diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/corstone1000/0001-Handle-logging-syscall.patch b/meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/corstone1000/0001-Handle-logging-syscall.patch
index 9c1d781..58ba2af 100644
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/corstone1000/0001-Handle-logging-syscall.patch
+++ b/meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/corstone1000/0001-Handle-logging-syscall.patch
@@ -4,7 +4,7 @@
 Subject: [PATCH] Handle logging syscall
 
 Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
-Upstream-Status:  Inappropriate [Other]
+Upstream-Status: Pending [upstreamed differently in 280b6a3]
 ---
  core/arch/arm/kernel/spmc_sp_handler.c | 7 ++++++-
  1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/n1sdp/0002-plat-n1sdp-add-N1SDP-platform-support.patch b/meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/n1sdp/0002-plat-n1sdp-add-N1SDP-platform-support.patch
index 50283db..29623b0 100644
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/n1sdp/0002-plat-n1sdp-add-N1SDP-platform-support.patch
+++ b/meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/n1sdp/0002-plat-n1sdp-add-N1SDP-platform-support.patch
@@ -50,8 +50,8 @@
 +CFG_CORE_HEAP_SIZE = 0x32000 # 200kb
 +
 +CFG_TEE_CORE_NB_CORE = 4
-+CFG_TZDRAM_START ?= 0x08000000
-+CFG_TZDRAM_SIZE  ?= 0x02008000
++CFG_TZDRAM_START ?= 0xDE000000
++CFG_TZDRAM_SIZE  ?= 0x02000000
 +
 +CFG_SHMEM_START  ?= 0x83000000
 +CFG_SHMEM_SIZE   ?= 0x00210000
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/n1sdp/0003-HACK-disable-instruction-cache-and-data-cache.patch b/meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/n1sdp/0003-HACK-disable-instruction-cache-and-data-cache.patch
deleted file mode 100644
index ebe4d72..0000000
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/n1sdp/0003-HACK-disable-instruction-cache-and-data-cache.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-Upstream-Status: Pending [Not submitted to upstream yet]
-Signed-off-by: Vishnu Banavath <vishnu.banavath@arm.com>
-
-From 0c3ce4c09cd7d2ff4cd2e62acab899dd88dc9514 Mon Sep 17 00:00:00 2001
-From: Vishnu Banavath <vishnu.banavath@arm.com>
-Date: Wed, 20 Jul 2022 16:45:59 +0100
-Subject: [PATCH] HACK: disable instruction cache and data cache.
-
-For some reason, n1sdp fails to boot with instruction cache and
-data cache enabled. This is a temporary change to disable I cache
-and D cache until a proper fix is found.
-
-Signed-off-by: Vishnu Banavath <vishnu.banavath@arm.com>
-
-
-diff --git a/core/arch/arm/kernel/entry_a64.S b/core/arch/arm/kernel/entry_a64.S
-index 875b6e69..594d6928 100644
---- a/core/arch/arm/kernel/entry_a64.S
-+++ b/core/arch/arm/kernel/entry_a64.S
-@@ -52,7 +52,7 @@
- 
- 	.macro set_sctlr_el1
- 		mrs	x0, sctlr_el1
--		orr	x0, x0, #SCTLR_I
-+		bic	x0, x0, #SCTLR_I
- 		orr	x0, x0, #SCTLR_SA
- 		orr	x0, x0, #SCTLR_SPAN
- #if defined(CFG_CORE_RWDATA_NOEXEC)
-@@ -490,11 +490,11 @@ LOCAL_FUNC enable_mmu , : , .identity_map
- 	isb
- 
- 	/* Enable I and D cache */
--	mrs	x1, sctlr_el1
-+	/* mrs	x1, sctlr_el1
- 	orr	x1, x1, #SCTLR_I
- 	orr	x1, x1, #SCTLR_C
- 	msr	sctlr_el1, x1
--	isb
-+	isb */
- 
- 	/* Adjust stack pointers and return address */
- 	msr	spsel, #1
--- 
-2.17.1
-
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/n1sdp/0004-Handle-logging-syscall.patch b/meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/n1sdp/0003-Handle-logging-syscall.patch
similarity index 94%
rename from meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/n1sdp/0004-Handle-logging-syscall.patch
rename to meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/n1sdp/0003-Handle-logging-syscall.patch
index 9d305ad..0955d99 100644
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/n1sdp/0004-Handle-logging-syscall.patch
+++ b/meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/n1sdp/0003-Handle-logging-syscall.patch
@@ -1,4 +1,4 @@
-Upstream-Status: Pending [Not submitted to upstream yet]
+Upstream-Status: Pending [upstreamed differently in 280b6a3]
 Signed-off-by: Vishnu Banavath <vishnu.banavath@arm.com>
 
 From b3fde6c2e1a950214f760ab9f194f3a6572292a8 Mon Sep 17 00:00:00 2001
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/n1sdp/0005-plat-n1sdp-register-DRAM1-to-optee-os.patch b/meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/n1sdp/0004-plat-n1sdp-register-DRAM1-to-optee-os.patch
similarity index 100%
rename from meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/n1sdp/0005-plat-n1sdp-register-DRAM1-to-optee-os.patch
rename to meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/n1sdp/0004-plat-n1sdp-register-DRAM1-to-optee-os.patch
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/n1sdp/0006-plat-n1sdp-add-external-device-tree-base-and-size.patch b/meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/n1sdp/0005-plat-n1sdp-add-external-device-tree-base-and-size.patch
similarity index 100%
rename from meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/n1sdp/0006-plat-n1sdp-add-external-device-tree-base-and-size.patch
rename to meta-arm/meta-arm-bsp/recipes-security/optee/files/optee-os/n1sdp/0005-plat-n1sdp-add-external-device-tree-base-and-size.patch
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-client_3.18.0.bb b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-client_3.18.0.bb
deleted file mode 100644
index ea7b65c..0000000
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-client_3.18.0.bb
+++ /dev/null
@@ -1,3 +0,0 @@
-require recipes-security/optee/optee-client.inc
-
-SRCREV = "e7cba71cc6e2ecd02f412c7e9ee104f0a5dffc6f"
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-client_3.22.0.bb b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-client_3.22.0.bb
new file mode 100644
index 0000000..904c256
--- /dev/null
+++ b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-client_3.22.0.bb
@@ -0,0 +1,7 @@
+require recipes-security/optee/optee-client.inc
+
+SRCREV = "8533e0e6329840ee96cf81b6453f257204227e6c"
+
+inherit pkgconfig
+DEPENDS += "util-linux"
+EXTRA_OEMAKE += "PKG_CONFIG=pkg-config"
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-examples_3.22.0.bb b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-examples_3.22.0.bb
new file mode 100644
index 0000000..f082a25
--- /dev/null
+++ b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-examples_3.22.0.bb
@@ -0,0 +1,3 @@
+require recipes-security/optee/optee-examples.inc
+
+SRCREV = "378dc0db2d5dd279f58a3b6cb3f78ffd6b165035"
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.18.0/0005-core-ldelf-link-add-z-execstack.patch b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.18.0/0005-core-ldelf-link-add-z-execstack.patch
deleted file mode 100644
index 862a76b..0000000
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.18.0/0005-core-ldelf-link-add-z-execstack.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-From 63445958678b58c5adc7eca476b216e5dc0f4195 Mon Sep 17 00:00:00 2001
-From: Jerome Forissier <jerome.forissier@linaro.org>
-Date: Tue, 23 Aug 2022 11:41:00 +0000
-Subject: [PATCH] core, ldelf: link: add -z execstack
-
-When building for arm32 with GNU binutils 2.39, the linker outputs
-warnings when generating some TEE core binaries (all_obj.o, init.o,
-unpaged.o and tee.elf) as well as ldelf.elf:
-
- arm-poky-linux-gnueabi-ld.bfd: warning: atomic_a32.o: missing .note.GNU-stack section implies executable stack
- arm-poky-linux-gnueabi-ld.bfd: NOTE: This behaviour is deprecated and will be removed in a future version of the linker
-
-The permissions used when mapping the TEE core stacks do not depend on
-any metadata found in the ELF file. Similarly when the TEE core loads
-ldelf it already creates a non-executable stack regardless of ELF
-information. Therefore we can safely ignore the warnings. This is done
-by adding the '-z execstack' option.
-
-Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
-
-Signed-off-by: Anton Antonov <Anton.Antonov@arm.com>
-Upstream-Status: Backport [https://github.com/OP-TEE/optee_os/pull/5499]
----
- core/arch/arm/kernel/link.mk | 13 +++++++++----
- ldelf/link.mk                |  3 +++
- 2 files changed, 12 insertions(+), 4 deletions(-)
-
-diff --git a/core/arch/arm/kernel/link.mk b/core/arch/arm/kernel/link.mk
-index c39d43cbfc5b..0e96e606cd9d 100644
---- a/core/arch/arm/kernel/link.mk
-+++ b/core/arch/arm/kernel/link.mk
-@@ -9,6 +9,11 @@ link-script-dep = $(link-out-dir)/.kern.ld.d
- 
- AWK	 = awk
- 
-+link-ldflags-common += $(call ld-option,--no-warn-rwx-segments)
-+ifeq ($(CFG_ARM32_core),y)
-+link-ldflags-common += $(call ld-option,--no-warn-execstack)
-+endif
-+
- link-ldflags  = $(LDFLAGS)
- ifeq ($(CFG_CORE_ASLR),y)
- link-ldflags += -pie -Bsymbolic -z norelro $(ldflag-apply-dynamic-relocs)
-@@ -31,7 +36,7 @@ link-ldflags += -T $(link-script-pp) -Map=$(link-out-dir)/tee.map
- link-ldflags += --sort-section=alignment
- link-ldflags += --fatal-warnings
- link-ldflags += --gc-sections
--link-ldflags += $(call ld-option,--no-warn-rwx-segments)
-+link-ldflags += $(link-ldflags-common)
- 
- link-ldadd  = $(LDADD)
- link-ldadd += $(ldflags-external)
-@@ -56,7 +61,7 @@ link-script-cppflags := \
- 		$(cppflagscore))
- 
- ldargs-all_objs := -T $(link-script-dummy) --no-check-sections \
--		   $(call ld-option,--no-warn-rwx-segments) \
-+		   $(link-ldflags-common) \
- 		   $(link-objs) $(link-ldadd) $(libgcccore)
- cleanfiles += $(link-out-dir)/all_objs.o
- $(link-out-dir)/all_objs.o: $(objs) $(libdeps) $(MAKEFILE_LIST)
-@@ -70,7 +75,7 @@ $(link-out-dir)/unpaged_entries.txt: $(link-out-dir)/all_objs.o
- 		$(AWK) '/ ____keep_pager/ { printf "-u%s ", $$3 }' > $@
- 
- unpaged-ldargs := -T $(link-script-dummy) --no-check-sections --gc-sections \
--		 $(call ld-option,--no-warn-rwx-segments)
-+		 $(link-ldflags-common)
- unpaged-ldadd := $(objs) $(link-ldadd) $(libgcccore)
- cleanfiles += $(link-out-dir)/unpaged.o
- $(link-out-dir)/unpaged.o: $(link-out-dir)/unpaged_entries.txt
-@@ -99,7 +104,7 @@ $(link-out-dir)/init_entries.txt: $(link-out-dir)/all_objs.o
- 		$(AWK) '/ ____keep_init/ { printf "-u%s ", $$3 }' > $@
- 
- init-ldargs := -T $(link-script-dummy) --no-check-sections --gc-sections \
--	       $(call ld-option,--no-warn-rwx-segments)
-+	       $(link-ldflags-common)
- init-ldadd := $(link-objs-init) $(link-out-dir)/version.o  $(link-ldadd) \
- 	      $(libgcccore)
- cleanfiles += $(link-out-dir)/init.o
-diff --git a/ldelf/link.mk b/ldelf/link.mk
-index 64c8212a06fa..bd49551e7065 100644
---- a/ldelf/link.mk
-+++ b/ldelf/link.mk
-@@ -20,6 +20,9 @@ link-ldflags += -z max-page-size=4096 # OP-TEE always uses 4K alignment
- ifeq ($(CFG_CORE_BTI),y)
- link-ldflags += $(call ld-option,-z force-bti) --fatal-warnings
- endif
-+ifeq ($(CFG_ARM32_$(sm)), y)
-+link-ldflags += $(call ld-option,--no-warn-execstack)
-+endif
- link-ldflags += $(link-ldflags$(sm))
- 
- link-ldadd  = $(addprefix -L,$(libdirs))
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.18.0/0006-arm32-libutils-libutee-ta-add-.note.GNU-stack-sectio.patch b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.18.0/0006-arm32-libutils-libutee-ta-add-.note.GNU-stack-sectio.patch
deleted file mode 100644
index e82fdc7..0000000
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.18.0/0006-arm32-libutils-libutee-ta-add-.note.GNU-stack-sectio.patch
+++ /dev/null
@@ -1,127 +0,0 @@
-From 1a991cbedf8647d5a1e7c312614f7867c3940968 Mon Sep 17 00:00:00 2001
-From: Jerome Forissier <jerome.forissier@linaro.org>
-Date: Tue, 23 Aug 2022 12:31:46 +0000
-Subject: [PATCH] arm32: libutils, libutee, ta: add .note.GNU-stack section to
-
- .S files
-
-When building for arm32 with GNU binutils 2.39, the linker outputs
-warnings when linking Trusted Applications:
-
- arm-unknown-linux-uclibcgnueabihf-ld.bfd: warning: utee_syscalls_a32.o: missing .note.GNU-stack section implies executable stack
- arm-unknown-linux-uclibcgnueabihf-ld.bfd: NOTE: This behaviour is deprecated and will be removed in a future version of the linker
-
-We could silence the warning by adding the '-z execstack' option to the
-TA link flags, like we did in the parent commit for the TEE core and
-ldelf. Indeed, ldelf always allocates a non-executable piece of memory
-for the TA to use as a stack.
-
-However it seems preferable to comply with the common ELF practices in
-this case. A better fix is therefore to add the missing .note.GNU-stack
-sections in the assembler files.
-
-Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
-
-Signed-off-by: Anton Antonov <Anton.Antonov@arm.com>
-Upstream-Status: Backport [https://github.com/OP-TEE/optee_os/pull/5499]
----
- lib/libutee/arch/arm/utee_syscalls_a32.S             | 2 ++
- lib/libutils/ext/arch/arm/atomic_a32.S               | 2 ++
- lib/libutils/ext/arch/arm/mcount_a32.S               | 2 ++
- lib/libutils/isoc/arch/arm/arm32_aeabi_divmod_a32.S  | 2 ++
- lib/libutils/isoc/arch/arm/arm32_aeabi_ldivmod_a32.S | 2 ++
- lib/libutils/isoc/arch/arm/setjmp_a32.S              | 2 ++
- ta/arch/arm/ta_entry_a32.S                           | 2 ++
- 7 files changed, 14 insertions(+)
-
-diff --git a/lib/libutee/arch/arm/utee_syscalls_a32.S b/lib/libutee/arch/arm/utee_syscalls_a32.S
-index 6e621ca6e06d..af405f62723c 100644
---- a/lib/libutee/arch/arm/utee_syscalls_a32.S
-+++ b/lib/libutee/arch/arm/utee_syscalls_a32.S
-@@ -7,6 +7,8 @@
- #include <tee_syscall_numbers.h>
- #include <asm.S>
- 
-+	.section .note.GNU-stack,"",%progbits
-+
-         .section .text
-         .balign 4
-         .code 32
-diff --git a/lib/libutils/ext/arch/arm/atomic_a32.S b/lib/libutils/ext/arch/arm/atomic_a32.S
-index eaef6914734e..2be73ffadcc9 100644
---- a/lib/libutils/ext/arch/arm/atomic_a32.S
-+++ b/lib/libutils/ext/arch/arm/atomic_a32.S
-@@ -5,6 +5,8 @@
- 
- #include <asm.S>
- 
-+	.section .note.GNU-stack,"",%progbits
-+
- /* uint32_t atomic_inc32(uint32_t *v); */
- FUNC atomic_inc32 , :
- 	ldrex	r1, [r0]
-diff --git a/lib/libutils/ext/arch/arm/mcount_a32.S b/lib/libutils/ext/arch/arm/mcount_a32.S
-index 51439a23014e..54dc3c02da66 100644
---- a/lib/libutils/ext/arch/arm/mcount_a32.S
-+++ b/lib/libutils/ext/arch/arm/mcount_a32.S
-@@ -7,6 +7,8 @@
- 
- #if defined(CFG_TA_GPROF_SUPPORT) || defined(CFG_FTRACE_SUPPORT)
- 
-+	.section .note.GNU-stack,"",%progbits
-+
- /*
-  * Convert return address to call site address by subtracting the size of the
-  * mcount call instruction (blx __gnu_mcount_nc).
-diff --git a/lib/libutils/isoc/arch/arm/arm32_aeabi_divmod_a32.S b/lib/libutils/isoc/arch/arm/arm32_aeabi_divmod_a32.S
-index a600c879668c..37ae9ec6f9f1 100644
---- a/lib/libutils/isoc/arch/arm/arm32_aeabi_divmod_a32.S
-+++ b/lib/libutils/isoc/arch/arm/arm32_aeabi_divmod_a32.S
-@@ -5,6 +5,8 @@
- 
- #include <asm.S>
- 
-+	.section .note.GNU-stack,"",%progbits
-+
- /*
-  * signed ret_idivmod_values(signed quot, signed rem);
-  * return quotient and remaining the EABI way (regs r0,r1)
-diff --git a/lib/libutils/isoc/arch/arm/arm32_aeabi_ldivmod_a32.S b/lib/libutils/isoc/arch/arm/arm32_aeabi_ldivmod_a32.S
-index 2dc50bc98bbf..5c3353e2c1ba 100644
---- a/lib/libutils/isoc/arch/arm/arm32_aeabi_ldivmod_a32.S
-+++ b/lib/libutils/isoc/arch/arm/arm32_aeabi_ldivmod_a32.S
-@@ -5,6 +5,8 @@
- 
- #include <asm.S>
- 
-+	.section .note.GNU-stack,"",%progbits
-+
- /*
-  * __value_in_regs lldiv_t __aeabi_ldivmod( long long n, long long d)
-  */
-diff --git a/lib/libutils/isoc/arch/arm/setjmp_a32.S b/lib/libutils/isoc/arch/arm/setjmp_a32.S
-index 43ea593758c9..f8a0b70df705 100644
---- a/lib/libutils/isoc/arch/arm/setjmp_a32.S
-+++ b/lib/libutils/isoc/arch/arm/setjmp_a32.S
-@@ -51,6 +51,8 @@
- #define SIZE(x)
- #endif
- 
-+	.section .note.GNU-stack,"",%progbits
-+
- /* Arm/Thumb interworking support:
- 
-    The interworking scheme expects functions to use a BX instruction
-diff --git a/ta/arch/arm/ta_entry_a32.S b/ta/arch/arm/ta_entry_a32.S
-index d2f8a69daa7f..cd9a12f9dbf9 100644
---- a/ta/arch/arm/ta_entry_a32.S
-+++ b/ta/arch/arm/ta_entry_a32.S
-@@ -5,6 +5,8 @@
- 
- #include <asm.S>
- 
-+	.section .note.GNU-stack,"",%progbits
-+
- /*
-  * This function is the bottom of the user call stack. Mark it as such so that
-  * the unwinding code won't try to go further down.
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.20.0/0005-core-arm-S-EL1-SPMC-boot-ABI-update.patch b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.20.0/0005-core-arm-S-EL1-SPMC-boot-ABI-update.patch
index 381cad9..e6fe716 100644
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.20.0/0005-core-arm-S-EL1-SPMC-boot-ABI-update.patch
+++ b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.20.0/0005-core-arm-S-EL1-SPMC-boot-ABI-update.patch
@@ -20,10 +20,11 @@
     file. Used by Trusted OS (BL32), that is, OP-TEE in this case
 Link: [2] https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/commit/?id=25ae7ad1878244f78206cc7c91f7bdbd267331a1
 
-Upstream-Status: Accepted
-
 Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
 Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+
+Upstream-Status: Backport [f1f431c7a92671b4fa397976d381cc5ad8adacc4]
+Signed-off-by: Gyorgy Szing <Gyorgy.Szing@arm.com>
 ---
  core/arch/arm/kernel/boot.c      |  8 +++++++-
  core/arch/arm/kernel/entry_a64.S | 17 ++++++++---------
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.20.0/0006-core-ffa-add-TOS_FW_CONFIG-handling.patch b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.20.0/0006-core-ffa-add-TOS_FW_CONFIG-handling.patch
index 5421b10..da0422b 100644
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.20.0/0006-core-ffa-add-TOS_FW_CONFIG-handling.patch
+++ b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.20.0/0006-core-ffa-add-TOS_FW_CONFIG-handling.patch
@@ -9,10 +9,11 @@
 retrieve it later. This is necessary for the CFG_CORE_SEL1_SPMC use
 case, because the SPMC manifest is passed in this DT.
 
-Upstream-Status: Accepted
-
 Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
 Signed-off-by: Balint Dobszay <balint.dobszay@arm.com>
+
+Upstream-Status: Backport [809fa817ae6331d98b55f7afaa3c20f8407822e4]
+Signed-off-by: Gyorgy Szing <Gyorgy.Szing@arm.com>
 ---
  core/arch/arm/kernel/boot.c               | 60 ++++++++++++++++++++++-
  core/arch/arm/kernel/entry_a32.S          |  3 +-
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.20.0/CVE-2023-41325.patch b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.20.0/CVE-2023-41325.patch
new file mode 100644
index 0000000..08acce0
--- /dev/null
+++ b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.20.0/CVE-2023-41325.patch
@@ -0,0 +1,634 @@
+From 800627f054959aac0dd3527495ee3fad0137600a Mon Sep 17 00:00:00 2001
+From: Jihwan Park <jihwp@amazon.com>
+Date: Mon, 3 Jul 2023 08:51:47 +0200
+Subject: [PATCH] core: crypto_bignum_free(): add indirection and set pointer
+ to NULL
+
+To prevent human mistake, crypto_bignum_free() sets the location of the
+bignum pointer to NULL after freeing it.
+
+Signed-off-by: Jihwan Park <jihwp@amazon.com>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
+Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
+Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
+
+CVE: CVE-2023-41325
+Upstream-Status: Backport
+Signed-off-by: Ross Burton <ross.burton@arm.com>
+---
+ core/crypto/crypto.c                        |  4 +--
+ core/drivers/crypto/caam/acipher/caam_dh.c  |  8 ++---
+ core/drivers/crypto/caam/acipher/caam_dsa.c | 14 ++++----
+ core/drivers/crypto/caam/acipher/caam_ecc.c | 10 +++---
+ core/drivers/crypto/caam/acipher/caam_rsa.c | 24 ++++++-------
+ core/drivers/crypto/se050/core/ecc.c        | 14 ++++----
+ core/drivers/crypto/se050/core/rsa.c        | 38 ++++++++++-----------
+ core/drivers/crypto/versal/ecc.c            |  6 ++--
+ core/include/crypto/crypto.h                |  2 +-
+ core/lib/libtomcrypt/dh.c                   |  8 ++---
+ core/lib/libtomcrypt/dsa.c                  | 14 ++++----
+ core/lib/libtomcrypt/ecc.c                  | 10 +++---
+ core/lib/libtomcrypt/mpi_desc.c             |  9 +++--
+ core/lib/libtomcrypt/rsa.c                  | 22 ++++++------
+ core/tee/tee_svc_cryp.c                     |  7 ++--
+ lib/libmbedtls/core/bignum.c                |  9 +++--
+ lib/libmbedtls/core/dh.c                    |  8 ++---
+ lib/libmbedtls/core/ecc.c                   | 10 +++---
+ lib/libmbedtls/core/rsa.c                   | 22 ++++++------
+ 19 files changed, 122 insertions(+), 117 deletions(-)
+
+diff --git a/core/crypto/crypto.c b/core/crypto/crypto.c
+index 9f7d35097..60cb89a31 100644
+--- a/core/crypto/crypto.c
++++ b/core/crypto/crypto.c
+@@ -498,9 +498,9 @@ void crypto_bignum_copy(struct bignum *to __unused,
+ 	bignum_cant_happen();
+ }
+ 
+-void crypto_bignum_free(struct bignum *a)
++void crypto_bignum_free(struct bignum **a)
+ {
+-	if (a)
++	if (a && *a)
+ 		panic();
+ }
+ 
+diff --git a/core/drivers/crypto/caam/acipher/caam_dh.c b/core/drivers/crypto/caam/acipher/caam_dh.c
+index 6131ff0ef..35fc44541 100644
+--- a/core/drivers/crypto/caam/acipher/caam_dh.c
++++ b/core/drivers/crypto/caam/acipher/caam_dh.c
+@@ -195,10 +195,10 @@ static TEE_Result do_allocate_keypair(struct dh_keypair *key, size_t size_bits)
+ err:
+ 	DH_TRACE("Allocation error");
+ 
+-	crypto_bignum_free(key->g);
+-	crypto_bignum_free(key->p);
+-	crypto_bignum_free(key->x);
+-	crypto_bignum_free(key->y);
++	crypto_bignum_free(&key->g);
++	crypto_bignum_free(&key->p);
++	crypto_bignum_free(&key->x);
++	crypto_bignum_free(&key->y);
+ 
+ 	return TEE_ERROR_OUT_OF_MEMORY;
+ }
+diff --git a/core/drivers/crypto/caam/acipher/caam_dsa.c b/core/drivers/crypto/caam/acipher/caam_dsa.c
+index 2696f0b3c..d60bb8e89 100644
+--- a/core/drivers/crypto/caam/acipher/caam_dsa.c
++++ b/core/drivers/crypto/caam/acipher/caam_dsa.c
+@@ -309,10 +309,10 @@ static TEE_Result do_allocate_keypair(struct dsa_keypair *key, size_t l_bits,
+ err:
+ 	DSA_TRACE("Allocation error");
+ 
+-	crypto_bignum_free(key->g);
+-	crypto_bignum_free(key->p);
+-	crypto_bignum_free(key->q);
+-	crypto_bignum_free(key->x);
++	crypto_bignum_free(&key->g);
++	crypto_bignum_free(&key->p);
++	crypto_bignum_free(&key->q);
++	crypto_bignum_free(&key->x);
+ 
+ 	return TEE_ERROR_OUT_OF_MEMORY;
+ }
+@@ -358,9 +358,9 @@ static TEE_Result do_allocate_publickey(struct dsa_public_key *key,
+ err:
+ 	DSA_TRACE("Allocation error");
+ 
+-	crypto_bignum_free(key->g);
+-	crypto_bignum_free(key->p);
+-	crypto_bignum_free(key->q);
++	crypto_bignum_free(&key->g);
++	crypto_bignum_free(&key->p);
++	crypto_bignum_free(&key->q);
+ 
+ 	return TEE_ERROR_OUT_OF_MEMORY;
+ }
+diff --git a/core/drivers/crypto/caam/acipher/caam_ecc.c b/core/drivers/crypto/caam/acipher/caam_ecc.c
+index 90e87c20a..6b12b6cbe 100644
+--- a/core/drivers/crypto/caam/acipher/caam_ecc.c
++++ b/core/drivers/crypto/caam/acipher/caam_ecc.c
+@@ -169,8 +169,8 @@ static TEE_Result do_allocate_keypair(struct ecc_keypair *key, size_t size_bits)
+ err:
+ 	ECC_TRACE("Allocation error");
+ 
+-	crypto_bignum_free(key->d);
+-	crypto_bignum_free(key->x);
++	crypto_bignum_free(&key->d);
++	crypto_bignum_free(&key->x);
+ 
+ 	return TEE_ERROR_OUT_OF_MEMORY;
+ }
+@@ -204,7 +204,7 @@ static TEE_Result do_allocate_publickey(struct ecc_public_key *key,
+ err:
+ 	ECC_TRACE("Allocation error");
+ 
+-	crypto_bignum_free(key->x);
++	crypto_bignum_free(&key->x);
+ 
+ 	return TEE_ERROR_OUT_OF_MEMORY;
+ }
+@@ -216,8 +216,8 @@ err:
+  */
+ static void do_free_publickey(struct ecc_public_key *key)
+ {
+-	crypto_bignum_free(key->x);
+-	crypto_bignum_free(key->y);
++	crypto_bignum_free(&key->x);
++	crypto_bignum_free(&key->y);
+ }
+ 
+ /*
+diff --git a/core/drivers/crypto/caam/acipher/caam_rsa.c b/core/drivers/crypto/caam/acipher/caam_rsa.c
+index e860c641c..b59ab0b6e 100644
+--- a/core/drivers/crypto/caam/acipher/caam_rsa.c
++++ b/core/drivers/crypto/caam/acipher/caam_rsa.c
+@@ -86,14 +86,14 @@ static uint8_t caam_era;
+  */
+ static void do_free_keypair(struct rsa_keypair *key)
+ {
+-	crypto_bignum_free(key->e);
+-	crypto_bignum_free(key->d);
+-	crypto_bignum_free(key->n);
+-	crypto_bignum_free(key->p);
+-	crypto_bignum_free(key->q);
+-	crypto_bignum_free(key->qp);
+-	crypto_bignum_free(key->dp);
+-	crypto_bignum_free(key->dq);
++	crypto_bignum_free(&key->e);
++	crypto_bignum_free(&key->d);
++	crypto_bignum_free(&key->n);
++	crypto_bignum_free(&key->p);
++	crypto_bignum_free(&key->q);
++	crypto_bignum_free(&key->qp);
++	crypto_bignum_free(&key->dp);
++	crypto_bignum_free(&key->dq);
+ }
+ 
+ /*
+@@ -435,8 +435,8 @@ static TEE_Result do_allocate_publickey(struct rsa_public_key *key,
+ err_alloc_publickey:
+ 	RSA_TRACE("Allocation error");
+ 
+-	crypto_bignum_free(key->e);
+-	crypto_bignum_free(key->n);
++	crypto_bignum_free(&key->e);
++	crypto_bignum_free(&key->n);
+ 
+ 	return TEE_ERROR_OUT_OF_MEMORY;
+ }
+@@ -448,8 +448,8 @@ err_alloc_publickey:
+  */
+ static void do_free_publickey(struct rsa_public_key *key)
+ {
+-	crypto_bignum_free(key->e);
+-	crypto_bignum_free(key->n);
++	crypto_bignum_free(&key->e);
++	crypto_bignum_free(&key->n);
+ }
+ 
+ /*
+diff --git a/core/drivers/crypto/se050/core/ecc.c b/core/drivers/crypto/se050/core/ecc.c
+index d74334760..52f82c69d 100644
+--- a/core/drivers/crypto/se050/core/ecc.c
++++ b/core/drivers/crypto/se050/core/ecc.c
+@@ -752,9 +752,9 @@ static TEE_Result do_alloc_keypair(struct ecc_keypair *s,
+ 		goto err;
+ 	return TEE_SUCCESS;
+ err:
+-	crypto_bignum_free(s->d);
+-	crypto_bignum_free(s->x);
+-	crypto_bignum_free(s->y);
++	crypto_bignum_free(&s->d);
++	crypto_bignum_free(&s->x);
++	crypto_bignum_free(&s->y);
+ 	return TEE_ERROR_OUT_OF_MEMORY;
+ }
+ 
+@@ -768,8 +768,8 @@ static TEE_Result do_alloc_publickey(struct ecc_public_key *s,
+ 		goto err;
+ 	return TEE_SUCCESS;
+ err:
+-	crypto_bignum_free(s->x);
+-	crypto_bignum_free(s->y);
++	crypto_bignum_free(&s->x);
++	crypto_bignum_free(&s->y);
+ 	return TEE_ERROR_OUT_OF_MEMORY;
+ }
+ 
+@@ -778,8 +778,8 @@ static void do_free_publickey(struct ecc_public_key *s)
+ 	if (!s)
+ 		return;
+ 
+-	crypto_bignum_free(s->x);
+-	crypto_bignum_free(s->y);
++	crypto_bignum_free(&s->x);
++	crypto_bignum_free(&s->y);
+ }
+ 
+ static struct drvcrypt_ecc driver_ecc = {
+diff --git a/core/drivers/crypto/se050/core/rsa.c b/core/drivers/crypto/se050/core/rsa.c
+index 815abb3cd..475d2b99a 100644
+--- a/core/drivers/crypto/se050/core/rsa.c
++++ b/core/drivers/crypto/se050/core/rsa.c
+@@ -537,14 +537,14 @@ static TEE_Result do_alloc_keypair(struct rsa_keypair *s,
+ 
+ 	return TEE_SUCCESS;
+ err:
+-	crypto_bignum_free(s->e);
+-	crypto_bignum_free(s->d);
+-	crypto_bignum_free(s->n);
+-	crypto_bignum_free(s->p);
+-	crypto_bignum_free(s->q);
+-	crypto_bignum_free(s->qp);
+-	crypto_bignum_free(s->dp);
+-	crypto_bignum_free(s->dq);
++	crypto_bignum_free(&s->e);
++	crypto_bignum_free(&s->d);
++	crypto_bignum_free(&s->n);
++	crypto_bignum_free(&s->p);
++	crypto_bignum_free(&s->q);
++	crypto_bignum_free(&s->qp);
++	crypto_bignum_free(&s->dp);
++	crypto_bignum_free(&s->dq);
+ 
+ 	return TEE_ERROR_OUT_OF_MEMORY;
+ }
+@@ -556,7 +556,7 @@ static TEE_Result do_alloc_publickey(struct rsa_public_key *s,
+ 	if (!bn_alloc_max(&s->e))
+ 		return TEE_ERROR_OUT_OF_MEMORY;
+ 	if (!bn_alloc_max(&s->n)) {
+-		crypto_bignum_free(s->e);
++		crypto_bignum_free(&s->e);
+ 		return TEE_ERROR_OUT_OF_MEMORY;
+ 	}
+ 
+@@ -566,8 +566,8 @@ static TEE_Result do_alloc_publickey(struct rsa_public_key *s,
+ static void do_free_publickey(struct rsa_public_key *s)
+ {
+ 	if (s) {
+-		crypto_bignum_free(s->n);
+-		crypto_bignum_free(s->e);
++		crypto_bignum_free(&s->n);
++		crypto_bignum_free(&s->e);
+ 	}
+ }
+ 
+@@ -587,14 +587,14 @@ static void do_free_keypair(struct rsa_keypair *s)
+ 			sss_se05x_key_store_erase_key(se050_kstore, &k_object);
+ 	}
+ 
+-	crypto_bignum_free(s->e);
+-	crypto_bignum_free(s->d);
+-	crypto_bignum_free(s->n);
+-	crypto_bignum_free(s->p);
+-	crypto_bignum_free(s->q);
+-	crypto_bignum_free(s->qp);
+-	crypto_bignum_free(s->dp);
+-	crypto_bignum_free(s->dq);
++	crypto_bignum_free(&s->e);
++	crypto_bignum_free(&s->d);
++	crypto_bignum_free(&s->n);
++	crypto_bignum_free(&s->p);
++	crypto_bignum_free(&s->q);
++	crypto_bignum_free(&s->qp);
++	crypto_bignum_free(&s->dp);
++	crypto_bignum_free(&s->dq);
+ }
+ 
+ static TEE_Result do_gen_keypair(struct rsa_keypair *key, size_t kb)
+diff --git a/core/drivers/crypto/versal/ecc.c b/core/drivers/crypto/versal/ecc.c
+index 3d5454509..18ec4f78d 100644
+--- a/core/drivers/crypto/versal/ecc.c
++++ b/core/drivers/crypto/versal/ecc.c
+@@ -284,9 +284,9 @@ static TEE_Result sign(uint32_t algo, struct ecc_keypair *key,
+ 
+ 	versal_mbox_alloc(bytes, NULL, &k);
+ 	crypto_bignum_bn2bin_eswap(key->curve, ephemeral.d, k.buf);
+-	crypto_bignum_free(ephemeral.d);
+-	crypto_bignum_free(ephemeral.x);
+-	crypto_bignum_free(ephemeral.y);
++	crypto_bignum_free(&ephemeral.d);
++	crypto_bignum_free(&ephemeral.x);
++	crypto_bignum_free(&ephemeral.y);
+ 
+ 	/* Private key*/
+ 	versal_mbox_alloc(bytes, NULL, &d);
+diff --git a/core/include/crypto/crypto.h b/core/include/crypto/crypto.h
+index 71a287ec6..0e6c139ce 100644
+--- a/core/include/crypto/crypto.h
++++ b/core/include/crypto/crypto.h
+@@ -98,7 +98,7 @@ size_t crypto_bignum_num_bytes(struct bignum *a);
+ size_t crypto_bignum_num_bits(struct bignum *a);
+ void crypto_bignum_bn2bin(const struct bignum *from, uint8_t *to);
+ void crypto_bignum_copy(struct bignum *to, const struct bignum *from);
+-void crypto_bignum_free(struct bignum *a);
++void crypto_bignum_free(struct bignum **a);
+ void crypto_bignum_clear(struct bignum *a);
+ 
+ /* return -1 if a<b, 0 if a==b, +1 if a>b */
+diff --git a/core/lib/libtomcrypt/dh.c b/core/lib/libtomcrypt/dh.c
+index 4eb9916f2..b1d0a4d00 100644
+--- a/core/lib/libtomcrypt/dh.c
++++ b/core/lib/libtomcrypt/dh.c
+@@ -28,10 +28,10 @@ TEE_Result crypto_acipher_alloc_dh_keypair(struct dh_keypair *s,
+ 		goto err;
+ 	return TEE_SUCCESS;
+ err:
+-	crypto_bignum_free(s->g);
+-	crypto_bignum_free(s->p);
+-	crypto_bignum_free(s->y);
+-	crypto_bignum_free(s->x);
++	crypto_bignum_free(&s->g);
++	crypto_bignum_free(&s->p);
++	crypto_bignum_free(&s->y);
++	crypto_bignum_free(&s->x);
+ 	return TEE_ERROR_OUT_OF_MEMORY;
+ }
+ 
+diff --git a/core/lib/libtomcrypt/dsa.c b/core/lib/libtomcrypt/dsa.c
+index a2dc720ed..d6243c469 100644
+--- a/core/lib/libtomcrypt/dsa.c
++++ b/core/lib/libtomcrypt/dsa.c
+@@ -30,10 +30,10 @@ TEE_Result crypto_acipher_alloc_dsa_keypair(struct dsa_keypair *s,
+ 		goto err;
+ 	return TEE_SUCCESS;
+ err:
+-	crypto_bignum_free(s->g);
+-	crypto_bignum_free(s->p);
+-	crypto_bignum_free(s->q);
+-	crypto_bignum_free(s->y);
++	crypto_bignum_free(&s->g);
++	crypto_bignum_free(&s->p);
++	crypto_bignum_free(&s->q);
++	crypto_bignum_free(&s->y);
+ 	return TEE_ERROR_OUT_OF_MEMORY;
+ }
+ 
+@@ -52,9 +52,9 @@ TEE_Result crypto_acipher_alloc_dsa_public_key(struct dsa_public_key *s,
+ 		goto err;
+ 	return TEE_SUCCESS;
+ err:
+-	crypto_bignum_free(s->g);
+-	crypto_bignum_free(s->p);
+-	crypto_bignum_free(s->q);
++	crypto_bignum_free(&s->g);
++	crypto_bignum_free(&s->p);
++	crypto_bignum_free(&s->q);
+ 	return TEE_ERROR_OUT_OF_MEMORY;
+ }
+ 
+diff --git a/core/lib/libtomcrypt/ecc.c b/core/lib/libtomcrypt/ecc.c
+index 938378247..fa645e17a 100644
+--- a/core/lib/libtomcrypt/ecc.c
++++ b/core/lib/libtomcrypt/ecc.c
+@@ -18,8 +18,8 @@ static void _ltc_ecc_free_public_key(struct ecc_public_key *s)
+ 	if (!s)
+ 		return;
+ 
+-	crypto_bignum_free(s->x);
+-	crypto_bignum_free(s->y);
++	crypto_bignum_free(&s->x);
++	crypto_bignum_free(&s->y);
+ }
+ 
+ /*
+@@ -465,8 +465,8 @@ TEE_Result crypto_asym_alloc_ecc_keypair(struct ecc_keypair *s,
+ err:
+ 	s->ops = NULL;
+ 
+-	crypto_bignum_free(s->d);
+-	crypto_bignum_free(s->x);
++	crypto_bignum_free(&s->d);
++	crypto_bignum_free(&s->x);
+ 
+ 	return TEE_ERROR_OUT_OF_MEMORY;
+ }
+@@ -541,7 +541,7 @@ TEE_Result crypto_asym_alloc_ecc_public_key(struct ecc_public_key *s,
+ err:
+ 	s->ops = NULL;
+ 
+-	crypto_bignum_free(s->x);
++	crypto_bignum_free(&s->x);
+ 
+ 	return TEE_ERROR_OUT_OF_MEMORY;
+ }
+diff --git a/core/lib/libtomcrypt/mpi_desc.c b/core/lib/libtomcrypt/mpi_desc.c
+index 235fbe630..ff8dd13c7 100644
+--- a/core/lib/libtomcrypt/mpi_desc.c
++++ b/core/lib/libtomcrypt/mpi_desc.c
+@@ -763,10 +763,13 @@ struct bignum *crypto_bignum_allocate(size_t size_bits)
+ 	return (struct bignum *)bn;
+ }
+ 
+-void crypto_bignum_free(struct bignum *s)
++void crypto_bignum_free(struct bignum **s)
+ {
+-	mbedtls_mpi_free((mbedtls_mpi *)s);
+-	free(s);
++	assert(s);
++
++	mbedtls_mpi_free((mbedtls_mpi *)*s);
++	free(*s);
++	*s = NULL;
+ }
+ 
+ void crypto_bignum_clear(struct bignum *s)
+diff --git a/core/lib/libtomcrypt/rsa.c b/core/lib/libtomcrypt/rsa.c
+index 8d0443f36..13ed23934 100644
+--- a/core/lib/libtomcrypt/rsa.c
++++ b/core/lib/libtomcrypt/rsa.c
+@@ -131,7 +131,7 @@ TEE_Result sw_crypto_acipher_alloc_rsa_public_key(struct rsa_public_key *s,
+ 		goto err;
+ 	return TEE_SUCCESS;
+ err:
+-	crypto_bignum_free(s->e);
++	crypto_bignum_free(&s->e);
+ 	return TEE_ERROR_OUT_OF_MEMORY;
+ }
+ 
+@@ -143,8 +143,8 @@ void sw_crypto_acipher_free_rsa_public_key(struct rsa_public_key *s)
+ {
+ 	if (!s)
+ 		return;
+-	crypto_bignum_free(s->n);
+-	crypto_bignum_free(s->e);
++	crypto_bignum_free(&s->n);
++	crypto_bignum_free(&s->e);
+ }
+ 
+ 
+@@ -155,14 +155,14 @@ void sw_crypto_acipher_free_rsa_keypair(struct rsa_keypair *s)
+ {
+ 	if (!s)
+ 		return;
+-	crypto_bignum_free(s->e);
+-	crypto_bignum_free(s->d);
+-	crypto_bignum_free(s->n);
+-	crypto_bignum_free(s->p);
+-	crypto_bignum_free(s->q);
+-	crypto_bignum_free(s->qp);
+-	crypto_bignum_free(s->dp);
+-	crypto_bignum_free(s->dq);
++	crypto_bignum_free(&s->e);
++	crypto_bignum_free(&s->d);
++	crypto_bignum_free(&s->n);
++	crypto_bignum_free(&s->p);
++	crypto_bignum_free(&s->q);
++	crypto_bignum_free(&s->qp);
++	crypto_bignum_free(&s->dp);
++	crypto_bignum_free(&s->dq);
+ }
+ 
+ TEE_Result crypto_acipher_gen_rsa_key(struct rsa_keypair *key,
+diff --git a/core/tee/tee_svc_cryp.c b/core/tee/tee_svc_cryp.c
+index 534e5ac39..880809753 100644
+--- a/core/tee/tee_svc_cryp.c
++++ b/core/tee/tee_svc_cryp.c
+@@ -869,8 +869,7 @@ static void op_attr_bignum_free(void *attr)
+ {
+ 	struct bignum **bn = attr;
+ 
+-	crypto_bignum_free(*bn);
+-	*bn = NULL;
++	crypto_bignum_free(bn);
+ }
+ 
+ static TEE_Result op_attr_value_from_user(void *attr, const void *buffer,
+@@ -3445,8 +3444,8 @@ TEE_Result syscall_cryp_derive_key(unsigned long state,
+ 		} else {
+ 			res = TEE_ERROR_OUT_OF_MEMORY;
+ 		}
+-		crypto_bignum_free(pub);
+-		crypto_bignum_free(ss);
++		crypto_bignum_free(&pub);
++		crypto_bignum_free(&ss);
+ 	} else if (TEE_ALG_GET_MAIN_ALG(cs->algo) == TEE_MAIN_ALGO_ECDH) {
+ 		struct ecc_public_key key_public;
+ 		uint8_t *pt_secret;
+diff --git a/lib/libmbedtls/core/bignum.c b/lib/libmbedtls/core/bignum.c
+index 61f6c5c60..dea30f61a 100644
+--- a/lib/libmbedtls/core/bignum.c
++++ b/lib/libmbedtls/core/bignum.c
+@@ -87,10 +87,13 @@ struct bignum *crypto_bignum_allocate(size_t size_bits)
+ 	return (struct bignum *)bn;
+ }
+ 
+-void crypto_bignum_free(struct bignum *s)
++void crypto_bignum_free(struct bignum **s)
+ {
+-	mbedtls_mpi_free((mbedtls_mpi *)s);
+-	free(s);
++	assert(s);
++
++	mbedtls_mpi_free((mbedtls_mpi *)*s);
++	free(*s);
++	*s = NULL;
+ }
+ 
+ void crypto_bignum_clear(struct bignum *s)
+diff --git a/lib/libmbedtls/core/dh.c b/lib/libmbedtls/core/dh.c
+index b3415aaa7..e95aa1495 100644
+--- a/lib/libmbedtls/core/dh.c
++++ b/lib/libmbedtls/core/dh.c
+@@ -35,10 +35,10 @@ TEE_Result crypto_acipher_alloc_dh_keypair(struct dh_keypair *s,
+ 		goto err;
+ 	return TEE_SUCCESS;
+ err:
+-	crypto_bignum_free(s->g);
+-	crypto_bignum_free(s->p);
+-	crypto_bignum_free(s->y);
+-	crypto_bignum_free(s->x);
++	crypto_bignum_free(&s->g);
++	crypto_bignum_free(&s->p);
++	crypto_bignum_free(&s->y);
++	crypto_bignum_free(&s->x);
+ 	return TEE_ERROR_OUT_OF_MEMORY;
+ }
+ 
+diff --git a/lib/libmbedtls/core/ecc.c b/lib/libmbedtls/core/ecc.c
+index fd4a51b9d..46cd9fd1c 100644
+--- a/lib/libmbedtls/core/ecc.c
++++ b/lib/libmbedtls/core/ecc.c
+@@ -40,8 +40,8 @@ static void ecc_free_public_key(struct ecc_public_key *s)
+ 	if (!s)
+ 		return;
+ 
+-	crypto_bignum_free(s->x);
+-	crypto_bignum_free(s->y);
++	crypto_bignum_free(&s->x);
++	crypto_bignum_free(&s->y);
+ }
+ 
+ /*
+@@ -484,8 +484,8 @@ TEE_Result crypto_asym_alloc_ecc_keypair(struct ecc_keypair *s,
+ 	return TEE_SUCCESS;
+ 
+ err:
+-	crypto_bignum_free(s->d);
+-	crypto_bignum_free(s->x);
++	crypto_bignum_free(&s->d);
++	crypto_bignum_free(&s->x);
+ 
+ 	return TEE_ERROR_OUT_OF_MEMORY;
+ }
+@@ -581,7 +581,7 @@ TEE_Result crypto_asym_alloc_ecc_public_key(struct ecc_public_key *s,
+ 	return TEE_SUCCESS;
+ 
+ err:
+-	crypto_bignum_free(s->x);
++	crypto_bignum_free(&s->x);
+ 
+ 	return TEE_ERROR_OUT_OF_MEMORY;
+ }
+diff --git a/lib/libmbedtls/core/rsa.c b/lib/libmbedtls/core/rsa.c
+index c3b5be509..a8aeb2c04 100644
+--- a/lib/libmbedtls/core/rsa.c
++++ b/lib/libmbedtls/core/rsa.c
+@@ -183,7 +183,7 @@ TEE_Result sw_crypto_acipher_alloc_rsa_public_key(struct rsa_public_key *s,
+ 		goto err;
+ 	return TEE_SUCCESS;
+ err:
+-	crypto_bignum_free(s->e);
++	crypto_bignum_free(&s->e);
+ 	return TEE_ERROR_OUT_OF_MEMORY;
+ }
+ 
+@@ -194,8 +194,8 @@ void sw_crypto_acipher_free_rsa_public_key(struct rsa_public_key *s)
+ {
+ 	if (!s)
+ 		return;
+-	crypto_bignum_free(s->n);
+-	crypto_bignum_free(s->e);
++	crypto_bignum_free(&s->n);
++	crypto_bignum_free(&s->e);
+ }
+ 
+ void crypto_acipher_free_rsa_keypair(struct rsa_keypair *s)
+@@ -205,14 +205,14 @@ void sw_crypto_acipher_free_rsa_keypair(struct rsa_keypair *s)
+ {
+ 	if (!s)
+ 		return;
+-	crypto_bignum_free(s->e);
+-	crypto_bignum_free(s->d);
+-	crypto_bignum_free(s->n);
+-	crypto_bignum_free(s->p);
+-	crypto_bignum_free(s->q);
+-	crypto_bignum_free(s->qp);
+-	crypto_bignum_free(s->dp);
+-	crypto_bignum_free(s->dq);
++	crypto_bignum_free(&s->e);
++	crypto_bignum_free(&s->d);
++	crypto_bignum_free(&s->n);
++	crypto_bignum_free(&s->p);
++	crypto_bignum_free(&s->q);
++	crypto_bignum_free(&s->qp);
++	crypto_bignum_free(&s->dp);
++	crypto_bignum_free(&s->dq);
+ }
+ 
+ TEE_Result crypto_acipher_gen_rsa_key(struct rsa_keypair *key,
+-- 
+2.34.1
+
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.22.0/0001-allow-setting-sysroot-for-libgcc-lookup.patch b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.22.0/0001-allow-setting-sysroot-for-libgcc-lookup.patch
new file mode 100644
index 0000000..392e8d8
--- /dev/null
+++ b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.22.0/0001-allow-setting-sysroot-for-libgcc-lookup.patch
@@ -0,0 +1,34 @@
+From 02ea8e616ac615efe3507d627dfba9820d3357f6 Mon Sep 17 00:00:00 2001
+From: Ross Burton <ross.burton@arm.com>
+Date: Tue, 26 May 2020 14:38:02 -0500
+Subject: [PATCH] allow setting sysroot for libgcc lookup
+
+Explicitly pass the new variable LIBGCC_LOCATE_CFLAGS variable when searching
+for the compiler libraries as there's no easy way to reliably pass --sysroot
+otherwise.
+
+Upstream-Status: Pending [https://github.com/OP-TEE/optee_os/issues/4188]
+Signed-off-by: Ross Burton <ross.burton@arm.com>
+---
+ mk/gcc.mk | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/mk/gcc.mk b/mk/gcc.mk
+index adc77a24f25e..81bfa78ad8d7 100644
+--- a/mk/gcc.mk
++++ b/mk/gcc.mk
+@@ -13,11 +13,11 @@ nostdinc$(sm)	:= -nostdinc -isystem $(shell $(CC$(sm)) \
+ 			-print-file-name=include 2> /dev/null)
+ 
+ # Get location of libgcc from gcc
+-libgcc$(sm)  	:= $(shell $(CC$(sm)) $(CFLAGS$(arch-bits-$(sm))) \
++libgcc$(sm)  	:= $(shell $(CC$(sm)) $(LIBGCC_LOCATE_CFLAGS) $(CFLAGS$(arch-bits-$(sm))) \
+ 			-print-libgcc-file-name 2> /dev/null)
+-libstdc++$(sm)	:= $(shell $(CXX$(sm)) $(CXXFLAGS$(arch-bits-$(sm))) $(comp-cxxflags$(sm)) \
++libstdc++$(sm)	:= $(shell $(CXX$(sm)) $(LIBGCC_LOCATE_CFLAGS) $(CXXFLAGS$(arch-bits-$(sm))) $(comp-cxxflags$(sm)) \
+ 			-print-file-name=libstdc++.a 2> /dev/null)
+-libgcc_eh$(sm)	:= $(shell $(CXX$(sm)) $(CXXFLAGS$(arch-bits-$(sm))) $(comp-cxxflags$(sm)) \
++libgcc_eh$(sm)	:= $(shell $(CXX$(sm)) $(LIBGCC_LOCATE_CFLAGS) $(CXXFLAGS$(arch-bits-$(sm))) $(comp-cxxflags$(sm)) \
+ 			-print-file-name=libgcc_eh.a 2> /dev/null)
+ 
+ # Define these to something to discover accidental use
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.22.0/0002-core-Define-section-attributes-for-clang.patch b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.22.0/0002-core-Define-section-attributes-for-clang.patch
new file mode 100644
index 0000000..15bdf07
--- /dev/null
+++ b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.22.0/0002-core-Define-section-attributes-for-clang.patch
@@ -0,0 +1,240 @@
+From 6f588813a170a671ebf1d6b51cebc7bc761295dc Mon Sep 17 00:00:00 2001
+From: Emekcan Aras <emekcan.aras@arm.com>
+Date: Wed, 21 Dec 2022 10:55:58 +0000
+Subject: [PATCH] core: Define section attributes for clang
+
+Clang's attribute section is not same as gcc, here we need to add flags
+to sections so they can be eventually collected by linker into final
+output segments. Only way to do so with clang is to use
+
+pragma clang section ...
+
+The behavious is described here [1], this allows us to define names bss
+sections. This was not an issue until clang-15 where LLD linker starts
+to detect the section flags before merging them and throws the following
+errors
+
+| ld.lld: error: section type mismatch for .nozi.kdata_page
+| >>> /mnt/b/yoe/master/build/tmp/work/qemuarm64-yoe-linux/optee-os-tadevkit/3.17.0-r0/build/core/arch/arm/kernel/thread.o:(.nozi.kdata_page): SHT_PROGBITS
+| >>> output section .nozi: SHT_NOBITS
+|
+| ld.lld: error: section type mismatch for .nozi.mmu.l2
+| >>> /mnt/b/yoe/master/build/tmp/work/qemuarm64-yoe-linux/optee-os-tadevkit/3.17.0-r0/build/core/arch/arm/mm/core_mmu_lpae.o:(.nozi.mmu.l2): SHT_PROGBITS
+| >>> output section .nozi: SHT_NOBITS
+
+These sections should be carrying SHT_NOBITS but so far it was not
+possible to do so, this patch tries to use clangs pragma to get this
+going and match the functionality with gcc.
+
+[1] https://intel.github.io/llvm-docs/clang/LanguageExtensions.html#specifying-section-names-for-global-objects-pragma-clang-section
+
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ core/arch/arm/kernel/thread.c    | 19 +++++++++++++++--
+ core/arch/arm/mm/core_mmu_lpae.c | 35 +++++++++++++++++++++++++++----
+ core/arch/arm/mm/core_mmu_v7.c   | 36 +++++++++++++++++++++++++++++---
+ core/arch/arm/mm/pgt_cache.c     | 12 ++++++++++-
+ core/kernel/thread.c             | 13 +++++++++++-
+ 5 files changed, 104 insertions(+), 11 deletions(-)
+
+diff --git a/core/arch/arm/kernel/thread.c b/core/arch/arm/kernel/thread.c
+index 4487ef026df9..f3624389611b 100644
+--- a/core/arch/arm/kernel/thread.c
++++ b/core/arch/arm/kernel/thread.c
+@@ -44,15 +44,30 @@ static size_t thread_user_kcode_size __nex_bss;
+ #if defined(CFG_CORE_UNMAP_CORE_AT_EL0) && \
+ 	defined(CFG_CORE_WORKAROUND_SPECTRE_BP_SEC) && defined(ARM64)
+ long thread_user_kdata_sp_offset __nex_bss;
++#ifdef __clang__
++#ifndef CFG_VIRTUALIZATION
++#pragma clang section bss=".nozi.kdata_page"
++#else
++#pragma clang section bss=".nex_nozi.kdata_page"
++#endif
++#endif
+ static uint8_t thread_user_kdata_page[
+ 	ROUNDUP(sizeof(struct thread_core_local) * CFG_TEE_CORE_NB_CORE,
+ 		SMALL_PAGE_SIZE)]
+ 	__aligned(SMALL_PAGE_SIZE)
++#ifndef __clang__
+ #ifndef CFG_NS_VIRTUALIZATION
+-	__section(".nozi.kdata_page");
++	__section(".nozi.kdata_page")
+ #else
+-	__section(".nex_nozi.kdata_page");
++	__section(".nex_nozi.kdata_page")
+ #endif
++#endif
++    ;
++#endif
++
++/* reset BSS section to default ( .bss ) */
++#ifdef __clang__
++#pragma clang section bss=""
+ #endif
+ 
+ #ifdef ARM32
+diff --git a/core/arch/arm/mm/core_mmu_lpae.c b/core/arch/arm/mm/core_mmu_lpae.c
+index 7e79f780ad28..ec4db9dc98c5 100644
+--- a/core/arch/arm/mm/core_mmu_lpae.c
++++ b/core/arch/arm/mm/core_mmu_lpae.c
+@@ -233,19 +233,46 @@ typedef uint16_t l1_idx_t;
+ typedef uint64_t base_xlat_tbls_t[CFG_TEE_CORE_NB_CORE][NUM_BASE_LEVEL_ENTRIES];
+ typedef uint64_t xlat_tbl_t[XLAT_TABLE_ENTRIES];
+ 
++#ifdef __clang__
++#pragma clang section bss=".nozi.mmu.base_table"
++#endif
+ static base_xlat_tbls_t base_xlation_table[NUM_BASE_TABLES]
+ 	__aligned(NUM_BASE_LEVEL_ENTRIES * XLAT_ENTRY_SIZE)
+-	__section(".nozi.mmu.base_table");
++#ifndef __clang__
++	__section(".nozi.mmu.base_table")
++#endif
++;
++#ifdef __clang__
++#pragma clang section bss=""
++#endif
+ 
++#ifdef __clang__
++#pragma clang section bss=".nozi.mmu.l2"
++#endif
+ static xlat_tbl_t xlat_tables[MAX_XLAT_TABLES]
+-	__aligned(XLAT_TABLE_SIZE) __section(".nozi.mmu.l2");
++	__aligned(XLAT_TABLE_SIZE)
++#ifndef __clang__
++	__section(".nozi.mmu.l2")
++#endif
++;
++#ifdef __clang__
++#pragma clang section bss=""
++#endif
+ 
+ #define XLAT_TABLES_SIZE	(sizeof(xlat_tbl_t) * MAX_XLAT_TABLES)
+ 
++#ifdef __clang__
++#pragma clang section bss=".nozi.mmu.l2"
++#endif
+ /* MMU L2 table for TAs, one for each thread */
+ static xlat_tbl_t xlat_tables_ul1[CFG_NUM_THREADS]
+-	__aligned(XLAT_TABLE_SIZE) __section(".nozi.mmu.l2");
+-
++#ifndef __clang__
++	__aligned(XLAT_TABLE_SIZE) __section(".nozi.mmu.l2")
++#endif
++;
++#ifdef __clang__
++#pragma clang section bss=""
++#endif
+ /*
+  * TAs page table entry inside a level 1 page table.
+  *
+diff --git a/core/arch/arm/mm/core_mmu_v7.c b/core/arch/arm/mm/core_mmu_v7.c
+index 61e703da89c8..1960c08ca688 100644
+--- a/core/arch/arm/mm/core_mmu_v7.c
++++ b/core/arch/arm/mm/core_mmu_v7.c
+@@ -204,16 +204,46 @@ typedef uint32_t l1_xlat_tbl_t[NUM_L1_ENTRIES];
+ typedef uint32_t l2_xlat_tbl_t[NUM_L2_ENTRIES];
+ typedef uint32_t ul1_xlat_tbl_t[NUM_UL1_ENTRIES];
+ 
++#ifdef __clang__
++#pragma clang section bss=".nozi.mmu.l1"
++#endif
+ static l1_xlat_tbl_t main_mmu_l1_ttb
+-		__aligned(L1_ALIGNMENT) __section(".nozi.mmu.l1");
++		__aligned(L1_ALIGNMENT)
++#ifndef __clang__
++       __section(".nozi.mmu.l1")
++#endif
++;
++#ifdef __clang__
++#pragma clang section bss=""
++#endif
+ 
+ /* L2 MMU tables */
++#ifdef __clang__
++#pragma clang section bss=".nozi.mmu.l2"
++#endif
+ static l2_xlat_tbl_t main_mmu_l2_ttb[MAX_XLAT_TABLES]
+-		__aligned(L2_ALIGNMENT) __section(".nozi.mmu.l2");
++		__aligned(L2_ALIGNMENT)
++#ifndef __clang__
++       __section(".nozi.mmu.l2")
++#endif
++;
++#ifdef __clang__
++#pragma clang section bss=""
++#endif
+ 
+ /* MMU L1 table for TAs, one for each thread */
++#ifdef __clang__
++#pragma clang section bss=".nozi.mmu.ul1"
++#endif
+ static ul1_xlat_tbl_t main_mmu_ul1_ttb[CFG_NUM_THREADS]
+-		__aligned(UL1_ALIGNMENT) __section(".nozi.mmu.ul1");
++		__aligned(UL1_ALIGNMENT)
++#ifndef __clang__
++       __section(".nozi.mmu.ul1")
++#endif
++;
++#ifdef __clang__
++#pragma clang section bss=""
++#endif
+ 
+ struct mmu_partition {
+ 	l1_xlat_tbl_t *l1_table;
+diff --git a/core/arch/arm/mm/pgt_cache.c b/core/arch/arm/mm/pgt_cache.c
+index 79553c6d2183..b9efdf42780b 100644
+--- a/core/arch/arm/mm/pgt_cache.c
++++ b/core/arch/arm/mm/pgt_cache.c
+@@ -410,8 +410,18 @@ void pgt_init(void)
+ 	 * has a large alignment, while .bss has a small alignment. The current
+ 	 * link script is optimized for small alignment in .bss
+ 	 */
++#ifdef __clang__
++#pragma clang section bss=".nozi.mmu.l2"
++#endif
+ 	static uint8_t pgt_tables[PGT_CACHE_SIZE][PGT_SIZE]
+-			__aligned(PGT_SIZE) __section(".nozi.pgt_cache");
++			__aligned(PGT_SIZE)
++#ifndef __clang__
++			__section(".nozi.pgt_cache")
++#endif
++			;
++#ifdef __clang__
++#pragma clang section bss=""
++#endif
+ 	size_t n;
+ 
+ 	for (n = 0; n < ARRAY_SIZE(pgt_tables); n++) {
+diff --git a/core/kernel/thread.c b/core/kernel/thread.c
+index 2a1f22dce635..5516b677141a 100644
+--- a/core/kernel/thread.c
++++ b/core/kernel/thread.c
+@@ -39,13 +39,24 @@ static uint32_t end_canary_value = 0xababab00;
+ 	name[stack_num][sizeof(name[stack_num]) / sizeof(uint32_t) - 1]
+ #endif
+ 
++#define DO_PRAGMA(x) _Pragma (#x)
++
++#ifdef __clang__
++#define DECLARE_STACK(name, num_stacks, stack_size, linkage) \
++DO_PRAGMA (clang section bss=".nozi_stack." #name) \
++linkage uint32_t name[num_stacks] \
++		[ROUNDUP(stack_size + STACK_CANARY_SIZE + STACK_CHECK_EXTRA, \
++			 STACK_ALIGNMENT) / sizeof(uint32_t)] \
++		__attribute__((aligned(STACK_ALIGNMENT))); \
++DO_PRAGMA(clang section bss="")
++#else
+ #define DECLARE_STACK(name, num_stacks, stack_size, linkage) \
+ linkage uint32_t name[num_stacks] \
+ 		[ROUNDUP(stack_size + STACK_CANARY_SIZE + STACK_CHECK_EXTRA, \
+ 			 STACK_ALIGNMENT) / sizeof(uint32_t)] \
+ 		__attribute__((section(".nozi_stack." # name), \
+ 			       aligned(STACK_ALIGNMENT)))
+-
++#endif
+ #define GET_STACK(stack) ((vaddr_t)(stack) + STACK_SIZE(stack))
+ 
+ DECLARE_STACK(stack_tmp, CFG_TEE_CORE_NB_CORE, STACK_TMP_SIZE,
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.22.0/0003-optee-enable-clang-support.patch b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.22.0/0003-optee-enable-clang-support.patch
new file mode 100644
index 0000000..b4ea8ed
--- /dev/null
+++ b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.22.0/0003-optee-enable-clang-support.patch
@@ -0,0 +1,29 @@
+From 9c55b7a4e39617c2abbf4e0e39fd8041c7b2b9b6 Mon Sep 17 00:00:00 2001
+From: Brett Warren <brett.warren@arm.com>
+Date: Wed, 23 Sep 2020 09:27:34 +0100
+Subject: [PATCH] optee: enable clang support
+
+When compiling with clang, the LIBGCC_LOCATE_CFLAG variable used
+to provide a sysroot wasn't included, which results in not locating
+compiler-rt. This is mitigated by including the variable as ammended.
+
+Upstream-Status: Pending
+ChangeId: 8ba69a4b2eb8ebaa047cb266c9aa6c2c3da45701
+Signed-off-by: Brett Warren <brett.warren@arm.com>
+---
+ mk/clang.mk | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mk/clang.mk b/mk/clang.mk
+index a045beee8482..1ebe2f702dcd 100644
+--- a/mk/clang.mk
++++ b/mk/clang.mk
+@@ -30,7 +30,7 @@ comp-cflags-warns-clang := -Wno-language-extension-token \
+ 
+ # Note, use the compiler runtime library (libclang_rt.builtins.*.a) instead of
+ # libgcc for clang
+-libgcc$(sm)	:= $(shell $(CC$(sm)) $(CFLAGS$(arch-bits-$(sm))) \
++libgcc$(sm)	:= $(shell $(CC$(sm)) $(LIBGCC_LOCATE_CFLAGS) $(CFLAGS$(arch-bits-$(sm))) \
+ 			-rtlib=compiler-rt -print-libgcc-file-name 2> /dev/null)
+ 
+ # Core ASLR relies on the executable being ready to run from its preferred load
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.22.0/0004-core-link-add-no-warn-rwx-segments.patch b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.22.0/0004-core-link-add-no-warn-rwx-segments.patch
new file mode 100644
index 0000000..d418d46
--- /dev/null
+++ b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-3.22.0/0004-core-link-add-no-warn-rwx-segments.patch
@@ -0,0 +1,62 @@
+From 3e191f732b3eba699b91ffd7ffa2ae0787f08947 Mon Sep 17 00:00:00 2001
+From: Jerome Forissier <jerome.forissier@linaro.org>
+Date: Fri, 5 Aug 2022 09:48:03 +0200
+Subject: [PATCH] core: link: add --no-warn-rwx-segments
+
+Signed-off-by: Anton Antonov <Anton.Antonov@arm.com>
+Upstream-Status: Backport [https://github.com/OP-TEE/optee_os/pull/5474]
+
+binutils ld.bfd generates one RWX LOAD segment by merging several sections
+with mixed R/W/X attributes (.text, .rodata, .data). After version 2.38 it
+also warns by default when that happens [1], which breaks the build due to
+--fatal-warnings. The RWX segment is not a problem for the TEE core, since
+that information is not used to set memory permissions. Therefore, silence
+the warning.
+
+Link: [1] https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ba951afb99912da01a6e8434126b8fac7aa75107
+Link: https://sourceware.org/bugzilla/show_bug.cgi?id=29448
+Reported-by: Dominique Martinet <dominique.martinet@atmark-techno.com>
+Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
+Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
+---
+ core/arch/arm/kernel/link.mk | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/core/arch/arm/kernel/link.mk b/core/arch/arm/kernel/link.mk
+index 49e9f4fa18a5..9e1cc172fb8a 100644
+--- a/core/arch/arm/kernel/link.mk
++++ b/core/arch/arm/kernel/link.mk
+@@ -37,6 +37,7 @@ link-ldflags += --sort-section=alignment
+ link-ldflags += --fatal-warnings
+ link-ldflags += --gc-sections
+ link-ldflags += $(link-ldflags-common)
++link-ldflags += $(call ld-option,--no-warn-rwx-segments)
+ 
+ link-ldadd  = $(LDADD)
+ link-ldadd += $(ldflags-external)
+@@ -61,6 +62,7 @@ link-script-cppflags := \
+ 		$(cppflagscore))
+ 
+ ldargs-all_objs := -T $(link-script-dummy) --no-check-sections \
++		   $(call ld-option,--no-warn-rwx-segments) \
+ 		   $(link-ldflags-common) \
+ 		   $(link-objs) $(link-ldadd) $(libgcccore)
+ cleanfiles += $(link-out-dir)/all_objs.o
+@@ -75,7 +77,7 @@ $(link-out-dir)/unpaged_entries.txt: $(link-out-dir)/all_objs.o
+ 		$(AWK) '/ ____keep_pager/ { printf "-u%s ", $$3 }' > $@
+ 
+ unpaged-ldargs := -T $(link-script-dummy) --no-check-sections --gc-sections \
+-		 $(link-ldflags-common)
++		 $(link-ldflags-common) $(call ld-option,--no-warn-rwx-segments)
+ unpaged-ldadd := $(objs) $(link-ldadd) $(libgcccore)
+ cleanfiles += $(link-out-dir)/unpaged.o
+ $(link-out-dir)/unpaged.o: $(link-out-dir)/unpaged_entries.txt
+@@ -104,7 +106,7 @@ $(link-out-dir)/init_entries.txt: $(link-out-dir)/all_objs.o
+ 		$(AWK) '/ ____keep_init/ { printf "-u%s ", $$3 }' > $@
+ 
+ init-ldargs := -T $(link-script-dummy) --no-check-sections --gc-sections \
+-	       $(link-ldflags-common)
++	       $(link-ldflags-common) $(call ld-option,--no-warn-rwx-segments)
+ init-ldadd := $(link-objs-init) $(link-out-dir)/version.o  $(link-ldadd) \
+ 	      $(libgcccore)
+ cleanfiles += $(link-out-dir)/init.o
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-n1sdp.inc b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-n1sdp.inc
index 80a11b5..1b66cd5 100644
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-n1sdp.inc
+++ b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-n1sdp.inc
@@ -8,10 +8,9 @@
 SRC_URI:append = " \
     file://0001-core-arm-add-MPIDR-affinity-shift-and-mask-for-32-bi.patch \
     file://0002-plat-n1sdp-add-N1SDP-platform-support.patch \
-    file://0003-HACK-disable-instruction-cache-and-data-cache.patch \
-    file://0004-Handle-logging-syscall.patch \
-    file://0005-plat-n1sdp-register-DRAM1-to-optee-os.patch \
-    file://0006-plat-n1sdp-add-external-device-tree-base-and-size.patch \
+    file://0003-Handle-logging-syscall.patch \
+    file://0004-plat-n1sdp-register-DRAM1-to-optee-os.patch \
+    file://0005-plat-n1sdp-add-external-device-tree-base-and-size.patch \
     "
 
 EXTRA_OEMAKE += " CFG_TEE_CORE_LOG_LEVEL=4"
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-tadevkit_3.18.0.bbappend b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-tadevkit_3.18.0.bbappend
deleted file mode 100644
index 0cb9b05..0000000
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-tadevkit_3.18.0.bbappend
+++ /dev/null
@@ -1,6 +0,0 @@
-# Machine specific configurations
-
-MACHINE_OPTEE_OS_TADEVKIT_REQUIRE ?= ""
-MACHINE_OPTEE_OS_TADEVKIT_REQUIRE:tc = "optee-os-tc.inc"
-
-require ${MACHINE_OPTEE_OS_TADEVKIT_REQUIRE}
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-tadevkit_3.18.0.bb b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-tadevkit_3.22.0.bb
similarity index 66%
rename from meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-tadevkit_3.18.0.bb
rename to meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-tadevkit_3.22.0.bb
index ff0baf8..4449616 100644
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-tadevkit_3.18.0.bb
+++ b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os-tadevkit_3.22.0.bb
@@ -1,4 +1,4 @@
-require optee-os_3.18.0.bb
+require optee-os_3.22.0.bb
 
 SUMMARY = "OP-TEE Trusted OS TA devkit"
 DESCRIPTION = "OP-TEE TA devkit for build TAs"
@@ -22,3 +22,8 @@
 
 # Build paths are currently embedded
 INSANE_SKIP:${PN}-dev += "buildpaths"
+
+# Include extra headers needed by SPMC tests to TA DEVKIT.
+# Supported after op-tee v3.20
+EXTRA_OEMAKE:append = "${@bb.utils.contains('MACHINE_FEATURES', 'optee-spmc-test', \
+                                        ' CFG_SPMC_TESTS=y', '' , d)}"
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.18.0.bb b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.18.0.bb
deleted file mode 100644
index 6e1e6ad..0000000
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.18.0.bb
+++ /dev/null
@@ -1,15 +0,0 @@
-require recipes-security/optee/optee-os.inc
-
-DEPENDS += "dtc-native"
-
-FILESEXTRAPATHS:prepend := "${THISDIR}/${P}:"
-
-SRCREV = "1ee647035939e073a2e8dddb727c0f019cc035f1"
-SRC_URI += " \
-    file://0001-allow-setting-sysroot-for-libgcc-lookup.patch \
-    file://0002-optee-enable-clang-support.patch \
-    file://0003-core-link-add-no-warn-rwx-segments.patch \
-    file://0004-core-Define-section-attributes-for-clang.patch \
-    file://0005-core-ldelf-link-add-z-execstack.patch \
-    file://0006-arm32-libutils-libutee-ta-add-.note.GNU-stack-sectio.patch \
-   "
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.18.0.bbappend b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.18.0.bbappend
deleted file mode 100644
index e276fb8..0000000
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.18.0.bbappend
+++ /dev/null
@@ -1,6 +0,0 @@
-# Machine specific configurations
-
-MACHINE_OPTEE_OS_REQUIRE ?= ""
-MACHINE_OPTEE_OS_REQUIRE:tc = "optee-os-tc.inc"
-
-require ${MACHINE_OPTEE_OS_REQUIRE}
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.20.0.bb b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.20.0.bb
index 0f3e58d..0638cf7 100644
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.20.0.bb
+++ b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.20.0.bb
@@ -14,4 +14,5 @@
     file://0006-core-ffa-add-TOS_FW_CONFIG-handling.patch \
     file://0007-core-spmc-handle-non-secure-interrupts.patch \
     file://0008-core-spmc-configure-SP-s-NS-interrupt-action-based-o.patch \
+    file://CVE-2023-41325.patch \
    "
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.22.0.bb b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.22.0.bb
new file mode 100644
index 0000000..e122019
--- /dev/null
+++ b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.22.0.bb
@@ -0,0 +1,13 @@
+require recipes-security/optee/optee-os.inc
+
+DEPENDS += "dtc-native"
+
+FILESEXTRAPATHS:prepend := "${THISDIR}/${P}:"
+
+SRCREV = "001ace6655dd6bb9cbe31aa31b4ba69746e1a1d9"
+SRC_URI += " \
+    file://0001-allow-setting-sysroot-for-libgcc-lookup.patch \
+    file://0002-core-Define-section-attributes-for-clang.patch \
+    file://0003-optee-enable-clang-support.patch \
+    file://0004-core-link-add-no-warn-rwx-segments.patch \
+   "
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.22.0.bbappend b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.22.0.bbappend
index b5493e5..ee4ca17 100644
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.22.0.bbappend
+++ b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.22.0.bbappend
@@ -1,5 +1,7 @@
-# Machine specific configurations
+# Include Trusted Services Secure Partitions
+require recipes-security/optee/optee-os-ts.inc
 
+# Machine specific configurations
 MACHINE_OPTEE_OS_REQUIRE ?= ""
 MACHINE_OPTEE_OS_REQUIRE:corstone1000 = "optee-os-corstone1000-common.inc"
 MACHINE_OPTEE_OS_REQUIRE:n1sdp = "optee-os-n1sdp.inc"
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-test_3.18.0.bb b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-test_3.18.0.bb
deleted file mode 100644
index cf8ea01..0000000
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-test_3.18.0.bb
+++ /dev/null
@@ -1,10 +0,0 @@
-require recipes-security/optee/optee-test.inc
-
-SRC_URI += " \
-    file://0001-xtest-regression_1000-remove-unneeded-stat.h-include.patch \
-   "
-SRCREV = "da5282a011b40621a2cf7a296c11a35c833ed91b"
-
-EXTRA_OEMAKE:append:libc-musl = " OPTEE_OPENSSL_EXPORT=${STAGING_INCDIR}"
-DEPENDS:append:libc-musl = " openssl"
-CFLAGS:append:libc-musl = " -Wno-error=deprecated-declarations"
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-test_3.20.0.bb b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-test_3.20.0.bb
index 5f73d41..4409ad5 100644
--- a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-test_3.20.0.bb
+++ b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-test_3.20.0.bb
@@ -6,7 +6,3 @@
     file://0003-Update-arm_ffa_user-driver-dependency.patch \
    "
 SRCREV = "5db8ab4c733d5b2f4afac3e9aef0a26634c4b444"
-
-EXTRA_OEMAKE:append = " OPTEE_OPENSSL_EXPORT=${STAGING_INCDIR}"
-DEPENDS:append = " openssl"
-CFLAGS:append = " -Wno-error=deprecated-declarations"
diff --git a/meta-arm/meta-arm-bsp/recipes-security/optee/optee-test_3.22.0.bb b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-test_3.22.0.bb
new file mode 100644
index 0000000..eddf04d
--- /dev/null
+++ b/meta-arm/meta-arm-bsp/recipes-security/optee/optee-test_3.22.0.bb
@@ -0,0 +1,14 @@
+require recipes-security/optee/optee-test.inc
+
+SRC_URI += " \
+    file://0001-xtest-regression_1000-remove-unneeded-stat.h-include.patch \
+   "
+SRCREV = "a286b57f1721af215ace318d5807e63f40186df6"
+
+# Include ffa_spmc test group if the SPMC test is enabled.
+# Supported after op-tee v3.20
+EXTRA_OEMAKE:append = "${@bb.utils.contains('MACHINE_FEATURES', 'optee-spmc-test', \
+                                        ' CFG_SPMC_TESTS=y CFG_SECURE_PARTITION=y', '' , d)}"
+
+RDEPENDS:${PN} += "${@bb.utils.contains('MACHINE_FEATURES', 'optee-spmc-test', \
+                                              ' arm-ffa-user', '' , d)}"
diff --git a/meta-arm/meta-arm-bsp/recipes-security/trusted-services/corstone1000/0008-plat-corstone1000-change-ns-interrupt-action.patch b/meta-arm/meta-arm-bsp/recipes-security/trusted-services/corstone1000/0008-plat-corstone1000-change-ns-interrupt-action.patch
deleted file mode 100644
index c50f286..0000000
--- a/meta-arm/meta-arm-bsp/recipes-security/trusted-services/corstone1000/0008-plat-corstone1000-change-ns-interrupt-action.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 7f51fa5f848b77b5aadfc553e1aeca52f4bcc5a1 Mon Sep 17 00:00:00 2001
-From: Emekcan Aras <emekcan.aras@arm.com>
-Date: Tue, 22 Aug 2023 17:18:26 +0100
-Subject: [PATCH] platform: corstone1000: change ns-interrupt-action 
-
-Changes ns-interrupt-action for corstone1000. The interrupts are queued as 
-in the previous optee release. Currently, enabling preemption (settig this field
-to 2) will halt psa-test from linux-userspace in corstone1000.
-
-Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
-Upstream-Status: Pending [Not submitted to upstream yet]
----
- .../config/corstone1000-opteesp/default_se-proxy.dts.in         | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/deployments/se-proxy/config/corstone1000-opteesp/default_se-proxy.dts.in b/deployments/se-proxy/config/corstone1000-opteesp/default_se-proxy.dts.in
-index cc42929d..839f7464 100644
---- a/deployments/se-proxy/config/corstone1000-opteesp/default_se-proxy.dts.in
-+++ b/deployments/se-proxy/config/corstone1000-opteesp/default_se-proxy.dts.in
-@@ -16,7 +16,7 @@
- 	execution-state = <0>; /* AArch64 */
- 	xlat-granule = <0>; /* 4KiB */
- 	messaging-method = <3>; /* Direct messaging only */
--	ns-interrupts-action = <2>; /* Non-secure interrupts are signaled */
-+	ns-interrupts-action = <0>; /* Non-secure interrupts are signaled */
- 	elf-format = <1>;
- 
- 	device-regions {
--- 
-2.17.1
-
diff --git a/meta-arm/meta-arm-bsp/recipes-security/trusted-services/corstone1000/0008-platform-corstone1000-fix-synchronization-issue.patch b/meta-arm/meta-arm-bsp/recipes-security/trusted-services/corstone1000/0008-platform-corstone1000-fix-synchronization-issue.patch
new file mode 100644
index 0000000..5d8f731
--- /dev/null
+++ b/meta-arm/meta-arm-bsp/recipes-security/trusted-services/corstone1000/0008-platform-corstone1000-fix-synchronization-issue.patch
@@ -0,0 +1,105 @@
+From 06c3e612cb0927d783f115077d83ed97841c5668 Mon Sep 17 00:00:00 2001
+From: Emekcan Aras <emekcan.aras@arm.com>
+Date: Tue, 14 Nov 2023 14:43:44 +0000
+Subject: [PATCH] plat: corstone1000: fix synchronization issue on openamp notification
+
+This fixes a race that is observed rarely in the FVP. It occurs in FVP
+when Secure Enclave sends the notication ack in openamp, and then reset the access
+request which resets the mhu registers before received by the SE-proxy-sp in the
+host processort. This solution introduces polling on the status register of
+mhu until the notificaiton is read by the host processor. (Inspired by
+signal_and_wait_for_signal function in mhu_wrapper_v2_x.c in trusted-firmware-m
+https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/tree/platform/ext/target/arm/rss/common/native_drivers/mhu_wrapper_v2_x.c#n61)
+
+Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
+Upstream-Status: Pending [Not submitted to upstream yet]
+---
+ components/messaging/openamp/sp/openamp_mhu.c |  9 ++++++++-
+ platform/drivers/arm/mhu_driver/mhu_v2.h      | 18 ++++++++++++++++++
+ platform/drivers/arm/mhu_driver/mhu_v2_x.c    | 17 +++++++++++++++++
+ 3 files changed, 43 insertions(+), 1 deletion(-)
+
+diff --git a/components/messaging/openamp/sp/openamp_mhu.c b/components/messaging/openamp/sp/openamp_mhu.c
+index bafba3e3..0700b8b9 100644
+--- a/components/messaging/openamp/sp/openamp_mhu.c
++++ b/components/messaging/openamp/sp/openamp_mhu.c
+@@ -85,7 +85,7 @@ int openamp_mhu_notify_peer(struct openamp_messenger *openamp)
+	struct mhu_v2_x_dev_t *tx_dev;
+	enum mhu_v2_x_error_t ret;
+	struct openamp_mhu *mhu;
+-	uint32_t access_ready;
++	uint32_t access_ready,val;
+
+	if (!openamp->transport) {
+		EMSG("openamp: mhu: notify transport not initialized");
+@@ -116,6 +116,13 @@ int openamp_mhu_notify_peer(struct openamp_messenger *openamp)
+		return -EPROTO;
+	}
+
++	do {
++		ret = mhu_v2_x_channel_poll(tx_dev, MHU_V_2_NOTIFY_CHANNEL, &val);
++		if (ret != MHU_V_2_X_ERR_NONE) {
++			break;
++		}
++	} while (val != 0);
++
+	ret = mhu_v2_x_reset_access_request(tx_dev);
+	if (ret != MHU_V_2_X_ERR_NONE) {
+		EMSG("openamp: mhu: failed reset access request");
+diff --git a/platform/drivers/arm/mhu_driver/mhu_v2.h b/platform/drivers/arm/mhu_driver/mhu_v2.h
+index 26b3a5d6..2b4d6fcb 100644
+--- a/platform/drivers/arm/mhu_driver/mhu_v2.h
++++ b/platform/drivers/arm/mhu_driver/mhu_v2.h
+@@ -384,6 +384,24 @@ enum mhu_v2_x_error_t mhu_v2_x_interrupt_clear(
+ enum mhu_v2_x_error_t mhu_v2_1_get_ch_interrupt_num(
+      const struct mhu_v2_x_dev_t *dev, uint32_t *channel);
+
++
++/**
++ * \brief Polls sender channel status.
++ *
++ * \param[in]  dev         MHU device struct \ref mhu_v2_x_dev_t
++ * \param[in]  channel     Channel to poll the status of.
++ * \param[out] value       Pointer to variable that will store the value.
++ *
++ * Polls sender channel status.
++ *
++ * \return Returns mhu_v2_x_error_t error code
++ *
++ * \note This function doesn't check if dev is NULL.
++ * \note This function doesn't check if channel is implemented.
++ */
++enum mhu_v2_x_error_t mhu_v2_x_channel_poll(const struct mhu_v2_x_dev_t *dev,
++     uint32_t channel, uint32_t *value);
++
+ #ifdef __cplusplus
+ }
+ #endif
+diff --git a/platform/drivers/arm/mhu_driver/mhu_v2_x.c b/platform/drivers/arm/mhu_driver/mhu_v2_x.c
+index d7e70efa..022e287a 100644
+--- a/platform/drivers/arm/mhu_driver/mhu_v2_x.c
++++ b/platform/drivers/arm/mhu_driver/mhu_v2_x.c
+@@ -600,3 +600,20 @@ enum mhu_v2_x_error_t mhu_v2_1_get_ch_interrupt_num(
+
+     return MHU_V_2_X_ERR_GENERAL;
+ }
++
++enum mhu_v2_x_error_t mhu_v2_x_channel_poll(const struct mhu_v2_x_dev_t *dev,
++     uint32_t channel, uint32_t *value)
++{
++    union _mhu_v2_x_frame_t *p_mhu = (union _mhu_v2_x_frame_t *)dev->base;
++
++    if ( !(dev->is_initialized) ) {
++        return MHU_V_2_X_ERR_NOT_INIT;
++    }
++
++    if (dev->frame == MHU_V2_X_SENDER_FRAME) {
++        *value = (SEND_FRAME(p_mhu))->send_ch_window[channel].ch_st;
++        return MHU_V_2_X_ERR_NONE;
++    } else {
++        return MHU_V_2_X_ERR_INVALID_ARG;
++    }
++}
+--
+2.25.1
+
diff --git a/meta-arm/meta-arm-bsp/recipes-security/trusted-services/ts-arm-platforms.inc b/meta-arm/meta-arm-bsp/recipes-security/trusted-services/ts-arm-platforms.inc
index 551a67d..3c7e94e 100644
--- a/meta-arm/meta-arm-bsp/recipes-security/trusted-services/ts-arm-platforms.inc
+++ b/meta-arm/meta-arm-bsp/recipes-security/trusted-services/ts-arm-platforms.inc
@@ -9,7 +9,7 @@
     file://0005-plat-corstone1000-add-compile-definitions-for-ECP_DP.patch \
     file://0006-plat-corstone1000-Use-the-stateless-platform-service.patch \
     file://0007-plat-corstone1000-Initialize-capsule-update-provider.patch \
-    file://0008-plat-corstone1000-change-ns-interrupt-action.patch \
+    file://0008-platform-corstone1000-fix-synchronization-issue.patch \
     "