This commit updates the secure boot support for STM platforms based on the
STM32 MPU Ecosystem v6.1.1. It introduces support for encrypted boot artifacts,
including TF-A and FIP for the ConnectCore MP13 platform.
https://onedigi.atlassian.net/browse/DEL-8535
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
Kernel commit b6ae6fee73eab568ba49a4a489fdac6bb5027997 removed the
RTO-based flush logic in stm32-usart.
As a result, the RT patch no longer applies cleanly because it
modifies the receive_chars() call using the old context.
Update the RT patch to match the new baseline while preserving
the PREEMPT_RT locking changes.
https://onedigi.atlassian.net/browse/DEL-10000
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
The fragment-07-rt-sysvinit.config disables several cgroup
controllers (PIDS, CPUACCT, DEVICE, FREEZER, etc.) and is
intended for minimal RT configurations using sysvinit.
It is currently applied unconditionally for STM32MP RT builds,
including systemd-based systems. This breaks container runtimes
such as podman, which require full cgroup support (notably
CONFIG_CGROUP_PIDS) when running on PREEMPT_RT kernels.
Apply the sysvinit RT fragment only when the 'sysvinit'
DISTRO_FEATURE is enabled, leaving systemd configurations
unaffected.
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
Warn when the deprecated TRUSTFENCE_DEK_PATH variable is detected, and fail the
build if it is used to disable artifact encryption. This prevents accidental
wrong compilations and guides users to replacement variables.
https://onedigi.atlassian.net/browse/DEL-9929
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
Add libcamera from NXP’s lf-6.12.49_2.2.0 release, and enable libcamera
gstreamer support for ccimx95.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
ETHOS_U_PKGS appended packages are already set in the bitbake recipe,
so there is no need to add them also in this bbappend.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
The ConnectCore 95 SMARC module has an MCA so we need to
build the mca-tool for this platform.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
Due to GPIO1 port belongs to the Always-ON (AON) domain and probed last,
port GPIO4 is probed as gpio2.
Signed-off-by: Francisco Gil <francisco.gilmartinez@digi.com>
CONFIG_BRIDGE_NETFILTER depends on CONFIG_NETFILTER_ADVANCED.
Some platforms enable this support, while others do not, so add it as an
explicit dependency.
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
This commit add secure storage service and helper
script to setup the secure storage at boot up.
Signed-off-by: Mike Engel <Mike.Engel@digi.com>
https://onedigi.atlassian.net/browse/DEL-9891
This commit updates the firmware binaries for Bluetooth and Wireless interfaces,
aligned with the Cypress Linux WiFi Driver (FMAC) release v6.1.145-2026_0108.
The updated wireless firmware versions are as follows:
- 2FY Wireless chip: v28.10.590.3
- 2EC Wireless chip: v18.53.546.29
These updates are included as part of the imx-styhead-longma_r1.0 Murata release.
https://onedigi.atlassian.net/browse/DEL-9960
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
Add IEEE 802.11ax (HE) support to enable High Efficiency capabilities when
operating in the 6 GHz band.
https://onedigi.atlassian.net/browse/DEL-9952
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
Optimize the script to remove unneeded code.
As the BT_REG_ON is managed by the driver, the REG_POWER_ON is not
needed at all.
Loading the hci_uart pulls btbcm, so no need to load it explicitly.
https://onedigi.atlassian.net/browse/DEL-9949
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
Consolidate the init script for platforms based on the same driver with
the same logic.
The btbmc and hciuart drivers are used in the ccmp1 and cc95.
The btnxpuart driver is used in the cc91 and cc93.
The btdigi driver is used in the cc8 platforms with the qca65x4 driver.
https://onedigi.atlassian.net/browse/DEL-9949
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
The ConnectCore 95 SOM v2 uses the Murata 2EC wireless combo chip, so this
confirmation includes the firmware recipe for Bluetooth initialization.
https://onedigi.atlassian.net/browse/DEL-9949
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
The i.MX91 does not include an NPU; only the i.MX93 does.
Remove the Ethos-U firmware support that was accidentally added during
code reorganization.
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
While BTRFS can be useful on server-class systems (e.g. RAID-based or
snapshot-heavy setups), enabling it unconditionally is not appropriate
for typical embedded systems. It introduces unnecessary kernel
complexity, pulls in RAID6 support, and increases kernel boot time by
approximately 0.7 seconds.
This reverts commit 503e50f392.
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
ccimx6 was the only platform using wpa_supplicant instead of hostapd for
SoftAP configuration, requiring additional platform-specific logic.
Since SoftAP works correctly with hostapd, drop the wpa_supplicant path
and unify the AP implementation across platforms.
https://onedigi.atlassian.net/browse/DEL-9923
Signed-off-by: Francisco Gil <francisco.gilmartinez@digi.com>
Revert patch. This is covered in Linux DT directly for SOM v2.
This reverts commit 8f7ece342d.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
Some of the hardware settings that were common between the cc93/cc91 SOMs
and DVK are not common for the cc95.
This commit moves those defines from common ccimx9.inc to each specific
machine configuration file.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
Blacklist the Bluetooth kernel module for CC95 (hci_uart) to let user
space bluetooth-init script load/unload it.
While on it, group blacklisting of all platforms using Murata chipsets.
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
For SOM v2, the Wi-Fi chipset has been changed, which requires
overlays that are specific to cc95, different than the ones
for cc93/cc91.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
https://onedigi.atlassian.net/browse/DEL-9915
Use the SDMA firmware provided by linux-firmware for i.MX6 and i.MX8
platforms. The SDMA blobs shipped in linux-firmware and firmware-imx are
identical, so just use the upstream ones as meta-freescale does.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Version 1.14.0 is no longer available, as meta-openembedded updated it
to version 1.14.1. Update our preferred version using a wildcard.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Enable signed firmware to prevent unauthenticated code on the Cortex-M4
co-processor by verifying images against custom public key from OP-TEE.
https://onedigi.atlassian.net/browse/DEL-9920
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
Add RSA key generation support for the Cortex-M4 co-processor on
ConnectCore MP15 platforms as part of DEY TrustFence framework.
https://onedigi.atlassian.net/browse/DEL-9920
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
Select the proper OP-TEE board configuration in the optee-os-stm32mp recipe so
trusted applications are built/exported correctly in the SDK. Without this
change, the build may choose a different MACHINE and trigger unexpected
compilation issues.
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
This commit adds a retry to the swu_package_path function of
the recovery-initramfs-init script. It has been seen that
with some USB memory stick a retry is necessary to mount
the external storage device containing the SWU package.
If the SWU package file is found before the max retries
is reached the loop will be exited and the SWU installation
will start. If max retry is reached and the SWU package
wasn't found it finishes with an error.
Signed-off-by: Mike Engel <Mike.Engel@digi.com>
https://onedigi.atlassian.net/browse/DEL-9908
Introduce a dynamic layer to integrate X-LINUX-ISP v6.1.0 ST layer into DEY,
providing ISP image quality software, tools, and example applications for
STM32MP25x series.
https://onedigi.atlassian.net/browse/DEL-9890
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
In previous versions of swupdate, only one SIGALG_* option could be chosen at
build-time, with SIGALG_RAWRSA being the default option. However, in 2025.12,
multiple SIGALG_* options can now be configured at build-time, allowing users
to choose the signature verification algorithm used at runtime via the
"digest-provider" parameter. We weren't explicitly setting any of these
algorithms in our defconfig, so the resulting builds didn't have any digest
providers, causing swupdate to fail early on when signed images are enabled.
To restore the behavior of previous swupdate versions, explicitly enable
SIGALG_RAWRSA when signed images are enabled. Since we only enable one digest
provider, it will be chosen automatically, without having to explicitly set the
"digest-provider" parameter at runtime.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
robin
Arturo Buzarra
Isaac Hermida
Javier Viguera
Hector Palacios
Francisco Gil
Mike Engel
Gonzalo Ruiz
Gabriel Valcazar