subtree updates:raspberrypi:arm:security: Jan 27 2023

meta-raspberrypi: 896566aa92..6c57b92708:
  Martin Jansa (2):
        pi-bluetooth: fix typo in Upstream-Status
        gstreamer1.0-omx: fix Upstream-Status format

meta-arm: 5c42f084f7..3d51e1117d:
  Abdellatif El Khlifi (1):
        arm-bsp/u-boot: Corstone1000: bump to v2022.10

  Anton Antonov (1):
        arm/kernel: Update ARM-FFA kernel drivers

  Daniel Díaz (1):
        arm-bsp/firmware-image-juno: Fix deployment of compressed Image

  Jon Mason (8):
        arm-bsp/juno: move to compressed initramfs image
        arm-bsp/juno: Update kernel patches to the latest
        arm-bsp/trusted-firmware-m: corstone1000: TFM file clean-ups
        arm/trusted-firmware-m: disable fatal warnings
        arm-toolchain: update Arm GCC to 12.2
        external-arm-toolchain: Enable 12.2.rel1 support
        arm-bsp: add u-boot v2022.10 support
        arm-bsp: add u-boot v2022.10 support

  Peter Hoyes (8):
        arm/scp-firmware: Ensure CMAKE_BUILD_TYPE is capitalized
        arm/scp-firmware: Disable cppcheck
        arm: Add addpylib declaration
        arm/lib: Add XAUTHORITY to runfvp environment
        classes: Define FVP_ENV_PASSTHROUGH variable dependencies
        classes: Prevent passing None to the runfvp environment
        classes: Set ARMLMD_LICENSE_FILE in the runfvp environment
        arm: Use SRC* variables consistently

  Qi Feng (1):
        arm-bsp/fvp-baser-aemv8r64: Rebase u-boot patches onto v2022.10

  Ross Burton (9):
        meta-*: mark layers as compatible with mickledore only
        arm-toolchain: remove obsolete oe_import
        CI: switch back to master
        CI: remove obsolete linux-yocto workarounds
        Revert "CI: revert a meta-clang change which breaks pixman (thus, xserver)"
        arm-bsp/fvp-base*: no need to remove rng-tools from openssh
        CI: pass --update and --force-checkout to kas in pending-updates job
        CI: use 'kas dump' instead of manually catting files
        CI: remove obsolete install

  Rui Miguel Silva (1):
        arm-bsp/u-boot: corstone500: bump to 2022.10

  Theodore A. Roth (1):
        arm/optee-os: Fix FILESEXTRAPATHS

meta-security: f991b20f56..3d9dab6d14:
  Chen Qi (1):
        openscap: add libpcre DEPEDNS to fix do_configure failure

  Markus Volk (1):
        bubblewrap: remove recipe

  Martin Jansa (1):
        layer.conf: update LAYERSERIES_COMPAT for mickledore

Signed-off-by: Andrew Geissler <geissonator@yahoo.com>
Change-Id: I5abd2487fbf395b33b1934ff90bd6d97c7953e6c

16 files changed, 98 insertions, 27 deletions

diff --git a/meta-arm/meta-arm/classes/fvpboot.bbclass b/meta-arm/meta-arm/classes/fvpboot.bbclass
index 508deb29c9..3159cd43db 100644
--- a/meta-arm/meta-arm/classes/fvpboot.bbclass
+++ b/meta-arm/meta-arm/classes/fvpboot.bbclass
@@ -24,7 +24,8 @@ FVP_CONSOLES[default] ?= "${FVP_CONSOLE}"
 # Arbitrary extra arguments
 FVP_EXTRA_ARGS ?= ""
 # Bitbake variables to pass to the FVP environment
-FVP_ENV_PASSTHROUGH ?= "FASTSIM_DISABLE_TA"
+FVP_ENV_PASSTHROUGH ?= "FASTSIM_DISABLE_TA ARMLMD_LICENSE_FILE"
+FVP_ENV_PASSTHROUGH[vardeps] = "${FVP_ENV_PASSTHROUGH}"
 # Disable timing annotation by default
 FASTSIM_DISABLE_TA ?= "1"
 
@@ -72,7 +73,8 @@ python do_write_fvpboot_conf() {
 
     data["env"] = {}
     for var in d.getVar("FVP_ENV_PASSTHROUGH").split():
-        data["env"][var] = d.getVar(var)
+        if d.getVar(var) is not None:
+            data["env"][var] = d.getVar(var)
 
     os.makedirs(os.path.dirname(conffile), exist_ok=True)
     with open(conffile, "wt") as f:
diff --git a/meta-arm/meta-arm/conf/layer.conf b/meta-arm/meta-arm/conf/layer.conf
index 68d8c562f2..2b3543751c 100644
--- a/meta-arm/meta-arm/conf/layer.conf
+++ b/meta-arm/meta-arm/conf/layer.conf
@@ -13,7 +13,9 @@ LAYERDEPENDS_meta-arm = " \
     core \
     arm-toolchain \
 "
-LAYERSERIES_COMPAT_meta-arm = "langdale mickledore"
+LAYERSERIES_COMPAT_meta-arm = "mickledore"
 
 # runfvp --console needs telnet, so pull this in for testimage.
 HOSTTOOLS_NONFATAL += "telnet"
+
+addpylib ${LAYERDIR}/lib oeqa
diff --git a/meta-arm/meta-arm/conf/machine/qemuarm-secureboot.conf b/meta-arm/meta-arm/conf/machine/qemuarm-secureboot.conf
index db02dc6891..cb54fe9470 100644
--- a/meta-arm/meta-arm/conf/machine/qemuarm-secureboot.conf
+++ b/meta-arm/meta-arm/conf/machine/qemuarm-secureboot.conf
@@ -23,4 +23,4 @@ IMAGE_BOOT_FILES = "${KERNEL_IMAGETYPE}"
 MACHINE_FEATURES += "optee-ftpm"
 
 PREFERRED_VERSION_optee-os ?= "3.18.%"
-
+PREFERRED_VERSION_u-boot ?= "2022.10"
diff --git a/meta-arm/meta-arm/lib/fvp/runner.py b/meta-arm/meta-arm/lib/fvp/runner.py
index 4fd624ba67..c52cdc1c14 100644
--- a/meta-arm/meta-arm/lib/fvp/runner.py
+++ b/meta-arm/meta-arm/lib/fvp/runner.py
@@ -91,7 +91,7 @@ class FVPRunner:
         # Pass through environment variables needed for GUI applications, such
         # as xterm, to work.
         env = config['env']
-        for name in ('DISPLAY', 'WAYLAND_DISPLAY'):
+        for name in ('DISPLAY', 'WAYLAND_DISPLAY', 'XAUTHORITY'):
             if name in os.environ:
                 env[name] = os.environ[name]
 
diff --git a/meta-arm/meta-arm/recipes-bsp/scp-firmware/scp-firmware_2.10.0.bb b/meta-arm/meta-arm/recipes-bsp/scp-firmware/scp-firmware_2.10.0.bb
index 4828fb552e..b25b9a4053 100644
--- a/meta-arm/meta-arm/recipes-bsp/scp-firmware/scp-firmware_2.10.0.bb
+++ b/meta-arm/meta-arm/recipes-bsp/scp-firmware/scp-firmware_2.10.0.bb
@@ -6,7 +6,9 @@ LICENSE = "BSD-3-Clause & Apache-2.0"
 LIC_FILES_CHKSUM = "file://license.md;beginline=5;md5=9db9e3d2fb8d9300a6c3d15101b19731 \
                     file://contrib/cmsis/git/LICENSE.txt;md5=e3fc50a88d0a364313df4b21ef20c29e"
 
-SRC_URI = "gitsm://github.com/ARM-software/SCP-firmware.git;protocol=https;branch=master"
+SRC_URI_SCP_FIRMWARE ?= "gitsm://github.com/ARM-software/SCP-firmware.git;protocol=https"
+SRC_URI = "${SRC_URI_SCP_FIRMWARE};branch=${SRCBRANCH}"
+SRCBRANCH = "master"
 
 SRCREV  = "673d014f3861ad81cc5ab06d2884a314a610799b"
 
@@ -27,7 +29,7 @@ DEPENDS = "virtual/arm-none-eabi-gcc-native \
 # For now we only build with GCC, so stop meta-clang trying to get involved
 TOOLCHAIN = "gcc"
 
-SCP_BUILD_STR = "${@bb.utils.contains('SCP_BUILD_RELEASE', '1', 'release', 'debug', d)}"
+SCP_BUILD_STR = "${@bb.utils.contains('SCP_BUILD_RELEASE', '1', 'Release', 'Debug', d)}"
 
 inherit deploy
 
@@ -46,6 +48,7 @@ CFLAGS[unexport] = "1"
 EXTRA_OECMAKE = "-D CMAKE_BUILD_TYPE=${SCP_BUILD_STR} \
                  -D SCP_LOG_LEVEL=${SCP_LOG_LEVEL} \
                  -D SCP_PLATFORM_FEATURE_SET=${SCP_PLATFORM_FEATURE_SET} \
+                 -D DISABLE_CPPCHECK=1 \
                 "
 
 do_configure() {
diff --git a/meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/tf-a-tests_2.7.0.bb b/meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/tf-a-tests_2.7.0.bb
index 645b2456c4..8ded64dd93 100644
--- a/meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/tf-a-tests_2.7.0.bb
+++ b/meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/tf-a-tests_2.7.0.bb
@@ -7,9 +7,11 @@ inherit deploy
 
 COMPATIBLE_MACHINE ?= "invalid"
 
-SRC_URI = "git://git.trustedfirmware.org/TF-A/tf-a-tests.git;protocol=https;branch=master \
+SRC_URI_TRUSTED_FIRMWARE_A_TESTS ?= "git://git.trustedfirmware.org/TF-A/tf-a-tests.git;protocol=https"
+SRC_URI = "${SRC_URI_TRUSTED_FIRMWARE_A_TESTS};branch=${SRCBRANCH} \
           file://tf-a-tests-no-warn-rwx-segments.patch"
-SRCREV ?= "5f591f67738a1bbe6b262c53d9dad46ed8bbcd67"
+SRCBRANCH = "master"
+SRCREV = "5f591f67738a1bbe6b262c53d9dad46ed8bbcd67"
 
 DEPENDS += "optee-os"
 
diff --git a/meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc b/meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc
index c5b695e4b3..b0533a1e10 100644
--- a/meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc
+++ b/meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc
@@ -5,7 +5,9 @@ PACKAGE_ARCH = "${MACHINE_ARCH}"
 
 inherit deploy
 
-SRC_URI = "git://git.trustedfirmware.org/TF-A/trusted-firmware-a.git;protocol=https;name=tfa;branch=master"
+SRC_URI_TRUSTED_FIRMWARE_A ?= "git://git.trustedfirmware.org/TF-A/trusted-firmware-a.git;protocol=https"
+SRCBRANCH = "master"
+SRC_URI = "${SRC_URI_TRUSTED_FIRMWARE_A};name=tfa;branch=${SRCBRANCH}"
 
 UPSTREAM_CHECK_GITTAGREGEX = "^v(?P<pver>\d+(\.\d+)+)$"
 
diff --git a/meta-arm/meta-arm/recipes-bsp/trusted-firmware-m/files/rwx.patch b/meta-arm/meta-arm/recipes-bsp/trusted-firmware-m/files/rwx.patch
new file mode 100644
index 0000000000..b279cfeae0
--- /dev/null
+++ b/meta-arm/meta-arm/recipes-bsp/trusted-firmware-m/files/rwx.patch
@@ -0,0 +1,24 @@
+From 1d548c77d07fc9a83e3e9aa28a23aa19a0177e3b Mon Sep 17 00:00:00 2001
+From: Jon Mason <jon.mason@arm.com>
+Date: Wed, 18 Jan 2023 15:13:37 -0500
+Subject: [PATCH] arm/trusted-firmware-m: disable fatal warnings
+
+Signed-off-by: Jon Mason <jon.mason@arm.com>
+Upstream-Status: Inappropriate
+
+---
+ toolchain_GNUARM.cmake | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/toolchain_GNUARM.cmake b/toolchain_GNUARM.cmake
+index 7978eaca68..88395f922a 100644
+--- a/toolchain_GNUARM.cmake
++++ b/toolchain_GNUARM.cmake
+@@ -66,7 +66,6 @@ macro(tfm_toolchain_reset_linker_flags)
+         --entry=Reset_Handler
+         --specs=nano.specs
+         LINKER:-check-sections
+-        LINKER:-fatal-warnings
+         LINKER:--gc-sections
+         LINKER:--no-wchar-size-warning
+         ${MEMORY_USAGE_FLAG}
diff --git a/meta-arm/meta-arm/recipes-bsp/trusted-firmware-m/trusted-firmware-m_1.7.0.bb b/meta-arm/meta-arm/recipes-bsp/trusted-firmware-m/trusted-firmware-m_1.7.0.bb
index 3b4469d097..b4a4c41ff8 100644
--- a/meta-arm/meta-arm/recipes-bsp/trusted-firmware-m/trusted-firmware-m_1.7.0.bb
+++ b/meta-arm/meta-arm/recipes-bsp/trusted-firmware-m/trusted-firmware-m_1.7.0.bb
@@ -15,11 +15,17 @@ LIC_FILES_CHKSUM = "file://license.rst;md5=07f368487da347f3c7bd0fc3085f3afa \
                     file://../mbedtls/LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57 \
                     file://../mcuboot/LICENSE;md5=b6ee33f1d12a5e6ee3de1e82fb51eeb8"
 
-SRC_URI  = "git://git.trustedfirmware.org/TF-M/trusted-firmware-m.git;protocol=https;branch=${SRCBRANCH_tfm};name=tfm;destsuffix=git/tfm \
-            git://git.trustedfirmware.org/TF-M/tf-m-tests.git;protocol=https;branch=${SRCBRANCH_tfm-tests};name=tfm-tests;destsuffix=git/tf-m-tests \
-            git://github.com/ARMmbed/mbedtls.git;protocol=https;branch=${SRCBRANCH_mbedtls};name=mbedtls;destsuffix=git/mbedtls \
-            git://github.com/mcu-tools/mcuboot.git;protocol=https;branch=${SRCBRANCH_mcuboot};name=mcuboot;destsuffix=git/mcuboot \
-            git://github.com/laurencelundblade/QCBOR.git;protocol=https;branch=${SRCBRANCH_qcbor};name=qcbor;destsuffix=git/qcbor \
+SRC_URI_TRUSTED_FIRMWARE_M ?= "git://git.trustedfirmware.org/TF-M/trusted-firmware-m.git;protocol=https"
+SRC_URI_TRUSTED_FIRMWARE_M_TESTS ?= "git://git.trustedfirmware.org/TF-M/tf-m-tests.git;protocol=https"
+SRC_URI_TRUSTED_FIRMWARE_M_MBEDTLS ?= "git://github.com/ARMmbed/mbedtls.git;protocol=https"
+SRC_URI_TRUSTED_FIRMWARE_M_MCUBOOT ?= "git://github.com/mcu-tools/mcuboot.git;protocol=https"
+SRC_URI_TRUSTED_FIRMWARE_M_QCBOR ?= "git://github.com/laurencelundblade/QCBOR.git;protocol=https"
+SRC_URI  = "${SRC_URI_TRUSTED_FIRMWARE_M};branch=${SRCBRANCH_tfm};name=tfm;destsuffix=git/tfm \
+            ${SRC_URI_TRUSTED_FIRMWARE_M_TESTS};branch=${SRCBRANCH_tfm-tests};name=tfm-tests;destsuffix=git/tf-m-tests \
+            ${SRC_URI_TRUSTED_FIRMWARE_M_MBEDTLS};branch=${SRCBRANCH_mbedtls};name=mbedtls;destsuffix=git/mbedtls \
+            ${SRC_URI_TRUSTED_FIRMWARE_M_MCUBOOT};branch=${SRCBRANCH_mcuboot};name=mcuboot;destsuffix=git/mcuboot \
+            ${SRC_URI_TRUSTED_FIRMWARE_M_QCBOR};branch=${SRCBRANCH_qcbor};name=qcbor;destsuffix=git/qcbor \
+            file://rwx.patch \
             "
 
 # The required dependencies are documented in tf-m/config/config_default.cmake
diff --git a/meta-arm/meta-arm/recipes-bsp/u-boot/u-boot_2022.10.bb b/meta-arm/meta-arm/recipes-bsp/u-boot/u-boot_2022.10.bb
new file mode 100644
index 0000000000..905ae552a7
--- /dev/null
+++ b/meta-arm/meta-arm/recipes-bsp/u-boot/u-boot_2022.10.bb
@@ -0,0 +1,26 @@
+HOMEPAGE = "http://www.denx.de/wiki/U-Boot/WebHome"
+DESCRIPTION = "U-Boot, a boot loader for Embedded boards based on PowerPC, \
+ARM, MIPS and several other processors, which can be installed in a boot \
+ROM and used to initialize and test the hardware or to download and run \
+application code."
+SECTION = "bootloaders"
+DEPENDS += "flex-native bison-native"
+
+LICENSE = "GPL-2.0-or-later"
+LIC_FILES_CHKSUM = "file://Licenses/README;md5=2ca5f2c35c8cc335f0a19756634782f1"
+PE = "1"
+
+# We use the revision in order to avoid having to fetch it from the
+# repo during parse
+SRCREV = "4debc57a3da6c3f4d3f89a637e99206f4cea0a96"
+
+SRC_URI = "git://git.denx.de/u-boot.git;branch=master \
+          "
+
+S = "${WORKDIR}/git"
+B = "${WORKDIR}/build"
+do_configure[cleandirs] = "${B}"
+
+require recipes-bsp/u-boot/u-boot.inc
+
+DEPENDS += "bc-native dtc-native gnutls-native"
diff --git a/meta-arm/meta-arm/recipes-bsp/uefi/edk2-firmware.inc b/meta-arm/meta-arm/recipes-bsp/uefi/edk2-firmware.inc
index c9f1f1da07..bc4774791f 100644
--- a/meta-arm/meta-arm/recipes-bsp/uefi/edk2-firmware.inc
+++ b/meta-arm/meta-arm/recipes-bsp/uefi/edk2-firmware.inc
@@ -11,12 +11,13 @@ LIC_FILES_CHKSUM = "file://License.txt;md5=2b415520383f7964e96700ae12b4570a"
 LIC_FILES_CHKSUM += "file://edk2-platforms/License.txt;md5=2b415520383f7964e96700ae12b4570a"
 
 # These can be overridden as needed
-EDK2_SRC_URI = "gitsm://github.com/tianocore/edk2.git;branch=master;protocol=https"
-EDK2_PLATFORMS_SRC_URI = "git://github.com/tianocore/edk2-platforms.git;branch=master;protocol=https"
-
+SRC_URI_EDK2 ?= "gitsm://github.com/tianocore/edk2.git;protocol=https"
+SRC_URI_EDK2_PLATFORMS ?= "git://github.com/tianocore/edk2-platforms.git;protocol=https"
+SRCBRANCH_edk2 = "master"
+SRCBRANCH_edk2_platforms = "master"
 SRC_URI = "\
-    ${EDK2_SRC_URI};name=edk2;destsuffix=edk2;nobranch=1 \
-    ${EDK2_PLATFORMS_SRC_URI};name=edk2-platforms;destsuffix=edk2/edk2-platforms;nobranch=1 \
+    ${SRC_URI_EDK2};branch=${SRCBRANCH_edk2_platforms};name=edk2;destsuffix=edk2 \
+    ${SRC_URI_EDK2_PLATFORMS};branch=${SRCBRANCH_edk2};name=edk2-platforms;destsuffix=edk2/edk2-platforms \
     file://unaligned.patch \
     file://default.patch;patchdir=edk2-platforms \
 "
diff --git a/meta-arm/meta-arm/recipes-devtools/fiptool/fiptool-native_2.7.bb b/meta-arm/meta-arm/recipes-devtools/fiptool/fiptool-native_2.7.bb
index ec531e44d9..66cf2ced37 100644
--- a/meta-arm/meta-arm/recipes-devtools/fiptool/fiptool-native_2.7.bb
+++ b/meta-arm/meta-arm/recipes-devtools/fiptool/fiptool-native_2.7.bb
@@ -5,7 +5,9 @@
 DESCRIPTION = "fiptool - Trusted Firmware tool for packaging"
 LICENSE = "BSD-3-Clause"
 
-SRC_URI = "git://git.trustedfirmware.org/TF-A/trusted-firmware-a.git;destsuffix=fiptool-${PV};protocol=https;branch=master"
+SRC_URI_TRUSTED_FIRMWARE_A ?= "git://git.trustedfirmware.org/TF-A/trusted-firmware-a.git;protocol=https"
+SRC_URI = "${SRC_URI_TRUSTED_FIRMWARE_A};destsuffix=fiptool-${PV};branch=${SRCBRANCH}"
+SRCBRANCH = "master"
 LIC_FILES_CHKSUM = "file://docs/license.rst;md5=b2c740efedc159745b9b31f88ff03dde"
 
 # Use fiptool from TF-A v2.7
diff --git a/meta-arm/meta-arm/recipes-devtools/trusted-firmware-m-scripts/trusted-firmware-m-scripts-native_1.6.0.bb b/meta-arm/meta-arm/recipes-devtools/trusted-firmware-m-scripts/trusted-firmware-m-scripts-native_1.6.0.bb
index 453d456abf..217f08a61c 100644
--- a/meta-arm/meta-arm/recipes-devtools/trusted-firmware-m-scripts/trusted-firmware-m-scripts-native_1.6.0.bb
+++ b/meta-arm/meta-arm/recipes-devtools/trusted-firmware-m-scripts/trusted-firmware-m-scripts-native_1.6.0.bb
@@ -1,5 +1,6 @@
 
-SRC_URI = "git://git.trustedfirmware.org/TF-M/trusted-firmware-m.git;protocol=https;branch=${SRCBRANCH}"
+SRC_URI_TRUSTED_FIRMWARE_M ?= "git://git.trustedfirmware.org/TF-M/trusted-firmware-m.git;protocol=https"
+SRC_URI = "${SRC_URI_TRUSTED_FIRMWARE_M};branch=${SRCBRANCH}"
 # Use the wrapper script from TF-Mv1.6.0
 SRCBRANCH ?= "release/1.6.x"
 SRCREV = "7387d88158701a3c51ad51c90a05326ee12847a8"
diff --git a/meta-arm/meta-arm/recipes-kernel/arm-ffa-tee/arm-ffa-tee_1.1.1.bb b/meta-arm/meta-arm/recipes-kernel/arm-ffa-tee/arm-ffa-tee_1.1.2.bb
index 9e997de1d3..5790d00f10 100644
--- a/meta-arm/meta-arm/recipes-kernel/arm-ffa-tee/arm-ffa-tee_1.1.1.bb
+++ b/meta-arm/meta-arm/recipes-kernel/arm-ffa-tee/arm-ffa-tee_1.1.2.bb
@@ -10,8 +10,8 @@ SRC_URI = "git://gitlab.arm.com/linux-arm/linux-trusted-services;protocol=https;
           "
 S = "${WORKDIR}/git"
 
-# Tag tee-v1.1
-SRCREV = "3b543b7591505b715f332c972248a3ea41604d83"
+# Tag tee-v1.1.2
+SRCREV = "8a81f5d2406f146b15a705d49b256efaa5fa3ba9"
 
 COMPATIBLE_HOST = "(arm|aarch64).*-linux"
 KERNEL_MODULE_AUTOLOAD += "arm-ffa-tee"
diff --git a/meta-arm/meta-arm/recipes-kernel/arm-ffa-user/arm-ffa-user_5.0.0.bb b/meta-arm/meta-arm/recipes-kernel/arm-ffa-user/arm-ffa-user_5.0.1.bb
index 8d86197d3d..1261fa413b 100644
--- a/meta-arm/meta-arm/recipes-kernel/arm-ffa-user/arm-ffa-user_5.0.0.bb
+++ b/meta-arm/meta-arm/recipes-kernel/arm-ffa-user/arm-ffa-user_5.0.1.bb
@@ -11,8 +11,8 @@ SRC_URI = "git://gitlab.arm.com/linux-arm/linux-trusted-services;protocol=https;
           "
 S = "${WORKDIR}/git"
 
-# Tag 5.0.0.
-SRCREV = "6ec4196a59db8204ed670ef3b78f24a8234b85a6"
+# Tag debugfs-v5.0.1
+SRCREV = "18e3be71f65a405dfb5d97603ae71b3c11759861"
 
 COMPATIBLE_HOST = "(arm|aarch64).*-linux"
 KERNEL_MODULE_AUTOLOAD += "arm-ffa-user"
diff --git a/meta-arm/meta-arm/recipes-security/optee/optee-os-3_19.inc b/meta-arm/meta-arm/recipes-security/optee/optee-os-3_19.inc
index 8adb6996d0..61475dcfaf 100644
--- a/meta-arm/meta-arm/recipes-security/optee/optee-os-3_19.inc
+++ b/meta-arm/meta-arm/recipes-security/optee/optee-os-3_19.inc
@@ -8,7 +8,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=c1f21c4f72f372ef38a5a4aee55ec173"
 inherit deploy python3native
 require optee.inc
 
-FILESEXTRAPATHS:prepend := "${THISDIR}/optee-os-3_19:"
+FILESEXTRAPATHS:prepend := "${THISDIR}/optee-os-3.19.0:"
 
 CVE_PRODUCT = "linaro:op-tee op-tee:op-tee_os"