diff --git a/README.md b/README.md
index e5105793a..aa5bd0acc 100644
--- a/README.md
+++ b/README.md
@@ -50,32 +50,6 @@ Software for the following hardware platforms is in production support:
   * [CC-WMX6UL-KIT](https://www.digi.com/products/models/cc-wmx6ul-kit) ([Get Started](https://www.digi.com/resources/documentation/digidocs/embedded/dey/3.0/cc6ul/yocto-gs_index))
   * [CC-SBP-WMX-JN58](https://www.digi.com/products/models/cc-sbp-wmx-jn58)
 
-## ConnectCore 6 Plus
-* ConnectCore 6 Plus System-on-Module (SOM)
-  * [CC-WMX-KK8D-TN](https://www.digi.com/products/models/cc-wmx-kk8d-tn)
-* ConnectCore 6 Plus professional development kit
-  * [CC-WMX6P-KIT](https://www.digi.com/products/models/cc-wmx6p-kit) ([Get Started](https://www.digi.com/resources/documentation/digidocs/embedded/dey/3.0/cc6plus/yocto-gs_index))
-
-## ConnectCore 6
-* ConnectCore 6 System-on-Module (SOM)
-  * [CC-WMX-J97C-TN](https://www.digi.com/products/models/cc-wmx-j97c-tn)
-  * [CC-WMX-L96C-TE](https://www.digi.com/products/models/cc-wmx-l96c-te)
-  * [CC-WMX-L87C-TE](https://www.digi.com/products/models/cc-wmx-l87c-te)
-  * [CC-MX-L76C-Z1](https://www.digi.com/products/models/cc-mx-l76c-z1)
-  * [CC-MX-L86C-Z1](https://www.digi.com/products/models/cc-mx-l86c-z1)
-  * [CC-MX-L96C-Z1](https://www.digi.com/products/models/cc-mx-l96c-z1)
-  * [CC-WMX-L76C-TE](https://www.digi.com/products/models/cc-wmx-l76c-te)
-  * CC-WMX-K87C-FJA
-  * CC-WMX-K77C-TE
-  * CC-WMX-L97D-TN
-  * CC-WMX-J98C-FJA
-  * CC-WMX-J98C-FJA-1
-* ConnectCore 6 Jumpstart Development Kit (SBC with Connectore 6 module)
-  * [CC-WMX6-KIT](https://www.digi.com/products/models/cc-wmx6-kit) ([Get Started](https://www.digi.com/resources/documentation/digidocs/embedded/dey/3.0/cc6/yocto-gs_index))
-  * [CC-SB-WMX-J97C-1](https://www.digi.com/products/models/cc-sb-wmx-j97c-1)
-  * [CC-SB-WMX-L87C-1](https://www.digi.com/products/models/cc-sb-wmx-l87c-1)
-  * [CC-SB-WMX-L76C-1](https://www.digi.com/products/models/cc-sb-wmx-l76c-1)
-
 Previous versions of Digi Embedded Yocto include support for additional Digi
 hardware.
 
@@ -110,7 +84,11 @@ Documentation is available online at https://www.digi.com/resources/documentatio
   * Updated OpenSSL to v1.1.1d
   * Package upgrades and security fixes
 * Updated kernel version to v5.4 for i.MX8X, i.MX8MN and i.MX6UL platforms
-* Updated U-Boot to version 2019.04-r1 for i.MX8X platform
+* Updated U-Boot to version 2017.03-r6 for i.MX6UL platform
+* Updated U-Boot to version 2018.03-r4 for i.MX8MN platform
+* Updated U-Boot to version 2019.04-r2 for i.MX8X platform
+* Added support for ConnectCore 8M Nano v2 SOM
+* Added initial TrustFence support for ConnectCore 8M Nano
 
 # Known Issues and Limitations
 
@@ -134,8 +112,8 @@ updated list can be found on the online documentation.
   * When working as an access point, DFS-capable channels in the 5GHz band are
     not supported.
   * For P2P connections Digi recommends "Negotiated GO" modes. The QCA6564
-    devices (ConnectCore 6UL, ConnectCore 6 Plus, ConnectCore 8M Nano) fail to
-    join autonomous groups.
+    devices (ConnectCore 6UL and ConnectCore 8M Nano) fail to join autonomous
+    groups.
 * Trustfence is not yet supported on the ConnectCore 8M Nano.
 
 ## ConnectCore 8M Nano
@@ -167,32 +145,6 @@ updated list can be found on the online documentation.
     reducing the maximum throughput of this interface.
   * The QCA6564 wireless chip does not support Wake On Wireless LAN.
 
-## ConnectCore 6 Plus
-
-* ConnectCore 6 Plus System-on-Module (SOM)
-  * NXP i.MX6QP processor has a documented errata (ERR004512) whereby the maximum
-    performance of the Gigabit FEC is limited to 400Mbps (total for Tx and Rx).
-* ConnectCore 6 Plus SBC
-  * The Micrel PHY KSZ9031 may take between five and six seconds to
-    auto-negotiate with Gigabit switches.
-
-## ConnectCore 6
-
-* ConnectCore 6 System-on-Module (SOM)
-  * NXP i.MX6 processor has a documented errata (ERR004512) whereby the maximum
-    performance of the Gigabit FEC is limited to 400Mbps (total for Tx and Rx).
-  * The Qualcomm AR6233 firmware does not support the following configuration
-    modes:
-    * Concurrent modes involving P2P mode, such as P2P + softAP or P2P + STA.
-    * Bluetooth + softAP + STA concurrent mode.
-  * A maximum of five clients are supported when using Qualcomm's AR6233 in
-    softAP mode.
-  * A maximum of ten connected devices are supported when using Qualcomm's AR6233
-    Bluetooth Low Energy mode.
-* ConnectCore 6 SBC
-  * The Micrel PHY KSZ9031 may take between five and six seconds to
-    auto-negotiate with Gigabit switches.
-
 # Support Contact Information
 
 For support questions please contact Digi Technical Support:
diff --git a/meta-digi-arm/classes/image_types_digi.bbclass b/meta-digi-arm/classes/image_types_digi.bbclass
index 60bd5d6b7..f30b47b04 100644
--- a/meta-digi-arm/classes/image_types_digi.bbclass
+++ b/meta-digi-arm/classes/image_types_digi.bbclass
@@ -207,12 +207,8 @@ trustence_sign_cpio() {
 		[ -n "${TRUSTFENCE_DEK_PATH}" ] && [ "${TRUSTFENCE_DEK_PATH}" != "0" ] && export CONFIG_DEK_PATH="${TRUSTFENCE_DEK_PATH}"
 		[ -n "${TRUSTFENCE_SIGN_MODE}" ] && export CONFIG_SIGN_MODE="${TRUSTFENCE_SIGN_MODE}"
 
-		if [ "${TRUSTFENCE_SIGN_MODE}" = "AHAB" ]; then
-			mkimage_imx8 -soc ${MX8_SOC_VAR} -rev ${MX8_CHIP_REV} -c -ap ${1} a35 ${RAM_CONTAINER_LOC_TF} -out ${1}-mkimg
-			mv "${1}-mkimg" "${1}"
-		fi
 		# Sign/encrypt the ramdisk
-		trustfence-sign-kernel.sh -p "${DIGI_FAMILY}" -i "${1}" "${1}.tf"
+		trustfence-sign-artifact.sh -p "${DIGI_FAMILY}" -i "${1}" "${1}.tf"
 	else
 		# Copy the image with no changes
 		cp "${1}" "${1}.tf"
@@ -284,14 +280,19 @@ IMAGE_CMD_sdcard() {
 	parted -s ${SDIMG} -- unit KiB mkpart primary ext2 $(expr ${IMAGE_ROOTFS_ALIGNMENT} \+ ${BOOT_SPACE_ALIGNED}) -1s
 	parted -s ${SDIMG} unit KiB print
 
-	# FIXME: adapt trustfence handling for imx-boot
 	# Set u-boot image to flash depending on whether TRUSTFENCE_SIGN is enabled
 	if [ "${TRUSTFENCE_SIGN}" = "1" ]; then
-		SDIMG_BOOTLOADER="$(readlink -e ${SDIMG_BOOTLOADER} | sed -e 's,u-boot-,u-boot-signed-,g')"
+		if [ "${BOOTLOADER_IMAGE_RECIPE}" = "u-boot" ]; then
+			SDIMG_BOOT="$(readlink -e ${SDIMG_BOOTLOADER} | sed -e 's,u-boot-,u-boot-dtb-signed-,g')"
+		else
+			SDIMG_BOOT="$(readlink -e ${SDIMG_BOOTLOADER} | sed -e 's,imx-boot-,imx-boot-signed-,g')"
+		fi
+	else
+		SDIMG_BOOT="$(readlink -e ${SDIMG_BOOTLOADER})"
 	fi
 
 	# Burn bootloader, boot and rootfs partitions
-	dd if=${SDIMG_BOOTLOADER} of=${SDIMG} conv=notrunc,fsync seek=${BOOTLOADER_SEEK} bs=1K
+	dd if=${SDIMG_BOOT} of=${SDIMG} conv=notrunc,fsync seek=${BOOTLOADER_SEEK} bs=1K
 	dd if=${SDIMG_BOOTFS} of=${SDIMG} conv=notrunc,fsync seek=1 bs=$(expr ${IMAGE_ROOTFS_ALIGNMENT} \* 1024)
 	dd if=${SDIMG_ROOTFS} of=${SDIMG} conv=notrunc,fsync seek=1 bs=$(expr ${IMAGE_ROOTFS_ALIGNMENT} \* 1024 + ${BOOT_SPACE_ALIGNED} \* 1024)
 }
diff --git a/meta-digi-arm/conf/machine/include/ccimx8mn.inc b/meta-digi-arm/conf/machine/include/ccimx8mn.inc
index 46997bed8..e08c8a983 100644
--- a/meta-digi-arm/conf/machine/include/ccimx8mn.inc
+++ b/meta-digi-arm/conf/machine/include/ccimx8mn.inc
@@ -34,7 +34,7 @@ WIRELESS_MODULE_append = " ${@oe.utils.conditional('HAVE_WIFI', '1', 'kernel-mod
 HAS_WIFI_VIRTWLANS = "true"
 
 # Firmware
-MACHINE_FIRMWARE ?= "firmware-imx-sdma firmware-imx-easrc"
+MACHINE_FIRMWARE ?= "firmware-imx-sdma firmware-imx-easrc firmware-imx-regulatory"
 MACHINE_FIRMWARE_append = " ${@oe.utils.conditional('HAVE_BT', '1', 'firmware-qualcomm-qca6564-bt', '', d)}"
 MACHINE_FIRMWARE_append = " ${@oe.utils.conditional('HAVE_WIFI', '1', 'firmware-qualcomm-qca6564-wifi', '', d)}"
 
@@ -60,7 +60,9 @@ VIRTUAL-RUNTIME_initscripts ?= "initscripts"
 
 # TrustFence
 TRUSTFENCE_SIGN_MODE = "HAB"
-# TODO: not yet supported
+# TODO: Encryption not yet supported
+TRUSTFENCE_DEK_PATH = "0"
+TRUSTFENCE_INITRAMFS_IMAGE = ""
 TRUSTFENCE_ENCRYPT_ENVIRONMENT = "0"
 
 # Adding 'wayland' along with 'x11' enables the xwayland backend
diff --git a/meta-digi-arm/conf/machine/include/ccimx8x.inc b/meta-digi-arm/conf/machine/include/ccimx8x.inc
index 35587f451..77fe85cfa 100644
--- a/meta-digi-arm/conf/machine/include/ccimx8x.inc
+++ b/meta-digi-arm/conf/machine/include/ccimx8x.inc
@@ -44,7 +44,7 @@ WIRELESS_MODULE_append = " ${@oe.utils.conditional('HAVE_WIFI', '1', 'kernel-mod
 HAS_WIFI_VIRTWLANS = "true"
 
 # Firmware
-MACHINE_FIRMWARE ?= "firmware-imx-vpu-imx8 firmware-imx-sdma"
+MACHINE_FIRMWARE ?= "firmware-imx-vpu-imx8 firmware-imx-sdma firmware-imx-regulatory"
 MACHINE_FIRMWARE_append = " ${@oe.utils.conditional('HAVE_BT', '1', 'firmware-qualcomm-qca6574-bt', '', d)}"
 MACHINE_FIRMWARE_append = " ${@oe.utils.conditional('HAVE_WIFI', '1', 'firmware-qualcomm-qca6574-wifi', '', d)}"
 
@@ -68,18 +68,12 @@ KERNEL_IMAGETYPE = "Image.gz"
 VIRTUAL-RUNTIME_init_manager ?= "systemd"
 VIRTUAL-RUNTIME_initscripts ?= "initscripts"
 
-# For i.MX 8 silicon chip revision
-MX8_CHIP_REV ?= "B0"
-MX8_SOC_VAR ?= "QX"
-
 # TrustFence
 TRUSTFENCE_SIGN_MODE = "AHAB"
-# TODO: not yet supported
+# TODO: Encryption not yet supported
+TRUSTFENCE_DEK_PATH = "0"
+TRUSTFENCE_INITRAMFS_IMAGE = ""
 TRUSTFENCE_ENCRYPT_ENVIRONMENT = "0"
-# For Trustfence container header RAM locations
-RAM_CONTAINER_LOC_BOOT = "0x80280000"
-RAM_CONTAINER_LOC_DTB = "0x82000000"
-RAM_CONTAINER_LOC_TF = "0x82100000"
 
 # Adding 'wayland' along with 'x11' enables the xwayland backend
 # Vulkan is necessary for wayland to build
diff --git a/meta-digi-arm/conf/machine/include/imx-digi-base.inc b/meta-digi-arm/conf/machine/include/imx-digi-base.inc
index 1423e092e..54bce7bf4 100644
--- a/meta-digi-arm/conf/machine/include/imx-digi-base.inc
+++ b/meta-digi-arm/conf/machine/include/imx-digi-base.inc
@@ -9,7 +9,7 @@ XSERVER = "xserver-xorg \
            ${XSERVER_DRIVER}"
 
 # Ship kernel modules
-MACHINE_EXTRA_RRECOMMENDS = "kernel-modules"
+MACHINE_EXTRA_RRECOMMENDS += "kernel-modules"
 
 # Tunes for hard/soft float-point selection. Note that we allow building for
 # thumb support giving distros the chance to enable thumb by setting
diff --git a/meta-digi-arm/recipes-bsp/digi-sc-firmware/digi-sc-firmware_1.4.0.2.bb b/meta-digi-arm/recipes-bsp/digi-sc-firmware/digi-sc-firmware_1.4.0.3.bb
similarity index 89%
rename from meta-digi-arm/recipes-bsp/digi-sc-firmware/digi-sc-firmware_1.4.0.2.bb
rename to meta-digi-arm/recipes-bsp/digi-sc-firmware/digi-sc-firmware_1.4.0.3.bb
index 9067689da..ba354088a 100644
--- a/meta-digi-arm/recipes-bsp/digi-sc-firmware/digi-sc-firmware_1.4.0.2.bb
+++ b/meta-digi-arm/recipes-bsp/digi-sc-firmware/digi-sc-firmware_1.4.0.3.bb
@@ -11,8 +11,8 @@ inherit pkgconfig deploy
 
 SRC_URI = "${DIGI_PKG_SRC}/${BPN}-${PV}.tar.gz"
 
-SRC_URI[md5sum] = "bcf3402c9d6a394dad8d518a73cb27ad"
-SRC_URI[sha256sum] = "bd5fb8a35d9fbb0e10f93513e52a3ce3e105e4a80d82624a0be4e73eb95b1352"
+SRC_URI[md5sum] = "24a8d857d5ecc81f08457f2f4512e779"
+SRC_URI[sha256sum] = "769282b099f97af6132e75f505056f3e7914dd8557778af8169db28fcf28727a"
 
 S = "${WORKDIR}/${PN}-${PV}"
 
diff --git a/meta-digi-arm/recipes-bsp/firmware-imx/files/ccimx8mn-dvk/sdma-firmware.service b/meta-digi-arm/recipes-bsp/firmware-imx/files/ccimx8mn-dvk/sdma-firmware.service
new file mode 100644
index 000000000..918cce6c9
--- /dev/null
+++ b/meta-digi-arm/recipes-bsp/firmware-imx/files/ccimx8mn-dvk/sdma-firmware.service
@@ -0,0 +1,15 @@
+# The SDMA firmware needs to be loaded in order for the kernel to carry out
+# SPI tranfers with DMA. Such transfers are required when probing the mcp25xxfd
+# module, so make sure the firmware is loaded before the module is by adding
+# the appropriate dependencies in this service.
+
+[Unit]
+Description=User Space SDMA Firmware Loading
+Before=systemd-modules-load.service
+DefaultDependencies=no
+
+[Service]
+ExecStart=/etc/sdma
+
+[Install]
+WantedBy=sysinit.target
diff --git a/meta-digi-arm/recipes-bsp/firmware-qualcomm/firmware-qualcomm.bb b/meta-digi-arm/recipes-bsp/firmware-qualcomm/firmware-qualcomm.bb
index 9fb83e6d3..c2b7c0bab 100644
--- a/meta-digi-arm/recipes-bsp/firmware-qualcomm/firmware-qualcomm.bb
+++ b/meta-digi-arm/recipes-bsp/firmware-qualcomm/firmware-qualcomm.bb
@@ -34,7 +34,7 @@ FW_QCA65X4_PCIE_PROPRIETARY = " \
     file://LICENCE.atheros_firmware \
     file://qca65X4_pcie_proprietary/otp30.bin \
     file://qca65X4_pcie_proprietary/qwlan30.bin \
-    file://qca65X4_pcie_proprietary/utf30.bin \
+    file://qca65X4_pcie_proprietary/utf.bin \
 "
 
 # Firmware files for QCA6574 (Qualcomm community driver)
diff --git a/meta-digi-arm/recipes-bsp/firmware-qualcomm/firmware-qualcomm/ccimx8x/bdwlan30_US.bin b/meta-digi-arm/recipes-bsp/firmware-qualcomm/firmware-qualcomm/ccimx8x/bdwlan30_US.bin
index 8d48bbef5..a687cedbd 100644
Binary files a/meta-digi-arm/recipes-bsp/firmware-qualcomm/firmware-qualcomm/ccimx8x/bdwlan30_US.bin and b/meta-digi-arm/recipes-bsp/firmware-qualcomm/firmware-qualcomm/ccimx8x/bdwlan30_US.bin differ
diff --git a/meta-digi-arm/recipes-bsp/firmware-qualcomm/firmware-qualcomm/qca65X4_pcie_proprietary/utf30.bin b/meta-digi-arm/recipes-bsp/firmware-qualcomm/firmware-qualcomm/qca65X4_pcie_proprietary/utf.bin
similarity index 100%
rename from meta-digi-arm/recipes-bsp/firmware-qualcomm/firmware-qualcomm/qca65X4_pcie_proprietary/utf30.bin
rename to meta-digi-arm/recipes-bsp/firmware-qualcomm/firmware-qualcomm/qca65X4_pcie_proprietary/utf.bin
diff --git a/meta-digi-arm/recipes-bsp/imx-mkimage/imx-boot_1.0.bbappend b/meta-digi-arm/recipes-bsp/imx-mkimage/imx-boot_1.0.bbappend
index 0c30f4f23..bca66452a 100644
--- a/meta-digi-arm/recipes-bsp/imx-mkimage/imx-boot_1.0.bbappend
+++ b/meta-digi-arm/recipes-bsp/imx-mkimage/imx-boot_1.0.bbappend
@@ -116,7 +116,7 @@ do_compile () {
 			if [ "${TRUSTFENCE_SIGN}" = "1" ]; then
 				# Log HAB FIT information
 				bbnote "building ${SOC_TARGET} - print_fit_hab"
-				make SOC=${SOC_TARGET} print_fit_hab > mkimage-print_fit_hab.log 2>&1
+				make SOC=${SOC_TARGET} dtbs=${UBOOT_DTB_NAME} print_fit_hab > mkimage-print_fit_hab.log 2>&1
 			fi
 		fi
 	done
@@ -212,11 +212,18 @@ do_deploy_append () {
 
 		# Sign U-boot image
 		if [ "${UBOOT_RAM_COMBINATIONS}" = "" ]; then
-			trustfence-sign-uboot.sh ${DEPLOYDIR}/${UBOOT_PREFIX}-${MACHINE}.bin ${DEPLOYDIR}/${UBOOT_PREFIX}-${MACHINE}-signed.bin
+			for target in ${IMXBOOT_TARGETS}; do
+				trustfence-sign-uboot.sh ${DEPLOYDIR}/${UBOOT_PREFIX}-${MACHINE}.bin-${target} ${DEPLOYDIR}/${UBOOT_PREFIX}-signed-${MACHINE}.bin-${target}
+			done
 		else
 			for ramc in ${UBOOT_RAM_COMBINATIONS}; do
 				for rev in ${SOC_REVISIONS}; do
-					trustfence-sign-uboot.sh ${DEPLOYDIR}/${UBOOT_PREFIX}-${MACHINE}-${rev}-${ramc}.bin ${DEPLOYDIR}/${UBOOT_PREFIX}-${MACHINE}-${rev}-${ramc}-signed.bin
+					for target in ${IMXBOOT_TARGETS}; do
+						# Do not sign "flash_regression_linux_m4" target files
+						if [ "${target}" != "flash_regression_linux_m4" ]; then
+							trustfence-sign-uboot.sh ${DEPLOYDIR}/${UBOOT_PREFIX}-${MACHINE}-${rev}-${ramc}.bin-${target} ${DEPLOYDIR}/${UBOOT_PREFIX}-signed-${MACHINE}-${rev}-${ramc}.bin-${target}
+						fi
+					done
 				done
 			done
 		fi
diff --git a/meta-digi-arm/recipes-bsp/imx-mkimage/imx-mkimage_git.bb b/meta-digi-arm/recipes-bsp/imx-mkimage/imx-mkimage_git.bb
index d76f879c2..511bb6195 100644
--- a/meta-digi-arm/recipes-bsp/imx-mkimage/imx-mkimage_git.bb
+++ b/meta-digi-arm/recipes-bsp/imx-mkimage/imx-mkimage_git.bb
@@ -8,8 +8,11 @@ LICENSE = "GPLv2"
 LIC_FILES_CHKSUM = "file://${COREBASE}/meta/files/common-licenses/GPL-2.0;md5=801f80980d171dd6425610833a22dbe6"
 SECTION = "BSP"
 
-inherit native deploy
-
+# Beware: applied last to first
+DEBUG_PREFIX_MAP = "-fdebug-prefix-map=${WORKDIR}=/usr/src/debug/${PN}/${EXTENDPE}${PV}-${PR} \
+                    -fdebug-prefix-map=${STAGING_DIR_HOST}= \
+                    -fdebug-prefix-map=${STAGING_DIR_NATIVE}= \
+"
 CFLAGS = "-O2 -Wall -std=c99 -I ${STAGING_INCDIR} -L ${STAGING_LIBDIR}"
 
 REV_CHIP ?= "B0"
diff --git a/meta-digi-arm/recipes-bsp/imx-mkimage/imx-mkimage_git.inc b/meta-digi-arm/recipes-bsp/imx-mkimage/imx-mkimage_git.inc
index 973d475eb..9cb78f4ae 100644
--- a/meta-digi-arm/recipes-bsp/imx-mkimage/imx-mkimage_git.inc
+++ b/meta-digi-arm/recipes-bsp/imx-mkimage/imx-mkimage_git.inc
@@ -1,6 +1,6 @@
 # Copyright 2017-2019 NXP
- 
-DEPENDS = "zlib-native openssl-native"
+
+DEPENDS = "zlib openssl"
 
 SRCBRANCH = "imx_5.4.3_2.0.0"
 IMX_MKIMAGE_SRC ?= "git://source.codeaurora.org/external/imx/imx-mkimage.git;protocol=https"
diff --git a/meta-digi-arm/recipes-bsp/u-boot/digi-u-boot.inc b/meta-digi-arm/recipes-bsp/u-boot/digi-u-boot.inc
index 1599ddcd7..922d34d2d 100644
--- a/meta-digi-arm/recipes-bsp/u-boot/digi-u-boot.inc
+++ b/meta-digi-arm/recipes-bsp/u-boot/digi-u-boot.inc
@@ -171,11 +171,9 @@ do_deploy_append() {
 		[ -n "${TRUSTFENCE_SIGN_MODE}" ] && export CONFIG_SIGN_MODE="${TRUSTFENCE_SIGN_MODE}"
 
 		# Sign boot script
-		if [ "${TRUSTFENCE_SIGN_MODE}" = "HAB" ] && [ "${BOOTLOADER_IMAGE_RECIPE}" = "u-boot" ]; then
-			TMP_SIGNED_BOOTSCR="$(mktemp ${WORKDIR}/bootscr-signed.XXXXXX)"
-			trustfence-sign-kernel.sh -p "${DIGI_FAMILY}" -b "${DEPLOYDIR}/boot.scr" "${TMP_SIGNED_BOOTSCR}"
-			mv "${TMP_SIGNED_BOOTSCR}" "${DEPLOYDIR}/boot.scr"
-		fi
+		TMP_SIGNED_BOOTSCR="$(mktemp ${WORKDIR}/bootscr-signed.XXXXXX)"
+		trustfence-sign-artifact.sh -p "${DIGI_FAMILY}" -b "${DEPLOYDIR}/boot.scr" "${TMP_SIGNED_BOOTSCR}"
+		mv "${TMP_SIGNED_BOOTSCR}" "${DEPLOYDIR}/boot.scr"
 	fi
 	rm -f ${TMP_BOOTSCR}
 }
@@ -188,11 +186,6 @@ do_deploy_append_ccimx8x() {
 	install -d ${DEPLOYDIR}/${BOOT_TOOLS}
 	mv ${DEPLOYDIR}/u-boot* ${DEPLOYDIR}/${BOOT_TOOLS}/
 	mv ${DEPLOYDIR}/${UBOOT_SYMLINK}-* ${DEPLOYDIR}/${BOOT_TOOLS}/
-	if [ "${TRUSTFENCE_SIGN}" = "1" ]; then
-		mkimage_imx8 -soc ${MX8_SOC_VAR} -rev ${MX8_CHIP_REV} -c -ap ${DEPLOYDIR}/boot.scr a35 ${RAM_CONTAINER_LOC_BOOT} -out ${DEPLOYDIR}/boot-mkimg.scr
-		trustfence-sign-kernel.sh -p "${DIGI_FAMILY}" -b "${DEPLOYDIR}/boot-mkimg.scr" "${DEPLOYDIR}/boot.scr"
-		rm -f ${DEPLOYDIR}/boot-mkimg.scr
-	fi
 }
 
 do_deploy_append_ccimx8mn() {
diff --git a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6qpsbc/boot.txt b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6qpsbc/boot.txt
index fcf0886e4..7c9012a1e 100644
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6qpsbc/boot.txt
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6qpsbc/boot.txt
@@ -32,4 +32,5 @@ else
 	# We are booting from the SD card.
 	setenv mmcroot /dev/mmcblk${mmcbootdev}p2
 fi
+setenv extra_bootargs fbcon=logo-pos:center ${extra_bootargs}
 dboot linux mmc ${mmcbootdev}:${mmcpart}
diff --git a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6sbc/boot.txt b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6sbc/boot.txt
index 422e9399c..95f55ff61 100644
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6sbc/boot.txt
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6sbc/boot.txt
@@ -62,4 +62,5 @@ else
 	# We are booting from the SD card.
 	setenv mmcroot /dev/mmcblk${mmcbootdev}p2
 fi
+setenv extra_bootargs fbcon=logo-pos:center ${extra_bootargs}
 dboot linux mmc ${mmcbootdev}:${mmcpart}
diff --git a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6ulsbc/boot.txt b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6ulsbc/boot.txt
index dcd797ba7..09e5b0ec1 100644
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6ulsbc/boot.txt
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6ulsbc/boot.txt
@@ -26,4 +26,5 @@ if test "${mtdbootpart}" = "recovery"; then
 else
 	true
 fi
+setenv extra_bootargs fbcon=logo-pos:center ${extra_bootargs}
 dboot linux nand ${mtdbootpart}
diff --git a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6ulstarter/boot.txt b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6ulstarter/boot.txt
index 0200b0d50..37758ec4f 100644
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6ulstarter/boot.txt
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx6ulstarter/boot.txt
@@ -26,4 +26,5 @@ if test "${mtdbootpart}" = "recovery"; then
 else
 	true
 fi
+setenv extra_bootargs fbcon=logo-pos:center ${extra_bootargs}
 dboot linux nand ${mtdbootpart}
diff --git a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8mn-dvk/boot.txt b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8mn-dvk/boot.txt
index 6815fc994..cfd7ac100 100644
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8mn-dvk/boot.txt
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey/ccimx8mn-dvk/boot.txt
@@ -47,4 +47,5 @@ else
 	# We are booting from the SD card.
 	setenv mmcroot /dev/mmcblk${mmcbootdev}p2
 fi
+setenv extra_bootargs fbcon=logo-pos:center ${extra_bootargs}
 dboot linux mmc ${mmcbootdev}:${mmcpart}
diff --git a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey_2019.04.bb b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey_2019.04.bb
index 604ebbc43..99287edae 100644
--- a/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey_2019.04.bb
+++ b/meta-digi-arm/recipes-bsp/u-boot/u-boot-dey_2019.04.bb
@@ -8,4 +8,4 @@ DEPENDS += "flex-native bison-native"
 SRCBRANCH = "v2019.04/master"
 SRCREV = "${AUTOREV}"
 
-COMPATIBLE_MACHINE = "(ccimx8x)"
\ No newline at end of file
+COMPATIBLE_MACHINE = "(ccimx8x)"
diff --git a/meta-digi-arm/recipes-core/packagegroup/packagegroup-base.bbappend b/meta-digi-arm/recipes-core/packagegroup/packagegroup-base.bbappend
deleted file mode 100644
index 4b6196654..000000000
--- a/meta-digi-arm/recipes-core/packagegroup/packagegroup-base.bbappend
+++ /dev/null
@@ -1,4 +0,0 @@
-# Copyright (C) 2020 Digi International.
-
-# wireless-regdb-static conflicts with wireless-regdb required by crda
-RDEPENDS_packagegroup-base-wifi_remove = "wireless-regdb-static"
diff --git a/meta-digi-arm/recipes-digi/mca/mca-tool_1.20.bb b/meta-digi-arm/recipes-digi/mca/mca-tool_1.22.bb
similarity index 62%
rename from meta-digi-arm/recipes-digi/mca/mca-tool_1.20.bb
rename to meta-digi-arm/recipes-digi/mca/mca-tool_1.22.bb
index 0e5e7bf00..807c20d13 100644
--- a/meta-digi-arm/recipes-digi/mca/mca-tool_1.20.bb
+++ b/meta-digi-arm/recipes-digi/mca/mca-tool_1.22.bb
@@ -8,13 +8,13 @@ PKGNAME = "mca_tool"
 
 # ARM tarball
 SRC_URI_arm = "${DIGI_PKG_SRC}/${PKGNAME}-${PV}-${TUNE_ARCH}.tar.gz;name=arm"
-SRC_URI[arm.md5sum] = "2007a858cd8f82ae2ddbff43f437335a"
-SRC_URI[arm.sha256sum] = "d9a0c1ca1c9f20041602edd585c31bd79b75bc8d8a74648d1809350e731af3d5"
+SRC_URI[arm.md5sum] = "2b2ce463139be67bd9929c7ce145ae42"
+SRC_URI[arm.sha256sum] = "2a241dbaad099cf2d526eff6bbfdbd7c548e4391cc6751bb9eaa22d16c3cd5e4"
 
 # AARCH64 tarball
 SRC_URI_aarch64 = "${DIGI_PKG_SRC}/${PKGNAME}-${PV}-${TUNE_ARCH}.tar.gz;name=aarch64"
-SRC_URI[aarch64.md5sum] = "600451f7312a130c63f3b3b5c7abdbb6"
-SRC_URI[aarch64.sha256sum] = "1acc7498943662e7e5bd26a67d2733a4814823170ba0756313459cb0e68e6e5f"
+SRC_URI[aarch64.md5sum] = "c5f235c29fd663fde135095016daed4f"
+SRC_URI[aarch64.sha256sum] = "9a0fd1bb053d9be0ede344ba22b0811528547130ef6c78432548a27dcd8f460c"
 
 S = "${WORKDIR}/${PKGNAME}-${PV}"
 
diff --git a/meta-digi-arm/recipes-digi/trustfence/trustfence-sign-tools/trustfence-sign-kernel.sh b/meta-digi-arm/recipes-digi/trustfence/trustfence-sign-tools/trustfence-sign-artifact.sh
similarity index 78%
rename from meta-digi-arm/recipes-digi/trustfence/trustfence-sign-tools/trustfence-sign-kernel.sh
rename to meta-digi-arm/recipes-digi/trustfence/trustfence-sign-tools/trustfence-sign-artifact.sh
index bdba4933a..21ba2b42d 100755
--- a/meta-digi-arm/recipes-digi/trustfence/trustfence-sign-tools/trustfence-sign-kernel.sh
+++ b/meta-digi-arm/recipes-digi/trustfence/trustfence-sign-tools/trustfence-sign-artifact.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 #===============================================================================
 #
-#  trustfence-sign-kernel.sh
+#  trustfence-sign-artifact.sh
 #
 #  Copyright (C) 2016-2020 by Digi International Inc.
 #  All rights reserved.
@@ -12,10 +12,11 @@
 #
 #
 #  Description:
-#    Script for building signed and encrypted kernel uImages using NXP CST.
+#    Script for building signed and encrypted artifacts using NXP CST.
 #
 #    The following environment variables define the script behaviour:
 #      CONFIG_SIGN_KEYS_PATH: (mandatory) path to the CST folder by NXP with keys generated.
+#      CONFIG_SIGN_MODE: (mandatory) Signing method: HAB/AHAB
 #      CONFIG_KEY_INDEX: (optional) key index to use for signing. Default is 0.
 #      CONFIG_DEK_PATH: (optional) Path to keyfile. Define it to generate
 #			encrypted images
@@ -32,12 +33,13 @@ done
 SCRIPT_NAME="$(basename ${0})"
 SCRIPT_PATH="$(cd $(dirname ${0}) && pwd)"
 
-while getopts "bdilp:" c; do
+while getopts "bdilop:" c; do
 	case "${c}" in
 		b) ARTIFACT_BOOTSCRIPT="y";;
 		d) ARTIFACT_DTB="y";;
 		i) ARTIFACT_INITRAMFS="y";;
 		l) ARTIFACT_KERNEL="y";;
+		o) ARTIFACT_DTB_OVERLAY="y";;
 		p) PLATFORM="${OPTARG}";;
 	esac
 done
@@ -51,10 +53,11 @@ Usage: ${SCRIPT_NAME} [OPTIONS] input-unsigned-image output-signed-image
     -p <platform>    select platform for the project
     -b               sign/encrypt bootscript
     -d               sign/encrypt DTB
+    -o               sign/encrypt DTB overlay
     -i               sign/encrypt initramfs
     -l               sign/encrypt Linux image
 
-Supported platforms: ccimx6, ccimx6ul, ccimx8x
+Supported platforms: ccimx6, ccimx6ul, ccimx8x, ccimx8mn
 
 EOF
 }
@@ -67,13 +70,6 @@ fi
 UIMAGE_PATH="$(readlink -e ${1})"
 TARGET="$(readlink -m ${2})"
 
-# Negative offset with respect to CONFIG_RAM_START in which U-Boot
-# copies the DEK blob.
-if [ "${CONFIG_SIGN_MODE}" = "HAB" ]; then
-	DEK_BLOB_OFFSET="0x100"
-	CONFIG_CSF_SIZE="0x4000"
-fi
-
 # Read user configuration file (if used)
 [ -f .config ] && . ./.config
 
@@ -82,8 +78,54 @@ if [ -z "${CONFIG_SIGN_KEYS_PATH}" ]; then
 	exit 1
 fi
 [ -d "${CONFIG_SIGN_KEYS_PATH}" ] || mkdir "${CONFIG_SIGN_KEYS_PATH}"
+if [ -z "${CONFIG_SIGN_MODE}" ]; then
+	echo "Undefined CONFIG_SIGN_MODE";
+	exit 1
+fi
+
+# Get RAM_START address
+if [ "${PLATFORM}" = "ccimx6" ]; then
+	CONFIG_FDT_LOADADDR="0x18000000"
+	CONFIG_RAMDISK_LOADADDR="0x19000000"
+	CONFIG_KERNEL_LOADADDR="0x12000000"
+	CONFIG_CSF_SIZE="0x4000"
+elif [ "${PLATFORM}" = "ccimx6ul" ]; then
+	CONFIG_FDT_LOADADDR="0x83000000"
+	CONFIG_RAMDISK_LOADADDR="0x83800000"
+	CONFIG_KERNEL_LOADADDR="0x80800000"
+	CONFIG_CSF_SIZE="0x4000"
+elif [ "${PLATFORM}" = "ccimx8x" ]; then
+	CONFIG_FDT_LOADADDR="0x82000000"
+	CONFIG_RAMDISK_LOADADDR="0x82100000"
+	CONFIG_KERNEL_LOADADDR="0x80280000"
+elif [ "${PLATFORM}" = "ccimx8mn" ]; then
+	CONFIG_FDT_LOADADDR="0x43000000"
+	CONFIG_RAMDISK_LOADADDR="0x43800000"
+	CONFIG_KERNEL_LOADADDR="0x40480000"
+	CONFIG_CSF_SIZE="0x2000"
+else
+	echo "Invalid platform: ${PLATFORM}"
+	echo "Supported platforms: ccimx6, ccimx6ul, ccimx8x, ccimx8mn"
+	exit 1
+fi
+
+[ "${ARTIFACT_DTB}" = "y" ] && CONFIG_RAM_START="${CONFIG_FDT_LOADADDR}"
+[ "${ARTIFACT_INITRAMFS}" = "y" ] && CONFIG_RAM_START="${CONFIG_RAMDISK_LOADADDR}"
+[ "${ARTIFACT_KERNEL}" = "y" ] && CONFIG_RAM_START="${CONFIG_KERNEL_LOADADDR}"
+# bootscripts are loaded to $loadaddr, just like the kernel
+[ "${ARTIFACT_BOOTSCRIPT}" = "y" ] && CONFIG_RAM_START="${CONFIG_KERNEL_LOADADDR}"
+# DTB overlays are loaded to $initrd_addr, just like the ramdisk
+[ "${ARTIFACT_DTB_OVERLAY}" = "y" ] && CONFIG_RAM_START="${CONFIG_RAMDISK_LOADADDR}"
+
+if [ -z "${CONFIG_RAM_START}" ]; then
+	echo "Specify the type of image to process (-b, -i, -d, -l, or -o)"
+	exit 1
+fi
 
 if [ "${CONFIG_SIGN_MODE}" = "HAB" ]; then
+	# Negative offset with respect to CONFIG_RAM_START in which U-Boot
+	# copies the DEK blob.
+	DEK_BLOB_OFFSET="0x100"
 	if [ -n "${CONFIG_DEK_PATH}" ]; then
 		if [ ! -f "${CONFIG_DEK_PATH}" ]; then
 			echo "DEK not found. Generating random 256 bit DEK."
@@ -97,31 +139,6 @@ if [ "${CONFIG_SIGN_MODE}" = "HAB" ]; then
 		fi
 		ENCRYPT="true"
 	fi
-
-	if [ "${PLATFORM}" = "ccimx6" ]; then
-		CONFIG_FDT_LOADADDR="0x18000000"
-		CONFIG_RAMDISK_LOADADDR="0x19000000"
-		CONFIG_KERNEL_LOADADDR="0x12000000"
-	elif [ "${PLATFORM}" = "ccimx6ul" ]; then
-		CONFIG_FDT_LOADADDR="0x83000000"
-		CONFIG_RAMDISK_LOADADDR="0x83800000"
-		CONFIG_KERNEL_LOADADDR="0x80800000"
-	else
-		echo "Invalid platform: ${PLATFORM}"
-		echo "Supported platforms: ccimx6, ccimx6ul"
-		exit 1
-	fi
-
-	[ "${ARTIFACT_DTB}" = "y" ] && CONFIG_RAM_START="${CONFIG_FDT_LOADADDR}"
-	[ "${ARTIFACT_INITRAMFS}" = "y" ] && CONFIG_RAM_START="${CONFIG_RAMDISK_LOADADDR}"
-	[ "${ARTIFACT_KERNEL}" = "y" ] && CONFIG_RAM_START="${CONFIG_KERNEL_LOADADDR}"
-	# bootscripts are loaded to $loadaddr, just like the kernel
-	[ "${ARTIFACT_BOOTSCRIPT}" = "y" ] && CONFIG_RAM_START="${CONFIG_KERNEL_LOADADDR}"
-
-	if [ -z "${CONFIG_RAM_START}" ]; then
-		echo "Specify the type of image to process (-b, -i, -d, or -l)"
-		exit 1
-	fi
 fi
 
 # Default values
@@ -166,6 +183,22 @@ elif [ "${CONFIG_SIGN_MODE}" = "AHAB" ]; then
 	fi
 fi
 
+LINUX64_MAGIC="0x644d5241"
+
+get_image_size()
+{
+	# Check if LINUX_ARM64 image magic number is found
+	magic_number="$(hexdump -n 4 -s 56 -e '/4 "0x%08x\t" "\n"' ${UIMAGE_PATH})"
+	if [ ${magic_number} = "${LINUX64_MAGIC}" ]; then
+		# LINUX_ARM64, read the size from the file header
+		image_size="$(hexdump -n 4 -s 16 -e '/4 "0x%08x\t" "\n"' ${UIMAGE_PATH})"
+	else
+		# Unknown image type, return the actual filesize
+		image_size="$(stat -L -c %s ${UIMAGE_PATH})"
+	fi
+	echo ${image_size}
+}
+
 SRK_TABLE="$(pwd)/SRK_table.bin"
 if [ "${CONFIG_SIGN_MODE}" = "HAB" ]; then
 	HAB_VER="hab_ver 4"
@@ -179,7 +212,7 @@ if [ "${CONFIG_SIGN_MODE}" = "HAB" ]; then
 	dek_blob_offset="$((CONFIG_KERNEL_LOADADDR - DEK_BLOB_OFFSET))"
 
 	# Compute the layout: sizes and offsets.
-	uimage_size="$(stat -L -c %s ${UIMAGE_PATH})"
+	uimage_size="$(get_image_size)"
 	uimage_offset="0x0"
 	pad_len="$(((uimage_size + 0x1000 - 1) & ~(0x1000 - 1)))"
 	auth_len="$((pad_len + 0x20))"
@@ -245,12 +278,15 @@ else
 	# Other constants
 	KERNEL_START_OFFSET="0x0"
 	KERNEL_SIG_BLOCK_OFFSET="0x90"
-	KERNEL_NAME="${1}"
 
 	HAB_VER="ahab"
 	DIGEST="sign_digest"
 	DIGEST_ALGO="sha512"
 
+	# Prepare the image container
+	mkimage_imx8 -soc "QX" -rev "B0" -c -ap ${UIMAGE_PATH} a35 ${CONFIG_RAM_START} -out temp-mkimg
+	KERNEL_NAME="$(readlink -e temp-mkimg)"
+
 	# Compute the layout: sizes and offsets.
 	container_header_offset="${KERNEL_START_OFFSET}"
 	signature_block_offset="${KERNEL_SIG_BLOCK_OFFSET}"
@@ -309,6 +345,7 @@ if [ "${CONFIG_SIGN_MODE}" = "HAB" ]; then
 
 	objcopy -I binary -O binary --pad-to "${sig_len}" --gap-fill="${GAP_FILLER}" "${TARGET}"
 else
+	# Sign the image
 	CURRENT_PATH="$(pwd)"
 	cst -o "${TARGET}" -i "${CURRENT_PATH}/csf_descriptor" >/dev/null
 	if [ $? -ne 0 ]; then
@@ -319,4 +356,4 @@ fi
 
 [ "${ENCRYPT}" = "true" ] && ENCRYPTED_MSG="and encrypted "
 echo "Signed ${ENCRYPTED_MSG}image ready: ${TARGET}"
-rm -f "${SRK_TABLE}" csf_descriptor csf.bin 2> /dev/null
+rm -f "${SRK_TABLE}" csf_descriptor csf.bin temp-mkimg 2> /dev/null
diff --git a/meta-digi-arm/recipes-digi/trustfence/trustfence-sign-tools_git.bb b/meta-digi-arm/recipes-digi/trustfence/trustfence-sign-tools_git.bb
index 17d1ab0b6..23e190c78 100644
--- a/meta-digi-arm/recipes-digi/trustfence/trustfence-sign-tools_git.bb
+++ b/meta-digi-arm/recipes-digi/trustfence/trustfence-sign-tools_git.bb
@@ -16,10 +16,10 @@ UBOOT_GIT_URI ?= "${@oe.utils.conditional('DIGI_INTERNAL_GIT', '1' , '${DIGI_GIT
 
 SRC_URI = " \
     ${UBOOT_GIT_URI};branch=${SRCBRANCH} \
-    file://trustfence-sign-kernel.sh;name=kernel-script \
-    file://sign_hab;name=kernel-sign \
-    file://encrypt_hab;name=kernel-encrypt \
-    file://sign_ahab;name=kernel-sign \
+    file://trustfence-sign-artifact.sh;name=artifact-sign-script \
+    file://sign_hab;name=artifact-hab-sign \
+    file://encrypt_hab;name=artifact-hab-encrypt \
+    file://sign_ahab;name=artifact-ahab-sign \
 "
 
 do_configure[noexec] = "1"
@@ -36,7 +36,7 @@ do_install() {
 		bberror "Unkown TRUSTFENCE_SIGN_MODE value"
 		exit 1
 	fi
-	install -m 0755 trustfence-sign-kernel.sh ${D}${bindir}/
+	install -m 0755 trustfence-sign-artifact.sh ${D}${bindir}/
 	install -m 0755 git/scripts/csf_templates/* ${D}${bindir}/csf_templates
 
 	# Select U-Boot sign script depending on U-Boot including an SPL image
diff --git a/meta-digi-arm/recipes-kernel/linux/linux-dey.inc b/meta-digi-arm/recipes-kernel/linux/linux-dey.inc
index 6919f7f24..07015ad45 100644
--- a/meta-digi-arm/recipes-kernel/linux/linux-dey.inc
+++ b/meta-digi-arm/recipes-kernel/linux/linux-dey.inc
@@ -25,49 +25,41 @@ trustfence_sign() {
 	[ -n "${TRUSTFENCE_SIGN_MODE}" ] && export CONFIG_SIGN_MODE="${TRUSTFENCE_SIGN_MODE}"
 
 	# Sign/encrypt the kernel images
-	if [ "${TRUSTFENCE_SIGN_MODE}" = "HAB" ]; then
-		for type in ${KERNEL_IMAGETYPES}; do
-			KERNEL_IMAGE="${type}-${KERNEL_IMAGE_NAME}.bin"
-			TMP_KERNEL_IMAGE_SIGNED="$(mktemp ${KERNEL_IMAGE}-signed.XXXXXX)"
-			trustfence-sign-kernel.sh -p "${DIGI_FAMILY}" -l "${KERNEL_IMAGE}" "${TMP_KERNEL_IMAGE_SIGNED}"
-			mv "${TMP_KERNEL_IMAGE_SIGNED}" "${KERNEL_IMAGE}"
-		done
+	for type in ${KERNEL_IMAGETYPES}; do
+		KERNEL_IMAGE="${type}-${KERNEL_IMAGE_NAME}.bin"
+		if [ "${type}" = "Image.gz" ]; then
+			# Sign the uncompressed Image
+			KERNEL_IMAGE=${WORKDIR}/build/arch/arm64/boot/Image
+		fi
 
-		# Sign/encrypt the device tree blobs
-		for DTB in ${KERNEL_DEVICETREE}; do
-			DTB=`normalize_dtb "${DTB}"`
-			DTB_EXT=${DTB##*.}
-			DTB_BASE_NAME=`basename ${DTB} ."${DTB_EXT}"`
-			DTB_IMAGE="${DTB_BASE_NAME}-${KERNEL_IMAGE_NAME}.${DTB_EXT}"
-			TMP_DTB_IMAGE_SIGNED="$(mktemp ${DTB_IMAGE}-signed.XXXXXX)"
-			trustfence-sign-kernel.sh -p "${DIGI_FAMILY}" -d "${DTB_IMAGE}" "${TMP_DTB_IMAGE_SIGNED}"
-			mv "${TMP_DTB_IMAGE_SIGNED}" "${DTB_IMAGE}"
-		done
-	elif [ "${TRUSTFENCE_SIGN_MODE}" = "AHAB" ]; then
-		# Sign the kernel images
-		for type in ${KERNEL_IMAGETYPES}; do
-			KERNEL_IMAGE="${type}-${KERNEL_IMAGE_NAME}.bin"
-			mkimage_imx8 -soc ${MX8_SOC_VAR} -rev ${MX8_CHIP_REV} -c -ap ${WORKDIR}/build/arch/arm64/boot/Image a35 ${RAM_CONTAINER_LOC_BOOT} -out flash_os.bin
-			trustfence-sign-kernel.sh -p "${DIGI_FAMILY}" -l "flash_os.bin" "${type}-${MACHINE}-signed.bin"
-			gzip ${type}-${MACHINE}-signed.bin
-			mv ${type}-${MACHINE}-signed.bin.gz "${KERNEL_IMAGE}"
-		done
+		TMP_KERNEL_IMAGE_SIGNED="$(mktemp ${KERNEL_IMAGE}-signed.XXXXXX)"
+		trustfence-sign-artifact.sh -p "${DIGI_FAMILY}" -l "${KERNEL_IMAGE}" "${TMP_KERNEL_IMAGE_SIGNED}"
 
-		# Sign/encrypt the device tree blobs
-		for DTB in ${KERNEL_DEVICETREE}; do
-			DTB=`normalize_dtb "${DTB}"`
-			DTB_EXT=${DTB##*.}
-			DTB_BASE_NAME=`basename ${DTB} ."${DTB_EXT}"`
-			DTB_IMAGE="${DTB_BASE_NAME}-${KERNEL_IMAGE_NAME}.${DTB_EXT}"
-			mkimage_imx8 -soc ${MX8_SOC_VAR} -rev ${MX8_CHIP_REV} -c -ap ${DTB_IMAGE} a35 ${RAM_CONTAINER_LOC_DTB} -out ${DTB_IMAGE}-mkimg-signed
-			trustfence-sign-kernel.sh -p "${DIGI_FAMILY}" -d "${DTB_IMAGE}-mkimg-signed" "${DTB_IMAGE}-signed"
-			mv "${DTB_IMAGE}-signed" "${DTB_IMAGE}"
-			rm -f ${DTB_IMAGE}-mkimg-signed
-		done
-	else
-		bberror "Unkown TRUSTFENCE_SIGN_MODE value"
-		exit 1
-	fi
+		if [ "${type}" = "Image.gz" ]; then
+			# Compress the signed Image and restore the original filename
+			gzip "${TMP_KERNEL_IMAGE_SIGNED}"
+			mv "${TMP_KERNEL_IMAGE_SIGNED}.gz" "${TMP_KERNEL_IMAGE_SIGNED}"
+			KERNEL_IMAGE="${type}-${KERNEL_IMAGE_NAME}.bin"
+		fi
+
+		mv "${TMP_KERNEL_IMAGE_SIGNED}" "${KERNEL_IMAGE}"
+	done
+
+	# Sign/encrypt the device tree blobs
+	for DTB in ${KERNEL_DEVICETREE}; do
+		DTB=`normalize_dtb "${DTB}"`
+		DTB_EXT=${DTB##*.}
+		DTB_BASE_NAME=`basename ${DTB} ."${DTB_EXT}"`
+		DTB_IMAGE="${DTB_BASE_NAME}-${KERNEL_IMAGE_NAME}.${DTB_EXT}"
+
+		TMP_DTB_IMAGE_SIGNED="$(mktemp ${DTB_IMAGE}-signed.XXXXXX)"
+		if [ "${DTB_EXT}" = "dtbo" ]; then
+			trustfence-sign-artifact.sh -p "${DIGI_FAMILY}" -o "${DTB_IMAGE}" "${TMP_DTB_IMAGE_SIGNED}"
+		else
+			trustfence-sign-artifact.sh -p "${DIGI_FAMILY}" -d "${DTB_IMAGE}" "${TMP_DTB_IMAGE_SIGNED}"
+		fi
+		mv "${TMP_DTB_IMAGE_SIGNED}" "${DTB_IMAGE}"
+	done
 }
 trustfence_sign[dirs] = "${DEPLOYDIR}"
 
diff --git a/meta-digi-dey/recipes-connectivity/packagegroups/packagegroup-dey-wireless.bb b/meta-digi-dey/recipes-connectivity/packagegroups/packagegroup-dey-wireless.bb
index 369d627c4..c3ec1f8a8 100644
--- a/meta-digi-dey/recipes-connectivity/packagegroups/packagegroup-dey-wireless.bb
+++ b/meta-digi-dey/recipes-connectivity/packagegroups/packagegroup-dey-wireless.bb
@@ -7,12 +7,14 @@ PACKAGE_ARCH = "${MACHINE_ARCH}"
 inherit packagegroup
 
 RDEPENDS_${PN} = "\
-    crda \
     hostapd \
     iw \
+    wireless-regdb-static \
     wpa-supplicant \
     wpa-supplicant-cli \
     wpa-supplicant-passphrase \
 "
 
 RDEPENDS_${PN}_remove_ccimx6sbc = "hostapd"
+RDEPENDS_${PN}_remove_ccimx6 = "wireless-regdb-static"
+RDEPENDS_${PN}_append_ccimx6 = " crda"
diff --git a/meta-digi-dey/recipes-core/recovery/recovery-initramfs/recovery-initramfs-init b/meta-digi-dey/recipes-core/recovery/recovery-initramfs/recovery-initramfs-init
index f3b74bd0e..02c590551 100644
--- a/meta-digi-dey/recipes-core/recovery/recovery-initramfs/recovery-initramfs-init
+++ b/meta-digi-dey/recipes-core/recovery/recovery-initramfs/recovery-initramfs-init
@@ -374,17 +374,14 @@ mount -t sysfs sysfs /sys
 mount -t devtmpfs devtmpfs /dev
 mount -t tmpfs tmpfs /tmp
 
-# Register mdev as device manager
-if [ -f /proc/sys/kernel/hotplug ]; then
-	echo > /dev/mdev.seq
-	echo > /dev/mdev.log
-	echo "/sbin/mdev" > /proc/sys/kernel/hotplug
-	mdev -s
-fi
-
-# Give some time for the devices to settle down
+# Give some time for the devices to settle down so mdev can mount all of them
 sleep 2
 
+# Register mdev as device manager
+echo > /dev/mdev.seq
+echo > /dev/mdev.log
+mdev -s
+
 # Run all shell scripts in postinstall folder
 run-parts /etc/*-postinsts
 
diff --git a/meta-digi-dey/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.16.imx.bb b/meta-digi-dey/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.16.imx.bb
index 4498f4386..0883c8543 100644
--- a/meta-digi-dey/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.16.imx.bb
+++ b/meta-digi-dey/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.16.imx.bb
@@ -1,4 +1,4 @@
-require recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.16.1.bb
+require recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.16.2.bb
 
 DEPENDS += "jpeg libdrm"
 DEPENDS_append_imxgpu2d = " virtual/libg2d"
diff --git a/meta-digi-dey/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.16.imx.bb b/meta-digi-dey/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.16.imx.bb
index 37f47564a..f88b7e5b0 100644
--- a/meta-digi-dey/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.16.imx.bb
+++ b/meta-digi-dey/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.16.imx.bb
@@ -1,4 +1,4 @@
-require recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.16.1.bb
+require recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.16.2.bb
 
 PV = "1.16.0.imx"
 
diff --git a/meta-digi-dey/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.16.imx.bb b/meta-digi-dey/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.16.imx.bb
index 47b9104c7..ca4ff3323 100644
--- a/meta-digi-dey/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.16.imx.bb
+++ b/meta-digi-dey/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.16.imx.bb
@@ -1,4 +1,4 @@
-require recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.16.1.bb
+require recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.16.2.bb
 
 PV = "1.16.0.imx"
 
diff --git a/meta-digi-dey/recipes-multimedia/gstreamer/gstreamer1.0_1.16.imx.bb b/meta-digi-dey/recipes-multimedia/gstreamer/gstreamer1.0_1.16.imx.bb
index 25ee5337f..99595498f 100644
--- a/meta-digi-dey/recipes-multimedia/gstreamer/gstreamer1.0_1.16.imx.bb
+++ b/meta-digi-dey/recipes-multimedia/gstreamer/gstreamer1.0_1.16.imx.bb
@@ -1,4 +1,4 @@
-require recipes-multimedia/gstreamer/gstreamer1.0_1.16.1.bb
+require recipes-multimedia/gstreamer/gstreamer1.0_1.16.2.bb
 
 PV = "1.16.0.imx"
 
diff --git a/meta-digi-dey/recipes-qt/qt5/gstreamer1.0-plugins-good-qt_1.16.imx.bb b/meta-digi-dey/recipes-qt/qt5/gstreamer1.0-plugins-good-qt_1.16.imx.bb
index 393a92069..12573ba39 100644
--- a/meta-digi-dey/recipes-qt/qt5/gstreamer1.0-plugins-good-qt_1.16.imx.bb
+++ b/meta-digi-dey/recipes-qt/qt5/gstreamer1.0-plugins-good-qt_1.16.imx.bb
@@ -1,4 +1,4 @@
-require recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.16.1.bb
+require recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.16.2.bb
 
 FILESEXTRAPATHS_prepend := "${COREBASE}/meta/recipes-multimedia/gstreamer/files:"
 
diff --git a/meta-digi-dey/recipes-qt/qt5/qtbase_%.bbappend b/meta-digi-dey/recipes-qt/qt5/qtbase_%.bbappend
index 0613b8b63..aebffbf37 100644
--- a/meta-digi-dey/recipes-qt/qt5/qtbase_%.bbappend
+++ b/meta-digi-dey/recipes-qt/qt5/qtbase_%.bbappend
@@ -14,14 +14,6 @@ IMX_BACKEND = \
 SRC_URI_append = " \
     file://qt5-${IMX_BACKEND}.sh \
 "
-# Technically, we should add the following patches to imxgpu platforms, but
-# doing so duplicates them for imxgpu2d platforms and causes build errors.
-# As of now, the only SoC that is imxgpu and not imxgpu2d is the i.MX8MN, so
-# append the patches to that SoC only.
-SRC_URI_append_mx8mn = " \
-    file://0014-Add-IMX-GPU-support.patch \
-    file://0001-egl.prf-Fix-build-error-when-egl-headers-need-platfo.patch \
-"
 SRC_URI_append_imxgpu3d = " \
     ${@bb.utils.contains('DISTRO_FEATURES', 'x11', \
         '', \
diff --git a/meta-digi-dey/recipes-support/libp11/libp11_0.4.10.bb b/meta-digi-dey/recipes-support/libp11/libp11_0.4.10.bb
deleted file mode 100644
index b40223e8a..000000000
--- a/meta-digi-dey/recipes-support/libp11/libp11_0.4.10.bb
+++ /dev/null
@@ -1,26 +0,0 @@
-SUMMARY = "Library for using PKCS"
-DESCRIPTION = "\
-Libp11 is a library implementing a small layer on top of PKCS \
-make using PKCS"
-HOMEPAGE = "https://github.com/OpenSC/libp11"
-BUGTRACKER = "https://github.com/OpenSC/libp11/issues"
-SECTION = "Development/Libraries"
-LICENSE = "LGPLv2+"
-LIC_FILES_CHKSUM = "file://COPYING;md5=fad9b3332be894bab9bc501572864b29"
-DEPENDS = "libtool openssl"
-
-SRC_URI = "git://github.com/OpenSC/libp11.git"
-SRCREV = "973d31f3f58d5549ddd8b1f822ce8f72186f9d68"
-
-S = "${WORKDIR}/git"
-
-inherit autotools pkgconfig
-
-EXTRA_OECONF = "--disable-static"
-
-do_install_append () {
-    rm -rf ${D}${docdir}/${BPN}
-}
-
-FILES_${PN} += "${libdir}/engines*/pkcs11.so"
-FILES_${PN}-dev += "${libdir}/engines*/libpkcs11${SOLIBSDEV}"
diff --git a/sdk/build.sh b/sdk/build.sh
index bccf7344d..bc89ce535 100755
--- a/sdk/build.sh
+++ b/sdk/build.sh
@@ -186,7 +186,7 @@ _EOF_
 
 YOCTO_IMGS_DIR="${WORKSPACE}/images"
 YOCTO_INST_DIR="${WORKSPACE}/digi-yocto-sdk.$(echo ${DY_REVISION} | tr '/' '_')"
-YOCTO_DOWNLOAD_DIR="${WORKSPACE}/downloads"
+YOCTO_DOWNLOAD_DIR="${DY_DOWNLOADS:-${WORKSPACE}}/downloads"
 YOCTO_PROJ_DIR="${WORKSPACE}/projects"
 
 CPUS="$(grep -c processor /proc/cpuinfo)"