Merge branch 'dey-4.0/master' into dey-4.0/maint

Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>

meta-digi-arm/classes/image_types_digi.bbclass

@@ -231,15 +231,17 @@ IMAGE_TYPES += "cpio.gz.u-boot.tf"
 do_image_squashfs[postfuncs] += "${@oe.utils.conditional('TRUSTFENCE_SIGN', '1', 'rootfs_sign', '', d)}"
 
 rootfs_sign() {
-        # Set environment variables for trustfence configuration
+	# Set environment variables for trustfence configuration
-        export CONFIG_SIGN_KEYS_PATH="${TRUSTFENCE_SIGN_KEYS_PATH}"
+	export CONFIG_SIGN_KEYS_PATH="${TRUSTFENCE_SIGN_KEYS_PATH}"
-        [ -n "${CONFIG_KEY_INDEX}" ] && export CONFIG_KEY_INDEX="${TRUSTFENCE_KEY_INDEX}"
+	[ -n "${CONFIG_KEY_INDEX}" ] && export CONFIG_KEY_INDEX="${TRUSTFENCE_KEY_INDEX}"
 
-        ROOTFS_IMAGE="${IMGDEPLOYDIR}/${IMAGE_NAME}.rootfs.squashfs"
+	if [ "${DEY_SOC_VENDOR}" = "NXP" ]; then
-        TMP_ROOTFS_IMAGE_SIGNED="$(mktemp ${ROOTFS_IMAGE}-signed.XXXXXX)"
+		ROOTFS_IMAGE="${IMGDEPLOYDIR}/${IMAGE_NAME}.rootfs.squashfs"
-        # Sign rootfs read-only image
+		TMP_ROOTFS_IMAGE_SIGNED="$(mktemp ${ROOTFS_IMAGE}-signed.XXXXXX)"
-        trustfence-sign-artifact.sh -p "${DIGI_SOM}" -r "${ROOTFS_IMAGE}" "${TMP_ROOTFS_IMAGE_SIGNED}"
+		# Sign rootfs read-only image
-        mv "${TMP_ROOTFS_IMAGE_SIGNED}" "${ROOTFS_IMAGE}"
+		trustfence-sign-artifact.sh -p "${DIGI_SOM}" -r "${ROOTFS_IMAGE}" "${TMP_ROOTFS_IMAGE_SIGNED}"
+		mv "${TMP_ROOTFS_IMAGE_SIGNED}" "${ROOTFS_IMAGE}"
+	fi
 }
 
 rootfs_sign[dirs] = "${DEPLOY_DIR_IMAGE}"

meta-digi-arm/conf/layer.conf

@@ -24,6 +24,15 @@ LAYERDEPENDS_digi-arm += "${@oe.utils.conditional('DEY_SOC_VENDOR', 'STM', 'stm-
 
 LAYERSERIES_COMPAT_digi-arm = "kirkstone"
 
+# Define new EULAs and add them to the list defined in meta-freescale.
+# See fsl-eula-unpack.bbclass.
+FSL_EULA_FILE_MD5SUM_LA_OPT_NXP_SOFTWARE_LICENSE_V42 = "ea25d099982d035af85d193c88a1b479"
+FSL_EULA_FILE_MD5SUM_LA_OPT_NXP_SOFTWARE_LICENSE_V45 = "63a38e9f392d8813d6f1f4d0d6fbe657"
+FSL_EULA_FILE_MD5SUMS:append = " \
+    ${FSL_EULA_FILE_MD5SUM_LA_OPT_NXP_SOFTWARE_LICENSE_V42} \
+    ${FSL_EULA_FILE_MD5SUM_LA_OPT_NXP_SOFTWARE_LICENSE_V45} \
+"
+
 # STM EULA
 EULA_FILE_ST_${MACHINE} = "${LAYERDIR}/conf/eula/${MACHINE}"
 EULA_FILE_ST_MD5SUM_${MACHINE} = "8b505090fb679839cefbcc784afe8ce9"

meta-digi-arm/conf/machine/ccimx8x-sbc-express.conf

@@ -6,11 +6,9 @@
 include conf/machine/include/ccimx8x.inc
 
 # U-Boot configurations
-# Last one is the default (the one the symlinks point at)
+UBOOT_CONFIG ??= "ccimx8x_sbc_express"
-UBOOT_CONFIG ??= "ccimx8x_sbc_express512MB ccimx8x_sbc_express1GB ccimx8x_sbc_express2GB"
+UBOOT_CONFIG[ccimx8x_sbc_express] = "ccimx8x_sbc_express_defconfig,,u-boot-dtb.${UBOOT_SUFFIX}"
-UBOOT_CONFIG[ccimx8x_sbc_express2GB] = "ccimx8x_sbc_express2GB_defconfig,,u-boot-dtb.${UBOOT_SUFFIX}"
+SPL_BINARY = "spl/u-boot-spl.bin"
-UBOOT_CONFIG[ccimx8x_sbc_express1GB] = "ccimx8x_sbc_express1GB_defconfig,,u-boot-dtb.${UBOOT_SUFFIX}"
-UBOOT_CONFIG[ccimx8x_sbc_express512MB] = "ccimx8x_sbc_express512MB_defconfig,,u-boot-dtb.${UBOOT_SUFFIX}"
 
 KERNEL_DEVICETREE ?= " \
     digi/ccimx8x-sbc-express.dtb \
@@ -36,12 +34,6 @@ IMAGE_FSTYPES ?= '${@bb.utils.contains("IMAGE_FEATURES", "read-only-rootfs", \
 
 # Boot artifacts to be copied from the deploy dir to the installer ZIP
 BOOTABLE_ARTIFACTS = " \
-    imx-boot-ccimx8x-sbc-express-B0-1GB_16bit.bin \
+    imx-boot-ccimx8x-sbc-express-B0.bin \
-    imx-boot-ccimx8x-sbc-express-B0-1GB_32bit.bin \
+    imx-boot-ccimx8x-sbc-express-C0.bin \
-    imx-boot-ccimx8x-sbc-express-B0-2GB_32bit.bin \
-    imx-boot-ccimx8x-sbc-express-B0-512MB_16bit.bin \
-    imx-boot-ccimx8x-sbc-express-C0-1GB_16bit.bin \
-    imx-boot-ccimx8x-sbc-express-C0-1GB_32bit.bin \
-    imx-boot-ccimx8x-sbc-express-C0-2GB_32bit.bin \
-    imx-boot-ccimx8x-sbc-express-C0-512MB_16bit.bin \
 "

meta-digi-arm/conf/machine/ccimx8x-sbc-pro.conf

@@ -7,10 +7,9 @@ include conf/machine/include/ccimx8x.inc
 
 # U-Boot configurations
 # Last one is the default (the one the symlinks point at)
-UBOOT_CONFIG ??= "ccimx8x_sbc_pro512MB ccimx8x_sbc_pro1GB ccimx8x_sbc_pro2GB"
+UBOOT_CONFIG ??= "ccimx8x_sbc_pro"
-UBOOT_CONFIG[ccimx8x_sbc_pro2GB] = "ccimx8x_sbc_pro2GB_defconfig,,u-boot-dtb.${UBOOT_SUFFIX}"
+UBOOT_CONFIG[ccimx8x_sbc_pro] = "ccimx8x_sbc_pro_defconfig,,u-boot-dtb.${UBOOT_SUFFIX}"
-UBOOT_CONFIG[ccimx8x_sbc_pro1GB] = "ccimx8x_sbc_pro1GB_defconfig,,u-boot-dtb.${UBOOT_SUFFIX}"
+SPL_BINARY = "spl/u-boot-spl.bin"
-UBOOT_CONFIG[ccimx8x_sbc_pro512MB] = "ccimx8x_sbc_pro512MB_defconfig,,u-boot-dtb.${UBOOT_SUFFIX}"
 
 KERNEL_DEVICETREE ?= " \
     digi/ccimx8x-sbc-pro.dtb \
@@ -49,17 +48,11 @@ IMAGE_FSTYPES ?= '${@bb.utils.contains("IMAGE_FEATURES", "read-only-rootfs", \
 
 # Boot artifacts to be copied from the deploy dir to the installer ZIP
 BOOTABLE_ARTIFACTS = " \
-    imx-boot-ccimx8x-sbc-pro-B0-1GB_16bit.bin \
+    imx-boot-ccimx8x-sbc-pro-B0.bin \
-    imx-boot-ccimx8x-sbc-pro-B0-1GB_32bit.bin \
+    imx-boot-ccimx8x-sbc-pro-C0.bin \
-    imx-boot-ccimx8x-sbc-pro-B0-2GB_32bit.bin \
-    imx-boot-ccimx8x-sbc-pro-B0-512MB_16bit.bin \
-    imx-boot-ccimx8x-sbc-pro-C0-1GB_16bit.bin \
-    imx-boot-ccimx8x-sbc-pro-C0-1GB_32bit.bin \
-    imx-boot-ccimx8x-sbc-pro-C0-2GB_32bit.bin \
-    imx-boot-ccimx8x-sbc-pro-C0-512MB_16bit.bin \
 "
 
 # Default overlayfs_etc mount point and type
 OVERLAYFS_ETC_MOUNT_POINT ?= "/mnt/data"
 OVERLAYFS_ETC_DEVICE ?= "/dev/mmcblk0p7"
-OVERLAYFS_ETC_FSTYPE ?= "ext4"
+OVERLAYFS_ETC_FSTYPE ?= "ext4"

meta-digi-arm/conf/machine/ccimx93-dvk.conf

@@ -14,6 +14,9 @@ UBOOT_CONFIG ??= "ccimx93-dvk"
 UBOOT_CONFIG[ccimx93-dvk] = "ccimx93-dvk_defconfig"
 UBOOT_DTB_NAME = "ccimx93-dvk.dtb"
 
+BOOTLOADER_SEEK_USERDATA = "32"
+BOOTLOADER_SEEK_BOOT = "0"
+
 KERNEL_DEVICETREE ?= " \
     digi/ccimx93-dvk.dtb \
     digi/_ov_board_dsi_display_ccimx93-dvk.dtbo \

meta-digi-arm/conf/machine/ccmp13-dvk.conf

@@ -17,8 +17,9 @@ MACHINEOVERRIDES = "arm:armv7ve:stcommon:stm32mpcommon:stm32mp1common:${DIGI_FAM
 # =========================================================================
 # boot device
 # =========================================================================
-# Configure the list of boards that enable NAND
+# Configure the list of boards that enable NAND/SDCARD
 DEVICE_BOARD_ENABLE:NAND   += "ccmp13-dvk"
+DEVICE_BOARD_ENABLE:SDCARD += "${@bb.utils.contains('BOOTDEVICE_LABELS', 'sdcard', 'ccmp13-dvk', '', d)}"
 
 # =========================================================================
 # U-Boot configs
@@ -92,12 +93,6 @@ ST_TOOLS_FOR_SDK:remove = "nativesdk-gcc-arm-none-eabi"
 # activate/deactivate the debug and trace on boot stage
 ST_DEBUG_TRACE = "0"
 
-# =========================================================================
-# trusted-firmware-a
-# =========================================================================
-# Configure trusted-firmware-a build
-TF_A_CONFIG = "optee nand"
-
 # =========================================================================
 # optee
 # =========================================================================
@@ -114,6 +109,7 @@ OPTEE_CONF = "ccmp13-dvk"
 KERNEL_IMAGETYPE = "zImage"
 KERNEL_ALT_IMAGETYPE = "Image uImage vmlinux"
 KERNEL_DEFCONFIG ?= "ccmp1_defconfig"
+KERNEL_EXTERNAL_DEFCONFIG ?= "defconfig"
 ST_KERNEL_LOADADDR ?= "0xC0008000"
 
 # =========================================================================
@@ -166,5 +162,5 @@ BOOTABLE_ARTIFACTS = " \
 
 # Default overlayfs_etc mount point and type
 OVERLAYFS_ETC_MOUNT_POINT ?= "/mnt/data"
-OVERLAYFS_ETC_DEVICE ?= "ubi0:data"
+OVERLAYFS_ETC_DEVICE ?= "ubi1:data"
 OVERLAYFS_ETC_FSTYPE ?= "ubifs"

meta-digi-arm/conf/machine/ccmp15-dvk.conf

@@ -17,8 +17,9 @@ MACHINEOVERRIDES = "arm:armv7ve:stcommon:stm32mpcommon:stm32mp1common:${DIGI_FAM
 # =========================================================================
 # boot device
 # =========================================================================
-# Configure the list of boards that enable NAND
+# Configure the list of boards that enable NAND/SDCARD
 DEVICE_BOARD_ENABLE:NAND   += "ccmp15-dvk"
+DEVICE_BOARD_ENABLE:SDCARD += "${@bb.utils.contains('BOOTDEVICE_LABELS', 'sdcard', 'ccmp15-dvk', '', d)}"
 
 # =========================================================================
 # U-Boot configs
@@ -50,6 +51,7 @@ STM32MP_KERNEL_DEVICETREE:ccmp15-dvk += " \
     _ov_board_v1_ccmp15-dvk.dtbo \
     _ov_som_bt_ccmp15.dtbo \
     _ov_som_bt_test_ccmp15.dtbo \
+    _ov_som_mca_ccmp15.dtbo \
     _ov_som_wifi_ccmp15.dtbo \
 "
 
@@ -99,12 +101,6 @@ ST_TOOLS_FOR_SDK:remove = "nativesdk-gcc-arm-none-eabi"
 # activate/deactivate the debug and trace on boot stage
 ST_DEBUG_TRACE = "0"
 
-# =========================================================================
-# trusted-firmware-a
-# =========================================================================
-# Configure trusted-firmware-a build
-TF_A_CONFIG = "optee nand"
-
 # =========================================================================
 # optee
 # =========================================================================
@@ -121,6 +117,7 @@ OPTEE_CONF = "ccmp15-dvk"
 KERNEL_IMAGETYPE = "zImage"
 KERNEL_ALT_IMAGETYPE = "Image uImage vmlinux"
 KERNEL_DEFCONFIG ?= "ccmp1_defconfig"
+KERNEL_EXTERNAL_DEFCONFIG ?= "defconfig"
 ST_KERNEL_LOADADDR ?= "0xC0008000"
 
 # =========================================================================
@@ -170,5 +167,5 @@ BOOTABLE_ARTIFACTS = " \
 
 # Default overlayfs_etc mount point and type
 OVERLAYFS_ETC_MOUNT_POINT ?= "/mnt/data"
-OVERLAYFS_ETC_DEVICE ?= "ubi0:data"
+OVERLAYFS_ETC_DEVICE ?= "ubi1:data"
 OVERLAYFS_ETC_FSTYPE ?= "ubifs"

meta-digi-arm/conf/machine/include/ccimx6.inc

@@ -11,6 +11,8 @@ include conf/machine/include/arm/armv7a/tune-cortexa9.inc
 # Platform u-boot settings
 UBOOT_PREFIX = "u-boot"
 UBOOT_SUFFIX = "imx"
+BOOTABLE_FILENAME = "${UBOOT_PREFIX}-${MACHINE}.${UBOOT_SUFFIX}"
+SDIMG_BOOTLOADER = "${DEPLOY_DIR_IMAGE}/${BOOTABLE_FILENAME}"
 
 # Linux kernel configuration
 KERNEL_DEFCONFIG ?= "arch/arm/configs/ccimx6sbc_defconfig"

meta-digi-arm/conf/machine/include/ccimx8x.inc

@@ -23,12 +23,6 @@ BOOTLOADER_SEEK_BOOT ?= "0"
 BOOTABLE_FILENAME = "${UBOOT_PREFIX}-${MACHINE}.bin"
 SDIMG_BOOTLOADER = "${DEPLOY_DIR_IMAGE}/${BOOTABLE_FILENAME}"
 
-# RAM variants
-# This determines the number of different DCD files, and thus the number of
-# different U-Boot binaries required.
-# Last one is the default (the one the symlinks point at)
-RAM_CONFIGS = "512MB_16bit 1GB_16bit 1GB_32bit 2GB_32bit"
-
 # The original variable used by NXP to store the mkimage "REV" parameter,
 # REV_OPTION, has a format of "REV=X0". Since we are interested in building
 # images for multiple revisions and using the revision in the imx-boot filename,
@@ -70,6 +64,13 @@ MACHINE_FEATURES += "accel-graphics wifi bluetooth cryptochip pci mca"
 # TrustFence
 TRUSTFENCE_SIGN_MODE = "AHAB"
 
+IMXBOOT_TARGETS = "flash_spl"
+
+IMX_BOOT_SOC_TARGET = "iMX8QX"
+IMX_BOOT_SEEK = "32"
+
+IMX_EXTRA_FIRMWARE:mx8x-generic-bsp  = "digi-sc-firmware imx-seco"
+
 # SWUpdate sw-description configuration
 BOOTFS_EXT ?= ".boot.vfat"
 ROOTFS_EXT ?= '${@bb.utils.contains("IMAGE_FEATURES", "read-only-rootfs", ".squashfs", ".ext4.gz", d)}'

meta-digi-arm/conf/machine/include/ccmp1.inc

@@ -44,12 +44,26 @@ MACHINE_EXTRA_RDEPENDS += " \
 
 # Image FS types
 IMAGE_FSTYPES:remove = "ext4 tar.xz"
+IMAGE_FSTYPES:append = " ${@bb.utils.contains('BOOTDEVICE_LABELS', 'sdcard', 'boot.vfat ext4.gz', '', d)}"
 
 # List of supported boot devices
-BOOTDEVICE_LABELS ?= "sdcard"
+BOOTDEVICE_LABELS ?= "nand-4-256"
+# Supported boot schemes
+BOOTSCHEME_LABELS ?= "optee"
+
+# Wic files
+WKS_FILE += "ccmp1.wks.in"
+WKS_FILE_DEPENDS ?= " \
+    virtual/bootloader \
+    virtual/trusted-firmware-a \
+    ${@bb.utils.contains('BOOTSCHEME_LABELS', 'optee', 'virtual/optee-os', '', d)} \
+"
 
 # Default secure console configuration
 TRUSTFENCE_CONSOLE_DISABLE ?= "0"
 
 # Alternatively, uncommment to enable the console autoboot stop passphrase
 # TRUSTFENCE_CONSOLE_PASSPHRASE_ENABLE = ""
+
+# Disable the generation of flashlayout files
+do_create_flashlayout_config[noexec] = "1"

meta-digi-arm/conf/machine/include/digi-defaults.inc

@@ -85,10 +85,10 @@ DEY_SELINUX_POLICY ?= "1"
 
 # U-Boot scripts to include in 'linux' partition
 # (use the '+=' operator, since other layers may append scripts to this list)
-BOOT_SCRIPTS += "boot.scr:boot.scr altboot.scr:altboot.scr"
+BOOT_SCRIPTS += "boot.scr:boot.scr"
 
 # This can be used to enable U-Boot update through swupdate
 SWUPDATE_UBOOTIMG ?= "false"
 
-# Cloud Connector package to install
+# ConnectCore Cloud Services packages to install
-CLOUDCONNECTOR_PKG ?= "cloudconnector"
+CCCS_PKGS ?= "cccs-gs-demo dey-examples-cccs"

meta-digi-arm/conf/machine/include/imx-digi-base.inc

@@ -69,7 +69,7 @@ MACHINEOVERRIDES_EXTENDER:mx8mn:use-mainline-bsp  = "imx-generic-bsp:imx-mainlin
 MACHINEOVERRIDES_EXTENDER:mx8mp:use-mainline-bsp  = "imx-generic-bsp:imx-mainline-bsp:mx8-generic-bsp:mx8-mainline-bsp:mx8m-generic-bsp:mx8m-mainline-bsp:mx8mp-generic-bsp:mx8mp-mainline-bsp"
 MACHINEOVERRIDES_EXTENDER:mx8qxp:use-mainline-bsp = "imx-generic-bsp:imx-mainline-bsp:mx8-generic-bsp:mx8-mainline-bsp:mx8x-generic-bsp:mx8x-mainline-bsp:mx8qxp-generic-bsp:mx8qxp-mainline-bsp"
 MACHINEOVERRIDES_EXTENDER:mx8dx:use-mainline-bsp  = "imx-generic-bsp:imx-mainline-bsp:mx8-generic-bsp:mx8-mainline-bsp:mx8x-generic-bsp:mx8x-mainline-bsp:mx8dx-generic-bsp:mx8dx-mainline-bsp"
-MACHINEOVERRIDES_EXTENDER:mx93:use-mainline-bsp  = "imx-generic-bsp:imx-mainline-bsp:imxdrm:imxpxp:mx9-generic-bsp:mx9-mainline-bsp:mx93-generic-bsp:mx93-mainline-bsp"
+MACHINEOVERRIDES_EXTENDER:mx93:use-mainline-bsp  = "imx-generic-bsp:imx-mainline-bsp:mx9-generic-bsp:mx9-mainline-bsp:mx93-generic-bsp:mx93-mainline-bsp"
 
 MACHINEOVERRIDES_EXTENDER_FILTER_OUT = " \
     mx6 \
@@ -272,11 +272,20 @@ PREFERRED_VERSION_vulkan-tools:imxvulkan   ??= "1.2.182.0"
 
 # Use i.MX optee Version
 PREFERRED_VERSION_optee-os:mx8-nxp-bsp     ??= "3.19.0.imx"
-PREFERRED_VERSION_optee-os:mx9-nxp-bsp     ??= "3.19.0.imx"
+PREFERRED_VERSION_optee-os:mx9-nxp-bsp     ??= "3.21.0.imx"
 PREFERRED_VERSION_optee-client:mx8-nxp-bsp ??= "3.19.0.imx"
-PREFERRED_VERSION_optee-client:mx9-nxp-bsp ??= "3.19.0.imx"
+PREFERRED_VERSION_optee-client:mx9-nxp-bsp ??= "3.21.0.imx"
 PREFERRED_VERSION_optee-test:mx8-nxp-bsp   ??= "3.19.0.imx"
-PREFERRED_VERSION_optee-test:mx9-nxp-bsp   ??= "3.19.0.imx"
+PREFERRED_VERSION_optee-test:mx9-nxp-bsp   ??= "3.21.0.imx"
+
+# Machine learning backports from NXP's lf-6.1.1_1.0.0 release
+PREFERRED_VERSION_deepview-rt:ccimx93 = "2.4.46.1-aarch64"
+PREFERRED_VERSION_ethos-u-vela:ccimx93 = "3.6.0"
+PREFERRED_VERSION_flatbuffers:ccimx93 = "2.0.7"
+PREFERRED_VERSION_flatbuffers-native:ccimx93 = "2.0.7"
+PREFERRED_VERSION_tensorflow-lite:ccimx93 = "2.10.0"
+PREFERRED_VERSION_tensorflow-lite-host-tools:ccimx93 = "2.10.0"
+PREFERRED_VERSION_tensorflow-lite-host-tools-native:ccimx93 = "2.10.0"
 
 # Optee runtime packages to install
 OPTEE_PKGS ??= "optee-client optee-os"
@@ -290,7 +299,7 @@ EXTRA_IMAGEDEPENDS += "u-boot"
 KERNEL_IMAGETYPE = "zImage"
 KERNEL_IMAGETYPE:aarch64 = "Image.gz"
 
-MACHINE_FEATURES = "usbgadget usbhost vfat alsa touchscreen"
+MACHINE_FEATURES = "usbgadget usbhost vfat alsa touchscreen screen"
 
 # IMX specific udev extra rules added when device manager is systemd/udev
 UDEV_EXTRA_RULES:append = " udev-rules-imx"

meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/firmware-imx/firmware-imx-9_8.20.bb

@@ -2,7 +2,16 @@
 SUMMARY = "Freescale i.MX firmware for i.MX 9 family"
 DESCRIPTION = "Freescale i.MX firmware for i.MX 9 family"
 
-require recipes-bsp/firmware-imx/firmware-imx-${PV}.inc
+#
+# Use meta-freescale's firmware-imx-8.18.inc and ammend license and
+# SRC_URI checksums
+#
+# require recipes-bsp/firmware-imx/firmware-imx-${PV}.inc
+require recipes-bsp/firmware-imx/firmware-imx-8.18.inc
+
+LIC_FILES_CHKSUM = "file://COPYING;md5=63a38e9f392d8813d6f1f4d0d6fbe657"
+SRC_URI[md5sum] = "25c50f3371450b2324401ee06ff1bf6a"
+SRC_URI[sha256sum] = "f6dc6a5c8fd9b913a15360d3ccd53d188db05a08a8594c518e57622478c72383"
 
 inherit deploy
 

meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/firmware-imx/firmware-nxp-wifi_%.bbappend

@@ -8,14 +8,19 @@ SRCBRANCH:ccimx93 = "lf-6.1.1_1.0.0"
 SRCREV:ccimx93 = "bacbeb4789c1b13d13aab12ada29217ce8c3e905"
 
 # Use this temporal binary till it is released
-SRC_URI:append:ccimx93 = " file://sduart_nw61x_v1.bin.se"
+SRC_URI:append:ccimx93 = " \
+    file://sd_w61x_v1.bin.se \
+    file://uartspi_n61x_v1.bin.se \
+"
 
 do_install:append:ccimx93() {
-	install -m 444 ${WORKDIR}/sduart_nw61x_v1.bin.se ${D}${base_libdir}/firmware/nxp
+	install -m 444 ${WORKDIR}/sd_w61x_v1.bin.se ${D}${base_libdir}/firmware/nxp
+	install -m 444 ${WORKDIR}/uartspi_n61x_v1.bin.se ${D}${base_libdir}/firmware/nxp
 }
 
 PACKAGES:prepend:ccimx93 = "${PN}-nxpiw612 "
 
 FILES:${PN}-nxpiw612 = " \
-    ${base_libdir}/firmware/nxp/sduart_nw61x_v1.bin.se \
+    ${base_libdir}/firmware/nxp/sd_w61x_v1.bin.se \
+    ${base_libdir}/firmware/nxp/uartspi_n61x_v1.bin.se \
 "

meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/firmware-sentinel/firmware-sentinel_0.10.bb

@@ -0,0 +1,29 @@
+# Copyright 2021-2023 NXP
+SUMMARY = "NXP i.MX Sentinel firmware"
+DESCRIPTION = "Firmware for i.MX Sentinel Security Controller"
+SECTION = "base"
+LICENSE = "Proprietary"
+LIC_FILES_CHKSUM = "file://COPYING;md5=63a38e9f392d8813d6f1f4d0d6fbe657"
+
+inherit fsl-eula-unpack use-imx-security-controller-firmware deploy
+
+SRC_URI = "${FSL_MIRROR}/${BP}.bin;fsl-eula=true"
+SRC_URI[md5sum] = "a92e272d665a3b3bb9281253d5eca69f"
+SRC_URI[sha256sum] = "be862b62c849510cce08ec24c1ddf53d826458e326e5a7f09c4b35092d6f9950"
+
+do_compile[noexec] = "1"
+
+do_install() {
+   install -d ${D}${nonarch_base_libdir}/firmware/imx/ele
+   install -m 0644 ${S}/${SECO_FIRMWARE_NAME} ${D}${nonarch_base_libdir}/firmware/imx/ele
+}
+
+do_deploy () {
+    # Deploy the related firmware to be package by imx-boot
+    install -m 0644 ${S}/${SECO_FIRMWARE_NAME}  ${DEPLOYDIR}
+}
+addtask deploy after do_install before do_build
+
+FILES:${PN} += "${nonarch_base_libdir}/firmware/imx/ele/${SECO_FIRMWARE_NAME}"
+
+COMPATIBLE_MACHINE = "(mx8ulp-nxp-bsp|mx9-nxp-bsp)"

meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/imx-atf/imx-atf/0005-ccimx93-use-UART6-for-the-default-console.patch

@@ -8,12 +8,12 @@ Signed-off-by: Javier Viguera <javier.viguera@digi.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/plat/imx/imx93/include/platform_def.h b/plat/imx/imx93/include/platform_def.h
-index a820c27a5b49..a563d8852d23 100644
+index 59ce1c267568..c4855d7f5e82 100644
 --- a/plat/imx/imx93/include/platform_def.h
 +++ b/plat/imx/imx93/include/platform_def.h
-@@ -47,7 +47,7 @@
+@@ -53,7 +53,7 @@
- #define MAX_XLAT_TABLES			12
  #define MAX_MMAP_REGIONS		16
+ #endif
  
 -#define IMX_LPUART_BASE			0x44380000
 +#define IMX_LPUART_BASE			0x425a0000

meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/imx-atf/imx-atf_%.bbappend

@@ -2,11 +2,13 @@
 
 FILESEXTRAPATHS:prepend := "${THISDIR}/${BPN}:"
 
-SRC_URI:append = " \
+SRC_URI:append:ccimx8m = " \
     file://0001-imx8mm-Define-UART1-as-console-for-boot-stage.patch \
     file://0002-imx8mm-Disable-M4-debug-console.patch \
     file://0003-imx8mn-Define-UART1-as-console-for-boot-stage.patch \
     file://0004-imx8mn-Disable-M7-debug-console.patch \
+"
+SRC_URI:append:ccimx93 = " \
     file://0005-ccimx93-use-UART6-for-the-default-console.patch \
 "
 

meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/imx-atf/imx-atf_2.8.bb

@@ -0,0 +1,12 @@
+# Copyright 2023 Digi International Inc.
+
+#
+# Reuse meta-freescale's imx-atf_2.6.bb
+#
+require recipes-bsp/imx-atf/imx-atf_2.6.bb
+
+SRC_URI = "git://github.com/nxp-imx/imx-atf.git;protocol=https;branch=${SRCBRANCH}"
+SRCBRANCH = "lf_v2.8"
+SRCREV = "99195a23d3aef485fb8f10939583b1bdef18881c"
+
+COMPATIBLE_MACHINE = "(ccimx93)"

meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/imx-mkimage/imx-boot_1.0.bbappend

@@ -2,11 +2,16 @@
 
 FILESEXTRAPATHS:prepend := "${THISDIR}/files:"
 
-SRC_URI:append = " \
+SRC_URI:append:ccimx8m = " \
     file://0001-imx8m-soc.mak-preserve-dtbs-after-build.patch \
     file://0002-imx8m-soc.mak-capture-commands-output-into-a-log-fil.patch \
 "
 
+# Use NXP's lf-6.1.22-2.0.0 release for ccimx93
+SRC_URI:ccimx93 = "git://github.com/nxp-imx/imx-mkimage.git;protocol=https;branch=${SRCBRANCH}"
+SRCBRANCH:ccimx93 = "lf-6.1.22_2.0.0"
+SRCREV:ccimx93 = "5cfd218012e080fb907d9cc301fbb4ece9bc17a9"
+
 DEPENDS += "${@oe.utils.conditional('TRUSTFENCE_SIGN', '1', 'trustfence-sign-tools-native', '', d)}"
 
 # Do not tag imx-boot
@@ -25,7 +30,42 @@ do_compile:append:ccimx8m() {
 	make SOC=${IMX_BOOT_SOC_TARGET} dtbs=${UBOOT_DTB_NAME} print_fit_hab
 }
 
-do_deploy:append() {
+do_compile:ccimx8x () {
+	compile_${SOC_FAMILY}
+	if ${DEPLOY_OPTEE}; then
+		cp ${DEPLOY_DIR_IMAGE}/tee.bin {BOOT_STAGING}
+	fi
+	# mkimage for i.MX8
+
+	for target in ${IMXBOOT_TARGETS}; do
+		for rev in ${SOC_REVISIONS}; do
+			bbnote "building ${IMX_BOOT_SOC_TARGET} - REV=${rev} ${target}"
+			make SOC=${IMX_BOOT_SOC_TARGET} dtbs=${UBOOT_DTB_NAME} REV=${rev} ${target} > ${S}/mkimage-${rev}-${target}.log 2>&1
+			if [ -e "${BOOT_STAGING}/flash.bin" ]; then
+				cp ${BOOT_STAGING}/flash.bin ${S}/${UBOOT_PREFIX}-${MACHINE}-${rev}.bin-${target}
+			fi
+			SCFWBUILT="yes"
+			# Remove u-boot-atf-container.img so it gets generated in the next iteration
+			rm ${BOOT_STAGING}/u-boot-atf-container.img
+		done
+	done
+
+	# Check that SCFW was built at least once
+	if [ "${IMX_BOOT_SOC_TARGET}" = "iMX8QX" and "${SCFWBUILT}" != "yes" ]; then
+		bbfatal "SCFW was not built!"
+	fi
+}
+
+do_install:ccimx8x () {
+	install -d ${D}/boot
+	for bin in ${BOOTABLE_ARTIFACTS}; do
+		for target in ${IMXBOOT_TARGETS}; do
+			install -m 0644 ${S}/${bin}-${target} ${D}/boot/
+		done
+	done
+}
+
+generate_symlinks() {
 	# imx-boot recipe in meta-freescale assumes only *one* build configuration
 	# (otherwise variable BOOT_CONFIG_MACHINE would expand to something incorrect)
 	for target in ${IMXBOOT_TARGETS}; do
@@ -36,12 +76,47 @@ do_deploy:append() {
 }
 
 do_deploy:append:ccimx8m() {
+	generate_symlinks
 	for target in ${IMXBOOT_TARGETS}; do
 		install -m 0644 ${BOOT_STAGING}/mkimage-${target}.log ${DEPLOYDIR}/${BOOT_TOOLS}
 	done
 	install -m 0644 ${BOOT_STAGING}/mkimage-print_fit_hab.log ${DEPLOYDIR}/${BOOT_TOOLS}
 }
 
+do_deploy:append:ccimx93() {
+	generate_symlinks
+}
+
+do_deploy:ccimx8x () {
+	deploy_${SOC_FAMILY}
+	# copy tee.bin to deploy path
+	if "${DEPLOY_OPTEE}"; then
+		install -m 0644 ${DEPLOY_DIR_IMAGE}/tee.bin ${DEPLOYDIR}/${BOOT_TOOLS}
+	fi
+	# copy makefile (soc.mak) for reference
+	install -m 0644 ${BOOT_STAGING}/soc.mak ${DEPLOYDIR}/${BOOT_TOOLS}
+	# copy the generated boot image to deploy path
+	for rev in ${SOC_REVISIONS}; do
+		IMAGE_IMXBOOT_TARGET=""
+		for target in ${IMXBOOT_TARGETS}; do
+			# Use first "target" as IMAGE_IMXBOOT_TARGET
+			if [ "$IMAGE_IMXBOOT_TARGET" = "" ]; then
+				IMAGE_IMXBOOT_TARGET="$target"
+				echo "Set boot target as $IMAGE_IMXBOOT_TARGET"
+			fi
+			install -m 0644 ${S}/${UBOOT_PREFIX}-${MACHINE}-${rev}.bin-${target} ${DEPLOYDIR}
+			# copy make log for reference
+			install -m 0644 ${S}/mkimage-${rev}-${target}.log ${DEPLOYDIR}/${BOOT_TOOLS}
+		done
+		cd ${DEPLOYDIR}
+		ln -sf ${UBOOT_PREFIX}-${MACHINE}-${rev}.bin-${IMAGE_IMXBOOT_TARGET} ${UBOOT_PREFIX}-${MACHINE}-${rev}.bin
+		# Link to default bootable U-Boot filename. It gets overwritten
+		# on every loop so the only last RAM_CONFIG will survive.
+		ln -sf ${UBOOT_PREFIX}-${MACHINE}-${rev}.bin-${IMAGE_IMXBOOT_TARGET} ${BOOTABLE_FILENAME}
+		cd -
+	done
+}
+
 do_deploy[postfuncs] += "${@oe.utils.conditional('TRUSTFENCE_SIGN', '1', 'trustfence_sign_imxboot', '', d)}"
 trustfence_sign_imxboot() {
 	TF_SIGN_ENV="CONFIG_SIGN_KEYS_PATH=${TRUSTFENCE_SIGN_KEYS_PATH}"
@@ -61,5 +136,25 @@ trustfence_sign_imxboot() {
 		fi
 	done
 }
+
+trustfence_sign_imxboot:ccimx8x() {
+	TF_SIGN_ENV="CONFIG_SIGN_KEYS_PATH=${TRUSTFENCE_SIGN_KEYS_PATH}"
+	[ -n "${TRUSTFENCE_KEY_INDEX}" ] && TF_SIGN_ENV="$TF_SIGN_ENV CONFIG_KEY_INDEX=${TRUSTFENCE_KEY_INDEX}"
+	[ -n "${TRUSTFENCE_SIGN_MODE}" ] && TF_SIGN_ENV="$TF_SIGN_ENV CONFIG_SIGN_MODE=${TRUSTFENCE_SIGN_MODE}"
+	[ -n "${TRUSTFENCE_SRK_REVOKE_MASK}" ] && TF_SIGN_ENV="$TF_SIGN_ENV SRK_REVOKE_MASK=${TRUSTFENCE_SRK_REVOKE_MASK}"
+
+	# Sign/encrypt boot image
+	for target in ${IMXBOOT_TARGETS}; do
+		for rev in ${SOC_REVISIONS}; do
+			TF_SIGN_ENV="$TF_SIGN_ENV CONFIG_MKIMAGE_LOG_PATH=${DEPLOYDIR}/${BOOT_TOOLS}/mkimage-${rev}-${target}.log"
+			env $TF_SIGN_ENV trustfence-sign-uboot.sh ${BOOT_NAME}-${MACHINE}-${rev}.bin-${target} ${BOOT_NAME}-signed-${MACHINE}-${rev}.bin-${target}
+			if [ -n "${TRUSTFENCE_DEK_PATH}" ] && [ "${TRUSTFENCE_DEK_PATH}" != "0" ]; then
+				TF_ENC_ENV="CONFIG_DEK_PATH=${TRUSTFENCE_DEK_PATH} ENABLE_ENCRYPTION=y"
+				env $TF_SIGN_ENV $TF_ENC_ENV trustfence-sign-uboot.sh ${BOOT_NAME}-${MACHINE}-${rev}.bin-${target} ${BOOT_NAME}-encrypted-${MACHINE}-${rev}.bin-${target}
+			fi
+		done
+	done
+}
+
 trustfence_sign_imxboot[dirs] = "${DEPLOYDIR}"
 trustfence_sign_imxboot[vardeps] += "TRUSTFENCE_SIGN_KEYS_PATH TRUSTFENCE_KEY_INDEX TRUSTFENCE_DEK_PATH TRUSTFENCE_SIGN_MODE TRUSTFENCE_SRK_REVOKE_MASK TRUSTFENCE_UNLOCK_KEY_REVOCATION"

meta-digi-arm/dynamic-layers/freescale-layer/recipes-bsp/imx-mkimage/imx-mkimage_git.bbappend

@@ -2,10 +2,15 @@
 
 FILESEXTRAPATHS:prepend := "${THISDIR}/files:"
 
-SRC_URI:append = " \
+SRC_URI:append:ccimx8m = " \
     file://0001-imx8m-soc.mak-preserve-dtbs-after-build.patch \
 "
 
+# Use NXP's lf-6.1.22-2.0.0 release for ccimx93
+SRC_URI:ccimx93 = "git://github.com/nxp-imx/imx-mkimage.git;protocol=https;branch=${SRCBRANCH}"
+SRCBRANCH:ccimx93 = "lf-6.1.22_2.0.0"
+SRCREV:ccimx93 = "5cfd218012e080fb907d9cc301fbb4ece9bc17a9"
+
 # "fmacro-prefix-map" is not supported on old versions of GCC
 DEBUG_PREFIX_MAP:remove:class-nativesdk = "-fmacro-prefix-map=${WORKDIR}=/usr/src/debug/${PN}/${EXTENDPE}${PV}-${PR}"
 

meta-digi-arm/dynamic-layers/freescale-layer/recipes-security/optee-imx/optee-client/tee-supplicant.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=TEE Supplicant
+
+[Service]
+User=root
+EnvironmentFile=-/etc/default/tee-supplicant
+ExecStart=/usr/bin/tee-supplicant $OPTARGS
+
+[Install]
+WantedBy=basic.target
+

meta-digi-arm/dynamic-layers/freescale-layer/recipes-security/optee-imx/optee-client_3.21.0.imx.bb

@@ -0,0 +1,15 @@
+# Copyright 2023 Digi International Inc.
+
+#
+# Reuse meta-freescale's optee-client_3.19.0.imx.bb
+#
+require recipes-security/optee-imx/optee-client_3.19.0.imx.bb
+
+SRCBRANCH = "lf-6.1.22_2.0.0"
+SRCREV = "8533e0e6329840ee96cf81b6453f257204227e6c"
+
+# Otherwise optee-client's makefile defaults to use $(CROSS_COMPILE)pkg-config
+# which is not what Yocto provides.
+export PKG_CONFIG='pkg-config'
+
+COMPATIBLE_MACHINE = "(ccimx93)"

meta-digi-arm/dynamic-layers/freescale-layer/recipes-security/optee-imx/optee-os/0001-core-imx-support-ccimx93-dvk.patch

@@ -0,0 +1,46 @@
+From: Javier Viguera <javier.viguera@digi.com>
+Date: Mon, 15 May 2023 17:59:54 +0200
+Subject: [PATCH] core: imx: support ccimx93-dvk
+
+Signed-off-by: Javier Viguera <javier.viguera@digi.com>
+---
+ core/arch/arm/plat-imx/conf.mk           | 6 ++++++
+ core/arch/arm/plat-imx/registers/imx93.h | 1 +
+ 2 files changed, 7 insertions(+)
+
+diff --git a/core/arch/arm/plat-imx/conf.mk b/core/arch/arm/plat-imx/conf.mk
+index 1d5081f96afe..5e2d0733dd04 100644
+--- a/core/arch/arm/plat-imx/conf.mk
++++ b/core/arch/arm/plat-imx/conf.mk
+@@ -88,6 +88,7 @@ mx8ulp-flavorlist = \
+ 	mx8ulpevk \
+ 
+ mx93-flavorlist = \
++	ccimx93dvk \
+ 	mx93evk \
+ 
+ ifneq (,$(filter $(PLATFORM_FLAVOR),$(mx6ul-flavorlist)))
+@@ -449,6 +450,11 @@ CFG_DDR_SIZE ?= 0x80000000
+ CFG_UART_BASE ?= UART1_BASE
+ endif
+ 
++ifneq (,$(filter $(PLATFORM_FLAVOR),ccimx93dvk))
++CFG_DDR_SIZE ?= 0x40000000
++CFG_UART_BASE ?= UART6_BASE
++endif
++
+ # i.MX6 Solo/SL/SoloX/DualLite/Dual/Quad specific config
+ ifeq ($(filter y, $(CFG_MX6QP) $(CFG_MX6Q) $(CFG_MX6D) $(CFG_MX6DL) $(CFG_MX6S) \
+ 	$(CFG_MX6SL) $(CFG_MX6SLL) $(CFG_MX6SX)), y)
+diff --git a/core/arch/arm/plat-imx/registers/imx93.h b/core/arch/arm/plat-imx/registers/imx93.h
+index e91607537380..66a6408109c2 100644
+--- a/core/arch/arm/plat-imx/registers/imx93.h
++++ b/core/arch/arm/plat-imx/registers/imx93.h
+@@ -9,6 +9,7 @@
+ #define GICR_BASE 0x48040000
+ 
+ #define UART1_BASE 0x44380000
++#define UART6_BASE 0x425a0000
+ #define MU_BASE	   0x47520000
+ #define MU_SIZE	   0x10000
+ 

meta-digi-arm/dynamic-layers/freescale-layer/recipes-security/optee-imx/optee-os/0007-allow-setting-sysroot-for-clang.patch

@@ -0,0 +1,30 @@
+From db9e44af75c7cfd3316cab15aaa387383df3e57e Mon Sep 17 00:00:00 2001
+From: Brett Warren <brett.warren@arm.com>
+Date: Wed, 23 Sep 2020 09:27:34 +0100
+Subject: [PATCH] optee: enable clang support
+
+When compiling with clang, the LIBGCC_LOCATE_CFLAG variable used
+to provide a sysroot wasn't included, which results in not locating
+compiler-rt. This is mitigated by including the variable as ammended.
+
+Upstream-Status: Pending
+ChangeId: 8ba69a4b2eb8ebaa047cb266c9aa6c2c3da45701
+Signed-off-by: Brett Warren <brett.warren@arm.com>
+
+---
+ mk/clang.mk | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mk/clang.mk b/mk/clang.mk
+index c141a3f2..7d067cc0 100644
+--- a/mk/clang.mk
++++ b/mk/clang.mk
+@@ -27,7 +27,7 @@ comp-cflags-warns-clang := -Wno-language-extension-token \
+ 
+ # Note, use the compiler runtime library (libclang_rt.builtins.*.a) instead of
+ # libgcc for clang
+-libgcc$(sm)	:= $(shell $(CC$(sm)) $(CFLAGS$(arch-bits-$(sm))) \
++libgcc$(sm)	:= $(shell $(CC$(sm)) $(LIBGCC_LOCATE_CFLAGS) $(CFLAGS$(arch-bits-$(sm))) \
+ 			-rtlib=compiler-rt -print-libgcc-file-name 2> /dev/null)
+ 
+ # Core ASLR relies on the executable being ready to run from its preferred load

meta-digi-arm/dynamic-layers/freescale-layer/recipes-security/optee-imx/optee-os_3.21.0.imx.bb

@@ -0,0 +1,18 @@
+# Copyright 2023 Digi International Inc.
+
+#
+# Reuse meta-freescale's optee-os_3.19.0.imx.bb
+#
+require recipes-security/optee-imx/optee-os_3.19.0.imx.bb
+
+SRC_URI = " \
+    git://github.com/nxp-imx/imx-optee-os.git;protocol=https;branch=${SRCBRANCH} \
+    file://0007-allow-setting-sysroot-for-clang.patch \
+    file://0001-core-imx-support-ccimx93-dvk.patch \
+"
+SRCBRANCH = "lf-6.1.22_2.0.0"
+SRCREV = "1962aec9581760803b1485d455cd62cb11c14870"
+
+PLATFORM_FLAVOR:ccimx93 = "ccimx93dvk"
+
+COMPATIBLE_MACHINE = "(ccimx93)"

meta-digi-arm/dynamic-layers/freescale-layer/recipes-security/optee-imx/optee-test_3.21.0.imx.bb

@@ -0,0 +1,11 @@
+# Copyright 2023 Digi International Inc.
+
+#
+# Reuse meta-freescale's optee-test_3.19.0.imx.bb
+#
+require recipes-security/optee-imx/optee-test_3.19.0.imx.bb
+
+SRCBRANCH = "lf-6.1.22_2.0.0"
+SRCREV = "c2c9f922044d2c8a7ab384812bb124c6da2b7888"
+
+COMPATIBLE_MACHINE = "(ccimx93)"

meta-digi-arm/dynamic-layers/stm-st-stm32mp/recipes-bsp/trusted-firmware-a/tf-a-stm32mp_%.bbappend

@@ -17,7 +17,7 @@ SRC_URI = " \
 TF_A_CONFIG[nand]   = "${DEVICE_BOARD_ENABLE:NAND},STM32MP_RAW_NAND=1 ${@'STM32MP_FORCE_MTD_START_OFFSET=${TF_A_MTD_START_OFFSET_NAND}' if ${TF_A_MTD_START_OFFSET_NAND} else ''} STM32MP_USB_PROGRAMMER=1"
 
 DEPENDS += " \
-    ${@oe.utils.conditional('TRUSTFENCE_SIGN', '1', 'trustfence-sign-tools-native trustfence-genpki-native', '', d)} \
+    ${@oe.utils.conditional('TRUSTFENCE_SIGN', '1', 'trustfence-sign-tools-native', '', d)} \
 "
 
 # This dependency is required so that the PKI generation completes before
@@ -28,6 +28,15 @@ do_install[depends] = " \
     openssl-native:do_populate_sysroot \
 "
 
+# Generate PKI tree if it doesn't exist.
+# This is an append to do_compile because in this recipe, the do_deploy
+# task comes right after do_compile, and the keys must be ready before that.
+do_compile:append() {
+	if ${@oe.utils.conditional('TRUSTFENCE_SIGN','1','true','false',d)}; then
+		check_gen_pki_tree
+	fi
+}
+
 # Obtain password to use in FIP generation
 # Get password from file using the given key index
 do_deploy[prefuncs] += "${@oe.utils.conditional('TRUSTFENCE_SIGN', '1', 'set_fip_sign_key', '', d)}"

meta-digi-arm/dynamic-layers/stm-st-stm32mp/recipes-security/optee/optee-os-stm32mp_%.bbappend

@@ -14,6 +14,3 @@ SRC_URI = " \
     ${OPTEE_GIT_URI};branch=${SRCBRANCH};name=os \
     file://fonts.tar.gz;subdir=git;name=fonts \
 "
-
-# Enable OTP write support
-EXTRA_OEMAKE += "CFG_STM32_BSEC_WRITE=y"

meta-digi-arm/recipes-bsp/alsa-state/alsa-state/ccimx93/asound.conf

@@ -1,9 +1,9 @@
-pcm.imxmax98088 {
+pcm.max98088audio {
     type hw
     card 0
 }
-ctl.imxmax98088 {
+ctl.max98088audio {
     type hw
     card 0
 }
-ctl.!default imxmax98088
+ctl.!default max98088audio

meta-digi-arm/recipes-bsp/digi-sc-firmware/digi-sc-firmware_1.15.0.bb

@@ -1,18 +1,18 @@
 # Copyright (C) 2016 Freescale Semiconductor
 # Copyright 2017-2018 NXP
-# Copyright (C) 2018-2021 Digi International.
+# Copyright (C) 2018-2023 Digi International.
 
 DESCRIPTION = "i.MX System Controller Firmware, customized for Digi platforms"
 LICENSE = "Proprietary"
-LIC_FILES_CHKSUM = "file://COPYING;md5=03bcadc8dc0a788f66ca9e2b89f56c6f"
+LIC_FILES_CHKSUM = "file://COPYING;md5=ea25d099982d035af85d193c88a1b479"
 SECTION = "BSP"
 
 inherit pkgconfig deploy
 
 SRC_URI = "${DIGI_PKG_SRC}/${BPN}-${PV}.tar.gz"
 
-SRC_URI[md5sum] = "0d20c7bb41d53bb8c2688b259c7ddfd4"
+SRC_URI[md5sum] = "d7d74493bb04ff73341481a9fbc551eb"
-SRC_URI[sha256sum] = "36a02b956c288dad6ce6ecb2b13a4e6fb2983fd5c39cab5028ae9a7dafe4a4c9"
+SRC_URI[sha256sum] = "aa4acd333bb8fc137854d276d12961a9bdf29064a94bcf4d3c76761d79afaca9"
 
 S = "${WORKDIR}/${PN}-${PV}"
 
@@ -23,22 +23,19 @@ SYSROOT_DIRS += "/boot"
 
 do_install () {
     install -d ${D}/boot
-    for ramc in ${RAM_CONFIGS}; do
+    install -m 0644 ${S}/${SC_FIRMWARE_NAME} ${D}/boot/
-        install -m 0644 ${S}/${SC_FIRMWARE_NAME}-${ramc} ${D}/boot/
+
-    done
 }
 
 BOOT_TOOLS = "imx-boot-tools"
 
 do_deploy () {
     install -d ${DEPLOYDIR}/${BOOT_TOOLS}
-    for ramc in ${RAM_CONFIGS}; do
+    install -m 0644 ${S}/${SC_FIRMWARE_NAME} ${DEPLOYDIR}/${BOOT_TOOLS}/
-        install -m 0644 ${S}/${SC_FIRMWARE_NAME}-${ramc} ${DEPLOYDIR}/${BOOT_TOOLS}/
+    cd ${DEPLOYDIR}/${BOOT_TOOLS}/
-        cd ${DEPLOYDIR}/${BOOT_TOOLS}/
+    rm -f ${symlink_name}
-        rm -f ${symlink_name}-${ramc}
+    ln -sf ${SC_FIRMWARE_NAME} ${symlink_name}
-        ln -sf ${SC_FIRMWARE_NAME}-${ramc} ${symlink_name}-${ramc}
+    cd -
-        cd -
-    done
 }
 
 addtask deploy after do_install

meta-digi-arm/recipes-bsp/firmware-murata/firmware-murata.bb

@@ -8,14 +8,15 @@ LIC_FILES_CHKSUM = "file://${S}/cyw-bt-patch/LICENCE.cypress;md5=cbc5f665d04f741
 SRC_URI = " \
     git://github.com/murata-wireless/cyw-fmac-fw;protocol=http;branch=fafnir;destsuffix=cyw-fmac-fw;name=cyw-fmac-fw \
     git://github.com/murata-wireless/cyw-fmac-nvram;protocol=http;branch=fafnir;destsuffix=cyw-fmac-nvram;name=cyw-fmac-nvram \
-    git://github.com/murata-wireless/cyw-bt-patch;protocol=http;branch=kirkstone-fafnir;destsuffix=cyw-bt-patch;name=cyw-bt-patch \
+    git://github.com/murata-wireless/cyw-bt-patch;protocol=http;branch=master;destsuffix=cyw-bt-patch;name=cyw-bt-patch \
     git://github.com/murata-wireless/cyw-fmac-utils-imx32;protocol=http;branch=fafnir;destsuffix=cyw-fmac-utils-imx32;name=cyw-fmac-utils-imx32 \
     git://github.com/murata-wireless/cyw-fmac-utils-imx64;protocol=http;branch=fafnir;destsuffix=cyw-fmac-utils-imx64;name=cyw-fmac-utils-imx64 \
+    file://cyfmac4373-sdio_US.clm_blob \
 "
 
 SRCREV_cyw-fmac-fw="1f83e807b8187508c811a7d91a353a768fef2d37"
 SRCREV_cyw-fmac-nvram="303acf1b04441f62fbc48d278a70a099fabacb4a"
-SRCREV_cyw-bt-patch="32af98f8bc8a8e123b4c428af0035d74e85ae4bb"
+SRCREV_cyw-bt-patch="9d24c254dae92af99ddfd661a4ea30af69190038"
 SRCREV_cyw-fmac-utils-imx32="e248804b6ba386fedcd462ddd9394f42f73a17af"
 SRCREV_cyw-fmac-utils-imx64="1bc78d68f9609290b2f6578516011c57691f7815"
 
@@ -33,12 +34,12 @@ do_install () {
 
 	# Install Bluetooth patch *.HCD file
 	# For Murata 2AE (LBEE5PK2AE-564)
-	install -m 444 ${S}/cyw-bt-patch/BCM4373A0.2AE.hcd ${D}${base_libdir}/firmware/brcm/BCM4373A0.hcd
+	install -m 444 ${S}/cyw-bt-patch/BCM4373A0_001.001.025.0103.0155.FCC.CE.2AE.hcd ${D}${base_libdir}/firmware/brcm/BCM4373A0_FCC.CE.hcd
 
 	# Install WLAN firmware file (*.bin) and Regulatory binary file (*.clm_blob)
 	# For Murata 2AE (LBEE5PK2AE-564)
 	install -m 444 ${S}/cyw-fmac-fw/cyfmac4373-sdio.2AE.bin ${D}${base_libdir}/firmware/cypress/cyfmac4373-sdio.bin
-	install -m 444 ${S}/cyw-fmac-fw/cyfmac4373-sdio.2AE.clm_blob ${D}${base_libdir}/firmware/cypress/cyfmac4373-sdio.clm_blob
+	install -m 444 cyfmac4373-sdio_US.clm_blob ${D}${base_libdir}/firmware/cypress/cyfmac4373-sdio_US.clm_blob
 
 	# Install NVRAM files (*.txt)
 	# For Murata 2AE (LBEE5PK2AE-564)

meta-digi-arm/recipes-bsp/firmware-qualcomm/firmware-qualcomm.bb

@@ -1,4 +1,4 @@
-# Copyright (C) 2016-2022 Digi International.
+# Copyright (C) 2016-2023 Digi International.
 
 SUMMARY = "Qualcomm firmware files for Digi's platforms."
 SECTION = "base"
@@ -110,10 +110,6 @@ do_install() {
 		ln -s /proc/device-tree/wireless/mac-address2 ${D}${WIFI_FW_PATH}/wlan/wlan_mac2
 		ln -s /proc/device-tree/wireless/mac-address3 ${D}${WIFI_FW_PATH}/wlan/wlan_mac3
 
-		# Create symbolic links to the proper FW files depending on the country region
-		ln -s bdwlan30_US.bin ${D}${WIFI_FW_PATH}/bdwlan30.bin
-		ln -s bdwlan30_US.bin ${D}${WIFI_FW_PATH}/utfbd30.bin
-
 		if [ "${FW_QUALCOMM_WIFI}" = "${FW_QCA65X4_PCIE_PROPRIETARY}" ]; then
 			ln -s qwlan30.bin ${D}${WIFI_FW_PATH}/athwlan.bin
 			ln -s otp30.bin ${D}${WIFI_FW_PATH}/athsetup.bin

meta-digi-arm/recipes-bsp/libubootenv/libubootenv_%.bbappend

@@ -21,6 +21,7 @@ SRC_URI += " \
     file://0002-Implement-U-Boot-environment-access-functions.patch \
     file://0003-tools-env-add-support-to-set-dynamic-location-of-env.patch \
     file://0004-fall-back-to-read-HWID-from-nvmem-device-if-not-avai.patch \
+    file://0005-Implement-support-for-environment-encryption-for-CCM.patch \
 "
 
 do_install:append() {

meta-digi-arm/recipes-bsp/trustfence-cst/trustfence-cst-3.3.1.inc

@@ -21,6 +21,7 @@ SRC_URI = " \
     file://0005-ahab_pki_tree.sh-automate-script.patch \
     file://0006-ahab_pki_tree.sh-use-a-random-password-for-the-defau.patch \
     file://0007-rules.mk-weaken-specific-function-err_msg.patch \
+    file://0008-pki_tree.sh-extract-public-keys-from-certificates.patch \
 "
 
 SRC_URI[cst.md5sum] = "27ba9c8bc0b8a7f14d23185775c53794"

meta-digi-arm/recipes-bsp/trustfence-cst/trustfence-cst/0008-pki_tree.sh-extract-public-keys-from-certificates.patch

@@ -0,0 +1,42 @@
+From: Hector Palacios <hector.palacios@digi.com>
+Date: Thu, 3 Aug 2023 16:25:36 +0200
+Subject: [PATCH] pki_tree.sh: extract public keys from certificates
+
+The public key needs to be available on the rootfs so that signed SWU
+packages can be authenticated.
+Do this on the PKI generation script so that recipes don't need to do it.
+
+Signed-off-by: Hector Palacios <hector.palacios@digi.com>
+---
+ keys/ahab_pki_tree.sh | 3 +++
+ keys/hab4_pki_tree.sh | 3 +++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/keys/ahab_pki_tree.sh b/keys/ahab_pki_tree.sh
+index 7f10c5388146..63b5ce58ade7 100755
+--- a/keys/ahab_pki_tree.sh
++++ b/keys/ahab_pki_tree.sh
+@@ -632,6 +632,9 @@ do
+                   -in temp_sgk.pem \
+                   -out ${sgk_key}.pem
+ 
++    # Extract public key from the certificate
++    openssl x509 -pubkey -noout -in "${srk_crt_i}" > ../crts/key${i}.pub
++
+     # Cleanup
+     rm ./temp_sgk.pem ./temp_sgk_req.pem
+ 
+diff --git a/keys/hab4_pki_tree.sh b/keys/hab4_pki_tree.sh
+index ac6fb29b7f91..e76f22f40643 100755
+--- a/keys/hab4_pki_tree.sh
++++ b/keys/hab4_pki_tree.sh
+@@ -682,6 +682,9 @@ do
+                   -in temp_img.pem \
+                   -out ${img_key}.pem
+ 
++    # Extract public key from the certificate
++    openssl x509 -pubkey -noout -in "${img_crt}.pem" > ../crts/key${i}.pub
++
+     # Cleanup
+     rm ./temp_img.pem ./temp_img_req.pem
+ 

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey.inc

@@ -28,7 +28,6 @@ INSTALL_FW_UBOOT_SCRIPTS = " \
 
 SRC_URI = " \
     ${UBOOT_GIT_URI};branch=${SRCBRANCH} \
-    file://altboot.txt \
     file://boot.txt \
     ${INSTALL_FW_UBOOT_SCRIPTS} \
 "
@@ -96,9 +95,6 @@ build_uboot_scripts() {
 	mkimage -T script -n bootscript -C none -d ${TMP_BOOTSCR} ${DEPLOYDIR}/boot.scr
 	rm -f ${TMP_BOOTSCR}
 
-	# Alternate boot script for dualboot
-	mkimage -T script -n "Alternate bootscript" -C none -d ${WORKDIR}/altboot.txt ${DEPLOYDIR}/altboot.scr
-
 	# Sign the scripts (TODO signing of artifacts for STM-based platforms)
 	if [ "${TRUSTFENCE_SIGN}" = "1" ] && [ "${DEY_SOC_VENDOR}" != "STM" ]; then
 		export CONFIG_SIGN_KEYS_PATH="${TRUSTFENCE_SIGN_KEYS_PATH}"
@@ -109,11 +105,6 @@ build_uboot_scripts() {
 		TMP_SIGNED_BOOTSCR="$(mktemp ${WORKDIR}/bootscr-signed.XXXXXX)"
 		trustfence-sign-artifact.sh -p "${DIGI_SOM}" -b "${DEPLOYDIR}/boot.scr" "${TMP_SIGNED_BOOTSCR}"
 		mv "${TMP_SIGNED_BOOTSCR}" "${DEPLOYDIR}/boot.scr"
-
-		# Sign altboot script
-		TMP_SIGNED_BOOTSCR="$(mktemp ${WORKDIR}/altboot-signed.XXXXXX)"
-		trustfence-sign-artifact.sh -p "${DIGI_SOM}" -b "${DEPLOYDIR}/altboot.scr" "${TMP_SIGNED_BOOTSCR}"
-		mv "${TMP_SIGNED_BOOTSCR}" "${DEPLOYDIR}/altboot.scr"
 	fi
 }
 
@@ -182,14 +173,6 @@ BOOT_TOOLS:ccmp1 = "u-boot"
 FIP_UBOOT_HEADER = "ccmp15-dvk"
 FIP_UBOOT_HEADER:ccmp13 = "ccmp13-dvk"
 
-do_deploy:append:ccimx8x() {
-	# Move all U-Boot artifacts to the imx-boot-tools folder
-	# U-Boot images are not bootable on the i.MX8X
-	install -d ${DEPLOYDIR}/${BOOT_TOOLS}
-	mv ${DEPLOYDIR}/u-boot* ${DEPLOYDIR}/${BOOT_TOOLS}/
-	mv ${DEPLOYDIR}/${UBOOT_SYMLINK}-* ${DEPLOYDIR}/${BOOT_TOOLS}/
-}
-
 do_deploy:append:ccimx8m() {
 	# Deploy u-boot-nodtb.bin and ccimx8m[m|n]-dvk.dtb, to be packaged in boot binary by imx-boot
 	if [ -n "${UBOOT_CONFIG}" ]

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6/altboot.txt

@@ -1,37 +0,0 @@
-#
-# U-Boot bootscript for altbootcmd (dual boot fallback after retries)
-#
-
-# After an upgrade, active_system has changed. U-Boot tries to boot this system
-# for a number of tries. If the limit is reached, altbootcmd is run instead.
-# This is the script that it will run. It has to:
-#  * switch back to previous system
-#  * reset the firmware update flag
-#  * run the regular boot command
-
-if test "${dualboot}" = "yes" && test "${upgrade_available}" = "1"; then
-	echo "## Update failed; Rolling back to previous version."
-	if test "${active_system}" = "linux_a"; then
-		setenv active_system linux_b
-		part number mmc ${mmcbootdev} linux_b linux_b_index
-		setexpr mmcpart ${linux_b_index}
-		# Save the partition index on variable rootfs_b_index
-		part number mmc ${mmcbootdev} rootfs_b rootfs_b_index
-		# Save the rootfs_b UUID into mmcroot_b
-		part uuid mmc ${mmcbootdev}:${rootfs_b_index} mmcroot_b
-		setenv mmcroot PARTUUID=${mmcroot_b}
-	else
-		setenv active_system linux_a
-		part number mmc ${mmcbootdev} linux_a linux_a_index
-		setexpr mmcpart ${linux_a_index}
-		# Save the partition index on variable rootfs_a_index
-		part number mmc ${mmcbootdev} rootfs_a rootfs_a_index
-		# Save the rootfs_a UUID into mmcroot_a
-		part uuid mmc ${mmcbootdev}:${rootfs_a_index} mmcroot_a
-		setenv mmcroot PARTUUID=${mmcroot_a}
-	fi
-	setenv upgrade_available
-	setenv bootcount 0
-	saveenv
-fi
-run bootcmd

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6qpsbc/boot.txt

@@ -13,23 +13,26 @@ if test "${dualboot}" = "yes"; then
 		echo "Update detected; Booting new system in ${active_system} (try ${bootcount})"
 	else
 		if test "${active_system}" = "linux_a"; then
-			echo "Booting from system A"
+			echo "Booting from system A (try ${bootcount})"
-			part number mmc ${mmcbootdev} linux_a pi
+			part number mmc ${mmcbootdev} linux_a tmp_mmcpart
-			setenv mmcpart ${pi}
+			part number mmc ${mmcbootdev} rootfs_a tmp_rootfs_index
-			# Save the partition index on variable rootfs_a_index
-			part number mmc ${mmcbootdev} rootfs_a rootfs_a_index
-			# Save the rootfs_a UUID into mmcroot_a
-			part uuid mmc ${mmcbootdev}:${rootfs_a_index} mmcroot_a
-			setenv mmcroot PARTUUID=${mmcroot_a}
 		else
-			echo "Booting from system B"
+			echo "Booting from system B (try ${bootcount})"
-			part number mmc ${mmcbootdev} linux_b pi
+			part number mmc ${mmcbootdev} linux_b tmp_mmcpart
-			setenv mmcpart ${pi}
+			part number mmc ${mmcbootdev} rootfs_b tmp_rootfs_index
-			# Save the partition index on variable rootfs_b_index
+		fi
-			part number mmc ${mmcbootdev} rootfs_b rootfs_b_index
+		part uuid mmc ${mmcbootdev}:${tmp_rootfs_index} tmp_mmcroot
-			# Save the rootfs_b UUID into mmcroot_b
+		if test "${mmcpart}" -ne "${tmp_mmcpart}"; then
-			part uuid mmc ${mmcbootdev}:${rootfs_b_index} mmcroot_b
+			setexpr mmcpart ${tmp_mmcpart}
-			setenv mmcroot PARTUUID=${mmcroot_b}
+			env_save_needed="1"
+		fi
+		if test "${mmcroot}" != "PARTUUID=${tmp_mmcroot}"; then
+			setenv mmcroot PARTUUID=${tmp_mmcroot}
+			env_save_needed="1"
+		fi
+		if test "${env_save_needed}" = "1"; then
+			env delete tmp_mmcpart tmp_rootfs_index tmp_mmcroot
+			env save
 		fi
 	fi
 else

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6qpsbc/install_linux_fw_sd.txt

@@ -63,6 +63,8 @@ for install_f in ${INSTALL_UBOOT_FILENAME} ${INSTALL_LINUX_FILENAME} ${INSTALL_R
 	fi;
 done
 if test "${install_abort}" = "1"; then
+	echo "To install a different image, set variable 'image-name', e.g.:"
+	echo "  => setenv image-name core-image-base"
 	echo "Aborted.";
 	exit;
 fi

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6qpsbc/install_linux_fw_usb.txt

@@ -63,6 +63,8 @@ for install_f in ${INSTALL_UBOOT_FILENAME} ${INSTALL_LINUX_FILENAME} ${INSTALL_R
 	fi;
 done
 if test "${install_abort}" = "1"; then
+	echo "To install a different image, set variable 'image-name', e.g.:"
+	echo "  => setenv image-name core-image-base"
 	echo "Aborted.";
 	exit;
 fi

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6sbc/boot.txt

@@ -13,23 +13,26 @@ if test "${dualboot}" = "yes"; then
 		echo "Update detected; Booting new system in ${active_system} (try ${bootcount})"
 	else
 		if test "${active_system}" = "linux_a"; then
-			echo "Booting from system A"
+			echo "Booting from system A (try ${bootcount})"
-			part number mmc ${mmcbootdev} linux_a pi
+			part number mmc ${mmcbootdev} linux_a tmp_mmcpart
-			setenv mmcpart ${pi}
+			part number mmc ${mmcbootdev} rootfs_a tmp_rootfs_index
-			# Save the partition index on variable rootfs_a_index
-			part number mmc ${mmcbootdev} rootfs_a rootfs_a_index
-			# Save the rootfs_a UUID into mmcroot_a
-			part uuid mmc ${mmcbootdev}:${rootfs_a_index} mmcroot_a
-			setenv mmcroot PARTUUID=${mmcroot_a}
 		else
-			echo "Booting from system B"
+			echo "Booting from system B (try ${bootcount})"
-			part number mmc ${mmcbootdev} linux_b pi
+			part number mmc ${mmcbootdev} linux_b tmp_mmcpart
-			setenv mmcpart ${pi}
+			part number mmc ${mmcbootdev} rootfs_b tmp_rootfs_index
-			# Save the partition index on variable rootfs_b_index
+		fi
-			part number mmc ${mmcbootdev} rootfs_b rootfs_b_index
+		part uuid mmc ${mmcbootdev}:${tmp_rootfs_index} tmp_mmcroot
-			# Save the rootfs_b UUID into mmcroot_b
+		if test "${mmcpart}" -ne "${tmp_mmcpart}"; then
-			part uuid mmc ${mmcbootdev}:${rootfs_b_index} mmcroot_b
+			setexpr mmcpart ${tmp_mmcpart}
-			setenv mmcroot PARTUUID=${mmcroot_b}
+			env_save_needed="1"
+		fi
+		if test "${mmcroot}" != "PARTUUID=${tmp_mmcroot}"; then
+			setenv mmcroot PARTUUID=${tmp_mmcroot}
+			env_save_needed="1"
+		fi
+		if test "${env_save_needed}" = "1"; then
+			env delete tmp_mmcpart tmp_rootfs_index tmp_mmcroot
+			env save
 		fi
 	fi
 else

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6sbc/install_linux_fw_sd.txt

@@ -74,6 +74,8 @@ for install_f in ${INSTALL_UBOOT_FILENAME} ${INSTALL_LINUX_FILENAME} ${INSTALL_R
 	fi;
 done
 if test "${install_abort}" = "1"; then
+	echo "To install a different image, set variable 'image-name', e.g.:"
+	echo "  => setenv image-name core-image-base"
 	echo "Aborted.";
 	exit;
 fi

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6sbc/install_linux_fw_usb.txt

@@ -74,6 +74,8 @@ for install_f in ${INSTALL_UBOOT_FILENAME} ${INSTALL_LINUX_FILENAME} ${INSTALL_R
 	fi;
 done
 if test "${install_abort}" = "1"; then
+	echo "To install a different image, set variable 'image-name', e.g.:"
+	echo "  => setenv image-name core-image-base"
 	echo "Aborted.";
 	exit;
 fi

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6ul/altboot.txt

@@ -1,29 +0,0 @@
-#
-# U-Boot bootscript for altbootcmd (dual boot fallback after retries)
-#
-
-# After an upgrade, active_system has changed. U-Boot tries to boot this system
-# for a number of tries. If the limit is reached, altbootcmd is run instead.
-# This is the script that it will run. It has to:
-#  * switch back to previous system
-#  * reset the firmware update flag
-#  * run the regular boot command
-
-if test "${dualboot}" = "yes" && test "${upgrade_available}" = "1"; then
-	echo "## Update failed; Rolling back to previous version."
-	if test "${active_system}" = "linux_a"; then
-		setenv active_system linux_b
-		setenv mtdbootpart ${active_system}
-		setenv mtdrootfspart ${rootfsvol_b}
-		setenv rootfsvol ${rootfsvol_b}
-	else
-		setenv active_system linux_a
-		setenv mtdbootpart ${active_system}
-		setenv mtdrootfspart ${rootfsvol_a}
-		setenv rootfsvol ${rootfsvol_a}
-	fi
-	setenv upgrade_available
-	setenv bootcount 0
-	saveenv
-fi
-run bootcmd

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6ul/install_linux_fw_sd.txt

@@ -67,6 +67,8 @@ for install_f in ${INSTALL_UBOOT_FILENAME} ${INSTALL_LINUX_FILENAME} ${INSTALL_R
 	fi;
 done
 if test "${install_abort}" = "1"; then
+	echo "To install a different image, set variable 'image-name', e.g.:"
+	echo "  => setenv image-name core-image-base"
 	echo "Aborted.";
 	exit;
 fi

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6ul/install_linux_fw_usb.txt

@@ -67,6 +67,8 @@ for install_f in ${INSTALL_UBOOT_FILENAME} ${INSTALL_LINUX_FILENAME} ${INSTALL_R
 	fi;
 done
 if test "${install_abort}" = "1"; then
+	echo "To install a different image, set variable 'image-name', e.g.:"
+	echo "  => setenv image-name core-image-base"
 	echo "Aborted.";
 	exit;
 fi

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6ulsbc/boot.txt

@@ -2,29 +2,39 @@
 # U-Boot bootscript for NAND images created by Yocto.
 #
 
-# As the first step in the boot script, check if we are using DualBoot and
+# As the first step in the boot script, check if we are using DualBoot. This
-# if an upgrade is available. This requires the script to change some variables
+# requires the script to change some variables and save them, while the rest
-# and save them, while the rest of the script changes variables only temporarily
+# of the script changes variables only temporarily without saving them.
-# without saving them.
 
-# Dual boot update verification
+# Dual boot verification
 if test "${dualboot}" = "yes"; then
-	if test "${upgrade_available}" = "1"; then
+	if test "${active_system}" = "linux_a"; then
-		echo "Update detected; Booting new system in ${active_system} (try ${bootcount})"
+		echo "Booting from system A (try ${bootcount})"
+		setenv tmp_mtdrootfspart ${rootfsvol_a}
+		setenv tmp_rootfsvol ${rootfsvol_a}
 	else
-		if test "${active_system}" = "linux_a"; then
+		echo "Booting from system B (try ${bootcount})"
-			echo "Booting from system A"
+		setenv tmp_mtdrootfspart ${rootfsvol_b}
-			setenv mtdbootpart ${active_system}
+		setenv tmp_rootfsvol ${rootfsvol_b}
-			setenv mtdrootfspart ${rootfsvol_a}
+	fi
-			setenv rootfsvol ${rootfsvol_a}
+	if test "${mtdbootpart}" != "${active_system}"; then
-		else
+		setenv mtdbootpart ${active_system}
-			echo "Booting from system B"
+		env_save_needed="1"
-			setenv mtdbootpart ${active_system}
+	fi
-			setenv mtdrootfspart ${rootfsvol_b}
+	if test "${mtdrootfspart}" != "${tmp_mtdrootfspart}"; then
-			setenv rootfsvol ${rootfsvol_b}
+		setenv mtdrootfspart ${tmp_mtdrootfspart}
-		fi
+		env_save_needed="1"
+	fi
+	if test "${rootfsvol}" != "${tmp_rootfsvol}"; then
+		setenv rootfsvol ${tmp_rootfsvol}
+		env_save_needed="1"
+	fi
+	if test "${env_save_needed}" = "1"; then
+		env delete tmp_rootfsvol tmp_mtdrootfspart
+		env save
 	fi
 else
+	echo "Booting system (try ${bootcount})"
 	if test "${mtdbootpart}" = "recovery"; then
 		setenv boot_initrd true
 		setenv initrd_file uramdisk-recovery.img

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6ulstarter/boot.txt

@@ -2,29 +2,39 @@
 # U-Boot bootscript for NAND images created by Yocto.
 #
 
-# As the first step in the boot script, check if we are using DualBoot and
+# As the first step in the boot script, check if we are using DualBoot. This
-# if an upgrade is available. This requires the script to change some variables
+# requires the script to change some variables and save them, while the rest
-# and save them, while the rest of the script changes variables only temporarily
+# of the script changes variables only temporarily without saving them.
-# without saving them.
 
-# Dual boot update verification
+# Dual boot verification
 if test "${dualboot}" = "yes"; then
-	if test "${upgrade_available}" = "1"; then
+	if test "${active_system}" = "linux_a"; then
-		echo "Update detected; Booting new system in ${active_system} (try ${bootcount})"
+		echo "Booting from system A (try ${bootcount})"
+		setenv tmp_mtdrootfspart ${rootfsvol_a}
+		setenv tmp_rootfsvol ${rootfsvol_a}
 	else
-		if test "${active_system}" = "linux_a"; then
+		echo "Booting from system B (try ${bootcount})"
-			echo "Booting from system A"
+		setenv tmp_mtdrootfspart ${rootfsvol_b}
-			setenv mtdbootpart ${active_system}
+		setenv tmp_rootfsvol ${rootfsvol_b}
-			setenv mtdrootfspart ${rootfsvol_a}
+	fi
-			setenv rootfsvol ${rootfsvol_a}
+	if test "${mtdbootpart}" != "${active_system}"; then
-		else
+		setenv mtdbootpart ${active_system}
-			echo "Booting from system B"
+		env_save_needed="1"
-			setenv mtdbootpart ${active_system}
+	fi
-			setenv mtdrootfspart ${rootfsvol_b}
+	if test "${mtdrootfspart}" != "${tmp_mtdrootfspart}"; then
-			setenv rootfsvol ${rootfsvol_b}
+		setenv mtdrootfspart ${tmp_mtdrootfspart}
-		fi
+		env_save_needed="1"
+	fi
+	if test "${rootfsvol}" != "${tmp_rootfsvol}"; then
+		setenv rootfsvol ${tmp_rootfsvol}
+		env_save_needed="1"
+	fi
+	if test "${env_save_needed}" = "1"; then
+		env delete tmp_rootfsvol tmp_mtdrootfspart
+		env save
 	fi
 else
+	echo "Booting system (try ${bootcount})"
 	if test "${mtdbootpart}" = "recovery"; then
 		setenv boot_initrd true
 		setenv initrd_file uramdisk-recovery.img

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8m/altboot.txt

@@ -1,37 +0,0 @@
-#
-# U-Boot bootscript for altbootcmd (dual boot fallback after retries)
-#
-
-# After an upgrade, active_system has changed. U-Boot tries to boot this system
-# for a number of tries. If the limit is reached, altbootcmd is run instead.
-# This is the script that it will run. It has to:
-#  * switch back to previous system
-#  * reset the firmware update flag
-#  * run the regular boot command
-
-if test "${dualboot}" = "yes" && test "${upgrade_available}" = "1"; then
-	echo "## Update failed; Rolling back to previous version."
-	if test "${active_system}" = "linux_a"; then
-		setenv active_system linux_b
-		part number mmc ${mmcbootdev} linux_b linux_b_index
-		setexpr mmcpart ${linux_b_index}
-		# Save the partition index on variable rootfs_b_index
-		part number mmc ${mmcbootdev} rootfs_b rootfs_b_index
-		# Save the rootfs_b UUID into mmcroot_b
-		part uuid mmc ${mmcbootdev}:${rootfs_b_index} mmcroot_b
-		setenv mmcroot PARTUUID=${mmcroot_b}
-	else
-		setenv active_system linux_a
-		part number mmc ${mmcbootdev} linux_a linux_a_index
-		setexpr mmcpart ${linux_a_index}
-		# Save the partition index on variable rootfs_a_index
-		part number mmc ${mmcbootdev} rootfs_a rootfs_a_index
-		# Save the rootfs_a UUID into mmcroot_a
-		part uuid mmc ${mmcbootdev}:${rootfs_a_index} mmcroot_a
-		setenv mmcroot PARTUUID=${mmcroot_a}
-	fi
-	setenv upgrade_available
-	setenv bootcount 0
-	saveenv
-fi
-run bootcmd

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8m/install_linux_fw_sd.txt

@@ -34,6 +34,8 @@ for install_f in ${INSTALL_UBOOT_FILENAME} ${INSTALL_LINUX_FILENAME} ${INSTALL_R
 	fi;
 done
 if test "${install_abort}" = "1"; then
+	echo "To install a different image, set variable 'image-name', e.g.:"
+	echo "  => setenv image-name core-image-base"
 	echo "Aborted.";
 	exit;
 fi

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8m/install_linux_fw_usb.txt

@@ -34,6 +34,8 @@ for install_f in ${INSTALL_UBOOT_FILENAME} ${INSTALL_LINUX_FILENAME} ${INSTALL_R
 	fi;
 done
 if test "${install_abort}" = "1"; then
+	echo "To install a different image, set variable 'image-name', e.g.:"
+	echo "  => setenv image-name core-image-base"
 	echo "Aborted.";
 	exit;
 fi

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8mm-dvk/boot.txt

@@ -2,37 +2,36 @@
 # U-Boot bootscript for EMMC/SD images created by Yocto.
 #
 
-# As the first step in the boot script, check if we are using DualBoot and
+# As the first step in the boot script, check if we are using DualBoot. This
-# if an upgrade is available. This requires the script to change some variables
+# requires the script to change some variables and save them, while the rest
-# and save them, while the rest of the script changes variables only temporarily
+# of the script changes variables only temporarily without saving them.
-# without saving them.
 
-# Dual boot update verification
+# Dual boot verification
 if test "${dualboot}" = "yes"; then
-	if test "${upgrade_available}" = "1"; then
+	if test "${active_system}" = "linux_a"; then
-		echo "Update detected; Booting new system in ${active_system} (try ${bootcount})"
+		echo "Booting from system A (try ${bootcount})"
+		part number mmc ${mmcbootdev} linux_a tmp_mmcpart
+		part number mmc ${mmcbootdev} rootfs_a tmp_rootfs_index
 	else
-		if test "${active_system}" = "linux_a"; then
+		echo "Booting from system B (try ${bootcount})"
-			echo "Booting from system A"
+		part number mmc ${mmcbootdev} linux_b tmp_mmcpart
-			part number mmc ${mmcbootdev} linux_a pi
+		part number mmc ${mmcbootdev} rootfs_b tmp_rootfs_index
-			setenv mmcpart ${pi}
+	fi
-			# Save the partition index on variable rootfs_a_index
+	part uuid mmc ${mmcbootdev}:${tmp_rootfs_index} tmp_mmcroot
-			part number mmc ${mmcbootdev} rootfs_a rootfs_a_index
+	if test "${mmcpart}" -ne "${tmp_mmcpart}"; then
-			# Save the rootfs_a UUID into mmcroot_a
+		setexpr mmcpart ${tmp_mmcpart}
-			part uuid mmc ${mmcbootdev}:${rootfs_a_index} mmcroot_a
+		env_save_needed="1"
-			setenv mmcroot PARTUUID=${mmcroot_a}
+	fi
-		else
+	if test "${mmcroot}" != "PARTUUID=${tmp_mmcroot}"; then
-			echo "Booting from system B"
+		setenv mmcroot PARTUUID=${tmp_mmcroot}
-			part number mmc ${mmcbootdev} linux_b pi
+		env_save_needed="1"
-			setenv mmcpart ${pi}
+	fi
-			# Save the partition index on variable rootfs_b_index
+	if test "${env_save_needed}" = "1"; then
-			part number mmc ${mmcbootdev} rootfs_b rootfs_b_index
+		env delete tmp_mmcpart tmp_rootfs_index tmp_mmcroot
-			# Save the rootfs_b UUID into mmcroot_b
+		env save
-			part uuid mmc ${mmcbootdev}:${rootfs_b_index} mmcroot_b
-			setenv mmcroot PARTUUID=${mmcroot_b}
-		fi
 	fi
 else
+	echo "Booting system (try ${bootcount})"
 	# Get the UUID of the configured boot partition.
 	part uuid mmc ${mmcbootdev}:${mmcpart} bootpart
 	# Check the boot source.

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8mn-dvk/boot.txt

@@ -2,37 +2,36 @@
 # U-Boot bootscript for EMMC/SD images created by Yocto.
 #
 
-# As the first step in the boot script, check if we are using DualBoot and
+# As the first step in the boot script, check if we are using DualBoot. This
-# if an upgrade is available. This requires the script to change some variables
+# requires the script to change some variables and save them, while the rest
-# and save them, while the rest of the script changes variables only temporarily
+# of the script changes variables only temporarily without saving them.
-# without saving them.
 
-# Dual boot update verification
+# Dual boot verification
 if test "${dualboot}" = "yes"; then
-	if test "${upgrade_available}" = "1"; then
+	if test "${active_system}" = "linux_a"; then
-		echo "Update detected; Booting new system in ${active_system} (try ${bootcount})"
+		echo "Booting from system A (try ${bootcount})"
+		part number mmc ${mmcbootdev} linux_a tmp_mmcpart
+		part number mmc ${mmcbootdev} rootfs_a tmp_rootfs_index
 	else
-		if test "${active_system}" = "linux_a"; then
+		echo "Booting from system B (try ${bootcount})"
-			echo "Booting from system A"
+		part number mmc ${mmcbootdev} linux_b tmp_mmcpart
-			part number mmc ${mmcbootdev} linux_a pi
+		part number mmc ${mmcbootdev} rootfs_b tmp_rootfs_index
-			setenv mmcpart ${pi}
+	fi
-			# Save the partition index on variable rootfs_a_index
+	part uuid mmc ${mmcbootdev}:${tmp_rootfs_index} tmp_mmcroot
-			part number mmc ${mmcbootdev} rootfs_a rootfs_a_index
+	if test "${mmcpart}" -ne "${tmp_mmcpart}"; then
-			# Save the rootfs_a UUID into mmcroot_a
+		setexpr mmcpart ${tmp_mmcpart}
-			part uuid mmc ${mmcbootdev}:${rootfs_a_index} mmcroot_a
+		env_save_needed="1"
-			setenv mmcroot PARTUUID=${mmcroot_a}
+	fi
-		else
+	if test "${mmcroot}" != "PARTUUID=${tmp_mmcroot}"; then
-			echo "Booting from system B"
+		setenv mmcroot PARTUUID=${tmp_mmcroot}
-			part number mmc ${mmcbootdev} linux_b pi
+		env_save_needed="1"
-			setenv mmcpart ${pi}
+	fi
-			# Save the partition index on variable rootfs_b_index
+	if test "${env_save_needed}" = "1"; then
-			part number mmc ${mmcbootdev} rootfs_b rootfs_b_index
+		env delete tmp_mmcpart tmp_rootfs_index tmp_mmcroot
-			# Save the rootfs_b UUID into mmcroot_b
+		env save
-			part uuid mmc ${mmcbootdev}:${rootfs_b_index} mmcroot_b
-			setenv mmcroot PARTUUID=${mmcroot_b}
-		fi
 	fi
 else
+	echo "Booting system (try ${bootcount})"
 	# Get the UUID of the configured boot partition.
 	part uuid mmc ${mmcbootdev}:${mmcpart} bootpart
 	# Check the boot source.

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8x-sbc-express/boot.txt

@@ -2,37 +2,36 @@
 # U-Boot bootscript for EMMC/SD images created by Yocto.
 #
 
-# As the first step in the boot script, check if we are using DualBoot and
+# As the first step in the boot script, check if we are using DualBoot. This
-# if an upgrade is available. This requires the script to change some variables
+# requires the script to change some variables and save them, while the rest
-# and save them, while the rest of the script changes variables only temporarily
+# of the script changes variables only temporarily without saving them.
-# without saving them.
 
-# Dual boot update verification
+# Dual boot verification
 if test "${dualboot}" = "yes"; then
-	if test "${upgrade_available}" = "1"; then
+	if test "${active_system}" = "linux_a"; then
-		echo "Update detected; Booting new system in ${active_system} (try ${bootcount})"
+		echo "Booting from system A (try ${bootcount})"
+		part number mmc ${mmcbootdev} linux_a tmp_mmcpart
+		part number mmc ${mmcbootdev} rootfs_a tmp_rootfs_index
 	else
-		if test "${active_system}" = "linux_a"; then
+		echo "Booting from system B (try ${bootcount})"
-			echo "Booting from system A"
+		part number mmc ${mmcbootdev} linux_b tmp_mmcpart
-			part number mmc ${mmcbootdev} linux_a pi
+		part number mmc ${mmcbootdev} rootfs_b tmp_rootfs_index
-			setenv mmcpart ${pi}
+	fi
-			# Save the partition index on variable rootfs_a_index
+	part uuid mmc ${mmcbootdev}:${tmp_rootfs_index} tmp_mmcroot
-			part number mmc ${mmcbootdev} rootfs_a rootfs_a_index
+	if test "${mmcpart}" -ne "${tmp_mmcpart}"; then
-			# Save the rootfs_a UUID into mmcroot_a
+		setexpr mmcpart ${tmp_mmcpart}
-			part uuid mmc ${mmcbootdev}:${rootfs_a_index} mmcroot_a
+		env_save_needed="1"
-			setenv mmcroot PARTUUID=${mmcroot_a}
+	fi
-		else
+	if test "${mmcroot}" != "PARTUUID=${tmp_mmcroot}"; then
-			echo "Booting from system B"
+		setenv mmcroot PARTUUID=${tmp_mmcroot}
-			part number mmc ${mmcbootdev} linux_b pi
+		env_save_needed="1"
-			setenv mmcpart ${pi}
+	fi
-			# Save the partition index on variable rootfs_b_index
+	if test "${env_save_needed}" = "1"; then
-			part number mmc ${mmcbootdev} rootfs_b rootfs_b_index
+		env delete tmp_mmcpart tmp_rootfs_index tmp_mmcroot
-			# Save the rootfs_b UUID into mmcroot_b
+		env save
-			part uuid mmc ${mmcbootdev}:${rootfs_b_index} mmcroot_b
-			setenv mmcroot PARTUUID=${mmcroot_b}
-		fi
 	fi
 else
+	echo "Booting system (try ${bootcount})"
 	# Get the UUID of the configured boot partition.
 	part uuid mmc ${mmcbootdev}:${mmcpart} bootpart
 	# Check the boot source.

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8x-sbc-pro/boot.txt

@@ -2,37 +2,36 @@
 # U-Boot bootscript for EMMC/SD images created by Yocto.
 #
 
-# As the first step in the boot script, check if we are using DualBoot and
+# As the first step in the boot script, check if we are using DualBoot. This
-# if an upgrade is available. This requires the script to change some variables
+# requires the script to change some variables and save them, while the rest
-# and save them, while the rest of the script changes variables only temporarily
+# of the script changes variables only temporarily without saving them.
-# without saving them.
 
-# Dual boot update verification
+# Dual boot verification
 if test "${dualboot}" = "yes"; then
-	if test "${upgrade_available}" = "1"; then
+	if test "${active_system}" = "linux_a"; then
-		echo "Update detected; Booting new system in ${active_system} (try ${bootcount})"
+		echo "Booting from system A (try ${bootcount})"
+		part number mmc ${mmcbootdev} linux_a tmp_mmcpart
+		part number mmc ${mmcbootdev} rootfs_a tmp_rootfs_index
 	else
-		if test "${active_system}" = "linux_a"; then
+		echo "Booting from system B (try ${bootcount})"
-			echo "Booting from system A"
+		part number mmc ${mmcbootdev} linux_b tmp_mmcpart
-			part number mmc ${mmcbootdev} linux_a pi
+		part number mmc ${mmcbootdev} rootfs_b tmp_rootfs_index
-			setenv mmcpart ${pi}
+	fi
-			# Save the partition index on variable rootfs_a_index
+	part uuid mmc ${mmcbootdev}:${tmp_rootfs_index} tmp_mmcroot
-			part number mmc ${mmcbootdev} rootfs_a rootfs_a_index
+	if test "${mmcpart}" -ne "${tmp_mmcpart}"; then
-			# Save the rootfs_a UUID into mmcroot_a
+		setexpr mmcpart ${tmp_mmcpart}
-			part uuid mmc ${mmcbootdev}:${rootfs_a_index} mmcroot_a
+		env_save_needed="1"
-			setenv mmcroot PARTUUID=${mmcroot_a}
+	fi
-		else
+	if test "${mmcroot}" != "PARTUUID=${tmp_mmcroot}"; then
-			echo "Booting from system B"
+		setenv mmcroot PARTUUID=${tmp_mmcroot}
-			part number mmc ${mmcbootdev} linux_b pi
+		env_save_needed="1"
-			setenv mmcpart ${pi}
+	fi
-			# Save the partition index on variable rootfs_b_index
+	if test "${env_save_needed}" = "1"; then
-			part number mmc ${mmcbootdev} rootfs_b rootfs_b_index
+		env delete tmp_mmcpart tmp_rootfs_index tmp_mmcroot
-			# Save the rootfs_b UUID into mmcroot_b
+		env save
-			part uuid mmc ${mmcbootdev}:${rootfs_b_index} mmcroot_b
-			setenv mmcroot PARTUUID=${mmcroot_b}
-		fi
 	fi
 else
+	echo "Booting system (try ${bootcount})"
 	# Get the UUID of the configured boot partition.
 	part uuid mmc ${mmcbootdev}:${mmcpart} bootpart
 	# Check the boot source.

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8x/altboot.txt

@@ -1,37 +0,0 @@
-#
-# U-Boot bootscript for altbootcmd (dual boot fallback after retries)
-#
-
-# After an upgrade, active_system has changed. U-Boot tries to boot this system
-# for a number of tries. If the limit is reached, altbootcmd is run instead.
-# This is the script that it will run. It has to:
-#  * switch back to previous system
-#  * reset the firmware update flag
-#  * run the regular boot command
-
-if test "${dualboot}" = "yes" && test "${upgrade_available}" = "1"; then
-	echo "## Update failed; Rolling back to previous version."
-	if test "${active_system}" = "linux_a"; then
-		setenv active_system linux_b
-		part number mmc ${mmcbootdev} linux_b linux_b_index
-		setexpr mmcpart ${linux_b_index}
-		# Save the partition index on variable rootfs_b_index
-		part number mmc ${mmcbootdev} rootfs_b rootfs_b_index
-		# Save the rootfs_b UUID into mmcroot_b
-		part uuid mmc ${mmcbootdev}:${rootfs_b_index} mmcroot_b
-		setenv mmcroot PARTUUID=${mmcroot_b}
-	else
-		setenv active_system linux_a
-		part number mmc ${mmcbootdev} linux_a linux_a_index
-		setexpr mmcpart ${linux_a_index}
-		# Save the partition index on variable rootfs_a_index
-		part number mmc ${mmcbootdev} rootfs_a rootfs_a_index
-		# Save the rootfs_a UUID into mmcroot_a
-		part uuid mmc ${mmcbootdev}:${rootfs_a_index} mmcroot_a
-		setenv mmcroot PARTUUID=${mmcroot_a}
-	fi
-	setenv upgrade_available
-	setenv bootcount 0
-	saveenv
-fi
-run bootcmd

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8x/install_linux_fw_sd.txt

@@ -18,66 +18,7 @@ fi
 # the necessary logic to choose the correct imx-boot file for the target's SOC.
 setenv skip-uboot-check "yes"
 
-# Determine U-Boot file to program basing on SOM's RAM size and SOC type (linked to bus width)
+setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}.bin;
-bus_width="32bit"
-if test -n "${module_ram}" && test -n "${soc_type}"; then
-	if test "${soc_type}" = "imx8dx"; then
-		bus_width="16bit"
-	fi
-	setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-${module_ram}_${bus_width}.bin;
-else
-	# Determine U-Boot file to program basing on SOM's variant
-	if test -n "${module_variant}"; then
-		if test "${module_variant}" = "0x01"; then
-			setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-1GB_32bit.bin;
-		elif test "${module_variant}" = "0x02"; then
-			setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-2GB_32bit.bin;
-		elif test "${module_variant}" = "0x03"; then
-			setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-2GB_32bit.bin;
-		elif test "${module_variant}" = "0x04"; then
-			setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-1GB_16bit.bin;
-		elif test "${module_variant}" = "0x05"; then
-			setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-1GB_16bit.bin;
-		elif test "${module_variant}" = "0x06"; then
-			setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-512MB_16bit.bin;
-		elif test "${module_variant}" = "0x07"; then
-			setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-1GB_32bit.bin;
-		elif test "${module_variant}" = "0x08"; then
-			setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-1GB_32bit.bin;
-		elif test "${module_variant}" = "0x09"; then
-			setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-512MB_16bit.bin;
-		elif test "${module_variant}" = "0x0A"; then
-			setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-1GB_16bit.bin;
-		elif test "${module_variant}" = "0x0B"; then
-			setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-1GB_16bit.bin;
-		fi
-	fi
-fi
-
-# Use 'test -n ...' because 'test -z ...' does not work well on old versions of
-# u-boot when the checked value is empty.
-if test -n "${INSTALL_UBOOT_FILENAME}"; then
-	true;
-else
-	echo "";
-	echo "[ERROR] Cannot determine U-Boot file for this module!";
-	echo "";
-	echo "1. Set variable 'INSTALL_UBOOT_FILENAME' depending on your ConnectCore 8X variant:";
-	echo "   - For a QuadXPlus CPU with 1GB LPDDR4, run:";
-	echo "     => setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-1GB_32bit.bin";
-	echo "   - For a QuadXPlus CPU with 2GB LPDDR4, run:";
-	echo "     => setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-2GB_32bit.bin";
-	echo "   - For a DualX CPU with 1GB LPDDR4, run:";
-	echo "     => setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-1GB_16bit.bin";
-	echo "   - For a DualX CPU with 512MB LPDDR4, run:";
-	echo "     => setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-512MB_16bit.bin";
-	echo "";
-	echo "2. Run the install script again.";
-	echo "";
-	echo "Aborted";
-	echo "";
-	exit;
-fi;
 
 setenv INSTALL_MMCDEV 1
 
@@ -105,6 +46,8 @@ for install_f in ${INSTALL_UBOOT_FILENAME} ${INSTALL_LINUX_FILENAME} ${INSTALL_R
 	fi;
 done
 if test "${install_abort}" = "1"; then
+	echo "To install a different image, set variable 'image-name', e.g.:"
+	echo "  => setenv image-name core-image-base"
 	echo "Aborted.";
 	exit;
 fi

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8x/install_linux_fw_usb.txt

@@ -18,66 +18,7 @@ fi
 # the necessary logic to choose the correct imx-boot file for the target's SOC.
 setenv skip-uboot-check "yes"
 
-# Determine U-Boot file to program basing on SOM's RAM size and SOC type (linked to bus width)
+setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}.bin;
-bus_width="32bit"
-if test -n "${module_ram}" && test -n "${soc_type}"; then
-	if test "${soc_type}" = "imx8dx"; then
-		bus_width="16bit"
-	fi
-	setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-${module_ram}_${bus_width}.bin;
-else
-	# Determine U-Boot file to program basing on SOM's variant
-	if test -n "${module_variant}"; then
-		if test "${module_variant}" = "0x01"; then
-			setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-1GB_32bit.bin;
-		elif test "${module_variant}" = "0x02"; then
-			setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-2GB_32bit.bin;
-		elif test "${module_variant}" = "0x03"; then
-			setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-2GB_32bit.bin;
-		elif test "${module_variant}" = "0x04"; then
-			setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-1GB_16bit.bin;
-		elif test "${module_variant}" = "0x05"; then
-			setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-1GB_16bit.bin;
-		elif test "${module_variant}" = "0x06"; then
-			setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-512MB_16bit.bin;
-		elif test "${module_variant}" = "0x07"; then
-			setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-1GB_32bit.bin;
-		elif test "${module_variant}" = "0x08"; then
-			setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-1GB_32bit.bin;
-		elif test "${module_variant}" = "0x09"; then
-			setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-512MB_16bit.bin;
-		elif test "${module_variant}" = "0x0A"; then
-			setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-1GB_16bit.bin;
-		elif test "${module_variant}" = "0x0B"; then
-			setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-1GB_16bit.bin;
-		fi
-	fi
-fi
-
-# Use 'test -n ...' because 'test -z ...' does not work well on old versions of
-# u-boot when the checked value is empty.
-if test -n "${INSTALL_UBOOT_FILENAME}"; then
-	true;
-else
-	echo "";
-	echo "[ERROR] Cannot determine U-Boot file for this module!";
-	echo "";
-	echo "1. Set variable 'INSTALL_UBOOT_FILENAME' depending on your ConnectCore 8X variant:";
-	echo "   - For a QuadXPlus CPU with 1GB LPDDR4, run:";
-	echo "     => setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-1GB_32bit.bin";
-	echo "   - For a QuadXPlus CPU with 2GB LPDDR4, run:";
-	echo "     => setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-2GB_32bit.bin";
-	echo "   - For a DualX CPU with 1GB LPDDR4, run:";
-	echo "     => setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-1GB_16bit.bin";
-	echo "   - For a DualX CPU with 512MB LPDDR4, run:";
-	echo "     => setenv INSTALL_UBOOT_FILENAME imx-boot-##MACHINE##-${soc_rev}-512MB_16bit.bin";
-	echo "";
-	echo "2. Run the install script again.";
-	echo "";
-	echo "Aborted";
-	echo "";
-	exit;
-fi;
 
 setenv INSTALL_USBDEV 0
 
@@ -105,6 +46,8 @@ for install_f in ${INSTALL_UBOOT_FILENAME} ${INSTALL_LINUX_FILENAME} ${INSTALL_R
 	fi;
 done
 if test "${install_abort}" = "1"; then
+	echo "To install a different image, set variable 'image-name', e.g.:"
+	echo "  => setenv image-name core-image-base"
 	echo "Aborted.";
 	exit;
 fi

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8x/install_linux_fw_uuu.sh

@@ -93,7 +93,7 @@ fi
 echo ""
 echo "Determining image files to use..."
 
-# Determine U-Boot file to program basing on SOM's SOC type (linked to bus width)
+# Determine U-Boot file to program basing on SOM's SOC revision
 if [ -z ${INSTALL_UBOOT_FILENAME} ]; then
 	# Since SOMs with the B0 SOC might have an older U-Boot that doesn't export the
 	# SOC revision to the environment, use B0 by default
@@ -102,59 +102,7 @@ if [ -z ${INSTALL_UBOOT_FILENAME} ]; then
 		soc_rev="B0"
 	fi
 
-	bus_width="32bit"
+	INSTALL_UBOOT_FILENAME="imx-boot-##MACHINE##-${soc_rev}.bin"
-	soc_type=$(getenv "soc_type")
-	if [ "$soc_type" = "imx8dx"  ]; then
-		bus_width="16bit"
-	fi
-
-	module_ram=$(getenv "module_ram")
-	if [ -z "${module_ram}" ]; then
-		module_variant=$(getenv "module_variant")
-		# Determine U-Boot file to program basing on SOM's variant
-		if [ -n "$module_variant" ] || [ "$module_variant" = "0x00" ]; then
-			if [ "$module_variant" = "0x01" ] || \
-			   [ "$module_variant" = "0x04" ] || \
-			   [ "$module_variant" = "0x05" ]; then
-				module_ram="1GB"
-			elif [ "$module_variant" = "0x06" ] || \
-			     [ "$module_variant" = "0x09" ]; then
-				module_ram="512MB"
-			else
-				module_ram="2GB"
-			fi
-			INSTALL_UBOOT_FILENAME="imx-boot-##MACHINE##-${soc_rev}-${module_ram}_${bus_width}.bin"
-		fi
-	else
-		INSTALL_UBOOT_FILENAME="imx-boot-##MACHINE##-${soc_rev}-${module_ram}_${bus_width}.bin"
-	fi
-
-	# U-Boot when the checked value is empty.
-	if [ -n "${INSTALL_UBOOT_FILENAME}" ]; then
-		true
-	else
-		# remove redirect
-		uuu fb: ucmd setenv stdout serial
-
-		echo ""
-		echo "[ERROR] Cannot determine U-Boot file for this module!"
-		echo ""
-		echo "1. Add U-boot file name, depending on your ConnectCore 8X variant, to script command line:"
-		echo "   - For a QuadXPlus CPU with 1GB LPDDR4, run:"
-		echo "     => ./install_linux_fw_uuu.sh -u imx-boot-##MACHINE##-${soc_rev}-1GB_32bit.bin"
-		echo "   - For a QuadXPlus CPU with 2GB LPDDR4, run:"
-		echo "     => ./install_linux_fw_uuu.sh -u imx-boot-##MACHINE##-${soc_rev}-2GB_32bit.bin"
-		echo "   - For a DualX CPU with 1GB LPDDR4, run:"
-		echo "     => ./install_linux_fw_uuu.sh -u imx-boot-##MACHINE##-${soc_rev}-1GB_16bit.bin"
-		echo "   - For a DualX CPU with 512MB LPDDR4, run:"
-		echo "     => ./install_linux_fw_uuu.sh -u imx-boot-##MACHINE##-${soc_rev}-512MB_16bit.bin"
-		echo ""
-		echo "2. Run the install script again."
-		echo ""
-		echo "Aborted"
-		echo ""
-		exit
-	fi
 fi
 
 # remove redirect

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx93-dvk/boot.txt

@@ -2,37 +2,39 @@
 # U-Boot bootscript for EMMC/SD images created by Yocto.
 #
 
-# As the first step in the boot script, check if we are using DualBoot and
+# As the first step in the boot script, check if we are using DualBoot. This
-# if an upgrade is available. This requires the script to change some variables
+# requires the script to change some variables and save them, while the rest
-# and save them, while the rest of the script changes variables only temporarily
+# of the script changes variables only temporarily without saving them.
-# without saving them.
 
-# Dual boot update verification
+# Pre step: check if we boot from uSD.
-if test "${dualboot}" = "yes"; then
+if test "${mmcbootdev}" = "1"; then
-	if test "${upgrade_available}" = "1"; then
+	# We are booting from the SD card.
-		echo "Update detected; Booting new system in ${active_system} (try ${bootcount})"
+	setenv mmcroot /dev/mmcblk${mmcbootdev}p2
+elif test "${dualboot}" = "yes"; then
+	if test "${active_system}" = "linux_a"; then
+		echo "Booting from system A (try ${bootcount})"
+		part number mmc ${mmcbootdev} linux_a tmp_mmcpart
+		part number mmc ${mmcbootdev} rootfs_a tmp_rootfs_index
 	else
-		if test "${active_system}" = "linux_a"; then
+		echo "Booting from system B (try ${bootcount})"
-			echo "Booting from system A"
+		part number mmc ${mmcbootdev} linux_b tmp_mmcpart
-			part number mmc ${mmcbootdev} linux_a pi
+		part number mmc ${mmcbootdev} rootfs_b tmp_rootfs_index
-			setenv mmcpart ${pi}
+	fi
-			# Save the partition index on variable rootfs_a_index
+	part uuid mmc ${mmcbootdev}:${tmp_rootfs_index} tmp_mmcroot
-			part number mmc ${mmcbootdev} rootfs_a rootfs_a_index
+	if test "${mmcpart}" -ne "${tmp_mmcpart}"; then
-			# Save the rootfs_a UUID into mmcroot_a
+		setexpr mmcpart ${tmp_mmcpart}
-			part uuid mmc ${mmcbootdev}:${rootfs_a_index} mmcroot_a
+		env_save_needed="1"
-			setenv mmcroot PARTUUID=${mmcroot_a}
+	fi
-		else
+	if test "${mmcroot}" != "PARTUUID=${tmp_mmcroot}"; then
-			echo "Booting from system B"
+		setenv mmcroot PARTUUID=${tmp_mmcroot}
-			part number mmc ${mmcbootdev} linux_b pi
+		env_save_needed="1"
-			setenv mmcpart ${pi}
+	fi
-			# Save the partition index on variable rootfs_b_index
+	if test "${env_save_needed}" = "1"; then
-			part number mmc ${mmcbootdev} rootfs_b rootfs_b_index
+		env delete tmp_mmcpart tmp_rootfs_index tmp_mmcroot
-			# Save the rootfs_b UUID into mmcroot_b
+		env save
-			part uuid mmc ${mmcbootdev}:${rootfs_b_index} mmcroot_b
-			setenv mmcroot PARTUUID=${mmcroot_b}
-		fi
 	fi
 else
+	echo "Booting system (try ${bootcount})"
 	# Get the UUID of the configured boot partition.
 	part uuid mmc ${mmcbootdev}:${mmcpart} bootpart
 	# Check the boot source.
@@ -43,9 +45,6 @@ else
 		# We are booting from the eMMC using 'recovery'.
 		setenv boot_initrd true
 		setenv initrd_file uramdisk-recovery.img
-	else
-		# We are booting from the SD card.
-		setenv mmcroot /dev/mmcblk${mmcbootdev}p2
 	fi
 fi
 
@@ -75,6 +74,17 @@ if test "${module_has_mca}" = "1" && test -z "${disable_mca}"; then
 	setenv overlays _ov_som_mca_ccimx93.dtbo,${overlays}
 fi
 
+if test "${cpu_type}" = "imx9352" || \
+   test "${cpu_type}" = "imx9351" || \
+   test "${cpu_type}" = "imx9322" || \
+   test "${cpu_type}" = "imx9321"; then
+	module_has_npu="1"
+fi
+
+if test "${module_has_npu}" = "1" && test -z "${disable_npu}"; then
+	setenv overlays _ov_som_npu_ccimx93.dtbo,${overlays}
+fi
+
 dboot linux mmc ${mmcbootdev}:${mmcpart}
 
 #

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx93/altboot.txt

@@ -1,37 +0,0 @@
-#
-# U-Boot bootscript for altbootcmd (dual boot fallback after retries)
-#
-
-# After an upgrade, active_system has changed. U-Boot tries to boot this system
-# for a number of tries. If the limit is reached, altbootcmd is run instead.
-# This is the script that it will run. It has to:
-#  * switch back to previous system
-#  * reset the firmware update flag
-#  * run the regular boot command
-
-if test "${dualboot}" = "yes" && test "${upgrade_available}" = "1"; then
-	echo "## Update failed; Rolling back to previous version."
-	if test "${active_system}" = "linux_a"; then
-		setenv active_system linux_b
-		part number mmc ${mmcbootdev} linux_b linux_b_index
-		setexpr mmcpart ${linux_b_index}
-		# Save the partition index on variable rootfs_b_index
-		part number mmc ${mmcbootdev} rootfs_b rootfs_b_index
-		# Save the rootfs_b UUID into mmcroot_b
-		part uuid mmc ${mmcbootdev}:${rootfs_b_index} mmcroot_b
-		setenv mmcroot PARTUUID=${mmcroot_b}
-	else
-		setenv active_system linux_a
-		part number mmc ${mmcbootdev} linux_a linux_a_index
-		setexpr mmcpart ${linux_a_index}
-		# Save the partition index on variable rootfs_a_index
-		part number mmc ${mmcbootdev} rootfs_a rootfs_a_index
-		# Save the rootfs_a UUID into mmcroot_a
-		part uuid mmc ${mmcbootdev}:${rootfs_a_index} mmcroot_a
-		setenv mmcroot PARTUUID=${mmcroot_a}
-	fi
-	setenv upgrade_available
-	setenv bootcount 0
-	saveenv
-fi
-run bootcmd

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccmp1/altboot.txt

@@ -1,27 +0,0 @@
-#
-# U-Boot bootscript for altbootcmd (dual boot fallback after retries)
-#
-
-# After an upgrade, active_system has changed. U-Boot tries to boot this system
-# for a number of tries. If the limit is reached, altbootcmd is run instead.
-# This is the script that it will run. It has to:
-#  * switch back to previous system
-#  * reset the firmware update flag
-#  * run the regular boot command
-
-if test "${dualboot}" = "yes" && test "${upgrade_available}" = "1"; then
-	echo "## Update failed; Rolling back to previous version."
-	if test "${active_system}" = "linux_a"; then
-		setenv active_system linux_b
-		setenv mtdbootpart ${active_system}
-		setenv rootfsvol ${rootfsvol_b}
-	else
-		setenv active_system linux_a
-		setenv mtdbootpart ${active_system}
-		setenv rootfsvol ${rootfsvol_a}
-	fi
-	setenv upgrade_available
-	setenv bootcount 0
-	saveenv
-fi
-run bootcmd

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccmp1/install_linux_fw_sd.txt

@@ -35,6 +35,8 @@ for install_f in ${INSTALL_ATF_FILENAME} ${INSTALL_FIP_FILENAME} ${INSTALL_LINUX
 	fi;
 done
 if test "${install_abort}" = "1"; then
+	echo "To install a different image, set variable 'image-name', e.g.:"
+	echo "  => setenv image-name core-image-base"
 	echo "Aborted.";
 	exit;
 fi
@@ -251,8 +253,10 @@ setenv bootcmd "
 	echo \"\";
 	echo \"\";
 	sleep 1;
+	bootcount reset;
 	reset;
 "
 
+bootcount reset
 saveenv
 reset

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccmp1/install_linux_fw_usb.txt

@@ -35,6 +35,8 @@ for install_f in ${INSTALL_ATF_FILENAME} ${INSTALL_FIP_FILENAME} ${INSTALL_RECOV
 	fi;
 done
 if test "${install_abort}" = "1"; then
+	echo "To install a different image, set variable 'image-name', e.g.:"
+	echo "  => setenv image-name core-image-base"
 	echo "Aborted.";
 	exit;
 fi
@@ -252,8 +254,10 @@ setenv bootcmd "
 	echo \"\";
 	echo \"\";
 	sleep 1;
+	bootcount reset;
 	reset;
 "
 
+bootcount reset
 saveenv
 reset

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccmp1/install_linux_fw_uuu.sh

@@ -221,12 +221,14 @@ fi
 # Set 'bootcmd' for the second part of the script that will
 #  - Reset environment to defaults
 #  - Keep the 'dualboot' status
+#  - Reset the bootcount
 #  - Save the environment
 #  - Update the 'linux' partition(s)
 #  - Update the 'rootfs' partition(s)
 uuu fb: ucmd setenv bootcmd "
 	env default -a;
 	setenv dualboot \${dualboot};
+	bootcount reset;
 	saveenv;
 	saveenv;
 	echo \"\";
@@ -277,6 +279,7 @@ else
 fi
 
 # Reset the target
+uuu fb: ucmd bootcount reset
 uuu fb: acmd reset
 
 echo "\033[32m"

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccmp13-dvk/boot.txt

@@ -2,27 +2,33 @@
 # U-Boot bootscript for NAND/SD images created by Yocto.
 #
 
-# As the first step in the boot script, check if we are using DualBoot and
+# As the first step in the boot script, check if we are using DualBoot. This
-# if an upgrade is available. This requires the script to change some variables
+# requires the script to change some variables and save them, while the rest
-# and save them, while the rest of the script changes variables only temporarily
+# of the script changes variables only temporarily without saving them.
-# without saving them.
 
-# Dual boot update verification
+# Dual boot verification
 if test "${dualboot}" = "yes"; then
-	if test "${upgrade_available}" = "1"; then
+	if test "${active_system}" = "linux_a"; then
-		echo "Update detected; Booting new system in ${active_system} (try ${bootcount})"
+		echo "Booting from system A (try ${bootcount})"
+		setenv tmp_rootfsvol ${rootfsvol_a}
 	else
-		if test "${active_system}" = "linux_a"; then
+		echo "Booting from system B (try ${bootcount})"
-			echo "Booting from system A"
+		setenv tmp_rootfsvol ${rootfsvol_b}
-			setenv mtdbootpart ${active_system}
+	fi
-			setenv rootfsvol ${rootfsvol_a}
+	if test "${mtdbootpart}" != "${active_system}"; then
-		else
+		setenv mtdbootpart ${active_system}
-			echo "Booting from system B"
+		env_save_needed="1"
-			setenv mtdbootpart ${active_system}
+	fi
-			setenv rootfsvol ${rootfsvol_b}
+	if test "${rootfsvol}" != "${tmp_rootfsvol}"; then
-		fi
+		setenv rootfsvol ${tmp_rootfsvol}
+		env_save_needed="1"
+	fi
+	if test "${env_save_needed}" = "1"; then
+		env delete tmp_rootfsvol
+		env save
 	fi
 else
+	echo "Booting system (try ${bootcount})"
 	# Check the boot source.
 	if test "${mtdbootpart}" = "linux"; then
 		# We are booting from the NAND using 'linux'.

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccmp15-dvk/boot.txt

@@ -2,27 +2,33 @@
 # U-Boot bootscript for NAND/SD images created by Yocto.
 #
 
-# As the first step in the boot script, check if we are using DualBoot and
+# As the first step in the boot script, check if we are using DualBoot. This
-# if an upgrade is available. This requires the script to change some variables
+# requires the script to change some variables and save them, while the rest
-# and save them, while the rest of the script changes variables only temporarily
+# of the script changes variables only temporarily without saving them.
-# without saving them.
 
-# Dual boot update verification
+# Dual boot verification
 if test "${dualboot}" = "yes"; then
-	if test "${upgrade_available}" = "1"; then
+	if test "${active_system}" = "linux_a"; then
-		echo "Update detected; Booting new system in ${active_system} (try ${bootcount})"
+		echo "Booting from system A (try ${bootcount})"
+		setenv tmp_rootfsvol ${rootfsvol_a}
 	else
-		if test "${active_system}" = "linux_a"; then
+		echo "Booting from system B (try ${bootcount})"
-			echo "Booting from system A"
+		setenv tmp_rootfsvol ${rootfsvol_b}
-			setenv mtdbootpart ${active_system}
+	fi
-			setenv rootfsvol ${rootfsvol_a}
+	if test "${mtdbootpart}" != "${active_system}"; then
-		else
+		setenv mtdbootpart ${active_system}
-			echo "Booting from system B"
+		env_save_needed="1"
-			setenv mtdbootpart ${active_system}
+	fi
-			setenv rootfsvol ${rootfsvol_b}
+	if test "${rootfsvol}" != "${tmp_rootfsvol}"; then
-		fi
+		setenv rootfsvol ${tmp_rootfsvol}
+		env_save_needed="1"
+	fi
+	if test "${env_save_needed}" = "1"; then
+		env delete tmp_rootfsvol
+		env save
 	fi
 else
+	echo "Booting system (try ${bootcount})"
 	# Check the boot source.
 	if test "${mtdbootpart}" = "linux"; then
 		# We are booting from the NAND using 'linux'.
@@ -45,6 +51,8 @@ setenv ORIG_overlays ${overlays}
 # Determine overlays to apply depending on the hardware capabilities
 # described by the HWID, SOM version, and carrier board version.
 #
+setexpr module_has_mca ${hwid_2} \& 10000
+setexpr module_has_mca ${module_has_mca} / 10000
 setexpr module_has_wifi ${hwid_2} \& 20000
 setexpr module_has_wifi ${module_has_wifi} / 20000
 setexpr module_has_bt ${hwid_2} \& 40000
@@ -58,6 +66,10 @@ if test "${module_has_wifi}" = "1" && test -z "${disable_wifi}"; then
 	setenv overlays _ov_som_wifi_ccmp15.dtbo,${overlays}
 fi
 
+if test "${module_has_mca}" = "1" && test -z "${disable_mca}"; then
+	setenv overlays _ov_som_mca_ccmp15.dtbo,${overlays}
+fi
+
 # Apply DVKv1 overlay if the board_version is 1
 if test -z "${board_version}" || test "${board_version}" -eq "1"; then
 	setenv overlays _ov_board_v1_ccmp15-dvk.dtbo,${overlays}

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey_2022.04.bb

@@ -1,11 +0,0 @@
-# Copyright (C) 2022 Digi International
-
-require u-boot-dey.inc
-LIC_FILES_CHKSUM = "file://Licenses/README;md5=5a7450c57ffe5ae63fd732446b988025"
-
-DEPENDS += "flex-native bison-native"
-
-SRCBRANCH = "v2022.04/maint"
-SRCREV = "${AUTOREV}"
-
-COMPATIBLE_MACHINE = "(ccimx93)"

meta-digi-arm/recipes-bsp/u-boot/u-boot-dey_2023.04.bb

@@ -0,0 +1,11 @@
+# Copyright 2023 Digi International Inc.
+
+require u-boot-dey.inc
+LIC_FILES_CHKSUM = "file://Licenses/README;md5=2ca5f2c35c8cc335f0a19756634782f1"
+
+DEPENDS += "flex-native bison-native"
+
+SRCBRANCH = "v2023.04/master"
+SRCREV = "${AUTOREV}"
+
+COMPATIBLE_MACHINE = "(ccimx93)"

meta-digi-arm/recipes-connectivity/nxp-wlan-sdk/nxp-wlan-sdk_git.inc

@@ -3,10 +3,10 @@ LICENSE = "GPL-2.0-only"
 LIC_FILES_CHKSUM = "file://${WORKDIR}/git/LICENSE;md5=ab04ac0f249af12befccb94447c08b77"
 
 # For Kernel 5.4 and later
-SRCBRANCH = "lf-6.1.1_1.0.0"
+SRCBRANCH = "lf-6.1.22_2.0.0"
 MRVL_SRC ?= "git://github.com/nxp-imx/mwifiex.git;protocol=https"
 SRC_URI = "${MRVL_SRC};branch=${SRCBRANCH}"
-SRCREV = "98e5b28b1a7afea9dbded4067e93bfd584531a79"
+SRCREV = "f1382ccbd34fc22daf504e798745f6cddb702b82"
 
 S = "${WORKDIR}/git/mxm_wifiex/wlan_src"
 

meta-digi-arm/recipes-core/udev/udev-extraconf/00-disable-sd.rules

@@ -1,2 +0,0 @@
-# Disable all SD devices
-SUBSYSTEMS=="mmc", ATTRS{type}=="SD", RUN:="/bin/true"

meta-digi-arm/recipes-core/udev/udev-extraconf/automount.rules

@@ -16,7 +16,7 @@
 # Digi-mounted partitions: linux, update, data
 SUBSYSTEM=="block", ENV{ID_PART_ENTRY_NAME}=="linux*|update*|data*", ACTION=="add", RUN+="/etc/udev/scripts/mount_digiparts.sh", GOTO="automount_rules_end"
 SUBSYSTEM=="mtd", ATTRS{name}=="linux*|update*|data*", ACTION=="add", RUN+="/etc/udev/scripts/mount_digiparts.sh", GOTO="automount_rules_end"
-SUBSYSTEM=="ubi", KERNEL=="ubi0*", ATTRS{name}=="linux*|update*|data*", ACTION=="add", RUN+="/etc/udev/scripts/mount_digiparts.sh", GOTO="automount_rules_end"
+SUBSYSTEM=="ubi", KERNEL=="ubi*", ATTRS{name}=="linux*|update*|data*", ACTION=="add", RUN+="/etc/udev/scripts/mount_digiparts.sh", GOTO="automount_rules_end"
 
 # Avoid mounting recovery partition
 SUBSYSTEM=="block", ENV{ID_PART_ENTRY_NAME}=="recovery*", ACTION=="add", GOTO="automount_rules_end"

meta-digi-arm/recipes-core/udev/udev-extraconf/mount_digiparts.sh

@@ -3,7 +3,7 @@
 #
 #  mount_bootparts.sh
 #
-#  Copyright (C) 2014-2022 by Digi International Inc.
+#  Copyright (C) 2014-2023 by Digi International Inc.
 #  All rights reserved.
 #
 #  This program is free software; you can redistribute it and/or modify it
@@ -15,14 +15,9 @@
 #===============================================================================
 
 BASE_INIT="$(readlink -f "@base_sbindir@/init")"
+BASE_INIT_ORIG="$(readlink -f "@base_sbindir@/init.orig")"
 INIT_SYSTEMD="@systemd_unitdir@/systemd"
 
-# Partitions are mounted:
-#   * For multi-MTD systems, when an MTD subsystem event is received.
-#   * For single-MTD systems, when a UBI subsystem event is received.
-# So, do nothing for UBI subsystem events in multi-MTD systems.
-[ "${SUBSYSTEM}" = "ubi" ] && [ -c /dev/ubi1 ] && exit 0
-
 if [ "${SUBSYSTEM}" = "block" ]; then
 	PARTNAME="${ID_PART_ENTRY_NAME}"
 elif [ "${SUBSYSTEM}" = "mtd" ]; then
@@ -30,6 +25,12 @@ elif [ "${SUBSYSTEM}" = "mtd" ]; then
 	PARTNAME="$(grep ${MTDN} /proc/mtd | sed -ne 's,.*"\(.*\)",\1,g;T;p')"
 elif [ "${SUBSYSTEM}" = "ubi" ]; then
 	PARTNAME="$(cat /sys/${DEVPATH}/name)"
+	# Multi-MTD systems only have one UBI volume per MTD partition that is
+	# called the same as the MTD partition. Do nothing for UBI events if the
+	# MTD partition is called the same, as they are already handled by the
+	# "mtd" subsystem rule
+	result="$(grep '\"${PARTNAME}\"$' /proc/mtd)"
+	[ -n "${result}" ] && exit 0
 fi
 
 MOUNT_FOLDER=${PARTNAME}
@@ -39,6 +40,13 @@ if [ "${PARTNAME}" = "linux" ] || [ "${PARTNAME}" = "linux_a" ] || [ "${PARTNAME
 	MOUNT_FOLDER="linux"
 	MOUNT_PARAMS="${MOUNT_PARAMS} -o ro"
 fi
+MOUNTPOINT="/mnt/${MOUNT_FOLDER}"
+
+# Skip if partition is already mounted. For example R/O systems with the '/etc' overlay enabled mount the 'data' partition in very early stages.
+if grep -qs "${MOUNTPOINT}" /proc/mounts; then
+	logger "Partition '${PARTNAME}' is already mounted, skipping..."
+	exit 0
+fi
 
 DUALBOOT_MODE="$(fw_printenv -n dualboot 2>/dev/null)"
 if [ "${DUALBOOT_MODE}" = "yes" ]; then
@@ -51,7 +59,9 @@ if [ "${DUALBOOT_MODE}" = "yes" ]; then
 	fi
 fi
 
-if [ "x$BASE_INIT" = "x$INIT_SYSTEMD" ];then
+# R/O systems using 'systemd' and '/etc' overlayfs do not link '/sbin/init' to 'systemd'. In these cases
+# 'init' is renamed to 'init.orig' and that is the linked file, so check this case too.
+if [ "x$BASE_INIT" = "x$INIT_SYSTEMD" ] || [ "x$BASE_INIT_ORIG" = "x$INIT_SYSTEMD" ]; then
 	# systemd as init uses systemd-mount to mount block devices
 
 	# Verify if unit is already launched, if so just restart it.
@@ -85,7 +95,6 @@ else
 fi
 
 # Create mount point if needed
-MOUNTPOINT="/mnt/${MOUNT_FOLDER}"
 [ -d "${MOUNTPOINT}" ] || mkdir -p ${MOUNTPOINT}
 
 if [ "${SUBSYSTEM}" = "block" ]; then

meta-digi-arm/recipes-core/udev/udev-extraconf_1.1.bbappend

@@ -9,7 +9,6 @@ SRC_URI += " \
 "
 SRC_URI:append:ccmp1 = " \
     file://99-ext-rtc-wakeup.rules \
-    file://00-disable-sd.rules \
 "
 
 do_install:append() {
@@ -60,9 +59,6 @@ do_install:append() {
 
 do_install:append:ccmp1() {
 	install -m 0644 ${WORKDIR}/99-ext-rtc-wakeup.rules ${D}${sysconfdir}/udev/rules.d/
-	# Disables all SD device but keeps on mounting other external memory devices like USB.
-	# This is currently needed for the CCMP1 platform as a workaround to fix a boot issue.
-	install -m 0644 ${WORKDIR}/00-disable-sd.rules ${D}${sysconfdir}/udev/rules.d/
 }
 
 FILES:${PN}:append = " \

meta-digi-arm/recipes-digi/trustfence/trustfence-genpki-native.bb

@@ -1,62 +0,0 @@
-# Copyright (C) 2023, Digi International Inc.
-
-SUMMARY = "TrustFence generation of Public Key Infrastructure (PKI)"
-LICENSE = "GPL-2.0-only"
-LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/GPL-2.0-only;md5=801f80980d171dd6425610833a22dbe6"
-
-inherit native
-
-RDEPENDS:${PN} = " \
-    trustfence-sign-tools-native \
-    openssl-native \
-"
-
-S = "${WORKDIR}"
-
-do_fetch[noexec] = "1"
-do_configure[noexec] = "1"
-do_compile[noexec] = "1"
-
-# Function to generate a PKI tree (with lock dir protection)
-GENPKI_LOCK_DIR = "${TRUSTFENCE_SIGN_KEYS_PATH}/.genpki.lock"
-gen_pki_tree() {
-	if mkdir -p ${GENPKI_LOCK_DIR}; then
-		if [ "${DEY_SOC_VENDOR}" = "NXP" ]; then
-			trustfence-gen-pki.sh ${TRUSTFENCE_SIGN_KEYS_PATH}
-		elif [ "${DEY_SOC_VENDOR}" = "STM" ]; then
-			# Call sign script with no artifact arguments to just
-			# generate the keys
-			export CONFIG_SIGN_KEYS_PATH="${TRUSTFENCE_SIGN_KEYS_PATH}"
-			export CONFIG_KEY_INDEX="${TRUSTFENCE_KEY_INDEX}"
-			trustfence-sign-artifact.sh -p ${DIGI_SOM}
-		fi
-		rm -rf ${GENPKI_LOCK_DIR}
-	else
-		bbfatal "Could not get lock to generate PKI tree"
-	fi
-}
-
-# Function that generates a PKI tree if there isn't one
-check_gen_pki_tree() {
-	if [ "${DEY_SOC_VENDOR}" = "NXP" ]; then
-		SRK_KEYS="$(echo ${TRUSTFENCE_SIGN_KEYS_PATH}/crts/SRK*crt.pem | sed s/\ /\,/g)"
-		n_commas="$(echo ${SRK_KEYS} | grep -o "," | wc -l)"
-		if [ "${n_commas}" -eq 0 ]; then
-			gen_pki_tree
-		elif [ "${n_commas}" -ne 3 ]; then
-			bbfatal "Inconsistent PKI tree"
-		fi
-	elif [ "${DEY_SOC_VENDOR}" = "STM" ]; then
-		# The script that generates the PKI tree already checks if
-		# there isn't one, so there's nothing to do here but calling it.
-		gen_pki_tree
-	fi
-}
-
-do_install[depends] = "trustfence-sign-tools-native:do_populate_sysroot \
-			openssl-native:do_populate_sysroot"
-do_install() {
-	check_gen_pki_tree
-}
-
-FILES:${PN} = "${bindir}"

meta-digi-arm/recipes-digi/trustfence/trustfence-sign-tools.inc

@@ -18,6 +18,7 @@ SRC_URI = " \
     ${UBOOT_GIT_URI};branch=${SRCBRANCH} \
     file://trustfence-sign-artifact-nxp.sh \
     file://trustfence-sign-artifact-stm.sh \
+    file://trustfence-gen-pki-stm.sh \
     file://sign_hab;name=artifact-hab-sign \
     file://encrypt_hab;name=artifact-hab-encrypt \
     file://sign_ahab;name=artifact-ahab-sign \
@@ -46,13 +47,18 @@ do_install() {
 
 		# Select U-Boot sign script depending on U-Boot including an SPL image
 		if [ -n "${SPL_BINARY}" ]; then
-			install -m 0755 git/scripts/sign_spl_fit.sh ${D}${bindir}/trustfence-sign-uboot.sh
+			if [ "${TRUSTFENCE_SIGN_MODE}" = "AHAB" ]; then
+				install -m 0755 git/scripts/sign_spl_ahab.sh ${D}${bindir}/trustfence-sign-uboot.sh
+			else
+				install -m 0755 git/scripts/sign_spl_fit.sh ${D}${bindir}/trustfence-sign-uboot.sh
+			fi
 		else
 			install -m 0755 git/scripts/sign.sh ${D}${bindir}/trustfence-sign-uboot.sh
 		fi
 	elif [ "${DEY_SOC_VENDOR}" = "STM" ]; then
 		install -d ${D}${bindir}
 		install -m 0755 trustfence-sign-artifact-stm.sh ${D}${bindir}/trustfence-sign-artifact.sh
+		install -m 0755 trustfence-gen-pki-stm.sh ${D}${bindir}/trustfence-gen-pki.sh
 	fi
 }
 

meta-digi-arm/recipes-digi/trustfence/trustfence-sign-tools/trustfence-gen-pki-stm.sh

@@ -0,0 +1,91 @@
+#!/bin/sh
+#===============================================================================
+#
+#  trustfence-gen-pki-stm.sh
+#
+#  Copyright (C) 2023 by Digi International Inc.
+#  All rights reserved.
+#
+#  This program is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU General Public License version 2 as published by
+#  the Free Software Foundation.
+#
+#
+#  Description:
+#    Script for generating PKI tree using STM tools
+#
+#===============================================================================
+
+# Avoid parallel execution of this script
+SINGLE_PROCESS_LOCK="/tmp/gen_pki_script.lock.d"
+trap 'rm -rf "${SINGLE_PROCESS_LOCK}"' INT TERM EXIT
+while ! mkdir "${SINGLE_PROCESS_LOCK}" > /dev/null 2>&1; do
+	sleep 1
+done
+
+SCRIPT_NAME="$(basename "${0}")"
+SUPPORTED_PLATFORMS="ccmp15, ccmp13"
+
+while getopts "p:" c; do
+	case "${c}" in
+		p) PLATFORM="${OPTARG}";;
+	esac
+done
+shift "$((OPTIND - 1))"
+
+usage() {
+	cat <<EOF
+
+Usage: ${SCRIPT_NAME} <OPTIONS>
+
+ Options:
+    -p <platform>    platform
+
+Supported platforms: ${SUPPORTED_PLATFORMS}
+
+EOF
+}
+
+if [ -z "${CONFIG_SIGN_KEYS_PATH}" ]; then
+	echo "Undefined CONFIG_SIGN_KEYS_PATH";
+	exit 1
+fi
+[ -d "${CONFIG_SIGN_KEYS_PATH}" ] || mkdir "${CONFIG_SIGN_KEYS_PATH}"
+
+# Default values
+KEY_PASS_FILE="${CONFIG_SIGN_KEYS_PATH}/keys/key_pass.txt"
+
+# Generate random keys if they don't exist
+N_PUBK="$(ls -l "${CONFIG_SIGN_KEYS_PATH}"/keys/publicKey*.pem 2>/dev/null | wc -l)"
+N_PRVK="$(ls -l "${CONFIG_SIGN_KEYS_PATH}"/keys/privateKey*.pem 2>/dev/null | wc -l)"
+if [ "${PLATFORM}" = "ccmp15" ]; then
+	if [ "${N_PUBK}" != "1" ] && [ "${N_PRVK}" != 1 ] && [ ! -f "${KEY_PASS_FILE}" ]; then
+		install -d "${CONFIG_SIGN_KEYS_PATH}/keys/"
+		# Random password
+		password="$(openssl rand -base64 32)"
+		echo "Generating random key"
+		if ! STM32MP_KeyGen_CLI -abs "${CONFIG_SIGN_KEYS_PATH}/keys/" -pwd ${password}; then
+			echo "[ERROR] Could not generate PKI tree"
+			exit 1
+		fi
+		echo "${password}" > "${KEY_PASS_FILE}"
+	fi
+elif [ "${PLATFORM}" = "ccmp13" ]; then
+	if [ "${N_PUBK}" != "8" ] && [ "${N_PRVK}" != 8 ] && [ ! -f "${KEY_PASS_FILE}" ]; then
+		install -d "${CONFIG_SIGN_KEYS_PATH}/keys/"
+		# 8 random passwords (separated by whitespaces)
+		passwords="$(openssl rand -base64 32)"
+		for i in $(seq 1 7); do
+			passwords="${passwords} $(openssl rand -base64 32)"
+		done
+		echo "Generating random keys"
+		if ! STM32MP_KeyGen_CLI -abs "${CONFIG_SIGN_KEYS_PATH}/keys/" -pwd ${passwords} -n 8; then
+			echo "[ERROR] Could not generate PKI tree"
+			exit 1
+		fi
+		echo "${passwords}" > "${KEY_PASS_FILE}"
+	fi
+else
+	echo "Undefined platform"
+	exit 1
+fi

meta-digi-arm/recipes-digi/trustfence/trustfence-sign-tools/trustfence-sign-artifact-nxp.sh

@@ -58,7 +58,7 @@ Usage: ${SCRIPT_NAME} [OPTIONS] input-unsigned-image output-signed-image
     -l               sign/encrypt Linux image
     -r               sign read-only rootfs image
 
-Supported platforms: ccimx6, ccimx6ul, ccimx8x, ccimx8mn, ccimx8mm
+Supported platforms: ccimx6, ccimx6qp, ccimx6ul, ccimx8x, ccimx8mn, ccimx8mm
 
 EOF
 }
@@ -81,7 +81,7 @@ fi
 [ -d "${CONFIG_SIGN_KEYS_PATH}" ] || mkdir "${CONFIG_SIGN_KEYS_PATH}"
 
 # Get RAM_START address
-if [ "${PLATFORM}" = "ccimx6" ]; then
+if [ "${PLATFORM}" = "ccimx6" ] || [ "${PLATFORM}" = "ccimx6qp" ]; then
 	CONFIG_FDT_LOADADDR="0x18000000"
 	CONFIG_RAMDISK_LOADADDR="0x19000000"
 	CONFIG_KERNEL_LOADADDR="0x12000000"

meta-digi-arm/recipes-digi/trustfence/trustfence-sign-tools/trustfence-sign-artifact-stm.sh

@@ -47,59 +47,36 @@ Usage: ${SCRIPT_NAME} <OPTIONS> [<input-unsigned-image> <output-signed-image>]
 
 Supported platforms: ${SUPPORTED_PLATFORMS}
 
-When called without filename parameters, it generates random keys if they
-do not exist.
-
 EOF
 }
 
+if [ "${#}" != "2" ]; then
+	usage
+	exit 1
+fi
+
 if [ -z "${CONFIG_SIGN_KEYS_PATH}" ]; then
 	echo "Undefined CONFIG_SIGN_KEYS_PATH";
 	exit 1
 fi
-[ -d "${CONFIG_SIGN_KEYS_PATH}" ] || mkdir "${CONFIG_SIGN_KEYS_PATH}"
 
 # Default values
 [ -z "${CONFIG_KEY_INDEX}" ] && CONFIG_KEY_INDEX="0"
 KEY_PASS_FILE="${CONFIG_SIGN_KEYS_PATH}/keys/key_pass.txt"
 
 # Generate random keys if they don't exist
-if [ "${PLATFORM}" = "ccmp15" ]; then
+if ! trustfence-gen-pki.sh -p ${PLATFORM}; then
-	PUBLIC_KEY="${CONFIG_SIGN_KEYS_PATH}/keys/publicKey00.pem"
-	PRIVATE_KEY="${CONFIG_SIGN_KEYS_PATH}/keys/privateKey00.pem"
-	if [ ! -f "${PRIVATE_KEY}" ] && [ ! -f "${PUBLIC_KEY}" ] && [ ! -f "${KEY_PASS_FILE}" ]; then
-		install -d "${CONFIG_SIGN_KEYS_PATH}/keys/"
-		# Random password
-		password="$(openssl rand -base64 32)"
-		echo "Generating random key"
-		STM32MP_KeyGen_CLI -abs "${CONFIG_SIGN_KEYS_PATH}/keys/" -pwd ${password} -n 1
-		echo "${password}" > "${KEY_PASS_FILE}"
-	fi
-elif [ "${PLATFORM}" = "ccmp13" ]; then
-	N_PUBK="$(ls -l ${CONFIG_SIGN_KEYS_PATH}/keys/publicKey0* 2>/dev/null | wc -l)"
-	N_PRVK="$(ls -l ${CONFIG_SIGN_KEYS_PATH}/keys/privateKey0* 2>/dev/null | wc -l)"
-	PUBLIC_KEY="${CONFIG_SIGN_KEYS_PATH}/keys/publicKey0*.pem"
-	PRIVATE_KEY="${CONFIG_SIGN_KEYS_PATH}/keys/privateKey0${CONFIG_KEY_INDEX}.pem"
-	if [ "${N_PUBK}" != "8" ] && [ "${N_PRVK}" != 8 ] && [ ! -f "${KEY_PASS_FILE}" ]; then
-		install -d "${CONFIG_SIGN_KEYS_PATH}/keys/"
-		# 8 random passwords (separated by whitespaces)
-		passwords="$(openssl rand -base64 32)"
-		for i in $(seq 1 7); do
-			passwords="${passwords} $(openssl rand -base64 32)"
-		done
-		echo "Generating random keys"
-		STM32MP_KeyGen_CLI -abs "${CONFIG_SIGN_KEYS_PATH}/keys/" -pwd ${passwords} -n 8
-		echo "${passwords}" > "${KEY_PASS_FILE}"
-	fi
-else
-	echo "Undefined platform"
 	exit 1
 fi
 
-if [ "${#}" = "0" ]; then
+if [ "${PLATFORM}" = "ccmp15" ]; then
-	exit 0
+	PUBLIC_KEY="${CONFIG_SIGN_KEYS_PATH}/keys/publicKey.pem"
-elif [ "${#}" != "2" ]; then
+	PRIVATE_KEY="${CONFIG_SIGN_KEYS_PATH}/keys/privateKey.pem"
-	usage
+elif [ "${PLATFORM}" = "ccmp13" ]; then
+	PUBLIC_KEY="${CONFIG_SIGN_KEYS_PATH}/keys/publicKey0*.pem"
+	PRIVATE_KEY="${CONFIG_SIGN_KEYS_PATH}/keys/privateKey0${CONFIG_KEY_INDEX}.pem"
+else
+	echo "Undefined platform"
 	exit 1
 fi
 

meta-digi-arm/recipes-kernel/dtc/dtc/0001-fdtdump-Fix-gcc11-warning.patch

@@ -0,0 +1,53 @@
+From: David Gibson <david@gibson.dropbear.id.au>
+Date: Wed, 6 Jan 2021 14:52:26 +1100
+Subject: [PATCH] fdtdump: Fix gcc11 warning
+
+In one place, fdtdump abuses fdt_set_magic(), passing it just a small char
+array instead of the full fdt header it expects.  That's relying on the
+fact that in fact fdt_set_magic() will only actually access the first 4
+bytes of the buffer.
+
+This trips a new warning in GCC 11 - and it's entirely possible it was
+always UB.  So, don't do that.
+
+Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
+(cherry picked from commit ca16a723fa9dde9c5da80dba567f48715000e77c)
+---
+ fdtdump.c       |  2 +-
+ libfdt/libfdt.h | 10 ++++++++++
+ 2 files changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/fdtdump.c b/fdtdump.c
+index fa3b561..072c0af 100644
+--- a/fdtdump.c
++++ b/fdtdump.c
+@@ -214,7 +214,7 @@ int main(int argc, char *argv[])
+ 		char *p = buf;
+ 		char *endp = buf + len;
+ 
+-		fdt_set_magic(smagic, FDT_MAGIC);
++		fdt32_st(smagic, FDT_MAGIC);
+ 
+ 		/* poor man's memmem */
+ 		while ((endp - p) >= FDT_MAGIC_SIZE) {
+diff --git a/libfdt/libfdt.h b/libfdt/libfdt.h
+index 313c72a..8795f10 100644
+--- a/libfdt/libfdt.h
++++ b/libfdt/libfdt.h
+@@ -153,6 +153,16 @@ static inline void *fdt_offset_ptr_w(void *fdt, int offset, int checklen)
+ 
+ uint32_t fdt_next_tag(const void *fdt, int offset, int *nextoffset);
+ 
++static inline void fdt32_st(void *property, uint32_t value)
++{
++	uint8_t *bp = (uint8_t *)property;
++
++	bp[0] = value >> 24;
++	bp[1] = (value >> 16) & 0xff;
++	bp[2] = (value >> 8) & 0xff;
++	bp[3] = value & 0xff;
++}
++
+ /**********************************************************************/
+ /* Traversal functions                                                */
+ /**********************************************************************/

meta-digi-arm/recipes-kernel/dtc/dtc_1.4.5.bb

@@ -9,6 +9,7 @@ SRCREV = "22a65c5331c22979d416738eb756b9541672e00d"
 
 SRC_URI:append = " \
     file://0001-Remove-redundant-YYLOC-global-declaration.patch \
+    file://0001-fdtdump-Fix-gcc11-warning.patch \
 "
 
 S = "${WORKDIR}/git"

meta-digi-arm/recipes-kernel/kernel-modules/kernel-module-nxp-wlan.bbappend

@@ -3,6 +3,7 @@
 FILESEXTRAPATHS:prepend := "${THISDIR}/${BPN}:"
 
 SRC_URI:append = " \
+    file://0001-Fix-for-the-HE-Rate-Index.patch \
     file://81-iw612-wifi.rules \
     file://load_iw612.sh \
 "

meta-digi-arm/recipes-kernel/kernel-modules/kernel-module-nxp-wlan/0001-Fix-for-the-HE-Rate-Index.patch

@@ -0,0 +1,70 @@
+From: Achyut Hegde <achyut.hegde@nxp.com>
+Date: Thu, 28 Apr 2022 17:51:45 +0000
+Subject: [PATCH] Fix for the HE Rate Index
+
+---
+ .../mlinux/moal_sta_cfg80211.c       | 37 ++++++++++++++++++-
+ 1 file changed, 35 insertions(+), 2 deletions(-)
+
+diff --git a/mxm_wifiex/mlinux/moal_sta_cfg80211.c b/mxm_wifiex/mlinux/moal_sta_cfg80211.c
+index bf39f0e9b003..5f300288a6c8 100644
+--- a/mlinux/moal_sta_cfg80211.c
++++ b/mlinux/moal_sta_cfg80211.c
+@@ -3393,6 +3393,37 @@ done:
+ 	return ret;
+ }
+ 
++#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 1, 18)
++/**
++ * @brief This function convert he_gi to nl80211_he_gi
++ *
++ * @param he_gi  0/1/2/3
++ *
++ *
++ * @return  0: NL80211_RATE_INFO_HE_GI_0_8
++ *          1: NL80211_RATE_INFO_HE_GI_1_6
++ *          2: NL80211_RATE_INFO_HE_GI_3_2
++ */
++static t_u8 woal_he_gi_to_nl80211_he_gi(t_u8 he_gi)
++{
++	t_u8 cfg_he_gi = 0;
++	switch(he_gi){
++		case 3:
++			cfg_he_gi = NL80211_RATE_INFO_HE_GI_3_2;
++			break;
++		case 2:
++			cfg_he_gi = NL80211_RATE_INFO_HE_GI_1_6;
++			break;
++		case 0:
++		case 1:
++		default:
++			cfg_he_gi = NL80211_RATE_INFO_HE_GI_0_8;
++			break;
++	}
++	return cfg_he_gi;
++}
++#endif
++
+ /**
+  * @brief Request the driver to fill the tx/rx rate info
+  *
+@@ -3469,7 +3500,8 @@ static void woal_cfg80211_fill_rate_info(moal_private *priv,
+ 			sinfo->txrate.flags = RATE_INFO_FLAGS_HE_MCS;
+ 			sinfo->txrate.nss = rate->param.data_rate.tx_nss + 1;
+ 			sinfo->txrate.mcs = rate->param.data_rate.tx_mcs_index;
+-			sinfo->txrate.he_gi = rate->param.data_rate.tx_ht_gi;
++			sinfo->txrate.he_gi = woal_he_gi_to_nl80211_he_gi(
++							rate->param.data_rate.tx_ht_gi);
+ 			if (rate->param.data_rate.tx_ht_bw == MLAN_VHT_BW80)
+ 				sinfo->txrate.bw = RATE_INFO_BW_80;
+ 			else if (rate->param.data_rate.tx_ht_bw == MLAN_HT_BW40)
+@@ -3516,7 +3548,8 @@ static void woal_cfg80211_fill_rate_info(moal_private *priv,
+ 			sinfo->rxrate.flags = RATE_INFO_FLAGS_HE_MCS;
+ 			sinfo->rxrate.nss = rate->param.data_rate.rx_nss + 1;
+ 			sinfo->rxrate.mcs = rate->param.data_rate.rx_mcs_index;
+-			sinfo->rxrate.he_gi = rate->param.data_rate.rx_ht_gi;
++			sinfo->rxrate.he_gi = woal_he_gi_to_nl80211_he_gi(
++						rate->param.data_rate.rx_ht_gi);
+ 			if (rate->param.data_rate.rx_ht_bw == MLAN_VHT_BW80)
+ 				sinfo->rxrate.bw = RATE_INFO_BW_80;
+ 			else if (rate->param.data_rate.rx_ht_bw == MLAN_HT_BW40)

meta-digi-arm/recipes-kernel/kernel-modules/kernel-module-nxp-wlan/load_iw612.sh

@@ -20,7 +20,7 @@ host_mlme=1 \
 drv_mode=${DRIVER_MODE} \
 drvdbg=${DRIVER_DEBUG} \
 sta_name=wlan \
-fw_name=nxp/sduart_nw61x_v1.bin.se\
+fw_name=nxp/sd_w61x_v1.bin.se\
 "
 
 log() {

meta-digi-arm/recipes-kernel/linux/linux-dey-src.inc

@@ -1,30 +0,0 @@
-# Copyright (C) 2018-2022 Digi International
-
-LOCALVERSION = "-dey"
-
-# Select internal or Github Linux repo
-LINUX_URI_STASH = "${DIGI_MTK_GIT}/linux/linux.git;protocol=ssh"
-LINUX_URI_GITHUB = "${DIGI_GITHUB_GIT}/linux.git;protocol=https"
-LINUX_GIT_URI ?= "${@oe.utils.conditional('DIGI_INTERNAL_GIT', '1' , '${LINUX_URI_STASH}', '${LINUX_URI_GITHUB}', d)}"
-
-SRC_URI = "${LINUX_GIT_URI};branch=${SRCBRANCH}"
-
-# A user can provide his own kernel 'defconfig' file by:
-# - setting the variable KERNEL_DEFCONFIG to a custom kernel configuration file
-#   inside the kernel repository.
-# - setting the variable KERNEL_DEFCONFIG to a kernel configuration file using
-#   the full path to the file.
-# - clearing the variable KERNEL_DEFCONFIG and providing a kernel configuration
-#   file in the layer (in this case the file must be named 'defconfig').
-# Otherwise the default platform's kernel configuration file will be taken from
-# the Linux source code tree.
-do_copy_defconfig[vardeps] += "KERNEL_DEFCONFIG"
-do_copy_defconfig[dirs] = "${S}"
-do_copy_defconfig () {
-        if [ -n "${KERNEL_DEFCONFIG}" ]; then
-                cp -f ${KERNEL_DEFCONFIG} ${WORKDIR}/defconfig
-        fi
-}
-addtask copy_defconfig after do_patch before do_kernel_localversion
-
-S = "${WORKDIR}/git"

meta-digi-arm/recipes-kernel/linux/linux-dey.inc

@@ -0,0 +1,74 @@
+# Copyright (C) 2018-2023 Digi International
+SUMMARY = "Linux kernel for Digi boards"
+LICENSE = "GPL-2.0-only"
+LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
+
+inherit kernel
+inherit ${@oe.utils.conditional('DEY_SOC_VENDOR', 'NXP', 'fsl-kernel-localversion', '', d)}
+require ${@oe.utils.conditional('DEY_SOC_VENDOR', 'STM', 'recipes-kernel/linux/linux-stm32mp.inc', '', d)}
+require ${@bb.utils.contains('DISTRO_FEATURES', 'virtualization', 'linux-virtualization.inc', '', d)}
+require ${@oe.utils.conditional('TRUSTFENCE_SIGN', '1', 'recipes-kernel/linux/linux-trustfence.inc', '', d)}
+
+# CONFIG_KERNEL_LZO in defconfig
+DEPENDS += "${@oe.utils.conditional('DEY_SOC_VENDOR', 'NXP', 'lzop-native', '', d)}"
+
+# Select internal or Github Linux repo
+LINUX_URI_STASH = "${DIGI_MTK_GIT}/linux/linux.git;protocol=ssh"
+LINUX_URI_GITHUB = "${DIGI_GITHUB_GIT}/linux.git;protocol=https"
+LINUX_GIT_URI ?= "${@oe.utils.conditional('DIGI_INTERNAL_GIT', '1', '${LINUX_URI_STASH}', '${LINUX_URI_GITHUB}', d)}"
+SRC_URI = " \
+    ${LINUX_GIT_URI};branch=${SRCBRANCH} \
+    ${@oe.utils.conditional('KERNEL_DEFCONFIG', '', 'file://defconfig', '', d)} \
+"
+S = "${WORKDIR}/git"
+
+LOCALVERSION = "-dey"
+
+# Create base DTB suitable for overlays
+OVERLAYS_DTC_FLAGS = "-@"
+OVERLAYS_DTC_FLAGS:ccimx6ul = ""
+OVERLAYS_DTC_FLAGS:ccimx6 = ""
+KERNEL_DTC_FLAGS = "${OVERLAYS_DTC_FLAGS}"
+
+KERNEL_EXTRA_ARGS:stm32mpcommon += "LOADADDR=${ST_KERNEL_LOADADDR}"
+
+# A user can provide his own kernel 'defconfig' file by:
+# - setting the variable KERNEL_DEFCONFIG to a custom kernel configuration file
+#   inside the kernel repository.
+# - setting the variable KERNEL_DEFCONFIG to a kernel configuration file using
+#   the full path to the file.
+# - clearing the variable KERNEL_DEFCONFIG and providing a kernel configuration
+#   file in the layer (in this case the file must be named 'defconfig').
+#
+# Otherwise the default platform's kernel configuration file will be taken from
+# the Linux source code tree.
+do_copy_defconfig[vardeps] += "KERNEL_DEFCONFIG"
+do_copy_defconfig[dirs] = "${S}"
+do_copy_defconfig () {
+	if [ -n "${KERNEL_DEFCONFIG}" ]; then
+		cp -f ${KERNEL_DEFCONFIG} ${WORKDIR}/defconfig
+	fi
+}
+addtask copy_defconfig after do_patch before do_kernel_localversion
+
+# This is needed because kernel_localversion (in fsl-kernel-localversion.bbclass)
+# creates a basic ${B}/.config file and because that file exists, kernel_do_configure
+# (in kernel.bbclass) does not apply our defconfig.
+do_configure:prepend:imx-nxp-bsp() {
+	if [ -f "${WORKDIR}/defconfig" ] && [ -f "${B}/.config" ]; then
+		cat "${WORKDIR}/defconfig" >> "${B}/.config"
+	fi
+}
+
+# Apply configuration fragments
+do_configure:append() {
+	# Only accept fragments ending in .cfg. If the fragments contain
+	# something other than kernel configs, it will be filtered out
+	# automatically.
+	if [ -n "${@' '.join(find_cfgs(d))}" ]; then
+		${S}/scripts/kconfig/merge_config.sh -m -O ${B} ${B}/.config ${@" ".join(find_cfgs(d))}
+	fi
+}
+
+# Don't create custom folder for kernel artifacts
+do_deploy[sstate-outputdirs] = "${DEPLOY_DIR_IMAGE}"

meta-digi-arm/recipes-kernel/linux/linux-dey_5.15.bb

@@ -1,55 +1,10 @@
 # Copyright (C) 2022,2023 Digi International
 
-SUMMARY = "Linux kernel for Digi boards"
+require recipes-kernel/linux/linux-dey.inc
-LICENSE = "GPL-2.0-only"
-LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
-
-# CONFIG_KERNEL_LZO in defconfig
-DEPENDS += "${@oe.utils.conditional('DEY_SOC_VENDOR', 'NXP', 'lzop-native', '', d)}"
-
-inherit kernel
-inherit ${@oe.utils.conditional('DEY_SOC_VENDOR', 'NXP', 'fsl-kernel-localversion', '', d)}
 
 SRCBRANCH = "v5.15/nxp/dey-4.0/maint"
 SRCBRANCH:stm32mpcommon = "v5.15/stm/dey-4.0/maint"
 SRCREV = "${AUTOREV}"
 SRCREV:stm32mpcommon = "${AUTOREV}"
 
-require ${@oe.utils.conditional('DEY_SOC_VENDOR', 'STM', 'recipes-kernel/linux/linux-stm32mp.inc', '', d)}
+COMPATIBLE_MACHINE = "(ccimx6ul|ccimx8m|ccimx6|ccmp1|ccimx8x)"
-# Don't create custom folder for kernel artifacts
-do_deploy[sstate-outputdirs] = "${DEPLOY_DIR_IMAGE}"
-
-require recipes-kernel/linux/linux-dey-src.inc
-require ${@bb.utils.contains('DISTRO_FEATURES', 'virtualization', 'linux-virtualization.inc', '', d)}
-require ${@oe.utils.conditional('TRUSTFENCE_SIGN', '1', 'recipes-kernel/linux/linux-trustfence.inc', '', d)}
-
-# Use custom provided 'defconfig' if variable KERNEL_DEFCONFIG is cleared
-SRC_URI +="${@oe.utils.conditional('KERNEL_DEFCONFIG', '', 'file://defconfig', '', d)}"
-
-# This is needed because kernel_localversion (in fsl-kernel-localversion.bbclass)
-# creates a basic ${B}/.config file and because that file exists, kernel_do_configure
-# (in kernel.bbclass) does not apply our defconfig.
-do_configure:prepend:imx-nxp-bsp() {
-	if [ -f "${WORKDIR}/defconfig" ] && [ -f "${B}/.config" ]; then
-		cat "${WORKDIR}/defconfig" >> "${B}/.config"
-	fi
-}
-
-# Apply configuration fragments
-do_configure:append() {
-	# Only accept fragments ending in .cfg. If the fragments contain
-	# something other than kernel configs, it will be filtered out
-	# automatically.
-	if [ -n "${@' '.join(find_cfgs(d))}" ]; then
-		${S}/scripts/kconfig/merge_config.sh -m -O ${B} ${B}/.config ${@" ".join(find_cfgs(d))}
-	fi
-}
-
-# Create base DTB suitable for overlays
-OVERLAYS_DTC_FLAGS = "-@"
-OVERLAYS_DTC_FLAGS:ccimx6ul = ""
-KERNEL_DTC_FLAGS = "${OVERLAYS_DTC_FLAGS}"
-
-KERNEL_EXTRA_ARGS:stm32mpcommon += "LOADADDR=${ST_KERNEL_LOADADDR}"
-
-COMPATIBLE_MACHINE = "(ccimx6ul|ccimx8m|ccimx93|ccmp1)"

meta-digi-arm/recipes-kernel/linux/linux-dey_6.1.bb

@@ -0,0 +1,12 @@
+# Copyright (C) 2023 Digi International
+
+require recipes-kernel/linux/linux-dey.inc
+
+SRCBRANCH = "v6.1.22/nxp/master"
+SRCREV = "${AUTOREV}"
+
+# Blacklist btnxpuart module. It will be managed by the bluetooth-init script
+KERNEL_MODULE_PROBECONF += "btnxpuart"
+module_conf_btnxpuart = "blacklist btnxpuart"
+
+COMPATIBLE_MACHINE = "(ccimx93)"

meta-digi-arm/wic/ccmp1.wks.in

@@ -0,0 +1,37 @@
+# short-description: Create SD card image with a boot partition (1GB)
+# long-description: Creates a partitioned SD card image (1GB)
+#
+#  - -------- ------------- ------ ------ ------------ -------- --------- --------
+# | | TFA(2) | Metadata(2) | FIPA | FIPB | U-BOOT ENV | linux  | rootfs  | data   |
+#  - -------- ------------- ------ ------ ------------ -------- --------- --------
+# ^ ^        ^             ^      ^      ^            ^        ^         ^        ^
+# | |        |             |      |      |            |        |         |        |
+# 0 17kB   542kB        1.06MB  5.26MB 9.45MB      9.97MB    77.1MB   898MB     1032MB
+#
+# Warning: the first stage of boot (here fsbl1, fsbl2, metadata1, metadata2, fipa, fipb) MUST be on GPT partition to be detected.
+#
+
+# FSBL partitions aka TF-A BL2
+part fsbl1 --source rawcopy --fstype=ext4 --fsoptions "noauto" --part-name=fsbl1 --sourceparams="file=${DEPLOY_DIR_IMAGE}/arm-trusted-firmware/tf-a-${MACHINE}-sdcard.stm32" --ondisk mmcblk --part-type 0x8301 --fixed-size 256K --align 17
+part fsbl2 --source rawcopy --fstype=ext4 --fsoptions "noauto" --part-name=fsbl2 --sourceparams="file=${DEPLOY_DIR_IMAGE}/arm-trusted-firmware/tf-a-${MACHINE}-sdcard.stm32" --ondisk mmcblk --part-type 0x8301 --fixed-size 256K
+
+# Metadata partitions
+part metadata1 --source rawcopy --fstype=ext4 --fsoptions "noauto" --part-name=metadata1 --sourceparams="file=${DEPLOY_DIR_IMAGE}/arm-trusted-firmware/metadata.bin" --ondisk mmcblk --part-type 0x8301 --fixed-size 256K
+part metadata2 --source rawcopy --fstype=ext4 --fsoptions "noauto" --part-name=metadata2 --sourceparams="file=${DEPLOY_DIR_IMAGE}/arm-trusted-firmware/metadata.bin" --ondisk mmcblk --part-type 0x8301 --fixed-size 256K
+
+# Fip partitions
+part fip-a   --source rawcopy --fstype=ext4 --fsoptions "noauto" --part-name=fip-a --sourceparams="file=${DEPLOY_DIR_IMAGE}/fip/fip-${MACHINE}-optee.bin" --ondisk mmcblk --part-type 19d5df83-11b0-457b-be2c-7559c13142a5 --fixed-size 4096K --uuid 4fd84c93-54ef-463f-a7ef-ae25ff887087
+part fip-b   --source rawcopy --fstype=ext4 --fsoptions "noauto" --part-name=fip-b --sourceparams="file=${DEPLOY_DIR_IMAGE}/fip/fip-${MACHINE}-optee.bin" --ondisk mmcblk --part-type 19d5df83-11b0-457b-be2c-7559c13142a5 --fixed-size 4096K --uuid 09c54952-d5bf-45af-acee-335303766fb3
+
+# U-BOOT env
+part u-boot-env --source empty --part-name=uboot-env --ondisk mmcblk --part-type 0x8301 --fixed-size 512K
+
+# linux
+part --source rawcopy --sourceparams="file=${DEPLOY_DIR_IMAGE}/${IMAGE_LINK_NAME}.boot.vfat" --ondisk mmcblk --fstype=vfat --part-name=linux --active --fixed-size 64M
+
+# Rootfs
+part / --source rootfs --ondisk mmcblk --fstype=ext4 --label rootfs --fixed-size 783M --uuid e91c4e10-16e6-4c0e-bd0e-77becf4a3582 --part-name=rootfs
+# data
+part data --ondisk mmcblk --fstype=ext4 --label data --fixed-size 128M --part-name=data
+
+bootloader --ptable gpt

meta-digi-dey/classes/dey-image.bbclass

@@ -57,13 +57,22 @@ fakeroot toolchain_create_sdk_dey_version() {
 }
 toolchain_create_sdk_dey_version[vardepsexclude] = "DATETIME"
 
+create_sw_versions_file() {
+	local swversionsfile="${IMAGE_ROOTFS}${sysconfdir}/sw-versions"
+
+	rm -f $swversionsfile
+	touch $swversionsfile
+	echo 'firmware ${DEY_FIRMWARE_VERSION}' >> $swversionsfile
+}
+ROOTFS_POSTPROCESS_COMMAND:append = " create_sw_versions_file;"
+
 #
 # Add dependency for read-only signed rootfs
 #
 DEPENDS += "${@oe.utils.conditional('TRUSTFENCE_SIGN', '1', 'trustfence-sign-tools-native', '', d)}"
 
-# Remove kernel-module-imx-gpu-viv from all images
-BAD_RECOMMENDATIONS += "kernel-module-imx-gpu-viv"
-
 # Do not include kernel in rootfs images
 PACKAGE_EXCLUDE = "kernel-image-*"
+
+# Add required methods to generate the correct SWU update package.
+inherit dey-swupdate

meta-digi-dey/classes/dey-swupdate-common.bbclass

@@ -0,0 +1,112 @@
+# Copyright (C) 2023 Digi International.
+#
+
+#######################################
+########## General variables ##########
+#######################################
+
+def get_baseimg_pn(d):
+    file_name = d.getVar('PN')
+    return file_name[:file_name.find("-swu")] if "-swu" in file_name else file_name
+
+IMAGE_DEPENDS = "${@get_baseimg_pn(d)}"
+
+IMG_NAME = "${IMAGE_DEPENDS}"
+
+# Update description.
+SWUPDATE_DESCRIPTION = "${@oe.utils.ifelse(d.getVar('TRUSTFENCE_ENCRYPT_ROOTFS') == '1', 'Encrypted rootfs ${IMG_NAME} update', '${IMG_NAME} update')}"
+
+# Storage type.
+SWUPDATE_STORAGE_TYPE = "${@oe.utils.conditional('STORAGE_MEDIA', 'mmc', 'mmc', 'mtd', d)}"
+
+# Root file system type.
+SWUPDATE_ROOTFS_TYPE = "${@bb.utils.contains('IMAGE_FEATURES', 'read-only-rootfs', 'squashfs', '', d)}"
+
+# Dual boot partition names for eMMC or MTD
+BOOT_DEV_NAME_A ?= "${@bb.utils.contains('STORAGE_MEDIA', 'mmc', '/dev/mmcblk0p1', 'linux_a', d)}"
+BOOT_DEV_NAME_B ?= "${@bb.utils.contains('STORAGE_MEDIA', 'mmc', '/dev/mmcblk0p2', 'linux_b', d)}"
+ROOTFS_DEV_NAME_A ?= "${@bb.utils.contains('STORAGE_MEDIA', 'mmc', '/dev/mmcblk0p3', 'rootfs_a', d)}"
+ROOTFS_DEV_NAME_B ?= "${@bb.utils.contains('STORAGE_MEDIA', 'mmc', '/dev/mmcblk0p4', 'rootfs_b', d)}"
+
+#######################################
+###### SWU Update based on files ######
+#######################################
+
+# Variable used to generate the tar.gz file. Do not modify.
+SWUPDATE_FILES_TARGZ_FILE_NAME = "swupdate-files.tar.gz"
+
+# Initialize variable to provide a custom tar.gz file containing files/dirs to install.
+SWUPDATE_FILES_TARGZ_FILE ?= ""
+
+# Initialize variable to store the files/folders that will be part of the SWUpdate package.
+SWUPDATE_FILES_LIST ?= ""
+
+# Checks whether SWU update is based on files or not.
+def update_based_on_files(d):
+    return str(d.getVar('SWUPDATE_FILES_TARGZ_FILE') != "" or d.getVar('SWUPDATE_FILES_LIST') != "").lower()
+
+# Variable that determines if SWU update is based on files or not.
+SWUPDATE_IS_FILES_UPDATE = "${@update_based_on_files(d)}"
+
+#######################################
+###### SWU Update based on RDIFF ######
+#######################################
+
+# Variable used to generate the 'rootfs' RDIFF file. Do not modify.
+SWUPDATE_RDIFF_ROOTFS_DELTA_FILE_NAME = "swupdate-rootfs.rdiff"
+
+# Initialize variable to provide the base file from which to generate the 'rootfs' RDIFF file.
+SWUPDATE_RDIFF_ROOTFS_SOURCE_FILE ?= ""
+
+# Rdiff image template based on storage type.
+SWUPDATE_RDIFF_IMAGE_TEMPLATE_FILE = "${@bb.utils.contains('STORAGE_MEDIA', 'mmc', 'image_template_rdiff_mmc', 'image_template_rdiff_nand', d)}"
+
+# Checks whether SWU update is based on RDIFF or not.
+def update_based_on_rdiff(d):
+    return str("read-only-rootfs" in d.getVar('IMAGE_FEATURES') and d.getVar('SWUPDATE_IS_FILES_UPDATE') != "true" and d.getVar('SWUPDATE_RDIFF_ROOTFS_SOURCE_FILE') != "").lower()
+
+# Variable that determines if SWU update is based on RDIFF or not.
+SWUPDATE_IS_RDIFF_UPDATE = "${@update_based_on_rdiff(d)}"
+
+#######################################
+##### SWU Update based on images ######
+#######################################
+
+# Image template based on storage type.
+SWUPDATE_IMAGES_IMAGE_TEMPLATE_FILE = "${@bb.utils.contains('STORAGE_MEDIA', 'mmc', 'image_template_mmc', 'image_template_nand', d)}"
+
+# Checks whether SWU update is based on images or not.
+def update_based_on_images(d):
+    return str(d.getVar('SWUPDATE_IS_FILES_UPDATE') != "true" and d.getVar('SWUPDATE_IS_RDIFF_UPDATE') != "true").lower()
+
+# Variable that determines if SWU update is based on images or not.
+SWUPDATE_IS_IMAGES_UPDATE = "${@update_based_on_images(d)}"
+
+#######################################
+########## SWU Update U-Boot ##########
+#######################################
+
+# Determine the correct UBoot update script file to use depending on storage type.
+SWUPDATE_UBOOT_SCRIPT = "${@oe.utils.conditional('STORAGE_MEDIA', 'mmc', 'swupdate_uboot_mmc.sh', 'swupdate_uboot_nand.sh', d)}"
+
+UBOOT_EXT ?= ".${UBOOT_SUFFIX}"
+
+UBOOTIMG_OFFSET ?= "${BOOTLOADER_SEEK_BOOT}"
+
+#######################################
+########## SWU Update Script ##########
+#######################################
+
+# Retrieve the correct update script name based on the SWU update type.
+def get_update_script_name(d):
+    if d.getVar('SWUPDATE_IS_FILES_UPDATE') == "true":
+        return "update_files.sh"
+    if d.getVar('SWUPDATE_IS_RDIFF_UPDATE') == "true":
+        return "update_rdiff.sh"
+    return "update_images.sh"
+
+# Initialize variable that configures the update script to use.
+SWUPDATE_SCRIPT ?= "${@get_update_script_name(d)}"
+
+# Name of the update script to include in the SWU package.
+SWUPDATE_SCRIPT_NAME = "${@os.path.basename(d.getVar('SWUPDATE_SCRIPT'))}"

meta-digi-dey/classes/dey-swupdate.bbclass

@@ -0,0 +1,87 @@
+# Copyright (C) 2023 Digi International.
+#
+# Generates a 'tar.gz' file with the files and folders to be included in the update package
+# as part of discrete files SWUpdate installation process.
+# 
+# Usage:
+#
+#      In your "local.conf" file, fill the "SWUPDATE_FILES_LIST" variable with the list of
+#      files/folders to include in the SWUpdate package. Paths must be relative to "/":
+#
+#      SWUPDATE_FILES_LIST = "<folder_path> <file_path> ..."
+#
+
+# Load commmon variables.
+inherit dey-swupdate-common
+
+DEPENDS += "${@oe.utils.ifelse(d.getVar('SWUPDATE_IS_RDIFF_UPDATE') == 'true', 'librsync-native', '')}"
+
+#######################################
+###### SWU Update based on files ######
+#######################################
+
+create_swupdate_targz_file() {
+	local targzfile="${DEPLOY_DIR_IMAGE}/${SWUPDATE_FILES_TARGZ_FILE_NAME}"
+	# Clean previous versions of the file.
+	rm -f "${targzfile}"
+
+	# Create the tar file including the 'sw-versions' file, as it is mandatory.
+	if [ "${SWUPDATE_FILES_TARGZ_FILE}" != "" ]; then
+		# User provides a custom tar.gz file. Copy it to distribution dir.
+		cp "${SWUPDATE_FILES_TARGZ_FILE}" "${targzfile}"
+		# Uncompress the tar file.
+		if ! gzip -t "${targzfile}"; then
+			# File is not correctly compressed, exit with error.
+			echo "[ERROR] File ${SWUPDATE_FILES_TARGZ_FILE} is not a valid 'tar.gz' file. Aborting..."
+			exit 1
+		fi
+		gunzip "${targzfile}"
+		# Add the 'sw-versions' file.
+		tar -C "${IMAGE_ROOTFS}" -uf "${targzfile%.*}" etc/sw-versions
+	else
+		# The tar.gz file is not provided by user. Create it including the 'sw-versions' file
+		tar -C "${IMAGE_ROOTFS}" -cf "${targzfile%.*}" etc/sw-versions
+	fi
+
+	# Iterate the list of files and folders. Add all entries directly except paths starting
+	# with 'mnt/linux'. Those files must be added from the 'DEPLOY_DIR_IMAGE' instead of
+	# 'IMAGE_ROOTFS', as they are part of the 'boot' image.
+	for file in ${SWUPDATE_FILES_LIST}; do
+		case "${file}" in
+			mnt/linux/*)
+				FILE_NAME="$(basename "${file}")"
+				tar -C "${DEPLOY_DIR_IMAGE}" --transform 's,^,mnt/linux/,' -uhf "${targzfile%.*}" "${FILE_NAME}"
+				;;
+			*)
+				tar -C "${IMAGE_ROOTFS}" -uf "${targzfile%.*}" "${file}"
+				;;
+		esac
+	done
+
+	# Compress the tar file.
+	gzip "${targzfile%.*}"
+}
+ROOTFS_POSTPROCESS_COMMAND:append = "${@oe.utils.conditional('SWUPDATE_IS_FILES_UPDATE', 'true', ' create_swupdate_targz_file;', '', d)}"
+
+#######################################
+###### SWU Update based on RDIFF ######
+#######################################
+
+create_swupdate_rdiff_file() {
+	local signature_file="${DEPLOY_DIR_IMAGE}/swupdate_rootfs_rdiff.sig"
+	local rootfs_rdiff_file="${DEPLOY_DIR_IMAGE}/${SWUPDATE_RDIFF_ROOTFS_DELTA_FILE_NAME}"
+	local rootfs_file="${IMGDEPLOYDIR}/${IMAGE_LINK_NAME}.squashfs"
+
+	# Clean previous versions of the files.
+	rm -f "${signature_file}" "${rootfs_rdiff_file}"
+
+	# Create signature file.
+	rdiff signature "${SWUPDATE_RDIFF_ROOTFS_SOURCE_FILE}" "${signature_file}"
+
+	# Create the delta file.
+	rdiff delta "${signature_file}" "${rootfs_file}" "${rootfs_rdiff_file}"
+
+	# Clean intermediates.
+	rm -f "${signature_file}"
+}
+IMAGE_POSTPROCESS_COMMAND:append = "${@oe.utils.conditional('SWUPDATE_IS_RDIFF_UPDATE', 'true', ' create_swupdate_rdiff_file;', '', d)}"

meta-digi-dey/classes/trustfence.bbclass

@@ -24,7 +24,6 @@ TRUSTFENCE_SIGN_KEYS_PATH ?= "default"
 TRUSTFENCE_DEK_PATH ?= "default"
 TRUSTFENCE_DEK_PATH:ccmp1 ?= "0"
 TRUSTFENCE_ENCRYPT_ENVIRONMENT ?= "1"
-TRUSTFENCE_ENCRYPT_ENVIRONMENT:ccmp1 ?= "0"
 TRUSTFENCE_SRK_REVOKE_MASK ?= "0x0"
 TRUSTFENCE_KEY_INDEX ?= "0"
 
@@ -37,6 +36,79 @@ TRUSTFENCE_READ_ONLY_ROOTFS ?= "${@bb.utils.contains("IMAGE_FEATURES", "read-onl
 
 IMAGE_FEATURES += "dey-trustfence"
 
+# Function to generate a PKI tree (with lock dir protection)
+GENPKI_LOCK_DIR = "${TRUSTFENCE_SIGN_KEYS_PATH}/.genpki.lock"
+gen_pki_tree() {
+	if mkdir -p ${GENPKI_LOCK_DIR}; then
+		if [ "${DEY_SOC_VENDOR}" = "NXP" ]; then
+			trustfence-gen-pki.sh ${TRUSTFENCE_SIGN_KEYS_PATH}
+		elif [ "${DEY_SOC_VENDOR}" = "STM" ]; then
+			export CONFIG_SIGN_KEYS_PATH="${TRUSTFENCE_SIGN_KEYS_PATH}"
+			trustfence-gen-pki.sh -p ${DIGI_SOM}
+		fi
+		rm -rf ${GENPKI_LOCK_DIR}
+	else
+		bbfatal "Could not get lock to generate PKI tree"
+	fi
+}
+
+# Function that generates a PKI tree if there isn't one
+check_gen_pki_tree() {
+	if [ "${DEY_SOC_VENDOR}" = "NXP" ]; then
+		SRK_KEYS="$(echo ${TRUSTFENCE_SIGN_KEYS_PATH}/crts/SRK*crt.pem | sed s/\ /\,/g)"
+		n_commas="$(echo ${SRK_KEYS} | grep -o "," | wc -l)"
+		if [ "${n_commas}" -eq 0 ]; then
+			gen_pki_tree
+		elif [ "${n_commas}" -ne 3 ]; then
+			bbfatal "Inconsistent PKI tree"
+		fi
+	elif [ "${DEY_SOC_VENDOR}" = "STM" ]; then
+		# The script that generates the PKI tree already checks if
+		# there isn't one, so there's nothing to do here but calling it.
+		gen_pki_tree
+	fi
+}
+
+copy_public_key() {
+	if [ "${DEY_SOC_VENDOR}" = "NXP" ]; then
+		KEY_INDEX="$(expr $TRUSTFENCE_KEY_INDEX + 1)"
+		PUBLIC_KEY="${TRUSTFENCE_SIGN_KEYS_PATH}/crts/key${KEY_INDEX}.pub"
+		# The new hab/ahab_pki_tree.sh script extracts the public keys after the PKI
+		# generation and leaves them in the crts/ folder. However, the PKI tree may
+		# already exist, the PKI generation script not called, and then the public
+		# keys may not be available. This is a fall-back to generate at least the
+		# selected public key.
+		if [ ! -f "${PUBLIC_KEY}" ]; then
+			if [ "${TRUSTFENCE_SIGN_MODE}" = "HAB" ]; then
+				CERT_IMG="$(echo ${TRUSTFENCE_SIGN_KEYS_PATH}/crts/IMG${KEY_INDEX}*crt.pem)"
+			elif [ "${TRUSTFENCE_SIGN_MODE}" = "AHAB" ]; then
+				CERT_IMG="$(echo ${TRUSTFENCE_SIGN_KEYS_PATH}/crts/SRK${KEY_INDEX}*_ca_crt.pem)"
+			else
+				bberror "Unknown TRUSTFENCE_SIGN_MODE value"
+				exit 1
+			fi
+			# Extract the public key from the certificate.
+			openssl x509 -pubkey -noout -in "${CERT_IMG}" > "${PUBLIC_KEY}"
+		fi
+	elif [ "${DEY_SOC_VENDOR}" = "STM" ]; then
+		if [ "${DIGI_SOM}" = "ccmp15" ]; then
+			PUBLIC_KEY="${TRUSTFENCE_SIGN_KEYS_PATH}/keys/publicKey.pem"
+		elif [ "${DIGI_SOM}" = "ccmp13" ]; then
+			PUBLIC_KEY="${TRUSTFENCE_SIGN_KEYS_PATH}/keys/publicKey0${TRUSTFENCE_KEY_INDEX}.pem"
+		else
+			bberror "Unknown DIGI_SOM"
+			exit 1
+		fi
+	else
+		echo "ERROR: Cannot determine the public key"
+		exit 1
+	fi
+	# Copy the public key to the rootfs
+	install -d ${IMAGE_ROOTFS}${sysconfdir}/ssl/certs
+	cp -f "${PUBLIC_KEY}" "${IMAGE_ROOTFS}${sysconfdir}/ssl/certs/key.pub"
+}
+ROOTFS_POSTPROCESS_COMMAND:append = " copy_public_key;"
+
 python () {
     import binascii
     import hashlib
@@ -77,7 +149,7 @@ python () {
             d.setVar("FIP_SIGN_ENABLE", "1")
             d.setVar("FIP_SIGN_KEY_EXTERNAL", "1")
             if (d.getVar("DIGI_SOM") == "ccmp15" ):
-                d.setVar("FIP_SIGN_KEY", d.getVar("TRUSTFENCE_SIGN_KEYS_PATH") + "/keys/privateKey00.pem");
+                d.setVar("FIP_SIGN_KEY", d.getVar("TRUSTFENCE_SIGN_KEYS_PATH") + "/keys/privateKey.pem");
             elif (d.getVar("DIGI_SOM") == "ccmp13" ):
                 d.setVar("FIP_SIGN_KEY", d.getVar("TRUSTFENCE_SIGN_KEYS_PATH") + "/keys/privateKey0%s.pem" % d.getVar("TRUSTFENCE_KEY_INDEX"));
             d.setVar("TRUSTFENCE_PASSWORD_FILE", d.getVar("TRUSTFENCE_SIGN_KEYS_PATH") + "/keys/key_pass.txt")
@@ -100,6 +172,8 @@ python () {
     if (d.getVar("TRUSTFENCE_ENCRYPT_ENVIRONMENT") == "1"):
         if (d.getVar("DEY_SOC_VENDOR") == "NXP"):
             d.appendVar("UBOOT_TF_CONF", "CONFIG_ENV_AES=y CONFIG_ENV_AES_CAAM_KEY=y ")
+        elif (d.getVar("DEY_SOC_VENDOR") == "STM"):
+            d.appendVar("UBOOT_TF_CONF", "CONFIG_ENV_AES_CCMP1=y ")
 
     # Provide sane default values for SWUPDATE class in case Trustfence is enabled
     if (d.getVar("TRUSTFENCE_SIGN") == "1"):
@@ -140,25 +214,3 @@ python () {
     else:
         d.setVar("TRUSTFENCE_INITRAMFS_IMAGE", "");
 }
-
-# Function to generate a PKI tree (with lock dir protection)
-GENPKI_LOCK_DIR = "${TRUSTFENCE_SIGN_KEYS_PATH}/.genpki.lock"
-gen_pki_tree() {
-	if mkdir -p ${GENPKI_LOCK_DIR}; then
-		trustfence-gen-pki.sh ${TRUSTFENCE_SIGN_KEYS_PATH}
-		rm -rf ${GENPKI_LOCK_DIR}
-	else
-		bbfatal "Could not get lock to generate PKI tree"
-	fi
-}
-
-# Function that generates a PKI tree if there isn't one
-check_gen_pki_tree() {
-	SRK_KEYS="$(echo ${TRUSTFENCE_SIGN_KEYS_PATH}/crts/SRK*crt.pem | sed s/\ /\,/g)"
-	n_commas="$(echo ${SRK_KEYS} | grep -o "," | wc -l)"
-	if [ "${n_commas}" -eq 0 ]; then
-		gen_pki_tree
-	elif [ "${n_commas}" -ne 3 ]; then
-		bbfatal "Inconsistent PKI tree"
-	fi
-}

meta-digi-dey/conf/distro/dey.conf

@@ -1,8 +1,18 @@
 require conf/distro/poky.conf
 
+# Discrete version values.
+YOCTO_MAJOR = "4"
+YOCTO_MINOR = "0"
+DEY_RELEASE = "4"
+DEY_BUILD = "1"
+
+# Firmware version of the system.
+DEY_FIRMWARE_VERSION ?= "${YOCTO_MAJOR}.${YOCTO_MINOR}.${DEY_RELEASE}.${DEY_BUILD}"
+
+# Distribution info.
 DISTRO = "dey"
 DISTRO_NAME = "Digi Embedded Yocto"
-DISTRO_VERSION = "4.0-r3"
+DISTRO_VERSION = "${YOCTO_MAJOR}.${YOCTO_MINOR}-r${DEY_RELEASE}"
 
 SDK_VENDOR = "-deysdk"
 
@@ -61,3 +71,9 @@ LICENSE_FLAGS_ACCEPTED += "commercial"
 
 # Use systemd init manager by default
 INIT_MANAGER ?= "systemd"
+
+# Enable examples for some QT packages
+PACKAGECONFIG:append:class-target:pn-qtbase        = " examples"
+PACKAGECONFIG:append:class-target:pn-qtdeclarative = " examples"
+PACKAGECONFIG:append:class-target:pn-qtquick3d     = " examples"
+PACKAGECONFIG:append:class-target:pn-qtwebengine   = " examples"