Merge branch 'dey-3.0/maint' into dey-3.0/master

Signed-off-by: Hector Bujanda <hector.bujanda@digi.com>

README.md

@@ -1,5 +1,5 @@
 # Digi Embedded Yocto (DEY) 3.0
-## Release 3.0-r2
+## Release 3.0-r3
 
 This document provides information about Digi Embedded Yocto,
 Digi International's professional embedded Yocto development environment.
@@ -93,17 +93,31 @@ Documentation is available online at https://www.digi.com/resources/documentatio
 
 # Downloads
 
-* Demo images: https://ftp1.digi.com/support/digiembeddedyocto/3.0/r2/images/
+* Demo images: https://ftp1.digi.com/support/digiembeddedyocto/3.0/r3/images/
-* Software Development Kit (SDK): https://ftp1.digi.com/support/digiembeddedyocto/3.0/r2/sdk/
+* Software Development Kit (SDK): https://ftp1.digi.com/support/digiembeddedyocto/3.0/r3/sdk/
 
 # Release Changelog
 
+## 3.0-r3
+
+* Updated BSP to NXP release rel_imx_5.4.47_2.2.0.
+* Updated U-Boot to version 2020.04-r2 for ConnectCore 6UL, ConnectCore 8M Nano
+  and ConnectCore 8X.
+* TrustFence: add support for encrypted artifacts on ConnectCore 8M Nano and
+  ConnectCore 8X.
+* TrustFence: add support for SRK revocation on ConnectCore 8X.
+* Added support to install firmware from a USB stick.
+* Added WebKit image recipe to platforms with XWayland backend.
+* Added MCA LED support for ConnectCore 8X and 8M Nano.
+* Other minor fixes.
+
+
 ## 3.0-r2
 
 * Updated BSP to NXP release rel_imx_5.4.24_2.1.0.
 * Added support to ConnectCore 6 and ConnectCore 6 Plus (kernel v5.4).
 * Updated U-Boot to version 2020.04-r1 for ConnectCore 8X.
-* TrustFence: added secure console and U-Boot environment encryption support.
+* TrustFence: added secure console and U-Boot environment encryption support
   to ConnectCore 8X and 8M Nano.
 * Added MCA keypad support for ConnectCore 8X and 8M Nano.
 * Fix SoftAP on 5GHz on ConnectCore 6UL.

meta-digi-arm/conf/machine/ccimx8x-sbc-express.conf

@@ -7,9 +7,10 @@ include conf/machine/include/ccimx8x.inc
 
 # U-Boot configurations
 # Last one is the default (the one the symlinks point at)
-UBOOT_CONFIG ??= "ccimx8x_sbc_express2GB ccimx8x_sbc_express1GB"
+UBOOT_CONFIG ??= "ccimx8x_sbc_express512MB ccimx8x_sbc_express1GB ccimx8x_sbc_express2GB"
 UBOOT_CONFIG[ccimx8x_sbc_express2GB] = "ccimx8x_sbc_express2GB_defconfig,,u-boot-dtb.${UBOOT_SUFFIX}"
 UBOOT_CONFIG[ccimx8x_sbc_express1GB] = "ccimx8x_sbc_express1GB_defconfig,,u-boot-dtb.${UBOOT_SUFFIX}"
+UBOOT_CONFIG[ccimx8x_sbc_express512MB] = "ccimx8x_sbc_express512MB_defconfig,,u-boot-dtb.${UBOOT_SUFFIX}"
 
 KERNEL_DEVICETREE ?= " \
     digi/ccimx8x-sbc-express.dtb \

meta-digi-arm/conf/machine/include/digi-defaults.inc

@@ -16,9 +16,9 @@ LINUXLIBCVERSION ?= "5.4%"
 # -------------------------------------------------
 # ccimx6        5.4               2017.03
 # ccimx6qp      5.4               2017.03
-# ccimx6ul      5.4               2017.03
+# ccimx6ul      5.4               2020.04
 # ccimx8x       5.4               2020.04 (packaged in imx-boot)
-# ccimx8mn      5.4               2018.03 (packaged in imx-boot)
+# ccimx8mn      5.4               2020.04 (packaged in imx-boot)
 #
 
 # Help variables used in recipes

meta-digi-arm/recipes-bsp/imx-mkimage/imx-boot_1.0.bbappend

@@ -72,7 +72,7 @@ maintain a custom recipe."
 	cp ${DEPLOY_DIR_IMAGE}/${BOOT_TOOLS}/${ATF_MACHINE_NAME} ${BOOT_STAGING}/bl31.bin
 	# Create dummy DEK blob
 	if [ "${TRUSTFENCE_DEK_PATH}" != "0" ]; then
-		dd if=/dev/zero of=${BOOT_STAGING}/dek_blob_fit_dummy.bin bs=96 count=1 && sync
+		dd if=/dev/zero of=${BOOT_STAGING}/dek_blob_fit_dummy.bin bs=96 count=1 oflag=sync
 	fi
 }
 
@@ -213,6 +213,7 @@ do_deploy_append () {
 		[ -n "${TRUSTFENCE_KEY_INDEX}" ] && export CONFIG_KEY_INDEX="${TRUSTFENCE_KEY_INDEX}"
 		[ -n "${TRUSTFENCE_DEK_PATH}" ] && [ "${TRUSTFENCE_DEK_PATH}" != "0" ] && export CONFIG_DEK_PATH="${TRUSTFENCE_DEK_PATH}"
 		[ -n "${TRUSTFENCE_SIGN_MODE}" ] && export CONFIG_SIGN_MODE="${TRUSTFENCE_SIGN_MODE}"
+		[ -n "${TRUSTFENCE_SRK_REVOKE_MASK}" ] && export SRK_REVOKE_MASK="${TRUSTFENCE_SRK_REVOKE_MASK}"
 
 		# Sign U-boot image
 		if [ "${UBOOT_RAM_COMBINATIONS}" = "" ]; then

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6ulsbc/install_linux_fw_sd.txt

@@ -82,12 +82,16 @@ echo ""
 echo ">> Installing U-Boot boot loader (target will reset)"
 echo ""
 echo ""
-update uboot mmc ${INSTALL_MMCDEV} fat ${INSTALL_UBOOT_FILENAME}
+update uboot mmc ${INSTALL_MMCDEV} ${INSTALL_UBOOT_FILENAME}
 if test $? -eq 1; then
-	echo "[ERROR] Failed to update U-Boot boot loader!";
+	# Use old-style update with source file system argument
-	echo "";
+	update uboot mmc ${INSTALL_MMCDEV} fat ${INSTALL_UBOOT_FILENAME}
-	echo "Aborted.";
+	if test $? -eq 1; then
-	exit;
+		echo "[ERROR] Failed to update U-Boot boot loader!";
+		echo "";
+		echo "Aborted.";
+		exit;
+	fi
 fi
 
 # Set 'bootcmd' to the second part of the script that will
@@ -96,6 +100,7 @@ fi
 #  - Update the 'linux' partition
 #  - Update the 'recovery' partition
 #  - Update the 'rootfs' partition
+#  - Erase the 'update' partition
 #  - Configure recovery to wipe 'update' partition
 #  - Run 'recovery' and let the system boot after
 setenv bootcmd "
@@ -107,7 +112,7 @@ setenv bootcmd "
 	echo \"\";
 	echo \"\";
 	nand erase.part linux;
-	update linux mmc ${INSTALL_MMCDEV} fat ${INSTALL_LINUX_FILENAME};
+	update linux mmc ${INSTALL_MMCDEV} ${INSTALL_LINUX_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update linux partition!\";
 		echo \"\";
@@ -120,7 +125,7 @@ setenv bootcmd "
 	echo \"\";
 	echo \"\";
 	nand erase.part recovery;
-	update recovery mmc ${INSTALL_MMCDEV} fat ${INSTALL_RECOVERY_FILENAME};
+	update recovery mmc ${INSTALL_MMCDEV} ${INSTALL_RECOVERY_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update recovery partition!\";
 		echo \"\";
@@ -133,7 +138,7 @@ setenv bootcmd "
 	echo \"\";
 	echo \"\";
 	nand erase.part rootfs;
-	update rootfs mmc ${INSTALL_MMCDEV} fat ${INSTALL_ROOTFS_FILENAME};
+	update rootfs mmc ${INSTALL_MMCDEV} ${INSTALL_ROOTFS_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update rootfs partition!\";
 		echo \"\";
@@ -141,6 +146,7 @@ setenv bootcmd "
 		exit;
 	fi;
 	echo \"\";
+	nand erase.part update;
 	setenv boot_recovery yes;
 	setenv recovery_command wipe_update;
 	saveenv;

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6ulsbc/install_linux_fw_usb.txt

@@ -82,12 +82,16 @@ echo ""
 echo ">> Installing U-Boot boot loader (target will reset)"
 echo ""
 echo ""
-update uboot usb ${INSTALL_USBDEV} fat ${INSTALL_UBOOT_FILENAME}
+update uboot usb ${INSTALL_USBDEV} ${INSTALL_UBOOT_FILENAME}
 if test $? -eq 1; then
-	echo "[ERROR] Failed to update U-Boot boot loader!";
+	# Use old-style update with source file system argument
-	echo "";
+	update uboot mmc ${INSTALL_USBDEV} fat ${INSTALL_UBOOT_FILENAME}
-	echo "Aborted.";
+	if test $? -eq 1; then
-	exit;
+		echo "[ERROR] Failed to update U-Boot boot loader!";
+		echo "";
+		echo "Aborted.";
+		exit;
+	fi
 fi
 
 # Set 'bootcmd' to the second part of the script that will
@@ -96,6 +100,7 @@ fi
 #  - Update the 'linux' partition
 #  - Update the 'recovery' partition
 #  - Update the 'rootfs' partition
+#  - Erase the 'update' partition
 #  - Configure recovery to wipe 'update' partition
 #  - Run 'recovery' and let the system boot after
 setenv bootcmd "
@@ -108,7 +113,7 @@ setenv bootcmd "
 	echo \"\";
 	echo \"\";
 	nand erase.part linux;
-	update linux usb ${INSTALL_USBDEV} fat ${INSTALL_LINUX_FILENAME};
+	update linux usb ${INSTALL_USBDEV} ${INSTALL_LINUX_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update linux partition!\";
 		echo \"\";
@@ -121,7 +126,7 @@ setenv bootcmd "
 	echo \"\";
 	echo \"\";
 	nand erase.part recovery;
-	update recovery usb ${INSTALL_USBDEV} fat ${INSTALL_RECOVERY_FILENAME};
+	update recovery usb ${INSTALL_USBDEV} ${INSTALL_RECOVERY_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update recovery partition!\";
 		echo \"\";
@@ -134,7 +139,7 @@ setenv bootcmd "
 	echo \"\";
 	echo \"\";
 	nand erase.part rootfs;
-	update rootfs usb ${INSTALL_USBDEV} fat ${INSTALL_ROOTFS_FILENAME};
+	update rootfs usb ${INSTALL_USBDEV} ${INSTALL_ROOTFS_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update rootfs partition!\";
 		echo \"\";
@@ -142,6 +147,7 @@ setenv bootcmd "
 		exit;
 	fi;
 	echo \"\";
+	nand erase.part update;
 	setenv boot_recovery yes;
 	setenv recovery_command wipe_update;
 	saveenv;

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6ulsbc/install_linux_fw_uuu.sh

@@ -119,6 +119,7 @@ nand_update "uboot" "${INSTALL_UBOOT_FILENAME}" 5000
 #  - Update the 'linux' partition
 #  - Update the 'recovery' partition
 #  - Update the 'rootfs' partition
+#  - Erase the 'update' partition
 uuu fb: ucmd setenv bootcmd "
 	env default -a;
 	saveenv;
@@ -152,6 +153,9 @@ nand_update "recovery" "${INSTALL_RECOVERY_FILENAME}" 15000
 # Update Rootfs
 nand_update "rootfs" "${INSTALL_ROOTFS_FILENAME}" 90000
 
+# Erase the 'Update' partition
+uuu fb: ucmd nand erase.part update
+
 # Configure u-boot to boot into recovery mode
 uuu fb: ucmd setenv boot_recovery yes
 uuu fb: ucmd setenv recovery_command wipe_update

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6ulstarter/install_linux_fw_sd.txt

@@ -82,12 +82,16 @@ echo ""
 echo ">> Installing U-Boot boot loader (target will reset)"
 echo ""
 echo ""
-update uboot mmc ${INSTALL_MMCDEV} fat ${INSTALL_UBOOT_FILENAME}
+update uboot mmc ${INSTALL_MMCDEV} ${INSTALL_UBOOT_FILENAME}
 if test $? -eq 1; then
-	echo "[ERROR] Failed to update U-Boot boot loader!";
+	# Use old-style update with source file system argument
-	echo "";
+	update uboot mmc ${INSTALL_MMCDEV} fat ${INSTALL_UBOOT_FILENAME}
-	echo "Aborted.";
+	if test $? -eq 1; then
-	exit;
+		echo "[ERROR] Failed to update U-Boot boot loader!";
+		echo "";
+		echo "Aborted.";
+		exit;
+	fi
 fi
 
 # Set 'bootcmd' to the second part of the script that will
@@ -96,6 +100,7 @@ fi
 #  - Update the 'linux' partition
 #  - Update the 'recovery' partition
 #  - Update the 'rootfs' partition
+#  - Erase the 'update' partition
 #  - Configure recovery to wipe 'update' partition
 #  - Run 'recovery' and let the system boot after
 setenv bootcmd "
@@ -107,7 +112,7 @@ setenv bootcmd "
 	echo \"\";
 	echo \"\";
 	nand erase.part linux;
-	update linux mmc ${INSTALL_MMCDEV} fat ${INSTALL_LINUX_FILENAME};
+	update linux mmc ${INSTALL_MMCDEV} ${INSTALL_LINUX_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update linux partition!\";
 		echo \"\";
@@ -120,7 +125,7 @@ setenv bootcmd "
 	echo \"\";
 	echo \"\";
 	nand erase.part recovery;
-	update recovery mmc ${INSTALL_MMCDEV} fat ${INSTALL_RECOVERY_FILENAME};
+	update recovery mmc ${INSTALL_MMCDEV} ${INSTALL_RECOVERY_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update recovery partition!\";
 		echo \"\";
@@ -133,7 +138,7 @@ setenv bootcmd "
 	echo \"\";
 	echo \"\";
 	nand erase.part rootfs;
-	update rootfs mmc ${INSTALL_MMCDEV} fat ${INSTALL_ROOTFS_FILENAME};
+	update rootfs mmc ${INSTALL_MMCDEV} ${INSTALL_ROOTFS_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update rootfs partition!\";
 		echo \"\";
@@ -141,6 +146,7 @@ setenv bootcmd "
 		exit;
 	fi;
 	echo \"\";
+	nand erase.part update;
 	setenv boot_recovery yes;
 	setenv recovery_command wipe_update;
 	saveenv;

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6ulstarter/install_linux_fw_usb.txt

@@ -82,12 +82,16 @@ echo ""
 echo ">> Installing U-Boot boot loader (target will reset)"
 echo ""
 echo ""
-update uboot usb ${INSTALL_USBDEV} fat ${INSTALL_UBOOT_FILENAME}
+update uboot usb ${INSTALL_USBDEV} ${INSTALL_UBOOT_FILENAME}
 if test $? -eq 1; then
-	echo "[ERROR] Failed to update U-Boot boot loader!";
+	# Use old-style update with source file system argument
-	echo "";
+	update uboot mmc ${INSTALL_USBDEV} fat ${INSTALL_UBOOT_FILENAME}
-	echo "Aborted.";
+	if test $? -eq 1; then
-	exit;
+		echo "[ERROR] Failed to update U-Boot boot loader!";
+		echo "";
+		echo "Aborted.";
+		exit;
+	fi
 fi
 
 # Set 'bootcmd' to the second part of the script that will
@@ -96,6 +100,7 @@ fi
 #  - Update the 'linux' partition
 #  - Update the 'recovery' partition
 #  - Update the 'rootfs' partition
+#  - Erase the 'update' partition
 #  - Configure recovery to wipe 'update' partition
 #  - Run 'recovery' and let the system boot after
 setenv bootcmd "
@@ -108,7 +113,7 @@ setenv bootcmd "
 	echo \"\";
 	echo \"\";
 	nand erase.part linux;
-	update linux usb ${INSTALL_USBDEV} fat ${INSTALL_LINUX_FILENAME};
+	update linux usb ${INSTALL_USBDEV} ${INSTALL_LINUX_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update linux partition!\";
 		echo \"\";
@@ -121,7 +126,7 @@ setenv bootcmd "
 	echo \"\";
 	echo \"\";
 	nand erase.part recovery;
-	update recovery usb ${INSTALL_USBDEV} fat ${INSTALL_RECOVERY_FILENAME};
+	update recovery usb ${INSTALL_USBDEV} ${INSTALL_RECOVERY_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update recovery partition!\";
 		echo \"\";
@@ -134,7 +139,7 @@ setenv bootcmd "
 	echo \"\";
 	echo \"\";
 	nand erase.part rootfs;
-	update rootfs usb ${INSTALL_USBDEV} fat ${INSTALL_ROOTFS_FILENAME};
+	update rootfs usb ${INSTALL_USBDEV} ${INSTALL_ROOTFS_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update rootfs partition!\";
 		echo \"\";
@@ -142,6 +147,7 @@ setenv bootcmd "
 		exit;
 	fi;
 	echo \"\";
+	nand erase.part update;
 	setenv boot_recovery yes;
 	setenv recovery_command wipe_update;
 	saveenv;

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6ulstarter/install_linux_fw_uuu.sh

@@ -119,6 +119,7 @@ nand_update "uboot" "${INSTALL_UBOOT_FILENAME}" 5000
 #  - Update the 'linux' partition
 #  - Update the 'recovery' partition
 #  - Update the 'rootfs' partition
+#  - Erase the 'update' partition
 uuu fb: ucmd setenv bootcmd "
 	env default -a;
 	saveenv;
@@ -152,6 +153,9 @@ nand_update "recovery" "${INSTALL_RECOVERY_FILENAME}" 15000
 # Update Rootfs
 nand_update "rootfs" "${INSTALL_ROOTFS_FILENAME}" 90000
 
+# Erase the 'Update' partition
+uuu fb: ucmd nand erase.part update
+
 # Configure u-boot to boot into recovery mode
 uuu fb: ucmd setenv boot_recovery yes
 uuu fb: ucmd setenv recovery_command wipe_update

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8mn-dvk/install_linux_fw_sd.txt

@@ -53,12 +53,16 @@ echo ""
 echo ">> Installing U-Boot boot loader (target will reset)"
 echo ""
 echo ""
-update uboot mmc ${INSTALL_MMCDEV} fat ${INSTALL_UBOOT_FILENAME}
+update uboot mmc ${INSTALL_MMCDEV} ${INSTALL_UBOOT_FILENAME}
 if test $? -eq 1; then
-	echo "[ERROR] Failed to update U-Boot boot loader!";
+	# Use old-style update with source file system argument
-	echo "";
+	update uboot mmc ${INSTALL_MMCDEV} fat ${INSTALL_UBOOT_FILENAME}
-	echo "Aborted.";
+	if test $? -eq 1; then
-	exit;
+		echo "[ERROR] Failed to update U-Boot boot loader!";
+		echo "";
+		echo "Aborted.";
+		exit;
+	fi
 fi
 
 # Set 'bootcmd' to the second part of the script that will
@@ -93,7 +97,7 @@ setenv bootcmd "
 	echo \">> Installing Linux kernel and device tree files\";
 	echo \"\";
 	echo \"\";
-	update linux mmc ${INSTALL_MMCDEV} fat ${INSTALL_LINUX_FILENAME};
+	update linux mmc ${INSTALL_MMCDEV} ${INSTALL_LINUX_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update linux partition!\";
 		echo \"\";
@@ -105,7 +109,7 @@ setenv bootcmd "
 	echo \">> Installing recovery\";
 	echo \"\";
 	echo \"\";
-	update recovery mmc ${INSTALL_MMCDEV} fat ${INSTALL_RECOVERY_FILENAME};
+	update recovery mmc ${INSTALL_MMCDEV} ${INSTALL_RECOVERY_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update recovery partition!\";
 		echo \"\";
@@ -117,7 +121,7 @@ setenv bootcmd "
 	echo \">> Installing Linux root file system\";
 	echo \"\";
 	echo \"\";
-	update rootfs mmc ${INSTALL_MMCDEV} fat ${INSTALL_ROOTFS_FILENAME};
+	update rootfs mmc ${INSTALL_MMCDEV} ${INSTALL_ROOTFS_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update rootfs partition!\";
 		echo \"\";

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8mn-dvk/install_linux_fw_usb.txt

@@ -53,12 +53,16 @@ echo ""
 echo ">> Installing U-Boot boot loader (target will reset)"
 echo ""
 echo ""
-update uboot usb ${INSTALL_USBDEV} fat ${INSTALL_UBOOT_FILENAME}
+update uboot usb ${INSTALL_USBDEV} ${INSTALL_UBOOT_FILENAME}
 if test $? -eq 1; then
-	echo "[ERROR] Failed to update U-Boot boot loader!";
+	# Use old-style update with source file system argument
-	echo "";
+	update uboot mmc ${INSTALL_USBDEV} fat ${INSTALL_UBOOT_FILENAME}
-	echo "Aborted.";
+	if test $? -eq 1; then
-	exit;
+		echo "[ERROR] Failed to update U-Boot boot loader!";
+		echo "";
+		echo "Aborted.";
+		exit;
+	fi
 fi
 
 # Set 'bootcmd' to the second part of the script that will
@@ -94,7 +98,7 @@ setenv bootcmd "
 	echo \">> Installing Linux kernel and device tree files\";
 	echo \"\";
 	echo \"\";
-	update linux usb ${INSTALL_USBDEV} fat ${INSTALL_LINUX_FILENAME};
+	update linux usb ${INSTALL_USBDEV} ${INSTALL_LINUX_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update linux partition!\";
 		echo \"\";
@@ -106,7 +110,7 @@ setenv bootcmd "
 	echo \">> Installing recovery\";
 	echo \"\";
 	echo \"\";
-	update recovery usb ${INSTALL_USBDEV} fat ${INSTALL_RECOVERY_FILENAME};
+	update recovery usb ${INSTALL_USBDEV} ${INSTALL_RECOVERY_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update recovery partition!\";
 		echo \"\";
@@ -118,7 +122,7 @@ setenv bootcmd "
 	echo \">> Installing Linux root file system\";
 	echo \"\";
 	echo \"\";
-	update rootfs usb ${INSTALL_USBDEV} fat ${INSTALL_ROOTFS_FILENAME};
+	update rootfs usb ${INSTALL_USBDEV} ${INSTALL_ROOTFS_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update rootfs partition!\";
 		echo \"\";

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8x-sbc-express/install_linux_fw_sd.txt

@@ -50,6 +50,18 @@ else
 			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-express-${soc_rev}-1GB_16bit.bin;
 		elif test "${module_variant}" = "0x05"; then
 			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-express-${soc_rev}-1GB_16bit.bin;
+		elif test "${module_variant}" = "0x06"; then
+			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-express-${soc_rev}-512MB_16bit.bin;
+		elif test "${module_variant}" = "0x07"; then
+			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-express-${soc_rev}-1GB_32bit.bin;
+		elif test "${module_variant}" = "0x08"; then
+			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-express-${soc_rev}-1GB_32bit.bin;
+		elif test "${module_variant}" = "0x09"; then
+			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-express-${soc_rev}-512MB_16bit.bin;
+		elif test "${module_variant}" = "0x0A"; then
+			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-express-${soc_rev}-1GB_16bit.bin;
+		elif test "${module_variant}" = "0x0B"; then
+			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-express-${soc_rev}-1GB_16bit.bin;
 		fi
 	fi
 fi
@@ -69,6 +81,8 @@ else
 	echo "     => setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-express-${soc_rev}-2GB_32bit.bin";
 	echo "   - For a DualX CPU with 1GB LPDDR4, run:";
 	echo "     => setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-express-${soc_rev}-1GB_16bit.bin";
+	echo "   - For a DualX CPU with 512MB LPDDR4, run:";
+	echo "     => setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-express-${soc_rev}-512MB_16bit.bin";
 	echo "";
 	echo "2. Run the install script again.";
 	echo "";
@@ -110,12 +124,16 @@ echo ""
 echo ">> Installing U-Boot boot loader (target will reset)"
 echo ""
 echo ""
-update uboot mmc ${INSTALL_MMCDEV} fat ${INSTALL_UBOOT_FILENAME}
+update uboot mmc ${INSTALL_MMCDEV} ${INSTALL_UBOOT_FILENAME}
 if test $? -eq 1; then
-	echo "[ERROR] Failed to update U-Boot boot loader!";
+	# Use old-style update with source file system argument
-	echo "";
+	update uboot mmc ${INSTALL_MMCDEV} fat ${INSTALL_UBOOT_FILENAME}
-	echo "Aborted.";
+	if test $? -eq 1; then
-	exit;
+		echo "[ERROR] Failed to update U-Boot boot loader!";
+		echo "";
+		echo "Aborted.";
+		exit;
+	fi
 fi
 
 # Set 'bootcmd' to the second part of the script that will
@@ -150,7 +168,7 @@ setenv bootcmd "
 	echo \">> Installing Linux kernel and device tree files\";
 	echo \"\";
 	echo \"\";
-	update linux mmc ${INSTALL_MMCDEV} fat ${INSTALL_LINUX_FILENAME};
+	update linux mmc ${INSTALL_MMCDEV} ${INSTALL_LINUX_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update linux partition!\";
 		echo \"\";
@@ -162,7 +180,7 @@ setenv bootcmd "
 	echo \">> Installing recovery\";
 	echo \"\";
 	echo \"\";
-	update recovery mmc ${INSTALL_MMCDEV} fat ${INSTALL_RECOVERY_FILENAME};
+	update recovery mmc ${INSTALL_MMCDEV} ${INSTALL_RECOVERY_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update recovery partition!\";
 		echo \"\";
@@ -174,7 +192,7 @@ setenv bootcmd "
 	echo \">> Installing Linux root file system\";
 	echo \"\";
 	echo \"\";
-	update rootfs mmc ${INSTALL_MMCDEV} fat ${INSTALL_ROOTFS_FILENAME};
+	update rootfs mmc ${INSTALL_MMCDEV} ${INSTALL_ROOTFS_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update rootfs partition!\";
 		echo \"\";

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8x-sbc-express/install_linux_fw_usb.txt

@@ -50,6 +50,18 @@ else
 			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-express-${soc_rev}-1GB_16bit.bin;
 		elif test "${module_variant}" = "0x05"; then
 			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-express-${soc_rev}-1GB_16bit.bin;
+		elif test "${module_variant}" = "0x06"; then
+			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-express-${soc_rev}-512MB_16bit.bin;
+		elif test "${module_variant}" = "0x07"; then
+			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-express-${soc_rev}-1GB_32bit.bin;
+		elif test "${module_variant}" = "0x08"; then
+			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-express-${soc_rev}-1GB_32bit.bin;
+		elif test "${module_variant}" = "0x09"; then
+			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-express-${soc_rev}-512MB_16bit.bin;
+		elif test "${module_variant}" = "0x0A"; then
+			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-express-${soc_rev}-1GB_16bit.bin;
+		elif test "${module_variant}" = "0x0B"; then
+			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-express-${soc_rev}-1GB_16bit.bin;
 		fi
 	fi
 fi
@@ -110,12 +122,16 @@ echo ""
 echo ">> Installing U-Boot boot loader (target will reset)"
 echo ""
 echo ""
-update uboot usb ${INSTALL_USBDEV} fat ${INSTALL_UBOOT_FILENAME}
+update uboot usb ${INSTALL_USBDEV} ${INSTALL_UBOOT_FILENAME}
 if test $? -eq 1; then
-	echo "[ERROR] Failed to update U-Boot boot loader!";
+	# Use old-style update with source file system argument
-	echo "";
+	update uboot mmc ${INSTALL_USBDEV} fat ${INSTALL_UBOOT_FILENAME}
-	echo "Aborted.";
+	if test $? -eq 1; then
-	exit;
+		echo "[ERROR] Failed to update U-Boot boot loader!";
+		echo "";
+		echo "Aborted.";
+		exit;
+	fi
 fi
 
 # Set 'bootcmd' to the second part of the script that will
@@ -151,7 +167,7 @@ setenv bootcmd "
 	echo \">> Installing Linux kernel and device tree files\";
 	echo \"\";
 	echo \"\";
-	update linux usb ${INSTALL_USBDEV} fat ${INSTALL_LINUX_FILENAME};
+	update linux usb ${INSTALL_USBDEV} ${INSTALL_LINUX_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update linux partition!\";
 		echo \"\";
@@ -163,7 +179,7 @@ setenv bootcmd "
 	echo \">> Installing recovery\";
 	echo \"\";
 	echo \"\";
-	update recovery usb ${INSTALL_USBDEV} fat ${INSTALL_RECOVERY_FILENAME};
+	update recovery usb ${INSTALL_USBDEV} ${INSTALL_RECOVERY_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update recovery partition!\";
 		echo \"\";
@@ -175,7 +191,7 @@ setenv bootcmd "
 	echo \">> Installing Linux root file system\";
 	echo \"\";
 	echo \"\";
-	update rootfs usb ${INSTALL_USBDEV} fat ${INSTALL_ROOTFS_FILENAME};
+	update rootfs usb ${INSTALL_USBDEV} ${INSTALL_ROOTFS_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update rootfs partition!\";
 		echo \"\";

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8x-sbc-pro/install_linux_fw_sd.txt

@@ -52,6 +52,16 @@ else
 			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-pro-${soc_rev}-1GB_16bit.bin;
 		elif test "${module_variant}" = "0x06"; then
 			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-pro-${soc_rev}-512MB_16bit.bin;
+		elif test "${module_variant}" = "0x07"; then
+			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-pro-${soc_rev}-1GB_32bit.bin;
+		elif test "${module_variant}" = "0x08"; then
+			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-pro-${soc_rev}-1GB_32bit.bin;
+		elif test "${module_variant}" = "0x09"; then
+			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-pro-${soc_rev}-512MB_16bit.bin;
+		elif test "${module_variant}" = "0x0A"; then
+			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-pro-${soc_rev}-1GB_16bit.bin;
+		elif test "${module_variant}" = "0x0B"; then
+			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-pro-${soc_rev}-1GB_16bit.bin;
 		fi
 	fi
 fi
@@ -114,12 +124,16 @@ echo ""
 echo ">> Installing U-Boot boot loader (target will reset)"
 echo ""
 echo ""
-update uboot mmc ${INSTALL_MMCDEV} fat ${INSTALL_UBOOT_FILENAME}
+update uboot mmc ${INSTALL_MMCDEV} ${INSTALL_UBOOT_FILENAME}
 if test $? -eq 1; then
-	echo "[ERROR] Failed to update U-Boot boot loader!";
+	# Use old-style update with source file system argument
-	echo "";
+	update uboot mmc ${INSTALL_MMCDEV} fat ${INSTALL_UBOOT_FILENAME}
-	echo "Aborted.";
+	if test $? -eq 1; then
-	exit;
+		echo "[ERROR] Failed to update U-Boot boot loader!";
+		echo "";
+		echo "Aborted.";
+		exit;
+	fi
 fi
 
 # Set 'bootcmd' to the second part of the script that will
@@ -154,7 +168,7 @@ setenv bootcmd "
 	echo \">> Installing Linux kernel and device tree files\";
 	echo \"\";
 	echo \"\";
-	update linux mmc ${INSTALL_MMCDEV} fat ${INSTALL_LINUX_FILENAME};
+	update linux mmc ${INSTALL_MMCDEV} ${INSTALL_LINUX_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update linux partition!\";
 		echo \"\";
@@ -166,7 +180,7 @@ setenv bootcmd "
 	echo \">> Installing recovery\";
 	echo \"\";
 	echo \"\";
-	update recovery mmc ${INSTALL_MMCDEV} fat ${INSTALL_RECOVERY_FILENAME};
+	update recovery mmc ${INSTALL_MMCDEV} ${INSTALL_RECOVERY_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update recovery partition!\";
 		echo \"\";
@@ -178,7 +192,7 @@ setenv bootcmd "
 	echo \">> Installing Linux root file system\";
 	echo \"\";
 	echo \"\";
-	update rootfs mmc ${INSTALL_MMCDEV} fat ${INSTALL_ROOTFS_FILENAME};
+	update rootfs mmc ${INSTALL_MMCDEV} ${INSTALL_ROOTFS_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update rootfs partition!\";
 		echo \"\";

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8x-sbc-pro/install_linux_fw_usb.txt

@@ -52,6 +52,16 @@ else
 			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-pro-${soc_rev}-1GB_16bit.bin;
 		elif test "${module_variant}" = "0x06"; then
 			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-pro-${soc_rev}-512MB_16bit.bin;
+		elif test "${module_variant}" = "0x07"; then
+			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-pro-${soc_rev}-1GB_32bit.bin;
+		elif test "${module_variant}" = "0x08"; then
+			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-pro-${soc_rev}-1GB_32bit.bin;
+		elif test "${module_variant}" = "0x09"; then
+			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-pro-${soc_rev}-512MB_16bit.bin;
+		elif test "${module_variant}" = "0x0A"; then
+			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-pro-${soc_rev}-1GB_16bit.bin;
+		elif test "${module_variant}" = "0x0B"; then
+			setenv INSTALL_UBOOT_FILENAME imx-boot-ccimx8x-sbc-pro-${soc_rev}-1GB_16bit.bin;
 		fi
 	fi
 fi
@@ -114,12 +124,16 @@ echo ""
 echo ">> Installing U-Boot boot loader (target will reset)"
 echo ""
 echo ""
-update uboot usb ${INSTALL_USBDEV} fat ${INSTALL_UBOOT_FILENAME}
+update uboot usb ${INSTALL_USBDEV} ${INSTALL_UBOOT_FILENAME}
 if test $? -eq 1; then
-	echo "[ERROR] Failed to update U-Boot boot loader!";
+	# Use old-style update with source file system argument
-	echo "";
+	update uboot mmc ${INSTALL_USBDEV} fat ${INSTALL_UBOOT_FILENAME}
-	echo "Aborted.";
+	if test $? -eq 1; then
-	exit;
+		echo "[ERROR] Failed to update U-Boot boot loader!";
+		echo "";
+		echo "Aborted.";
+		exit;
+	fi
 fi
 
 # Set 'bootcmd' to the second part of the script that will
@@ -155,7 +169,7 @@ setenv bootcmd "
 	echo \">> Installing Linux kernel and device tree files\";
 	echo \"\";
 	echo \"\";
-	update linux usb ${INSTALL_USBDEV} fat ${INSTALL_LINUX_FILENAME};
+	update linux usb ${INSTALL_USBDEV} ${INSTALL_LINUX_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update linux partition!\";
 		echo \"\";
@@ -167,7 +181,7 @@ setenv bootcmd "
 	echo \">> Installing recovery\";
 	echo \"\";
 	echo \"\";
-	update recovery usb ${INSTALL_USBDEV} fat ${INSTALL_RECOVERY_FILENAME};
+	update recovery usb ${INSTALL_USBDEV} ${INSTALL_RECOVERY_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update recovery partition!\";
 		echo \"\";
@@ -179,7 +193,7 @@ setenv bootcmd "
 	echo \">> Installing Linux root file system\";
 	echo \"\";
 	echo \"\";
-	update rootfs usb ${INSTALL_USBDEV} fat ${INSTALL_ROOTFS_FILENAME};
+	update rootfs usb ${INSTALL_USBDEV} ${INSTALL_ROOTFS_FILENAME};
 	if test \$? -eq 1; then
 		echo \"[ERROR] Failed to update rootfs partition!\";
 		echo \"\";

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey_2017.03.bb

@@ -2,7 +2,7 @@
 
 require digi-u-boot.inc
 
-SRCBRANCH = "v2017.03/master"
+SRCBRANCH = "v2017.03/maint"
 SRCREV = "${AUTOREV}"
 
 COMPATIBLE_MACHINE = "(ccimx6$|ccimx6ul|ccimx8x)"

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey_2018.03.bb

@@ -1,8 +0,0 @@
-# Copyright (C) 2019,2020 Digi International
-
-require digi-u-boot.inc
-
-SRCBRANCH = "v2018.03/master"
-SRCREV = "${AUTOREV}"
-
-COMPATIBLE_MACHINE = "(ccimx8x|ccimx8m)"

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey_2020.04.bb

@@ -5,7 +5,7 @@ LIC_FILES_CHKSUM = "file://Licenses/README;md5=30503fd321432fc713238f582193b78e"
 
 DEPENDS += "flex-native bison-native"
 
-SRCBRANCH = "v2020.04/master"
+SRCBRANCH = "v2020.04/maint"
 SRCREV = "${AUTOREV}"
 
 COMPATIBLE_MACHINE = "(ccimx8x|ccimx8m|ccimx6ul)"

meta-digi-arm/recipes-digi/trustfence/trustfence-sign-tools/encrypt_ahab

@@ -0,0 +1,29 @@
+# The syntax for this file is documented in the AHAB Code Signing Tool
+# User's Guide which is included in the CST package distributed by NXP
+[Header]
+    Target = AHAB
+    Version = 1.0
+
+[Install SRK]
+    # SRK table generated by srktool
+    File = "%srk_table%"
+    # Public key certificate in PEM format
+    Source = "%cert_img%"
+    # Index of the public key certificate within the SRK table (0 .. 3)
+    Source index = %key_index%
+    # Type of SRK set (NXP or OEM)
+    Source set = OEM
+    # bitmask of the revoked SRKs
+    Revocations = 0x0
+
+[Authenticate Data]
+    # Binary to be signed generated by mkimage
+    File = "%kernel-img%"
+    # Offsets = Container header Signature block (printed out by mkimage)
+    Offsets = %container_offset% %block_offset%
+
+[Install Secret Key]
+    Key = "%dek_path%"
+    Key Length = %dek_len%
+    #Key Identifier = 0x1234CAFE
+    Image Indexes = 0xFFFFFFFF

meta-digi-arm/recipes-digi/trustfence/trustfence-sign-tools/sign_ahab

@@ -14,7 +14,7 @@
     # Type of SRK set (NXP or OEM)
     Source set = OEM
     # bitmask of the revoked SRKs
-    Revocations = 0x%key_index%
+    Revocations = 0x0
 
 [Authenticate Data]
     # Binary to be signed generated by mkimage

meta-digi-arm/recipes-digi/trustfence/trustfence-sign-tools/trustfence-sign-artifact.sh

@@ -3,7 +3,7 @@
 #
 #  trustfence-sign-artifact.sh
 #
-#  Copyright (C) 2016-2020 by Digi International Inc.
+#  Copyright (C) 2016-2021 by Digi International Inc.
 #  All rights reserved.
 #
 #  This program is free software; you can redistribute it and/or modify it
@@ -122,29 +122,31 @@ if [ -z "${CONFIG_RAM_START}" ]; then
 	exit 1
 fi
 
+# Get DEK key
+if [ -n "${CONFIG_DEK_PATH}" ]; then
+	if [ ! -f "${CONFIG_DEK_PATH}" ]; then
+		if [ "${PLATFORM}" = "ccimx8mn" ]; then
+			echo "DEK not found. Generating random 128 bit DEK."
+			[ -d $(dirname ${CONFIG_DEK_PATH}) ] || mkdir -p $(dirname ${CONFIG_DEK_PATH})
+			dd if=/dev/urandom of="${CONFIG_DEK_PATH}" bs=16 count=1 >/dev/null 2>&1
+		else
+			echo "DEK not found. Generating random 256 bit DEK."
+			[ -d $(dirname ${CONFIG_DEK_PATH}) ] || mkdir -p $(dirname ${CONFIG_DEK_PATH})
+			dd if=/dev/urandom of="${CONFIG_DEK_PATH}" bs=32 count=1 >/dev/null 2>&1
+		fi
+	fi
+	dek_size="$((8 * $(stat -L -c %s ${CONFIG_DEK_PATH})))"
+	if [ "${dek_size}" != "128" ] && [ "${dek_size}" != "192" ] && [ "${dek_size}" != "256" ]; then
+		echo "Invalid DEK size: ${dek_size} bits. Valid sizes are 128, 192 and 256 bits"
+		exit 1
+	fi
+	ENCRYPT="true"
+fi
+
 if [ "${CONFIG_SIGN_MODE}" = "HAB" ]; then
 	# Negative offset with respect to CONFIG_RAM_START in which U-Boot
 	# copies the DEK blob.
 	DEK_BLOB_OFFSET="0x100"
-	if [ -n "${CONFIG_DEK_PATH}" ]; then
-		if [ ! -f "${CONFIG_DEK_PATH}" ]; then
-			if [ "${PLATFORM}" = "ccimx8mn" ]; then
-				echo "DEK not found. Generating random 128 bit DEK."
-				[ -d $(dirname ${CONFIG_DEK_PATH}) ] || mkdir -p $(dirname ${CONFIG_DEK_PATH})
-				dd if=/dev/urandom of="${CONFIG_DEK_PATH}" bs=16 count=1 >/dev/null 2>&1
-			else
-				echo "DEK not found. Generating random 256 bit DEK."
-				[ -d $(dirname ${CONFIG_DEK_PATH}) ] || mkdir -p $(dirname ${CONFIG_DEK_PATH})
-				dd if=/dev/urandom of="${CONFIG_DEK_PATH}" bs=32 count=1 >/dev/null 2>&1
-			fi
-		fi
-		dek_size="$((8 * $(stat -L -c %s ${CONFIG_DEK_PATH})))"
-		if [ "${dek_size}" != "128" ] && [ "${dek_size}" != "192" ] && [ "${dek_size}" != "256" ]; then
-			echo "Invalid DEK size: ${dek_size} bits. Valid sizes are 128, 192 and 256 bits"
-			exit 1
-		fi
-		ENCRYPT="true"
-	fi
 fi
 
 # Default values
@@ -280,7 +282,7 @@ if [ "${CONFIG_SIGN_MODE}" = "HAB" ]; then
 		-e "s,%key_index%,${CONFIG_KEY_INDEX},g"	   \
 		"${SCRIPT_PATH}/csf_templates/sign_hab" > csf_descriptor
 	fi
-else
+elif [ "${CONFIG_SIGN_MODE}" = "AHAB" ]; then
 	# Other constants
 	KERNEL_START_OFFSET="0x0"
 	KERNEL_SIG_BLOCK_OFFSET="0x90"
@@ -299,17 +301,25 @@ else
 
 	SRK_CERT_KEY_IMG="$(echo ${CONFIG_SIGN_KEYS_PATH}/crts/SRK${CONFIG_KEY_INDEX_1}*crt.pem | sed s/\ /\,/g)"
 
-	sed -e "s,%srk_table%,${SRK_TABLE},g"		   \
+	# Generate actual CSF descriptor file from template
-	-e "s,%cert_img%,${SRK_CERT_KEY_IMG},g"		   \
-	-e "s,%kernel-img%,${KERNEL_NAME},g"		   \
-	-e "s,%key_index%,${CONFIG_KEY_INDEX},g"	   \
-	-e "s,%container_offset%,${container_header_offset},g" \
-	-e "s,%block_offset%,${signature_block_offset},g" \
-	"${SCRIPT_PATH}/csf_templates/sign_ahab" > csf_descriptor
-
 	if [ "${ENCRYPT}" = "true" ]; then
-		echo "[ERROR] Environment encryption is not supported."
+		sed -e "s,%srk_table%,${SRK_TABLE},g"		   	\
-		exit 1
+		-e "s,%cert_img%,${SRK_CERT_KEY_IMG},g"		   	\
+		-e "s,%kernel-img%,${KERNEL_NAME},g"		   	\
+		-e "s,%key_index%,${CONFIG_KEY_INDEX},g"	   	\
+		-e "s,%container_offset%,${container_header_offset},g" 	\
+		-e "s,%block_offset%,${signature_block_offset},g" 	\
+		-e "s,%dek_path%,${CONFIG_DEK_PATH},g"		   	\
+		-e "s,%dek_len%,${dek_size},g"			   	\
+		"${SCRIPT_PATH}/csf_templates/encrypt_ahab" > csf_descriptor
+	else
+		sed -e "s,%srk_table%,${SRK_TABLE},g"		   	\
+		-e "s,%cert_img%,${SRK_CERT_KEY_IMG},g"		   	\
+		-e "s,%kernel-img%,${KERNEL_NAME},g"		   	\
+		-e "s,%key_index%,${CONFIG_KEY_INDEX},g"	   	\
+		-e "s,%container_offset%,${container_header_offset},g" 	\
+		-e "s,%block_offset%,${signature_block_offset},g" 	\
+		"${SCRIPT_PATH}/csf_templates/sign_ahab" > csf_descriptor
 	fi
 fi
 
@@ -350,8 +360,8 @@ if [ "${CONFIG_SIGN_MODE}" = "HAB" ]; then
 	cat csf.bin >> "${TARGET}"
 
 	objcopy -I binary -O binary --pad-to "${sig_len}" --gap-fill="${GAP_FILLER}" "${TARGET}"
-else
+elif [ "${CONFIG_SIGN_MODE}" = "AHAB" ]; then
-	# Sign the image
+	# Sign and encrypt the image
 	CURRENT_PATH="$(pwd)"
 	cst -o "${TARGET}" -i "${CURRENT_PATH}/csf_descriptor" >/dev/null
 	if [ $? -ne 0 ]; then

meta-digi-arm/recipes-digi/trustfence/trustfence-sign-tools_git.bb

@@ -1,4 +1,4 @@
-# Copyright (C) 2017-2020 Digi International
+# Copyright (C) 2017-2021 Digi International
 SUMMARY = "TrustFence signing and encryption scripts"
 LICENSE = "GPL-2.0"
 LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/GPL-2.0;md5=801f80980d171dd6425610833a22dbe6"
@@ -6,7 +6,7 @@ LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/GPL-2.0;md5=801f80980d171dd6425
 DEPENDS = "trustfence-cst coreutils util-linux"
 DEPENDS += "${@oe.utils.conditional('TRUSTFENCE_SIGN_MODE', 'AHAB', 'imx-mkimage', '', d)}"
 
-SRCBRANCH = "v2020.04/master"
+SRCBRANCH = "v2020.04/maint"
 SRCREV = "${AUTOREV}"
 
 S = "${WORKDIR}"
@@ -20,6 +20,7 @@ SRC_URI = " \
     file://sign_hab;name=artifact-hab-sign \
     file://encrypt_hab;name=artifact-hab-encrypt \
     file://sign_ahab;name=artifact-ahab-sign \
+    file://encrypt_ahab;name=artifact-ahab-encrypt \
 "
 
 do_configure[noexec] = "1"
@@ -29,6 +30,7 @@ do_install() {
 	install -d ${D}${bindir}/csf_templates
 	if [ "${TRUSTFENCE_SIGN_MODE}" = "AHAB" ]; then
 		install -m 0755 sign_ahab ${D}${bindir}/csf_templates/
+		install -m 0755 encrypt_ahab ${D}${bindir}/csf_templates/
 	elif [ "${TRUSTFENCE_SIGN_MODE}" = "HAB" ]; then
 		install -m 0755 sign_hab ${D}${bindir}/csf_templates/
 		install -m 0755 encrypt_hab ${D}${bindir}/csf_templates/

meta-digi-arm/recipes-kernel/kernel-module-qualcomm/kernel-module-qualcomm.bb

@@ -8,7 +8,7 @@ LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/ISC;md5=f3b90e78ea0cffb20bf5cca
 # Reference Qualcomm tag/version
 PV = "v4.0.11.213X"
 
-SRCBRANCH = "qca65X4/master"
+SRCBRANCH = "qca65X4/dey-3.0/maint"
 SRCREV = "${AUTOREV}"
 
 QCOM_GIT_URI = "${@oe.utils.conditional('DIGI_INTERNAL_GIT', '1' , '${DIGI_MTK_GIT}linux/qcacld-2.0.git;protocol=ssh', '${DIGI_GITHUB_GIT}/qcacld-2.0.git;protocol=https', d)}"

meta-digi-arm/recipes-kernel/linux/linux-dey-src.inc

@@ -4,7 +4,7 @@ LICENSE = "GPLv2"
 LIC_FILES_CHKSUM = "file://COPYING;md5=bbea815ee2795b2f4230826c0c6b8814"
 
 LOCALVERSION = "-dey"
-SRCBRANCH = "v5.4.47/master"
+SRCBRANCH = "v5.4/dey-3.0/maint"
 SRCREV = "${AUTOREV}"
 
 # Select internal or Github Linux repo

meta-digi-dey/classes/trustfence.bbclass

@@ -23,6 +23,7 @@ TRUSTFENCE_SIGN ?= "1"
 TRUSTFENCE_SIGN_KEYS_PATH ?= "default"
 TRUSTFENCE_DEK_PATH ?= "default"
 TRUSTFENCE_ENCRYPT_ENVIRONMENT ?= "1"
+TRUSTFENCE_SRK_REVOKE_MASK ?= "0x0"
 
 # Trustfence initramfs image recipe
 TRUSTFENCE_INITRAMFS_IMAGE ?= "dey-image-trustfence-initramfs"

meta-digi-dey/recipes-digi/dey-examples/dey-examples-src.inc

@@ -1,6 +1,6 @@
 # Copyright (C) 2019,2020, Digi International Inc.
 
-SRCBRANCH = "master"
+SRCBRANCH = "dey-3.0/maint"
 SRCREV = "${AUTOREV}"
 
 DEY_EXAMPLES_STASH = "${DIGI_MTK_GIT}dey/dey-examples.git;protocol=ssh"

meta-digi-dey/recipes-digi/libdigiapix/libdigiapix_git.bb

@@ -8,7 +8,7 @@ LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/ISC;md5=f3b90e78ea0cffb20bf5cca
 
 DEPENDS = "libsoc libsocketcan libgpiod"
 
-SRCBRANCH ?= "master"
+SRCBRANCH ?= "dey-3.0/maint"
 SRCREV = "${AUTOREV}"
 
 LIBDIGIAPIX_URI_STASH = "${DIGI_MTK_GIT}dey/libdigiapix.git;protocol=ssh"

meta-digi-dey/recipes-graphics/wayland/weston-init.bbappend

@@ -17,7 +17,8 @@ INI_UNCOMMENT_ASSIGNMENTS_append_mx8mp = " \
 "
 
 # Digi: use g2d on ccimx6sbc to fix desktop window issue
-INI_UNCOMMENT_ASSIGNMENTS_append_ccimx6sbc = " \
+# Also needed to workaround an HDMI hotplug issue on the ccimx6qpsbc
+INI_UNCOMMENT_ASSIGNMENTS_append_ccimx6 = " \
     use-g2d=1 \
 "
 

meta-digi-dey/recipes-graphics/wayland/weston_%.bbappend

@@ -1,3 +1,3 @@
 # Copyright (C) 2020 Digi International.
 
-SRC_URI_append_ccimx6sbc = " file://0001-libweston-g2d-renderer-try-re-adjusting-fb-if-the-FB.patch"
+SRC_URI_append_ccimx6 = " file://0001-libweston-g2d-renderer-try-re-adjusting-fb-if-the-FB.patch"

meta-digi-dey/recipes-support/dnsmasq/dnsmasq/lua.patch

@@ -1,7 +1,7 @@
 From be1b3d2d0f1608cba5efee73d6aac5ad0709041b Mon Sep 17 00:00:00 2001
 From: Joe MacDonald <joe_macdonald@mentor.com>
 Date: Tue, 9 Sep 2014 10:24:58 -0400
-Subject: [PATCH] Upstream-status: Inappropriate [OE specific]
+Subject: [PATCH] Upstream-Status: Inappropriate [OE specific]
 
 Signed-off-by: Christopher Larson <chris_larson@mentor.com>
 Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
@@ -14,7 +14,7 @@ diff --git a/Makefile b/Makefile
 index 73ea23e..ed3eeb9 100644
 --- a/Makefile
 +++ b/Makefile
-@@ -59,8 +59,8 @@ idn2_cflags =   `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_LIBIDN2 $(PKG_CONFI
+@@ -60,8 +60,8 @@ idn2_cflags =   `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_LIBIDN2 $(PKG_CONFI
  idn2_libs =     `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_LIBIDN2 $(PKG_CONFIG) --libs libidn2`
  ct_cflags =     `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_CONNTRACK $(PKG_CONFIG) --cflags libnetfilter_conntrack`
  ct_libs =       `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_CONNTRACK $(PKG_CONFIG) --libs libnetfilter_conntrack`
@@ -22,9 +22,9 @@ index 73ea23e..ed3eeb9 100644
 -lua_libs =      `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_LUASCRIPT $(PKG_CONFIG) --libs lua5.2` 
 +lua_cflags =    `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_LUASCRIPT $(PKG_CONFIG) --cflags lua`
 +lua_libs =      `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_LUASCRIPT $(PKG_CONFIG) --libs lua`
- nettle_cflags = `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DNSSEC $(PKG_CONFIG) --cflags nettle hogweed`
+ nettle_cflags = `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DNSSEC     $(PKG_CONFIG) --cflags 'nettle hogweed' \
- nettle_libs =   `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DNSSEC $(PKG_CONFIG) --libs nettle hogweed`
+                                                         HAVE_NETTLEHASH $(PKG_CONFIG) --cflags nettle`
- gmp_libs =      `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DNSSEC NO_GMP --copy -lgmp`
+ nettle_libs =   `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DNSSEC     $(PKG_CONFIG) --libs 'nettle hogweed' \
 -- 
 2.9.5
 

meta-digi-dey/recipes-support/dnsmasq/dnsmasq_2.83.bb

@@ -0,0 +1,10 @@
+require recipes-support/dnsmasq/dnsmasq.inc
+
+# To avoid duplicating files, re-use the original ones from meta-openembedded.
+FILESEXTRAPATHS_prepend := "${COREBASE}/../meta-openembedded/meta-networking/recipes-support/${PN}/files:"
+
+SRC_URI[dnsmasq-2.83.md5sum] = "c87d5af020d12984d2ab9fbf04e2dcca"
+SRC_URI[dnsmasq-2.83.sha256sum] = "6b67955873acc931bfff61a0a1e0dc239f8b52e31df50e9164d3a4537571342f"
+SRC_URI += "\
+    file://lua.patch \
+"

meta-digi-dey/recipes-support/dnsmasq/files/99_dnsmasq

@@ -1 +0,0 @@
-d root root 0755 /run/dnsmasq none

meta-digi-dey/recipes-support/dnsmasq/files/dnsmasq-noresolvconf.service

@@ -1,15 +0,0 @@
-[Unit]
-Description=DNS forwarder and DHCP server
-After=network.target
-
-[Service]
-Type=forking
-PIDFile=/run/dnsmasq.pid
-ExecStartPre=/usr/bin/dnsmasq --test
-ExecStart=/usr/bin/dnsmasq -x /run/dnsmasq.pid -7 /etc/dnsmasq.d --local-service
-ExecStop=/bin/kill $MAINPID
-ExecReload=/bin/kill -HUP $MAINPID
-
-[Install]
-WantedBy=multi-user.target
-

meta-digi-dey/recipes-support/dnsmasq/files/dnsmasq-resolvconf-helper

@@ -1,62 +0,0 @@
-#!/bin/bash
-#
-# Borrowing heavily from the dnsmasq initscript's version of support for
-# resolvconf, intended for use in systemd-only configurations.
-#
-PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
-DAEMON=/usr/sbin/dnsmasq
-NAME=dnsmasq
-
-# Most configuration options in /etc/default/dnsmasq are deprecated
-# but still honoured.
-if [ -r /etc/default/$NAME ]; then
-   . /etc/default/$NAME
-fi
-
-start_resolvconf()
-{
-   # If interface "lo" is explicitly disabled in /etc/default/dnsmasq
-   # Then dnsmasq won't be providing local DNS, so don't add it to
-   # the resolvconf server set.
-   for interface in $DNSMASQ_EXCEPT
-   do
-      [ $interface = lo ] && return
-   done
-
-   if [ -x /sbin/resolvconf ] ; then
-      echo "nameserver 127.0.0.1" |
-      /sbin/resolvconf -a lo.$NAME
-   fi
-   return 0
-}
-
-stop_resolvconf()
-{
-   if [ -x /sbin/resolvconf ] ; then
-      /sbin/resolvconf -d lo.$NAME
-   fi
-   return 0
-}
-
-case "$1" in
-   start)
-      start_resolvconf
-      exit 0
-      ;;
-   stop)
-      stop_resolvconf
-      exit 0
-      ;;
-   restart)
-      stop_resolvconf
-      start_resolvconf
-      exit 0
-      ;;
-   *)
-      echo "Usage: /etc/init.d/$NAME {start|stop|restart}" >&2
-      exit 3
-      ;;
-esac
-
-exit 0
-

meta-digi-dey/recipes-support/dnsmasq/files/dnsmasq-resolvconf.service

@@ -1,17 +0,0 @@
-[Unit]
-Description=DNS forwarder and DHCP server
-After=network.target
-
-[Service]
-Type=forking
-PIDFile=/run/dnsmasq.pid
-ExecStartPre=/usr/bin/dnsmasq --test
-ExecStart=/usr/bin/dnsmasq -x /run/dnsmasq.pid -7 /etc/dnsmasq.d --local-service
-ExecStartPost=/usr/bin/dnsmasq-resolvconf-helper start
-ExecStopPre=/usr/bin/dnsmasq-resolvconf-helper stop
-ExecStop=/bin/kill $MAINPID
-ExecReload=/bin/kill -HUP $MAINPID
-
-[Install]
-WantedBy=multi-user.target
-

meta-digi-dey/recipes-support/dnsmasq/files/dnsmasq.conf

@@ -1,298 +0,0 @@
-# Configuration file for dnsmasq.
-#
-# Format is one option per line, legal options are the same
-# as the long options legal on the command line. See
-# "/usr/sbin/dnsmasq --help" or "man 8 dnsmasq" for details.
-
-# Listen on this specific port instead of the standard DNS port
-# (53). Setting this to zero completely disables DNS function,
-# leaving only DHCP and/or TFTP.
-#port=5353
-
-# Change these lines if you want dnsmasq to serve MX records.
-# Only one of mx-host and mx-target need be set, the other defaults
-# to the name of the host  running dnsmasq.
-#mx-host=
-#mx-target=
-#selfmx
-#localmx
-
-# The following two options make you a better netizen, since they 
-# tell dnsmasq to filter out queries which the public DNS cannot
-# answer, and which load the servers (especially the root servers) 
-# uneccessarily. If you have a dial-on-demand link they also stop
-# these requests from bringing up the link uneccessarily.
-
-# Never forward plain names (with a dot or domain part)
-domain-needed
-# Never forward addresses in the non-routed address spaces.
-bogus-priv
-
-
-# Uncomment this to filter useless windows-originated DNS requests
-# which can trigger dial-on-demand links needlessly.
-# Note that (amongst other things) this blocks all SRV requests, 
-# so don't use it if you use eg Kerberos.
-#filterwin2k
-
-# Change this line if you want dns to get its upstream servers from
-# somewhere other that /etc/resolv.conf 
-#resolv-file=
-
-# By  default,  dnsmasq  will  send queries to any of the upstream
-# servers it knows about and tries to favour servers to are  known
-# to  be  up.  Uncommenting this forces dnsmasq to try each query
-# with  each  server  strictly  in  the  order  they   appear   in
-# /etc/resolv.conf
-#strict-order
-
-# If you don't want dnsmasq to read /etc/resolv.conf or any other
-# file, getting its servers for this file instead (see below), then
-# uncomment this
-#no-resolv
-
-# If you don't want dnsmasq to poll /etc/resolv.conf or other resolv
-# files for changes and re-read them then uncomment this.
-#no-poll
-
-# Add other name servers here, with domain specs if they are for 
-# non-public domains.
-#server=/localnet/192.168.0.1
-
-# Add local-only domains here, queries in these domains are answered
-# from /etc/hosts or DHCP only.
-#local=/localnet/
-
-# Add domains which you want to force to an IP address here.
-# The example below send any host in doubleclick.net to a local
-# webserver.
-#address=/doubleclick.net/127.0.0.1
-
-# You no longer (as of version 1.7) need to set these to enable 
-# dnsmasq to read /etc/ppp/resolv.conf since dnsmasq now uses the
-# "dip" group to achieve this.
-#user=
-#group=
-
-# If you want dnsmasq to listen for requests only on specified interfaces
-# (and the loopback) give the name of the interface (eg eth0) here. 
-# Repeat the line for more than one interface.
-#interface=
-# Or you can specify which interface _not_ to listen on
-#except-interface=
-# Or which to listen on by address (remember to include 127.0.0.1 if
-# you use this.)
-#listen-address=127.0.0.1
-
-# On systems which support it, dnsmasq binds the wildcard address,
-# even when it is listening on only some interfaces. It then discards
-# requests that it shouldn't reply to. This has the advantage of 
-# working even when interfaces come and go and change address. If you
-# want dnsmasq to really bind only the interfaces it is listening on,
-# uncomment this option. About the only time you may need this is when 
-# running another nameserver on the same machine.
-#bind-interfaces 
-
-# If you don't want dnsmasq to read /etc/hosts, uncomment the
-# following line.
-#no-hosts
-# or if you want it to read another file, as well as /etc/hosts, use
-# this.
-#addn-hosts=/etc/banner_add_hosts
-
-# Set this (and domain: see below) if you want to have a domain
-# automatically added to simple names in a hosts-file.
-#expand-hosts
-
-# Set the domain for dnsmasq. this is optional, but if it is set, it
-# does the following things.
-# 1) Allows DHCP hosts to have fully qualified domain names, as long
-#     as the domain part matches this setting.
-# 2) Sets the "domain" DHCP option thereby potentially setting the
-#    domain of all systems configured by DHCP
-# 3) Provides the domain part for "expand-hosts"
-#domain=thekelleys.org.uk
-  
-# Uncomment this to enable the integrated DHCP server, you need
-# to supply the range of addresses available for lease and optionally 
-# a lease time. If you have more than one network, you will need to
-# repeat this for each network on which you want to supply DHCP
-# service.
-#dhcp-range=192.168.0.50,192.168.0.150,12h
-#dhcp-range=10.0.0.10,10.0.0.200,2h
-
-# This is an example of a DHCP range where the netmask is given. This
-# is needed for networks we reach the dnsmasq DHCP server via a relay 
-# agent. If you don't know what a DHCP relay agent is, you probably
-# don't need to worry about this.
-#dhcp-range=192.168.0.50,192.168.0.150,255.255.255.0,12h
-
-# This is an example of a DHCP range with a network-id, so that
-# some DHCP options may be set only for this network.
-#dhcp-range=red,192.168.0.50,192.168.0.150
-
-# Supply parameters for specified hosts using DHCP. There are lots
-# of valid alternatives, so we will give examples of each. Note that
-# IP addresses DO NOT have to be in the range given above, they just
-# need to be on the same network. The order of the parameters in these
-# do not matter, it's permissble to give name,adddress and MAC in any order
-
-# Always allocate the host with ethernet address 11:22:33:44:55:66 
-# The IP address 192.168.0.60
-#dhcp-host=11:22:33:44:55:66,192.168.0.60
-
-# Always set the name of the host with hardware address
-# 11:22:33:44:55:66 to be "fred"
-#dhcp-host=11:22:33:44:55:66,fred
-
-# Always give the host with ethernet address 11:22:33:44:55:66
-# the name fred and IP address 192.168.0.60 and lease time 45 minutes
-#dhcp-host=11:22:33:44:55:66,fred,192.168.0.60,45m
-
-# Give the machine which says it's name is "bert" IP address
-# 192.168.0.70 and an infinite lease
-#dhcp-host=bert,192.168.0.70,infinite
-
-# Always give the host with client identifier 01:02:02:04 
-# the IP address 192.168.0.60
-#dhcp-host=id:01:02:02:04,192.168.0.60
-
-# Always give the host with client identifier "marjorie"
-# the IP address 192.168.0.60
-#dhcp-host=id:marjorie,192.168.0.60
-
-# Enable the address given for "judge" in /etc/hosts
-# to be given to a machine presenting the name "judge" when
-# it asks for a DHCP lease.
-#dhcp-host=judge
-
-# Never offer DHCP service to a machine whose ethernet 
-# address is 11:22:33:44:55:66
-#dhcp-host=11:22:33:44:55:66,ignore
-
-# Ignore any client-id presented by the machine with ethernet
-# address 11:22:33:44:55:66. This is useful to prevent a machine 
-# being treated differently when running under different OS's or
-# between PXE boot and OS boot.
-#dhcp-host=11:22:33:44:55:66,id:*
-
-# Send extra options which are tagged as "red" to 
-# the machine with ethernet address 11:22:33:44:55:66
-#dhcp-host=11:22:33:44:55:66,net:red
-
-# Send extra options which are tagged as "red" to any machine whose
-# DHCP vendorclass string includes the substring "Linux"
-#dhcp-vendorclass=red,Linux
-
-# Send extra options which are tagged as "red" to any machine one 
-# of whose DHCP userclass strings includes the substring "accounts"
-#dhcp-userclass=red,accounts
-
-# If this line is uncommented, dnsmasq will read /etc/ethers and act
-# on the ethernet-address/IP pairs found there just as if they had
-# been given as --dhcp-host options. Useful if you keep
-# MAC-address/host mappings there for other purposes.
-#read-ethers
-
-# Send options to hosts which ask for a DHCP lease.
-# See RFC 2132 for details of available options.
-# Note that all the common settings, such as netmask and
-# broadcast address, DNS server and default route, are given
-# sane defaults by dnsmasq. You very likely will not need any
-# any dhcp-options. If you use Windows clients and Samba, there
-# are some options which are recommended, they are detailed at the
-# end of this section.
-# For reference, the common options are:
-# subnet mask - 1
-# default router - 3
-# DNS server - 6
-# broadcast address - 28
-
-# Set the NTP time server addresses to 192.168.0.4 and 10.10.0.5
-#dhcp-option=42,192.168.0.4,10.10.0.5
-
-# Set the NTP time server address to be the same machine as 
-# is running dnsmasq
-#dhcp-option=42,0.0.0.0
-
-# Set the NIS domain name to "welly"
-#dhcp-option=40,welly
-
-# Set the default time-to-live to 50
-#dhcp-option=23,50
-
-# Set the "all subnets are local" flag
-#dhcp-option=27,1
-
-# Send the etherboot magic flag and then etherboot options (a string).
-#dhcp-option=128,e4:45:74:68:00:00
-#dhcp-option=129,NIC=eepro100
-
-# Specify an option which will only be sent to the "red" network 
-# (see dhcp-range for the declaration of the "red" network)
-#dhcp-option=red,42,192.168.1.1
-
-# The following DHCP options set up dnsmasq in the same way as is specified
-# for the ISC dhcpcd in 
-# http://www.samba.org/samba/ftp/docs/textdocs/DHCP-Server-Configuration.txt
-# adapted for a typical dnsmasq installation where the host running
-# dnsmasq is also the host running samba.
-# you may want to uncomment them if you use Windows clients and Samba.
-#dhcp-option=19,0           # option ip-forwarding off 
-#dhcp-option=44,0.0.0.0     # set netbios-over-TCP/IP nameserver(s) aka WINS server(s)
-#dhcp-option=45,0.0.0.0     # netbios datagram distribution server
-#dhcp-option=46,8           # netbios node type
-#dhcp-option=47             # empty netbios scope.
- 
-
-# Set the boot filename and tftpd server name and address
-# for BOOTP. You will only need this is you want to
-# boot machines over the network.
-#dhcp-boot=/var/ftpd/pxelinux.0,boothost,192.168.0.3
-
-# Set the limit on DHCP leases, the default is 150
-#dhcp-lease-max=150
-
-# The DHCP server needs somewhere on disk to keep its lease database.
-# This defaults to a sane location, but if you want to change it, use
-# the line below.
-#dhcp-leasefile=/var/lib/misc/dnsmasq.leases
-
-# Set the cachesize here.
-#cache-size=150
-
-# If you want to disable negative caching, uncomment this.
-#no-negcache
-
-# Normally responses which come form /etc/hosts and the DHCP lease
-# file have Time-To-Live set as zero, which conventionally means
-# do not cache further. If you are happy to trade lower load on the 
-# server for potentially stale date, you can set a time-to-live (in 
-# seconds) here.
-#local-ttl=
-
-# If you want dnsmasq to detect attempts by Verisign to send queries
-# to unregistered .com and .net hosts to its sitefinder service and
-# have dnsmasq instead return the correct NXDOMAIN response, uncomment
-# this line. You can add similar lines to do the same for other
-# registries which have implemented wildcard A records.
-#bogus-nxdomain=64.94.110.11
-
-# If you want to fix up DNS results from upstream servers, use the
-# alias option. This only works for IPv4.
-# This alias makes a result of 1.2.3.4 appear as 5.6.7.8
-#alias=1.2.3.4,5.6.7.8
-# and this maps 1.2.3.x to 5.6.7.x
-#alias=1.2.3.0,5.6.7.0,255.255.255.0
-
-# For debugging purposes, log each DNS query as it passes through
-# dnsmasq.
-#log-queries
-
-# Include a another lot of configuration options.
-#conf-file=/etc/dnsmasq.more.conf
- 
- 
-
-
-

meta-digi-dey/recipes-support/dnsmasq/files/dnsmasq.resolvconf

@@ -1,84 +0,0 @@
-#!/bin/sh
-#
-# Script to update the resolver list for dnsmasq
-#
-# N.B. Resolvconf may run us even if dnsmasq is not (yet) running.
-# If dnsmasq is installed then we go ahead and update the resolver list
-# in case dnsmasq is started later.
-#
-# Assumption: On entry, PWD contains the resolv.conf-type files.
-#
-# This file is part of the dnsmasq package.
-#
-
-set -e
-
-RUN_DIR="/run/dnsmasq"
-RSLVRLIST_FILE="${RUN_DIR}/resolv.conf"
-TMP_FILE="${RSLVRLIST_FILE}_new.$$"
-MY_NAME_FOR_RESOLVCONF="dnsmasq"
-
-[ -x /usr/bin/dnsmasq ] || exit 0
-[ -x /lib/resolvconf/list-records ] || exit 1
-
-PATH=/bin:/sbin
-
-report_err() { echo "$0: Error: $*" >&2 ; }
-
-# Stores arguments (minus duplicates) in RSLT, separated by spaces
-# Doesn't work properly if an argument itself contains whitespace
-uniquify()
-{
-	RSLT=""
-	while [ "$1" ] ; do
-		for E in $RSLT ; do
-			[ "$1" = "$E" ] && { shift ; continue 2 ; }
-		done
-		RSLT="${RSLT:+$RSLT }$1"
-		shift
-	done
-}
-
-if [ ! -d "$RUN_DIR" ] && ! mkdir --parents --mode=0755 "$RUN_DIR" ; then
-	report_err "Failed trying to create directory $RUN_DIR"
-	exit 1
-fi
-
-RSLVCNFFILES=""
-for F in $(/lib/resolvconf/list-records --after "lo.$MY_NAME_FOR_RESOLVCONF") ; do
-	case "$F" in
-	    "lo.$MY_NAME_FOR_RESOLVCONF")
-		# Omit own record
-		;;
-	    lo.*)
-		# Include no more records after one for a local nameserver
-		RSLVCNFFILES="${RSLVCNFFILES:+$RSLVCNFFILES }$F"
-		break
-		;;
-	  *)
-		RSLVCNFFILES="${RSLVCNFFILES:+$RSLVCNFFILES }$F"
-		;;
-	esac
-done
-
-NMSRVRS=""
-if [ "$RSLVCNFFILES" ] ; then
-	uniquify $(sed -n -e 's/^[[:space:]]*nameserver[[:space:]]\+//p' $RSLVCNFFILES)
-	NMSRVRS="$RSLT"
-fi
-
-# Dnsmasq uses the mtime of $RSLVRLIST_FILE, with a resolution of one second,
-# to detect changes in the file. This means that if a resolvconf update occurs
-# within one second of the previous one then dnsmasq may fail to notice the
-# more recent change. To work around this problem we sleep one second here
-# if necessary in order to ensure that the new mtime is different.
-if [ -f "$RSLVRLIST_FILE" ] && [ "$(stat -c %X "$RSLVRLIST_FILE")" = "$(date +%s)" ] ; then
-	sleep 1
-fi
-
-clean_up() { rm -f "$TMP_FILE" ; }
-trap clean_up EXIT
-: >| "$TMP_FILE"
-for N in $NMSRVRS ; do echo "nameserver $N" >> "$TMP_FILE" ; done
-mv -f "$TMP_FILE" "$RSLVRLIST_FILE"
-

meta-digi-dey/recipes-support/dnsmasq/files/init

@@ -1,117 +0,0 @@
-#!/bin/sh
-DAEMON=/usr/bin/dnsmasq
-NAME=dnsmasq
-DESC="DNS forwarder and DHCP server"
-ARGS="-7 /etc/dnsmasq.d"
-
-test -f $DAEMON || exit 0
-
-set -e
-
-if [ -r /etc/default/$NAME ]
-then
-	. /etc/default/$NAME
-fi
-
-DNSMASQ_CONF="/etc/dnsmasq.conf"
-test "/etc/dnsmasq.d/*" != '/etc/dnsmasq.d/*' && DNSMASQ_CONF="${DNSMASQ_CONF} /etc/dnsmasq.d/*"
-
-test -z "${PIDFILE}" && PIFILE="/run/dnsmasq.pid"
-
-if [ -z "$IGNORE_RESOLVCONF" ]
-then
-	egrep -h -q '^no-resolv' ${DNSMASQ_CONF} && IGNORE_RESOLVCONF="yes"
-fi
-
-# RESOLV_CONF:
-# If the resolvconf package is installed then use the resolv conf file
-# that it provides as the default.  Otherwise use /etc/resolv.conf as
-# the default.
-#
-# If IGNORE_RESOLVCONF is set in /etc/default/dnsmasq or an explicit
-# filename is set there then this inhibits the use of the resolvconf-provided
-# information.
-#
-# Note that if the resolvconf package is installed it is not possible to
-# override it just by configuration in /etc/dnsmasq.conf, it is necessary
-# to set IGNORE_RESOLVCONF=yes in /etc/default/dnsmasq.
-
-test -z "$RESOLV_CONF" -a "$IGNORE_RESOLVCONF" != "yes" -a -x /sbin/resolvconf && \
-	RESOLV_CONF=/run/dnsmasq/resolv.conf
-
-start_resolvconf()
-{
-        if [ "$IGNORE_RESOLVCONF" != "yes" -a -x /sbin/resolvconf ]
-	then
-		echo "nameserver 127.0.0.1" | /sbin/resolvconf -a lo.$NAME
-	fi
-	:
-}
-
-stop_resolvconf()
-{
-	if [ "$IGNORE_RESOLVCONF" != "yes" -a -x /sbin/resolvconf ]
-	then
-		/sbin/resolvconf -d lo.$NAME
-	fi
-	:
-}
-
-case "$1" in
-    start)
-        echo -n "starting $DESC: $NAME... "
-	test -d /var/lib/misc/ || mkdir /var/lib/misc/
-	start-stop-daemon -S -x $DAEMON -- $ARGS \
-		${RESOLV_CONF:+ -r $RESOLV_CONF} \
-		${PIDFILE:+ -x $PIDFILE}
-	test $? -eq 0 && start_resolvconf
-	echo "done."
-	;;
-    stop)
-        echo -n "stopping $DESC: $NAME... "
-	stop_resolvconf
-	start-stop-daemon -K -x $DAEMON
-	echo "done."
-	;;
-    status)
-	echo -n "dnsmasq "
-	start-stop-daemon -q -K -t -x $DAEMON
-	RET=$?
-	if [ "$RET" = "0" ]; then
-		PID=`cat ${PIDFILE}`
-		echo "($PID) is running"
-	else
-		echo "is not running"
-		exit $RET
-	fi
-	;;
-    restart)
-        echo "restarting $DESC: $NAME... "
- 	$0 stop
-	$0 start
-	echo "done."
-	;;
-    reload)
-    	echo -n "reloading $DESC: $NAME... "
-    	killall -HUP $(basename ${DAEMON})
-	echo "done."
-	;;
-    systemd-start-resolvconf)
-	start_resolvconf
-	;;
-    systemd-stop-resolvconf)
-	stop_resolvconf
-	;;
-    systemd-exec)
-	test -d /var/lib/misc/ || mkdir /var/lib/misc/
-	exec $DAEMON --keep-in-foreground $ARGS \
-		${RESOLV_CONF:+ -r $RESOLV_CONF} \
-		${PIDFILE:+ -x $PIDFILE}
-	;;
-    *)
-	echo "Usage: $0 {start|stop|status|restart|reload}"
-	exit 1
-	;;
-esac
-
-exit 0

sdk/build.sh

@@ -174,11 +174,11 @@ while read _pl _var _tgt; do
 	eval "${_pl//-/_}_var=\"${_var//,/ }\""
 	eval "${_pl//-/_}_tgt=\"${_tgt//,/ }\""
 done<<-_EOF_
-	ccimx8mn-dvk         DONTBUILDVARIANTS   dey-image-qt,dey-image-webkit,dey-image-aws
+	ccimx8mn-dvk         DONTBUILDVARIANTS   dey-image-qt,dey-image-aws
-	ccimx8x-sbc-pro      DONTBUILDVARIANTS   dey-image-qt,dey-image-webkit,dey-image-aws
+	ccimx8x-sbc-pro      DONTBUILDVARIANTS   dey-image-qt,dey-image-aws
-	ccimx8x-sbc-express  DONTBUILDVARIANTS   dey-image-qt,dey-image-webkit,dey-image-aws
+	ccimx8x-sbc-express  DONTBUILDVARIANTS   dey-image-qt,dey-image-aws
-	ccimx6qpsbc          DONTBUILDVARIANTS   dey-image-qt,dey-image-webkit,dey-image-aws
+	ccimx6qpsbc          DONTBUILDVARIANTS   dey-image-qt,dey-image-aws
-	ccimx6sbc            DONTBUILDVARIANTS   dey-image-qt,dey-image-webkit,dey-image-aws
+	ccimx6sbc            DONTBUILDVARIANTS   dey-image-qt,dey-image-aws
 	ccimx6ulsbc          DONTBUILDVARIANTS   dey-image-qt,dey-image-aws
 	ccimx6ulstarter      DONTBUILDVARIANTS   core-image-base,dey-image-aws
 	ccimx6ulsom          DONTBUILDVARIANTS   dey-image-mft-module-min