diff --git a/meta-arm/.gitlab-ci.yml b/meta-arm/.gitlab-ci.yml
index 22ecfd7..e1b8dd2 100644
--- a/meta-arm/.gitlab-ci.yml
+++ b/meta-arm/.gitlab-ci.yml
@@ -1,16 +1,26 @@
 image: ${MIRROR_GHCR}/siemens/kas/kas:4.0
 
 variables:
-  CPU_REQUEST: ""
-  DEFAULT_TAG: ""
-  CACHE_DIR: $CI_BUILDS_DIR/persist
-  MIRROR_GHCR: ghcr.io
-  # These are needed as the k8s executor doesn't respect the container entrypoint
-  # by default
+  # These are needed as the k8s executor doesn't respect the container
+  # entrypoint by default
   FF_KUBERNETES_HONOR_ENTRYPOINT: 1
   FF_USE_LEGACY_KUBERNETES_EXECUTION_STRATEGY: 0
-  ACS_TEST: 0
+  # The default value for KUBERNETES_CPU_REQUEST
+  CPU_REQUEST: ""
+  # The default machine tag for the build jobs
+  DEFAULT_TAG: ""
+  # The machine tag for the ACS test jobs
   ACS_TAG: ""
+  # The directory to use as the persistent cache (the root for DL_DIR, SSTATE_DIR, etc)
+  CACHE_DIR: $CI_BUILDS_DIR/persist
+  # The container mirror to use
+  MIRROR_GHCR: ghcr.io
+  # Whether to run the SystemReady ACS tests
+  ACS_TEST: 0
+  # The list of extra Kas fragments to be used when building
+  EXTRA_KAS_FILES: ""
+  # The NVD API key to use when fetching CVEs
+  NVDCVE_API_KEY: ""
 
 stages:
   - prep
@@ -61,7 +71,7 @@
     # Catch all for everything else
     - if: '$KERNEL != "linux-yocto-dev"'
   script:
-    - KASFILES=$(./ci/jobs-to-kas "$CI_JOB_NAME"):lockfile.yml
+    - KASFILES=$(./ci/jobs-to-kas "$CI_JOB_NAME" $EXTRA_KAS_FILES):lockfile.yml
     - kas dump --update --force-checkout --resolve-refs --resolve-env $KASFILES
     - kas build $KASFILES
     - ./ci/check-warnings $KAS_WORK_DIR/build/warnings.log
diff --git a/meta-arm/ci/corstone1000-common.yml b/meta-arm/ci/corstone1000-common.yml
index 0947228..5720b78 100644
--- a/meta-arm/ci/corstone1000-common.yml
+++ b/meta-arm/ci/corstone1000-common.yml
@@ -3,13 +3,40 @@
   includes:
     - ci/base.yml
     - ci/meta-openembedded.yml
-    - ci/poky-tiny.yml
     - ci/meta-secure-core.yml
 
 local_conf_header:
-    extrapackages: |
+  extrapackages: |
     # Intentionally blank to prevent perf from being added to the image in base.yml
 
+  distrosetup: |
+    DISTRO_FEATURES = "usbhost ipv4"
+
+  initramfsetup: |
+    # Telling the build system which image is responsible of the generation of the initramfs rootfs
+    INITRAMFS_IMAGE_BUNDLE = "1"
+    INITRAMFS_IMAGE ?= "core-image-minimal"
+    IMAGE_FSTYPES = "${INITRAMFS_FSTYPES}"
+    IMAGE_NAME_SUFFIX = ""
+
+    # enable mdev/busybox for init
+    INIT_MANAGER = "mdev-busybox"
+    VIRTUAL-RUNTIME_init_manager = "busybox"
+
+    # prevent the kernel image from being included in the intramfs rootfs
+    PACKAGE_EXCLUDE += "kernel-image-*"
+    # Don't include kernel binary in rootfs /boot path
+    RRECOMMENDS:${KERNEL_PACKAGE_NAME}-base = ""
+
+    # Disable openssl in kmod to shrink the initramfs size
+    PACKAGECONFIG:remove:pn-kmod = "openssl"
+
+    # all optee packages
+    IMAGE_INSTALL += "optee-client"
+
+    # TS PSA API tests commands for crypto, its, ps and iat
+    IMAGE_INSTALL += "packagegroup-ts-tests-psa"
+
 target:
-  - corstone1000-image
+  - corstone1000-flash-firmware-image
   - perf
diff --git a/meta-arm/ci/cve.yml b/meta-arm/ci/cve.yml
new file mode 100644
index 0000000..e2aca0e
--- /dev/null
+++ b/meta-arm/ci/cve.yml
@@ -0,0 +1,19 @@
+header:
+  version: 14
+
+local_conf_header:
+  cve: |
+    INHERIT += "cve-check"
+
+    # Allow the runner environment to provide an API key
+    NVDCVE_API_KEY = "${@d.getVar('BB_ORIGENV').getVar('NVDCVE_API_KEY') or ''}"
+
+    # Just show the warnings for our layers
+    CVE_CHECK_SHOW_WARNINGS = "0"
+    CVE_CHECK_SHOW_WARNINGS:layer-arm-toolchain = "1"
+    CVE_CHECK_SHOW_WARNINGS:layer-meta-arm = "1"
+    CVE_CHECK_SHOW_WARNINGS:layer-meta-arm-bsp = "1"
+    CVE_CHECK_SHOW_WARNINGS:layer-meta-arm-systemready = "1"
+
+    # Ignore the kernel, we sometime carry kernels in meta-arm
+    CVE_CHECK_SHOW_WARNINGS:pn-linux-yocto = "0"
diff --git a/meta-arm/ci/jobs-to-kas b/meta-arm/ci/jobs-to-kas
index eea6e46..df81c2e 100755
--- a/meta-arm/ci/jobs-to-kas
+++ b/meta-arm/ci/jobs-to-kas
@@ -3,17 +3,28 @@
 # This script is expecting an input of machine name, optionally followed by a
 # colon and a list of one or more parameters separated by commas between
 # brackets.  For example, the following are acceptable:
-# corstone1000-mps3
-# fvp-base: [testimage]
-# qemuarm64-secureboot: [clang, glibc, testimage]
+#   corstone1000-mps3
+#   fvp-base: [testimage]
+#   qemuarm64-secureboot: [clang, glibc, testimage]
+# This argument should be quoted to avoid expansion and to be handled
+# as a single value.
+#
+# Any further arguments will be handled as further yml file basenames.
 #
 # Turn this list into a series of yml files separated by colons to pass to kas
 
 set -e -u
 
-FILES="ci/$(echo $1 | cut -d ':' -f 1).yml"
+# First, parse the GitLab CI job name (CI_JOB_NAME via $1) and accumulate a list
+# of Kas files.
+JOBNAME="$1"
+shift
 
-for i in $(echo $1 | cut -s -d ':' -f 2 | sed 's/[][,]//g'); do
+# The base name of the job
+FILES="ci/$(echo $JOBNAME | cut -d ':' -f 1).yml"
+
+# The list of matrix variations
+for i in $(echo $JOBNAME | cut -s -d ':' -f 2 | sed 's/[][,]//g'); do
 	# Given that there are no yml files for gcc or glibc, as those are the
 	# defaults, we can simply ignore those parameters.  They are necessary
 	# to pass in so that matrix can correctly setup all of the permutations
@@ -24,4 +35,9 @@
 	FILES+=":ci/$i.yml"
 done
 
+# Now pick up any further names
+for i in $*; do
+	FILES+=":ci/$i.yml"
+done
+
 echo $FILES
diff --git a/meta-arm/ci/meta-virtualization.yml b/meta-arm/ci/meta-virtualization.yml
index 88f8cdc..f0f6280 100644
--- a/meta-arm/ci/meta-virtualization.yml
+++ b/meta-arm/ci/meta-virtualization.yml
@@ -5,4 +5,4 @@
 
 repos:
   meta-virtualization:
-    url: git://git.yoctoproject.org/meta-virtualization
+    url: https://git.yoctoproject.org/meta-virtualization
diff --git a/meta-arm/meta-arm-bsp/conf/layer.conf b/meta-arm/meta-arm-bsp/conf/layer.conf
index 71f64d9..543b8c2 100644
--- a/meta-arm/meta-arm-bsp/conf/layer.conf
+++ b/meta-arm/meta-arm-bsp/conf/layer.conf
@@ -9,7 +9,7 @@
 BBFILE_PATTERN_meta-arm-bsp = "^${LAYERDIR}/"
 BBFILE_PRIORITY_meta-arm-bsp = "5"
 
-LAYERSERIES_COMPAT_meta-arm-bsp = "nanbield"
+LAYERSERIES_COMPAT_meta-arm-bsp = "nanbield scarthgap"
 
 LAYERDEPENDS_meta-arm-bsp = "core meta-arm"
 # This won't be used by layerindex-fetch, but works everywhere else
diff --git a/meta-arm/meta-arm-bsp/conf/machine/include/corstone1000.inc b/meta-arm/meta-arm-bsp/conf/machine/include/corstone1000.inc
index d03c23c..373dd04 100644
--- a/meta-arm/meta-arm-bsp/conf/machine/include/corstone1000.inc
+++ b/meta-arm/meta-arm-bsp/conf/machine/include/corstone1000.inc
@@ -2,82 +2,49 @@
 
 MACHINEOVERRIDES =. "corstone1000:"
 
+# TF-M
+PREFERRED_VERSION_trusted-firmware-m ?= "1.8.%"
+
 # TF-A
 TFA_PLATFORM = "corstone1000"
-EXTRA_IMAGEDEPENDS += "trusted-firmware-a"
 PREFERRED_VERSION_trusted-firmware-a ?= "2.9.%"
 PREFERRED_VERSION_tf-a-tests ?= "2.8.%"
 
 TFA_BL2_BINARY = "bl2-corstone1000.bin"
 TFA_FIP_BINARY = "fip-corstone1000.bin"
 
-# TF-M
-EXTRA_IMAGEDEPENDS += "trusted-firmware-m"
-PREFERRED_VERSION_trusted-firmware-m ?= "1.8.%"
+# optee
+PREFERRED_VERSION_optee-os ?= "4.1.%"
 
-# TF-M settings for signing host images
-TFA_BL2_RE_IMAGE_LOAD_ADDRESS = "0x62353000"
-TFA_BL2_RE_SIGN_BIN_SIZE = "0x2d000"
-TFA_FIP_RE_IMAGE_LOAD_ADDRESS = "0x68130000"
-TFA_FIP_RE_SIGN_BIN_SIZE = "0x00200000"
-RE_LAYOUT_WRAPPER_VERSION = "0.0.7"
-TFM_SIGN_PRIVATE_KEY = "${libdir}/tfm-scripts/root-RSA-3072_1.pem"
-RE_IMAGE_OFFSET = "0x1000"
+# Trusted Services
+TS_PLATFORM = "arm/corstone1000"
+TS_SP_SE_PROXY_CONFIG = "corstone1000"
+# Include smm-gateway and se-proxy SPs into optee-os binary
+MACHINE_FEATURES += "ts-smm-gateway ts-se-proxy"
 
 # u-boot
 PREFERRED_VERSION_u-boot ?= "2023.07%"
-EXTRA_IMAGEDEPENDS += "u-boot"
+MACHINE_FEATURES += "efi"
+EFI_PROVIDER ?= "grub-efi"
 
-UBOOT_CONFIG ??= "EFI"
-UBOOT_CONFIG[EFI] = "corstone1000_defconfig"
-UBOOT_ENTRYPOINT  = "0x80000000"
-UBOOT_LOADADDRESS = "0x80000000"
-UBOOT_BOOTARGS = "earlycon=pl011,0x1a510000 console=ttyAMA0 loglevel=9"
-UBOOT_ARCH = "arm"
-UBOOT_EXTLINUX = "0"
-
-#optee
-PREFERRED_VERSION_optee-os ?= "4.0.%"
-PREFERRED_VERSION_optee-client ?= "3.22%"
-EXTRA_IMAGEDEPENDS += "optee-os"
-OPTEE_ARCH = "arm64"
-OPTEE_BINARY = "tee-pager_v2.bin"
-
-# Include smm-gateway and se-proxy SPs into optee-os binary
-MACHINE_FEATURES += "ts-smm-gateway ts-se-proxy"
-TS_PLATFORM = "arm/corstone1000"
-TS_SP_SE_PROXY_CONFIG = "corstone1000"
-
-# External System(Cortex-M3)
-EXTRA_IMAGEDEPENDS += "external-system"
+# Grub
+LINUX_KERNEL_ARGS ?= "earlycon=pl011,0x1a510000 console=ttyAMA0,115200"
+GRUB_LINUX_APPEND ?= "${LINUX_KERNEL_ARGS}"
+IMAGE_CMD:wic[vardeps] += "GRUB_LINUX_APPEND"
 
 # Linux kernel
-PREFERRED_PROVIDER_virtual/kernel:forcevariable = "linux-yocto"
-PREFERRED_VERSION_linux-yocto = "6.6.%"
+PREFERRED_PROVIDER_virtual/kernel ?= "linux-yocto"
+PREFERRED_VERSION_linux-yocto ?= "6.6.%"
 KERNEL_IMAGETYPE = "Image.gz"
-
-INITRAMFS_IMAGE_BUNDLE ?= "1"
-
-#telling the build system which image is responsible of the generation of the initramfs rootfs
-INITRAMFS_IMAGE = "corstone1000-initramfs-image"
-IMAGE_NAME_SUFFIX = ""
-
 # add FF-A support in the kernel
 MACHINE_FEATURES += "arm-ffa"
-
-# prevent the kernel image from being included in the intramfs rootfs
-PACKAGE_EXCLUDE = "kernel-image-*"
-
 # enable this feature for kernel debugging
 # MACHINE_FEATURES += "corstone1000_kernel_debug"
 
 # login terminal serial port settings
 SERIAL_CONSOLES ?= "115200;ttyAMA0"
 
+WKS_FILE ?= "corstone1000-flash-firmware.wks.in"
+
 # making sure EXTRA_IMAGEDEPENDS will be used while creating the image
 WKS_FILE_DEPENDS:append = " ${EXTRA_IMAGEDEPENDS}"
-
-WKS_FILE ?= "corstone1000-image.corstone1000.wks"
-
-# Disable openssl in kmod to shink the initramfs size
-PACKAGECONFIG:remove:pn-kmod = "openssl"
diff --git a/meta-arm/meta-arm-bsp/conf/machine/n1sdp.conf b/meta-arm/meta-arm-bsp/conf/machine/n1sdp.conf
index 79604ce..7ac1f02 100644
--- a/meta-arm/meta-arm-bsp/conf/machine/n1sdp.conf
+++ b/meta-arm/meta-arm-bsp/conf/machine/n1sdp.conf
@@ -28,6 +28,7 @@
 EXTRA_IMAGEDEPENDS += "trusted-firmware-a"
 TFA_PLATFORM = "n1sdp"
 PREFERRED_VERSION_trusted-firmware-a ?= "2.9.%"
+PREFERRED_VERSION_tf-a-tests ?= "2.10.%"
 
 # SCP
 EXTRA_IMAGEDEPENDS += "virtual/control-processor-firmware"
@@ -37,7 +38,10 @@
 PREFERRED_VERSION_edk2-firmware ?= "202305"
 
 #optee
-PREFERRED_VERSION_optee-os ?= "4.0.%"
+PREFERRED_VERSION_optee-os ?= "4.1.%"
+PREFERRED_VERSION_optee-os-tadevkit ?= "4.1.%"
+PREFERRED_VERSION_optee-test ?= "4.1.%"
+PREFERRED_VERSION_optee-client ?= "4.1.%"
 
 #grub-efi
 EFI_PROVIDER ?= "grub-efi"
diff --git a/meta-arm/meta-arm-bsp/documentation/corstone1000/user-guide.rst b/meta-arm/meta-arm-bsp/documentation/corstone1000/user-guide.rst
index 318cddf..a308e42 100644
--- a/meta-arm/meta-arm-bsp/documentation/corstone1000/user-guide.rst
+++ b/meta-arm/meta-arm-bsp/documentation/corstone1000/user-guide.rst
@@ -658,7 +658,7 @@
   cd meta-arm
   git am 0001-embedded-a-corstone1000-sr-ir-workaround.patch
   cd ..
-  kas shell meta-arm/kas/corstone1000-fvp.yml:meta-arm/ci/debug.yml -c="bitbake u-boot -c cleanall; bitbake trusted-firmware-a -c cleanall; corstone1000-image -c cleanall; bitbake corstone1000-image"
+  kas shell meta-arm/kas/corstone1000-fvp.yml:meta-arm/ci/debug.yml -c="bitbake u-boot -c cleanall; bitbake trusted-firmware-a -c cleanall; bitbake corstone1000-image -c cleanall; bitbake corstone1000-image"
 
 
 Common to FVP and FPGA
@@ -1080,7 +1080,7 @@
   cd <_workspace>/meta-arm
   git reset --hard HEAD~1
   cd ..
-  kas shell meta-arm/kas/corstone1000-fvp.yml:meta-arm/ci/debug.yml -c="bitbake u-boot -c cleanall; bitbake trusted-firmware-a -c cleanall; corstone1000-image -c cleanall; bitbake corstone1000-image"
+  kas shell meta-arm/kas/corstone1000-fvp.yml:meta-arm/ci/debug.yml -c="bitbake u-boot -c cleanall; bitbake trusted-firmware-a -c cleanall; bitbake corstone1000-image -c cleanall; bitbake corstone1000-image"
 
 *************************************************
 Preparing the Installation Media
diff --git a/meta-arm/meta-arm-bsp/recipes-bsp/images/corstone1000-flash-firmware-image.bb b/meta-arm/meta-arm-bsp/recipes-bsp/images/corstone1000-flash-firmware-image.bb
new file mode 100644
index 0000000..73fc176
--- /dev/null
+++ b/meta-arm/meta-arm-bsp/recipes-bsp/images/corstone1000-flash-firmware-image.bb
@@ -0,0 +1,58 @@
+SUMARY = "Corstone1000 platform Image"
+DESCRIPTION = "This is the main image which is the container of all the binaries \
+               generated for the Corstone1000 platform."
+LICENSE = "MIT"
+
+COMPATIBLE_MACHINE = "corstone1000"
+
+# IMAGE_FSTYPES must be set before 'inherit image'
+# https://docs.yoctoproject.org/ref-manual/variables.html#term-IMAGE_FSTYPES
+IMAGE_FSTYPES = "wic uefi_capsule"
+
+inherit image
+inherit tfm_sign_image
+inherit uefi_capsule
+
+DEPENDS += "external-system \
+            trusted-firmware-a \
+            trusted-firmware-m \
+"
+
+IMAGE_FEATURES = ""
+IMAGE_LINGUAS = ""
+
+PACKAGE_INSTALL = ""
+
+UEFI_FIRMWARE_BINARY = "${IMAGE_LINK_NAME}.${CAPSULE_IMGTYPE}"
+UEFI_CAPSULE_CONFIG = "${THISDIR}/files/${PN}-capsule-update-image.json"
+CAPSULE_IMGTYPE = "wic"
+
+# TF-A settings for signing host images
+TFA_BL2_BINARY = "bl2-corstone1000.bin"
+TFA_FIP_BINARY = "fip-corstone1000.bin"
+TFA_BL2_RE_IMAGE_LOAD_ADDRESS = "0x62353000"
+TFA_BL2_RE_SIGN_BIN_SIZE = "0x2d000"
+TFA_FIP_RE_IMAGE_LOAD_ADDRESS = "0x68130000"
+TFA_FIP_RE_SIGN_BIN_SIZE = "0x00200000"
+RE_LAYOUT_WRAPPER_VERSION = "0.0.7"
+TFM_SIGN_PRIVATE_KEY = "${libdir}/tfm-scripts/root-RSA-3072_1.pem"
+RE_IMAGE_OFFSET = "0x1000"
+
+do_sign_images() {
+    # Sign TF-A BL2
+    sign_host_image ${RECIPE_SYSROOT}/firmware/${TFA_BL2_BINARY} \
+        ${TFA_BL2_RE_IMAGE_LOAD_ADDRESS} ${TFA_BL2_RE_SIGN_BIN_SIZE}
+
+    # Update BL2 in the FIP image
+    cp ${RECIPE_SYSROOT}/firmware/${TFA_FIP_BINARY} .
+    fiptool update --tb-fw \
+        ${TFM_IMAGE_SIGN_DEPLOY_DIR}/signed_${TFA_BL2_BINARY} \
+        ${TFM_IMAGE_SIGN_DIR}/${TFA_FIP_BINARY}
+
+    # Sign the FIP image
+    sign_host_image ${TFM_IMAGE_SIGN_DIR}/${TFA_FIP_BINARY} \
+        ${TFA_FIP_RE_IMAGE_LOAD_ADDRESS} ${TFA_FIP_RE_SIGN_BIN_SIZE}
+}
+do_sign_images[depends] = "\
+    fiptool-native:do_populate_sysroot \
+    "
diff --git a/meta-arm/meta-arm-bsp/recipes-bsp/images/corstone1000-image.bb b/meta-arm/meta-arm-bsp/recipes-bsp/images/corstone1000-image.bb
deleted file mode 100644
index 714a57c..0000000
--- a/meta-arm/meta-arm-bsp/recipes-bsp/images/corstone1000-image.bb
+++ /dev/null
@@ -1,38 +0,0 @@
-SUMARY = "Corstone1000 platform Image"
-DESCRIPTION = "This is the main image which is the container of all the binaries \
-               generated for the Corstone1000 platform."
-LICENSE = "MIT"
-
-COMPATIBLE_MACHINE = "corstone1000"
-
-inherit image
-inherit tfm_sign_image
-inherit  uefi_capsule
-
-PACKAGE_INSTALL = ""
-
-IMAGE_FSTYPES += "wic uefi_capsule"
-
-UEFI_FIRMWARE_BINARY = "${PN}-${MACHINE}.${CAPSULE_IMGTYPE}"
-UEFI_CAPSULE_CONFIG = "${THISDIR}/files/${PN}-capsule-update-image.json"
-CAPSULE_IMGTYPE = "wic"
-
-do_sign_images() {
-    # Sign TF-A BL2
-    sign_host_image ${RECIPE_SYSROOT}/firmware/${TFA_BL2_BINARY} \
-        ${TFA_BL2_RE_IMAGE_LOAD_ADDRESS} ${TFA_BL2_RE_SIGN_BIN_SIZE}
-
-    # Update BL2 in the FIP image
-    cp ${RECIPE_SYSROOT}/firmware/${TFA_FIP_BINARY} .
-    fiptool update --tb-fw \
-        ${TFM_IMAGE_SIGN_DEPLOY_DIR}/signed_${TFA_BL2_BINARY} \
-        ${TFM_IMAGE_SIGN_DIR}/${TFA_FIP_BINARY}
-
-    # Sign the FIP image
-    sign_host_image ${TFM_IMAGE_SIGN_DIR}/${TFA_FIP_BINARY} \
-        ${TFA_FIP_RE_IMAGE_LOAD_ADDRESS} ${TFA_FIP_RE_SIGN_BIN_SIZE}
-}
-do_sign_images[depends] = "\
-    trusted-firmware-a:do_populate_sysroot \
-    fiptool-native:do_populate_sysroot \
-    "
diff --git a/meta-arm/meta-arm-bsp/recipes-bsp/images/corstone1000-initramfs-image.bb b/meta-arm/meta-arm-bsp/recipes-bsp/images/corstone1000-initramfs-image.bb
deleted file mode 100644
index cac3b73..0000000
--- a/meta-arm/meta-arm-bsp/recipes-bsp/images/corstone1000-initramfs-image.bb
+++ /dev/null
@@ -1,25 +0,0 @@
-SUMARY = "Corstone1000 platform Initramfs Image"
-DESCRIPTION = "This is the main Linux image which includes an initramfs kernel/rootfs bundle."
-
-LICENSE = "MIT"
-
-COMPATIBLE_MACHINE = "corstone1000"
-
-IMAGE_FSTYPES = "${INITRAMFS_FSTYPES}"
-
-inherit core-image
-
-# By default all basic packages required for a bootable system are installed
-# by core-image . These packages are: packagegroup-core-boot and
-# packagegroup-base-extended
-
-inherit image-buildinfo
-
-#package management is not supported in corstone1000
-IMAGE_FEATURES:remove = "package-management"
-
-# all optee packages
-IMAGE_INSTALL += "optee-client"
-
-# TS PSA API tests commands for crypto, its, ps and iat
-IMAGE_INSTALL += "packagegroup-ts-tests-psa"
diff --git a/meta-arm/meta-arm-bsp/recipes-bsp/images/files/corstone1000-image-capsule-update-image.json b/meta-arm/meta-arm-bsp/recipes-bsp/images/files/corstone1000-flash-firmware-image-capsule-update-image.json
similarity index 100%
rename from meta-arm/meta-arm-bsp/recipes-bsp/images/files/corstone1000-image-capsule-update-image.json
rename to meta-arm/meta-arm-bsp/recipes-bsp/images/files/corstone1000-flash-firmware-image-capsule-update-image.json
diff --git a/meta-arm/meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/0001-n1sdp-tftf-tests-to-skip.patch b/meta-arm/meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/0001-n1sdp-tftf-tests-to-skip.patch
new file mode 100644
index 0000000..b31567c
--- /dev/null
+++ b/meta-arm/meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/0001-n1sdp-tftf-tests-to-skip.patch
@@ -0,0 +1,46 @@
+From cc0153b56d634aa80b740be5afed15bedb94a2c9 Mon Sep 17 00:00:00 2001
+From: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
+Date: Tue, 23 Jan 2024 14:19:39 +0000
+Subject: [PATCH] n1sdp patch tests to skip
+
+Upstream-Status: Pending
+Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
+---
+ plat/arm/n1sdp/tests_to_skip.txt | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/plat/arm/n1sdp/tests_to_skip.txt b/plat/arm/n1sdp/tests_to_skip.txt
+index b6e87bf..1848408 100644
+--- a/plat/arm/n1sdp/tests_to_skip.txt
++++ b/plat/arm/n1sdp/tests_to_skip.txt
+@@ -11,7 +11,7 @@ SMMUv3 tests
+ PSCI CPU Suspend in OSI mode
+ 
+ # PSCI is enabled but not tested
+-PSCI STAT/Stats test cases after system suspend
++PSCI STAT
+ PSCI System Suspend Validation
+ 
+ # Disable FF-A Interrupt tests as TWDOG is not supported by TC platform
+@@ -25,9 +25,14 @@ FF-A Interrupt
+ # files in TFTF, since the port was done purely to test the spectre workaround
+ # performance impact. Once that was done no further work was done on the port.
+ 
+-Timer framework Validation/Target timer to a power down cpu
+-Timer framework Validation/Test scenario where multiple CPUs call same timeout
+-Timer framework Validation/Stress test the timer framework
++Timer framework Validation
+ PSCI Affinity Info/Affinity info level0 powerdown
+ PSCI CPU Suspend
+-PSCI STAT/for valid composite state CPU suspend
++Framework Validation/NVM serialisation
++Framework Validation/Events API
++Boot requirement tests
++CPU Hotplug
++ARM_ARCH_SVC/SMCCC_ARCH_WORKAROUND_1 test
++ARM_ARCH_SVC/SMCCC_ARCH_WORKAROUND_2 test
++ARM_ARCH_SVC/SMCCC_ARCH_WORKAROUND_3 test
++FF-A Power management
+-- 
+2.34.1
+
diff --git a/meta-arm/meta-arm-bsp/recipes-bsp/trusted-firmware-a/tf-a-tests_%.bbappend b/meta-arm/meta-arm-bsp/recipes-bsp/trusted-firmware-a/tf-a-tests_%.bbappend
index eef21b9..6421033 100644
--- a/meta-arm/meta-arm-bsp/recipes-bsp/trusted-firmware-a/tf-a-tests_%.bbappend
+++ b/meta-arm/meta-arm-bsp/recipes-bsp/trusted-firmware-a/tf-a-tests_%.bbappend
@@ -1,5 +1,7 @@
 # Machine specific TFAs
 
+FILESEXTRAPATHS:prepend := "${THISDIR}/files:"
+
 COMPATIBLE_MACHINE:corstone1000 = "corstone1000"
 SRCREV:corstone1000 = "5f591f67738a1bbe6b262c53d9dad46ed8bbcd67"
 EXTRA_OEMAKE:append:corstone1000 = " DEBUG=0"
@@ -7,3 +9,9 @@
 TFTF_MODE:corstone1000 = "release"
 
 COMPATIBLE_MACHINE:n1sdp = "n1sdp"
+EXTRA_OEMAKE:append:n1sdp = " DEBUG=1"
+EXTRA_OEMAKE:append:n1sdp = " LOG_LEVEL=50"
+TFTF_MODE:n1sdp = "debug"
+SRC_URI:append:n1sdp = " \
+			file://0001-n1sdp-tftf-tests-to-skip.patch \
+			"
diff --git a/meta-arm/meta-arm-bsp/recipes-bsp/u-boot/u-boot-corstone1000.inc b/meta-arm/meta-arm-bsp/recipes-bsp/u-boot/u-boot-corstone1000.inc
index b6b7a04..2585ff2 100644
--- a/meta-arm/meta-arm-bsp/recipes-bsp/u-boot/u-boot-corstone1000.inc
+++ b/meta-arm/meta-arm-bsp/recipes-bsp/u-boot/u-boot-corstone1000.inc
@@ -1,10 +1,18 @@
 # Corstone1000 specific U-boot support
 
-DEPENDS:append = " gnutls-native openssl-native efitools-native"
+DEPENDS:append = " openssl-native efitools-native"
 CORSTONE1000_DEVICE_TREE:corstone1000-mps3 = "corstone1000-mps3"
 CORSTONE1000_DEVICE_TREE:corstone1000-fvp = "corstone1000-fvp"
 EXTRA_OEMAKE:append = ' DEVICE_TREE=${CORSTONE1000_DEVICE_TREE}'
 
+UBOOT_CONFIG ??= "EFI"
+UBOOT_CONFIG[EFI] = "corstone1000_defconfig"
+UBOOT_ENTRYPOINT  = "0x80000000"
+UBOOT_LOADADDRESS = "0x80000000"
+UBOOT_BOOTARGS = "${LINUX_KERNEL_ARGS} loglevel=9"
+UBOOT_ARCH = "arm"
+UBOOT_EXTLINUX = "0"
+
 SYSROOT_DIRS:append = " /boot"
 
 SRC_URI:append = " \
@@ -52,12 +60,19 @@
     file://0042-corstone1000-enable-virtio-net-support.patch		  \
     "
 
-do_configure:append(){
+do_configure:append() {
     openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=CRT/ -keyout ${B}/CRT.key -out ${B}/CRT.crt -nodes -days 365
     cert-to-efi-sig-list ${B}/CRT.crt ${B}/corstone1000_defconfig/CRT.esl
 }
 
+FILES:${PN} += "/corstone1000_capsule_*"
 do_install:append() {
-   install -D -p -m 0644 ${B}/CRT.crt ${DEPLOY_DIR_IMAGE}/corstone1000_capsule_cert.crt
-   install -D -p -m 0644 ${B}/CRT.key ${DEPLOY_DIR_IMAGE}/corstone1000_capsule_key.key
+   install -D -p -m 0644 ${B}/CRT.crt ${D}/corstone1000_capsule_cert.crt
+   install -D -p -m 0644 ${B}/CRT.key ${D}/corstone1000_capsule_key.key
 }
+
+do_deploy:append(){
+   cp -Rf ${D}/corstone1000_capsule* ${DEPLOYDIR}/
+}
+
+addtask deploy after do_install
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/n1sdp/0001-plat-n1sdp-add-N1SDP-platform-support.patch b/meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/n1sdp/0001-plat-n1sdp-add-N1SDP-platform-support.patch
index 29623b0..3bb460a 100644
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/n1sdp/0001-plat-n1sdp-add-N1SDP-platform-support.patch
+++ b/meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/n1sdp/0001-plat-n1sdp-add-N1SDP-platform-support.patch
@@ -1,4 +1,4 @@
-From 33d86d23bcf2bbcb191e33e3130c3429650b9204 Mon Sep 17 00:00:00 2001
+From 56f2afcd10e8404a3c4efed6277a005fc4099e48 Mon Sep 17 00:00:00 2001
 From: Vishnu Banavath <vishnu.banavath@arm.com>
 Date: Thu, 30 Jun 2022 18:36:26 +0100
 Subject: [PATCH] plat-n1sdp: add N1SDP platform support
@@ -10,10 +10,23 @@
 
 Signed-off-by: Vishnu Banavath <vishnu.banavath@arm.com>
 Signed-off-by: Mariam Elshakfy <mariam.elshakfy@arm.com>
+Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
+---
+ core/arch/arm/plat-n1sdp/conf.mk           | 41 +++++++++++++++++
+ core/arch/arm/plat-n1sdp/main.c            | 53 ++++++++++++++++++++++
+ core/arch/arm/plat-n1sdp/n1sdp_core_pos.S  | 32 +++++++++++++
+ core/arch/arm/plat-n1sdp/platform_config.h | 49 ++++++++++++++++++++
+ core/arch/arm/plat-n1sdp/sub.mk            |  3 ++
+ 5 files changed, 178 insertions(+)
+ create mode 100644 core/arch/arm/plat-n1sdp/conf.mk
+ create mode 100644 core/arch/arm/plat-n1sdp/main.c
+ create mode 100644 core/arch/arm/plat-n1sdp/n1sdp_core_pos.S
+ create mode 100644 core/arch/arm/plat-n1sdp/platform_config.h
+ create mode 100644 core/arch/arm/plat-n1sdp/sub.mk
 
 diff --git a/core/arch/arm/plat-n1sdp/conf.mk b/core/arch/arm/plat-n1sdp/conf.mk
 new file mode 100644
-index 00000000..06b4975a
+index 000000000..3dc79fe20
 --- /dev/null
 +++ b/core/arch/arm/plat-n1sdp/conf.mk
 @@ -0,0 +1,41 @@
@@ -60,7 +73,7 @@
 +$(call force,CFG_CORE_ARM64_PA_BITS,36)
 diff --git a/core/arch/arm/plat-n1sdp/main.c b/core/arch/arm/plat-n1sdp/main.c
 new file mode 100644
-index 00000000..39360711
+index 000000000..38212d84c
 --- /dev/null
 +++ b/core/arch/arm/plat-n1sdp/main.c
 @@ -0,0 +1,53 @@
@@ -108,7 +121,7 @@
 +
 +void main_secondary_init_gic(void)
 +{
-+	gic_cpu_init();
++	gic_init_per_cpu();
 +}
 +
 +void console_init(void)
@@ -119,7 +132,7 @@
 +}
 diff --git a/core/arch/arm/plat-n1sdp/n1sdp_core_pos.S b/core/arch/arm/plat-n1sdp/n1sdp_core_pos.S
 new file mode 100644
-index 00000000..439d4e67
+index 000000000..439d4e675
 --- /dev/null
 +++ b/core/arch/arm/plat-n1sdp/n1sdp_core_pos.S
 @@ -0,0 +1,32 @@
@@ -157,7 +170,7 @@
 +END_FUNC get_core_pos_mpidr
 diff --git a/core/arch/arm/plat-n1sdp/platform_config.h b/core/arch/arm/plat-n1sdp/platform_config.h
 new file mode 100644
-index 00000000..81b99409
+index 000000000..81b994091
 --- /dev/null
 +++ b/core/arch/arm/plat-n1sdp/platform_config.h
 @@ -0,0 +1,49 @@
@@ -212,7 +225,7 @@
 +#endif /*PLATFORM_CONFIG_H*/
 diff --git a/core/arch/arm/plat-n1sdp/sub.mk b/core/arch/arm/plat-n1sdp/sub.mk
 new file mode 100644
-index 00000000..a0b49da1
+index 000000000..a0b49da14
 --- /dev/null
 +++ b/core/arch/arm/plat-n1sdp/sub.mk
 @@ -0,0 +1,3 @@
@@ -220,4 +233,5 @@
 +srcs-y += main.c
 +srcs-y	+= n1sdp_core_pos.S
 -- 
-2.17.1
+2.25.1
+
diff --git a/meta-arm/meta-arm/recipes-security/optee/optee-client_4.0.0.bb b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-client_4.0.0.bb
similarity index 100%
rename from meta-arm/meta-arm/recipes-security/optee/optee-client_4.0.0.bb
rename to meta-arm/meta-arm-bsp/recipes-security/optee/optee-client_4.0.0.bb
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-examples_3.22.0.bb b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-examples_3.22.0.bb
deleted file mode 100644
index f082a25..0000000
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-examples_3.22.0.bb
+++ /dev/null
@@ -1,3 +0,0 @@
-require recipes-security/optee/optee-examples.inc
-
-SRCREV = "378dc0db2d5dd279f58a3b6cb3f78ffd6b165035"
diff --git a/meta-arm/meta-arm/recipes-security/optee/optee-examples_4.0.0.bb b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-examples_4.0.0.bb
similarity index 100%
rename from meta-arm/meta-arm/recipes-security/optee/optee-examples_4.0.0.bb
rename to meta-arm/meta-arm-bsp/recipes-security/optee/optee-examples_4.0.0.bb
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.22.0/0001-allow-setting-sysroot-for-libgcc-lookup.patch b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.22.0/0001-allow-setting-sysroot-for-libgcc-lookup.patch
deleted file mode 100644
index 392e8d8..0000000
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.22.0/0001-allow-setting-sysroot-for-libgcc-lookup.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 02ea8e616ac615efe3507d627dfba9820d3357f6 Mon Sep 17 00:00:00 2001
-From: Ross Burton <ross.burton@arm.com>
-Date: Tue, 26 May 2020 14:38:02 -0500
-Subject: [PATCH] allow setting sysroot for libgcc lookup
-
-Explicitly pass the new variable LIBGCC_LOCATE_CFLAGS variable when searching
-for the compiler libraries as there's no easy way to reliably pass --sysroot
-otherwise.
-
-Upstream-Status: Pending [https://github.com/OP-TEE/optee_os/issues/4188]
-Signed-off-by: Ross Burton <ross.burton@arm.com>
----
- mk/gcc.mk | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/mk/gcc.mk b/mk/gcc.mk
-index adc77a24f25e..81bfa78ad8d7 100644
---- a/mk/gcc.mk
-+++ b/mk/gcc.mk
-@@ -13,11 +13,11 @@ nostdinc$(sm)	:= -nostdinc -isystem $(shell $(CC$(sm)) \
- 			-print-file-name=include 2> /dev/null)
- 
- # Get location of libgcc from gcc
--libgcc$(sm)  	:= $(shell $(CC$(sm)) $(CFLAGS$(arch-bits-$(sm))) \
-+libgcc$(sm)  	:= $(shell $(CC$(sm)) $(LIBGCC_LOCATE_CFLAGS) $(CFLAGS$(arch-bits-$(sm))) \
- 			-print-libgcc-file-name 2> /dev/null)
--libstdc++$(sm)	:= $(shell $(CXX$(sm)) $(CXXFLAGS$(arch-bits-$(sm))) $(comp-cxxflags$(sm)) \
-+libstdc++$(sm)	:= $(shell $(CXX$(sm)) $(LIBGCC_LOCATE_CFLAGS) $(CXXFLAGS$(arch-bits-$(sm))) $(comp-cxxflags$(sm)) \
- 			-print-file-name=libstdc++.a 2> /dev/null)
--libgcc_eh$(sm)	:= $(shell $(CXX$(sm)) $(CXXFLAGS$(arch-bits-$(sm))) $(comp-cxxflags$(sm)) \
-+libgcc_eh$(sm)	:= $(shell $(CXX$(sm)) $(LIBGCC_LOCATE_CFLAGS) $(CXXFLAGS$(arch-bits-$(sm))) $(comp-cxxflags$(sm)) \
- 			-print-file-name=libgcc_eh.a 2> /dev/null)
- 
- # Define these to something to discover accidental use
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.22.0/0002-core-Define-section-attributes-for-clang.patch b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.22.0/0002-core-Define-section-attributes-for-clang.patch
deleted file mode 100644
index 15bdf07..0000000
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.22.0/0002-core-Define-section-attributes-for-clang.patch
+++ /dev/null
@@ -1,240 +0,0 @@
-From 6f588813a170a671ebf1d6b51cebc7bc761295dc Mon Sep 17 00:00:00 2001
-From: Emekcan Aras <emekcan.aras@arm.com>
-Date: Wed, 21 Dec 2022 10:55:58 +0000
-Subject: [PATCH] core: Define section attributes for clang
-
-Clang's attribute section is not same as gcc, here we need to add flags
-to sections so they can be eventually collected by linker into final
-output segments. Only way to do so with clang is to use
-
-pragma clang section ...
-
-The behavious is described here [1], this allows us to define names bss
-sections. This was not an issue until clang-15 where LLD linker starts
-to detect the section flags before merging them and throws the following
-errors
-
-| ld.lld: error: section type mismatch for .nozi.kdata_page
-| >>> /mnt/b/yoe/master/build/tmp/work/qemuarm64-yoe-linux/optee-os-tadevkit/3.17.0-r0/build/core/arch/arm/kernel/thread.o:(.nozi.kdata_page): SHT_PROGBITS
-| >>> output section .nozi: SHT_NOBITS
-|
-| ld.lld: error: section type mismatch for .nozi.mmu.l2
-| >>> /mnt/b/yoe/master/build/tmp/work/qemuarm64-yoe-linux/optee-os-tadevkit/3.17.0-r0/build/core/arch/arm/mm/core_mmu_lpae.o:(.nozi.mmu.l2): SHT_PROGBITS
-| >>> output section .nozi: SHT_NOBITS
-
-These sections should be carrying SHT_NOBITS but so far it was not
-possible to do so, this patch tries to use clangs pragma to get this
-going and match the functionality with gcc.
-
-[1] https://intel.github.io/llvm-docs/clang/LanguageExtensions.html#specifying-section-names-for-global-objects-pragma-clang-section
-
-Upstream-Status: Pending
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
----
- core/arch/arm/kernel/thread.c    | 19 +++++++++++++++--
- core/arch/arm/mm/core_mmu_lpae.c | 35 +++++++++++++++++++++++++++----
- core/arch/arm/mm/core_mmu_v7.c   | 36 +++++++++++++++++++++++++++++---
- core/arch/arm/mm/pgt_cache.c     | 12 ++++++++++-
- core/kernel/thread.c             | 13 +++++++++++-
- 5 files changed, 104 insertions(+), 11 deletions(-)
-
-diff --git a/core/arch/arm/kernel/thread.c b/core/arch/arm/kernel/thread.c
-index 4487ef026df9..f3624389611b 100644
---- a/core/arch/arm/kernel/thread.c
-+++ b/core/arch/arm/kernel/thread.c
-@@ -44,15 +44,30 @@ static size_t thread_user_kcode_size __nex_bss;
- #if defined(CFG_CORE_UNMAP_CORE_AT_EL0) && \
- 	defined(CFG_CORE_WORKAROUND_SPECTRE_BP_SEC) && defined(ARM64)
- long thread_user_kdata_sp_offset __nex_bss;
-+#ifdef __clang__
-+#ifndef CFG_VIRTUALIZATION
-+#pragma clang section bss=".nozi.kdata_page"
-+#else
-+#pragma clang section bss=".nex_nozi.kdata_page"
-+#endif
-+#endif
- static uint8_t thread_user_kdata_page[
- 	ROUNDUP(sizeof(struct thread_core_local) * CFG_TEE_CORE_NB_CORE,
- 		SMALL_PAGE_SIZE)]
- 	__aligned(SMALL_PAGE_SIZE)
-+#ifndef __clang__
- #ifndef CFG_NS_VIRTUALIZATION
--	__section(".nozi.kdata_page");
-+	__section(".nozi.kdata_page")
- #else
--	__section(".nex_nozi.kdata_page");
-+	__section(".nex_nozi.kdata_page")
- #endif
-+#endif
-+    ;
-+#endif
-+
-+/* reset BSS section to default ( .bss ) */
-+#ifdef __clang__
-+#pragma clang section bss=""
- #endif
- 
- #ifdef ARM32
-diff --git a/core/arch/arm/mm/core_mmu_lpae.c b/core/arch/arm/mm/core_mmu_lpae.c
-index 7e79f780ad28..ec4db9dc98c5 100644
---- a/core/arch/arm/mm/core_mmu_lpae.c
-+++ b/core/arch/arm/mm/core_mmu_lpae.c
-@@ -233,19 +233,46 @@ typedef uint16_t l1_idx_t;
- typedef uint64_t base_xlat_tbls_t[CFG_TEE_CORE_NB_CORE][NUM_BASE_LEVEL_ENTRIES];
- typedef uint64_t xlat_tbl_t[XLAT_TABLE_ENTRIES];
- 
-+#ifdef __clang__
-+#pragma clang section bss=".nozi.mmu.base_table"
-+#endif
- static base_xlat_tbls_t base_xlation_table[NUM_BASE_TABLES]
- 	__aligned(NUM_BASE_LEVEL_ENTRIES * XLAT_ENTRY_SIZE)
--	__section(".nozi.mmu.base_table");
-+#ifndef __clang__
-+	__section(".nozi.mmu.base_table")
-+#endif
-+;
-+#ifdef __clang__
-+#pragma clang section bss=""
-+#endif
- 
-+#ifdef __clang__
-+#pragma clang section bss=".nozi.mmu.l2"
-+#endif
- static xlat_tbl_t xlat_tables[MAX_XLAT_TABLES]
--	__aligned(XLAT_TABLE_SIZE) __section(".nozi.mmu.l2");
-+	__aligned(XLAT_TABLE_SIZE)
-+#ifndef __clang__
-+	__section(".nozi.mmu.l2")
-+#endif
-+;
-+#ifdef __clang__
-+#pragma clang section bss=""
-+#endif
- 
- #define XLAT_TABLES_SIZE	(sizeof(xlat_tbl_t) * MAX_XLAT_TABLES)
- 
-+#ifdef __clang__
-+#pragma clang section bss=".nozi.mmu.l2"
-+#endif
- /* MMU L2 table for TAs, one for each thread */
- static xlat_tbl_t xlat_tables_ul1[CFG_NUM_THREADS]
--	__aligned(XLAT_TABLE_SIZE) __section(".nozi.mmu.l2");
--
-+#ifndef __clang__
-+	__aligned(XLAT_TABLE_SIZE) __section(".nozi.mmu.l2")
-+#endif
-+;
-+#ifdef __clang__
-+#pragma clang section bss=""
-+#endif
- /*
-  * TAs page table entry inside a level 1 page table.
-  *
-diff --git a/core/arch/arm/mm/core_mmu_v7.c b/core/arch/arm/mm/core_mmu_v7.c
-index 61e703da89c8..1960c08ca688 100644
---- a/core/arch/arm/mm/core_mmu_v7.c
-+++ b/core/arch/arm/mm/core_mmu_v7.c
-@@ -204,16 +204,46 @@ typedef uint32_t l1_xlat_tbl_t[NUM_L1_ENTRIES];
- typedef uint32_t l2_xlat_tbl_t[NUM_L2_ENTRIES];
- typedef uint32_t ul1_xlat_tbl_t[NUM_UL1_ENTRIES];
- 
-+#ifdef __clang__
-+#pragma clang section bss=".nozi.mmu.l1"
-+#endif
- static l1_xlat_tbl_t main_mmu_l1_ttb
--		__aligned(L1_ALIGNMENT) __section(".nozi.mmu.l1");
-+		__aligned(L1_ALIGNMENT)
-+#ifndef __clang__
-+       __section(".nozi.mmu.l1")
-+#endif
-+;
-+#ifdef __clang__
-+#pragma clang section bss=""
-+#endif
- 
- /* L2 MMU tables */
-+#ifdef __clang__
-+#pragma clang section bss=".nozi.mmu.l2"
-+#endif
- static l2_xlat_tbl_t main_mmu_l2_ttb[MAX_XLAT_TABLES]
--		__aligned(L2_ALIGNMENT) __section(".nozi.mmu.l2");
-+		__aligned(L2_ALIGNMENT)
-+#ifndef __clang__
-+       __section(".nozi.mmu.l2")
-+#endif
-+;
-+#ifdef __clang__
-+#pragma clang section bss=""
-+#endif
- 
- /* MMU L1 table for TAs, one for each thread */
-+#ifdef __clang__
-+#pragma clang section bss=".nozi.mmu.ul1"
-+#endif
- static ul1_xlat_tbl_t main_mmu_ul1_ttb[CFG_NUM_THREADS]
--		__aligned(UL1_ALIGNMENT) __section(".nozi.mmu.ul1");
-+		__aligned(UL1_ALIGNMENT)
-+#ifndef __clang__
-+       __section(".nozi.mmu.ul1")
-+#endif
-+;
-+#ifdef __clang__
-+#pragma clang section bss=""
-+#endif
- 
- struct mmu_partition {
- 	l1_xlat_tbl_t *l1_table;
-diff --git a/core/arch/arm/mm/pgt_cache.c b/core/arch/arm/mm/pgt_cache.c
-index 79553c6d2183..b9efdf42780b 100644
---- a/core/arch/arm/mm/pgt_cache.c
-+++ b/core/arch/arm/mm/pgt_cache.c
-@@ -410,8 +410,18 @@ void pgt_init(void)
- 	 * has a large alignment, while .bss has a small alignment. The current
- 	 * link script is optimized for small alignment in .bss
- 	 */
-+#ifdef __clang__
-+#pragma clang section bss=".nozi.mmu.l2"
-+#endif
- 	static uint8_t pgt_tables[PGT_CACHE_SIZE][PGT_SIZE]
--			__aligned(PGT_SIZE) __section(".nozi.pgt_cache");
-+			__aligned(PGT_SIZE)
-+#ifndef __clang__
-+			__section(".nozi.pgt_cache")
-+#endif
-+			;
-+#ifdef __clang__
-+#pragma clang section bss=""
-+#endif
- 	size_t n;
- 
- 	for (n = 0; n < ARRAY_SIZE(pgt_tables); n++) {
-diff --git a/core/kernel/thread.c b/core/kernel/thread.c
-index 2a1f22dce635..5516b677141a 100644
---- a/core/kernel/thread.c
-+++ b/core/kernel/thread.c
-@@ -39,13 +39,24 @@ static uint32_t end_canary_value = 0xababab00;
- 	name[stack_num][sizeof(name[stack_num]) / sizeof(uint32_t) - 1]
- #endif
- 
-+#define DO_PRAGMA(x) _Pragma (#x)
-+
-+#ifdef __clang__
-+#define DECLARE_STACK(name, num_stacks, stack_size, linkage) \
-+DO_PRAGMA (clang section bss=".nozi_stack." #name) \
-+linkage uint32_t name[num_stacks] \
-+		[ROUNDUP(stack_size + STACK_CANARY_SIZE + STACK_CHECK_EXTRA, \
-+			 STACK_ALIGNMENT) / sizeof(uint32_t)] \
-+		__attribute__((aligned(STACK_ALIGNMENT))); \
-+DO_PRAGMA(clang section bss="")
-+#else
- #define DECLARE_STACK(name, num_stacks, stack_size, linkage) \
- linkage uint32_t name[num_stacks] \
- 		[ROUNDUP(stack_size + STACK_CANARY_SIZE + STACK_CHECK_EXTRA, \
- 			 STACK_ALIGNMENT) / sizeof(uint32_t)] \
- 		__attribute__((section(".nozi_stack." # name), \
- 			       aligned(STACK_ALIGNMENT)))
--
-+#endif
- #define GET_STACK(stack) ((vaddr_t)(stack) + STACK_SIZE(stack))
- 
- DECLARE_STACK(stack_tmp, CFG_TEE_CORE_NB_CORE, STACK_TMP_SIZE,
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.22.0/0004-core-link-add-no-warn-rwx-segments.patch b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.22.0/0004-core-link-add-no-warn-rwx-segments.patch
deleted file mode 100644
index d418d46..0000000
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.22.0/0004-core-link-add-no-warn-rwx-segments.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From 3e191f732b3eba699b91ffd7ffa2ae0787f08947 Mon Sep 17 00:00:00 2001
-From: Jerome Forissier <jerome.forissier@linaro.org>
-Date: Fri, 5 Aug 2022 09:48:03 +0200
-Subject: [PATCH] core: link: add --no-warn-rwx-segments
-
-Signed-off-by: Anton Antonov <Anton.Antonov@arm.com>
-Upstream-Status: Backport [https://github.com/OP-TEE/optee_os/pull/5474]
-
-binutils ld.bfd generates one RWX LOAD segment by merging several sections
-with mixed R/W/X attributes (.text, .rodata, .data). After version 2.38 it
-also warns by default when that happens [1], which breaks the build due to
---fatal-warnings. The RWX segment is not a problem for the TEE core, since
-that information is not used to set memory permissions. Therefore, silence
-the warning.
-
-Link: [1] https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ba951afb99912da01a6e8434126b8fac7aa75107
-Link: https://sourceware.org/bugzilla/show_bug.cgi?id=29448
-Reported-by: Dominique Martinet <dominique.martinet@atmark-techno.com>
-Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
-Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
----
- core/arch/arm/kernel/link.mk | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/core/arch/arm/kernel/link.mk b/core/arch/arm/kernel/link.mk
-index 49e9f4fa18a5..9e1cc172fb8a 100644
---- a/core/arch/arm/kernel/link.mk
-+++ b/core/arch/arm/kernel/link.mk
-@@ -37,6 +37,7 @@ link-ldflags += --sort-section=alignment
- link-ldflags += --fatal-warnings
- link-ldflags += --gc-sections
- link-ldflags += $(link-ldflags-common)
-+link-ldflags += $(call ld-option,--no-warn-rwx-segments)
- 
- link-ldadd  = $(LDADD)
- link-ldadd += $(ldflags-external)
-@@ -61,6 +62,7 @@ link-script-cppflags := \
- 		$(cppflagscore))
- 
- ldargs-all_objs := -T $(link-script-dummy) --no-check-sections \
-+		   $(call ld-option,--no-warn-rwx-segments) \
- 		   $(link-ldflags-common) \
- 		   $(link-objs) $(link-ldadd) $(libgcccore)
- cleanfiles += $(link-out-dir)/all_objs.o
-@@ -75,7 +77,7 @@ $(link-out-dir)/unpaged_entries.txt: $(link-out-dir)/all_objs.o
- 		$(AWK) '/ ____keep_pager/ { printf "-u%s ", $$3 }' > $@
- 
- unpaged-ldargs := -T $(link-script-dummy) --no-check-sections --gc-sections \
--		 $(link-ldflags-common)
-+		 $(link-ldflags-common) $(call ld-option,--no-warn-rwx-segments)
- unpaged-ldadd := $(objs) $(link-ldadd) $(libgcccore)
- cleanfiles += $(link-out-dir)/unpaged.o
- $(link-out-dir)/unpaged.o: $(link-out-dir)/unpaged_entries.txt
-@@ -104,7 +106,7 @@ $(link-out-dir)/init_entries.txt: $(link-out-dir)/all_objs.o
- 		$(AWK) '/ ____keep_init/ { printf "-u%s ", $$3 }' > $@
- 
- init-ldargs := -T $(link-script-dummy) --no-check-sections --gc-sections \
--	       $(link-ldflags-common)
-+	       $(link-ldflags-common) $(call ld-option,--no-warn-rwx-segments)
- init-ldadd := $(link-objs-init) $(link-out-dir)/version.o  $(link-ldadd) \
- 	      $(libgcccore)
- cleanfiles += $(link-out-dir)/init.o
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-tadevkit_3.22.0.bbappend b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-tadevkit_3.22.0.bbappend
deleted file mode 100644
index e09c4a5..0000000
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-tadevkit_3.22.0.bbappend
+++ /dev/null
@@ -1,6 +0,0 @@
-# Machine specific configurations
-
-MACHINE_OPTEE_OS_TADEVKIT_REQUIRE ?= ""
-MACHINE_OPTEE_OS_TADEVKIT_REQUIRE:n1sdp = "optee-os-n1sdp.inc"
-
-require ${MACHINE_OPTEE_OS_TADEVKIT_REQUIRE}
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-tadevkit_4.0.0.bbappend b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-tadevkit_4.%.bbappend
similarity index 100%
rename from meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-tadevkit_4.0.0.bbappend
rename to meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-tadevkit_4.%.bbappend
diff --git a/meta-arm/meta-arm/recipes-security/optee/optee-os-tadevkit_4.0.0.bb b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-tadevkit_4.0.0.bb
similarity index 100%
rename from meta-arm/meta-arm/recipes-security/optee/optee-os-tadevkit_4.0.0.bb
rename to meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-tadevkit_4.0.0.bb
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.22.0/0003-optee-enable-clang-support.patch b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os/0003-optee-enable-clang-support.patch
similarity index 91%
rename from meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.22.0/0003-optee-enable-clang-support.patch
rename to meta-arm/meta-arm-bsp/recipes-security/optee/optee-os/0003-optee-enable-clang-support.patch
index b4ea8ed..3c13ce3 100644
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.22.0/0003-optee-enable-clang-support.patch
+++ b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os/0003-optee-enable-clang-support.patch
@@ -1,4 +1,4 @@
-From 9c55b7a4e39617c2abbf4e0e39fd8041c7b2b9b6 Mon Sep 17 00:00:00 2001
+From 59d4c190eae11c93b26cca5a7b005a17dadc8248 Mon Sep 17 00:00:00 2001
 From: Brett Warren <brett.warren@arm.com>
 Date: Wed, 23 Sep 2020 09:27:34 +0100
 Subject: [PATCH] optee: enable clang support
@@ -10,12 +10,13 @@
 Upstream-Status: Pending
 ChangeId: 8ba69a4b2eb8ebaa047cb266c9aa6c2c3da45701
 Signed-off-by: Brett Warren <brett.warren@arm.com>
+
 ---
  mk/clang.mk | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mk/clang.mk b/mk/clang.mk
-index a045beee8482..1ebe2f702dcd 100644
+index a045beee8..1ebe2f702 100644
 --- a/mk/clang.mk
 +++ b/mk/clang.mk
 @@ -30,7 +30,7 @@ comp-cflags-warns-clang := -Wno-language-extension-token \
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.22.0.bb b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.22.0.bb
deleted file mode 100644
index e122019..0000000
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.22.0.bb
+++ /dev/null
@@ -1,13 +0,0 @@
-require recipes-security/optee/optee-os.inc
-
-DEPENDS += "dtc-native"
-
-FILESEXTRAPATHS:prepend := "${THISDIR}/${P}:"
-
-SRCREV = "001ace6655dd6bb9cbe31aa31b4ba69746e1a1d9"
-SRC_URI += " \
-    file://0001-allow-setting-sysroot-for-libgcc-lookup.patch \
-    file://0002-core-Define-section-attributes-for-clang.patch \
-    file://0003-optee-enable-clang-support.patch \
-    file://0004-core-link-add-no-warn-rwx-segments.patch \
-   "
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.22.0.bbappend b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.22.0.bbappend
deleted file mode 100644
index ee4ca17..0000000
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.22.0.bbappend
+++ /dev/null
@@ -1,9 +0,0 @@
-# Include Trusted Services Secure Partitions
-require recipes-security/optee/optee-os-ts.inc
-
-# Machine specific configurations
-MACHINE_OPTEE_OS_REQUIRE ?= ""
-MACHINE_OPTEE_OS_REQUIRE:corstone1000 = "optee-os-corstone1000-common.inc"
-MACHINE_OPTEE_OS_REQUIRE:n1sdp = "optee-os-n1sdp.inc"
-
-require ${MACHINE_OPTEE_OS_REQUIRE}
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_4.0.0.bbappend b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_4.%.bbappend
similarity index 100%
rename from meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_4.0.0.bbappend
rename to meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_4.%.bbappend
diff --git a/meta-arm/meta-arm/recipes-security/optee/optee-os_4.0.0.bb b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_4.0.0.bb
similarity index 100%
rename from meta-arm/meta-arm/recipes-security/optee/optee-os_4.0.0.bb
rename to meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_4.0.0.bb
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-test_3.22.0.bbappend b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-test_3.22.0.bbappend
deleted file mode 100644
index 05e2abc..0000000
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-test_3.22.0.bbappend
+++ /dev/null
@@ -1,6 +0,0 @@
-# Machine specific configurations
-
-MACHINE_OPTEE_TEST_REQUIRE ?= ""
-MACHINE_OPTEE_TEST_REQUIRE:n1sdp = "optee-os-generic-n1sdp.inc"
-
-require ${MACHINE_OPTEE_TEST_REQUIRE}
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-test_4.0.0.bbappend b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-test_4.%.bbappend
similarity index 100%
rename from meta-arm/meta-arm-bsp/recipes-security/optee/optee-test_4.0.0.bbappend
rename to meta-arm/meta-arm-bsp/recipes-security/optee/optee-test_4.%.bbappend
diff --git a/meta-arm/meta-arm/recipes-security/optee/optee-test_4.0.0.bb b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-test_4.0.0.bb
similarity index 100%
rename from meta-arm/meta-arm/recipes-security/optee/optee-test_4.0.0.bb
rename to meta-arm/meta-arm-bsp/recipes-security/optee/optee-test_4.0.0.bb
diff --git a/meta-arm/meta-arm-bsp/wic/corstone1000-image.corstone1000.wks b/meta-arm/meta-arm-bsp/wic/corstone1000-flash-firmware.wks.in
similarity index 100%
rename from meta-arm/meta-arm-bsp/wic/corstone1000-image.corstone1000.wks
rename to meta-arm/meta-arm-bsp/wic/corstone1000-flash-firmware.wks.in
diff --git a/meta-arm/meta-arm-systemready/conf/layer.conf b/meta-arm/meta-arm-systemready/conf/layer.conf
index 27bb568..79ef3a1 100644
--- a/meta-arm/meta-arm-systemready/conf/layer.conf
+++ b/meta-arm/meta-arm-systemready/conf/layer.conf
@@ -8,7 +8,7 @@
 BBFILE_COLLECTIONS += "meta-arm-systemready"
 BBFILE_PATTERN_meta-arm-systemready = "^${LAYERDIR}/"
 
-LAYERSERIES_COMPAT_meta-arm-systemready = "nanbield"
+LAYERSERIES_COMPAT_meta-arm-systemready = "nanbield scarthgap"
 
 LAYERDEPENDS_meta-arm-systemready = "core"
 
diff --git a/meta-arm/meta-arm-toolchain/conf/layer.conf b/meta-arm/meta-arm-toolchain/conf/layer.conf
index bce70da..0649493 100644
--- a/meta-arm/meta-arm-toolchain/conf/layer.conf
+++ b/meta-arm/meta-arm-toolchain/conf/layer.conf
@@ -9,4 +9,4 @@
 BBFILE_PRIORITY_arm-toolchain = "5"
 
 LAYERDEPENDS_arm-toolchain = "core"
-LAYERSERIES_COMPAT_arm-toolchain = "nanbield"
+LAYERSERIES_COMPAT_arm-toolchain = "nanbield scarthgap"
diff --git a/meta-arm/meta-arm/conf/layer.conf b/meta-arm/meta-arm/conf/layer.conf
index b506af8..af8275a 100644
--- a/meta-arm/meta-arm/conf/layer.conf
+++ b/meta-arm/meta-arm/conf/layer.conf
@@ -13,7 +13,7 @@
     core \
     arm-toolchain \
 "
-LAYERSERIES_COMPAT_meta-arm = "nanbield"
+LAYERSERIES_COMPAT_meta-arm = "nanbield scarthgap"
 
 # runfvp --console needs telnet, so pull this in for testimage.
 HOSTTOOLS_NONFATAL += "telnet"
diff --git a/meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/tf-a-tests_2.10.0.bb b/meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/tf-a-tests_2.10.0.bb
index f3818b6..fffdf5d 100644
--- a/meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/tf-a-tests_2.10.0.bb
+++ b/meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/tf-a-tests_2.10.0.bb
@@ -19,6 +19,9 @@
 EXTRA_OEMAKE += "SHELL_COLOR=1"
 EXTRA_OEMAKE += "DEBUG=1"
 
+# Modify mode based on debug or release mode
+TFTF_MODE ?= "debug"
+
 # Platform must be set for each machine
 TFA_PLATFORM ?= "invalid"
 
@@ -46,7 +49,7 @@
 
 do_install() {
     install -d -m 755 ${D}/firmware
-    install -m 0644 ${B}/${TFA_PLATFORM}/debug/tftf.bin ${D}/firmware/tftf.bin
+    install -m 0644 ${B}/${TFA_PLATFORM}/${TFTF_MODE}/tftf.bin ${D}/firmware/tftf.bin
 }
 
 do_deploy() {
diff --git a/meta-arm/meta-arm/recipes-devtools/opencsd/opencsd_1.4.2.bb b/meta-arm/meta-arm/recipes-devtools/opencsd/opencsd_1.5.1.bb
similarity index 94%
rename from meta-arm/meta-arm/recipes-devtools/opencsd/opencsd_1.4.2.bb
rename to meta-arm/meta-arm/recipes-devtools/opencsd/opencsd_1.5.1.bb
index 4bfed27..5f83855 100644
--- a/meta-arm/meta-arm/recipes-devtools/opencsd/opencsd_1.4.2.bb
+++ b/meta-arm/meta-arm/recipes-devtools/opencsd/opencsd_1.5.1.bb
@@ -4,7 +4,7 @@
 LIC_FILES_CHKSUM = "file://LICENSE;md5=ad8cb685eb324d2fa2530b985a43f3e5"
 
 SRC_URI = "git://github.com/Linaro/OpenCSD;protocol=https;branch=master"
-SRCREV = "37ace5c3e1a9f87d0541b3d3cbbbf39267258dbc"
+SRCREV = "c16418833b5d7cbcbcb4e2a2d917ad0147efb2be"
 
 S = "${WORKDIR}/git"
 
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-client_3.22.0.bb b/meta-arm/meta-arm/recipes-security/optee/optee-client_4.1.0.bb
similarity index 71%
rename from meta-arm/meta-arm-bsp/recipes-security/optee/optee-client_3.22.0.bb
rename to meta-arm/meta-arm/recipes-security/optee/optee-client_4.1.0.bb
index 904c256..2f95676 100644
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-client_3.22.0.bb
+++ b/meta-arm/meta-arm/recipes-security/optee/optee-client_4.1.0.bb
@@ -1,6 +1,6 @@
 require recipes-security/optee/optee-client.inc
 
-SRCREV = "8533e0e6329840ee96cf81b6453f257204227e6c"
+SRCREV = "f7e4ced15d1fefd073bbfc484fe0e1f74afe96c2"
 
 inherit pkgconfig
 DEPENDS += "util-linux"
diff --git a/meta-arm/meta-arm/recipes-security/optee/optee-examples_4.0.0.bb b/meta-arm/meta-arm/recipes-security/optee/optee-examples_4.1.0.bb
similarity index 100%
copy from meta-arm/meta-arm/recipes-security/optee/optee-examples_4.0.0.bb
copy to meta-arm/meta-arm/recipes-security/optee/optee-examples_4.1.0.bb
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-tadevkit_3.22.0.bb b/meta-arm/meta-arm/recipes-security/optee/optee-os-tadevkit_4.1.0.bb
similarity index 93%
rename from meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-tadevkit_3.22.0.bb
rename to meta-arm/meta-arm/recipes-security/optee/optee-os-tadevkit_4.1.0.bb
index 4449616..961d525 100644
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-tadevkit_3.22.0.bb
+++ b/meta-arm/meta-arm/recipes-security/optee/optee-os-tadevkit_4.1.0.bb
@@ -1,4 +1,4 @@
-require optee-os_3.22.0.bb
+require recipes-security/optee/optee-os_${PV}.bb
 
 SUMMARY = "OP-TEE Trusted OS TA devkit"
 DESCRIPTION = "OP-TEE TA devkit for build TAs"
diff --git a/meta-arm/meta-arm/recipes-security/optee/optee-os_4.1.0.bb b/meta-arm/meta-arm/recipes-security/optee/optee-os_4.1.0.bb
new file mode 100644
index 0000000..bfb61eb
--- /dev/null
+++ b/meta-arm/meta-arm/recipes-security/optee/optee-os_4.1.0.bb
@@ -0,0 +1,10 @@
+require recipes-security/optee/optee-os.inc
+
+DEPENDS += "dtc-native"
+
+FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}:"
+
+SRCREV = "18b424c23aa5a798dfe2e4d20b4bde3919dc4e99"
+SRC_URI += " \
+    file://0003-optee-enable-clang-support.patch \
+   "
diff --git a/meta-arm/meta-arm/recipes-security/optee/optee-test/0001-xtest-stats-remove-unneeded-stat.h-include.patch b/meta-arm/meta-arm/recipes-security/optee/optee-test/0001-xtest-stats-remove-unneeded-stat.h-include.patch
new file mode 100644
index 0000000..581c6db
--- /dev/null
+++ b/meta-arm/meta-arm/recipes-security/optee/optee-test/0001-xtest-stats-remove-unneeded-stat.h-include.patch
@@ -0,0 +1,34 @@
+From 236ebb968a298fa5d461e734559ad8a13b667eb6 Mon Sep 17 00:00:00 2001
+From: Jon Mason <jon.mason@arm.com>
+Date: Wed, 24 Jan 2024 11:35:50 -0500
+Subject: [PATCH] xtest: stats: remove unneeded stat.h include
+
+Hack to work around musl compile error:
+
+| In file included from optee-test/4.1.0/recipe-sysroot/usr/include/sys/stat.h:23,
+|                  from optee-test/4.1.0/git/host/xtest/stats.c:17:
+| optee-test/4.1.0/recipe-sysroot/usr/include/bits/stat.h:17:26: error: expected identifier or '(' before '[' token
+|    17 |         unsigned __unused[2];
+|       |                          ^
+
+stat.h is not needed, since it is not being used in this file.  So
+removing it.
+
+Upstream-Status: Inappropriate [https://github.com/OP-TEE/optee_test/issues/722]
+Signed-off-by: Jon Mason <jon.mason@arm.com>
+---
+ host/xtest/stats.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/host/xtest/stats.c b/host/xtest/stats.c
+index fb16d55586da..05aa3adac611 100644
+--- a/host/xtest/stats.c
++++ b/host/xtest/stats.c
+@@ -14,7 +14,6 @@
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
+-#include <sys/stat.h>
+ #include <sys/types.h>
+ #include <tee_client_api.h>
+ #include <unistd.h>
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-test_3.22.0.bb b/meta-arm/meta-arm/recipes-security/optee/optee-test_4.1.0.bb
similarity index 75%
rename from meta-arm/meta-arm-bsp/recipes-security/optee/optee-test_3.22.0.bb
rename to meta-arm/meta-arm/recipes-security/optee/optee-test_4.1.0.bb
index eddf04d..1b12455 100644
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-test_3.22.0.bb
+++ b/meta-arm/meta-arm/recipes-security/optee/optee-test_4.1.0.bb
@@ -1,9 +1,7 @@
 require recipes-security/optee/optee-test.inc
 
-SRC_URI += " \
-    file://0001-xtest-regression_1000-remove-unneeded-stat.h-include.patch \
-   "
-SRCREV = "a286b57f1721af215ace318d5807e63f40186df6"
+SRCREV = "2e1e7a9c9d659585566a75fc8802f4758c42bcb2"
+SRC_URI += "file://0001-xtest-stats-remove-unneeded-stat.h-include.patch"
 
 # Include ffa_spmc test group if the SPMC test is enabled.
 # Supported after op-tee v3.20