Merge branch 'dey-4.0/master' into dey-4.0/maint

Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
2024-01-19 11:41:58 +01:00 · 2024-01-19 11:41:58 +01:00 · 62fa660d05
parent b6c453a8c1 2ecaf1ca55
commit 62fa660d05
231 changed files with 4914 additions and 1252 deletions
--- a/README.md
+++ b/README.md
@ -1,5 +1,5 @@
 # Digi Embedded Yocto (DEY) 4.0
-## Release 4.0-r4
+## Release 4.0-r5

 This document provides information about Digi Embedded Yocto,
 Digi International's professional embedded Yocto development environment.
--- a/meta-digi-arm/classes/image_types_digi.bbclass
+++ b/meta-digi-arm/classes/image_types_digi.bbclass
@ -21,15 +21,18 @@ do_image_boot_vfat[depends] += " \
 IMAGE_CMD:boot.vfat() {
 	BOOTIMG_FILES="$(readlink -e ${DEPLOY_DIR_IMAGE}/${KERNEL_IMAGETYPE}-${MACHINE}.bin)"
 	BOOTIMG_FILES_SYMLINK="${DEPLOY_DIR_IMAGE}/${KERNEL_IMAGETYPE}-${MACHINE}.bin"
-	if [ -n "${KERNEL_DEVICETREE}" ]; then
-		for DTB in ${KERNEL_DEVICETREE}; do
-			# Remove potential sub-folders
-			DTB="$(basename ${DTB})"
-			if [ -e "${DEPLOY_DIR_IMAGE}/${DTB}" ]; then
-				BOOTIMG_FILES="${BOOTIMG_FILES} $(readlink -e ${DEPLOY_DIR_IMAGE}/${DTB})"
-				BOOTIMG_FILES_SYMLINK="${BOOTIMG_FILES_SYMLINK} ${DEPLOY_DIR_IMAGE}/${DTB}"
-			fi
-		done
+	# Exclude DTB and DTBO from VFAT image when creating a FIT image
+	if [ "${TRUSTFENCE_FIT_IMG}" != "1" ]; then
+		if [ -n "${KERNEL_DEVICETREE}" ]; then
+			for DTB in ${KERNEL_DEVICETREE}; do
+				# Remove potential sub-folders
+				DTB="$(basename ${DTB})"
+				if [ -e "${DEPLOY_DIR_IMAGE}/${DTB}" ]; then
+					BOOTIMG_FILES="${BOOTIMG_FILES} $(readlink -e ${DEPLOY_DIR_IMAGE}/${DTB})"
+					BOOTIMG_FILES_SYMLINK="${BOOTIMG_FILES_SYMLINK} ${DEPLOY_DIR_IMAGE}/${DTB}"
+				fi
+			done
+		fi
 	fi

 	# Add Trustfence initramfs if enabled
@ -57,12 +60,15 @@ IMAGE_CMD:boot.vfat() {
 	mkfs.vfat -n "Boot DEY" -S 512 -C ${IMGDEPLOYDIR}/${IMAGE_NAME}.boot.vfat ${BOOTIMG_BLOCKS}
 	mcopy -i ${IMGDEPLOYDIR}/${IMAGE_NAME}.boot.vfat ${BOOTIMG_FILES_SYMLINK} ::/

-	# Copy boot scripts into the VFAT image
-	for item in ${BOOT_SCRIPTS}; do
-		src=`echo $item | awk -F':' '{ print $1 }'`
-		dst=`echo $item | awk -F':' '{ print $2 }'`
-		mcopy -i ${IMGDEPLOYDIR}/${IMAGE_NAME}.boot.vfat -s ${DEPLOY_DIR_IMAGE}/$src ::/$dst
-	done
+	# Exclude boot scripts from VFAT image when creating a FIT image
+	if [ "${TRUSTFENCE_FIT_IMG}" != "1" ]; then
+		# Copy boot scripts into the VFAT image
+		for item in ${BOOT_SCRIPTS}; do
+			src=`echo $item | awk -F':' '{ print $1 }'`
+			dst=`echo $item | awk -F':' '{ print $2 }'`
+			mcopy -i ${IMGDEPLOYDIR}/${IMAGE_NAME}.boot.vfat -s ${DEPLOY_DIR_IMAGE}/$src ::/$dst
+		done
+	fi

 	# Truncate the image to speed up the downloading/writing to the EMMC
 	if [ -n "${BOARD_BOOTIMAGE_PARTITION_SIZE}" ]; then
@ -83,14 +89,17 @@ do_image_boot_ubifs[depends] += " \

 IMAGE_CMD:boot.ubifs() {
 	BOOTIMG_FILES_SYMLINK="${DEPLOY_DIR_IMAGE}/${KERNEL_IMAGETYPE}-${MACHINE}.bin"
-	if [ -n "${KERNEL_DEVICETREE}" ]; then
-		for DTB in ${KERNEL_DEVICETREE}; do
-			# Remove potential sub-folders
-			DTB="$(basename ${DTB})"
-			if [ -e "${DEPLOY_DIR_IMAGE}/${DTB}" ]; then
-				BOOTIMG_FILES_SYMLINK="${BOOTIMG_FILES_SYMLINK} ${DEPLOY_DIR_IMAGE}/${DTB}"
-			fi
-		done
+	# Exclude DTB and DTBO from UBIFS image when creating a FIT image
+	if [ "${TRUSTFENCE_FIT_IMG}" != "1" ]; then
+		if [ -n "${KERNEL_DEVICETREE}" ]; then
+			for DTB in ${KERNEL_DEVICETREE}; do
+				# Remove potential sub-folders
+				DTB="$(basename ${DTB})"
+				if [ -e "${DEPLOY_DIR_IMAGE}/${DTB}" ]; then
+					BOOTIMG_FILES_SYMLINK="${BOOTIMG_FILES_SYMLINK} ${DEPLOY_DIR_IMAGE}/${DTB}"
+				fi
+			done
+		fi
 	fi

 	# Add Trustfence initramfs if enabled
@ -107,12 +116,15 @@ IMAGE_CMD:boot.ubifs() {
 		ln ${orig} ${TMP_BOOTDIR}/$(basename ${item})
 	done

-	# Hard-link boot scripts into the temporary folder
-	for item in ${BOOT_SCRIPTS}; do
-		src="$(echo ${item} | awk -F':' '{ print $1 }')"
-		dst="$(echo ${item} | awk -F':' '{ print $2 }')"
-		ln ${DEPLOY_DIR_IMAGE}/${src} ${TMP_BOOTDIR}/${dst}
-	done
+	# Exclude boot scripts from UBIFS image when creating a FIT image
+	if [ "${TRUSTFENCE_FIT_IMG}" != "1" ]; then
+		# Hard-link boot scripts into the temporary folder
+		for item in ${BOOT_SCRIPTS}; do
+			src="$(echo ${item} | awk -F':' '{ print $1 }')"
+			dst="$(echo ${item} | awk -F':' '{ print $2 }')"
+			ln ${DEPLOY_DIR_IMAGE}/${src} ${TMP_BOOTDIR}/${dst}
+		done
+	fi

 	# Build UBIFS boot image out of temp folder
 	mkfs.ubifs -r ${TMP_BOOTDIR} -o ${IMGDEPLOYDIR}/${IMAGE_NAME}.boot.ubifs ${MKUBIFS_BOOT_ARGS}
@ -135,8 +147,11 @@ IMAGE_CMD:recovery.vfat() {
 	# Use 'boot.vfat' image as base
 	cp --remove-destination ${IMGDEPLOYDIR}/${IMAGE_NAME}.boot.vfat ${IMGDEPLOYDIR}/${IMAGE_NAME}.recovery.vfat

-	# Copy the recovery initramfs into the VFAT image
-	mcopy -i ${IMGDEPLOYDIR}/${IMAGE_NAME}.recovery.vfat -s ${DEPLOY_DIR_IMAGE}/${RECOVERY_INITRAMFS_IMAGE}-${MACHINE}.cpio.gz.u-boot.tf ::/uramdisk-recovery.img
+	# Exclude initRAMFS from VFAT image when creating a FIT image
+	if [ "${TRUSTFENCE_FIT_IMG}" != "1" ]; then
+		# Copy the recovery initramfs into the VFAT image
+		mcopy -i ${IMGDEPLOYDIR}/${IMAGE_NAME}.recovery.vfat -s ${DEPLOY_DIR_IMAGE}/${RECOVERY_INITRAMFS_IMAGE}-${MACHINE}.cpio.gz.u-boot.tf ::/uramdisk-recovery.img
+	fi
 }

 # Remove the default ".rootfs." suffix for 'recovery.vfat' images
@ -153,14 +168,17 @@ do_image_recovery_ubifs[depends] += " \

 IMAGE_CMD:recovery.ubifs() {
 	RECOVERYIMG_FILES_SYMLINK="${DEPLOY_DIR_IMAGE}/${KERNEL_IMAGETYPE}-${MACHINE}.bin"
-	if [ -n "${KERNEL_DEVICETREE}" ]; then
-		for DTB in ${KERNEL_DEVICETREE}; do
-			# Remove potential sub-folders
-			DTB="$(basename ${DTB})"
-			if [ -e "${DEPLOY_DIR_IMAGE}/${DTB}" ]; then
-				RECOVERYIMG_FILES_SYMLINK="${RECOVERYIMG_FILES_SYMLINK} ${DEPLOY_DIR_IMAGE}/${DTB}"
-			fi
-		done
+	# Exclude DTB and DTBO from VFAT image when creating a FIT image
+	if [ "${TRUSTFENCE_FIT_IMG}" != "1" ]; then
+		if [ -n "${KERNEL_DEVICETREE}" ]; then
+			for DTB in ${KERNEL_DEVICETREE}; do
+				# Remove potential sub-folders
+				DTB="$(basename ${DTB})"
+				if [ -e "${DEPLOY_DIR_IMAGE}/${DTB}" ]; then
+					RECOVERYIMG_FILES_SYMLINK="${RECOVERYIMG_FILES_SYMLINK} ${DEPLOY_DIR_IMAGE}/${DTB}"
+				fi
+			done
+		fi
 	fi

 	# Create temporary folder
@ -172,18 +190,21 @@ IMAGE_CMD:recovery.ubifs() {
 		ln ${orig} ${TMP_RECOVERYDIR}/$(basename ${item})
 	done

-	# Hard-link boot scripts into the temporary folder
-	for item in ${BOOT_SCRIPTS}; do
-		src="$(echo ${item} | awk -F':' '{ print $1 }')"
-		dst="$(echo ${item} | awk -F':' '{ print $2 }')"
-		ln ${DEPLOY_DIR_IMAGE}/${src} ${TMP_RECOVERYDIR}/${dst}
-	done
+	# Exclude bootscript from VFAT image when creating a FIT image
+	if [ "${TRUSTFENCE_FIT_IMG}" != "1" ]; then
+		# Hard-link boot scripts into the temporary folder
+		for item in ${BOOT_SCRIPTS}; do
+			src="$(echo ${item} | awk -F':' '{ print $1 }')"
+			dst="$(echo ${item} | awk -F':' '{ print $2 }')"
+			ln ${DEPLOY_DIR_IMAGE}/${src} ${TMP_RECOVERYDIR}/${dst}
+		done

-	# Copy the recovery initramfs into the temporary folder
-	cp ${DEPLOY_DIR_IMAGE}/${RECOVERY_INITRAMFS_IMAGE}-${MACHINE}.cpio.gz.u-boot.tf ${TMP_RECOVERYDIR}/uramdisk-recovery.img
+		# Copy the recovery initramfs into the temporary folder
+		cp ${DEPLOY_DIR_IMAGE}/${RECOVERY_INITRAMFS_IMAGE}-${MACHINE}.cpio.gz.u-boot.tf ${TMP_RECOVERYDIR}/uramdisk-recovery.img
+	fi

 	# Build UBIFS recovery image out of temp folder
-	mkfs.ubifs -r ${TMP_RECOVERYDIR} -o ${IMGDEPLOYDIR}/${IMAGE_NAME}.recovery.ubifs ${MKUBIFS_BOOT_ARGS}
+	mkfs.ubifs -r ${TMP_RECOVERYDIR} -o ${IMGDEPLOYDIR}/${IMAGE_NAME}.recovery.ubifs ${MKUBIFS_RECOVERY_ARGS}

 	# Remove the temporary folder
 	rm -rf ${TMP_RECOVERYDIR}
@ -200,21 +221,13 @@ trustence_sign_cpio() {
 	# Image generation code for image type 'cpio.gz.u-boot.tf'
 	# (signed/encrypted ramdisk)
 	#
-	if [ "${TRUSTFENCE_SIGN}" = "1" ]; then
+	if [ "${TRUSTFENCE_SIGN_ARTIFACTS}" = "1" ]; then
 		# Set environment variables for trustfence configuration
 		export CONFIG_SIGN_KEYS_PATH="${TRUSTFENCE_SIGN_KEYS_PATH}"
 		[ -n "${TRUSTFENCE_KEY_INDEX}" ] && export CONFIG_KEY_INDEX="${TRUSTFENCE_KEY_INDEX}"
 		[ -n "${TRUSTFENCE_DEK_PATH}" ] && [ "${TRUSTFENCE_DEK_PATH}" != "0" ] && export CONFIG_DEK_PATH="${TRUSTFENCE_DEK_PATH}"
-
 		# Sign/encrypt the ramdisk
-		if [ "${DEY_SOC_VENDOR}" = "NXP" ]; then
-			trustfence-sign-artifact.sh -p "${DIGI_SOM}" -i "${1}" "${1}.tf"
-		elif [ "${DEY_SOC_VENDOR}" = "STM" ]; then
-			# TODO: sign the ramdisk for ST platforms
-
-			# (fall-back) Copy the image with no changes
-			cp "${1}" "${1}.tf"
-		fi
+		trustfence-sign-artifact.sh -p "${DIGI_SOM}" -i "${1}" "${1}.tf"
 	else
 		# Copy the image with no changes
 		cp "${1}" "${1}.tf"
@ -228,22 +241,18 @@ IMAGE_TYPES += "cpio.gz.u-boot.tf"
 #
 # Sign read-only rootfs
 #
-do_image_squashfs[postfuncs] += "${@oe.utils.conditional('TRUSTFENCE_SIGN', '1', 'rootfs_sign', '', d)}"
-
+do_image_squashfs[postfuncs] += "${@oe.utils.vartrue('TRUSTFENCE_SIGN_ARTIFACTS', 'rootfs_sign', '', d)}"
 rootfs_sign() {
 	# Set environment variables for trustfence configuration
 	export CONFIG_SIGN_KEYS_PATH="${TRUSTFENCE_SIGN_KEYS_PATH}"
 	[ -n "${CONFIG_KEY_INDEX}" ] && export CONFIG_KEY_INDEX="${TRUSTFENCE_KEY_INDEX}"

-	if [ "${DEY_SOC_VENDOR}" = "NXP" ]; then
-		ROOTFS_IMAGE="${IMGDEPLOYDIR}/${IMAGE_NAME}.rootfs.squashfs"
-		TMP_ROOTFS_IMAGE_SIGNED="$(mktemp ${ROOTFS_IMAGE}-signed.XXXXXX)"
-		# Sign rootfs read-only image
-		trustfence-sign-artifact.sh -p "${DIGI_SOM}" -r "${ROOTFS_IMAGE}" "${TMP_ROOTFS_IMAGE_SIGNED}"
-		mv "${TMP_ROOTFS_IMAGE_SIGNED}" "${ROOTFS_IMAGE}"
-	fi
+	ROOTFS_IMAGE="${IMGDEPLOYDIR}/${IMAGE_NAME}.rootfs.squashfs"
+	TMP_ROOTFS_IMAGE_SIGNED="$(mktemp ${ROOTFS_IMAGE}-signed.XXXXXX)"
+	# Sign rootfs read-only image
+	trustfence-sign-artifact.sh -p "${DIGI_SOM}" -r "${ROOTFS_IMAGE}" "${TMP_ROOTFS_IMAGE_SIGNED}"
+	mv "${TMP_ROOTFS_IMAGE_SIGNED}" "${ROOTFS_IMAGE}"
 }
-
 rootfs_sign[dirs] = "${DEPLOY_DIR_IMAGE}"

 do_image_squashfs[vardeps] += "TRUSTFENCE_SIGN_KEYS_PATH TRUSTFENCE_KEY_INDEX"
--- a/meta-digi-arm/conf/layer.conf
+++ b/meta-digi-arm/conf/layer.conf
@ -28,9 +28,13 @@ LAYERSERIES_COMPAT_digi-arm = "kirkstone"
 # See fsl-eula-unpack.bbclass.
 FSL_EULA_FILE_MD5SUM_LA_OPT_NXP_SOFTWARE_LICENSE_V42 = "ea25d099982d035af85d193c88a1b479"
 FSL_EULA_FILE_MD5SUM_LA_OPT_NXP_SOFTWARE_LICENSE_V45 = "63a38e9f392d8813d6f1f4d0d6fbe657"
+FSL_EULA_FILE_MD5SUM_LA_OPT_NXP_SOFTWARE_LICENSE_V48 = "db4762b09b6bda63da103963e6e081de"
+FSL_EULA_FILE_MD5SUM_LA_OPT_NXP_SOFTWARE_LICENSE_V49 = "2827219e81f28aba7c6a569f7c437fa7"
 FSL_EULA_FILE_MD5SUMS:append = " \
    ${FSL_EULA_FILE_MD5SUM_LA_OPT_NXP_SOFTWARE_LICENSE_V42} \
    ${FSL_EULA_FILE_MD5SUM_LA_OPT_NXP_SOFTWARE_LICENSE_V45} \
+    ${FSL_EULA_FILE_MD5SUM_LA_OPT_NXP_SOFTWARE_LICENSE_V48} \
+    ${FSL_EULA_FILE_MD5SUM_LA_OPT_NXP_SOFTWARE_LICENSE_V49} \
 "

 # STM EULA
@ -43,6 +47,7 @@ BBMASK += " \
    meta-st-stm32mp/recipes-core/base-files/base-files_%.bbappend \
    meta-st-stm32mp/recipes-core/busybox/busybox_%.bbappend \
    meta-st-stm32mp/recipes-core/systemd/systemd-conf_%.bbappend \
+    meta-st-stm32mp/recipes-kernel/linux/linux-stm32mp_5.15.bb \
 "

 # Tweak stm32mpu-ai dependencies to use ST's machine learning packages
--- a/meta-digi-arm/conf/machine/ccimx6qpsbc.conf
+++ b/meta-digi-arm/conf/machine/ccimx6qpsbc.conf
@ -26,8 +26,6 @@ UBOOT_CONFIG ??= "ccimx6qpsbc1GB ccimx6qpsbc2GB"
 UBOOT_CONFIG[ccimx6qpsbc1GB] = "ccimx6qpsbc1GB_defconfig,,u-boot-dtb.${UBOOT_SUFFIX}"
 UBOOT_CONFIG[ccimx6qpsbc2GB] = "ccimx6qpsbc2GB_defconfig,,u-boot-dtb.${UBOOT_SUFFIX}"

-BOOTLOADER_SEEK_BOOT = "1"
-
 KERNEL_DEVICETREE ?= " \
    imx6qp-ccimx6qpsbc.dtb \
    imx6qp-ccimx6qpsbc-id160.dtb \
@ -59,4 +57,4 @@ BOOTABLE_ARTIFACTS = " \
 # Default overlayfs_etc mount point and type
 OVERLAYFS_ETC_MOUNT_POINT ?= "/mnt/data"
 OVERLAYFS_ETC_DEVICE ?= "/dev/mmcblk0p7"
-OVERLAYFS_ETC_FSTYPE ?= "ext4"
+OVERLAYFS_ETC_FSTYPE ?= "ext4"
--- a/meta-digi-arm/conf/machine/ccimx6sbc.conf
+++ b/meta-digi-arm/conf/machine/ccimx6sbc.conf
@ -24,8 +24,6 @@ UBOOT_CONFIG[ccimx6qsbc2GB] = "ccimx6qsbc2GB_defconfig,,u-boot-dtb.${UBOOT_SUFFI
 UBOOT_CONFIG[ccimx6qsbc512MB] = "ccimx6qsbc512MB_defconfig,,u-boot-dtb.${UBOOT_SUFFIX}"
 UBOOT_CONFIG[ccimx6qsbc] = "ccimx6qsbc_defconfig,,u-boot-dtb.${UBOOT_SUFFIX}"

-BOOTLOADER_SEEK_BOOT = "1"
-
 KERNEL_DEVICETREE ?= " \
    imx6dl-ccimx6sbc.dtb \
    imx6dl-ccimx6sbc-w.dtb \
@ -64,4 +62,4 @@ BOOTABLE_ARTIFACTS = " \
 # Default overlayfs_etc mount point and type
 OVERLAYFS_ETC_MOUNT_POINT ?= "/mnt/data"
 OVERLAYFS_ETC_DEVICE ?= "/dev/mmcblk0p7"
-OVERLAYFS_ETC_FSTYPE ?= "ext4"
+OVERLAYFS_ETC_FSTYPE ?= "ext4"
--- a/meta-digi-arm/conf/machine/ccimx8mm-dvk.conf
+++ b/meta-digi-arm/conf/machine/ccimx8mm-dvk.conf
@ -9,7 +9,7 @@ MACHINEOVERRIDES =. "mx8:mx8m:mx8mm:${DIGI_FAMILY}:${DIGI_SOM}:"
 include conf/machine/include/ccimx8m.inc

 BOOTLOADER_SEEK_USERDATA = "33"
-BOOTLOADER_SEEK_BOOT = "0"
+BOOTLOADER_SEEK_BOOTPART = "33"

 # U-Boot configurations
 #
@ -33,6 +33,7 @@ KERNEL_DEVICETREE ?= " \
    digi/_ov_board_lvds_ccimx8m-dvk.dtbo \
    digi/_ov_board_user-leds_ccimx8m-dvk.dtbo \
    digi/_ov_som_bt_ccimx8m.dtbo \
+    digi/_ov_som_cm4_ccimx8mm.dtbo \
    digi/_ov_som_mca-keypad_ccimx8m.dtbo \
    digi/_ov_som_wifi_ccimx8m.dtbo \
 "
@ -58,4 +59,4 @@ BOOTABLE_ARTIFACTS = "imx-boot-ccimx8mm-dvk.bin"
 # Default overlayfs_etc mount point and type
 OVERLAYFS_ETC_MOUNT_POINT ?= "/mnt/data"
 OVERLAYFS_ETC_DEVICE ?= "/dev/mmcblk0p7"
-OVERLAYFS_ETC_FSTYPE ?= "ext4"
+OVERLAYFS_ETC_FSTYPE ?= "ext4"
--- a/meta-digi-arm/conf/machine/ccimx8mn-dvk.conf
+++ b/meta-digi-arm/conf/machine/ccimx8mn-dvk.conf
@ -9,7 +9,6 @@ MACHINEOVERRIDES =. "mx8:mx8m:mx8mn:${DIGI_FAMILY}:${DIGI_SOM}:"
 include conf/machine/include/ccimx8m.inc

 BOOTLOADER_SEEK_USERDATA = "32"
-BOOTLOADER_SEEK_BOOT = "0"

 # U-Boot configurations
 #
@ -34,6 +33,7 @@ KERNEL_DEVICETREE ?= " \
    digi/_ov_board_user-leds_ccimx8m-dvk.dtbo \
    digi/_ov_board_v1-v2_ccimx8mn-dvk.dtbo \
    digi/_ov_som_bt_ccimx8m.dtbo \
+    digi/_ov_som_cm7_ccimx8mn.dtbo \
    digi/_ov_som_mca-keypad_ccimx8m.dtbo \
    digi/_ov_som_v1_ccimx8mn.dtbo \
    digi/_ov_som_wifi_ccimx8m.dtbo \
@ -60,4 +60,4 @@ BOOTABLE_ARTIFACTS = "imx-boot-ccimx8mn-dvk.bin"
 # Default overlayfs_etc mount point and type
 OVERLAYFS_ETC_MOUNT_POINT ?= "/mnt/data"
 OVERLAYFS_ETC_DEVICE ?= "/dev/mmcblk0p7"
-OVERLAYFS_ETC_FSTYPE ?= "ext4"
+OVERLAYFS_ETC_FSTYPE ?= "ext4"
--- a/meta-digi-arm/conf/machine/ccimx8x-sbc-pro.conf
+++ b/meta-digi-arm/conf/machine/ccimx8x-sbc-pro.conf
@ -26,6 +26,7 @@ KERNEL_DEVICETREE ?= " \
    digi/_ov_board_user-leds_ccimx8x-sbc-pro.dtbo \
    digi/_ov_board_v1-v3_ccimx8x-sbc-pro.dtbo \
    digi/_ov_som_bt_ccimx8x.dtbo \
+    digi/_ov_som_cm4_ccimx8x.dtbo \
    digi/_ov_som_mca-keypad_ccimx8x.dtbo \
    digi/_ov_som_quad_ccimx8x.dtbo \
    digi/_ov_som_wifi_ccimx8x.dtbo \
--- a/meta-digi-arm/conf/machine/ccimx93-dvk.conf
+++ b/meta-digi-arm/conf/machine/ccimx93-dvk.conf
@ -13,7 +13,6 @@ UBOOT_CONFIG[ccimx93-dvk] = "ccimx93-dvk_defconfig"
 UBOOT_DTB_NAME = "ccimx93-dvk.dtb"

 BOOTLOADER_SEEK_USERDATA = "32"
-BOOTLOADER_SEEK_BOOT = "0"

 KERNEL_DEVICETREE ?= " \
    digi/ccimx93-dvk.dtb \
@ -23,7 +22,6 @@ KERNEL_DEVICETREE ?= " \
    digi/_ov_board_mikroe-accel2-click_ccimx93-dvk.dtbo \
    digi/_ov_board_mikroe-gyro-click_ccimx93-dvk.dtbo \
    digi/_ov_som_bt_ccimx93.dtbo \
-    digi/_ov_som_mca_ccimx93.dtbo \
    digi/_ov_som_npu_ccimx93.dtbo \
    digi/_ov_som_wifi_ccimx93.dtbo \
 "
@ -55,7 +53,10 @@ IMAGE_FSTYPES ?= '${@bb.utils.contains("IMAGE_FEATURES", "read-only-rootfs", \
 				       "boot.vfat recovery.vfat ext4.gz tar.bz2 sdcard.gz", d)}'

 # Boot artifacts to be copied from the deploy dir to the installer ZIP
-BOOTABLE_ARTIFACTS = "imx-boot-ccimx93-dvk.bin"
+BOOTABLE_ARTIFACTS = " \
+    imx-boot-ccimx93-dvk.bin \
+    imx-boot-ccimx93-dvk-A0.bin \
+"

 # Default overlayfs_etc mount point and type
 OVERLAYFS_ETC_MOUNT_POINT ?= "/mnt/data"
--- a/meta-digi-arm/conf/machine/ccmp13-dvk.conf
+++ b/meta-digi-arm/conf/machine/ccmp13-dvk.conf
@ -43,10 +43,13 @@ STM32MP_KERNEL_DEVICETREE:ccmp13-dvk += " \
    _ov_board_mikroe-gyro-click_ccmp13-dvk.dtbo \
    _ov_board_mikroe-i2c-to-spi-click_ccmp13-dvk.dtbo \
    _ov_board_pwm8_ccmp13-dvk.dtbo \
+    _ov_board_v2_ccmp13-dvk.dtbo \
    _ov_som_bt_ccmp13.dtbo \
    _ov_som_bt_test_ccmp13.dtbo \
    _ov_som_wifi_ccmp13.dtbo \
 "
+# Set DTB load address to U-Boot fdt_addr_r
+UBOOT_DTB_LOADADDRESS = "${@bb.utils.contains('TRUSTFENCE_FIT_IMG', '1', '0xc4000000', '', d)}"

 # =========================================================================
 # Machine features
@ -106,11 +109,10 @@ OPTEE_CONF = "ccmp13-dvk"
 # =========================================================================
 # Kernel
 # =========================================================================
-KERNEL_IMAGETYPE = "zImage"
-KERNEL_ALT_IMAGETYPE = "Image uImage vmlinux"
-KERNEL_DEFCONFIG ?= "ccmp1_defconfig"
-KERNEL_EXTERNAL_DEFCONFIG ?= "defconfig"
-ST_KERNEL_LOADADDR ?= "0xC0008000"
+KERNEL_IMAGETYPE = "${@bb.utils.contains('TRUSTFENCE_FIT_IMG', '1', 'fitImage', 'zImage', d)}"
+KERNEL_CLASSES = "${@bb.utils.contains('TRUSTFENCE_FIT_IMG', '1', 'kernel-fitimage', 'kernel-uimage', d)}"
+KERNEL_ALT_IMAGETYPE = "Image vmlinux"
+KERNEL_DEFCONFIG ?= "arch/arm/configs/ccmp1_defconfig"

 # =========================================================================
 # DEY settings
@ -121,6 +123,10 @@ IMAGE_CLASSES = "image_types_digi image_types-stubi"
 # Max LEB count (-c 255) calculated for a partition of up to 32 MiB considering 128 KiB erase-block size.
 MKUBIFS_BOOT_ARGS ?= "-m 2048 -e 126976 -c 255"

+# mkfs.ubifs parameters for recovery partition
+# Same parameters as the boot partition, but using zlib compression to reduce image size.
+MKUBIFS_RECOVERY_ARGS ?= "${MKUBIFS_BOOT_ARGS} -x zlib"
+
 # mkfs.ubifs parameters for rootfs partition
 # Max LEB count (-c 8191) calculated for a partition of up to 1 GiB considering 128 KiB erase-block size.
 MKUBIFS_ARGS ?= "-m 2048 -e 126976 -c 8191"
--- a/meta-digi-arm/conf/machine/ccmp15-dvk.conf
+++ b/meta-digi-arm/conf/machine/ccmp15-dvk.conf
@ -49,11 +49,14 @@ STM32MP_KERNEL_DEVICETREE:ccmp15-dvk += " \
    _ov_board_mikroe-gyro-click_ccmp15-dvk.dtbo \
    _ov_board_mikroe-i2c-to-spi-click_ccmp15-dvk.dtbo \
    _ov_board_v1_ccmp15-dvk.dtbo \
+    _ov_board_v2_ccmp15-dvk.dtbo \
    _ov_som_bt_ccmp15.dtbo \
    _ov_som_bt_test_ccmp15.dtbo \
-    _ov_som_mca_ccmp15.dtbo \
+    _ov_som_m4_ccmp15.dtbo \
    _ov_som_wifi_ccmp15.dtbo \
 "
+# Set DTB load address to U-Boot fdt_addr_r
+UBOOT_DTB_LOADADDRESS = "${@bb.utils.contains('TRUSTFENCE_FIT_IMG', '1', '0xc4000000', '', d)}"

 # =========================================================================
 # Machine features
@ -114,11 +117,10 @@ OPTEE_CONF = "ccmp15-dvk"
 # =========================================================================
 # Kernel
 # =========================================================================
-KERNEL_IMAGETYPE = "zImage"
-KERNEL_ALT_IMAGETYPE = "Image uImage vmlinux"
-KERNEL_DEFCONFIG ?= "ccmp1_defconfig"
-KERNEL_EXTERNAL_DEFCONFIG ?= "defconfig"
-ST_KERNEL_LOADADDR ?= "0xC0008000"
+KERNEL_IMAGETYPE = "${@bb.utils.contains('TRUSTFENCE_FIT_IMG', '1', 'fitImage', 'zImage', d)}"
+KERNEL_CLASSES = "${@bb.utils.contains('TRUSTFENCE_FIT_IMG', '1', 'kernel-fitimage', 'kernel-uimage', d)}"
+KERNEL_ALT_IMAGETYPE = "Image vmlinux"
+KERNEL_DEFCONFIG ?= "arch/arm/configs/ccmp1_defconfig"

 # =========================================================================
 # DEY settings
@ -129,6 +131,10 @@ IMAGE_CLASSES = "image_types_digi image_types-stubi"
 # Max LEB count (-c 255) calculated for a partition of up to 32 MiB considering 128 KiB erase-block size.
 MKUBIFS_BOOT_ARGS ?= "-m 2048 -e 126976 -c 255"

+# mkfs.ubifs parameters for recovery partition
+# Same parameters as the boot partition, but using zlib compression to reduce image size.
+MKUBIFS_RECOVERY_ARGS ?= "${MKUBIFS_BOOT_ARGS} -x zlib"
+
 # mkfs.ubifs parameters for rootfs partition
 # Max LEB count (-c 8191) calculated for a partition of up to 1 GiB considering 128 KiB erase-block size.
 MKUBIFS_ARGS ?= "-m 2048 -e 126976 -c 8191"
--- a/meta-digi-arm/conf/machine/include/ccimx6.inc
+++ b/meta-digi-arm/conf/machine/include/ccimx6.inc
@ -8,6 +8,8 @@ MACHINEOVERRIDES =. "mx6:mx6dl:mx6q:${DIGI_FAMILY}:${DIGI_SOM}:"
 include conf/machine/include/imx-digi-base.inc
 include conf/machine/include/arm/armv7a/tune-cortexa9.inc

+BOOTLOADER_SEEK_BOOTPART = "1"
+
 # Platform u-boot settings
 UBOOT_PREFIX = "u-boot"
 UBOOT_SUFFIX = "imx"
--- a/meta-digi-arm/conf/machine/include/ccimx6ul.inc
+++ b/meta-digi-arm/conf/machine/include/ccimx6ul.inc
@ -41,6 +41,10 @@ MACHINE_FEATURES:remove:use-mainline-bsp = "wifi"
 # Max LEB count (-c 255) calculated for a partition of up to 32 MiB considering 128 KiB erase-block size.
 MKUBIFS_BOOT_ARGS ?= "-m 2048 -e 126976 -c 255"

+# mkfs.ubifs parameters for recovery partition
+# Same parameters as the boot partition, but using zlib compression to reduce image size.
+MKUBIFS_RECOVERY_ARGS ?= "${MKUBIFS_BOOT_ARGS} -x zlib"
+
 # mkfs.ubifs parameters for rootfs partition
 # Max LEB count (-c 8191) calculated for a partition of up to 1 GiB considering 128 KiB erase-block size.
 MKUBIFS_ARGS ?= "-m 2048 -e 126976 -c 8191"
@ -69,3 +73,7 @@ UBOOT_ENV_SIZE ?= "0x20000"
 # the U-Boot environment can take up (if undefined, it will take up all the
 # available space in the environment partition)
 UBOOT_ENV_RANGE ?= ""
+
+# Partitions to blacklist for swupdate:
+# bootloader, environment, safe
+SWUPDATE_MTD_BLACKLIST = "0 1 2"
--- a/meta-digi-arm/conf/machine/include/ccimx8x.inc
+++ b/meta-digi-arm/conf/machine/include/ccimx8x.inc
@ -18,8 +18,6 @@ EXTRA_IMAGEDEPENDS += "imx-boot"
 BOOTLOADER_IMAGE_RECIPE = "imx-boot"
 # BOOTLOADER_SEEK_USERDATA is 33 for step A of the silicon and 32 for step B
 BOOTLOADER_SEEK_USERDATA = "32"
-# BOOTLOADER_SEEK_BOOT is 32 for step B of silicon and 0 for step C
-BOOTLOADER_SEEK_BOOT ?= "0"
 BOOTABLE_FILENAME = "${UBOOT_PREFIX}-${MACHINE}.bin"
 SDIMG_BOOTLOADER = "${DEPLOY_DIR_IMAGE}/${BOOTABLE_FILENAME}"

--- a/meta-digi-arm/conf/machine/include/ccimx93.inc
+++ b/meta-digi-arm/conf/machine/include/ccimx93.inc
@ -17,6 +17,10 @@ BOOTLOADER_IMAGE_RECIPE = "imx-boot"
 BOOTABLE_FILENAME = "${UBOOT_PREFIX}-${MACHINE}.bin"
 SDIMG_BOOTLOADER = "${DEPLOY_DIR_IMAGE}/${BOOTABLE_FILENAME}"

+# Generate images for all SOC revisions (keep the override as otherwise the
+# one in "use-imx-security-controller-firmware.bbclass" takes precedence)
+SECO_FIRMWARE_NAME:ccimx93 = "mx93??-ahab-container.img"
+
 DDR_FIRMWARE_NAME = " \
    lpddr4_dmem_1d_v202201.bin \
    lpddr4_dmem_2d_v202201.bin \
@ -48,7 +52,7 @@ MACHINE_EXTRA_RDEPENDS += " \
 # TrustFence
 TRUSTFENCE_SIGN_MODE = "AHAB"

-IMXBOOT_TARGETS = "flash_singleboot"
+IMXBOOT_TARGETS = "flash_singleboot flash_singleboot_a0"

 IMX_BOOT_SOC_TARGET = "iMX9"
 IMX_BOOT_SEEK = "32"
@ -72,3 +76,17 @@ BOOT_DEV_NAME ?= "/dev/mmcblk0p1"
 ROOTFS_DEV_NAME ?= "/dev/mmcblk0p3"
 ROOTFS_ENC_DEV = "/dev/mapper/cryptrootfs"
 ROOTFS_DEV_NAME_FINAL = "${@oe.utils.ifelse(d.getVar('TRUSTFENCE_ENCRYPT_ROOTFS') == '1', '${ROOTFS_ENC_DEV}', '${ROOTFS_DEV_NAME}')}"
+
+PREFERRED_VERSION_gstreamer1.0:ccimx93              ?= "1.22.5.imx"
+PREFERRED_VERSION_gstreamer1.0-plugins-bad:ccimx93  ?= "1.22.5.imx"
+PREFERRED_VERSION_gstreamer1.0-plugins-base:ccimx93 ?= "1.22.5.imx"
+PREFERRED_VERSION_gstreamer1.0-plugins-good:ccimx93 ?= "1.22.5.imx"
+PREFERRED_VERSION_gstreamer1.0-plugins-ugly:ccimx93 ?= "1.22.6"
+
+PREFERRED_VERSION_libdrm:ccimx93            ?= "2.4.115.imx"
+PREFERRED_VERSION_nativesdk-wayland:ccimx93 ?= "1.22.0.imx"
+PREFERRED_VERSION_wayland:ccimx93           ?= "1.22.0.imx"
+PREFERRED_VERSION_wayland-native:ccimx93    ?= "1.22.0.imx"
+PREFERRED_VERSION_wayland-protocols:ccimx93 ?= "1.32.imx"
+PREFERRED_VERSION_weston:ccimx93            ?= "11.0.3.imx"
+PREFERRED_VERSION_xwayland:ccimx93          ?= "23.1.1.imx"
--- a/meta-digi-arm/conf/machine/include/ccmp1.inc
+++ b/meta-digi-arm/conf/machine/include/ccmp1.inc
@ -8,11 +8,15 @@ include conf/machine/include/digi-defaults.inc

 DIGI_FAMILY = "ccmp1"

+# Platform T-FA settings
+TFA_SIGN_SUFFIX ?= "${@bb.utils.contains('TRUSTFENCE_SIGN', '1', '_signed', '', d)}"
+
 # Platform u-boot settings
-UBOOT_PREFIX = "u-boot"
+UBOOT_PREFIX = "fip"
 UBOOT_SUFFIX = "bin"
 # Set U-Boot FIP settings
 FIP_UBOOT_DTB = "u-boot"
+FIP_SIGN_SUFFIX ?= "${@bb.utils.contains('TRUSTFENCE_SIGN', '1', '_Signed', '', d)}"

 STORAGE_MEDIA = "mtd"

@ -41,6 +45,7 @@ UBOOT_ENV_RANGE ?= ""
 MACHINE_EXTRA_RDEPENDS += " \
    mtd-utils-ubifs \
 "
+MACHINE_EXTRA_RRECOMMENDS:remove = "kernel-imagebootfs"

 # Image FS types
 IMAGE_FSTYPES:remove = "ext4 tar.xz"
@ -72,3 +77,10 @@ TRUSTFENCE_CONSOLE_DISABLE ?= "0"

 # Disable the generation of flashlayout files
 do_create_flashlayout_config[noexec] = "1"
+
+# Include boot script into the FIT image
+UBOOT_ENV = "${@bb.utils.contains('TRUSTFENCE_FIT_IMG', '1', 'boot', '', d)}"
+
+# Partitions to blacklist for swupdate:
+# fsbl1, fsbl2, metadata1, metadata2, fip-a, fip-b
+SWUPDATE_MTD_BLACKLIST = "0 1 2 3 4 5"
--- a/meta-digi-arm/conf/machine/include/digi-defaults.inc
+++ b/meta-digi-arm/conf/machine/include/digi-defaults.inc
@ -78,7 +78,7 @@ MACHINE_EXTRA_RRECOMMENDS += "${@bb.utils.contains_any('VIRTUAL-RUNTIME_dev_mana
 DEFAULT_IMAGE_NAME ??= "dey-image-qt"

 # List of graphical images names (for install scripts)
-GRAPHICAL_IMAGES ?= "dey-image-crank dey-image-qt dey-image-webkit"
+GRAPHICAL_IMAGES ?= "dey-image-crank dey-image-qt dey-image-webkit dey-image-lvgl"

 # Include DEY SELinux policy modifications by default
 DEY_SELINUX_POLICY ?= "1"
@ -89,6 +89,10 @@ BOOT_SCRIPTS += "boot.scr:boot.scr"

 # This can be used to enable U-Boot update through swupdate
 SWUPDATE_UBOOTIMG ?= "false"
+SWUPDATE_UBOOTIMG_REDUNDANT ?= "false"

 # ConnectCore Cloud Services packages to install
 CCCS_PKGS ?= "cccs-gs-demo dey-examples-cccs"
+
+# Default 1k-bloks seek in boot partition.
+BOOTLOADER_SEEK_BOOTPART ?= "0"
--- a/meta-digi-arm/conf/machine/include/imx-digi-base.inc
+++ b/meta-digi-arm/conf/machine/include/imx-digi-base.inc
@ -188,7 +188,7 @@ IMX_EXTRA_FIRMWARE                  ?= ""
 IMX_EXTRA_FIRMWARE:mx8-generic-bsp   = "firmware-imx-8 imx-sc-firmware imx-seco"
 IMX_EXTRA_FIRMWARE:mx8m-generic-bsp  = "firmware-imx-8m"
 IMX_EXTRA_FIRMWARE:mx8x-generic-bsp  = "imx-sc-firmware imx-seco"
-IMX_EXTRA_FIRMWARE:mx93-generic-bsp  = "firmware-imx-9 firmware-sentinel"
+IMX_EXTRA_FIRMWARE:mx93-generic-bsp  = "imx-boot-firmware-files firmware-ele-imx"

 # Firmware
 MACHINE_FIRMWARE ?= ""
@ -272,27 +272,29 @@ PREFERRED_VERSION_vulkan-tools:imxvulkan   ??= "1.2.182.0"

 # Use i.MX optee Version
 PREFERRED_VERSION_optee-os:mx8-nxp-bsp     ??= "3.19.0.imx"
-PREFERRED_VERSION_optee-os:mx9-nxp-bsp     ??= "3.21.0.imx"
+PREFERRED_VERSION_optee-os:mx9-nxp-bsp     ??= "4.0.0.imx"
 PREFERRED_VERSION_optee-client:mx8-nxp-bsp ??= "3.19.0.imx"
-PREFERRED_VERSION_optee-client:mx9-nxp-bsp ??= "3.21.0.imx"
+PREFERRED_VERSION_optee-client:mx9-nxp-bsp ??= "4.0.0.imx"
 PREFERRED_VERSION_optee-test:mx8-nxp-bsp   ??= "3.19.0.imx"
-PREFERRED_VERSION_optee-test:mx9-nxp-bsp   ??= "3.21.0.imx"
+PREFERRED_VERSION_optee-test:mx9-nxp-bsp   ??= "4.0.0.imx"

-# Machine learning backports from NXP's lf-6.1.1_1.0.0 release
-PREFERRED_VERSION_deepview-rt:ccimx93 = "2.4.46.1-aarch64"
-PREFERRED_VERSION_ethos-u-vela:ccimx93 = "3.6.0"
+# Machine learning backports from NXP's lf-6.1.55-2.2.0 release
+PREFERRED_VERSION_ethos-u-driver-stack:ccimx93 = "23.08"
+PREFERRED_VERSION_ethos-u-firmware:ccimx93 = "23.08"
+PREFERRED_VERSION_ethos-u-vela:ccimx93 = "3.9.0"
 PREFERRED_VERSION_flatbuffers:ccimx93 = "2.0.7"
 PREFERRED_VERSION_flatbuffers-native:ccimx93 = "2.0.7"
-PREFERRED_VERSION_tensorflow-lite:ccimx93 = "2.10.0"
-PREFERRED_VERSION_tensorflow-lite-host-tools:ccimx93 = "2.10.0"
-PREFERRED_VERSION_tensorflow-lite-host-tools-native:ccimx93 = "2.10.0"
+PREFERRED_VERSION_onnxruntime:ccimx93 = "1.16.1"
+PREFERRED_VERSION_tensorflow-lite:ccimx93 = "2.12.1"
+PREFERRED_VERSION_tensorflow-lite-host-tools:ccimx93 = "2.12.1"
+PREFERRED_VERSION_tensorflow-lite-host-tools-native:ccimx93 = "2.12.1"

 # Optee runtime packages to install
 OPTEE_PKGS ??= "optee-client optee-os"

 # Use i.MX opencv Version
 PREFERRED_VERSION_opencv:mx8-nxp-bsp ??= "4.6.0.imx"
-PREFERRED_VERSION_opencv:mx9-nxp-bsp ??= "4.6.0.imx"
+PREFERRED_VERSION_opencv:mx9-nxp-bsp ??= "4.7.0.imx"

 EXTRA_IMAGEDEPENDS += "u-boot"

--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/firmware-sentinel/firmware-sentinel_0.10.bb
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/firmware-sentinel/firmware-sentinel_0.10.bb
@ -1,15 +1,15 @@
 # Copyright 2021-2023 NXP
-SUMMARY = "NXP i.MX Sentinel firmware"
-DESCRIPTION = "Firmware for i.MX Sentinel Security Controller"
+SUMMARY = "NXP i.MX ELE firmware"
+DESCRIPTION = "EdgeLock Enclave firmware for i.MX series SoCs"
 SECTION = "base"
 LICENSE = "Proprietary"
-LIC_FILES_CHKSUM = "file://COPYING;md5=63a38e9f392d8813d6f1f4d0d6fbe657"
+LIC_FILES_CHKSUM = "file://COPYING;md5=2827219e81f28aba7c6a569f7c437fa7"

 inherit fsl-eula-unpack use-imx-security-controller-firmware deploy

 SRC_URI = "${FSL_MIRROR}/${BP}.bin;fsl-eula=true"
-SRC_URI[md5sum] = "a92e272d665a3b3bb9281253d5eca69f"
-SRC_URI[sha256sum] = "be862b62c849510cce08ec24c1ddf53d826458e326e5a7f09c4b35092d6f9950"
+SRC_URI[md5sum] = "7532c2e356574c1c9255c01169d38427"
+SRC_URI[sha256sum] = "4a0440168d8dfb95989a17be8fafb149589e110e7d4518e5e8a33463dfb5e5ca"

 do_compile[noexec] = "1"

--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/firmware-imx/firmware-nxp-wifi/ccimx93/sd_w61x_v1.bin.se
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/firmware-imx/firmware-nxp-wifi/ccimx93/sd_w61x_v1.bin.se
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/firmware-imx/firmware-nxp-wifi/ccimx93/uartspi_n61x_v1.bin.se
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/firmware-imx/firmware-nxp-wifi/ccimx93/uartspi_n61x_v1.bin.se
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/firmware-imx/firmware-nxp-wifi_%.bbappend
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/firmware-imx/firmware-nxp-wifi_%.bbappend
@ -1,26 +1,19 @@
 # Copyright (C) 2023 Digi International.

-FILESEXTRAPATHS:prepend := "${THISDIR}/${BPN}:"
+LIC_FILES_CHKSUM:ccimx93 = "file://LICENSE.txt;md5=2827219e81f28aba7c6a569f7c437fa7"

-LIC_FILES_CHKSUM:ccimx93 = "file://EULA.txt;md5=add2d392714d3096ed7e0f7e2190724b"
-
-SRCBRANCH:ccimx93 = "lf-6.1.1_1.0.0"
-SRCREV:ccimx93 = "bacbeb4789c1b13d13aab12ada29217ce8c3e905"
-
-# Use this temporal binary till it is released
-SRC_URI:append:ccimx93 = " \
-    file://sd_w61x_v1.bin.se \
-    file://uartspi_n61x_v1.bin.se \
-"
+SRCBRANCH:ccimx93 = "lf-6.1.55_2.2.0"
+SRCREV:ccimx93 = "7be5a936ce8677962dd7b41c6c9f41dd14350bec"

 do_install:append:ccimx93() {
-	install -m 444 ${WORKDIR}/sd_w61x_v1.bin.se ${D}${base_libdir}/firmware/nxp
-	install -m 444 ${WORKDIR}/uartspi_n61x_v1.bin.se ${D}${base_libdir}/firmware/nxp
+	# Install NXP Connectivity IW612 firmware
+	install -m 0644 nxp/FwImage_IW612_SD/sd_w61x_v1.bin.se  ${D}${nonarch_base_libdir}/firmware/nxp
+	install -m 0644 nxp/FwImage_IW612_SD/uartspi_n61x_v1.bin.se ${D}${nonarch_base_libdir}/firmware/nxp
 }

 PACKAGES:prepend:ccimx93 = "${PN}-nxpiw612 "

 FILES:${PN}-nxpiw612 = " \
-    ${base_libdir}/firmware/nxp/sd_w61x_v1.bin.se \
-    ${base_libdir}/firmware/nxp/uartspi_n61x_v1.bin.se \
+    ${nonarch_base_libdir}/firmware/nxp/sd_w61x_v1.bin.se \
+    ${nonarch_base_libdir}/firmware/nxp/uartspi_n61x_v1.bin.se \
 "
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/firmware-imx/imx-boot-firmware-files_8.22.bb
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/firmware-imx/imx-boot-firmware-files_8.22.bb
@ -9,11 +9,11 @@ DESCRIPTION = "Freescale i.MX firmware for i.MX 9 family"
 # require recipes-bsp/firmware-imx/firmware-imx-${PV}.inc
 require recipes-bsp/firmware-imx/firmware-imx-8.18.inc

-LIC_FILES_CHKSUM = "file://COPYING;md5=63a38e9f392d8813d6f1f4d0d6fbe657"
-SRC_URI[md5sum] = "25c50f3371450b2324401ee06ff1bf6a"
-SRC_URI[sha256sum] = "f6dc6a5c8fd9b913a15360d3ccd53d188db05a08a8594c518e57622478c72383"
+LIC_FILES_CHKSUM = "file://COPYING;md5=2827219e81f28aba7c6a569f7c437fa7"
+SRC_URI[md5sum] = "c5cf3842569f0a7fd990fbc64979e84f"
+SRC_URI[sha256sum] = "94c8bceac56ec503c232e614f77d6bbd8e17c7daa71d4e651ea8fd5034c30350"

-inherit deploy
+inherit deploy nopackages

 do_install[noexec] = "1"

--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/imx-atf/imx-atf/0001-ccimx93-use-UART6-for-the-default-console.patch
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/imx-atf/imx-atf/0001-ccimx93-use-UART6-for-the-default-console.patch
@ -8,11 +8,11 @@ Signed-off-by: Javier Viguera <javier.viguera@digi.com>
 1 file changed, 1 insertion(+), 1 deletion(-)

 diff --git a/plat/imx/imx93/include/platform_def.h b/plat/imx/imx93/include/platform_def.h
-index 59ce1c267568..c4855d7f5e82 100644
+index 9bbee908fe80..8eba2f6d917a 100644
 --- a/plat/imx/imx93/include/platform_def.h
 +++ b/plat/imx/imx93/include/platform_def.h
-@@ -53,7 +53,7 @@
- #define MAX_MMAP_REGIONS		16
+@@ -61,7 +61,7 @@
+ #define MAX_MMAP_REGIONS		17
 #endif
 
 -#define IMX_LPUART_BASE			0x44380000
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/imx-atf/imx-atf/0002-imx93-bring-back-ELE-clock-workaround-for-soc-revisi.patch
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/imx-atf/imx-atf/0002-imx93-bring-back-ELE-clock-workaround-for-soc-revisi.patch
@ -0,0 +1,53 @@
+From: Javier Viguera <javier.viguera@digi.com>
+Date: Tue, 31 Oct 2023 11:25:46 +0100
+Subject: [PATCH] imx93: bring back ELE clock workaround for soc revision A0
+
+Revert commit 7411561db535a20f61ff6621fec5b374130d34f9 to allow building
+for soc revision A0 using a compilation flag.
+
+Signed-off-by: Javier Viguera <javier.viguera@digi.com>
+---
+ plat/imx/imx93/imx93_psci.c | 10 ++++++++++
+ plat/imx/imx93/platform.mk  |  4 ++++
+ 2 files changed, 14 insertions(+)
+
+diff --git a/plat/imx/imx93/imx93_psci.c b/plat/imx/imx93/imx93_psci.c
+index 6a21ee970079..b9c4e0a1752b 100644
+--- a/plat/imx/imx93/imx93_psci.c
+++ b/plat/imx/imx93/imx93_psci.c
+@@ -794,6 +794,11 @@ void imx_pwr_domain_suspend(const psci_power_state_t *target_state)
+ 		} else {
+ 			write_clusterpwrdn(DSU_CLUSTER_PWR_OFF);
+ 		}
+
+#ifdef SOC_REV_A0
+		/* FIXME: slow down S401 clock: 24M OSC */
+		mmio_clrbits_32(0x44450200, GENMASK_32(9, 8));
+#endif
+ 	}
+ 
+ 	if (is_local_state_retn(SYSTEM_PWR_STATE(target_state))) {
+@@ -924,6 +929,11 @@ void imx_pwr_domain_suspend_finish(const psci_power_state_t *target_state)
+ 		mmio_write_32(IMX_GPC_BASE + A55C0_CMC_OFFSET + 0x800 * 2 + CM_MODE_CTRL, CM_MODE_RUN);
+ 		/* clear L3 retention */
+ 		mmio_clrbits_32(IMX_SRC_BASE + A55C0_MEM + 0x400 * 3 + 0x4, MEM_LP_RETENTION);
+
+#ifdef SOC_REV_A0
+		/* FIXME:  set S401 clock back */
+		mmio_setbits_32(0x44450200, BIT(9));
+#endif
+ 	}
+ 	/* do core level */
+ 	if (is_local_state_off(CORE_PWR_STATE(target_state))) {
+diff --git a/plat/imx/imx93/platform.mk b/plat/imx/imx93/platform.mk
+index be09b9f0be7a..440c13c1dbe1 100644
+--- a/plat/imx/imx93/platform.mk
+++ b/plat/imx/imx93/platform.mk
+@@ -57,3 +57,7 @@ BL32_BASE               ?=      0x96000000
+ BL32_SIZE               ?=      0x02000000
+ $(eval $(call add_define,BL32_BASE))
+ $(eval $(call add_define,BL32_SIZE))
+
+ifeq (${SOC_REV_A0},1)
+$(eval $(call add_define,SOC_REV_A0))
+endif
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/imx-atf/imx-atf_%.bbappend
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/imx-atf/imx-atf_%.bbappend
@ -9,14 +9,35 @@ SRC_URI:append:ccimx8m = " \
    file://0004-imx8mn-Disable-M7-debug-console.patch \
 "
 SRC_URI:append:ccimx93 = " \
-    file://0005-ccimx93-use-UART6-for-the-default-console.patch \
+    file://0001-ccimx93-use-UART6-for-the-default-console.patch \
+    file://0002-imx93-bring-back-ELE-clock-workaround-for-soc-revisi.patch \
 "

 BOOT_TOOLS = "imx-boot-tools"

+# Build ATF for imx93 SOC revision A0
+do_compile:append:ccimx93() {
+	oe_runmake SOC_REV_A0=1 BUILD_BASE=build-A0 clean
+	oe_runmake SOC_REV_A0=1 BUILD_BASE=build-A0 bl31
+	if ${BUILD_OPTEE}; then
+		oe_runmake SOC_REV_A0=1 BUILD_BASE=build-A0-optee clean
+		oe_runmake SOC_REV_A0=1 BUILD_BASE=build-A0-optee SPD=opteed bl31
+	fi
+}
+
 do_deploy:append() {
 	install -Dm 0644 ${S}/build/${ATF_PLATFORM}/release/bl31.bin ${DEPLOYDIR}/${BOOT_TOOLS}/bl31-${ATF_PLATFORM}.bin
 	if ${BUILD_OPTEE}; then
 		install -m 0644 ${S}/build-optee/${ATF_PLATFORM}/release/bl31.bin ${DEPLOYDIR}/${BOOT_TOOLS}/bl31-${ATF_PLATFORM}.bin-optee
 	fi
 }
+
+# Deploy ATF for imx93 SOC revision A0
+do_deploy:append:ccimx93() {
+	install -Dm 0644 ${S}/build-A0/${ATF_PLATFORM}/release/bl31.bin ${DEPLOYDIR}/bl31-${ATF_PLATFORM}-A0.bin
+	install -Dm 0644 ${S}/build-A0/${ATF_PLATFORM}/release/bl31.bin ${DEPLOYDIR}/${BOOT_TOOLS}/bl31-${ATF_PLATFORM}-A0.bin
+	if ${BUILD_OPTEE}; then
+		install -m 0644 ${S}/build-A0-optee/${ATF_PLATFORM}/release/bl31.bin ${DEPLOYDIR}/bl31-${ATF_PLATFORM}-A0.bin-optee
+		install -m 0644 ${S}/build-A0-optee/${ATF_PLATFORM}/release/bl31.bin ${DEPLOYDIR}/${BOOT_TOOLS}/bl31-${ATF_PLATFORM}-A0.bin-optee
+	fi
+}
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/imx-atf/imx-atf_2.8.bb
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/imx-atf/imx-atf_2.8.bb
@ -7,6 +7,7 @@ require recipes-bsp/imx-atf/imx-atf_2.6.bb

 SRC_URI = "git://github.com/nxp-imx/imx-atf.git;protocol=https;branch=${SRCBRANCH}"
 SRCBRANCH = "lf_v2.8"
-SRCREV = "99195a23d3aef485fb8f10939583b1bdef18881c"
+# Tag: lf-6.1.55-2.2.0
+SRCREV = "08e9d4eef2262c0dd072b4325e8919e06d349e02"

 COMPATIBLE_MACHINE = "(ccimx93)"
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/imx-mkimage/files/0001-imx9-soc.mak-capture-commands-output-into-a-log-file.patch
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/imx-mkimage/files/0001-imx9-soc.mak-capture-commands-output-into-a-log-file.patch
@ -0,0 +1,49 @@
+From: Javier Viguera <javier.viguera@digi.com>
+Date: Thu, 31 Aug 2023 16:33:13 +0200
+Subject: [PATCH] imx9: soc.mak: capture commands output into a log file
+
+This is later used to get the needed information for the signing of the
+boot artifacts.
+
+Signed-off-by: Javier Viguera <javier.viguera@digi.com>
+---
+ iMX9/soc.mak | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/iMX9/soc.mak b/iMX9/soc.mak
+index b17db6b7ca8c..c4bcac4e42cd 100644
+--- a/iMX9/soc.mak
+++ b/iMX9/soc.mak
+@@ -1,4 +1,5 @@
+ MKIMG = ../mkimage_imx8
+MKIMAGE_LOG = "mkimage-$(firstword $(MAKECMDGOALS)).log"
+ 
+ CC ?= gcc
+ REV ?= A0
+@@ -110,7 +111,7 @@ define append_container
+ 	@flashbin_size=`wc -c flash.bin | awk '{print $$1}'`; \
+                    psize=$$((0x400 * $(2))); \
+                    pad_cnt=$$(((flashbin_size + psize - 1) / psize)); \
+-                   echo "append $(1) at $$((pad_cnt * $(2))) KB, psize=$$psize"; \
+                   echo "append $(1) at $$((pad_cnt * $(2))) KB, psize=$$psize" | tee -a $(MKIMAGE_LOG); \
+                    dd if=$(1) of=flash.bin bs=1K seek=$$((pad_cnt * $(2)));
+ endef
+ 
+@@ -209,7 +210,7 @@ u-boot-atf-container.img: bl31.bin u-boot-hash.bin
+ 			   -ap bl31.bin a55 $(ATF_LOAD_ADDR) \
+ 			   -ap u-boot-hash.bin a55 $(UBOOT_LOAD_ADDR) \
+ 			   -out u-boot-atf-container.img; \
+-	fi
+	fi | tee $(MKIMAGE_LOG)
+ 
+ u-boot-atf-container-spinand.img: bl31.bin u-boot-hash.bin
+ 	if [ -f $(TEE) ]; then \
+@@ -286,7 +287,7 @@ endif
+ 
+ flash_singleboot: $(MKIMG) $(AHAB_IMG) $(SPL_A55_IMG) u-boot-atf-container.img $(OEI_A55_DDR)
+ 	./$(MKIMG) -soc IMX9 -append $(AHAB_IMG) -c $(OEI_OPT_A55) \
+-		   -ap $(SPL_A55_IMG) a55 $(SPL_LOAD_ADDR) -out flash.bin
+		   -ap $(SPL_A55_IMG) a55 $(SPL_LOAD_ADDR) -out flash.bin | tee -a $(MKIMAGE_LOG)
+ 	$(call append_container,u-boot-atf-container.img,1)
+ 
+ flash_singleboot_no_ahabfw: $(MKIMG) $(SPL_A55_IMG) u-boot-atf-container.img $(OEI_A55_DDR)
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/imx-mkimage/files/0002-imx9-soc.mak-add-makefile-target-to-build-A0-revisio.patch
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/imx-mkimage/files/0002-imx9-soc.mak-add-makefile-target-to-build-A0-revisio.patch
@ -0,0 +1,25 @@
+From: Javier Viguera <javier.viguera@digi.com>
+Date: Thu, 2 Nov 2023 15:03:13 +0100
+Subject: [PATCH] imx9: soc.mak: add makefile target to build A0 revision
+
+Signed-off-by: Javier Viguera <javier.viguera@digi.com>
+---
+ iMX9/soc.mak | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/iMX9/soc.mak b/iMX9/soc.mak
+index c4bcac4e42cd..4f741451d1d0 100644
+--- a/iMX9/soc.mak
+++ b/iMX9/soc.mak
+@@ -290,6 +290,11 @@ flash_singleboot: $(MKIMG) $(AHAB_IMG) $(SPL_A55_IMG) u-boot-atf-container.img $
+ 		   -ap $(SPL_A55_IMG) a55 $(SPL_LOAD_ADDR) -out flash.bin | tee -a $(MKIMAGE_LOG)
+ 	$(call append_container,u-boot-atf-container.img,1)
+ 
+flash_singleboot_a0: $(MKIMG) mx93a0-ahab-container.img $(SPL_A55_IMG) u-boot-atf-container.img $(OEI_A55_DDR)
+	./$(MKIMG) -soc IMX9 -append mx93a0-ahab-container.img -c $(OEI_OPT_A55) \
+		   -ap $(SPL_A55_IMG) a55 $(SPL_LOAD_ADDR) -out flash.bin | tee -a $(MKIMAGE_LOG)
+	$(call append_container,u-boot-atf-container.img,1)
+
+ flash_singleboot_no_ahabfw: $(MKIMG) $(SPL_A55_IMG) u-boot-atf-container.img $(OEI_A55_DDR)
+ 	./$(MKIMG) -soc IMX9 -c $(OEI_OPT_A55) \
+ 		   -ap $(SPL_A55_IMG) a55 $(SPL_LOAD_ADDR) -out flash.bin
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/imx-mkimage/imx-boot_1.0.bbappend
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/imx-mkimage/imx-boot_1.0.bbappend
@ -1,4 +1,4 @@
-# Copyright (C) 2022-2023 Digi International Inc.
+# Copyright (C) 2022-2024 Digi International Inc.

 FILESEXTRAPATHS:prepend := "${THISDIR}/files:"

@ -7,10 +7,15 @@ SRC_URI:append:ccimx8m = " \
    file://0002-imx8m-soc.mak-capture-commands-output-into-a-log-fil.patch \
 "

-# Use NXP's lf-6.1.22-2.0.0 release for ccimx93
+SRC_URI:append:ccimx93 = " \
+    file://0001-imx9-soc.mak-capture-commands-output-into-a-log-file.patch \
+    file://0002-imx9-soc.mak-add-makefile-target-to-build-A0-revisio.patch \
+"
+
+# Use NXP's lf-6.1.55-2.2.0 release for ccimx93
 SRC_URI:ccimx93 = "git://github.com/nxp-imx/imx-mkimage.git;protocol=https;branch=${SRCBRANCH}"
-SRCBRANCH:ccimx93 = "lf-6.1.22_2.0.0"
-SRCREV:ccimx93 = "5cfd218012e080fb907d9cc301fbb4ece9bc17a9"
+SRCBRANCH:ccimx93 = "lf-6.1.55_2.2.0"
+SRCREV:ccimx93 = "c4365450fb115d87f245df2864fee1604d97c06a"

 DEPENDS += "${@oe.utils.conditional('TRUSTFENCE_SIGN', '1', 'trustfence-sign-tools-native', '', d)}"

@ -18,6 +23,8 @@ DEPENDS += "${@oe.utils.conditional('TRUSTFENCE_SIGN', '1', 'trustfence-sign-too
 UUU_BOOTLOADER = ""
 UUU_BOOTLOADER_TAGGED = ""

+REV_OPTION:ccimx93 = "REV=A1"
+
 compile_mx8m:append:ccimx8m() {
 	# Create dummy DEK blob to support building with encrypted u-boot
 	if [ -n "${TRUSTFENCE_DEK_PATH}" ] && [ "${TRUSTFENCE_DEK_PATH}" != "0" ]; then
@ -25,6 +32,18 @@ compile_mx8m:append:ccimx8m() {
 	fi
 }

+# For SOC revision A0 we need a different ATF binary
+compile_mx93:append:ccimx93() {
+	if [ "$target" = "flash_singleboot_a0" ]; then
+		ATF_MACHINE_NAME_A0="$(echo ${ATF_MACHINE_NAME} | sed -e 's,.bin,-A0.bin,g')"
+		bbnote "Copy ATF binary for SOC revision A0: ${ATF_MACHINE_NAME_A0}"
+		\cp --remove-destination ${DEPLOY_DIR_IMAGE}/${ATF_MACHINE_NAME_A0} ${BOOT_STAGING}/bl31.bin
+		# Filename must match the deployed one in "optee-os" recipe for A0 SOC revision
+		\cp --remove-destination ${DEPLOY_DIR_IMAGE}/tee.ccimx93dvk_a0.bin ${BOOT_STAGING}/tee.bin
+		unset ATF_MACHINE_NAME_A0
+	fi
+}
+
 do_compile:append:ccimx8m() {
 	bbnote "building ${IMX_BOOT_SOC_TARGET} - print_fit_hab"
 	make SOC=${IMX_BOOT_SOC_TARGET} dtbs=${UBOOT_DTB_NAME} print_fit_hab
@ -83,6 +102,18 @@ do_deploy:append:ccimx8m() {

 do_deploy:append:ccimx93() {
 	generate_symlinks
+	for target in ${IMXBOOT_TARGETS}; do
+		install -m 0644 ${BOOT_STAGING}/mkimage-${target}.log ${DEPLOYDIR}/${BOOT_TOOLS}
+		# Generate symlink for SOC revision A0
+		if [ "$target" = "flash_singleboot_a0" ]; then
+			ln -sf ${BOOT_NAME}-${MACHINE}.bin-${target} ${DEPLOYDIR}/${BOOT_NAME}-${MACHINE}-A0.bin
+		fi
+	done
+	# Deploy A0 optee binary
+	if ${DEPLOY_OPTEE}; then
+		# Filename must match the deployed one in "optee-os" recipe for A0 SOC revision
+		install -m 0644 ${DEPLOY_DIR_IMAGE}/tee.ccimx93dvk_a0.bin ${DEPLOYDIR}/${BOOT_TOOLS}
+	fi
 }

 do_deploy:ccimx8x () {
@ -126,6 +157,11 @@ trustfence_sign_imxboot() {

 	# Sign/encrypt boot image
 	for target in ${IMXBOOT_TARGETS}; do
+		# Use first "target" as IMAGE_IMXBOOT_TARGET
+		if [ "$IMAGE_IMXBOOT_TARGET" = "" ]; then
+			IMAGE_IMXBOOT_TARGET="$target"
+			echo "Set boot target as $IMAGE_IMXBOOT_TARGET"
+		fi
 		TF_SIGN_ENV="$TF_SIGN_ENV CONFIG_MKIMAGE_LOG_PATH=${DEPLOYDIR}/${BOOT_TOOLS}/mkimage-${target}.log"
 		env $TF_SIGN_ENV trustfence-sign-uboot.sh ${BOOT_NAME}-${MACHINE}.bin-${target} ${BOOT_NAME}-signed-${MACHINE}.bin-${target}
 		if [ -n "${TRUSTFENCE_DEK_PATH}" ] && [ "${TRUSTFENCE_DEK_PATH}" != "0" ]; then
@ -133,6 +169,12 @@ trustfence_sign_imxboot() {
 			env $TF_SIGN_ENV $TF_ENC_ENV trustfence-sign-uboot.sh ${BOOT_NAME}-${MACHINE}.bin-${target} ${BOOT_NAME}-encrypted-${MACHINE}.bin-${target}
 		fi
 	done
+
+	# Generate symlinks for trustfence artifacts.
+	ln -sf ${BOOT_NAME}-signed-${MACHINE}.bin-${IMAGE_IMXBOOT_TARGET} ${DEPLOYDIR}/${BOOT_NAME}-signed-${MACHINE}.bin
+	if [ -n "${TRUSTFENCE_DEK_PATH}" ] && [ "${TRUSTFENCE_DEK_PATH}" != "0" ]; then
+		ln -sf ${BOOT_NAME}-encrypted-${MACHINE}.bin-${IMAGE_IMXBOOT_TARGET} ${DEPLOYDIR}/${BOOT_NAME}-encrypted-${MACHINE}.bin
+	fi
 }

 trustfence_sign_imxboot:ccimx8x() {
@ -143,6 +185,11 @@ trustfence_sign_imxboot:ccimx8x() {

 	# Sign/encrypt boot image
 	for target in ${IMXBOOT_TARGETS}; do
+		# Use first "target" as IMAGE_IMXBOOT_TARGET
+		if [ "$IMAGE_IMXBOOT_TARGET" = "" ]; then
+			IMAGE_IMXBOOT_TARGET="$target"
+			echo "Set boot target as $IMAGE_IMXBOOT_TARGET"
+		fi
 		for rev in ${SOC_REVISIONS}; do
 			TF_SIGN_ENV="$TF_SIGN_ENV CONFIG_MKIMAGE_LOG_PATH=${DEPLOYDIR}/${BOOT_TOOLS}/mkimage-${rev}-${target}.log"
 			env $TF_SIGN_ENV trustfence-sign-uboot.sh ${BOOT_NAME}-${MACHINE}-${rev}.bin-${target} ${BOOT_NAME}-signed-${MACHINE}-${rev}.bin-${target}
@ -152,6 +199,12 @@ trustfence_sign_imxboot:ccimx8x() {
 			fi
 		done
 	done
+
+	# Generate symlinks for trustfence artifacts.
+	ln -sf ${UBOOT_PREFIX}-signed-${MACHINE}-${rev}.bin-${IMAGE_IMXBOOT_TARGET} ${DEPLOYDIR}/${UBOOT_PREFIX}-signed-${MACHINE}.bin
+	if [ -n "${TRUSTFENCE_DEK_PATH}" ] && [ "${TRUSTFENCE_DEK_PATH}" != "0" ]; then
+		ln -sf ${UBOOT_PREFIX}-encrypted-${MACHINE}-${rev}.bin-${IMAGE_IMXBOOT_TARGET} ${DEPLOYDIR}/${UBOOT_PREFIX}-encrypted-${MACHINE}.bin
+	fi
 }

 trustfence_sign_imxboot[dirs] = "${DEPLOYDIR}"
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/imx-mkimage/imx-mkimage_git.bbappend
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/imx-mkimage/imx-mkimage_git.bbappend
@ -1,4 +1,4 @@
-# Copyright (C) 2022 Digi International
+# Copyright (C) 2022-2024 Digi International Inc.

 FILESEXTRAPATHS:prepend := "${THISDIR}/files:"

@ -6,10 +6,10 @@ SRC_URI:append:ccimx8m = " \
    file://0001-imx8m-soc.mak-preserve-dtbs-after-build.patch \
 "

-# Use NXP's lf-6.1.22-2.0.0 release for ccimx93
+# Use NXP's lf-6.1.55-2.2.0 release for ccimx93
 SRC_URI:ccimx93 = "git://github.com/nxp-imx/imx-mkimage.git;protocol=https;branch=${SRCBRANCH}"
-SRCBRANCH:ccimx93 = "lf-6.1.22_2.0.0"
-SRCREV:ccimx93 = "5cfd218012e080fb907d9cc301fbb4ece9bc17a9"
+SRCBRANCH:ccimx93 = "lf-6.1.55_2.2.0"
+SRCREV:ccimx93 = "c4365450fb115d87f245df2864fee1604d97c06a"

 # "fmacro-prefix-map" is not supported on old versions of GCC
 DEBUG_PREFIX_MAP:remove:class-nativesdk = "-fmacro-prefix-map=${WORKDIR}=/usr/src/debug/${PN}/${EXTENDPE}${PV}-${PR}"
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-graphics/drm/libdrm_2.4.115.imx.bb
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-graphics/drm/libdrm_2.4.115.imx.bb
@ -0,0 +1,74 @@
+SUMMARY = "Userspace interface to the kernel DRM services"
+DESCRIPTION = "The runtime library for accessing the kernel DRM services.  DRM \
+stands for \"Direct Rendering Manager\", which is the kernel portion of the \
+\"Direct Rendering Infrastructure\" (DRI).  DRI is required for many hardware \
+accelerated OpenGL drivers."
+HOMEPAGE = "http://dri.freedesktop.org"
+SECTION = "x11/base"
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=9eb1f4831351ab42d762c40b3ebb7add \
+		    file://xf86drm.c;beginline=9;endline=32;md5=c8a3b961af7667c530816761e949dc71"
+PROVIDES = "drm"
+DEPENDS = "libpthread-stubs"
+
+SRC_URI = "${IMX_LIBDRM_SRC};branch=${SRCBRANCH}"
+IMX_LIBDRM_SRC ?= "git://github.com/nxp-imx/libdrm-imx.git;protocol=https;nobranch=1"
+SRCBRANCH ?= "libdrm-imx-2.4.115"
+SRCREV = "0f889a1f9640f6210132dd565141eb19005245fb"
+
+S = "${WORKDIR}/git"
+
+DEFAULT_PREFERENCE = "-1"
+COMPATIBLE_MACHINE = "(ccimx93)"
+
+inherit meson pkgconfig manpages
+
+PACKAGECONFIG ??= "intel radeon amdgpu nouveau vmwgfx omap freedreno vc4 etnaviv tests install-test-programs"
+PACKAGECONFIG[intel] = "-Dintel=enabled,-Dintel=disabled,libpciaccess"
+PACKAGECONFIG[radeon] = "-Dradeon=enabled,-Dradeon=disabled"
+PACKAGECONFIG[amdgpu] = "-Damdgpu=enabled,-Damdgpu=disabled"
+PACKAGECONFIG[nouveau] = "-Dnouveau=enabled,-Dnouveau=disabled"
+PACKAGECONFIG[vmwgfx] = "-Dvmwgfx=enabled,-Dvmwgfx=disabled"
+PACKAGECONFIG[omap] = "-Domap=enabled,-Domap=disabled"
+PACKAGECONFIG[exynos] = "-Dexynos=enabled,-Dexynos=disabled"
+PACKAGECONFIG[freedreno] = "-Dfreedreno=enabled,-Dfreedreno=disabled"
+PACKAGECONFIG[tegra] = "-Dtegra=enabled,-Dtegra=disabled"
+PACKAGECONFIG[vc4] = "-Dvc4=enabled,-Dvc4=disabled"
+PACKAGECONFIG[etnaviv] = "-Detnaviv=enabled,-Detnaviv=disabled"
+PACKAGECONFIG[freedreno-kgsl] = "-Dfreedreno-kgsl=true,-Dfreedreno-kgsl=false"
+PACKAGECONFIG[valgrind] = "-Dvalgrind=enabled,-Dvalgrind=disabled,valgrind"
+PACKAGECONFIG[install-test-programs] = "-Dinstall-test-programs=true,-Dinstall-test-programs=false"
+PACKAGECONFIG[cairo-tests] = "-Dcairo-tests=enabled,-Dcairo-tests=disabled"
+PACKAGECONFIG[tests] = "-Dtests=true,-Dtests=false"
+PACKAGECONFIG[udev] = "-Dudev=true,-Dudev=false,udev"
+PACKAGECONFIG[manpages] = "-Dman-pages=enabled,-Dman-pages=disabled,libxslt-native xmlto-native python3-docutils-native"
+
+ALLOW_EMPTY:${PN}-drivers = "1"
+PACKAGES =+ "${PN}-tests ${PN}-drivers ${PN}-radeon ${PN}-nouveau ${PN}-omap \
+             ${PN}-intel ${PN}-exynos ${PN}-kms ${PN}-freedreno ${PN}-amdgpu \
+             ${PN}-etnaviv"
+
+RRECOMMENDS:${PN}-drivers = "${PN}-radeon ${PN}-nouveau ${PN}-omap ${PN}-intel \
+                             ${PN}-exynos ${PN}-freedreno ${PN}-amdgpu \
+                             ${PN}-etnaviv"
+
+FILES:${PN}-tests = "${bindir}/*"
+FILES:${PN}-radeon = "${libdir}/libdrm_radeon.so.*"
+FILES:${PN}-nouveau = "${libdir}/libdrm_nouveau.so.*"
+FILES:${PN}-omap = "${libdir}/libdrm_omap.so.*"
+FILES:${PN}-intel = "${libdir}/libdrm_intel.so.*"
+FILES:${PN}-exynos = "${libdir}/libdrm_exynos.so.*"
+FILES:${PN}-kms = "${libdir}/libkms*.so.*"
+FILES:${PN}-freedreno = "${libdir}/libdrm_freedreno.so.*"
+FILES:${PN}-amdgpu = "${libdir}/libdrm_amdgpu.so.* ${datadir}/${PN}/amdgpu.ids"
+FILES:${PN}-etnaviv = "${libdir}/libdrm_etnaviv.so.*"
+
+BBCLASSEXTEND = "native nativesdk"
+
+PACKAGES:prepend:imxgpu = "${PN}-vivante "
+RRECOMMENDS:${PN}-drivers:append:imxgpu = " ${PN}-vivante"
+FILES:${PN}-vivante = "${libdir}/libdrm_vivante.so.*"
+PACKAGECONFIG:append:imxgpu = " vivante"
+PACKAGECONFIG[vivante] = "-Dvivante=true,-Dvivante=false"
+
+PACKAGE_ARCH = "${MACHINE_SOCARCH}"
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-graphics/imx-g2d/imx-g2d-samples_git.bbappend
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-graphics/imx-g2d/imx-g2d-samples_git.bbappend
@ -1,4 +1,6 @@
-# Copyright (c) 2023, Digi International Inc.
+# Copyright 2023, 2024 Digi International Inc.
+
+SRCREV:mx93-nxp-bsp = "4391dcda499870418bb38fe395c3cba0664c5bab"

 PACKAGECONFIG_IMPLEMENTATION:mx93-nxp-bsp = "pxp"

--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-graphics/imx-g2d/imx-pxp-g2d_git.bbappend
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-graphics/imx-g2d/imx-pxp-g2d_git.bbappend
@ -0,0 +1,5 @@
+# Copyright 2023, 2024 Digi International Inc.
+
+LIC_FILES_CHKSUM:ccimx93 = "file://LICENSE.txt;md5=2827219e81f28aba7c6a569f7c437fa7"
+
+SRCREV:ccimx93 = "f3adab05bd0cbb7c38578110d772e8ddf52b4e8e"
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-graphics/wayland/wayland/0001-build-Fix-strndup-detection-on-MinGW.patch
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-graphics/wayland/wayland/0001-build-Fix-strndup-detection-on-MinGW.patch
@ -0,0 +1,41 @@
+From b4c64b6f07743e3fb63ce52359bc664ab7d60df0 Mon Sep 17 00:00:00 2001
+From: Joshua Watt <JPEWhacker@gmail.com>
+Date: Thu, 20 Feb 2020 15:20:45 -0600
+Subject: [PATCH] build: Fix strndup detection on MinGW
+
+GCC and meson conspire together to incorrectly detect that strndup()
+exists on MinGW as __builtin_strndup, when no such function exists. As a
+work around, meson will skip looking for __builtin functions if an
+'#include' is in the prefix, so add '#include <string.h>' when looking
+for strndup().
+
+See: https://github.com/mesonbuild/meson/issues/3672
+
+Upstream-Status: Submitted [https://gitlab.freedesktop.org/wayland/wayland/merge_requests/63]
+
+Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
+Signed-off-by: Denys Dmytriyenko <denis@denix.org>
+---
+ meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/meson.build b/meson.build
+index 3bc25c9..adde7b9 100644
+--- a/meson.build
+++ b/meson.build
+@@ -38,11 +38,11 @@ have_funcs = [
+ 	'prctl',
+ 	'memfd_create',
+ 	'mremap',
+-	'strndup',
+ ]
+ foreach f: have_funcs
+ 	config_h.set('HAVE_' + f.underscorify().to_upper(), cc.has_function(f))
+ endforeach
+config_h.set('HAVE_STRNDUP', cc.has_function('strndup') and cc.has_header_symbol('string.h', 'strndup'))
+ config_h.set10('HAVE_XUCRED_CR_PID', cc.has_member('struct xucred', 'cr_pid', prefix : '#include <sys/ucred.h>'))
+ have_broken_msg_cmsg_cloexec = false
+ if host_machine.system() == 'freebsd'
+-- 
+2.7.4
+
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-graphics/wayland/wayland/run-ptest
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-graphics/wayland/wayland/run-ptest
@ -0,0 +1,17 @@
+#!/bin/sh
+
+export WAYLAND_SCANNER=wayland-scanner
+export TEST_DATA_DIR=tests/data
+export TEST_OUTPUT_DIR=tests/output
+export SED=sed
+export WAYLAND_EGL_LIB=/usr/lib/libwayland-egl.so.1
+export NM=nm
+
+for i in `ls tests/*-test tests/wayland-egl-symbols-check tests/scanner-test.sh`; do
+    $i
+    if [ $? -eq 0 ]; then
+        echo "PASS: $i"
+    else
+        echo "FAIL: $i"
+    fi
+done
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-graphics/wayland/wayland_1.22.0.imx.bb
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-graphics/wayland/wayland_1.22.0.imx.bb
@ -0,0 +1,67 @@
+SUMMARY = "Wayland, a protocol between a compositor and clients"
+DESCRIPTION = "Wayland is a protocol for a compositor to talk to its clients \
+as well as a C library implementation of that protocol. The compositor can be \
+a standalone display server running on Linux kernel modesetting and evdev \
+input devices, an X application, or a wayland client itself. The clients can \
+be traditional applications, X servers (rootless or fullscreen) or other \
+display servers."
+HOMEPAGE = "http://wayland.freedesktop.org"
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://COPYING;md5=b31d8f53b6aaf2b4985d7dd7810a70d1 \
+                    file://src/wayland-server.c;endline=24;md5=b8e046164a766bb1ede8ba38e9dcd7ce"
+
+DEPENDS = "expat libffi wayland-native"
+
+SRC_URI = "https://gitlab.freedesktop.org/wayland/wayland/-/releases/1.22.0/downloads/${BP_ORIGINAL}.tar.xz \
+           file://run-ptest \
+           file://0001-build-Fix-strndup-detection-on-MinGW.patch \
+           "
+SRC_URI[sha256sum] = "1540af1ea698a471c2d8e9d288332c7e0fd360c8f1d12936ebb7e7cbc2425842"
+BP_ORIGINAL = "${BPN}-1.22.0"
+S = "${WORKDIR}/${BP_ORIGINAL}"
+
+UPSTREAM_CHECK_URI = "https://wayland.freedesktop.org/releases.html"
+UPSTREAM_CHECK_REGEX = "wayland-(?P<pver>\d+\.\d+\.(?!9\d+)\d+)"
+
+inherit meson pkgconfig ptest
+
+PACKAGECONFIG ??= "dtd-validation"
+PACKAGECONFIG[dtd-validation] = "-Ddtd_validation=true,-Ddtd_validation=false,libxml2,,"
+
+EXTRA_OEMESON = "-Ddocumentation=false"
+EXTRA_OEMESON:class-native = "-Ddocumentation=false"
+
+# Wayland installs a M4 macro for other projects to use, which uses the target
+# pkg-config to find files.  Replace pkg-config with pkg-config-native.
+do_install:append:class-native() {
+  sed -e 's,PKG_CHECK_MODULES(.*),,g' \
+      -e 's,$PKG_CONFIG,pkg-config-native,g' \
+      -i ${D}/${datadir}/aclocal/wayland-scanner.m4
+}
+
+do_install_ptest() {
+    mkdir -p ${D}${PTEST_PATH}/tests/data
+    cp -rf ${B}/tests/*-test ${B}/tests/*-checker ${D}${PTEST_PATH}/tests
+    cp -rf ${B}/tests/*-checker ${D}${PTEST_PATH}
+    cp -rf ${S}/tests/scanner-test.sh ${D}${PTEST_PATH}/tests
+    cp -rf ${S}/tests/data/* ${D}${PTEST_PATH}/tests/data/
+    cp -rf ${S}/egl/wayland-egl-symbols-check ${D}${PTEST_PATH}/tests/
+}
+
+sysroot_stage_all:append:class-target () {
+	rm ${SYSROOT_DESTDIR}/${datadir}/aclocal/wayland-scanner.m4
+	cp ${STAGING_DATADIR_NATIVE}/aclocal/wayland-scanner.m4 ${SYSROOT_DESTDIR}/${datadir}/aclocal/
+}
+
+PACKAGES =+ "${PN}-tools"
+
+FILES:${PN}-tools = "${bindir}/wayland-scanner"
+FILES:${PN}-dev += "${datadir}/${BPN}/wayland-scanner.mk"
+
+BBCLASSEXTEND = "native nativesdk"
+
+RDEPENDS:${PN}-ptest += "binutils sed ${PN}-tools"
+
+PACKAGE_ARCH = "${MACHINE_SOCARCH}"
+
+DEFAULT_PREFERENCE = "-1"
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-graphics/xwayland/xwayland_23.1.1.imx.bb
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-graphics/xwayland/xwayland_23.1.1.imx.bb
@ -0,0 +1,53 @@
+# This recipe copy helps keep meta-freescale master branch compatible
+# with Yocto langdale.
+# (From OE-Core rev: 35fdbd0ea81650a0421d50fb53989d96c5956331)
+
+SUMMARY = "XWayland is an X Server that runs under Wayland."
+DESCRIPTION = "XWayland is an X Server running as a Wayland client, \
+and thus is capable of displaying native X11 client applications in a \
+Wayland compositor environment. The goal of XWayland is to facilitate \
+the transition from X Window System to Wayland environments, providing \
+a way to run unported applications in the meantime."
+HOMEPAGE = "https://fedoraproject.org/wiki/Changes/XwaylandStandalone"
+
+DEFAULT_PREFERENCE = "-1"
+
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://COPYING;md5=5df87950af51ac2c5822094553ea1880"
+
+SRC_URI = "https://www.x.org/archive/individual/xserver/${BP_ORIGINAL}.tar.xz"
+BP_ORIGINAL = "${BPN}-23.1.1"
+SRC_URI[sha256sum] = "fb9461f5cb9fea5e07e91882311b0c88b43e8843b017ebac05eb5af69aa34c15"
+S = "${WORKDIR}/${BP_ORIGINAL}"
+
+UPSTREAM_CHECK_REGEX = "xwayland-(?P<pver>\d+(\.(?!90\d)\d+)+)\.tar"
+
+inherit meson features_check pkgconfig
+REQUIRED_DISTRO_FEATURES = "x11 opengl"
+
+DEPENDS += "xorgproto xtrans pixman libxkbfile libxfont2 wayland wayland-native wayland-protocols libdrm libepoxy libxcvt"
+
+OPENGL_PKGCONFIGS = "glx glamor dri3"
+PACKAGECONFIG ??= "${XORG_CRYPTO} \
+                   ${@bb.utils.contains('DISTRO_FEATURES', 'opengl', '${OPENGL_PKGCONFIGS}', '', d)} \
+"
+PACKAGECONFIG[dri3] = "-Ddri3=true,-Ddri3=false,libxshmfence"
+PACKAGECONFIG[glx] = "-Dglx=true,-Dglx=false,virtual/libgl virtual/libx11"
+PACKAGECONFIG[glamor] = "-Dglamor=true,-Dglamor=false,libepoxy virtual/libgbm,libegl"
+PACKAGECONFIG[unwind] = "-Dlibunwind=true,-Dlibunwind=false,libunwind"
+PACKAGECONFIG[xinerama] = "-Dxinerama=true,-Dxinerama=false"
+
+# Xorg requires a SHA1 implementation, pick one
+XORG_CRYPTO ??= "openssl"
+PACKAGECONFIG[openssl] = "-Dsha1=libcrypto,,openssl"
+PACKAGECONFIG[nettle] = "-Dsha1=libnettle,,nettle"
+PACKAGECONFIG[gcrypt] = "-Dsha1=libgcrypt,,libgcrypt"
+
+do_install:append() {
+    # remove files not needed and clashing with xserver-xorg
+    rm -rf ${D}/${libdir}/xorg/
+}
+
+FILES:${PN} += "${libdir}/xorg/protocol.txt"
+
+RDEPENDS:${PN} += "xkbcomp"
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-kernel/linux/linux-imx-headers_6.1.bb
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-kernel/linux/linux-imx-headers_6.1.bb
@ -0,0 +1,14 @@
+# Copyright 2023, 2024 Digi International Inc.
+
+#
+# Reuse meta-freescale's linux-imx-headers_5.15.bb
+#
+require recipes-kernel/linux/linux-imx-headers_5.15.bb
+
+SRCBRANCH = "lf-6.1.y"
+LOCALVERSION = "-lts-${SRCBRANCH}"
+SRCREV = "770c5fe2c1d1529fae21b7043911cd50c6cf087e"
+
+IMX_UAPI_HEADERS:remove = "isl29023.h"
+
+COMPATIBLE_MACHINE = "(ccimx93)"
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-security/optee-imx/optee-client/tee-supplicant.service
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-security/optee-imx/optee-client/tee-supplicant.service
@ -3,9 +3,8 @@ Description=TEE Supplicant

 [Service]
 User=root
-EnvironmentFile=-/etc/default/tee-supplicant
-ExecStart=/usr/bin/tee-supplicant $OPTARGS
+EnvironmentFile=-@sysconfdir@/default/tee-supplicant
+ExecStart=@sbindir@/tee-supplicant $OPTARGS

 [Install]
 WantedBy=basic.target
-
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-security/optee-imx/optee-client_3.21.0.imx.bb
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-security/optee-imx/optee-client_3.21.0.imx.bb
@ -1,15 +0,0 @@
-# Copyright 2023 Digi International Inc.
-
-#
-# Reuse meta-freescale's optee-client_3.19.0.imx.bb
-#
-require recipes-security/optee-imx/optee-client_3.19.0.imx.bb
-
-SRCBRANCH = "lf-6.1.22_2.0.0"
-SRCREV = "8533e0e6329840ee96cf81b6453f257204227e6c"
-
-# Otherwise optee-client's makefile defaults to use $(CROSS_COMPILE)pkg-config
-# which is not what Yocto provides.
-export PKG_CONFIG='pkg-config'
-
-COMPATIBLE_MACHINE = "(ccimx93)"
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-security/optee-imx/optee-client_4.0.0.imx.bb
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-security/optee-imx/optee-client_4.0.0.imx.bb
@ -0,0 +1,13 @@
+# Copyright 2023 Digi International Inc.
+
+#
+# Reuse meta-freescale's optee-client_3.19.0.imx.bb
+#
+require recipes-security/optee-imx/optee-client_3.19.0.imx.bb
+
+SRCBRANCH = "lf-6.1.55_2.2.0"
+SRCREV = "acb0885c117e73cb6c5c9b1dd9054cb3f93507ee"
+
+EXTRA_OEMAKE += "PKG_CONFIG=pkg-config"
+
+COMPATIBLE_MACHINE = "(ccimx93)"
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-security/optee-imx/optee-os/0001-core-imx-support-ccimx93-dvk.patch
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-security/optee-imx/optee-os/0001-core-imx-support-ccimx93-dvk.patch
@ -2,25 +2,28 @@ From: Javier Viguera <javier.viguera@digi.com>
 Date: Mon, 15 May 2023 17:59:54 +0200
 Subject: [PATCH] core: imx: support ccimx93-dvk

+SOC revision A0 requires a different build.
+
 Signed-off-by: Javier Viguera <javier.viguera@digi.com>
 ---
- core/arch/arm/plat-imx/conf.mk           | 6 ++++++
- core/arch/arm/plat-imx/registers/imx93.h | 1 +
- 2 files changed, 7 insertions(+)
+ core/arch/arm/plat-imx/conf.mk           | 13 +++++++++++++
+ core/arch/arm/plat-imx/registers/imx93.h |  5 +++++
+ 2 files changed, 18 insertions(+)

 diff --git a/core/arch/arm/plat-imx/conf.mk b/core/arch/arm/plat-imx/conf.mk
-index 1d5081f96afe..5e2d0733dd04 100644
+index 0bd9ccd6bef1..5e4c02e27d2e 100644
 --- a/core/arch/arm/plat-imx/conf.mk
 +++ b/core/arch/arm/plat-imx/conf.mk
-@@ -88,6 +88,7 @@ mx8ulp-flavorlist = \
+@@ -88,6 +88,8 @@ mx8ulp-flavorlist = \
 	mx8ulpevk \
 
 mx93-flavorlist = \
 +	ccimx93dvk \
+	ccimx93dvk_a0 \
 	mx93evk \
 
 ifneq (,$(filter $(PLATFORM_FLAVOR),$(mx6ul-flavorlist)))
-@@ -449,6 +450,11 @@ CFG_DDR_SIZE ?= 0x80000000
+@@ -451,6 +453,17 @@ CFG_DDR_SIZE ?= 0x80000000
 CFG_UART_BASE ?= UART1_BASE
 endif
 
@ -28,19 +31,34 @@ index 1d5081f96afe..5e2d0733dd04 100644
 +CFG_DDR_SIZE ?= 0x40000000
 +CFG_UART_BASE ?= UART6_BASE
 +endif
+
+ifneq (,$(filter $(PLATFORM_FLAVOR),ccimx93dvk_a0))
+CFG_DDR_SIZE ?= 0x40000000
+CFG_UART_BASE ?= UART6_BASE
+$(call force,CFG_SOC_REV_A0,y)
+endif
 +
 # i.MX6 Solo/SL/SoloX/DualLite/Dual/Quad specific config
 ifeq ($(filter y, $(CFG_MX6QP) $(CFG_MX6Q) $(CFG_MX6D) $(CFG_MX6DL) $(CFG_MX6S) \
 	$(CFG_MX6SL) $(CFG_MX6SLL) $(CFG_MX6SX)), y)
 diff --git a/core/arch/arm/plat-imx/registers/imx93.h b/core/arch/arm/plat-imx/registers/imx93.h
-index e91607537380..66a6408109c2 100644
+index 21080da82d04..29070eb917ac 100644
 --- a/core/arch/arm/plat-imx/registers/imx93.h
 +++ b/core/arch/arm/plat-imx/registers/imx93.h
-@@ -9,6 +9,7 @@
+@@ -9,11 +9,16 @@
 #define GICR_BASE 0x48040000
 
 #define UART1_BASE 0x44380000
 +#define UART6_BASE 0x425a0000
- #define MU_BASE	   0x47520000
+ /*
+  * For Normal MU - Use MU_BASE as 0x47520000
+  * For Trust MU - Use MU_BASE as 0x47530000
+  */
+#ifdef CFG_SOC_REV_A0
+#define MU_BASE 0x47520000
+#else
+ #define MU_BASE 0x47530000
+#endif
 #define MU_SIZE	   0x10000
 
+ #define MU_TRUST_BASE 0x47530000
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-security/optee-imx/optee-os_3.21.0.imx.bb
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-security/optee-imx/optee-os_3.21.0.imx.bb
@ -10,9 +10,19 @@ SRC_URI = " \
    file://0007-allow-setting-sysroot-for-clang.patch \
    file://0001-core-imx-support-ccimx93-dvk.patch \
 "
-SRCBRANCH = "lf-6.1.22_2.0.0"
-SRCREV = "1962aec9581760803b1485d455cd62cb11c14870"
+SRCBRANCH = "lf-6.1.55_2.2.0"
+# Tag: lf-6.1.55-2.2.0
+SRCREV = "a303fc80f7c4bd713315687a1fa1d6ed136e78ee"

 PLATFORM_FLAVOR:ccimx93 = "ccimx93dvk"

+do_compile:append:ccimx93 () {
+    oe_runmake PLATFORM=imx-${PLATFORM_FLAVOR}_a0 O=${B}-A0 all
+}
+do_compile[cleandirs] += "${B}-A0"
+
+do_deploy:append:ccimx93 () {
+    cp ${B}-A0/core/tee-raw.bin ${DEPLOYDIR}/tee.${PLATFORM_FLAVOR}_a0.bin
+}
+
 COMPATIBLE_MACHINE = "(ccimx93)"
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-security/optee-imx/optee-test_3.21.0.imx.bb
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-security/optee-imx/optee-test_3.21.0.imx.bb
@ -5,7 +5,9 @@
 #
 require recipes-security/optee-imx/optee-test_3.19.0.imx.bb

-SRCBRANCH = "lf-6.1.22_2.0.0"
-SRCREV = "c2c9f922044d2c8a7ab384812bb124c6da2b7888"
+DEPENDS += "openssl"
+
+SRCBRANCH = "lf-6.1.55_2.2.0"
+SRCREV = "38efacef3b14b32a6792ceaebe211b5718536fbb"

 COMPATIBLE_MACHINE = "(ccimx93)"
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-support/opencv/opencv/0001-3rdparty-ippicv-Use-pre-downloaded-ipp.patch
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-support/opencv/opencv/0001-3rdparty-ippicv-Use-pre-downloaded-ipp.patch
@ -0,0 +1,36 @@
+From 9b4959b97d2e95d4b49cf6ca2a3fce3cdb484f2d Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
+Date: Thu, 31 Mar 2016 00:20:15 +0200
+Subject: [PATCH] 3rdparty/ippicv: Use pre-downloaded ipp
+
+Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
+Signed-off-by: Ismo Puustinen <ismo.puustinen@intel.com>
+
+---
+ 3rdparty/ippicv/ippicv.cmake | 15 +--------------
+ 1 file changed, 1 insertion(+), 14 deletions(-)
+
+diff --git a/3rdparty/ippicv/ippicv.cmake b/3rdparty/ippicv/ippicv.cmake
+index 257af6fcc6..f88460450f 100644
+--- a/3rdparty/ippicv/ippicv.cmake
+++ b/3rdparty/ippicv/ippicv.cmake
+@@ -34,18 +34,5 @@ function(download_ippicv root_var)
+   endif()
+ 
+   set(THE_ROOT "${OpenCV_BINARY_DIR}/3rdparty/ippicv")
+-  ocv_download(FILENAME ${OPENCV_ICV_NAME}
+-               HASH ${OPENCV_ICV_HASH}
+-               URL
+-                 "${OPENCV_IPPICV_URL}"
+-                 "$ENV{OPENCV_IPPICV_URL}"
+-                 "https://raw.githubusercontent.com/opencv/opencv_3rdparty/${IPPICV_COMMIT}/ippicv/"
+-               DESTINATION_DIR "${THE_ROOT}"
+-               ID IPPICV
+-               STATUS res
+-               UNPACK RELATIVE_URL)
+-
+-  if(res)
+-    set(${root_var} "${THE_ROOT}/${OPENCV_ICV_PACKAGE_SUBDIR}" PARENT_SCOPE)
+-  endif()
+  set(${root_var} "${THE_ROOT}/${OPENCV_ICV_PACKAGE_SUBDIR}" PARENT_SCOPE)
+ endfunction()
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-support/opencv/opencv/0001-Add-smaller-version-of-download_models.py.patch
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-support/opencv/opencv/0001-Add-smaller-version-of-download_models.py.patch
@ -0,0 +1,179 @@
+From fca4d9eec289f22c081daa2c61a1110e3f268f92 Mon Sep 17 00:00:00 2001
+From: Tom Hochstein <tom.hochstein@nxp.com>
+Date: Tue, 1 Sep 2020 14:57:07 -0500
+Subject: [PATCH] Add smaller version of download_models.py
+
+Signed-off-by: Tom Hochstein <tom.hochstein@nxp.com>
+---
+ testdata/dnn/download_models_basic.py | 159 ++++++++++++++++++++++++++
+ 1 file changed, 159 insertions(+)
+ create mode 100644 testdata/dnn/download_models_basic.py
+
+diff --git a/testdata/dnn/download_models_basic.py b/testdata/dnn/download_models_basic.py
+new file mode 100644
+index 0000000..5c8a616
+--- /dev/null
+++ b/testdata/dnn/download_models_basic.py
+@@ -0,0 +1,159 @@
+#!/usr/bin/env python
+
+from __future__ import print_function
+import hashlib
+import sys
+import tarfile
+if sys.version_info[0] < 3:
+    from urllib2 import urlopen
+else:
+    from urllib.request import urlopen
+
+
+class Model:
+    MB = 1024*1024
+    BUFSIZE = 10*MB
+
+    def __init__(self, **kwargs):
+        self.name = kwargs.pop('name')
+        self.url = kwargs.pop('url', None)
+        self.filename = kwargs.pop('filename')
+        self.sha = kwargs.pop('sha', None)
+        self.archive = kwargs.pop('archive', None)
+        self.member = kwargs.pop('member', None)
+
+    def __str__(self):
+        return 'Model <{}>'.format(self.name)
+
+    def printRequest(self, r):
+        def getMB(r):
+            d = dict(r.info())
+            for c in ['content-length', 'Content-Length']:
+                if c in d:
+                    return int(d[c]) / self.MB
+            return '<unknown>'
+        print('  {} {} [{} Mb]'.format(r.getcode(), r.msg, getMB(r)))
+
+    def verify(self):
+        if not self.sha:
+            return False
+        print('  expect {}'.format(self.sha))
+        sha = hashlib.sha1()
+        try:
+            with open(self.filename, 'rb') as f:
+                while True:
+                    buf = f.read(self.BUFSIZE)
+                    if not buf:
+                        break
+                    sha.update(buf)
+            print('  actual {}'.format(sha.hexdigest()))
+            return self.sha == sha.hexdigest()
+        except Exception as e:
+            print('  catch {}'.format(e))
+
+    def get(self):
+        if self.verify():
+            print('  hash match - skipping')
+            return True
+
+        if self.archive or self.member:
+            assert(self.archive and self.member)
+            print('  hash check failed - extracting')
+            print('  get {}'.format(self.member))
+            self.extract()
+        else:
+            assert(self.url)
+            print('  hash check failed - downloading')
+            print('  get {}'.format(self.url))
+            self.download()
+
+        print(' done')
+        print(' file {}'.format(self.filename))
+        return self.verify()
+
+    def download(self):
+        try:
+            r = urlopen(self.url, timeout=60)
+            self.printRequest(r)
+            self.save(r)
+        except Exception as e:
+            print('  catch {}'.format(e))
+
+    def extract(self):
+        try:
+            with tarfile.open(self.archive) as f:
+                assert self.member in f.getnames()
+                self.save(f.extractfile(self.member))
+        except Exception as e:
+            print('  catch {}'.format(e))
+
+    def save(self, r):
+        with open(self.filename, 'wb') as f:
+            print('  progress ', end='')
+            sys.stdout.flush()
+            while True:
+                buf = r.read(self.BUFSIZE)
+                if not buf:
+                    break
+                f.write(buf)
+                print('>', end='')
+                sys.stdout.flush()
+
+models = [
+    Model(
+        name='Fcn',
+        url='http://dl.caffe.berkeleyvision.org/fcn8s-heavy-pascal.caffemodel',
+        sha='c449ea74dd7d83751d1357d6a8c323fcf4038962',
+        filename='fcn8s-heavy-pascal.caffemodel'),
+    Model(
+        name='SqueezeNet_v1.1',
+        url='https://raw.githubusercontent.com/DeepScale/SqueezeNet/b5c3f1a23713c8b3fd7b801d229f6b04c64374a5/SqueezeNet_v1.1/squeezenet_v1.1.caffemodel',
+        sha='3397f026368a45ae236403ccc81cfcbe8ebe1bd0',
+        filename='squeezenet_v1.1.caffemodel'),
+    Model(
+        name='Colorization',
+        url='https://raw.githubusercontent.com/richzhang/colorization/master/models/colorization_deploy_v2.prototxt',
+        sha='f528334e386a69cbaaf237a7611d833bef8e5219',
+        filename='colorization_deploy_v2.prototxt'),
+    Model(
+        name='Colorization',
+        url='http://eecs.berkeley.edu/~rich.zhang/projects/2016_colorization/files/demo_v2/colorization_release_v2.caffemodel',
+        sha='21e61293a3fa6747308171c11b6dd18a68a26e7f',
+        filename='colorization_release_v2.caffemodel'),
+    Model(
+        name='OpenPose/pose/coco',  # https://github.com/CMU-Perceptual-Computing-Lab/openpose
+        url='http://posefs1.perception.cs.cmu.edu/OpenPose/models/pose/coco/pose_iter_440000.caffemodel',
+        sha='ac7e97da66f3ab8169af2e601384c144e23a95c1',
+        filename='openpose_pose_coco.caffemodel'),
+    Model(
+        name='YOLOv3',  # https://pjreddie.com/darknet/yolo/
+        url='https://pjreddie.com/media/files/yolov3.weights',
+        sha='520878f12e97cf820529daea502acca380f1cb8e',
+        filename='yolov3.weights'),
+    Model(
+        name='EAST',  # https://github.com/argman/EAST (a TensorFlow model), https://arxiv.org/abs/1704.03155v2 (a paper)
+        url='https://www.dropbox.com/s/r2ingd0l3zt8hxs/frozen_east_text_detection.tar.gz?dl=1',
+        sha='3ca8233d6edd748f7ed23246c8ca24cbf696bb94',
+        filename='frozen_east_text_detection.tar.gz'),
+    Model(
+        name='EAST',
+        archive='frozen_east_text_detection.tar.gz',
+        member='frozen_east_text_detection.pb',
+        sha='fffabf5ac36f37bddf68e34e84b45f5c4247ed06',
+        filename='frozen_east_text_detection.pb'),
+]
+
+# Note: models will be downloaded to current working directory
+#       expected working directory is opencv_extra/testdata/dnn
+if __name__ == '__main__':
+    failedModels = []
+    for m in models:
+        print(m)
+        if not m.get():
+            failedModels.append(m.filename)
+
+    if failedModels:
+        print("Following models have not been downloaded:")
+        for f in failedModels:
+            print("* {}".format(f))
+        exit(15)
+-- 
+2.17.1
+
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-support/opencv/opencv/0001-Dont-use-isystem.patch
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-support/opencv/opencv/0001-Dont-use-isystem.patch
@ -0,0 +1,28 @@
+From 66e50ee69fa9ee2469d349100e70d8b296c4b4dc Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Tue, 11 Sep 2018 00:21:18 -0700
+Subject: [PATCH] Dont use isystem
+
+clang really does not like it
+
+Upstream-Status: Pending
+
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+
+---
+ cmake/OpenCVPCHSupport.cmake | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/cmake/OpenCVPCHSupport.cmake b/cmake/OpenCVPCHSupport.cmake
+index 08cd06def4..46c9c02da3 100644
+--- a/cmake/OpenCVPCHSupport.cmake
+++ b/cmake/OpenCVPCHSupport.cmake
+@@ -18,6 +18,8 @@ IF(CV_GCC)
+         SET(PCHSupport_FOUND TRUE)
+     ENDIF()
+ 
+    SET(CMAKE_INCLUDE_SYSTEM_FLAG_C "-I")
+    SET(CMAKE_INCLUDE_SYSTEM_FLAG_CXX "-I")
+     SET(_PCH_include_prefix "-I")
+     SET(_PCH_isystem_prefix "-isystem")
+     SET(_PCH_define_prefix "-D")
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-support/opencv/opencv/0001-Make-ts-module-external.patch
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-support/opencv/opencv/0001-Make-ts-module-external.patch
@ -0,0 +1,42 @@
+From 11bbf909e08594628bd757d989ae34cf1bfe200b Mon Sep 17 00:00:00 2001
+From: Mingli Yu <mingli.yu@windriver.com>
+Date: Thu, 18 Jun 2020 05:51:38 +0000
+Subject: [PATCH] Make ts module external
+
+Make ts module external
+
+Reference: https://github.com/qbonnard/opencv/commit/6b229c5834cb9a0930425e762a6c7b03244d7abb
+
+Upstream-Status: Submitted [https://github.com/opencv/opencv/issues/8408]
+
+Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
+---
+ modules/ts/CMakeLists.txt | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/modules/ts/CMakeLists.txt b/modules/ts/CMakeLists.txt
+index f95bed0793..66f315bcca 100644
+--- a/modules/ts/CMakeLists.txt
+++ b/modules/ts/CMakeLists.txt
+@@ -4,9 +4,6 @@ if(NOT BUILD_opencv_ts AND NOT BUILD_TESTS AND NOT BUILD_PERF_TESTS)
+   ocv_module_disable(ts)
+ endif()
+ 
+-set(OPENCV_MODULE_TYPE STATIC)
+-set(OPENCV_MODULE_IS_PART_OF_WORLD FALSE)
+-
+ if(WINRT)
+   # WINRT doesn't have access to environment variables
+   # so adding corresponding macros during CMake run
+@@ -16,7 +13,7 @@ endif()
+ 
+ ocv_warnings_disable(CMAKE_CXX_FLAGS -Wundef)
+ 
+-ocv_add_module(ts INTERNAL opencv_core opencv_imgproc opencv_imgcodecs opencv_videoio opencv_highgui)
+ocv_add_module(ts opencv_core opencv_imgproc opencv_imgcodecs opencv_videoio opencv_highgui)
+ 
+ ocv_glob_module_sources()
+ ocv_module_include_directories()
+-- 
+2.24.1
+
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-support/opencv/opencv/0001-Temporarliy-work-around-deprecated-ffmpeg-RAW-functi.patch
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-support/opencv/opencv/0001-Temporarliy-work-around-deprecated-ffmpeg-RAW-functi.patch
@ -0,0 +1,31 @@
+From e4ec6cea72da9e9ae5ba57140fa2f5c63f1f8295 Mon Sep 17 00:00:00 2001
+From: Jason Wessel <jason.wessel@windriver.com>
+Date: Wed, 9 May 2018 13:33:59 -0700
+Subject: [PATCH] Temporarliy work around deprecated ffmpeg RAW function
+ compile failure until next uprev
+
+Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
+
+---
+ modules/videoio/src/cap_ffmpeg_impl.hpp | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/modules/videoio/src/cap_ffmpeg_impl.hpp b/modules/videoio/src/cap_ffmpeg_impl.hpp
+index 6dca724a89..ae55dd4555 100644
+--- a/modules/videoio/src/cap_ffmpeg_impl.hpp
+++ b/modules/videoio/src/cap_ffmpeg_impl.hpp
+@@ -774,6 +774,14 @@ struct ImplMutex::Impl
+ 
+ #endif
+ 
+/* NOTE This is deprecated in ffmpeg and the code should be removed */
+#ifndef AVFMT_RAWPICTURE
+#define AVFMT_RAWPICTURE	0x0020
+#endif /* AVFMT_RAWPICTURE */
+#ifndef CODEC_FLAG_GLOBAL_HEADER
+#define CODEC_FLAG_GLOBAL_HEADER	AV_CODEC_FLAG_GLOBAL_HEADER
+#endif
+
+ void ImplMutex::init()
+ {
+     impl = new Impl();
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-support/opencv/opencv/0003-To-fix-errors-as-following.patch
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-support/opencv/opencv/0003-To-fix-errors-as-following.patch
@ -0,0 +1,70 @@
+From f42c9b8c7bafcadc7e95fb25a391707f970eb426 Mon Sep 17 00:00:00 2001
+From: Huang Qiyu <huangqy.fnst@cn.fujitsu.com>
+Date: Fri, 19 May 2017 04:27:50 +0900
+Subject: [PATCH] To fix errors as following:
+
+"test_main.cpp:45: undefined reference to `parseCustomOptions(int, char**)'"
+"perf_abs.cpp:13: undefined reference to `cvtest::param_seed'"
+"test_superres.cpp:270: undefined reference to `checkIppStatus()'"
+
+Signed-off-by: Huang Qiyu <huangqy.fnst@cn.fujitsu.com>
+
+Also add the visibility changes for certain OpenCL-related functions in
+ts module.
+
+Signed-off-by: Ismo Puustinen <ismo.puustinen@intel.com>
+
+---
+ modules/ts/include/opencv2/ts.hpp          | 4 ++--
+ modules/ts/include/opencv2/ts/ocl_test.hpp | 2 +-
+ modules/ts/include/opencv2/ts/ts_ext.hpp   | 2 +-
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/modules/ts/include/opencv2/ts.hpp b/modules/ts/include/opencv2/ts.hpp
+index ed7491a89a..80919d13ee 100644
+--- a/modules/ts/include/opencv2/ts.hpp
+++ b/modules/ts/include/opencv2/ts.hpp
+@@ -728,7 +728,7 @@ protected:
+     }
+ };
+ 
+-extern uint64 param_seed;
+CV_EXPORTS extern uint64 param_seed;
+ 
+ struct DefaultRngAuto
+ {
+@@ -791,7 +791,7 @@ private:
+ #endif
+ #endif
+ 
+-void parseCustomOptions(int argc, char **argv);
+CV_EXPORTS void parseCustomOptions(int argc, char **argv);
+ 
+ #define CV_TEST_INIT0_NOOP (void)0
+ 
+diff --git a/modules/ts/include/opencv2/ts/ocl_test.hpp b/modules/ts/include/opencv2/ts/ocl_test.hpp
+index 11572e9f48..438112e2aa 100644
+--- a/modules/ts/include/opencv2/ts/ocl_test.hpp
+++ b/modules/ts/include/opencv2/ts/ocl_test.hpp
+@@ -82,7 +82,7 @@ inline UMat ToUMat(InputArray src)
+     return dst;
+ }
+ 
+-extern int test_loop_times;
+CV_EXPORTS extern int test_loop_times;
+ 
+ #define MAX_VALUE 357
+ 
+diff --git a/modules/ts/include/opencv2/ts/ts_ext.hpp b/modules/ts/include/opencv2/ts/ts_ext.hpp
+index b2a4cac241..b94c681c0c 100644
+--- a/modules/ts/include/opencv2/ts/ts_ext.hpp
+++ b/modules/ts/include/opencv2/ts/ts_ext.hpp
+@@ -9,7 +9,7 @@
+ #define OPENCV_TS_EXT_HPP
+ 
+ namespace cvtest {
+-void checkIppStatus();
+CV_EXPORTS void checkIppStatus();
+ extern bool skipUnstableTests;
+ extern bool runBigDataTests;
+ extern int testThreads;
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-support/opencv/opencv/OpenCV_DNN_examples.patch
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-support/opencv/opencv/OpenCV_DNN_examples.patch
@ -0,0 +1,141 @@
+From 3c4daafb54f961e376104a461ca7ec114ff0331a Mon Sep 17 00:00:00 2001
+From: Ludek Slosarcik <ludek.slosarcik@nxp.com>
+Date: Fri, 14 Feb 2020 15:46:50 +0100
+Subject: [PATCH] opencv_dnn: added video device for 2 examples, and change text labels
+
+Signed-off-by: Ludek Slosarcik <ludek.slosarcik@nxp.com>
+
+Upstream-Status: Pending
+---
+ samples/cpp/logistic_regression.cpp |  2 +-
+ samples/dnn/classification.cpp      |  7 ++++---
+ samples/dnn/object_detection.cpp    | 10 +++++-----
+ samples/dnn/segmentation.cpp        |  2 +-
+ samples/dnn/text_detection.cpp      |  5 +++--
+ 5 files changed, 14 insertions(+), 12 deletions(-)
+
+Index: git/samples/cpp/logistic_regression.cpp
+===================================================================
+--- git.orig/samples/cpp/logistic_regression.cpp
+++ git/samples/cpp/logistic_regression.cpp
+@@ -28,7 +28,7 @@ static float calculateAccuracyPercent(co
+ 
+ int main()
+ {
+-    const String filename = samples::findFile("data01.xml");
+    const String filename = samples::findFile("../data/data01.xml");
+     cout << "**********************************************************************" << endl;
+     cout << filename
+          << " contains digits 0 and 1 of 20 samples each, collected on an Android device" << endl;
+Index: git/samples/dnn/classification.cpp
+===================================================================
+--- git.orig/samples/dnn/classification.cpp
+++ git/samples/dnn/classification.cpp
+@@ -12,6 +12,7 @@ std::string keys =
+     "{ help  h          | | Print help message. }"
+     "{ @alias           | | An alias name of model to extract preprocessing parameters from models.yml file. }"
+     "{ zoo              | models.yml | An optional path to file with preprocessing parameters }"
+    "{ device           | 0 | camera device number. }"
+     "{ input i          | | Path to input image or video file. Skip this argument to capture frames from a camera.}"
+     "{ initial_width    | 0 | Preprocess input image by initial resizing to a specific width.}"
+     "{ initial_height   | 0 | Preprocess input image by initial resizing to a specific height.}"
+@@ -113,7 +114,7 @@ int main(int argc, char** argv)
+     if (parser.has("input"))
+         cap.open(parser.get<String>("input"));
+     else
+-        cap.open(0);
+        cap.open(parser.get<int>("device"));
+     //! [Open a video file or an image file or a camera stream]
+ 
+     // Process frames.
+@@ -195,14 +196,14 @@ int main(int argc, char** argv)
+         }
+         std::string label = format("Inference time of 1 round: %.2f ms", t1);
+         std::string label2 = format("Average time of 200 rounds: %.2f ms", timeRecorder.getTimeMilli()/200);
+-        putText(frame, label, Point(0, 15), FONT_HERSHEY_SIMPLEX, 0.5, Scalar(0, 255, 0));
+-        putText(frame, label2, Point(0, 35), FONT_HERSHEY_SIMPLEX, 0.5, Scalar(0, 255, 0));
+        putText(frame, label, Point(0, 20), FONT_HERSHEY_SIMPLEX, 0.8, Scalar(0, 0, 255), 2, 8, false);
+        putText(frame, label2, Point(0, 45), FONT_HERSHEY_SIMPLEX, 0.8, Scalar(0, 0, 255), 2, 8, false);
+ 
+         // Print predicted class.
+         label = format("%s: %.4f", (classes.empty() ? format("Class #%d", classId).c_str() :
+                                                       classes[classId].c_str()),
+                                    confidence);
+-        putText(frame, label, Point(0, 55), FONT_HERSHEY_SIMPLEX, 0.5, Scalar(0, 255, 0));
+        putText(frame, label, Point(0, 70), FONT_HERSHEY_SIMPLEX, 0.8, Scalar(0, 0, 255), 2, 8, false);
+ 
+         imshow(kWinName, frame);
+     }
+Index: git/samples/dnn/object_detection.cpp
+===================================================================
+--- git.orig/samples/dnn/object_detection.cpp
+++ git/samples/dnn/object_detection.cpp
+@@ -260,13 +260,13 @@ int main(int argc, char** argv)
+         if (predictionsQueue.counter > 1)
+         {
+             std::string label = format("Camera: %.2f FPS", framesQueue.getFPS());
+-            putText(frame, label, Point(0, 15), FONT_HERSHEY_SIMPLEX, 0.5, Scalar(0, 255, 0));
+            putText(frame, label, Point(0, 20), FONT_HERSHEY_SIMPLEX, 0.8, Scalar(0, 0, 255), 2, 8, false);
+ 
+             label = format("Network: %.2f FPS", predictionsQueue.getFPS());
+-            putText(frame, label, Point(0, 30), FONT_HERSHEY_SIMPLEX, 0.5, Scalar(0, 255, 0));
+            putText(frame, label, Point(0, 45), FONT_HERSHEY_SIMPLEX, 0.8, Scalar(0, 0, 255), 2, 8, false);
+ 
+             label = format("Skipped frames: %d", framesQueue.counter - predictionsQueue.counter);
+-            putText(frame, label, Point(0, 45), FONT_HERSHEY_SIMPLEX, 0.5, Scalar(0, 255, 0));
+            putText(frame, label, Point(0, 70), FONT_HERSHEY_SIMPLEX, 0.8, Scalar(0, 0, 255), 2, 8, false);
+         }
+         imshow(kWinName, frame);
+     }
+@@ -302,7 +302,7 @@ int main(int argc, char** argv)
+         double freq = getTickFrequency() / 1000;
+         double t = net.getPerfProfile(layersTimes) / freq;
+         std::string label = format("Inference time: %.2f ms", t);
+-        putText(frame, label, Point(0, 15), FONT_HERSHEY_SIMPLEX, 0.5, Scalar(0, 255, 0));
+        putText(frame, label, Point(0, 20), FONT_HERSHEY_SIMPLEX, 0.8, Scalar(0, 0, 255), 2, 8, false);
+ 
+         imshow(kWinName, frame);
+     }
+@@ -471,7 +471,7 @@ void drawPred(int classId, float conf, i
+     top = max(top, labelSize.height);
+     rectangle(frame, Point(left, top - labelSize.height),
+               Point(left + labelSize.width, top + baseLine), Scalar::all(255), FILLED);
+-    putText(frame, label, Point(left, top), FONT_HERSHEY_SIMPLEX, 0.5, Scalar());
+    putText(frame, label, Point(left, top), FONT_HERSHEY_SIMPLEX, 0.8, Scalar());
+ }
+ 
+ void callback(int pos, void*)
+Index: git/samples/dnn/segmentation.cpp
+===================================================================
+--- git.orig/samples/dnn/segmentation.cpp
+++ git/samples/dnn/segmentation.cpp
+@@ -162,7 +162,7 @@ int main(int argc, char** argv)
+         double freq = getTickFrequency() / 1000;
+         double t = net.getPerfProfile(layersTimes) / freq;
+         std::string label = format("Inference time: %.2f ms", t);
+-        putText(frame, label, Point(0, 15), FONT_HERSHEY_SIMPLEX, 0.5, Scalar(0, 255, 0));
+        putText(frame, label, Point(0, 20), FONT_HERSHEY_SIMPLEX, 0.8, Scalar(0, 0, 255), 2, 8, false);
+ 
+         imshow(kWinName, frame);
+         if (!classes.empty())
+Index: git/samples/dnn/text_detection.cpp
+===================================================================
+--- git.orig/samples/dnn/text_detection.cpp
+++ git/samples/dnn/text_detection.cpp
+@@ -30,6 +30,7 @@ using namespace cv::dnn;
+ const char* keys =
+     "{ help  h              | | Print help message. }"
+     "{ input i              | | Path to input image or video file. Skip this argument to capture frames from a camera.}"
+    "{ device               | 0 | camera device number. }"
+     "{ detModel dmp         | | Path to a binary .pb file contains trained detector network.}"
+     "{ width                | 320 | Preprocess input image by resizing to a specific width. It should be multiple by 32. }"
+     "{ height               | 320 | Preprocess input image by resizing to a specific height. It should be multiple by 32. }"
+@@ -106,7 +107,7 @@ int main(int argc, char** argv)
+ 
+     // Open a video file or an image file or a camera stream.
+     VideoCapture cap;
+-    bool openSuccess = parser.has("input") ? cap.open(parser.get<String>("input")) : cap.open(0);
+    bool openSuccess = parser.has("input") ? cap.open(parser.get<String>("input")) : cap.open(parser.get<int>("device"));
+     CV_Assert(openSuccess);
+ 
+     static const std::string kWinName = "EAST: An Efficient and Accurate Scene Text Detector";
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-support/opencv/opencv/download.patch
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-support/opencv/opencv/download.patch
@ -0,0 +1,41 @@
+From b18a280fab06a680d9f831bf8b462647f3cb6214 Mon Sep 17 00:00:00 2001
+From: Ross Burton <ross.burton@intel.com>
+Date: Thu, 9 Jan 2020 16:24:24 +0000
+Subject: [PATCH] opencv: abort configure if we need to download
+
+This CMake module will download files during do_configure.  This is bad as it
+means we can't do offline builds.
+
+Add an option to disallow downloads by emitting a fatal error.
+
+Upstream-Status: Pending
+Signed-off-by: Ross Burton <ross.burton@intel.com>
+
+---
+ cmake/OpenCVDownload.cmake | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/cmake/OpenCVDownload.cmake b/cmake/OpenCVDownload.cmake
+index 63cf6d3238..4acf477f70 100644
+--- a/cmake/OpenCVDownload.cmake
+++ b/cmake/OpenCVDownload.cmake
+@@ -14,6 +14,7 @@
+ #    RELATIVE_URL - if set, then URL is treated as a base, and FILENAME will be appended to it
+ #  Note: uses OPENCV_DOWNLOAD_PATH folder as cache, default is <opencv>/.cache
+ 
+set(OPENCV_ALLOW_DOWNLOADS ON CACHE BOOL "Allow downloads")
+ set(HELP_OPENCV_DOWNLOAD_PATH "Cache directory for downloaded files")
+ if(DEFINED ENV{OPENCV_DOWNLOAD_PATH})
+   set(OPENCV_DOWNLOAD_PATH "$ENV{OPENCV_DOWNLOAD_PATH}" CACHE PATH "${HELP_OPENCV_DOWNLOAD_PATH}")
+@@ -156,6 +157,11 @@ function(ocv_download)
+ 
+   # Download
+   if(NOT EXISTS "${CACHE_CANDIDATE}")
+    if(NOT OPENCV_ALLOW_DOWNLOADS)
+      message(FATAL_ERROR "Not going to download ${DL_FILENAME}")
+      return()
+    endif()
+
+     ocv_download_log("#cmake_download \"${CACHE_CANDIDATE}\" \"${DL_URL}\"")
+     foreach(try ${OPENCV_DOWNLOAD_TRIES_LIST})
+       ocv_download_log("#try ${try}")
--- a/meta-digi-arm/dynamic-layers/freescale-layer/recipes-support/opencv/opencv_4.7.0.imx.bb
+++ b/meta-digi-arm/dynamic-layers/freescale-layer/recipes-support/opencv/opencv_4.7.0.imx.bb
@ -0,0 +1,23 @@
+# Copyright 2024 Digi International Inc.
+
+#
+# Reuse meta-freescale's opencv_4.6.0.imx.bb
+#
+require recipes-support/opencv/opencv_4.6.0.imx.bb
+
+SRC_URI:remove = "file://0001-Add-missing-header-for-LIBAVCODEC_VERSION_INT.patch"
+
+SRCBRANCH = "4.7.0_imx"
+SRCREV_opencv = "3acf6a50fcb4f774728d2338553ad646ccc14b14"
+
+# Update opencv_contrib
+SRC_URI:remove = "git://github.com/opencv/opencv_contrib.git;destsuffix=git/contrib;name=contrib;branch=master;protocol=https"
+SRC_URI += "git://github.com/opencv/opencv_contrib.git;destsuffix=git/contrib;name=contrib;branch=4.x;protocol=https"
+SRCREV_contrib = "e247b680a6bd396f110274b6c214406a93171350"
+
+SRC_URI:remove = "git://github.com/opencv/opencv_extra.git;destsuffix=extra;name=extra;branch=master;protocol=https"
+SRC_URI =+ "git://github.com/opencv/opencv_extra.git;destsuffix=extra;name=extra;branch=4.x;protocol=https"
+
+SRCREV_extra = "5abbd7e0546bbb34ae7487170383d3e571fb1dd1"
+
+COMPATIBLE_MACHINE = "(mx9-nxp-bsp)"
--- a/meta-digi-arm/dynamic-layers/stm-st-stm32mp/recipes-bsp/trusted-firmware-a/tf-a-stm32mp_%.bbappend
+++ b/meta-digi-arm/dynamic-layers/stm-st-stm32mp/recipes-bsp/trusted-firmware-a/tf-a-stm32mp_%.bbappend
@ -74,7 +74,7 @@ do_deploy:append() {
 		i="$(expr ${i} + 1)"
 		dt_config="$(echo ${FIP_DEVICETREE} | cut -d',' -f${i})"
 		for dt in ${dt_config}; do
-			FIP_FILENAME="${FIP_BASENAME}-${dt}-${config}.${FIP_SUFFIX}"
+			FIP_FILENAME="${FIP_BASENAME}-${dt}-${config}${FIP_SIGN_SUFFIX}.${FIP_SUFFIX}"
 			echo "${FIP_FILENAME}"
 			if [ -f "${DEPLOYDIR}/fip/${FIP_FILENAME}" ]; then
 				cd "${DEPLOYDIR}"
@ -104,9 +104,11 @@ tfa_sign() {
 				bl2)
 					TF_A_FILENAME="${tfa_basename}-${dt}-${config}.${TF_A_SUFFIX}"
 					if [ -f "${DEPLOYDIR}/arm-trusted-firmware/${TF_A_FILENAME}" ]; then
-						trustfence-sign-artifact.sh -p "${DIGI_SOM}" -t "${DEPLOYDIR}/arm-trusted-firmware/${TF_A_FILENAME}" "${DEPLOYDIR}/arm-trusted-firmware/${TF_A_FILENAME}_signed"
+						trustfence-sign-artifact.sh -p "${DIGI_SOM}" -t "${DEPLOYDIR}/arm-trusted-firmware/${TF_A_FILENAME}" "${DEPLOYDIR}/arm-trusted-firmware/${TF_A_FILENAME}${TFA_SIGN_SUFFIX}"
 						# the generated artifact lacks 'w' permission which prevents deletion by the build system
-						chmod u+w "${DEPLOYDIR}/arm-trusted-firmware/${TF_A_FILENAME}_signed"
+						chmod u+w "${DEPLOYDIR}/arm-trusted-firmware/${TF_A_FILENAME}${TFA_SIGN_SUFFIX}"
+						# symlink TF-A
+						ln -s "arm-trusted-firmware/${TF_A_FILENAME}${TFA_SIGN_SUFFIX}" "${DEPLOYDIR}/"
 					fi
 				esac
 			done # for file_type in ${tfa_file_type}
--- a/meta-digi-arm/recipes-bsp/firmware-qualcomm/firmware-qualcomm.bb
+++ b/meta-digi-arm/recipes-bsp/firmware-qualcomm/firmware-qualcomm.bb
@ -144,4 +144,4 @@ FILES:${PN}-${QCA_MODEL}-bt = "/lib/firmware/qca"
 FILES:${PN}-${QCA_MODEL}-wifi = "/lib/firmware"

 PACKAGE_ARCH = "${MACHINE_ARCH}"
-COMPATIBLE_MACHINE = "(ccimx6$|ccimx6ul|ccimx8x|ccimx8m)"
+COMPATIBLE_MACHINE = "(ccimx6$|ccimx6ul|ccimx8m|ccimx8x)"
--- a/meta-digi-arm/recipes-bsp/libubootenv/libubootenv/0005-Implement-support-for-environment-encryption-for-CCM.patch
+++ b/meta-digi-arm/recipes-bsp/libubootenv/libubootenv/0005-Implement-support-for-environment-encryption-for-CCM.patch
@ -1,4 +1,4 @@
-From 89b035959578fe0d7714748487dad875bc018ef5 Mon Sep 17 00:00:00 2001
+From 768cac09ee47729e3ef38b477c7a69e5b3d10c60 Mon Sep 17 00:00:00 2001
 From: Mike Engel <Mike.Engel@digi.com>
 Date: Fri, 26 May 2023 11:21:43 +0200
 Subject: [PATCH] Implement support for environment encryption for CCMP1
@ -19,8 +19,8 @@ Signed-off-by: Mike Engel <Mike.Engel@digi.com>
 src/teec_benchmark.h            |  37 ++
 src/teec_trace.c                | 141 +++++
 src/teec_trace.h                | 148 +++++
- src/uboot_env.c                 | 181 +++++-
- 11 files changed, 2655 insertions(+), 4 deletions(-)
+ src/uboot_env.c                 | 180 +++++-
+ 11 files changed, 2654 insertions(+), 4 deletions(-)
 create mode 100644 src/ta_ccmp1_aes.h
 create mode 100644 src/tee.h
 create mode 100644 src/tee_bench.h
@ -2576,7 +2576,7 @@ index 0000000..b1e37ec
 +
 +#endif
 diff --git a/src/uboot_env.c b/src/uboot_env.c
-index 86f9b9e..f9aa985 100644
+index 86f9b9e..45b356f 100644
 --- a/src/uboot_env.c
 +++ b/src/uboot_env.c
@@ -41,6 +41,9 @@
@ -2598,15 +2598,7 @@ index 86f9b9e..f9aa985 100644
 {
 	int i;
 	int len;
-@@ -993,6 +996,7 @@ static int env_caam_get_keymod(unsigned char output[16])
- 				return -1;
- 			}
- 			ocotp_hwid[i] = ntohl(*(uint32_t *)buf);
-+			fprintf(stderr, "HWID_%d %x \n ",i,ocotp_hwid[i]);
- 			close(fd);
- 		} else if (machine_is_compatible("digi,ccimx6ul") ||
- 			   machine_is_compatible("digi,ccimx6")) {
-@@ -1040,7 +1044,7 @@ static int env_caam_crypt(char *data, unsigned int size, const int enc)
+@@ -1040,7 +1043,7 @@ static int env_caam_crypt(char *data, unsigned int size, const int enc)
 	char *buffer;
 	unsigned char key_modifier[16];
 
@ -2615,7 +2607,7 @@ index 86f9b9e..f9aa985 100644
 	if (ret)
 		return ret;
 
-@@ -1087,6 +1091,165 @@ free:
+@@ -1087,6 +1090,165 @@ free:
 	return ret;
 }
 
@ -2781,7 +2773,7 @@ index 86f9b9e..f9aa985 100644
 int libuboot_env_store(struct uboot_ctx *ctx)
 {
 	struct var_entry *entry;
-@@ -1163,7 +1326,12 @@ int libuboot_env_store(struct uboot_ctx *ctx)
+@@ -1163,7 +1325,12 @@ int libuboot_env_store(struct uboot_ctx *ctx)
 	}
 
 	if (ctx->encrypted) {
@ -2795,7 +2787,7 @@ index 86f9b9e..f9aa985 100644
 		if (ret) {
 			fprintf(stderr,
 				"Error: can't encrypt env for flash\n");
-@@ -1237,7 +1405,12 @@ static int libuboot_load(struct uboot_ctx *ctx)
+@@ -1237,7 +1404,12 @@ static int libuboot_load(struct uboot_ctx *ctx)
 		crc = *(uint32_t *)(buf[i] + offsetcrc);
 		dev->crc = crc32(0, (uint8_t *)data, usable_envsize);
 		if (ctx->encrypted) {
--- a/meta-digi-arm/recipes-bsp/libubootenv/libubootenv/ccimx93/mmc/fw_env.config
+++ b/meta-digi-arm/recipes-bsp/libubootenv/libubootenv/ccimx93/mmc/fw_env.config
@ -0,0 +1,7 @@
+# Configuration file for fw_(printenv/setenv) utility.
+# Up to two entries are valid, in this case the redundant
+# environment sector is assumed present.
+
+# Device name        Offset	 Size
+/dev/mmcblk0boot0    -0x4000    0x4000
+/dev/mmcblk0boot1    -0x4000    0x4000
--- a/meta-digi-arm/recipes-bsp/trustfence-cst/nativesdk-trustfence-cst_3.3.2.bb
+++ b/meta-digi-arm/recipes-bsp/trustfence-cst/nativesdk-trustfence-cst_3.3.2.bb
--- a/meta-digi-arm/recipes-bsp/trustfence-cst/trustfence-cst-3.3.2.inc
+++ b/meta-digi-arm/recipes-bsp/trustfence-cst/trustfence-cst-3.3.2.inc
@ -1,4 +1,4 @@
-# Copyright (C) 2017-2022 Digi International
+# Copyright (C) 2017-2023 Digi International

 SUMMARY = "NXP Code signing Tool for the High Assurance Boot library"
 DESCRIPTION = "Provides software code signing support designed for use with \
@ -9,32 +9,28 @@ LIC_FILES_CHKSUM = "file://LICENSE.bsd3;md5=1fbcd66ae51447aa94da10cbf6271530"

 DEPENDS = "byacc-native flex-native"

-OPENSSL1_VERSION = "1.1.1s"
+OPENSSL1_VERSION = "1.1.1t"

 SRC_URI = " \
    ${DIGI_PKG_SRC}/cst-${PV}.tgz;name=cst \
    https://www.openssl.org/source/openssl-${OPENSSL1_VERSION}.tar.gz;name=openssl \
    file://0001-gen_auth_encrypted_data-reuse-existing-DEK-file.patch \
-    file://0002-hab4_pki_tree.sh-automate-script.patch \
-    file://0003-openssl_helper-use-dev-urandom-as-seed-source.patch \
-    file://0004-hab4_pki_tree.sh-usa-a-random-password-for-the-defau.patch \
-    file://0005-ahab_pki_tree.sh-automate-script.patch \
-    file://0006-ahab_pki_tree.sh-use-a-random-password-for-the-defau.patch \
-    file://0007-rules.mk-weaken-specific-function-err_msg.patch \
-    file://0008-pki_tree.sh-extract-public-keys-from-certificates.patch \
+    file://0002-openssl_helper-use-dev-urandom-as-seed-source.patch \
+    file://0003-hab4_pki_tree.sh-adapt-script-for-DEY.patch \
+    file://0004-ahab_pki_tree.sh-adapt-script-for-DEY.patch \
 "

-SRC_URI[cst.md5sum] = "27ba9c8bc0b8a7f14d23185775c53794"
-SRC_URI[cst.sha256sum] = "8b7e44e3e126f814f5caf8a634646fe64021405302ca59ff02f5c8f3b9a5abb9"
-SRC_URI[openssl.md5sum] = "077f69d357758c7d6ef686f813e16f30"
-SRC_URI[openssl.sha256sum] = "c5ac01e760ee6ff0dab61d6b2bbd30146724d063eb322180c6f18a6f74e4b6aa"
+SRC_URI[cst.md5sum] = "4b9fccac381fa412cba8ba7028c154c7"
+SRC_URI[cst.sha256sum] = "517b11dca181e8c438a6249f56f0a13a0eb251b30e690760be3bf6191ee06c68"
+SRC_URI[openssl.md5sum] = "1cfee919e0eac6be62c88c5ae8bcd91e"
+SRC_URI[openssl.sha256sum] = "8dee9b24bdb1dcbf0c3d1e9b02fb8f6bf22165e807f45adeb7c9677536859d3b"

 S = "${WORKDIR}/cst-${PV}"

 do_compile() {
 	cd code/cst
 	oe_runmake OPENSSL_PATH=${WORKDIR}/openssl-${OPENSSL1_VERSION} OSTYPE=linux64 openssl
-	oe_runmake OPENSSL_PATH=${WORKDIR}/openssl-${OPENSSL1_VERSION} OSTYPE=linux64 rel_bin
+	oe_runmake OPENSSL_PATH=${WORKDIR}/openssl-${OPENSSL1_VERSION} OSTYPE=linux64 os_bin
 }

 do_install() {
--- a/meta-digi-arm/recipes-bsp/trustfence-cst/trustfence-cst-3.3.2/0001-gen_auth_encrypted_data-reuse-existing-DEK-file.patch
+++ b/meta-digi-arm/recipes-bsp/trustfence-cst/trustfence-cst-3.3.2/0001-gen_auth_encrypted_data-reuse-existing-DEK-file.patch
@ -12,14 +12,14 @@ https://jira.digi.com/browse/DUB-608

 Signed-off-by: Diaz de Grenu, Jose <Jose.DiazdeGrenu@digi.com>
 ---
- code/cst/code/back_end/src/adapt_layer_openssl.c | 1 +
+ code/cst/code/back_end-ssl/src/adapt_layer_openssl.c | 1 +
 1 file changed, 1 insertion(+)

-diff --git a/code/cst/code/back_end/src/adapt_layer_openssl.c b/code/cst/code/back_end/src/adapt_layer_openssl.c
-index 38b8bf5..f389e23 100755
--- a/code/cst/code/back_end/src/adapt_layer_openssl.c
-+++ b/code/cst/code/back_end/src/adapt_layer_openssl.c
-@@ -1146,6 +1146,7 @@ int32_t gen_auth_encrypted_data(const char* in_file,
+diff --git a/code/cst/code/back_end-ssl/src/adapt_layer_openssl.c b/code/cst/code/back_end-ssl/src/adapt_layer_openssl.c
+index d8df54e..86e7e4f 100755
+--- a/code/cst/code/back_end-ssl/src/adapt_layer_openssl.c
+++ b/code/cst/code/back_end-ssl/src/adapt_layer_openssl.c
+@@ -1231,6 +1231,7 @@ int32_t gen_auth_encrypted_data(const char* in_file,
         printf("\n");
 #endif
         if (0 == key_init_done) {
--- a/meta-digi-arm/recipes-bsp/trustfence-cst/trustfence-cst-3.3.2/0002-openssl_helper-use-dev-urandom-as-seed-source.patch
+++ b/meta-digi-arm/recipes-bsp/trustfence-cst/trustfence-cst-3.3.2/0002-openssl_helper-use-dev-urandom-as-seed-source.patch
@ -10,10 +10,10 @@ Signed-off-by: Diaz de Grenu, Jose <Jose.DiazdeGrenu@digi.com>
 1 file changed, 1 insertion(+), 1 deletion(-)

 diff --git a/code/cst/code/common/src/openssl_helper.c b/code/cst/code/common/src/openssl_helper.c
-index 871cf55..b62c8a8 100755
+index 1e1131b..918c82e 100755
 --- a/code/cst/code/common/src/openssl_helper.c
 +++ b/code/cst/code/common/src/openssl_helper.c
-@@ -414,7 +414,7 @@ void print_version(void)
+@@ -404,7 +404,7 @@ void print_version(void)
 ---------------------------*/
 uint32_t seed_prng(uint32_t bytes)
 {
--- a/meta-digi-arm/recipes-bsp/trustfence-cst/trustfence-cst-3.3.2/0003-hab4_pki_tree.sh-adapt-script-for-DEY.patch
+++ b/meta-digi-arm/recipes-bsp/trustfence-cst/trustfence-cst-3.3.2/0003-hab4_pki_tree.sh-adapt-script-for-DEY.patch
@ -1,23 +1,32 @@
 From: Arturo Buzarra <arturo.buzarra@digi.com>
 Date: Wed, 22 Jul 2020 14:37:03 +0200
-Subject: [PATCH] hab4_pki_tree.sh: automate script
+Subject: [PATCH] hab4_pki_tree.sh: adapt script for DEY

-This commit introduce a new command line argument to specify the
-CSF path folder and prepare it to automate the build process.
+* support non interactive execution: introduce a new command line
+  argument to specify the CSF path folder and prepare it to automate the
+  build process.

+* use a random password for the default PKI generation
+
+* extract public keys from certificates: the public key needs to be
+  available on the rootfs so that signed SWU packages can be authenticated.
+
+Co-Authored-By: Javier Viguera <javier.viguera@digi.com>
+Co-Authored-By: Hector Palacios <hector.palacios@digi.com>
+Co-Authored-By: Diaz de Grenu, Jose <Jose.DiazdeGrenu@digi.com>
 Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
 ---
- keys/hab4_pki_tree.sh | 78 ++++++++++++++++++++++++++++---------------
- 1 file changed, 51 insertions(+), 27 deletions(-)
+ keys/hab4_pki_tree.sh | 80 +++++++++++++++++++++++++++++--------------
+ 1 file changed, 54 insertions(+), 26 deletions(-)

 diff --git a/keys/hab4_pki_tree.sh b/keys/hab4_pki_tree.sh
-index 944cc66..39ed3bf 100755
+index 49834f0..de0c969 100755
 --- a/keys/hab4_pki_tree.sh
 +++ b/keys/hab4_pki_tree.sh
@@ -66,6 +66,8 @@ printf "    +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n"
-
+ 
 stty erase 
-
+ 
 +SCRIPT_BASEDIR="$(cd $(dirname ${0}) && pwd)"
 +
 if [ $# -gt 0 ]; then
@ -27,24 +36,24 @@ index 944cc66..39ed3bf 100755
     echo "$0"
     echo
     echo "Command Line Mode:"
-    echo "$0 -existing-ca <y/n> [-ca-key <CA key name> -ca-cert <CA cert name>] -use-ecc <y/n> -kl <ECC/RSA Key Length> -duration <years> -num-srk <1-4> -srk-ca <y/n>"
-+    echo "$0 [-csf-path] <CSF Path> -existing-ca <y/n> [-ca-key <CA key name> -ca-cert <CA cert name>] -use-ecc <y/n> -kl <ECC/RSA Key Length> -duration <years> -num-srk <1-4> -srk-ca <y/n>"
-     echo "Options:"
-     echo "    -kl: -use-ecc = y then Supported key lengths: p256, p384, p521"
-     echo "       : -use-ecc = n then Supported key lengths: 1024, 2048, 3072, 4096"
-@@ -89,10 +91,18 @@ usage()
+-    echo "$0 -existing-ca <y/n> [-ca-key <CA key name> -ca-cert <CA cert name>] -kt < rsa/rsa-pss/ecc> -kl <ECC Curve/RSA Key Length> -duration <years> -num-srk <1-4> -srk-ca <y/n>"
+    echo "$0 [-csf-path] <CSF Path> -existing-ca <y/n> [-ca-key <CA key name> -ca-cert <CA cert name>] -kt < rsa/rsa-pss/ecc> -kl <ECC Curve/RSA Key Length> -duration <years> -num-srk <1-4> -srk-ca <y/n>"
+     echo "  Key Type Options:"
+     echo "    -kl ecc     : then Supported key lengths: p256, p384, p521"
+     echo "    -kl rsa     : then Supported key lengths: 1024, 2048, 3072, 4096"
+@@ -90,10 +92,18 @@ usage()
     echo
 }
-
+ 
 -max_param=16
 -min_param=12
 +max_param=18
 +min_param=1
 num_param=1
-
+ 
 +# Default values
 +existing_ca="n"
-+use_ecc="n"
+kt="rsa"
 +kl=4096
 +duration=10
 +num_srk=4
@ -53,7 +62,7 @@ index 944cc66..39ed3bf 100755
 if [ $interactive = "n" ]
 then
     # Validate command line parameters
-@@ -111,6 +121,11 @@ then
+@@ -112,6 +122,11 @@ then
     while [ $num_param -le $max_param ] && [ "$1" != "" ]
     do
         case $1 in
@ -65,7 +74,7 @@ index 944cc66..39ed3bf 100755
             -existing-ca)
                 shift
                 existing_ca=$1
-@@ -164,9 +179,8 @@ then
+@@ -165,9 +180,8 @@ then
                 shift
                 ;;
             *)
@ -77,10 +86,10 @@ index 944cc66..39ed3bf 100755
                 ;;
         esac
         num_param=$(( num_param + 2 ))
-@@ -242,6 +256,16 @@ then
+@@ -261,6 +275,16 @@ then
     read duration
 fi
-
+ 
 +# CSF folder structure
 +if [ ! -d "${CSF_PATH}" ]; then
 +    echo "Invalid CSF_PATH: ${CSF_PATH}"
@ -93,8 +102,8 @@ index 944cc66..39ed3bf 100755
 +
 # Compute validity period
 val_period=$((duration*365))
-
-@@ -275,9 +299,9 @@ then
+ 
+@@ -294,9 +318,9 @@ then
 	script_name=$0
 fi
 script_path=$(cd $(dirname "${script_name}") && pwd -P)
@ -104,13 +113,13 @@ index 944cc66..39ed3bf 100755
 +keys_dir=${CSF_PATH}/keys/
 +crts_dir=${CSF_PATH}/crts/
 +ca_dir=${CSF_PATH}/ca/
-
+ 
 if [ ! -d "${keys_dir}" ]
 then
-@@ -291,11 +315,11 @@ then
+@@ -310,11 +334,11 @@ then
     exit 1 
 fi
-
+ 
 -if [ ! -d "${ca_dir}" ]
 -then
 -    echo ERROR: "Openssl configuration directory ${ca_dir} is missing. Expecting <cst>/ca directory to hold openssl configuration files."
@ -121,28 +130,33 @@ index 944cc66..39ed3bf 100755
 +#     echo ERROR: "Openssl configuration directory ${ca_dir} is missing. Expecting <cst>/ca directory to hold openssl configuration files."
 +#     exit 1
 +# fi
-
+ 
 # Switch current working directory to keys directory, if needed.
 if [ "${crt_dir}" != "${keys_dir}" ]
-@@ -365,7 +389,7 @@ then
+@@ -337,9 +361,10 @@ fi
+ # Check that the file "key_pass.txt" is present, if not create it with default user/pwd:
+ if [ ! -f key_pass.txt ]
+ then
+-    echo "test" > key_pass.txt
+-    echo "test" >> key_pass.txt
+-    echo "A default file 'key_pass.txt' was created with password = test!"
+    password="$(openssl rand -base64 32)"
+    echo "${password}" > key_pass.txt
+    echo "${password}" >> key_pass.txt
+    echo "A file 'key_pass.txt' was created with a random password!"
+ fi
+ 
+ # The following is required otherwise OpenSSL complains
+@@ -384,7 +409,7 @@ then
                    -x509 -extensions v3_ca \
                    -keyout temp_ca.pem \
                    -out ${ca_cert}.pem \
 -                   -days ${val_period} -config ../ca/openssl.cnf
 +                   -days ${val_period} -config "${SCRIPT_BASEDIR}/openssl.cnf"
-
+ 
     # Generate CA key in PKCS #8 format - both PEM and DER
     openssl pkcs8 -passin file:./key_pass.txt -passout file:./key_pass.txt \
-@@ -382,7 +406,7 @@ then
-     openssl x509 -inform PEM -outform DER -in ${ca_cert}.pem -out ${ca_cert}.der
-
-     # Cleanup
-    \rm temp_ca.pem
-+    rm temp_ca.pem
- fi
-
-
-@@ -432,10 +456,10 @@ then
+@@ -452,10 +477,10 @@ then
                       -in ./temp_srk_req.pem \
                       -cert ${ca_cert}.pem \
                    -keyfile ${ca_key}.pem \
@ -152,19 +166,10 @@ index 944cc66..39ed3bf 100755
                       -days ${val_period} \
 -                      -config ../ca/openssl.cnf
 +                      -config "${SCRIPT_BASEDIR}/openssl.cnf"
-
+ 
         # Convert SRK Certificate to DER format
         openssl x509 -inform PEM -outform DER \
-@@ -456,7 +480,7 @@ then
-                       -out ${srk_key}.pem
-
-         # Cleanup
-        \rm ./temp_srk.pem ./temp_srk_req.pem
-+        rm ./temp_srk.pem ./temp_srk_req.pem
-         i=$((i+1))
-     done
- else
-@@ -505,10 +529,10 @@ do
+@@ -526,10 +551,10 @@ do
                   -in ./temp_srk_req.pem \
                   -cert ${ca_cert}.pem \
                   -keyfile ${ca_key}.pem \
@ -174,10 +179,10 @@ index 944cc66..39ed3bf 100755
                   -days ${val_period} \
 -                  -config ../ca/openssl.cnf
 +                  -config "${SCRIPT_BASEDIR}/openssl.cnf"
-
+ 
     # Convert SRK Certificate to DER format
     openssl x509 -inform PEM -outform DER \
-@@ -574,10 +598,10 @@ do
+@@ -596,10 +621,10 @@ do
                -in ./temp_csf_req.pem \
                -cert ${srk_crt_i} \
                -keyfile ${srk_key_i} \
@ -187,19 +192,10 @@ index 944cc66..39ed3bf 100755
                -days ${val_period} \
 -               -config ../ca/openssl.cnf
 +               -config "${SCRIPT_BASEDIR}/openssl.cnf"
-
+ 
     # Convert CSF Certificate to DER format
     openssl x509 -inform PEM -outform DER \
-@@ -596,7 +620,7 @@ do
-                   -out ${csf_key}.pem
-
-     # Cleanup
-    \rm ./temp_csf.pem ./temp_csf_req.pem
-+    rm ./temp_csf.pem ./temp_csf_req.pem
-
-     echo
-     echo ++++++++++++++++++++++++++++++++++++++++
-@@ -636,10 +660,10 @@ do
+@@ -659,10 +684,10 @@ do
                -in ./temp_img_req.pem \
                -cert ${srk_crt_i} \
                -keyfile ${srk_key_i} \
@ -209,15 +205,16 @@ index 944cc66..39ed3bf 100755
                -days ${val_period} \
 -               -config ../ca/openssl.cnf
 +               -config "${SCRIPT_BASEDIR}/openssl.cnf"
-
+ 
     # Convert IMG Certificate to DER format
     openssl x509 -inform PEM -outform DER \
-@@ -658,7 +682,7 @@ do
+@@ -680,6 +705,9 @@ do
+                   -in temp_img.pem \
                   -out ${img_key}.pem
-
+ 
+    # Extract public key from the certificate
+    openssl x509 -pubkey -noout -in "${img_crt}.pem" > ../crts/key${i}.pub
+
     # Cleanup
-    \rm ./temp_img.pem ./temp_img_req.pem
-+    rm ./temp_img.pem ./temp_img_req.pem
-
-     i=$((i+1))
- done
+     \rm ./temp_img.pem ./temp_img_req.pem
+ 
--- a/meta-digi-arm/recipes-bsp/trustfence-cst/trustfence-cst-3.3.2/0004-ahab_pki_tree.sh-adapt-script-for-DEY.patch
+++ b/meta-digi-arm/recipes-bsp/trustfence-cst/trustfence-cst-3.3.2/0004-ahab_pki_tree.sh-adapt-script-for-DEY.patch
@ -1,23 +1,32 @@
 From: Arturo Buzarra <arturo.buzarra@digi.com>
 Date: Wed, 22 Jul 2020 15:10:21 +0200
-Subject: [PATCH] ahab_pki_tree.sh: automate script
+Subject: [PATCH] ahab_pki_tree.sh: adapt script for DEY

-This commit introduce a new command line argument to specify the
-CSF path folder and prepare it to automate the build process.
+* support non interactive execution: introduce a new command line
+  argument to specify the CSF path folder and prepare it to automate the
+  build process.

+* use a random password for the default PKI generation
+
+* extract public keys from certificates: the public key needs to be
+  available on the rootfs so that signed SWU packages can be authenticated.
+
+Co-Authored-By: Javier Viguera <javier.viguera@digi.com>
+Co-Authored-By: Hector Palacios <hector.palacios@digi.com>
+Co-Authored-By: Mike Engel <Mike.Engel@digi.com>
 Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
 ---
- keys/ahab_pki_tree.sh | 70 +++++++++++++++++++++++++++++--------------
- 1 file changed, 47 insertions(+), 23 deletions(-)
+ keys/ahab_pki_tree.sh | 79 ++++++++++++++++++++++++++++++-------------
+ 1 file changed, 55 insertions(+), 24 deletions(-)

 diff --git a/keys/ahab_pki_tree.sh b/keys/ahab_pki_tree.sh
-index f5ab36c..2c16533 100755
+index 0327f83..5c986b2 100755
 --- a/keys/ahab_pki_tree.sh
 +++ b/keys/ahab_pki_tree.sh
@@ -64,6 +64,8 @@ printf "    +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n"
-
+ 
 stty erase 
-
+ 
 +SCRIPT_BASEDIR="$(cd $(dirname ${0}) && pwd)"
 +
 if [ $# -gt 0 ]; then
@ -27,33 +36,33 @@ index f5ab36c..2c16533 100755
     echo "$0"
     echo
     echo "Command Line Mode:"
-    echo "$0 -existing-ca <y/n> [-ca-key <CA key name> -ca-cert <CA cert name>] -use-ecc <y/n> -kl <ECC/RSA Key Length> -da <digest algorithm> -duration <years> -srk-ca <y/n>"
-+    echo "$0 [-csf-path] <CSF Path> -existing-ca <y/n> [-ca-key <CA key name> -ca-cert <CA cert name>] -use-ecc <y/n> -kl <ECC/RSA Key Length> -da <digest algorithm> -duration <years> -srk-ca <y/n>"
+-    echo "$0 -existing-ca <y/n> [-ca-key <CA key name> -ca-cert <CA cert name>] -kt <y/n> -kl <ECC/RSA Key Length> -da <digest algorithm> -duration <years> -srk-ca <y/n>"
+    echo "$0 [-csf-path] <CSF Path> -existing-ca <y/n> [-ca-key <CA key name> -ca-cert <CA cert name>] -kt <y/n> -kl <ECC/RSA Key Length> -da <digest algorithm> -duration <years> -srk-ca <y/n>"
     echo "Options:"
-     echo "    -kl: -use-ecc = y then Supported key lengths: p256, p384, p521"
-     echo "       : -use-ecc = n then Supported key lengths: 2048, 3072, 4096"
-@@ -88,10 +90,18 @@ usage()
+     echo "    -kt ecc     : then Supported key lengths: p256, p384, p521"
+     echo "    -kt rsa     : then Supported key lengths: 2048, 3072, 4096"
+@@ -89,10 +91,18 @@ usage()
     echo
 }
-
+ 
 -max_param=16
 -min_param=12
 +max_param=18
 +min_param=1
 num_param=1
-
+ 
 +# Default values
 +existing_ca="n"
-+use_ecc="y"
+kt="ecc"
 +kl=p521
 +da=sha512
 +duration=10
-+srk_ca="y"
+srk_ca="n"
 +
 if [ $interactive = "n" ]
 then
     # Validate command line parameters
-@@ -110,6 +120,11 @@ then
+@@ -111,6 +121,11 @@ then
     while [ $num_param -le $max_param ] && [ "$1" != "" ]
     do
         case $1 in
@ -65,7 +74,7 @@ index f5ab36c..2c16533 100755
             -existing-ca)
                 shift
                 existing_ca=$1
-@@ -163,9 +178,8 @@ then
+@@ -164,9 +179,8 @@ then
                 shift
                 ;;
             *)
@ -77,10 +86,10 @@ index f5ab36c..2c16533 100755
                 ;;
         esac
         num_param=$(( num_param + 2 ))
-@@ -255,6 +269,16 @@ then
+@@ -274,6 +288,16 @@ then
     read duration
 fi
-
+ 
 +# CSF folder structure
 +if [ ! -d "${CSF_PATH}" ]; then
 +    echo "Invalid CSF_PATH: ${CSF_PATH}"
@ -93,8 +102,8 @@ index f5ab36c..2c16533 100755
 +
 # Compute validity period
 val_period=$((duration*365))
-
-@@ -286,9 +310,9 @@ then
+ 
+@@ -305,9 +329,9 @@ then
 	script_name=$0
 fi
 script_path=$(cd $(dirname "${script_name}") && pwd -P)
@ -104,54 +113,73 @@ index f5ab36c..2c16533 100755
 +keys_dir=${CSF_PATH}/keys/
 +crts_dir=${CSF_PATH}/crts/
 +ca_dir=${CSF_PATH}/ca/
-
+ 
 if [ ! -d "${keys_dir}" ]
 then
-@@ -302,11 +326,11 @@ then
-     exit 1 
+@@ -321,11 +345,11 @@ then
+     exit 1
 fi
-
+ 
 -if [ ! -d "${ca_dir}" ]
 -then
 -    echo ERROR: "Openssl configuration directory ${ca_dir} is missing. Expecting <cst>/ca directory to hold openssl configuration files."
-    exit 1 
+-    exit 1
 -fi
 +# if [ ! -d "${ca_dir}" ]
 +# then
 +#     echo ERROR: "Openssl configuration directory ${ca_dir} is missing. Expecting <cst>/ca directory to hold openssl configuration files."
 +#     exit 1
 +# fi
-
+ 
 # Switch current working directory to keys directory, if needed.
 if [ "${crt_dir}" != "${keys_dir}" ]
-@@ -377,7 +401,7 @@ then
+@@ -348,9 +372,10 @@ fi
+ # Check that the file "key_pass.txt" is present, if not create it with default user/pwd:
+ if [ ! -f key_pass.txt ]
+ then
+-    echo "test" > key_pass.txt
+-    echo "test" >> key_pass.txt
+-    echo "A default file 'key_pass.txt' was created with password = test!"
+    password="$(openssl rand -base64 32)"
+    echo "${password}" > key_pass.txt
+    echo "${password}" >> key_pass.txt
+    echo "A file 'key_pass.txt' was created with a random password!"
+ fi
+ 
+ # The following is required otherwise OpenSSL complains
+@@ -396,7 +421,7 @@ then
                    -x509 -extensions v3_ca \
                    -keyout temp_ca.pem \
                    -out ${ca_cert}.pem \
 -                   -days ${val_period} -config ../ca/openssl.cnf
 +                   -days ${val_period} -config "${SCRIPT_BASEDIR}/openssl.cnf"
-
+ 
     # Generate CA key in PKCS #8 format - both PEM and DER
     openssl pkcs8 -passin file:./key_pass.txt -passout file:./key_pass.txt \
-@@ -394,7 +418,7 @@ then
-     openssl x509 -inform PEM -outform DER -in ${ca_cert}.pem -out ${ca_cert}.der
-
-     # Cleanup
-    \rm temp_ca.pem
-+    rm temp_ca.pem
- fi
-
-
-@@ -468,7 +492,7 @@ then
+@@ -464,10 +489,10 @@ then
+                       -in ./temp_srk_req.pem \
+                       -cert ${ca_cert}.pem \
+                    -keyfile ${ca_key}.pem \
+-                      -extfile ../ca/v3_usr.cnf \
+                      -extfile "${SCRIPT_BASEDIR}/v3_usr.cnf" \
+                       -out ${srk_crt}.pem \
+                       -days ${val_period} \
+-                      -config ../ca/openssl.cnf
+                      -config "${SCRIPT_BASEDIR}/openssl.cnf"
+ 
+         # Convert SRK Certificate to DER format
+         openssl x509 -inform PEM -outform DER \
+@@ -487,6 +512,9 @@ then
+                       -in temp_srk.pem \
                       -out ${srk_key}.pem
-
+ 
+        # Extract public key from the certificate
+        openssl x509 -pubkey -noout -in "${srk_crt}.pem" > ../crts/key${i}.pub
+
         # Cleanup
-        \rm ./temp_srk.pem ./temp_srk_req.pem
-+        rm ./temp_srk.pem ./temp_srk_req.pem
+         \rm ./temp_srk.pem ./temp_srk_req.pem
         i=$((i+1))
-     done
- else
-@@ -517,10 +541,10 @@ do
+@@ -539,10 +567,10 @@ do
                   -in ./temp_srk_req.pem \
                   -cert ${ca_cert}.pem \
                   -keyfile ${ca_key}.pem \
@ -161,19 +189,10 @@ index f5ab36c..2c16533 100755
                   -days ${val_period} \
 -                  -config ../ca/openssl.cnf
 +                  -config "${SCRIPT_BASEDIR}/openssl.cnf"
-
+ 
     # Convert SRK Certificate to DER format
     openssl x509 -inform PEM -outform DER \
-@@ -541,7 +565,7 @@ do
-                   -out ${srk_key}.pem
-
-     # Cleanup
-    \rm ./temp_srk.pem ./temp_srk_req.pem
-+    rm ./temp_srk.pem ./temp_srk_req.pem
-
-     echo
-     echo ++++++++++++++++++++++++++++++++++++++++
-@@ -586,10 +610,10 @@ do
+@@ -609,10 +637,10 @@ do
                -in ./temp_sgk_req.pem \
                -cert ${srk_crt_i} \
                -keyfile ${srk_key_i} \
@ -183,15 +202,16 @@ index f5ab36c..2c16533 100755
                -days ${val_period} \
 -               -config ../ca/openssl.cnf
 +               -config "${SCRIPT_BASEDIR}/openssl.cnf"
-
+ 
     # Convert SGK Certificate to DER format
     openssl x509 -inform PEM -outform DER \
-@@ -608,7 +632,7 @@ do
+@@ -630,6 +658,9 @@ do
+                   -in temp_sgk.pem \
                   -out ${sgk_key}.pem
-
+ 
+    # Extract public key from the certificate
+    openssl x509 -pubkey -noout -in "${srk_crt_i}" > ../crts/key${i}.pub
+
     # Cleanup
-    \rm ./temp_sgk.pem ./temp_sgk_req.pem
-+    rm ./temp_sgk.pem ./temp_sgk_req.pem
-
-     i=$((i+1))
- done
+     \rm ./temp_sgk.pem ./temp_sgk_req.pem
+ 
--- a/meta-digi-arm/recipes-bsp/trustfence-cst/trustfence-cst-native_3.3.2.bb
+++ b/meta-digi-arm/recipes-bsp/trustfence-cst/trustfence-cst-native_3.3.2.bb
--- a/meta-digi-arm/recipes-bsp/trustfence-cst/trustfence-cst/0004-hab4_pki_tree.sh-usa-a-random-password-for-the-defau.patch
+++ b/meta-digi-arm/recipes-bsp/trustfence-cst/trustfence-cst/0004-hab4_pki_tree.sh-usa-a-random-password-for-the-defau.patch
@ -1,28 +0,0 @@
-From: "Diaz de Grenu, Jose" <Jose.DiazdeGrenu@digi.com>
-Date: Fri, 29 Jul 2016 17:20:28 +0200
-Subject: [PATCH] hab4_pki_tree.sh: usa a random password for the default PKI
- generation
-
-Signed-off-by: Diaz de Grenu, Jose <Jose.DiazdeGrenu@digi.com>
---
- keys/hab4_pki_tree.sh | 7 ++++---
- 1 file changed, 4 insertions(+), 3 deletions(-)
-
-diff --git a/keys/hab4_pki_tree.sh b/keys/hab4_pki_tree.sh
-index 39ed3bf..ac6fb29 100755
--- a/keys/hab4_pki_tree.sh
-+++ b/keys/hab4_pki_tree.sh
-@@ -342,9 +342,10 @@ fi
- # Check that the file "key_pass.txt" is present, if not create it with default user/pwd:
- if [ ! -f key_pass.txt ]
- then
-    echo "test" > key_pass.txt
-    echo "test" >> key_pass.txt
-    echo "A default file 'key_pass.txt' was created with password = test!"
-+    password="$(openssl rand -base64 32)"
-+    echo "${password}" > key_pass.txt
-+    echo "${password}" >> key_pass.txt
-+    echo "A file 'key_pass.txt' was created with a random password!"
- fi
- 
- # The following is required otherwise OpenSSL complains
--- a/meta-digi-arm/recipes-bsp/trustfence-cst/trustfence-cst/0006-ahab_pki_tree.sh-use-a-random-password-for-the-defau.patch
+++ b/meta-digi-arm/recipes-bsp/trustfence-cst/trustfence-cst/0006-ahab_pki_tree.sh-use-a-random-password-for-the-defau.patch
@ -1,28 +0,0 @@
-From: Mike Engel <Mike.Engel@digi.com>
-Date: Fri, 24 Jan 2020 17:47:56 +0100
-Subject: [PATCH] ahab_pki_tree.sh: use a random password for the default PKI
- generation
-
-Signed-off-by: Mike Engel <Mike.Engel@digi.com>
---
- keys/ahab_pki_tree.sh | 7 ++++---
- 1 file changed, 4 insertions(+), 3 deletions(-)
-
-diff --git a/keys/ahab_pki_tree.sh b/keys/ahab_pki_tree.sh
-index 2c16533..b85b00d 100755
--- a/keys/ahab_pki_tree.sh
-+++ b/keys/ahab_pki_tree.sh
-@@ -353,9 +353,10 @@ fi
- # Check that the file "key_pass.txt" is present, if not create it with default user/pwd:
- if [ ! -f key_pass.txt ]
- then
-    echo "test" > key_pass.txt
-    echo "test" >> key_pass.txt
-    echo "A default file 'key_pass.txt' was created with password = test!"
-+    password="$(openssl rand -base64 32)"
-+    echo "${password}" > key_pass.txt
-+    echo "${password}" >> key_pass.txt
-+    echo "A file 'key_pass.txt' was created with a random password!"
- fi
- 
- # The following is required otherwise OpenSSL complains
--- a/meta-digi-arm/recipes-bsp/trustfence-cst/trustfence-cst/0007-rules.mk-weaken-specific-function-err_msg.patch
+++ b/meta-digi-arm/recipes-bsp/trustfence-cst/trustfence-cst/0007-rules.mk-weaken-specific-function-err_msg.patch
@ -1,33 +0,0 @@
-From fe51b132c7c07de5a63c3dfc5a16bc9fc7816f7e Mon Sep 17 00:00:00 2001
-From: Hector Palacios <hector.palacios@digi.com>
-Date: Mon, 30 Jan 2023 10:38:22 +0100
-Subject: [PATCH] rules.mk: weaken specific function err_msg()
-
-A bug in binutils 2.38 objcopy '--weaken' produces malformed
-binaries.
-For the cst, it looks like it's enough to weaken function err_msg()
-which is otherwise redefined.
-Change the global '--weaken' flag with '--weaken-symbol err_msg'
-to have the build process generate a valid 'cst' binary.
-
-Signed-off-by: Hector Palacios <hector.palacios@digi.com>
-
-https://onedigi.atlassian.net/browse/DEL-8332
-https://onedigi.atlassian.net/browse/DEL-8033
---
- code/cst/code/build/make/rules.mk | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/code/cst/code/build/make/rules.mk b/code/cst/code/build/make/rules.mk
-index 1c0842bd070e..032e18bc5134 100755
--- a/code/cst/code/build/make/rules.mk
-+++ b/code/cst/code/build/make/rules.mk
-@@ -27,7 +27,7 @@ LFLAGS  := -t
- 	$(AR) $(ARFLAGS) $@ $^
- ifneq ($(OSTYPE),mingw32)
- ifneq ($(OSTYPE),osx)
-	$(OBJCOPY) --weaken $@
-+	$(OBJCOPY) --weaken-symbol err_msg $@
- endif
- endif
- 
--- a/meta-digi-arm/recipes-bsp/trustfence-cst/trustfence-cst/0008-pki_tree.sh-extract-public-keys-from-certificates.patch
+++ b/meta-digi-arm/recipes-bsp/trustfence-cst/trustfence-cst/0008-pki_tree.sh-extract-public-keys-from-certificates.patch
@ -1,42 +0,0 @@
-From: Hector Palacios <hector.palacios@digi.com>
-Date: Thu, 3 Aug 2023 16:25:36 +0200
-Subject: [PATCH] pki_tree.sh: extract public keys from certificates
-
-The public key needs to be available on the rootfs so that signed SWU
-packages can be authenticated.
-Do this on the PKI generation script so that recipes don't need to do it.
-
-Signed-off-by: Hector Palacios <hector.palacios@digi.com>
---
- keys/ahab_pki_tree.sh | 3 +++
- keys/hab4_pki_tree.sh | 3 +++
- 2 files changed, 6 insertions(+)
-
-diff --git a/keys/ahab_pki_tree.sh b/keys/ahab_pki_tree.sh
-index 7f10c5388146..63b5ce58ade7 100755
--- a/keys/ahab_pki_tree.sh
-+++ b/keys/ahab_pki_tree.sh
-@@ -632,6 +632,9 @@ do
-                   -in temp_sgk.pem \
-                   -out ${sgk_key}.pem
- 
-+    # Extract public key from the certificate
-+    openssl x509 -pubkey -noout -in "${srk_crt_i}" > ../crts/key${i}.pub
-+
-     # Cleanup
-     rm ./temp_sgk.pem ./temp_sgk_req.pem
- 
-diff --git a/keys/hab4_pki_tree.sh b/keys/hab4_pki_tree.sh
-index ac6fb29b7f91..e76f22f40643 100755
--- a/keys/hab4_pki_tree.sh
-+++ b/keys/hab4_pki_tree.sh
-@@ -682,6 +682,9 @@ do
-                   -in temp_img.pem \
-                   -out ${img_key}.pem
- 
-+    # Extract public key from the certificate
-+    openssl x509 -pubkey -noout -in "${img_crt}.pem" > ../crts/key${i}.pub
-+
-     # Cleanup
-     rm ./temp_img.pem ./temp_img_req.pem
- 
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey.inc
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey.inc
@ -95,8 +95,8 @@ build_uboot_scripts() {
 	mkimage -T script -n bootscript -C none -d ${TMP_BOOTSCR} ${DEPLOYDIR}/boot.scr
 	rm -f ${TMP_BOOTSCR}

-	# Sign the scripts (TODO signing of artifacts for STM-based platforms)
-	if [ "${TRUSTFENCE_SIGN}" = "1" ] && [ "${DEY_SOC_VENDOR}" != "STM" ]; then
+	# Sign the boot script
+	if [ "${TRUSTFENCE_SIGN_ARTIFACTS}" = "1" ]; then
 		export CONFIG_SIGN_KEYS_PATH="${TRUSTFENCE_SIGN_KEYS_PATH}"
 		[ -n "${TRUSTFENCE_KEY_INDEX}" ] && export CONFIG_KEY_INDEX="${TRUSTFENCE_KEY_INDEX}"
 		[ -n "${TRUSTFENCE_DEK_PATH}" ] && [ "${TRUSTFENCE_DEK_PATH}" != "0" ] && export CONFIG_DEK_PATH="${TRUSTFENCE_DEK_PATH}"
@ -198,6 +198,18 @@ do_deploy:append:ccmp1() {
 	# Deploy u-boot-nodtb.bin and ccmp1x-dvk.dtb, to be packaged in fip binary by tf-a
 	install -d ${DEPLOYDIR}/${BOOT_TOOLS}
 	install -m 0777 ${B}/${config}/arch/arm/dts/${UBOOT_DTB_NAME} ${DEPLOYDIR}/${BOOT_TOOLS}/${FIP_UBOOT_DTB}-${FIP_UBOOT_HEADER}.dtb
-
 	install -m 0777 ${B}/${config}/u-boot-nodtb.bin  ${DEPLOYDIR}/${BOOT_TOOLS}/u-boot-nodtb.bin
+
+	# Append signature to u-boot DT
+	if [ "x${UBOOT_SIGN_ENABLE}" = "x1" ] ; then
+		# get name of u-boot devicetree without signature
+		ubootdevicetree="${DEPLOYDIR}/${BOOT_TOOLS}/u-boot-${UBOOT_DTB_NAME}"
+		namewithoutsignature=`echo $ubootdevicetree | sed "s/\.dtb/-without-signature.dtb/g"`
+		namewithsignature=`echo $ubootdevicetree | sed "s/\.dtb/-with-signature.dtb/g"`
+		mv $ubootdevicetree $namewithoutsignature
+		# get name of U-Boot device tree from DEPLOY_DIR
+		nameonkernel="${DEPLOY_DIR_IMAGE}/u-boot-${MACHINE}*.dtb"
+		cp $nameonkernel $namewithsignature
+		cp $nameonkernel $ubootdevicetree
+	fi
 }
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6qpsbc/install_linux_fw_sd.txt
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6qpsbc/install_linux_fw_sd.txt
@ -144,6 +144,7 @@ fi
 #  - Partition the eMMC user data area for Linux
 #  - If Dual Boot
 #     - Update the system partitions: linux_a, linux_b, rootfs_a, rootfs_b
+      - Set bootlimit to 3
 #  - If Normal Boot:
 #     - Update the system partitions: linux, recovery, rootfs
 #     - Erase the 'update' partition
@ -219,6 +220,7 @@ setenv bootcmd "
 				exit;
 			fi;
 		fi;
+		setenv bootlimit 3;
 	else
 		echo \"\";
 		echo \"\";
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6qpsbc/install_linux_fw_usb.txt
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6qpsbc/install_linux_fw_usb.txt
@ -144,6 +144,7 @@ fi
 #  - Partition the eMMC user data area for Linux
 #  - If Dual Boot
 #     - Update the system partitions: linux_a, linux_b, rootfs_a, rootfs_b
+      - Set bootlimit to 3
 #  - If Normal Boot:
 #     - Update the system partitions: linux, recovery, rootfs
 #     - Erase the 'update' partition
@ -222,6 +223,7 @@ setenv bootcmd "
 				exit;
 			fi;
 		fi;
+		setenv bootlimit 3;
 	else
 		echo \"\";
 		echo \"\";
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6qpsbc/install_linux_fw_uuu.sh
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6qpsbc/install_linux_fw_uuu.sh
@ -32,7 +32,9 @@ show_usage()
 	echo "Usage: $0 [options]"
 	echo ""
 	echo "  Options:"
+	echo "   -b                     Activate bootcount mechanism (3 boot attempts)."
 	echo "   -d                     Install firmware on dualboot partitions (system A and system B)."
+	echo "                          (Implies -b)."
 	echo "   -h                     Show this help."
 	echo "   -i <dey-image-name>    Image name that prefixes the image filenames, such as 'dey-image-qt', "
 	echo "                          'dey-image-webkit', 'core-image-base'..."
@ -70,10 +72,11 @@ echo "############################################################"
 # Command line admits the following parameters:
 # -u <u-boot-filename>
 # -i <image-name>
-while getopts 'dhi:nu:' c
+while getopts 'bdhi:nu:' c
 do
 	case $c in
-	d) INSTALL_DUALBOOT=true ;;
+	b) BOOTCOUNT=true ;;
+	d) INSTALL_DUALBOOT=true && BOOTCOUNT=true ;;
 	h) show_usage ;;
 	i) IMAGE_NAME=${OPTARG} ;;
 	n) NOWAIT=true ;;
@ -184,6 +187,11 @@ if [ ! -f ${INSTALL_ROOTFS_FILENAME} ]; then
 	fi
 fi

+# Enable bootcount mechanism by setting a bootlimit
+if [ "${BOOTCOUNT}" = true ]; then
+	bootlimit_cmd="setenv bootlimit 3"
+fi
+
 [ "${ABORT}" = true ] && exit 1

 # parts names
@ -241,6 +249,7 @@ uuu fb: ucmd mmc partconf 0 1 1 1
 # Set 'bootcmd' for the second part of the script that will
 #  - Reset environment to defaults
 #  - Reset the bootcount
+#  - Set bootlimit (if required)
 #  - Save the environment
 #  - Partition the eMMC user data area for Linux
 #  - Update the 'linux' partition
@ -250,6 +259,7 @@ uuu fb: ucmd setenv bootcmd "
 	env default -a;
 	setenv dualboot \${dualboot};
 	setenv bootcount 0
+	${bootlimit_cmd};
 	saveenv;
 	echo \"\";
 	echo \"\";
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6sbc/install_linux_fw_sd.txt
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6sbc/install_linux_fw_sd.txt
@ -155,6 +155,7 @@ fi
 #  - Partition the eMMC user data area for Linux
 #  - If Dual Boot
 #     - Update the system partitions: linux_a, linux_b, rootfs_a, rootfs_b
+      - Set bootlimit to 3
 #  - If Normal Boot:
 #     - Update the system partitions: linux, recovery, rootfs
 #     - Erase the 'update' partition
@ -230,6 +231,7 @@ setenv bootcmd "
 				exit;
 			fi;
 		fi;
+		setenv bootlimit 3;
 	else
 		echo \"\";
 		echo \"\";
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6sbc/install_linux_fw_usb.txt
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6sbc/install_linux_fw_usb.txt
@ -155,6 +155,7 @@ fi
 #  - Partition the eMMC user data area for Linux
 #  - If Dual Boot
 #     - Update the system partitions: linux_a, linux_b, rootfs_a, rootfs_b
+      - Set bootlimit to 3
 #  - If Normal Boot:
 #     - Update the system partitions: linux, recovery, rootfs
 #     - Erase the 'update' partition
@ -233,6 +234,7 @@ setenv bootcmd "
 				exit;
 			fi;
 		fi;
+		setenv bootlimit 3;
 	else
 		echo \"\";
 		echo \"\";
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6sbc/install_linux_fw_uuu.sh
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6sbc/install_linux_fw_uuu.sh
@ -32,7 +32,9 @@ show_usage()
 	echo "Usage: $0 [options]"
 	echo ""
 	echo "  Options:"
+	echo "   -b                     Activate bootcount mechanism (3 boot attempts)."
 	echo "   -d                     Install firmware on dualboot partitions (system A and system B)."
+	echo "                          (Implies -b)."
 	echo "   -h                     Show this help."
 	echo "   -i <dey-image-name>    Image name that prefixes the image filenames, such as 'dey-image-qt', "
 	echo "                          'dey-image-webkit', 'core-image-base'..."
@ -70,10 +72,11 @@ echo "############################################################"
 # Command line admits the following parameters:
 # -u <u-boot-filename>
 # -i <image-name>
-while getopts 'dhi:nu:' c
+while getopts 'bdhi:nu:' c
 do
 	case $c in
-	d) INSTALL_DUALBOOT=true ;;
+	b) BOOTCOUNT=true ;;
+	d) INSTALL_DUALBOOT=true && BOOTCOUNT=true ;;
 	h) show_usage ;;
 	i) IMAGE_NAME=${OPTARG} ;;
 	n) NOWAIT=true ;;
@ -202,6 +205,11 @@ if [ ! -f ${INSTALL_ROOTFS_FILENAME} ]; then
 	fi
 fi

+# Enable bootcount mechanism by setting a bootlimit
+if [ "${BOOTCOUNT}" = true ]; then
+	bootlimit_cmd="setenv bootlimit 3"
+fi
+
 [ "${ABORT}" = true ] && exit 1

 # parts names
@ -259,6 +267,7 @@ uuu fb: ucmd mmc partconf 0 1 1 1
 # Set 'bootcmd' for the second part of the script that will
 #  - Reset environment to defaults
 #  - Reset the bootcount
+#  - Set bootlimit (if required)
 #  - Save the environment
 #  - Partition the eMMC user data area for Linux
 #  - Update the 'linux' partition
@ -268,6 +277,7 @@ uuu fb: ucmd setenv bootcmd "
 	env default -a;
 	setenv dualboot \${dualboot};
 	setenv bootcount 0
+	${bootlimit_cmd};
 	saveenv;
 	echo \"\";
 	echo \"\";
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6ul/install_linux_fw_sd.txt
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6ul/install_linux_fw_sd.txt
@ -151,6 +151,7 @@ fi
 #  - Save the environment
 #  - If Dual Boot
 #     - Update the system partitions: linux_a, linux_b, rootfs_a, rootfs_b
+      - Set bootlimit to 3
 #  - If Normal Boot:
 #     - Update the system partitions: linux, recovery, rootfs
 #     - Erase the 'update' partition
@ -222,6 +223,7 @@ setenv bootcmd "
 				exit;
 			fi;
 		fi;
+		setenv bootlimit 3;
 	else
 		echo \"\";
 		echo \"\";
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6ul/install_linux_fw_usb.txt
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6ul/install_linux_fw_usb.txt
@ -153,6 +153,7 @@ fi
 #  - Save the environment
 #  - If Dual Boot
 #     - Update the system partitions: linux_a, linux_b, rootfs_a, rootfs_b
+      - Set bootlimit to 3
 #  - If Normal Boot:
 #     - Update the system partitions: linux, recovery, rootfs
 #     - Erase the 'update' partition
@ -225,6 +226,7 @@ setenv bootcmd "
 				exit;
 			fi;
 		fi;
+		setenv bootlimit 3;
 	else
 		echo \"\";
 		echo \"\";
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6ul/install_linux_fw_uuu.sh
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6ul/install_linux_fw_uuu.sh
@ -32,7 +32,9 @@ show_usage()
 	echo "Usage: $0 [options]"
 	echo ""
 	echo "  Options:"
+	echo "   -b                     Activate bootcount mechanism (3 boot attempts)."
 	echo "   -d                     Install firmware on dualboot partitions (system A and system B)."
+	echo "                          (Implies -b)."
 	echo "   -h                     Show this help."
 	echo "   -i <dey-image-name>    Image name that prefixes the image filenames, such as 'dey-image-qt', "
 	echo "                          'dey-image-webkit', 'core-image-base'..."
@ -79,10 +81,11 @@ echo "############################################################"
 # Command line admits the following parameters:
 # -u <u-boot-filename>
 # -i <image-name>
-while getopts 'dhi:nu:' c
+while getopts 'bdhi:nu:' c
 do
 	case $c in
-	d) INSTALL_DUALBOOT=true ;;
+	b) BOOTCOUNT=true ;;
+	d) INSTALL_DUALBOOT=true && BOOTCOUNT=true ;;
 	h) show_usage ;;
 	i) IMAGE_NAME=${OPTARG} ;;
 	n) NOWAIT=true ;;
@ -193,6 +196,11 @@ if [ ! -f ${INSTALL_ROOTFS_FILENAME} ]; then
 	fi
 fi

+# Enable bootcount mechanism by setting a bootlimit
+if [ "${BOOTCOUNT}" = true ]; then
+	bootlimit_cmd="setenv bootlimit 3"
+fi
+
 [ "${ABORT}" = true ] && exit 1

 # parts names
@ -250,6 +258,7 @@ part_update "uboot" "${INSTALL_UBOOT_FILENAME}" 5000
 # Set 'bootcmd' for the second part of the script that will
 #  - Reset environment to defaults
 #  - Reset the bootcount
+#  - Set bootlimit (if required)
 #  - Save the environment
 #  - Update the 'linux' partition
 #  - Update the 'recovery' partition
@ -260,6 +269,7 @@ uuu fb: ucmd setenv bootcmd "
 	setenv dualboot \${dualboot};
 	bootcount reset;
 	setenv singlemtdsys \${singlemtdsys};
+	${bootlimit_cmd};
 	saveenv;
 	echo \"\";
 	echo \"\";
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8m/install_linux_fw_sd.txt
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8m/install_linux_fw_sd.txt
@ -120,6 +120,7 @@ fi
 #  - Partition the eMMC user data area for Linux
 #  - If Dual Boot
 #     - Update the system partitions: linux_a, linux_b, rootfs_a, rootfs_b
+      - Set bootlimit to 3
 #  - If Normal Boot:
 #     - Update the system partitions: linux, recovery, rootfs
 #     - Erase the 'update' partition
@ -196,6 +197,7 @@ setenv bootcmd "
 				exit;
 			fi;
 		fi;
+		setenv bootlimit 3;
 	else
 		echo \"\";
 		echo \"\";
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8m/install_linux_fw_usb.txt
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8m/install_linux_fw_usb.txt
@ -120,6 +120,7 @@ fi
 #  - Partition the eMMC user data area for Linux
 #  - If Dual Boot
 #     - Update the system partitions: linux_a, linux_b, rootfs_a, rootfs_b
+      - Set bootlimit to 3
 #  - If Normal Boot:
 #     - Update the system partitions: linux, recovery, rootfs
 #     - Erase the 'update' partition
@ -197,6 +198,7 @@ setenv bootcmd "
 				exit;
 			fi;
 		fi;
+		setenv bootlimit 3;
 	else
 		echo \"\";
 		echo \"\";
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8m/install_linux_fw_uuu.sh
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8m/install_linux_fw_uuu.sh
@ -32,7 +32,9 @@ show_usage()
 	echo "Usage: $0 [options]"
 	echo ""
 	echo "  Options:"
+	echo "   -b                     Activate bootcount mechanism (3 boot attempts)."
 	echo "   -d                     Install firmware on dualboot partitions (system A and system B)."
+	echo "                          (Implies -b)."
 	echo "   -h                     Show this help."
 	echo "   -i <dey-image-name>    Image name that prefixes the image filenames, such as 'dey-image-qt', "
 	echo "                          'dey-image-webkit', 'core-image-base'..."
@ -70,10 +72,11 @@ echo "############################################################"
 # Command line admits the following parameters:
 # -u <u-boot-filename>
 # -i <image-name>
-while getopts 'dhi:nu:' c
+while getopts 'bdhi:nu:' c
 do
 	case $c in
-	d) INSTALL_DUALBOOT=true ;;
+	b) BOOTCOUNT=true ;;
+	d) INSTALL_DUALBOOT=true && BOOTCOUNT=true ;;
 	h) show_usage ;;
 	i) IMAGE_NAME=${OPTARG} ;;
 	n) NOWAIT=true ;;
@ -150,6 +153,11 @@ if [ ! -f ${INSTALL_ROOTFS_FILENAME} ]; then
 	fi
 fi

+# Enable bootcount mechanism by setting a bootlimit
+if [ "${BOOTCOUNT}" = true ]; then
+	bootlimit_cmd="setenv bootlimit 3"
+fi
+
 [ "${ABORT}" = true ] && exit 1

 # parts names
@ -210,6 +218,7 @@ uuu fb: ucmd mmc partconf 0 1 1 1
 # Set 'bootcmd' for the second part of the script that will
 #  - Reset environment to defaults
 #  - Reset the bootcount
+#  - Set bootlimit (if required)
 #  - Save the environment
 #  - Partition the eMMC user data area for Linux
 #  - Update the 'linux' partition
@ -219,6 +228,7 @@ uuu fb: ucmd setenv bootcmd "
 	env default -a;
 	setenv dualboot \${dualboot};
 	bootcount reset;
+	${bootlimit_cmd};
 	saveenv;
 	echo \"\";
 	echo \"\";
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8x/install_linux_fw_sd.txt
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8x/install_linux_fw_sd.txt
@ -132,6 +132,7 @@ fi
 #  - Partition the eMMC user data area for Linux
 #  - If Dual Boot
 #     - Update the system partitions: linux_a, linux_b, rootfs_a, rootfs_b
+      - Set bootlimit to 3
 #  - If Normal Boot:
 #     - Update the system partitions: linux, recovery, rootfs
 #     - Erase the 'update' partition
@ -208,6 +209,7 @@ setenv bootcmd "
 				exit;
 			fi;
 		fi;
+		setenv bootlimit 3;
 	else
 		echo \"\";
 		echo \"\";
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8x/install_linux_fw_usb.txt
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8x/install_linux_fw_usb.txt
@ -132,6 +132,7 @@ fi
 #  - Partition the eMMC user data area for Linux
 #  - If Dual Boot
 #     - Update the system partitions: linux_a, linux_b, rootfs_a, rootfs_b
+      - Set bootlimit to 3
 #  - If Normal Boot:
 #     - Update the system partitions: linux, recovery, rootfs
 #     - Erase the 'update' partition
@ -211,6 +212,7 @@ setenv bootcmd "
 				exit;
 			fi;
 		fi;
+		setenv bootlimit 3;
 	else
 		echo \"\";
 		echo \"\";
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8x/install_linux_fw_uuu.sh
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8x/install_linux_fw_uuu.sh
@ -32,7 +32,9 @@ show_usage()
 	echo "Usage: $0 [options]"
 	echo ""
 	echo "  Options:"
+	echo "   -b                     Activate bootcount mechanism (3 boot attempts)."
 	echo "   -d                     Install firmware on dualboot partitions (system A and system B)."
+	echo "                          (Implies -b)."
 	echo "   -h                     Show this help."
 	echo "   -i <dey-image-name>    Image name that prefixes the image filenames, such as 'dey-image-qt', "
 	echo "                          'dey-image-webkit', 'core-image-base'..."
@ -70,10 +72,11 @@ echo "############################################################"
 # Command line admits the following parameters:
 # -u <u-boot-filename>
 # -i <image-name>
-while getopts 'dhi:nu:' c
+while getopts 'bdhi:nu:' c
 do
 	case $c in
-	d) INSTALL_DUALBOOT=true ;;
+	b) BOOTCOUNT=true ;;
+	d) INSTALL_DUALBOOT=true && BOOTCOUNT=true ;;
 	h) show_usage ;;
 	i) IMAGE_NAME=${OPTARG} ;;
 	n) NOWAIT=true ;;
@ -157,6 +160,11 @@ if [ ! -f ${INSTALL_ROOTFS_FILENAME} ]; then
 	fi
 fi

+# Enable bootcount mechanism by setting a bootlimit
+if [ "${BOOTCOUNT}" = true ]; then
+	bootlimit_cmd="setenv bootlimit 3"
+fi
+
 [ "${ABORT}" = true ] && exit 1

 # parts names
@ -214,6 +222,7 @@ uuu fb: ucmd mmc partconf 0 1 1 1
 # Set 'bootcmd' for the second part of the script that will
 #  - Reset environment to defaults
 #  - Reset the bootcount
+#  - Set bootlimit (if required)
 #  - Save the environment
 #  - Partition the eMMC user data area for Linux
 #  - Update the 'linux' partition
@ -223,6 +232,7 @@ uuu fb: ucmd setenv bootcmd "
 	env default -a;
 	setenv dualboot \${dualboot};
 	bootcount reset;
+	${bootlimit_cmd};
 	saveenv;
 	echo \"\";
 	echo \"\";
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx93-dvk/boot.txt
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx93-dvk/boot.txt
@ -60,8 +60,6 @@ setenv ORIG_overlays ${overlays}
 # Determine overlays to apply depending on the hardware capabilities
 # described by the HWID, SOM version, and carrier board version.
 #
-setexpr module_has_mca ${hwid_2} \& 10000
-setexpr module_has_mca ${module_has_mca} / 10000
 setexpr module_has_wifi ${hwid_2} \& 20000
 setexpr module_has_wifi ${module_has_wifi} / 20000
 setexpr module_has_bt ${hwid_2} \& 40000
@ -75,10 +73,6 @@ if test "${module_has_wifi}" = "1" && test -z "${disable_wifi}"; then
 	setenv overlays _ov_som_wifi_ccimx93.dtbo,${overlays}
 fi

-if test "${module_has_mca}" = "1" && test -z "${disable_mca}"; then
-	setenv overlays _ov_som_mca_ccimx93.dtbo,${overlays}
-fi
-
 if test "${cpu_type}" = "imx9352" || \
   test "${cpu_type}" = "imx9351" || \
   test "${cpu_type}" = "imx9322" || \
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx93/install_linux_fw_sd.txt
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx93/install_linux_fw_sd.txt
@ -7,7 +7,20 @@
 install_abort=0
 BASEFILENAME=0

-setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##.bin;
+# Determine U-Boot file to program basing on SOM's SOC revision
+if test -z "${soc_rev}"; then
+	# Fallback to hardware version if soc_rev is empty
+	setexpr som_hv ${hwid_2} \& 78
+	setexpr som_hv ${som_hv} / 8
+	if test "${som_hv}" -lt "2"; then
+		SOCREV="-A0"
+	fi
+else
+	if test "${soc_rev}" = "0x10"; then
+		SOCREV="-A0"
+	fi
+fi
+setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##${SOCREV}.bin
 setenv INSTALL_MMCDEV 1

 if test -z "${image-name}"; then
@ -118,6 +131,7 @@ fi
 #  - Partition the eMMC user data area for Linux
 #  - If Dual Boot
 #     - Update the system partitions: linux_a, linux_b, rootfs_a, rootfs_b
+      - Set bootlimit to 3
 #  - If Normal Boot:
 #     - Update the system partitions: linux, recovery, rootfs
 #     - Erase the 'update' partition
@ -194,6 +208,7 @@ setenv bootcmd "
 				exit;
 			fi;
 		fi;
+		setenv bootlimit 3;
 	else
 		echo \"\";
 		echo \"\";
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx93/install_linux_fw_usb.txt
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx93/install_linux_fw_usb.txt
@ -7,7 +7,20 @@
 install_abort=0
 BASEFILENAME=0

-setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##.bin;
+# Determine U-Boot file to program basing on SOM's SOC revision
+if test -z "${soc_rev}"; then
+	# Fallback to hardware version if soc_rev is empty
+	setexpr som_hv ${hwid_2} \& 78
+	setexpr som_hv ${som_hv} / 8
+	if test "${som_hv}" -lt "2"; then
+		SOCREV="-A0"
+	fi
+else
+	if test "${soc_rev}" = "0x10"; then
+		SOCREV="-A0"
+	fi
+fi
+setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##${SOCREV}.bin
 setenv INSTALL_USBDEV 0

 if test -z "${image-name}"; then
@ -118,6 +131,7 @@ fi
 #  - Partition the eMMC user data area for Linux
 #  - If Dual Boot
 #     - Update the system partitions: linux_a, linux_b, rootfs_a, rootfs_b
+      - Set bootlimit to 3
 #  - If Normal Boot:
 #     - Update the system partitions: linux, recovery, rootfs
 #     - Erase the 'update' partition
@ -195,6 +209,7 @@ setenv bootcmd "
 				exit;
 			fi;
 		fi;
+		setenv bootlimit 3;
 	else
 		echo \"\";
 		echo \"\";
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx93/install_linux_fw_uuu.sh
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx93/install_linux_fw_uuu.sh
@ -32,7 +32,9 @@ show_usage()
 	echo "Usage: $0 [options]"
 	echo ""
 	echo "  Options:"
+	echo "   -b                     Activate bootcount mechanism (3 boot attempts)."
 	echo "   -d                     Install firmware on dualboot partitions (system A and system B)."
+	echo "                          (Implies -b)."
 	echo "   -h                     Show this help."
 	echo "   -i <dey-image-name>    Image name that prefixes the image filenames, such as 'dey-image-qt', "
 	echo "                          'dey-image-webkit', 'core-image-base'..."
@ -70,10 +72,11 @@ echo "############################################################"
 # Command line admits the following parameters:
 # -u <u-boot-filename>
 # -i <image-name>
-while getopts 'dhi:nu:' c
+while getopts 'bdhi:nu:' c
 do
 	case $c in
-	d) INSTALL_DUALBOOT=true ;;
+	b) BOOTCOUNT=true ;;
+	d) INSTALL_DUALBOOT=true && BOOTCOUNT=true ;;
 	h) show_usage ;;
 	i) IMAGE_NAME=${OPTARG} ;;
 	n) NOWAIT=true ;;
@ -90,17 +93,27 @@ if [ "${dualboot}" = "yes" ]; then
 	DUALBOOT=true;
 fi

-# remove redirect
-uuu fb: ucmd setenv stdout serial
-
 echo ""
 echo "Determining image files to use..."

-# Determine U-Boot file to program basing on SOM's SOC type (linked to bus width)
+# Determine U-Boot file to program basing on SOM's SOC revision
 if [ -z "${INSTALL_UBOOT_FILENAME}" ]; then
-	INSTALL_UBOOT_FILENAME="imx-boot-##MACHINE##.bin"
+	soc_rev="$(getenv soc_rev)"
+	if [ -n "${soc_rev}" ]; then
+		[ "${soc_rev}" = "0x10" ] && SOCREV="-A0"
+	else
+		# Fallback to hardware version if soc_rev is empty
+		hwid_2="$(getenv hwid_2)"
+		hwid_2="0x${hwid_2#0x}"
+		som_hv="$(((hwid_2 & 0x78) >> 3))"
+		[ "${som_hv}" -lt "2" ] && SOCREV="-A0"
+	fi
+	INSTALL_UBOOT_FILENAME="imx-boot-##MACHINE##${SOCREV}.bin"
 fi

+# remove redirect
+uuu fb: ucmd setenv stdout serial
+
 # Determine linux, recovery, and rootfs image filenames to update
 if [ -z "${IMAGE_NAME}" ]; then
 	IMAGE_NAME="##DEFAULT_IMAGE_NAME##"
@ -150,6 +163,11 @@ if [ ! -f ${INSTALL_ROOTFS_FILENAME} ]; then
 	fi
 fi

+# Enable bootcount mechanism by setting a bootlimit
+if [ "${BOOTCOUNT}" = true ]; then
+	bootlimit_cmd="setenv bootlimit 3"
+fi
+
 [ "${ABORT}" = true ] && exit 1

 # parts names
@ -210,6 +228,7 @@ uuu fb: ucmd mmc partconf 0 1 1 1
 # Set 'bootcmd' for the second part of the script that will
 #  - Reset environment to defaults
 #  - Reset the bootcount
+#  - Set bootlimit (if required)
 #  - Save the environment
 #  - Partition the eMMC user data area for Linux
 #  - Update the 'linux' partition
@ -219,6 +238,7 @@ uuu fb: ucmd setenv bootcmd "
 	env default -a;
 	setenv dualboot \${dualboot};
 	bootcount reset;
+	${bootlimit_cmd};
 	saveenv;
 	echo \"\";
 	echo \"\";
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccmp1/fit_legacy.cfg
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccmp1/fit_legacy.cfg
@ -0,0 +1 @@
+# CONFIG_LEGACY_IMAGE_FORMAT is not set
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccmp1/fit_signature.cfg
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccmp1/fit_signature.cfg
@ -0,0 +1,4 @@
+CONFIG_FIT_SIGNATURE=y
+CONFIG_RSA=y
+CONFIG_ECDSA=y
+CONFIG_ECDSA_VERIFY=y
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccmp1/install_linux_fw_sd.txt
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccmp1/install_linux_fw_sd.txt
@ -152,6 +152,7 @@ fi
 #    environment
 #  - If Dual Boot
 #     - Update the system partitions: linux_a, linux_b, rootfs_a, rootfs_b
+      - Set bootlimit to 3
 #  - If Normal Boot:
 #     - Update the system partitions: linux, recovery, rootfs
 #     - Configure recovery to wipe 'update' partition
@ -215,6 +216,7 @@ setenv bootcmd "
 				exit;
 			fi;
 		fi;
+		setenv bootlimit 3;
 	else
 		echo \"\";
 		echo \"\";
@ -255,8 +257,8 @@ setenv bootcmd "
 		echo \"\";
 		setenv boot_recovery yes;
 		setenv recovery_command wipe_update;
-		saveenv;
 	fi;
+	saveenv;
 	echo \"\";
 	echo \"\";
 	echo \">> Firmware installation complete.\";
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccmp1/install_linux_fw_usb.txt
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccmp1/install_linux_fw_usb.txt
@ -154,6 +154,7 @@ fi
 #    environment
 #  - If Dual Boot
 #     - Update the system partitions: linux_a, linux_b, rootfs_a, rootfs_b
+      - Set bootlimit to 3
 #  - If Normal Boot:
 #     - Update the system partitions: linux, recovery, rootfs
 #     - Configure recovery to wipe 'update' partition
@ -218,6 +219,7 @@ setenv bootcmd "
 				exit;
 			fi;
 		fi;
+		setenv bootlimit 3;
 	else
 		echo \"\";
 		echo \"\";
@ -258,8 +260,8 @@ setenv bootcmd "
 		echo \"\";
 		setenv boot_recovery yes;
 		setenv recovery_command wipe_update;
-		saveenv;
 	fi;
+	saveenv;
 	echo \"\";
 	echo \"\";
 	echo \">> Firmware installation complete.\";
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccmp1/install_linux_fw_uuu.sh
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccmp1/install_linux_fw_uuu.sh
@ -40,7 +40,9 @@ show_usage()
 	echo "  Options:"
 	echo "   -a <atf-filename>      Arm-trusted-firmware filename."
 	echo "                          Auto-determined by variant if not provided."
+	echo "   -b                     Activate bootcount mechanism (3 boot attempts)."
 	echo "   -d                     Install firmware on dualboot partitions (system A and system B)."
+	echo "                          (Implies -b)."
 	echo "   -f <fip-filename>      FIP filename."
 	echo "                          Auto-determined by variant if not provided."
 	echo "   -h                     Show this help."
@ -80,11 +82,12 @@ echo "############################################################"
 # -a <atf-filename>
 # -f <fip-filename>
 # -i <image-name>
-while getopts 'a:df:hi:n' c
+while getopts 'a:bdf:hi:n' c
 do
 	case $c in
 	a) INSTALL_ATF_FILENAME=${OPTARG} ;;
-	d) INSTALL_DUALBOOT=true ;;
+	b) BOOTCOUNT=true ;;
+	d) INSTALL_DUALBOOT=true && BOOTCOUNT=true ;;
 	f) INSTALL_FIP_FILENAME=${OPTARG} ;;
 	h) show_usage ;;
 	i) IMAGE_NAME=${OPTARG} ;;
@ -163,6 +166,11 @@ if [ ! -f ${INSTALL_ROOTFS_FILENAME} ]; then
 	fi
 fi

+# Enable bootcount mechanism by setting a bootlimit
+if [ "${BOOTCOUNT}" = true ]; then
+	bootlimit_cmd="setenv bootlimit 3"
+fi
+
 [ "${ABORT}" = true ] && exit 1

 # parts names
@ -235,6 +243,7 @@ fi
 #  - Reset environment to defaults
 #  - Keep the 'dualboot' status
 #  - Reset the bootcount
+#  - Set bootlimit (if required)
 #  - Save the environment
 #  - Update the 'linux' partition(s)
 #  - Update the 'rootfs' partition(s)
@ -242,6 +251,7 @@ uuu fb: ucmd setenv bootcmd "
 	env default -a;
 	setenv dualboot \${dualboot};
 	bootcount reset;
+	${bootlimit_cmd};
 	saveenv;
 	saveenv;
 	echo \"\";
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccmp13-dvk/boot.txt
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccmp13-dvk/boot.txt
@ -66,9 +66,18 @@ if test "${module_has_wifi}" = "1" && test -z "${disable_wifi}"; then
 	setenv overlays _ov_som_wifi_ccmp13.dtbo,${overlays}
 fi

+# Apply DVKv2 overlay if the board_version is 2
+if test "${board_version}" -eq "2"; then
+	setenv overlays _ov_board_v2_ccmp13-dvk.dtbo,${overlays}
+fi
+
 if test "${boot_device}" = "mmc"; then
 	dboot linux mmc
 else
+	if test "${dboot_kernel_var}" = "fitimage"; then
+		# Set temp var to avoid re-loading fitimage
+		setenv temp-fitimg-loaded yes
+	fi
 	dboot linux nand ${mtdbootpart}
 fi

--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccmp15-dvk/boot.txt
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccmp15-dvk/boot.txt
@ -53,8 +53,6 @@ setenv ORIG_overlays ${overlays}
 # Determine overlays to apply depending on the hardware capabilities
 # described by the HWID, SOM version, and carrier board version.
 #
-setexpr module_has_mca ${hwid_2} \& 10000
-setexpr module_has_mca ${module_has_mca} / 10000
 setexpr module_has_wifi ${hwid_2} \& 20000
 setexpr module_has_wifi ${module_has_wifi} / 20000
 setexpr module_has_bt ${hwid_2} \& 40000
@ -68,18 +66,23 @@ if test "${module_has_wifi}" = "1" && test -z "${disable_wifi}"; then
 	setenv overlays _ov_som_wifi_ccmp15.dtbo,${overlays}
 fi

-if test "${module_has_mca}" = "1" && test -z "${disable_mca}"; then
-	setenv overlays _ov_som_mca_ccmp15.dtbo,${overlays}
-fi
-
 # Apply DVKv1 overlay if the board_version is 1
 if test -z "${board_version}" || test "${board_version}" -eq "1"; then
 	setenv overlays _ov_board_v1_ccmp15-dvk.dtbo,${overlays}
 fi

+# Apply DVKv2 overlay if the board_version is 2
+if test "${board_version}" -eq "2"; then
+	setenv overlays _ov_board_v2_ccmp15-dvk.dtbo,${overlays}
+fi
+
 if test "${boot_device}" = "mmc"; then
 	dboot linux mmc
 else
+	if test "${dboot_kernel_var}" = "fitimage"; then
+		# Set temp var to avoid re-loading fitimage
+		setenv temp-fitimg-loaded yes
+	fi
 	dboot linux nand ${mtdbootpart}
 fi

--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey_2020.04.bb
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey_2020.04.bb
@ -1,4 +1,4 @@
-# Copyright (C) 2020-2022 Digi International
+# Copyright (C) 2020-2023 Digi International

 require u-boot-dey.inc
 LIC_FILES_CHKSUM = "file://Licenses/README;md5=30503fd321432fc713238f582193b78e"
@ -8,4 +8,4 @@ DEPENDS += "flex-native bison-native"
 SRCBRANCH = "v2020.04/maint"
 SRCREV = "${AUTOREV}"

-COMPATIBLE_MACHINE = "(ccimx8x|ccimx8m|ccimx6ul)"
+COMPATIBLE_MACHINE = "(ccimx6ul|ccimx8m|ccimx8x)"
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey_2021.10.bb
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey_2021.10.bb
@ -1,4 +1,4 @@
-# Copyright (C) 2022 Digi International
+# Copyright (C) 2022,2023 Digi International

 require u-boot-dey.inc
 LIC_FILES_CHKSUM = "file://Licenses/README;md5=5a7450c57ffe5ae63fd732446b988025"
@ -9,4 +9,31 @@ DEPENDS += "python3-setuptools-native"
 SRCBRANCH = "v2021.10/maint"
 SRCREV = "${AUTOREV}"

+UBOOT_FIT_CFG_FRAGMENTS = " \
+    file://fit_legacy.cfg \
+    file://fit_signature.cfg \
+"
+
+SRC_URI += " \
+    ${@oe.utils.conditional('TRUSTFENCE_SIGN', '1', '${UBOOT_FIT_CFG_FRAGMENTS}', '', d)} \
+"
+# Install UBOOT_ENV_BINARY to datadir, so that kernel can use it
+# to include it into the FIT image.
+install_helper_bootscr() {
+	if [ -f "${D}/boot/${UBOOT_ENV_BINARY}" ]; then
+		# Install UBOOT_ENV_BINARY into datadir to share it with the kernel
+		install -Dm 0644 ${D}/boot/${UBOOT_ENV_BINARY} ${D}${datadir}/${UBOOT_ENV_IMAGE}
+		ln -sf ${UBOOT_ENV_IMAGE} ${D}${datadir}/${UBOOT_ENV_BINARY}
+	else
+		bbwarn "${D}/boot/${UBOOT_ENV_BINARY} not found"
+	fi
+}
+
+do_install:append() {
+	# Copy boot script, so kernel can include it when creating the FIT image 
+	if [ "${TRUSTFENCE_FIT_IMG}" = "1" ] && [ -n "${UBOOT_ENV_BINARY}" ]; then
+		install_helper_bootscr
+	fi
+}
+
 COMPATIBLE_MACHINE = "(ccmp1)"
--- a/meta-digi-arm/recipes-connectivity/nxp-wlan-sdk/nxp-wlan-sdk_git.inc
+++ b/meta-digi-arm/recipes-connectivity/nxp-wlan-sdk/nxp-wlan-sdk_git.inc
@ -3,10 +3,10 @@ LICENSE = "GPL-2.0-only"
 LIC_FILES_CHKSUM = "file://${WORKDIR}/git/LICENSE;md5=ab04ac0f249af12befccb94447c08b77"

 # For Kernel 5.4 and later
-SRCBRANCH = "lf-6.1.22_2.0.0"
+SRCBRANCH = "lf-6.1.55_2.2.0"
 MRVL_SRC ?= "git://github.com/nxp-imx/mwifiex.git;protocol=https"
 SRC_URI = "${MRVL_SRC};branch=${SRCBRANCH}"
-SRCREV = "f1382ccbd34fc22daf504e798745f6cddb702b82"
+SRCREV = "952d10f3349426f917636a4560974117eb6eef5b"

 S = "${WORKDIR}/git/mxm_wifiex/wlan_src"

--- a/meta-digi-arm/recipes-core/udev/udev-extraconf/automount.rules
+++ b/meta-digi-arm/recipes-core/udev/udev-extraconf/automount.rules
@ -18,13 +18,13 @@ SUBSYSTEM=="block", ENV{ID_PART_ENTRY_NAME}=="linux*|update*|data*", ACTION=="ad
 SUBSYSTEM=="mtd", ATTRS{name}=="linux*|update*|data*", ACTION=="add", RUN+="/etc/udev/scripts/mount_digiparts.sh", GOTO="automount_rules_end"
 SUBSYSTEM=="ubi", KERNEL=="ubi*", ATTRS{name}=="linux*|update*|data*", ACTION=="add", RUN+="/etc/udev/scripts/mount_digiparts.sh", GOTO="automount_rules_end"

-# Avoid mounting recovery partition
-SUBSYSTEM=="block", ENV{ID_PART_ENTRY_NAME}=="recovery*", ACTION=="add", GOTO="automount_rules_end"
+# Avoid mounting recovery partition & alternative rootfs partition
+SUBSYSTEM=="block", ENV{ID_PART_ENTRY_NAME}=="recovery*|rootfs*", ACTION=="add", GOTO="automount_rules_end"
 SUBSYSTEM=="mtd", ATTRS{name}=="recovery*", ACTION=="add", GOTO="automount_rules_end"

 # Media automounting
-SUBSYSTEM=="block", ACTION=="add"    RUN+="/etc/udev/scripts/mount.sh"
-SUBSYSTEM=="block", ACTION=="remove" RUN+="/etc/udev/scripts/mount.sh"
-SUBSYSTEM=="block", ACTION=="change", ENV{DISK_MEDIA_CHANGE}=="1" RUN+="/etc/udev/scripts/mount.sh"
+SUBSYSTEM=="block", ENV{ID_FS_USAGE}=="filesystem", ACTION=="add", RUN+="/etc/udev/scripts/mount.sh"
+SUBSYSTEM=="block", ACTION=="remove", RUN+="/etc/udev/scripts/mount.sh"
+SUBSYSTEM=="block", ACTION=="change", ENV{DISK_MEDIA_CHANGE}=="1", RUN+="/etc/udev/scripts/mount.sh"

 LABEL="automount_rules_end"
--- a/Show More
+++ b/Show More