230"	if BR2_KERNEL_HEADERS_5_10
+	default "5.15.173"	if BR2_KERNEL_HEADERS_5_15
+	default "6.1.119"	if BR2_KERNEL_HEADERS_6_1
+	default "6.6.63"	if BR2_KERNEL_HEADERS_6_6
 	default BR2_DEFAULT_KERNEL_VERSION if BR2_KERNEL_HEADERS_VERSION
 	default "custom"	if BR2_KERNEL_HEADERS_CUSTOM_TARBALL
 	default BR2_KERNEL_HEADERS_CUSTOM_REPO_VERSION \
@@ -28,7 +28,8 @@ PERF_MAKE_FLAGS = \
 	NO_LIBPERL=1 \
 	NO_LIBPYTHON=1 \
 	NO_LIBBIONIC=1 \
-	NO_LIBTRACEEVENT=1
+	NO_LIBTRACEEVENT=1 \
+	NO_SHELLCHECK=1

 # We need to pass an argument to ld for setting the emulation when
 # building for MIPS architecture, otherwise the default one will always
@@ -0,0 +1,30 @@
+From 2c7ff6989bc6161d8a2cc823d3aa7c9cb1deca80 Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Date: Wed, 4 Dec 2024 22:59:31 +0100
+Subject: [PATCH] scripts/build: make it possible to set LDLIBS
+
+LDLIBS is currently unconditionnally set to '-lm', but doesn't allow
+the user to provide additional libraries to link with.
+
+Upstream: dead, last release in 2006
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+---
+ scripts/build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/build b/scripts/build
+index 60b755c..4820d80 100755
+--- a/scripts/build
+++ b/scripts/build
+@@ -18,7 +18,7 @@ done
+ 
+ trap 'rm -f ${BASE}$$.s ${BASE}$$.c ${BASE}$$.o ${BASE}$$; exit 1' 1 2 15
+ 
+-LDLIBS=-lm
+LDLIBS="${LDLIBS} -lm"
+ 
+ # check for HP-UX's ANSI compiler
+ echo "main(int ac, char *av[]) { int i; }" > ${BASE}$$.c
+-- 
+2.47.0
+
@@ -26,7 +26,6 @@ LMBENCH_POST_PATCH_HOOKS += UPDATE_CONFIG_HOOK

 define LMBENCH_CONFIGURE_CMDS
 	sed -i 's/CFLAGS=/CFLAGS+=/g' $(@D)/src/Makefile
-	sed -i 's/LDLIBS=/LDLIBS+=/g' $(@D)/scripts/build
 	sed -i '/cd .*doc/d' $(@D)/src/Makefile
 	sed -i '/include/d' $(@D)/src/Makefile
 	touch $@
@@ -1,4 +1,4 @@
-# From https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.8:
-sha256  241c68402cef653e586be3ce28d57da24598eb0df13fcdea9d99bfce58717132  mbedtls-2.28.8.tar.bz2
+# From https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.9:
+sha256  e85ea97aaf78dd6c0a5ba2e54dd5932ffa15f39abfc189c26beef7684630c02b  mbedtls-2.28.9.tar.bz2
 # Locally calculated
 sha256  9b405ef4c89342f5eae1dd828882f931747f71001cfba7d114801039b52ad09b  LICENSE
@@ -4,8 +4,8 @@
 #
 ################################################################################

-MBEDTLS_VERSION = 2.28.8
-MBEDTLS_SITE = https://github.com/Mbed-TLS/mbedtls/releases/download/v$(MBEDTLS_VERSION)
+MBEDTLS_VERSION = 2.28.9
+MBEDTLS_SITE = https://github.com/Mbed-TLS/mbedtls/releases/download/mbedtls-$(MBEDTLS_VERSION)
 MBEDTLS_SOURCE = mbedtls-$(MBEDTLS_VERSION).tar.bz2
 MBEDTLS_CONF_OPTS = \
 	-DCMAKE_C_FLAGS="$(TARGET_CFLAGS) -std=c99" \
@@ -0,0 +1,390 @@
+From 18d41744338d6e291612e66e8baace4faaad7b2e Mon Sep 17 00:00:00 2001
+From: Peter Korsgaard <peter@korsgaard.com>
+Date: Fri, 6 Dec 2024 08:27:53 +0100
+Subject: [PATCH] Revert "Fix NetBSD build"
+
+This reverts commit 88b7bb3521cc51cb1e80630395ae736040cc8ff8.
+
+This unfortunately broke non-thread builds, so revert it until fixed
+upstream.
+
+Upstream: https://github.com/eclipse-mosquitto/mosquitto/issues/3183
+Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
+---
+ lib/dummypthread.h       | 14 ++++++++++++
+ lib/handle_pubackcomp.c  |  4 ++--
+ lib/mosquitto_internal.h |  6 +++++-
+ lib/packet_mosq.c        | 46 ++++++++++++++++++++--------------------
+ lib/pthread_compat.h     | 28 ------------------------
+ lib/util_mosq.c          | 32 ++++++++++++++--------------
+ 6 files changed, 60 insertions(+), 70 deletions(-)
+ create mode 100644 lib/dummypthread.h
+ delete mode 100644 lib/pthread_compat.h
+
+diff --git a/lib/dummypthread.h b/lib/dummypthread.h
+new file mode 100644
+index 00000000..c0eb2c15
+--- /dev/null
+++ b/lib/dummypthread.h
+@@ -0,0 +1,14 @@
+#ifndef DUMMYPTHREAD_H
+#define DUMMYPTHREAD_H
+
+#define pthread_create(A, B, C, D)
+#define pthread_join(A, B)
+#define pthread_cancel(A)
+#define pthread_testcancel()
+
+#define pthread_mutex_init(A, B)
+#define pthread_mutex_destroy(A)
+#define pthread_mutex_lock(A)
+#define pthread_mutex_unlock(A)
+
+#endif
+diff --git a/lib/handle_pubackcomp.c b/lib/handle_pubackcomp.c
+index d70d602d..4568bb40 100644
+--- a/lib/handle_pubackcomp.c
+++ b/lib/handle_pubackcomp.c
+@@ -57,9 +57,9 @@ int handle__pubackcomp(struct mosquitto *mosq, const char *type)
+ 		}
+ 	}
+ 
+-	COMPAT_pthread_mutex_lock(&mosq->msgs_out.mutex);
+	pthread_mutex_lock(&mosq->msgs_out.mutex);
+ 	util__increment_send_quota(mosq);
+-	COMPAT_pthread_mutex_unlock(&mosq->msgs_out.mutex);
+	pthread_mutex_unlock(&mosq->msgs_out.mutex);
+ 
+ 	rc = packet__read_uint16(&mosq->in_packet, &mid);
+ 	if(rc) return rc;
+diff --git a/lib/mosquitto_internal.h b/lib/mosquitto_internal.h
+index 31120258..ac71ffbf 100644
+--- a/lib/mosquitto_internal.h
+++ b/lib/mosquitto_internal.h
+@@ -33,7 +33,11 @@ Contributors:
+ #endif
+ #include <stdlib.h>
+ 
+-#include <pthread_compat.h>
+#if defined(WITH_THREADING) && !defined(WITH_BROKER)
+#  include <pthread.h>
+#else
+#  include <dummypthread.h>
+#endif
+ 
+ #ifdef WITH_SRV
+ #  include <ares.h>
+diff --git a/lib/packet_mosq.c b/lib/packet_mosq.c
+index b063eb71..fd716baf 100644
+--- a/lib/packet_mosq.c
+++ b/lib/packet_mosq.c
+@@ -129,13 +129,13 @@ void packet__cleanup_all_no_locks(struct mosquitto *mosq)
+ 
+ void packet__cleanup_all(struct mosquitto *mosq)
+ {
+-	COMPAT_pthread_mutex_lock(&mosq->current_out_packet_mutex);
+-	COMPAT_pthread_mutex_lock(&mosq->out_packet_mutex);
+	pthread_mutex_lock(&mosq->current_out_packet_mutex);
+	pthread_mutex_lock(&mosq->out_packet_mutex);
+ 
+ 	packet__cleanup_all_no_locks(mosq);
+ 
+-	COMPAT_pthread_mutex_unlock(&mosq->out_packet_mutex);
+-	COMPAT_pthread_mutex_unlock(&mosq->current_out_packet_mutex);
+	pthread_mutex_unlock(&mosq->out_packet_mutex);
+	pthread_mutex_unlock(&mosq->current_out_packet_mutex);
+ }
+ 
+ 
+@@ -151,7 +151,7 @@ int packet__queue(struct mosquitto *mosq, struct mosquitto__packet *packet)
+ 	packet->to_process = packet->packet_length;
+ 
+ 	packet->next = NULL;
+-	COMPAT_pthread_mutex_lock(&mosq->out_packet_mutex);
+	pthread_mutex_lock(&mosq->out_packet_mutex);
+ 
+ #ifdef WITH_BROKER
+ 	if(db.config->max_queued_messages > 0 && mosq->out_packet_count >= db.config->max_queued_messages){
+@@ -174,7 +174,7 @@ int packet__queue(struct mosquitto *mosq, struct mosquitto__packet *packet)
+ 	}
+ 	mosq->out_packet_last = packet;
+ 	mosq->out_packet_count++;
+-	COMPAT_pthread_mutex_unlock(&mosq->out_packet_mutex);
+	pthread_mutex_unlock(&mosq->out_packet_mutex);
+ #ifdef WITH_BROKER
+ #  ifdef WITH_WEBSOCKETS
+ 	if(mosq->wsi){
+@@ -232,8 +232,8 @@ int packet__write(struct mosquitto *mosq)
+ 	if(!mosq) return MOSQ_ERR_INVAL;
+ 	if(mosq->sock == INVALID_SOCKET) return MOSQ_ERR_NO_CONN;
+ 
+-	COMPAT_pthread_mutex_lock(&mosq->current_out_packet_mutex);
+-	COMPAT_pthread_mutex_lock(&mosq->out_packet_mutex);
+	pthread_mutex_lock(&mosq->current_out_packet_mutex);
+	pthread_mutex_lock(&mosq->out_packet_mutex);
+ 	if(mosq->out_packet && !mosq->current_out_packet){
+ 		mosq->current_out_packet = mosq->out_packet;
+ 		mosq->out_packet = mosq->out_packet->next;
+@@ -242,7 +242,7 @@ int packet__write(struct mosquitto *mosq)
+ 		}
+ 		mosq->out_packet_count--;
+ 	}
+-	COMPAT_pthread_mutex_unlock(&mosq->out_packet_mutex);
+	pthread_mutex_unlock(&mosq->out_packet_mutex);
+ 
+ #ifdef WITH_BROKER
+ 	if(mosq->current_out_packet){
+@@ -252,7 +252,7 @@ int packet__write(struct mosquitto *mosq)
+ 
+ 	state = mosquitto__get_state(mosq);
+ 	if(state == mosq_cs_connect_pending){
+-		COMPAT_pthread_mutex_unlock(&mosq->current_out_packet_mutex);
+		pthread_mutex_unlock(&mosq->current_out_packet_mutex);
+ 		return MOSQ_ERR_SUCCESS;
+ 	}
+ 
+@@ -274,10 +274,10 @@ int packet__write(struct mosquitto *mosq)
+ 						|| errno == WSAENOTCONN
+ #endif
+ 						){
+-					COMPAT_pthread_mutex_unlock(&mosq->current_out_packet_mutex);
+					pthread_mutex_unlock(&mosq->current_out_packet_mutex);
+ 					return MOSQ_ERR_SUCCESS;
+ 				}else{
+-					COMPAT_pthread_mutex_unlock(&mosq->current_out_packet_mutex);
+					pthread_mutex_unlock(&mosq->current_out_packet_mutex);
+ 					switch(errno){
+ 						case COMPAT_ECONNRESET:
+ 							return MOSQ_ERR_CONN_LOST;
+@@ -296,7 +296,7 @@ int packet__write(struct mosquitto *mosq)
+ 		if(((packet->command)&0xF6) == CMD_PUBLISH){
+ 			G_PUB_MSGS_SENT_INC(1);
+ #ifndef WITH_BROKER
+-			COMPAT_pthread_mutex_lock(&mosq->callback_mutex);
+			pthread_mutex_lock(&mosq->callback_mutex);
+ 			if(mosq->on_publish){
+ 				/* This is a QoS=0 message */
+ 				mosq->in_callback = true;
+@@ -309,7 +309,7 @@ int packet__write(struct mosquitto *mosq)
+ 				mosq->on_publish_v5(mosq, mosq->userdata, packet->mid, 0, NULL);
+ 				mosq->in_callback = false;
+ 			}
+-			COMPAT_pthread_mutex_unlock(&mosq->callback_mutex);
+			pthread_mutex_unlock(&mosq->callback_mutex);
+ 		}else if(((packet->command)&0xF0) == CMD_DISCONNECT){
+ 			do_client_disconnect(mosq, MOSQ_ERR_SUCCESS, NULL);
+ 			packet__cleanup(packet);
+@@ -321,7 +321,7 @@ int packet__write(struct mosquitto *mosq)
+ 		}
+ 
+ 		/* Free data and reset values */
+-		COMPAT_pthread_mutex_lock(&mosq->out_packet_mutex);
+		pthread_mutex_lock(&mosq->out_packet_mutex);
+ 		mosq->current_out_packet = mosq->out_packet;
+ 		if(mosq->out_packet){
+ 			mosq->out_packet = mosq->out_packet->next;
+@@ -330,7 +330,7 @@ int packet__write(struct mosquitto *mosq)
+ 			}
+ 			mosq->out_packet_count--;
+ 		}
+-		COMPAT_pthread_mutex_unlock(&mosq->out_packet_mutex);
+		pthread_mutex_unlock(&mosq->out_packet_mutex);
+ 
+ 		packet__cleanup(packet);
+ 		mosquitto__free(packet);
+@@ -338,9 +338,9 @@ int packet__write(struct mosquitto *mosq)
+ #ifdef WITH_BROKER
+ 		mosq->next_msg_out = db.now_s + mosq->keepalive;
+ #else
+-		COMPAT_pthread_mutex_lock(&mosq->msgtime_mutex);
+		pthread_mutex_lock(&mosq->msgtime_mutex);
+ 		mosq->next_msg_out = mosquitto_time() + mosq->keepalive;
+-		COMPAT_pthread_mutex_unlock(&mosq->msgtime_mutex);
+		pthread_mutex_unlock(&mosq->msgtime_mutex);
+ #endif
+ 	}
+ #ifdef WITH_BROKER
+@@ -348,7 +348,7 @@ int packet__write(struct mosquitto *mosq)
+ 		mux__remove_out(mosq);
+ 	}
+ #endif
+-	COMPAT_pthread_mutex_unlock(&mosq->current_out_packet_mutex);
+	pthread_mutex_unlock(&mosq->current_out_packet_mutex);
+ 	return MOSQ_ERR_SUCCESS;
+ }
+ 
+@@ -536,9 +536,9 @@ int packet__read(struct mosquitto *mosq)
+ #ifdef WITH_BROKER
+ 					keepalive__update(mosq);
+ #else
+-					COMPAT_pthread_mutex_lock(&mosq->msgtime_mutex);
+					pthread_mutex_lock(&mosq->msgtime_mutex);
+ 					mosq->last_msg_in = mosquitto_time();
+-					COMPAT_pthread_mutex_unlock(&mosq->msgtime_mutex);
+					pthread_mutex_unlock(&mosq->msgtime_mutex);
+ #endif
+ 				}
+ 				return MOSQ_ERR_SUCCESS;
+@@ -571,9 +571,9 @@ int packet__read(struct mosquitto *mosq)
+ #ifdef WITH_BROKER
+ 	keepalive__update(mosq);
+ #else
+-	COMPAT_pthread_mutex_lock(&mosq->msgtime_mutex);
+	pthread_mutex_lock(&mosq->msgtime_mutex);
+ 	mosq->last_msg_in = mosquitto_time();
+-	COMPAT_pthread_mutex_unlock(&mosq->msgtime_mutex);
+	pthread_mutex_unlock(&mosq->msgtime_mutex);
+ #endif
+ 	return rc;
+ }
+diff --git a/lib/pthread_compat.h b/lib/pthread_compat.h
+deleted file mode 100644
+index ca1f27dc..00000000
+--- a/lib/pthread_compat.h
+++ /dev/null
+@@ -1,28 +0,0 @@
+-#ifndef PTHREAD_COMPAT_
+-#define PTHREAD_COMPAT_
+-
+-#if defined(WITH_THREADING) && !defined(WITH_BROKER)
+-#  include <pthread.h>
+-
+-#  define COMPAT_pthread_create(A, B, C, D) pthread_create((A), (B), (C), (D))
+-#  define COMPAT_pthread_join(A, B) pthread_join((A), (B))
+-#  define COMPAT_pthread_cancel(A) pthread_cancel((A))
+-#  define COMPAT_pthread_testcancel() pthread_testcancel()
+-
+-#  define COMPAT_pthread_mutex_init(A, B) pthread_mutex_init((A), (B))
+-#  define COMPAT_pthread_mutex_destroy(A) pthread_mutex_init((A))
+-#  define COMPAT_pthread_mutex_lock(A) pthread_mutex_lock((A))
+-#  define COMPAT_pthread_mutex_unlock(A) pthread_mutex_unlock((A))
+-#else
+-#  define COMPAT_pthread_create(A, B, C, D)
+-#  define COMPAT_pthread_join(A, B)
+-#  define COMPAT_pthread_cancel(A)
+-#  define COMPAT_pthread_testcancel()
+-
+-#  define COMPAT_pthread_mutex_init(A, B)
+-#  define COMPAT_pthread_mutex_destroy(A)
+-#  define COMPAT_pthread_mutex_lock(A)
+-#  define COMPAT_pthread_mutex_unlock(A)
+-#endif
+-
+-#endif
+diff --git a/lib/util_mosq.c b/lib/util_mosq.c
+index 4bebcbd0..22f8c4d5 100644
+--- a/lib/util_mosq.c
+++ b/lib/util_mosq.c
+@@ -87,10 +87,10 @@ int mosquitto__check_keepalive(struct mosquitto *mosq)
+ 		return MOSQ_ERR_SUCCESS;
+ 	}
+ #endif
+-	COMPAT_pthread_mutex_lock(&mosq->msgtime_mutex);
+	pthread_mutex_lock(&mosq->msgtime_mutex);
+ 	next_msg_out = mosq->next_msg_out;
+ 	last_msg_in = mosq->last_msg_in;
+-	COMPAT_pthread_mutex_unlock(&mosq->msgtime_mutex);
+	pthread_mutex_unlock(&mosq->msgtime_mutex);
+ 	if(mosq->keepalive && mosq->sock != INVALID_SOCKET &&
+ 			(now >= next_msg_out || now - last_msg_in >= mosq->keepalive)){
+ 
+@@ -98,10 +98,10 @@ int mosquitto__check_keepalive(struct mosquitto *mosq)
+ 		if(state == mosq_cs_active && mosq->ping_t == 0){
+ 			send__pingreq(mosq);
+ 			/* Reset last msg times to give the server time to send a pingresp */
+-			COMPAT_pthread_mutex_lock(&mosq->msgtime_mutex);
+			pthread_mutex_lock(&mosq->msgtime_mutex);
+ 			mosq->last_msg_in = now;
+ 			mosq->next_msg_out = now + mosq->keepalive;
+-			COMPAT_pthread_mutex_unlock(&mosq->msgtime_mutex);
+			pthread_mutex_unlock(&mosq->msgtime_mutex);
+ 		}else{
+ #ifdef WITH_BROKER
+ #  ifdef WITH_BRIDGE
+@@ -118,7 +118,7 @@ int mosquitto__check_keepalive(struct mosquitto *mosq)
+ 			}else{
+ 				rc = MOSQ_ERR_KEEPALIVE;
+ 			}
+-			COMPAT_pthread_mutex_lock(&mosq->callback_mutex);
+			pthread_mutex_lock(&mosq->callback_mutex);
+ 			if(mosq->on_disconnect){
+ 				mosq->in_callback = true;
+ 				mosq->on_disconnect(mosq, mosq->userdata, rc);
+@@ -129,7 +129,7 @@ int mosquitto__check_keepalive(struct mosquitto *mosq)
+ 				mosq->on_disconnect_v5(mosq, mosq->userdata, rc, NULL);
+ 				mosq->in_callback = false;
+ 			}
+-			COMPAT_pthread_mutex_unlock(&mosq->callback_mutex);
+			pthread_mutex_unlock(&mosq->callback_mutex);
+ 
+ 			return rc;
+ #endif
+@@ -150,11 +150,11 @@ uint16_t mosquitto__mid_generate(struct mosquitto *mosq)
+ 	uint16_t mid;
+ 	assert(mosq);
+ 
+-	COMPAT_pthread_mutex_lock(&mosq->mid_mutex);
+	pthread_mutex_lock(&mosq->mid_mutex);
+ 	mosq->last_mid++;
+ 	if(mosq->last_mid == 0) mosq->last_mid++;
+ 	mid = mosq->last_mid;
+-	COMPAT_pthread_mutex_unlock(&mosq->mid_mutex);
+	pthread_mutex_unlock(&mosq->mid_mutex);
+ 
+ 	return mid;
+ }
+@@ -280,14 +280,14 @@ int util__random_bytes(void *bytes, int count)
+ 
+ int mosquitto__set_state(struct mosquitto *mosq, enum mosquitto_client_state state)
+ {
+-	COMPAT_pthread_mutex_lock(&mosq->state_mutex);
+	pthread_mutex_lock(&mosq->state_mutex);
+ #ifdef WITH_BROKER
+ 	if(mosq->state != mosq_cs_disused)
+ #endif
+ 	{
+ 		mosq->state = state;
+ 	}
+-	COMPAT_pthread_mutex_unlock(&mosq->state_mutex);
+	pthread_mutex_unlock(&mosq->state_mutex);
+ 
+ 	return MOSQ_ERR_SUCCESS;
+ }
+@@ -296,9 +296,9 @@ enum mosquitto_client_state mosquitto__get_state(struct mosquitto *mosq)
+ {
+ 	enum mosquitto_client_state state;
+ 
+-	COMPAT_pthread_mutex_lock(&mosq->state_mutex);
+	pthread_mutex_lock(&mosq->state_mutex);
+ 	state = mosq->state;
+-	COMPAT_pthread_mutex_unlock(&mosq->state_mutex);
+	pthread_mutex_unlock(&mosq->state_mutex);
+ 
+ 	return state;
+ }
+@@ -306,18 +306,18 @@ enum mosquitto_client_state mosquitto__get_state(struct mosquitto *mosq)
+ #ifndef WITH_BROKER
+ void mosquitto__set_request_disconnect(struct mosquitto *mosq, bool request_disconnect)
+ {
+-	COMPAT_pthread_mutex_lock(&mosq->state_mutex);
+	pthread_mutex_lock(&mosq->state_mutex);
+ 	mosq->request_disconnect = request_disconnect;
+-	COMPAT_pthread_mutex_unlock(&mosq->state_mutex);
+	pthread_mutex_unlock(&mosq->state_mutex);
+ }
+ 
+ bool mosquitto__get_request_disconnect(struct mosquitto *mosq)
+ {
+ 	bool request_disconnect;
+ 
+-	COMPAT_pthread_mutex_lock(&mosq->state_mutex);
+	pthread_mutex_lock(&mosq->state_mutex);
+ 	request_disconnect = mosq->request_disconnect;
+-	COMPAT_pthread_mutex_unlock(&mosq->state_mutex);
+	pthread_mutex_unlock(&mosq->state_mutex);
+ 
+ 	return request_disconnect;
+ }
+-- 
+2.39.5
+
@@ -1,2 +1,2 @@
 # Locally calculated
-sha256  c13407edd0e33be73cae72514cb234f8612e1c0e54401c9448daffd3a240158b  queue.h?rev=1.70
+sha256  c13407edd0e33be73cae72514cb234f8612e1c0e54401c9448daffd3a240158b  queue.h
@@ -5,7 +5,7 @@
 ################################################################################

 # No main site, just using extra downloads
-MUSL_COMPAT_HEADERS_QUEUE_H = http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/sys/queue.h?rev=1.70
+MUSL_COMPAT_HEADERS_QUEUE_H = https://raw.githubusercontent.com/NetBSD/src/03be82a6b173b3c62116b7a186067fed3004dd44/sys/sys/queue.h

 MUSL_COMPAT_HEADERS_EXTRA_DOWNLOADS = $(MUSL_COMPAT_HEADERS_QUEUE_H)

@@ -0,0 +1,42 @@
+From 9c78557af0a5e521cdb46a4ca7630f2987d2523e Mon Sep 17 00:00:00 2001
+From: Rich Felker <dalias@aerifal.cx>
+Date: Sat, 10 Aug 2024 19:49:24 -0400
+Subject: [PATCH] use hidden visibility for C entry point function _start_c
+
+the file-level crt_arch.h asm fragments generally make direct
+(non-PLT) calls from _start to _start_c, which is only valid when
+there is a local, non-interposable definition for _start_c. generally,
+the linker is expected to know that local definitions in a main
+executable (as opposed to shared library) output are non-interposable,
+making this work, but historically there have been linker bugs in this
+area, and microblaze is reportedly still broken, flagging the
+relocation for the call as a textrel.
+
+the equivalent _dlstart_c, called from the same crt_arch.h asm
+fragments, has always used hidden visibility without problem, and
+semantically it should be hidden, so make it hidden. this ensures the
+direct call is always valid regardless of whether the linker properly
+special-cases main executable output.
+
+Upstream: https://git.musl-libc.org/cgit/musl/commit/?id=9c78557af0a5e521cdb46a4ca7630f2987d2523e
+Signed-off-by: J. Neuschäfer <j.neuschaefer@gmx.net>
+---
+ crt/crt1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/crt/crt1.c b/crt/crt1.c
+index 8fe8ab5d..10601215 100644
+--- a/crt/crt1.c
+++ b/crt/crt1.c
+@@ -11,7 +11,7 @@ weak void _fini();
+ int __libc_start_main(int (*)(), int, char **,
+ 	void (*)(), void(*)(), void(*)());
+
+-void _start_c(long *p)
+hidden void _start_c(long *p)
+ {
+ 	int argc = p[0];
+ 	char **argv = (void *)(p+1);
+--
+2.45.2
+
@@ -79,7 +79,7 @@ NFS_UTILS_POST_INSTALL_TARGET_HOOKS += NFS_UTILS_INSTALL_FIXUP

 ifeq ($(BR2_INIT_SYSTEMD),y)
 NFS_UTILS_CONF_OPTS += --with-systemd=/usr/lib/systemd/system
-NFS_UTILS_DEPENDENCIES += systemd
+NFS_UTILS_DEPENDENCIES += systemd host-systemd
 else
 NFS_UTILS_CONF_OPTS += --without-systemd
 endif
@@ -0,0 +1,38 @@
+Fix crash when binding IPv6 address
+
+Reference:
+  https://bugs.ntp.org/show_bug.cgi?id=3928
+
+Upstream: https://people.nwtime.org/hart/ntp-stable-3928-29.tar.gz
+
+Ported fix from updated tarball provided by upstream:
+https://bugs.ntp.org/show_bug.cgi?id=3928#c14
+
+Signed-off-by: TIAN Yuanhao <tianyuanhao3@163.com>
+---
+ ntpd/ntp_io.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+Index: ntp-4.2.8p18/ntpd/ntp_io.c
+===================================================================
+--- ntp-4.2.8p18.orig/ntpd/ntp_io.c
+++ ntp-4.2.8p18/ntpd/ntp_io.c
+@@ -1917,15 +1917,15 @@ update_interfaces(
+ 			}
+ 			new_interface_found = TRUE;
+ 			DPRINT_INTERFACE(3,
+-				(ep, "updating ", " new - created\n"));
+				(ep2, "updating ", " new - created\n"));
+ 		}
+ 		else {
+ 			DPRINT_INTERFACE(3,
+-				(ep, "updating ", " new - FAILED"));
+				(ep2, "updating ", " new - FAILED"));
+ 
+ 			msyslog(LOG_ERR,
+ 				"cannot bind address %s",
+-				stoa(&ep->sin));
+				stoa(&ep2->sin));
+ 		}
+ 		free(ep2);
+ 	}
@@ -1,5 +1,5 @@
 # From https://www.php.net/downloads.php
-sha256  330b54876ea1d05ade12ee9726167332058bccd58dffa1d4e12117f6b4f616b9  php-8.2.25.tar.xz
+sha256  54747400cb4874288ad41a785e6147e2ff546cceeeb55c23c00c771ac125c6ef  php-8.2.26.tar.xz

 # License file
 sha256  b42e4df5e50e6ecda1047d503d6d91d71032d09ed1027ba1ef29eed26f890c5a  LICENSE
@@ -4,7 +4,7 @@
 #
 ################################################################################

-PHP_VERSION = 8.2.25
+PHP_VERSION = 8.2.26
 PHP_SITE = https://www.php.net/distributions
 PHP_SOURCE = php-$(PHP_VERSION).tar.xz
 PHP_INSTALL_STAGING = YES
@@ -1,4 +1,4 @@
-# From https://ftp.postgresql.org/pub/source/v16.4/postgresql-16.4.tar.bz2.sha256
-sha256  971766d645aa73e93b9ef4e3be44201b4f45b5477095b049125403f9f3386d6f  postgresql-16.4.tar.bz2
+# From https://ftp.postgresql.org/pub/source/v16.6/postgresql-16.6.tar.bz2.sha256
+sha256  23369cdaccd45270ac5dcc30fa9da205d5be33fa505e1f17a0418d2caeca477b  postgresql-16.6.tar.bz2
 # License file, Locally calculated
 sha256  9bf20ee493926a7e17a74bc7f05089fbc014269667b1540bc35a6b194a40c9de  COPYRIGHT
@@ -4,7 +4,7 @@
 #
 ################################################################################

-POSTGRESQL_VERSION = 16.4
+POSTGRESQL_VERSION = 16.6
 POSTGRESQL_SOURCE = postgresql-$(POSTGRESQL_VERSION).tar.bz2
 POSTGRESQL_SITE = https://ftp.postgresql.org/pub/source/v$(POSTGRESQL_VERSION)
 POSTGRESQL_LICENSE = PostgreSQL
@@ -0,0 +1,99 @@
+From f37d178d5c25c547835d054fbb1eda32c25034b3 Mon Sep 17 00:00:00 2001
+From: Craig Small <csmall@dropbear.xyz>
+Date: Mon, 30 Sep 2024 17:26:01 +1000
+Subject: [PATCH] build-sys: Fix pidfd_open checking
+
+The previous build setup would check for pidfd_open using
+AC_CHECK_FUNC and would be incorrectly reported as true.
+
+Also, if pidfd_open() and __NR_pidfd_open were not present,
+pidwait would silently not be built.
+
+So, changes:
+ compile a small programin using pidfd_open to test it properly
+ conditionally try to find NR_pidfd_open if the function fails
+ complain if neither are present
+ have --disable-pidwait configure option so you are explicit in
+ not wanting and knowing you wont get pidwait
+
+References:
+ #352
+ commit d9c3e3676d86094abaa239b3218f57bf49d70b4f
+ commit 17f94796a9b3c4f1ff28829107a82107dcb362b4
+
+Signed-off-by: Craig Small <csmall@dropbear.xyz>
+
+Upstream: https://gitlab.com/procps-ng/procps/-/commit/2507bc475782ff5e0541d37c780dff1e293c9553
+
+Signed-off-by: Scott Fan <fancp2007@gmail.com>
+[Scott: backported to version 4.0.4]
+---
+ configure.ac | 45 ++++++++++++++++++++++++++++++---------------
+ 1 file changed, 30 insertions(+), 15 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index fec27e3f..0719fcd1 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -170,21 +170,6 @@ AC_TRY_COMPILE([#include <errno.h>],
+ 		AC_MSG_RESULT(yes),
+ 		AC_MSG_RESULT(no))
+ 
+-AC_CHECK_FUNC([pidfd_open], [enable_pidwait=yes], [
+-  AC_MSG_CHECKING([for __NR_pidfd_open])
+-  AC_COMPILE_IFELSE([AC_LANG_SOURCE([
+-#include <sys/syscall.h>
+-#ifndef __NR_pidfd_open
+-#error __NR_pidfd_open not defined
+-#endif
+-    ])], [enable_pidwait=yes], [enable_pidwait=no])
+-  AC_MSG_RESULT([$enable_pidwait])
+-])
+-if test "$enable_pidwait" = yes; then
+-  AC_DEFINE([ENABLE_PIDWAIT], [1], [Enable pidwait])
+-fi
+-AM_CONDITIONAL([BUILD_PIDWAIT], [test x$enable_pidwait = xyes])
+-
+ dnl watch8bit must be before the AC_ARG_WITH set as it sets up ncurses
+ AC_SUBST([WITH_WATCH8BIT])
+ AC_ARG_ENABLE([watch8bit],
+@@ -321,6 +306,36 @@ AC_ARG_ENABLE([pidof],
+ )
+ AM_CONDITIONAL(BUILD_PIDOF, test "x$enable_pidof" = xyes)
+ 
+# If pidwait is enabled, we need either pidfd_open() or __NR_pidfd_open need to be defined
+# Cannot use AC_CHECK_FUNC as it (incorrectly) passes with pidfd_open missing
+AC_ARG_ENABLE([pidwait],
+  AS_HELP_STRING([--disable-pidwait], [do not build pidwait]),
+  [], [
+    enable_pidwait=yes
+    AC_DEFINE(ENABLE_PIDWAIT, 1, [enable pidwait])
+  ]
+)
+AM_CONDITIONAL(BUILD_PIDWAIT, test "x$enable_pidwait" = xyes)
+AC_MSG_CHECKING([for pidfd_open()])
+AC_LINK_IFELSE([AC_LANG_PROGRAM([], [[ [pidfd_open(1,1)]]])],
+  have_pidfd_open=yes; AC_MSG_RESULT([yes]) ,
+  have_pidfd_open=no; AC_MSG_RESULT([no])
+  )
+
+AS_IF([[test "x$enable_pidwait" = xyes -a "x$have_pidfd_open" = xno]],
+   AC_MSG_CHECKING([for __NR_pidfd_open])
+   AC_COMPILE_IFELSE([AC_LANG_SOURCE([
+#include <sys/syscall.h>
+#ifndef __NR_pidfd_open
+#error __NR_pidfd_open not defined
+#endif
+      ])],
+      AC_MSG_RESULT([yes]),
+      AC_MSG_RESULT([no])
+      AC_MSG_ERROR([Neither pidfd_open or __NR_pidfd_open found. Disable pidwait with configure option --disable-pidwait])
+    )
+   ,[])
+
+ AC_ARG_ENABLE([kill],
+   AS_HELP_STRING([--disable-kill], [do not build kill]),
+   [], [enable_kill=yes]
+-- 
+2.43.0
+
@@ -0,0 +1,37 @@
+From 1e2d53e1d86cb75e8f39b42b9a5c409e5d3261ed Mon Sep 17 00:00:00 2001
+From: oli-ben <24815225-oli-ben@users.noreply.gitlab.com>
+Date: Wed, 27 Nov 2024 20:17:11 +0000
+Subject: [PATCH] build-sys: Fix define of HAVE_PIDFD_OPEN
+
+Fix cross-compilation issues when using GCC-12.3
+* configure fails to detect that the sysroot does support the pidfd_open
+  syscall wrapper
+* configure fails to define HAVE_PIDFD_OPEN which is used in pgrep.c,
+  so it fails building, because __NR_pidfd_open is then undefined
+
+Upstream: https://gitlab.com/procps-ng/procps/-/commit/587efb47df7ddbfda4e6abdd1e7792a2531a238f
+
+Signed-off-by: Scott Fan <fancp2007@gmail.com>
+[Scott: backported to version 4.0.4]
+---
+ configure.ac | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 0719fcd1..6242a8f8 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -317,8 +317,8 @@ AC_ARG_ENABLE([pidwait],
+ )
+ AM_CONDITIONAL(BUILD_PIDWAIT, test "x$enable_pidwait" = xyes)
+ AC_MSG_CHECKING([for pidfd_open()])
+-AC_LINK_IFELSE([AC_LANG_PROGRAM([], [[ [pidfd_open(1,1)]]])],
+-  have_pidfd_open=yes; AC_MSG_RESULT([yes]) ,
+AC_LINK_IFELSE([AC_LANG_PROGRAM([], [[pidfd_open(1,1)]])],
+  have_pidfd_open=yes; AC_DEFINE(HAVE_PIDFD_OPEN, 1, [pidfd_open is defined]) AC_MSG_RESULT([yes]),
+   have_pidfd_open=no; AC_MSG_RESULT([no])
+   )
+ 
+-- 
+2.43.0
+
@@ -0,0 +1,41 @@
+From 81ded587d2484b6f470f2d5c837c5591491377ce Mon Sep 17 00:00:00 2001
+From: Craig Small <csmall@dropbear.xyz>
+Date: Thu, 28 Nov 2024 07:20:42 +1100
+Subject: [PATCH] pgrep: Include sys/syscall.h if making pidwait
+
+sys/syscall.h would only be included if pidwait was made
+and we found pidfd_open() The previous commit fixed the
+finding part, but in fact we want sys/syscall.h either
+way because syscall() is defined there too.
+
+Most of the time the header is included by other headers
+but adding it explicitly means if that header is removed or
+changed it still works.
+
+Signed-off-by: Craig Small <csmall@dropbear.xyz>
+
+Upstream: https://gitlab.com/procps-ng/procps/-/commit/5acbb5dc1587d688de646d739a97251eb893bbb0
+
+Signed-off-by: Scott Fan <fancp2007@gmail.com>
+[Scott: backported to version 4.0.4]
+---
+ src/pgrep.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/src/pgrep.c b/src/pgrep.c
+index d8e57dff..a2607532 100644
+--- a/src/pgrep.c
+++ b/src/pgrep.c
+@@ -44,9 +44,7 @@
+ 
+ #ifdef ENABLE_PIDWAIT
+ #include <sys/epoll.h>
+-#ifndef HAVE_PIDFD_OPEN
+ #include <sys/syscall.h>
+-#endif /* !HAVE_PIDFD_OPEN */
+ #endif
+ 
+ /* EXIT_SUCCESS is 0 */
+-- 
+2.43.0
+
@@ -16,6 +16,8 @@ PROCPS_NG_CONF_OPTS = LIBS=$(TARGET_NLS_LIBS)

 # Applying 0001-build-sys-Add-systemd-elogind-to-w.patch touches Makefile.am
 # Applying 0002-fix-ncurses-h-include.patch touches configure.ac
+# Applying 0003-build-sys-Fix-pidfd_open-checking.patch touches configure.ac
+# Applying 0004-build-sys-Fix-define-of-HAVE_PIDFD_OPEN.patch touches configure.ac
 PROCPS_NG_AUTORECONF = YES

 ifeq ($(BR2_PACKAGE_SYSTEMD),y)
@@ -1,6 +1,8 @@
 config BR2_PACKAGE_PYTHON_PSYCOPG2
 	bool "python-psycopg2"
+	depends on BR2_USE_MMU # postgresql
 	depends on BR2_USE_WCHAR # postgresql
+	depends on !BR2_STATIC_LIBS # postgresql
 	depends on !BR2_OPTIMIZE_FAST # postgresql
 	select BR2_PACKAGE_POSTGRESQL
 	help
@@ -21,10 +23,11 @@ config BR2_PACKAGE_PYTHON_PSYCOPG2
 	  customized thanks to a flexible objects adaptation system.
 	  Psycopg 2 is both Unicode and Python 3 friendly.

-	  http://initd.org/psycopg/
+	  https://github.com/psycopg/psycopg2/

-comment "python-psycopg2 needs a toolchain w/ wchar"
-	depends on !BR2_USE_WCHAR
+comment "python-psycopg2 needs a toolchain w/ dynamic library, wchar"
+	depends on BR2_USE_MMU
+	depends on BR2_STATIC_LIBS || !BR2_USE_WCHAR

 comment "python-psycopg2 can't be built with Optimize for fast"
 	depends on BR2_OPTIMIZE_FAST
@@ -21,8 +21,10 @@ define HOST_PYTHON_SIP_BUILD_CMDS
 	$(HOST_MAKE_ENV) $(HOST_CONFIGURE_OPTS) $(MAKE) -C $(@D)
 endef

+# Race condition on fast machine between sipconfig.py install and
+# {sipdistutils.py,mk_distinfo.py} scripts.
 define HOST_PYTHON_SIP_INSTALL_CMDS
-	$(HOST_MAKE_ENV) $(HOST_CONFIGURE_OPTS) $(MAKE) install -C $(@D)
+	$(HOST_MAKE_ENV) $(HOST_CONFIGURE_OPTS) $(MAKE1) install -C $(@D)
 endef

 define PYTHON_SIP_CONFIGURE_CMDS
@@ -42,8 +44,10 @@ define PYTHON_SIP_BUILD_CMDS
 	$(TARGET_MAKE_ENV) $(TARGET_CONFIGURE_OPTS) $(MAKE) -C $(@D)
 endef

+# Race condition on fast machine between sipconfig.py install and
+# {sipdistutils.py,mk_distinfo.py} scripts.
 define PYTHON_SIP_INSTALL_TARGET_CMDS
-	$(TARGET_MAKE_ENV) $(TARGET_CONFIGURE_OPTS) $(MAKE) install -C $(@D)
+	$(TARGET_MAKE_ENV) $(TARGET_CONFIGURE_OPTS) $(MAKE1) install -C $(@D)
 endef

 $(eval $(generic-package))
@@ -59,7 +59,6 @@ QT6BASE_INSTALL_STAGING = YES

 QT6BASE_CONF_OPTS = \
 	-DQT_HOST_PATH=$(HOST_DIR) \
-	-DFEATURE_concurrent=OFF \
 	-DFEATURE_xml=OFF \
 	-DFEATURE_sql=OFF \
 	-DFEATURE_testlib=OFF \
@@ -5,7 +5,8 @@
 ################################################################################

 QUAGGA_VERSION = 1.2.4
-QUAGGA_SITE = http://download.savannah.gnu.org/releases/quagga
+# upstream (http://download.savannah.gnu.org/releases/quagga) dead
+QUAGGA_SITE = http://sources.buildroot.net/quagga
 QUAGGA_INSTALL_STAGING = YES
 QUAGGA_DEPENDENCIES = host-gawk host-pkgconf
 QUAGGA_LICENSE = GPL-2.0+
@@ -4,7 +4,7 @@
 #
 ################################################################################

-RT_TESTS_SITE = $(BR2_KERNEL_MIRROR)/linux/utils/rt-tests
+RT_TESTS_SITE = $(BR2_KERNEL_MIRROR)/linux/utils/rt-tests/older
 RT_TESTS_SOURCE = rt-tests-$(RT_TESTS_VERSION).tar.xz
 RT_TESTS_VERSION = 2.5
 RT_TESTS_LICENSE = GPL-2.0+
@@ -25,6 +25,8 @@ endef
 define SSHGUARD_INSTALL_INIT_SYSTEMD
 	$(INSTALL) -D -m 0644 $(@D)/examples/sshguard.service \
 		$(TARGET_DIR)/usr/lib/systemd/system/sshguard.service
+	$(SED) 's:/usr/local/sbin/sshguard:/usr/sbin/sshguard:g' \
+		$(TARGET_DIR)/usr/lib/systemd/system/sshguard.service
 endef

 $(eval $(autotools-package))
@@ -1,4 +1,4 @@
-From e5ff9b585d7dc54f50085d518d7d588c250b0690 Mon Sep 17 00:00:00 2001
+From 48c1cd62de0339722fd3b72ef86aaaf1c38ff3dd Mon Sep 17 00:00:00 2001
 From: Chris Packham <chris.packham@alliedtelesis.co.nz>
 Date: Fri, 31 May 2024 09:51:38 +1200
 Subject: [PATCH] basic: Add BCACHEFS magic
@@ -34,7 +34,7 @@ index 1cd66b5a5f..c82fe98227 100644
 binder,          {BINDERFS_SUPER_MAGIC}
 binfmt_misc,     {BINFMTFS_MAGIC}
 diff --git a/src/basic/missing_magic.h b/src/basic/missing_magic.h
-index 82d71c8ad1..b3d2ee9f57 100644
+index 82d71c8ad1..c8ecf44357 100644
 --- a/src/basic/missing_magic.h
 +++ b/src/basic/missing_magic.h
@@ -197,3 +197,10 @@
@@ -46,8 +46,8 @@ index 82d71c8ad1..b3d2ee9f57 100644
 +#ifndef BCACHEFS_SUPER_MAGIC
 +#  define BCACHEFS_SUPER_MAGIC 0xca451a4e
 +#else
-+assert_cc(BCACHEFS_SUPER_MAGIC == 0xca451a4e)
+assert_cc(BCACHEFS_SUPER_MAGIC == 0xca451a4e);
 +#endif
--
-2.45.1
+-- 
+2.47.0

@@ -1,3 +1,5 @@
-# Locally computed
-sha256  88b3979e6d5c7e32b50d7ec72fb15af724f6ab2cbf7e10880c360a77e4b5d99a  tiff-4.6.0.tar.gz
+# Locally computed after checking pgp signature
+# https://download.osgeo.org/libtiff/tiff-4.7.0.tar.xz.sig
+# with key: B1FA7D81EEB8E66399178B9733EBBFC47B3DD87D
+sha256  273a0a73b1f0bed640afee4a5df0337357ced5b53d3d5d1c405b936501f71017  tiff-4.7.0.tar.xz
 sha256  0780558a8bfba0af1160ec1ff11ade4f41c0d7deafd6ecfc796b492a788e380d  LICENSE.md
@@ -4,8 +4,9 @@
 #
 ################################################################################

-TIFF_VERSION = 4.6.0
-TIFF_SITE = http://download.osgeo.org/libtiff
+TIFF_VERSION = 4.7.0
+TIFF_SOURCE = tiff-$(TIFF_VERSION).tar.xz
+TIFF_SITE = https://download.osgeo.org/libtiff
 TIFF_LICENSE = tiff license
 TIFF_LICENSE_FILES = LICENSE.md
 TIFF_CPE_ID_VENDOR = libtiff
@@ -17,7 +17,7 @@ config BR2_PACKAGE_USBREDIR
 	  Note: only the library is installed, not the utilities. Say
 	  'y' below if you want the tools too.

-	  http://www.spice-space.org/page/UsbRedir
+	  https://www.spice-space.org/usbredir.html

 if BR2_PACKAGE_USBREDIR

@@ -1,4 +1,4 @@
-From daecf59cc8b294265666482a4766aaa3148c308b Mon Sep 17 00:00:00 2001
+From 8ca0465fda181bd20e5d30c36fb2aea56ed27b6b Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Sat, 30 Nov 2019 11:43:32 -0800
 Subject: [PATCH] Fix build on 32bit arches with 64bit time_t
@@ -8,8 +8,7 @@ input.h [1]

 [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=152194fe9c3f

-[Retrieved from:
-https://github.com/LibVNC/x11vnc/commit/daecf59cc8b294265666482a4766aaa3148c308b]
+Upstream: https://github.com/LibVNC/x11vnc/commit/daecf59cc8b294265666482a4766aaa3148c308b
 Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
 ---
 src/uinput.c | 25 +++++++++++++++++++++----
@@ -107,3 +106,6 @@ index 28fbad3..d71bcde 100644
 	ev.type = EV_KEY;
 	ev.code = (unsigned char) scancode;
 	ev.value = down;
+-- 
+2.43.0
+
@@ -1,10 +1,9 @@
-From 69eeb9f7baa14ca03b16c9de821f9876def7a36a Mon Sep 17 00:00:00 2001
+From 3870280eca9c10a3607440209e9caf6d7749e379 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Gu=C3=A9nal=20DAVALAN?= <guenal.davalan@uca.fr>
 Date: Wed, 18 Nov 2020 08:40:45 +0100
 Subject: [PATCH] scan: limit access to shared memory segments to current user

-[Retrieved from:
-https://github.com/LibVNC/x11vnc/commit/69eeb9f7baa14ca03b16c9de821f9876def7a36a]
+Upstream: https://github.com/LibVNC/x11vnc/commit/69eeb9f7baa14ca03b16c9de821f9876def7a36a
 Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
 ---
 src/scan.c | 2 +-
@@ -23,3 +22,6 @@ index 43e00d2..12994d5 100644
 
 	if (shm->shmid == -1) {
 		rfbErr("shmget(%s) failed.\n", name);
+-- 
+2.43.0
+
@@ -0,0 +1,48 @@
+From 08d57adf499264fcd32461a4092cd799c474d669 Mon Sep 17 00:00:00 2001
+From: Alexander Tsoy <alexander@tsoy.me>
+Date: Tue, 28 Jan 2020 22:21:01 +0300
+Subject: [PATCH] Fix build with -fno-common
+
+GCC 10 defaults to -fno-common
+
+Upstream: https://github.com/LibVNC/x11vnc/commit/a48b0b1cd887d7f3ae67f525d7d334bd2feffe60
+Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
+---
+ src/util.c | 3 +++
+ src/util.h | 6 +++---
+ 2 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/src/util.c b/src/util.c
+index a82a1a4..6a52ebf 100644
+--- a/src/util.c
+++ b/src/util.c
+@@ -47,6 +47,9 @@ int hxl = 0;
+ #ifdef LIBVNCSERVER_HAVE_LIBPTHREAD
+ MUTEX(x11Mutex);
+ MUTEX(scrollMutex);
+MUTEX(clientMutex);
+MUTEX(inputMutex);
+MUTEX(pointerMutex);
+ #endif
+ 
+ int nfix(int i, int n);
+diff --git a/src/util.h b/src/util.h
+index 35c1afd..99b5dd1 100644
+--- a/src/util.h
+++ b/src/util.h
+@@ -102,9 +102,9 @@ extern struct timeval _mysleep;
+ #ifdef LIBVNCSERVER_HAVE_LIBPTHREAD
+ extern MUTEX(x11Mutex);
+ extern MUTEX(scrollMutex);
+-MUTEX(clientMutex);
+-MUTEX(inputMutex);
+-MUTEX(pointerMutex);
+extern MUTEX(clientMutex);
+extern MUTEX(inputMutex);
+extern MUTEX(pointerMutex);
+ #endif
+ 
+ #define X_INIT INIT_MUTEX(x11Mutex)
+-- 
+2.43.0
+
@@ -5,7 +5,7 @@
 ################################################################################

 # Buildroot version to use
-RELEASE='2024.02.8'
+RELEASE='2024.02.9'

 ### Change here for more memory/cores ###
 VM_MEMORY=2048
@@ -137,6 +137,9 @@ class Emulator(object):
            self.qemu.expect("Password:")
            self.qemu.sendline(password)

+        self.connect_shell()
+
+    def connect_shell(self):
        extra_init_cmd = " && ".join([
            'export PAGER=cat',
            'dmesg -n 1',
@@ -18,10 +18,8 @@ class TestInitSystemNone(InitSystemBase):
        if index != 0:
            self.emulator.logfile.write("==> System does not boot")
            raise SystemError("System does not boot")
-        index = self.emulator.qemu.expect(["#", pexpect.TIMEOUT], timeout=60)
-        if index != 0:
-            self.emulator.logfile.write("==> System does not boot")
-            raise SystemError("System does not boot")
+
+        self.emulator.connect_shell()

        out, exit_code = self.emulator.run("sh -c 'echo $PPID'")
        self.assertEqual(exit_code, 0)
@@ -0,0 +1,91 @@
+import os
+
+import infra.basetest
+
+
+class TestAudit(infra.basetest.BRTest):
+    # This test needs a Kernel with the audit support (the builtin
+    # test Kernel does not have this support). Since the audit support
+    # enabled by default, a kernel fragment is not required.
+    config = \
+        """
+        BR2_aarch64=y
+        BR2_TOOLCHAIN_EXTERNAL=y
+        BR2_TARGET_GENERIC_GETTY_PORT="ttyAMA0"
+        BR2_LINUX_KERNEL=y
+        BR2_LINUX_KERNEL_CUSTOM_VERSION=y
+        BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.58"
+        BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
+        BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="board/qemu/aarch64-virt/linux.config"
+        BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
+        BR2_PACKAGE_AUDIT=y
+        BR2_TARGET_ROOTFS_CPIO=y
+        BR2_TARGET_ROOTFS_CPIO_GZIP=y
+        # BR2_TARGET_ROOTFS_TAR is not set
+        """
+
+    def test_run(self):
+        img = os.path.join(self.builddir, "images", "rootfs.cpio.gz")
+        kern = os.path.join(self.builddir, "images", "Image")
+        self.emulator.boot(arch="aarch64",
+                           kernel=kern,
+                           kernel_cmdline=["console=ttyAMA0"],
+                           options=["-M", "virt",
+                                    "-cpu", "cortex-a57",
+                                    "-m", "256M",
+                                    "-initrd", img])
+        self.emulator.login()
+
+        # We check the program can run by showing its version. This
+        # invocation also checks the Kernel has the audit support
+        # enabled.
+        self.assertRunOk("auditctl -v")
+
+        # We define a normal user name for this test.
+        user = "audit-test"
+
+        # Audit rule inspired from auditctl manual page examples.
+
+        # We add an audit rule logging write access on the
+        # system password file.
+        cmd = "auditctl -a always,exit -F path=/etc/shadow -F perm=wa"
+        self.assertRunOk(cmd)
+
+        # We do a read-only access on this file, as the root user.
+        self.assertRunOk("cat /etc/shadow")
+
+        # We check our previous read-only access did NOT generated an
+        # event record.
+        ausearch_cmd = "ausearch --format text"
+        out, ret = self.emulator.run(ausearch_cmd)
+        self.assertEqual(ret, 0)
+        open_shadow_str = "acting as root, successfully opened-file /etc/shadow"
+        self.assertNotIn(open_shadow_str, "\n".join(out))
+
+        # We create a normal user. This will modify the shadow password file.
+        cmd = f"adduser -D -h /tmp -H -s /bin/sh {user}"
+        self.assertRunOk(cmd)
+
+        # We are now expecting an event record of this modification.
+        out, ret = self.emulator.run(ausearch_cmd)
+        self.assertEqual(ret, 0)
+        self.assertIn(open_shadow_str, "\n".join(out))
+
+        # We add a new audit rule, recording failed open of the system
+        # password file.
+        cmd = "auditctl -a always,exit -S openat -F success=0 -F path=/etc/shadow"
+        self.assertRunOk(cmd)
+
+        # We attempt to read the system password file as our new
+        # normal user. This command is expected to fail (as only root
+        # can root is supposed to read this file).
+        cmd = f"su - {user} -c 'cat /etc/shadow'"
+        _, ret = self.emulator.run(cmd)
+        self.assertNotEqual(ret, 0)
+
+        # Our last failed read attempt is supposed to have generated
+        # an event. We check we can see it in the log.
+        out, ret = self.emulator.run(ausearch_cmd)
+        self.assertEqual(ret, 0)
+        evt_str = f"acting as {user}, unsuccessfully opened-file /etc/shadow"
+        self.assertIn(evt_str, "\n".join(out))
@@ -25,13 +25,19 @@ class TestMosquitto(infra.basetest.BRTest):
        msg = "Hello Buildroot!"

        # We subscribe to a topic and write one message to a log file.
-        self.assertRunOk(f"mosquitto_sub -t {topic} -C 1 > {log} &")
+        cmd = f"( mosquitto_sub -t {topic} -C 1 > {log} 2> /dev/null & )"
+        self.assertRunOk(cmd)

-        time.sleep(1)
+        # We give some time to the subscriber process to settle.
+        time.sleep(5)

        # We publish a message.
        self.assertRunOk(f"mosquitto_pub -t {topic} -m '{msg}'")

+        # We give some more time to the subscriber process to write
+        # the log and quit.
+        time.sleep(5)
+
        # We check the log file contains our message.
        out, ret = self.emulator.run(f"cat {log}")
        self.assertEqual(ret, 0)
@@ -0,0 +1,100 @@
+import os
+
+import infra.basetest
+
+
+class TestRRDTool(infra.basetest.BRTest):
+    config = infra.basetest.BASIC_TOOLCHAIN_CONFIG + \
+        """
+        BR2_PACKAGE_RRDTOOL=y
+        BR2_PACKAGE_RRDTOOL_RRDGRAPH=y
+        BR2_TARGET_ROOTFS_CPIO=y
+        # BR2_TARGET_ROOTFS_TAR is not set
+        """
+
+    def test_run(self):
+        cpio_file = os.path.join(self.builddir, "images", "rootfs.cpio")
+        self.emulator.boot(arch="armv5",
+                           kernel="builtin",
+                           options=["-initrd", cpio_file])
+        self.emulator.login()
+
+        # We check the program can run.
+        self.assertRunOk("rrdtool --version")
+
+        # This test sequence is inspired from parts of the RRDTool
+        # tutorial:
+        # https://oss.oetiker.ch/rrdtool/tut/rrdtutorial.en.html
+
+        rrd_file = "test.rrd"
+        data_source = "speed"
+
+        cmd = f"rrdtool create {rrd_file}"
+        cmd += " --start 920804400"
+        cmd += f" DS:{data_source}:COUNTER:600:U:U"
+        cmd += " RRA:AVERAGE:0.5:1:24"
+        cmd += " RRA:AVERAGE:0.5:6:10"
+        self.assertRunOk(cmd)
+
+        # Some data to fill in our database, from the tutorial page.
+        data = [12345, 12357, 12363, 12363, 12363,
+                12373, 12383, 12393, 12399, 12405,
+                12411, 12415, 12420, 12422, 12423]
+        timestamp = 920804700  # timestamp of: Sun Mar  7 12:05:00 PM CET 1999
+
+        # We check we can put our data in the database. We start at
+        # our timestamp, then increase by 5 minutes.
+        for d in data:
+            cmd = f"rrdtool update {rrd_file} {timestamp}:{d}"
+            timestamp += 300
+            self.assertRunOk(cmd)
+
+        # We check we can read back our data.
+        cmd = f"rrdtool fetch {rrd_file}"
+        cmd += " AVERAGE --start 920804400 --end 920809200"
+        out, ret = self.emulator.run(cmd)
+        self.assertEqual(ret, 0)
+        self.assertEqual(out[0].strip(), data_source)
+        # We check that at time=920805600 we have speed=0.
+        data_line = next(ln for ln in out if ln.strip().startswith('920805600:'))
+        speed = float(data_line.split(':')[1])
+        self.assertAlmostEqual(speed, 0.)
+
+        # We generate a first simple image graph.
+        cmd = "rrdtool graph speed.png"
+        cmd += " --start 920804400 --end 920808000"
+        cmd += f" DEF:myspeed={rrd_file}:{data_source}:AVERAGE"
+        cmd += " LINE2:myspeed#FF0000"
+        self.assertRunOk(cmd, timeout=20)
+
+        # We check the output file exists and has a size
+        # greater than zero.
+        self.assertRunOk("test -s speed.png")
+
+        # We generate a slightly more complex graph.
+        cmd = "rrdtool graph speed2.png"
+        cmd += " --start 920804400 --end 920808000"
+        cmd += " --vertical-label m/s"
+        cmd += f" DEF:myspeed={rrd_file}:{data_source}:AVERAGE"
+        cmd += " CDEF:realspeed=myspeed,1000,\\*"
+        cmd += " LINE2:realspeed#FF0000"
+        self.assertRunOk(cmd, timeout=20)
+
+        # Again, we check the output file exists.
+        self.assertRunOk("test -s speed2.png")
+
+        # Finally, we generate the last graph, with some rules.
+        cmd = "rrdtool graph speed3.png"
+        cmd += " --start 920804400 --end 920808000"
+        cmd += " --vertical-label km/h"
+        cmd += f" DEF:myspeed={rrd_file}:{data_source}:AVERAGE"
+        cmd += " \"CDEF:kmh=myspeed,3600,*\""
+        cmd += " CDEF:fast=kmh,100,GT,kmh,0,IF"
+        cmd += " CDEF:good=kmh,100,GT,0,kmh,IF"
+        cmd += " HRULE:100#0000FF:\"Maximum allowed\""
+        cmd += " AREA:good#00FF00:\"Good speed\""
+        cmd += " AREA:fast#FF0000:\"Too fast\""
+        self.assertRunOk(cmd, timeout=20)
+
+        # And again, we check the output file exists.
+        self.assertRunOk("test -s speed3.png")