diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000000000000000000000000000000000000..1297791d7db90b13e75f7d69d97f1f81ffdfeadc
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,51 @@
+name: CI
+on: [push, pull_request]
+permissions:
+  contents: read # to fetch code (actions/checkout)
+jobs:
+  debian:
+    name: build (Debian)
+    runs-on: ubuntu-latest
+    container: jforissier/optee_client_ci_debian
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: arm64 with make
+        run: make -j O=out-make-aarch64 CROSS_COMPILE=aarch64-linux-gnu-
+      - name: armhf with make
+        run: make -j O=out-make-armhf CROSS_COMPILE=arm-linux-gnueabihf-
+      - name: arm64 with cmake
+        run: |
+          set -e -v
+          mkdir out-cmake-aarch64 && cd out-cmake-aarch64
+          PKG_CONFIG=aarch64-linux-gnu-pkg-config cmake .. -DCMAKE_C_COMPILER=aarch64-linux-gnu-gcc
+          make -j
+      - name: armhf with cmake
+        run: |
+          set -e -v
+          mkdir out-cmake-armhf && cd out-cmake-armhf
+          PKG_CONFIG=arm-linux-gnueabihf-pkg-config cmake .. -DCMAKE_C_COMPILER=arm-linux-gnueabihf-gcc
+          make -j
+  ubuntu:
+    name: build (Ubuntu)
+    runs-on: ubuntu-latest
+    container: jforissier/optee_client_ci_ubuntu
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: arm64 with make
+        run: make -j O=out-make-aarch64 CROSS_COMPILE=aarch64-linux-gnu-
+      - name: armhf with make
+        run: make -j O=out-make-armhf CROSS_COMPILE=arm-linux-gnueabihf-
+      - name: arm64 with cmake
+        run: |
+          set -e -v
+          mkdir out-cmake-aarch64 && cd out-cmake-aarch64
+          PKG_CONFIG=aarch64-linux-gnu-pkg-config cmake .. -DCMAKE_C_COMPILER=aarch64-linux-gnu-gcc
+          make -j
+      - name: armhf with cmake
+        run: |
+          set -e -v
+          mkdir out-cmake-armhf && cd out-cmake-armhf
+          PKG_CONFIG=arm-linux-gnueabihf-pkg-config cmake .. -DCMAKE_C_COMPILER=arm-linux-gnueabihf-gcc
+          make -j
diff --git a/Android.mk b/Android.mk
index ca08a807af96bfe5d59beb8b4a53d7d6b2eca812..08e72e8248a12db5db0086470e479acc051d61fc 100644
--- a/Android.mk
+++ b/Android.mk
@@ -49,8 +49,7 @@ LOCAL_CFLAGS += -DCFG_TEE_BENCHMARK
 LOCAL_SRC_FILES += teec_benchmark.c
 endif
 
-LOCAL_C_INCLUDES := $(LOCAL_PATH)/public \
-                    $(LOCAL_PATH)/libteec/include \
+LOCAL_C_INCLUDES := $(LOCAL_PATH)/libteec/include
 
 LOCAL_PRELINK_MODULE := false
 LOCAL_MODULE := libteec
@@ -62,7 +61,7 @@ LOCAL_VENDOR_MODULE := true
 LOCAL_MULTILIB := both
 LOCAL_MODULE_TARGET_ARCH := arm arm64
 
-LOCAL_EXPORT_C_INCLUDE_DIRS := $(LOCAL_PATH)/public
+LOCAL_EXPORT_C_INCLUDE_DIRS := $(LOCAL_PATH)/libteec/include
 
 include $(BUILD_SHARED_LIBRARY)
 
@@ -82,7 +81,7 @@ LOCAL_SRC_FILES := libckteec/src/pkcs11_api.c \
                    libckteec/src/serializer.c \
                    libckteec/src/serialize_ck.c
 
-LOCAL_C_INCLUDES := $(LOCAL_PATH)/public \
+LOCAL_C_INCLUDES := $(LOCAL_PATH)/libteec/include \
                     $(LOCAL_PATH)/libckteec/include
 
 LOCAL_SHARED_LIBRARIES := libteec
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 0786752a00026c469d684d5c6646f2980a26693b..83107f49db17a2d1fb3a98b3f85fff7f17f5ba50 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,10 +1,11 @@
-cmake_minimum_required (VERSION 3.4)
-project (optee_client C)
+cmake_minimum_required(VERSION 3.4)
+project(optee_client C)
 
 # https://cmake.org/Wiki/CMake_Useful_Variables
-set (CMAKE_TOOLCHAIN_FILE CMakeToolchain.txt)
+set(CMAKE_TOOLCHAIN_FILE CMakeToolchain.txt)
 
-set (CFG_WERROR 1 CACHE BOOL "Build with -Werror")
+option(CFG_WERROR "Build with -Werror" TRUE)
+option(WITH_TEEACL "Build libteeacl" TRUE)
 
 include(GNUInstallDirs)
 
@@ -12,7 +13,7 @@ include(GNUInstallDirs)
 # Compiler flags:
 #   We want to use the same flags in the entire optee_client git
 ################################################################################
-add_compile_options (
+add_compile_options(
 	-Wall -Wbad-function-cast -Wcast-align
 	-Werror-implicit-function-declaration -Wextra
 	-Wfloat-equal -Wformat-nonliteral -Wformat-security
@@ -20,9 +21,13 @@ add_compile_options (
 	-Wmissing-format-attribute -Wmissing-include-dirs
 	-Wmissing-noreturn -Wmissing-prototypes -Wnested-externs
 	-Wpointer-arith -Wshadow -Wstrict-prototypes
-	-Wswitch-default -Wunsafe-loop-optimizations
-	-Wwrite-strings -fPIC
+	-Wswitch-default -Wwrite-strings -fPIC
 )
+if("${CMAKE_C_COMPILER_ID}" STREQUAL "GNU")
+    add_compile_options(
+        -Wunsafe-loop-optimizations
+    )
+endif()
 if(CFG_WERROR)
     add_compile_options(-Werror)
 endif(CFG_WERROR)
@@ -33,11 +38,12 @@ if(CCACHE_FOUND)
     set_property(GLOBAL PROPERTY RULE_LAUNCH_LINK ccache)
 endif(CCACHE_FOUND)
 
-add_subdirectory (libteec)
-add_subdirectory (tee-supplicant)
-add_subdirectory (public)
-add_subdirectory (libckteec)
-find_package (PkgConfig REQUIRED)
-pkg_check_modules(uuid REQUIRED IMPORTED_TARGET uuid)
-add_subdirectory (libteeacl)
-add_subdirectory (libseteec)
+add_subdirectory(libteec)
+add_subdirectory(tee-supplicant)
+add_subdirectory(libckteec)
+if(WITH_TEEACL)
+    find_package(PkgConfig REQUIRED)
+    pkg_check_modules(uuid REQUIRED IMPORTED_TARGET uuid)
+    add_subdirectory(libteeacl)
+endif(WITH_TEEACL)
+add_subdirectory(libseteec)
diff --git a/Makefile b/Makefile
index 7803a5a95cb52c0df9540d5876d7f048be7e6070..0d5a500a59b2026a2683c7279c53c735dcabab0c 100644
--- a/Makefile
+++ b/Makefile
@@ -15,9 +15,14 @@ DESTDIR ?= $(EXPORT_DIR)
 SBINDIR ?= /usr/sbin
 LIBDIR ?= /usr/lib
 INCLUDEDIR ?= /usr/include
+sbindir ?= $(SBINDIR)
+libdir ?= $(LIBDIR)
+includedir ?= $(INCLUDEDIR)
+
+WITH_TEEACL ?= 1
 
 .PHONY: all build build-libteec build-libckteec build-libseteec \
-	build-libteeacl check-libuuid install copy_export clean cscope \
+	build-libteeacl install copy_export clean cscope \
 	clean-cscope \
 	checkpatch-pre-req checkpatch-modified-patch checkpatch-modified-file \
 	checkpatch-last-commit-patch checkpatch-last-commit-file \
@@ -35,8 +40,10 @@ build-tee-supplicant: build-libteec
 	@echo "Building tee-supplicant"
 	$(MAKE) --directory=tee-supplicant  --no-print-directory --no-builtin-variables CFG_TEE_SUPP_LOG_LEVEL=$(CFG_TEE_SUPP_LOG_LEVEL)
 
-build: build-libteec build-tee-supplicant build-libckteec build-libseteec \
-	build-libteeacl
+build: build-libteec build-tee-supplicant build-libckteec build-libseteec
+ifeq ($(WITH_TEEACL),1)
+build: build-libteeacl
+endif
 
 build-libckteec: build-libteec
 	@echo "Building libckteec.so"
@@ -46,18 +53,17 @@ build-libseteec: build-libteec
 	@echo "Building libseteec.so"
 	@$(MAKE) --directory=libseteec --no-print-directory --no-builtin-variables
 
-build-libteeacl: check-libuuid
+build-libteeacl:
 	@echo "Building libteeacl.so"
 	@$(MAKE) --directory=libteeacl --no-print-directory --no-builtin-variables
 
-check-libuuid:
-	@echo "Finding uuid.pc"
-	pkg-config --atleast-version=2.34 uuid
-
 install: copy_export
 
 clean: clean-libteec clean-tee-supplicant clean-cscope clean-libckteec \
-	clean-libseteec clean-libteeacl
+	clean-libseteec
+ifeq ($(WITH_TEEACL),1)
+clean: clean-libteeacl
+endif
 
 clean-libteec:
 	@$(MAKE) --directory=libteec --no-print-directory clean
@@ -149,18 +155,20 @@ checkpatch-all-files: checkpatch-pre-req
 distclean: clean
 
 copy_export: build
-	mkdir -p $(DESTDIR)$(SBINDIR) $(DESTDIR)$(LIBDIR) $(DESTDIR)$(INCLUDEDIR)
-	cp config.mk $(DESTDIR)/$(INCLUDEDIR)/optee_client_config.mk
-	cp -d ${O}/libteec/libteec.so* $(DESTDIR)$(LIBDIR)
-	cp -d ${O}/libteec/libteec.a $(DESTDIR)$(LIBDIR)
-	cp ${O}/tee-supplicant/tee-supplicant $(DESTDIR)$(SBINDIR)
-	cp public/*.h $(DESTDIR)$(INCLUDEDIR)
-	cp libckteec/include/*.h $(DESTDIR)$(INCLUDEDIR)
-	cp -d ${O}/libckteec/libckteec.so* $(DESTDIR)$(LIBDIR)
-	cp -d ${O}/libckteec/libckteec.a $(DESTDIR)$(LIBDIR)
-	cp libteeacl/include/*.h $(DESTDIR)$(INCLUDEDIR)
-	cp -d ${O}/libteeacl/libteeacl.so* $(DESTDIR)$(LIBDIR)
-	cp -d ${O}/libteeacl/libteeacl.a $(DESTDIR)$(LIBDIR)
-	cp libseteec/include/*.h $(DESTDIR)$(INCLUDEDIR)
-	cp -d ${O}/libseteec/libseteec.so* $(DESTDIR)$(LIBDIR)
-	cp -d ${O}/libseteec/libseteec.a $(DESTDIR)$(LIBDIR)
+	mkdir -p $(DESTDIR)$(sbindir) $(DESTDIR)$(libdir) $(DESTDIR)$(includedir)
+	cp config.mk $(DESTDIR)/$(includedir)/optee_client_config.mk
+	cp -d ${O}/libteec/libteec.so* $(DESTDIR)$(libdir)
+	cp -d ${O}/libteec/libteec.a $(DESTDIR)$(libdir)
+	cp ${O}/tee-supplicant/tee-supplicant $(DESTDIR)$(sbindir)
+	cp libteec/include/*.h $(DESTDIR)$(includedir)
+	cp libckteec/include/*.h $(DESTDIR)$(includedir)
+	cp -d ${O}/libckteec/libckteec.so* $(DESTDIR)$(libdir)
+	cp -d ${O}/libckteec/libckteec.a $(DESTDIR)$(libdir)
+ifeq ($(WITH_TEEACL),1)
+	cp libteeacl/include/*.h $(DESTDIR)$(includedir)
+	cp -d ${O}/libteeacl/libteeacl.so* $(DESTDIR)$(libdir)
+	cp -d ${O}/libteeacl/libteeacl.a $(DESTDIR)$(libdir)
+endif
+	cp libseteec/include/*.h $(DESTDIR)$(includedir)
+	cp -d ${O}/libseteec/libseteec.so* $(DESTDIR)$(libdir)
+	cp -d ${O}/libseteec/libseteec.a $(DESTDIR)$(libdir)
diff --git a/ci/Dockerfile.debian b/ci/Dockerfile.debian
new file mode 100644
index 0000000000000000000000000000000000000000..875f1137d8c93ff8ef83e425443b1fa512312b94
--- /dev/null
+++ b/ci/Dockerfile.debian
@@ -0,0 +1,21 @@
+# Dockerfile for CI image used in ../.github/workflows/ci.yml
+
+FROM debian:bullseye-slim
+MAINTAINER Jerome Forissier <jerome.forissier@linaro.org>
+
+ENV LANG=C.UTF-8
+
+RUN dpkg --add-architecture armhf
+RUN dpkg --add-architecture arm64
+
+RUN apt update
+RUN apt upgrade -y
+RUN apt install -y \
+  cmake \
+  dpkg-dev \
+  gcc-aarch64-linux-gnu \
+  gcc-arm-linux-gnueabihf \
+  make \
+  pkg-config \
+  uuid-dev:armhf \
+  uuid-dev:arm64
diff --git a/ci/Dockerfile.ubuntu b/ci/Dockerfile.ubuntu
new file mode 100644
index 0000000000000000000000000000000000000000..9a4f8a5415bf90f38d8de1a1ced332f75c402fb9
--- /dev/null
+++ b/ci/Dockerfile.ubuntu
@@ -0,0 +1,30 @@
+# Dockerfile for CI image used in ../.github/workflows/ci.yml
+
+FROM ubuntu:22.04
+MAINTAINER Jerome Forissier <jerome.forissier@linaro.org>
+
+ENV LANG=C.UTF-8
+
+RUN dpkg --add-architecture armhf
+RUN dpkg --add-architecture arm64
+
+RUN echo 'deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ jammy main restricted universe multiverse' > /etc/apt/sources.list
+RUN echo 'deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ jammy-updates main restricted universe multiverse' >> /etc/apt/sources.list
+RUN echo 'deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ jammy-backports main restricted universe multiverse' >> /etc/apt/sources.list
+RUN echo 'deb [arch=amd64] http://security.ubuntu.com/ubuntu/ jammy-security main restricted universe multiverse' >> /etc/apt/sources.list
+RUN echo 'deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports/ jammy main restricted universe multiverse' >> /etc/apt/sources.list
+RUN echo 'deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports/ jammy-updates main restricted universe multiverse' >> /etc/apt/sources.list
+RUN echo 'deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports/ jammy-backports main restricted universe multiverse' >> /etc/apt/sources.list
+RUN echo 'deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports/ jammy-security main restricted universe multiverse' >> /etc/apt/sources.list
+
+RUN apt update
+RUN apt upgrade -y
+RUN apt install -y \
+  cmake \
+  dpkg-dev \
+  gcc-aarch64-linux-gnu \
+  gcc-arm-linux-gnueabihf \
+  make \
+  pkg-config \
+  uuid-dev:armhf \
+  uuid-dev:arm64
diff --git a/debian/apertis/copyright b/debian/apertis/copyright
index ae0a9a2e79849cd7454c0ad88dc45c983c99d35e..7fe0606365f947cf2a039a1c2402c7862567eaac 100644
--- a/debian/apertis/copyright
+++ b/debian/apertis/copyright
@@ -57,40 +57,37 @@ Copyright: 2020, Vaisala Oyj.
 License: BSD-2-clause
 
 Files: libteec/*
-Copyright: 2015, 2016, Linaro Limited
+Copyright: 2016, Linaro Limited
 License: BSD-2-clause
 
-Files: libteec/include/teec_benchmark.h
+Files: libteec/include/tee_bench.h
 Copyright: 2017, Linaro Limited
 License: BSD-2-clause
 
-Files: libteec/src/teec_benchmark.c
-Copyright: 2017, Linaro Limited
+Files: libteec/include/tee_client_api.h
+Copyright: 2015, 2016, Linaro Limited
+ 2014, STMicroelectronics International N.V.
 License: BSD-2-clause
 
-Files: libteec/src/teec_trace.c
-Copyright: 2014, STMicroelectronics International N.V.
+Files: libteec/include/tee_plugin_method.h
+Copyright: 2020, Open Mobile Platform LLC
 License: BSD-2-clause
 
-Files: public/*
+Files: libteec/include/teec_trace.h
 Copyright: 2014, STMicroelectronics International N.V.
 License: BSD-2-clause
 
-Files: public/tee_bench.h
-Copyright: 2017, Linaro Limited
-License: BSD-2-clause
-
-Files: public/tee_client_api.h
+Files: libteec/src/*
 Copyright: 2015, 2016, Linaro Limited
- 2014, STMicroelectronics International N.V.
 License: BSD-2-clause
 
-Files: public/tee_client_api_extensions.h
-Copyright: 2016, Linaro Limited
+Files: libteec/src/teec_benchmark.c
+ libteec/src/teec_benchmark.h
+Copyright: 2017, Linaro Limited
 License: BSD-2-clause
 
-Files: public/tee_plugin_method.h
-Copyright: 2020, Open Mobile Platform LLC
+Files: libteec/src/teec_trace.c
+Copyright: 2014, STMicroelectronics International N.V.
 License: BSD-2-clause
 
 Files: scripts/*
diff --git a/debian/changelog b/debian/changelog
index 32b5a62c9563f31dbe66846c19a0040d1a615b90..aac40e4f05b8fb83c376db205475a736babfd92e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,28 @@
+optee-client (4.0.0-1+apertis1) apertis; urgency=medium
+
+  * Sync from debian/trixie.
+
+ -- Dylan Aïssi <dylan.aissi@collabora.com>  Tue, 13 Feb 2024 10:10:42 +0100
+
+optee-client (4.0.0-1) unstable; urgency=low
+
+  * New upstream release.
+    - FTCBFS fixed by the upstream (Closes: #1023233)
+
+ -- Ying-Chun Liu (PaulLiu) <paulliu@debian.org>  Mon, 11 Dec 2023 01:07:42 +0800
+
+optee-client (3.21.0-1) unstable; urgency=low
+
+  * New upstream release.
+
+ -- Ying-Chun Liu (PaulLiu) <paulliu@debian.org>  Mon, 26 Jun 2023 04:11:50 +0800
+
+optee-client (3.20.0-1) unstable; urgency=low
+
+  * New upstream release.
+
+ -- Ying-Chun Liu (PaulLiu) <paulliu@debian.org>  Fri, 23 Jun 2023 02:01:10 +0800
+
 optee-client (3.19.0-1+apertis1) apertis; urgency=medium
 
   * Add debian/apertis/copyright
diff --git a/debian/control b/debian/control
index 48a7dd90e6a74b758b6b35ae1e4b974e50a18386..fa5f40a8d40d62047fb570a39815bd12e3b6e33f 100644
--- a/debian/control
+++ b/debian/control
@@ -11,6 +11,8 @@ Standards-Version: 4.5.1
 Section: libs
 Homepage: https://github.com/OP-TEE/optee_client
 Rules-Requires-Root: no
+Vcs-Browser: https://salsa.debian.org/debian/optee-client
+Vcs-Git: https://salsa.debian.org/debian/optee-client.git
 
 Package: optee-client-dev
 Section: libdevel
@@ -18,6 +20,7 @@ Architecture: arm64 armhf
 Multi-Arch: same
 Depends: libckteec0 (= ${binary:Version}),
          libseteec0 (= ${binary:Version}),
+         libteeacl0.1.0 (= ${binary:Version}),
          libteec1 (= ${binary:Version}),
          ${misc:Depends}
 Description: normal world user space client APIs for OP-TEE (development)
@@ -30,6 +33,20 @@ Description: normal world user space client APIs for OP-TEE (development)
  .
  This package contains the development files OpTEE Client API
 
+Package: libteeacl0.1.0
+Architecture: arm64 armhf
+Multi-Arch: same
+Depends: ${misc:Depends}, ${shlibs:Depends}
+Description: normal world user space client APIs for OP-TEE
+ OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a
+ non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone
+ technology. OP-TEE implements TEE Internal Core API v1.1.x which is the API
+ exposed to Trusted Applications and the TEE Client API v1.0, which is the
+ API describing how to communicate with a TEE. This package provides the TEE
+ Client API library.
+ .
+ This package contains libteeacl library.
+
 Package: libteec1
 Architecture: arm64 armhf
 Multi-Arch: same
diff --git a/debian/gbp.conf b/debian/gbp.conf
new file mode 100644
index 0000000000000000000000000000000000000000..3ee9faab1ec11236c2c66b2ea4290305bf978bdd
--- /dev/null
+++ b/debian/gbp.conf
@@ -0,0 +1,3 @@
+[DEFAULT]
+pristine-tar = True
+filter = [ '.gitignore', '.travis.yml', '.git*' ]
diff --git a/debian/libteeacl0.1.0.install b/debian/libteeacl0.1.0.install
new file mode 100644
index 0000000000000000000000000000000000000000..1542252de5637bb53a0946b52ec0de5669d4bd90
--- /dev/null
+++ b/debian/libteeacl0.1.0.install
@@ -0,0 +1 @@
+usr/lib/*/libteeacl*.so.*
diff --git a/debian/patches/0001_fix_libckteec_symlink.patch b/debian/patches/0001_fix_libckteec_symlink.patch
index 50d705d4bf7d7a26389c9c7bedbd416f92e00190..7dce16138d37cab5e489459dbeb2f34961f8e6e7 100644
--- a/debian/patches/0001_fix_libckteec_symlink.patch
+++ b/debian/patches/0001_fix_libckteec_symlink.patch
@@ -3,10 +3,10 @@ Description: Fix ldconfig-symlink-referencing-wrong-file
 Author: Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
 Last-Update: 2022-02-05
 
-Index: optee-client-3.17.0/libckteec/Makefile
+Index: optee-client-4.0.0/libckteec/Makefile
 ===================================================================
---- optee-client-3.17.0.orig/libckteec/Makefile
-+++ optee-client-3.17.0/libckteec/Makefile
+--- optee-client-4.0.0.orig/libckteec/Makefile
++++ optee-client-4.0.0/libckteec/Makefile
 @@ -61,7 +61,7 @@ $(OUT_DIR)/$(LIBCKTEEC_AR_LIBRARY): $(LI
  
  libckteec:
diff --git a/debian/patches/0001_fix_libseteec_symlink.patch b/debian/patches/0001_fix_libseteec_symlink.patch
index bda6882b4a04edf59ae65c09f100c76240742c2c..4d5eb7160790dbe362f04d01a5d9a17cc1c25938 100644
--- a/debian/patches/0001_fix_libseteec_symlink.patch
+++ b/debian/patches/0001_fix_libseteec_symlink.patch
@@ -3,10 +3,10 @@ Description: Fix ldconfig-symlink-referencing-wrong-file
 Author: Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
 Last-Update: 2022-02-05
 
-Index: optee-client-3.17.0/libseteec/Makefile
+Index: optee-client-4.0.0/libseteec/Makefile
 ===================================================================
---- optee-client-3.17.0.orig/libseteec/Makefile
-+++ optee-client-3.17.0/libseteec/Makefile
+--- optee-client-4.0.0.orig/libseteec/Makefile
++++ optee-client-4.0.0/libseteec/Makefile
 @@ -54,7 +54,7 @@ $(OUT_DIR)/$(LIBSETEEC_AR_LIBRARY): $(LI
  
  libseteec:
diff --git a/debian/patches/0002_dont_set_crosscompile.patch b/debian/patches/0002_dont_set_crosscompile.patch
index 8cae6db174438b9452abd7c15afc955489dcc5df..608c78b1e43ed3f1503903bd3f9d1a98bf386f56 100644
--- a/debian/patches/0002_dont_set_crosscompile.patch
+++ b/debian/patches/0002_dont_set_crosscompile.patch
@@ -5,10 +5,10 @@ Author: Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
 Bug-Debian: https://bugs.debian.org/868215
 Last-Update: 2021-05-20
 
-Index: optee-client-3.17.0/flags.mk
+Index: optee-client-4.0.0/flags.mk
 ===================================================================
---- optee-client-3.17.0.orig/flags.mk
-+++ optee-client-3.17.0/flags.mk
+--- optee-client-4.0.0.orig/flags.mk
++++ optee-client-4.0.0/flags.mk
 @@ -2,7 +2,7 @@
  # COMMON COMPILATION FLAGS                                              #
  #########################################################################
@@ -17,4 +17,4 @@ Index: optee-client-3.17.0/flags.mk
 +CROSS_COMPILE   ?= 
  CC              ?= $(CROSS_COMPILE)gcc
  AR		?= $(CROSS_COMPILE)ar
- 
+ PKG_CONFIG	?= $(CROSS_COMPILE)pkg-config
diff --git a/flags.mk b/flags.mk
index c2f1846e37bf5be6db241e0c31e9bb1028876c87..be4088c15f7b7821bf235d5e3a0c10e9af48faa6 100644
--- a/flags.mk
+++ b/flags.mk
@@ -5,6 +5,9 @@
 CROSS_COMPILE   ?= arm-linux-gnueabihf-
 CC              ?= $(CROSS_COMPILE)gcc
 AR		?= $(CROSS_COMPILE)ar
+PKG_CONFIG	?= $(CROSS_COMPILE)pkg-config
+
+C_COMPILER=$(shell readlink -f $$(which $(CC)))
 
 override CFLAGS += -Wall -Wbad-function-cast -Wcast-align \
 		   -Werror-implicit-function-declaration -Wextra \
@@ -13,8 +16,10 @@ override CFLAGS += -Wall -Wbad-function-cast -Wcast-align \
 		   -Wmissing-format-attribute -Wmissing-include-dirs \
 		   -Wmissing-noreturn -Wmissing-prototypes -Wnested-externs \
 		   -Wpointer-arith -Wshadow -Wstrict-prototypes \
-		   -Wswitch-default -Wunsafe-loop-optimizations \
-		   -Wwrite-strings -D_FILE_OFFSET_BITS=64
+		   -Wswitch-default -Wwrite-strings -D_FILE_OFFSET_BITS=64
+ifneq (,$(findstring gcc,$(C_COMPILER)))
+override CFLAGS	+= -Wunsafe-loop-optimizations
+endif
 ifeq ($(CFG_WERROR),y)
 override CFLAGS	+= -Werror
 endif
diff --git a/libckteec/CMakeLists.txt b/libckteec/CMakeLists.txt
index 26c050eb2f025d5e7a87827ad9de180f3609d727..978e665231b148f13756a9238bdc9a2049442395 100644
--- a/libckteec/CMakeLists.txt
+++ b/libckteec/CMakeLists.txt
@@ -15,7 +15,7 @@ include(GNUInstallDirs)
 ################################################################################
 # Source files
 ################################################################################
-set (SRC
+set(SRC
 	src/pkcs11_api.c
 	src/ck_debug.c
 	src/ck_helpers.c
@@ -29,9 +29,9 @@ set (SRC
 ################################################################################
 # Built library
 ################################################################################
-add_library (ckteec ${SRC})
+add_library(ckteec ${SRC})
 
-set_target_properties (ckteec PROPERTIES
+set_target_properties(ckteec PROPERTIES
 	VERSION ${PROJECT_VERSION}
 	SOVERSION ${PROJECT_VERSION_MAJOR}
 )
@@ -39,7 +39,7 @@ set_target_properties (ckteec PROPERTIES
 ################################################################################
 # Flags always set
 ################################################################################
-target_compile_definitions (ckteec
+target_compile_definitions(ckteec
 	PRIVATE -D_GNU_SOURCE
 	PRIVATE -DBINARY_PREFIX="LT"
 )
@@ -61,7 +61,7 @@ target_include_directories(teec
 	PUBLIC include
 )
 
-target_link_libraries (ckteec
+target_link_libraries(ckteec
 	PRIVATE pthread
 	PRIVATE teec
 	PRIVATE m
@@ -70,7 +70,7 @@ target_link_libraries (ckteec
 ################################################################################
 # Install targets
 ################################################################################
-install (TARGETS ckteec
+install(TARGETS ckteec
 	DESTINATION ${CMAKE_INSTALL_LIBDIR}
 )
 
diff --git a/libckteec/Makefile b/libckteec/Makefile
index 859ce3cea8f269a8c26a43e9c39b0ee2902b1f2f..de7e3309395e415ae085db0b7b16e6ffccec0cc7 100644
--- a/libckteec/Makefile
+++ b/libckteec/Makefile
@@ -31,7 +31,7 @@ LIBCKTEEC_SRCS		+= serializer.c
 LIBCKTEEC_SRCS		+= serialize_ck.c
 
 LIBCKTEEC_INCLUDES	= ${CURDIR}/include
-LIBCKTEEC_INCLUDES 	+= ${CURDIR}/../public
+LIBCKTEEC_INCLUDES 	+= ${CURDIR}/../libteec/include
 
 LIBCKTEEC_CFLAGS	:= $(addprefix -I, $(LIBCKTEEC_INCLUDES)) \
 			$(CFLAGS) -D_GNU_SOURCE -fPIC
diff --git a/libckteec/include/CMakeLists.txt b/libckteec/include/CMakeLists.txt
index 826bb481621aa5d9fa0e2c5210e8fcfee7cef98a..c34201223861b87f5ca65a7019020c6903320680 100644
--- a/libckteec/include/CMakeLists.txt
+++ b/libckteec/include/CMakeLists.txt
@@ -1,4 +1,4 @@
-project (libckteec-headers C)
+project(libckteec-headers C)
 
 FILE(GLOB INSTALL_HEADERS "*.h")
 
@@ -9,4 +9,4 @@ target_include_directories(
         $<INSTALL_INTERFACE:{CMAKE_INSTALL_INCLUDEDIR}>
 )
 
-install (FILES ${INSTALL_HEADERS} DESTINATION ${CMAKE_INSTALL_INCLUDEDIR})
+install(FILES ${INSTALL_HEADERS} DESTINATION ${CMAKE_INSTALL_INCLUDEDIR})
diff --git a/libckteec/include/pkcs11.h b/libckteec/include/pkcs11.h
index bfd766144753848a91bae0eefa99b7ae53a621c3..6d7a0f77f2c4d3effa998d310ec702da8c8b412c 100644
--- a/libckteec/include/pkcs11.h
+++ b/libckteec/include/pkcs11.h
@@ -548,6 +548,13 @@ struct CK_RSA_PKCS_OAEP_PARAMS {
 	CK_ULONG		ulSourceDataLen;
 };
 
+typedef struct CK_RSA_AES_KEY_WRAP_PARAMS {
+	CK_ULONG ulAESKeyBits;
+	CK_RSA_PKCS_OAEP_PARAMS_PTR pOAEPParams;
+} CK_RSA_AES_KEY_WRAP_PARAMS;
+
+typedef CK_RSA_AES_KEY_WRAP_PARAMS *CK_RSA_AES_KEY_WRAP_PARAMS_PTR;
+
 /*
  * PKCS#11 return values
  */
diff --git a/libckteec/src/serialize_ck.c b/libckteec/src/serialize_ck.c
index d1411ece5967a3258bb86fe90309b0db85b5e131..6fe9d1041796d0cad953eeb7c01044af30ea7e5e 100644
--- a/libckteec/src/serialize_ck.c
+++ b/libckteec/src/serialize_ck.c
@@ -582,6 +582,49 @@ static CK_RV serialize_mecha_rsa_oaep_param(struct serializer *obj,
 				params->ulSourceDataLen);
 }
 
+static CK_RV serialize_mecha_rsa_aes_key_wrap(struct serializer *obj,
+					      CK_MECHANISM_PTR mecha)
+{
+	CK_RSA_AES_KEY_WRAP_PARAMS *params = mecha->pParameter;
+	CK_RSA_PKCS_OAEP_PARAMS *aes_params = params->pOAEPParams;
+	CK_RV rv = CKR_GENERAL_ERROR;
+	size_t params_size = 5 * sizeof(uint32_t) + aes_params->ulSourceDataLen;
+
+	if (mecha->ulParameterLen != sizeof(*params))
+		return CKR_ARGUMENTS_BAD;
+
+	rv = serialize_32b(obj, obj->type);
+	if (rv)
+		return rv;
+
+	rv = serialize_32b(obj, params_size);
+	if (rv)
+		return rv;
+
+	rv = serialize_ck_ulong(obj, params->ulAESKeyBits);
+	if (rv)
+		return rv;
+
+	rv = serialize_ck_ulong(obj, aes_params->hashAlg);
+	if (rv)
+		return rv;
+
+	rv = serialize_ck_ulong(obj, aes_params->mgf);
+	if (rv)
+		return rv;
+
+	rv = serialize_ck_ulong(obj, aes_params->source);
+	if (rv)
+		return rv;
+
+	rv = serialize_ck_ulong(obj, aes_params->ulSourceDataLen);
+	if (rv)
+		return rv;
+
+	return serialize_buffer(obj, aes_params->pSourceData,
+				aes_params->ulSourceDataLen);
+}
+
 static CK_RV serialize_mecha_eddsa(struct serializer *obj,
 				   CK_MECHANISM_PTR mecha)
 {
@@ -739,6 +782,8 @@ CK_RV serialize_ck_mecha_params(struct serializer *obj,
 	case CKM_SHA384_HMAC_GENERAL:
 	case CKM_SHA512_HMAC_GENERAL:
 		return serialize_mecha_mac_general_param(obj, &mecha);
+	case CKM_RSA_AES_KEY_WRAP:
+		return serialize_mecha_rsa_aes_key_wrap(obj, &mecha);
 
 	default:
 		return CKR_MECHANISM_INVALID;
diff --git a/libseteec/CMakeLists.txt b/libseteec/CMakeLists.txt
index 5080231dcad6fc9ebda8312da6a31e60284cb5c7..cabf92f04877bf4dabde98f66574a1bbd8a307a5 100644
--- a/libseteec/CMakeLists.txt
+++ b/libseteec/CMakeLists.txt
@@ -15,16 +15,16 @@ include(GNUInstallDirs)
 ################################################################################
 # Source files
 ################################################################################
-set (SRC
+set(SRC
 	src/se.c
 )
 
 ################################################################################
 # Built library
 ################################################################################
-add_library (seteec ${SRC})
+add_library(seteec ${SRC})
 
-set_target_properties (seteec PROPERTIES
+set_target_properties(seteec PROPERTIES
 	VERSION ${PROJECT_VERSION}
 	SOVERSION ${PROJECT_VERSION_MAJOR}
 )
@@ -32,7 +32,7 @@ set_target_properties (seteec PROPERTIES
 ################################################################################
 # Flags always set
 ################################################################################
-target_compile_definitions (seteec
+target_compile_definitions(seteec
 	PRIVATE -D_GNU_SOURCE
 	PRIVATE -DBINARY_PREFIX="LT"
 )
@@ -50,7 +50,7 @@ target_include_directories(seteec
 	PRIVATE src
 )
 
-target_link_libraries (seteec
+target_link_libraries(seteec
 	PRIVATE pthread
 	PRIVATE teec
 )
@@ -58,7 +58,7 @@ target_link_libraries (seteec
 ################################################################################
 # Install targets
 ################################################################################
-install (TARGETS seteec
+install(TARGETS seteec
 	DESTINATION ${CMAKE_INSTALL_LIBDIR}
 )
 
diff --git a/libseteec/Makefile b/libseteec/Makefile
index 8384d5b169a6f8fd905ea77c675319aac151d377..ce8b2176724b47ad350532d80784837991f24a11 100644
--- a/libseteec/Makefile
+++ b/libseteec/Makefile
@@ -24,7 +24,7 @@ LIBSETEEC_SRC_DIR	:= src
 LIBSETEEC_SRCS	= se.c
 
 LIBSETEEC_INCLUDES	= ${CURDIR}/include
-LIBSETEEC_INCLUDES 	+= ${CURDIR}/../public
+LIBSETEEC_INCLUDES 	+= ${CURDIR}/../libteec/include
 
 LIBSETEEC_CFLAGS	:= $(addprefix -I, $(LIBSETEEC_INCLUDES)) \
 			$(CFLAGS) -D_GNU_SOURCE -fPIC
diff --git a/libseteec/include/CMakeLists.txt b/libseteec/include/CMakeLists.txt
index 924157449187fac1c5187170d78fb8e5ef6d7c8e..ee6faddc28054bcae0f4ece5c0e2f809d958ee22 100644
--- a/libseteec/include/CMakeLists.txt
+++ b/libseteec/include/CMakeLists.txt
@@ -1,7 +1,7 @@
-project (libseteec-headers C)
+project(libseteec-headers C)
 
 FILE(GLOB INSTALL_HEADERS "*.h")
 
 add_library(${PROJECT_NAME} INTERFACE)
 
-install (FILES ${INSTALL_HEADERS} DESTINATION ${CMAKE_INSTALL_INCLUDEDIR})
+install(FILES ${INSTALL_HEADERS} DESTINATION ${CMAKE_INSTALL_INCLUDEDIR})
diff --git a/libteeacl/Makefile b/libteeacl/Makefile
index 54851442da2f552b75c92b68b65e1bb5be478328..fe50c51d68230660ec9210ef042b91ed1564836c 100644
--- a/libteeacl/Makefile
+++ b/libteeacl/Makefile
@@ -3,7 +3,7 @@ include ../config.mk
 
 OUT_DIR := $(OO)/libteeacl
 
-.PHONY: all libteeacl clean
+.PHONY: all libteeacl check-libuuid clean
 
 all: libteeacl
 install: libteeacl
@@ -27,10 +27,10 @@ LIBTEEACL_SRCS	+= tee_uuid.c
 LIBTEEACL_INCLUDES	= ${CURDIR}/include
 
 LIBTEEACL_CFLAGS	:= $(addprefix -I, $(LIBTEEACL_INCLUDES)) \
-			$(shell pkg-config --cflags uuid) \
+			$(shell $(PKG_CONFIG) --cflags uuid) \
 			$(CFLAGS) -D_GNU_SOURCE -fPIC
 
-LIBTEEACL_LFLAGS	:= $(LDFLAGS) $(shell pkg-config --libs uuid)
+LIBTEEACL_LFLAGS	:= $(LDFLAGS) $(shell $(PKG_CONFIG) --libs uuid)
 
 LIBTEEACL_OBJ_DIR	:= $(OUT_DIR)
 LIBTEEACL_OBJS	:= $(patsubst %.c,$(LIBTEEACL_OBJ_DIR)/%.o, $(LIBTEEACL_SRCS))
@@ -40,6 +40,12 @@ $(LIBTEEACL_OBJ_DIR)/%.o: ${LIBTEEACL_SRC_DIR}/%.c
 	@echo "  CC      $<"
 	$(VPREFIX)$(CC) $(LIBTEEACL_CFLAGS) -c $< -o $@
 
+libteeacl: check-libuuid
+
+check-libuuid:
+	@echo "  Finding uuid.pc"
+	$(VPREFIX)$(PKG_CONFIG) --atleast-version=2.34 uuid
+
 libteeacl: $(OUT_DIR)/$(LIBTEEACL_SO_LIBRARY)
 
 $(OUT_DIR)/$(LIBTEEACL_SO_LIBRARY): $(LIBTEEACL_OBJS)
diff --git a/libteeacl/include/teeacl.h b/libteeacl/include/teeacl.h
index f4db9141fe8e708e981ec4d8e5be5bb48d2406e1..1d7a5eef7d6eb7b62ef60f97023d693047441b46 100644
--- a/libteeacl/include/teeacl.h
+++ b/libteeacl/include/teeacl.h
@@ -12,7 +12,7 @@
 #define TEEACL_H
 
 #include <grp.h>
-#include <uuid/uuid.h>
+#include <uuid.h>
 
 #ifdef __cplusplus
 extern "C" {
diff --git a/libteeacl/src/group.c b/libteeacl/src/group.c
index 10965dd090ed5a4e570ca179ae4d2234c0d4ee81..bd165a111ddf903712074dfc1bac0b68f1058151 100644
--- a/libteeacl/src/group.c
+++ b/libteeacl/src/group.c
@@ -72,7 +72,8 @@ enum rv_groupmember teeacl_user_is_member_of(const char *user, gid_t group)
 	if (ret == -1) {
 		p_groups = groups;
 
-		groups = reallocarray(groups, grouplistsize, sizeof(gid_t));
+		/* we use realloc, since uClibc does not implement reallocarray */
+		groups = realloc(groups, grouplistsize * sizeof(gid_t));
 		if (!groups) {
 			free(p_groups);
 			return E_MEMORY;
diff --git a/libteec/CMakeLists.txt b/libteec/CMakeLists.txt
index dd96e1bac056c15cfd0e3c3abc683f585b5231a3..0c73ebaef5259ee8da11d5674f05100fc7184eaa 100644
--- a/libteec/CMakeLists.txt
+++ b/libteec/CMakeLists.txt
@@ -13,29 +13,32 @@ endif()
 ################################################################################
 # Configuration flags always included
 ################################################################################
-option (CFG_TEE_BENCHMARK "Build with benchmark support" OFF)
+option(CFG_TEE_BENCHMARK "Build with benchmark support" OFF)
 
-set (CFG_TEE_CLIENT_LOG_LEVEL "1" CACHE STRING "libteec log level")
-set (CFG_TEE_CLIENT_LOG_FILE "/data/tee/teec.log" CACHE STRING "Location of libteec log")
+set(CFG_TEE_CLIENT_LOG_LEVEL "1" CACHE STRING "libteec log level")
+set(CFG_TEE_CLIENT_LOG_FILE "/data/tee/teec.log" CACHE STRING "Location of libteec log")
 
 ################################################################################
 # Source files
 ################################################################################
-set (SRC
+set(SRC
 	src/tee_client_api.c
 	src/teec_trace.c
 )
 
-if (CFG_TEE_BENCHMARK)
-	set (SRC ${SRC} src/teec_benchmark.c)
+if(CFG_TEE_BENCHMARK)
+	set(SRC ${SRC} src/teec_benchmark.c)
 endif()
 
 ################################################################################
 # Built library
 ################################################################################
-add_library (teec ${SRC})
+add_library(teec ${SRC})
 
-set_target_properties (teec PROPERTIES
+set(libteectgt teec)
+configure_file(libteec.pc.in libteec.pc @ONLY)
+
+set_target_properties(teec PROPERTIES
 	VERSION ${PROJECT_VERSION}
 	SOVERSION ${PROJECT_VERSION_MAJOR}
 )
@@ -43,7 +46,7 @@ set_target_properties (teec PROPERTIES
 ################################################################################
 # Flags always set
 ################################################################################
-target_compile_definitions (teec
+target_compile_definitions(teec
 	PRIVATE -D_GNU_SOURCE
 	PRIVATE -DDEBUGLEVEL_${CFG_TEE_CLIENT_LOG_LEVEL}
 	PRIVATE -DTEEC_LOG_FILE="${CFG_TEE_CLIENT_LOG_FILE}"
@@ -53,23 +56,34 @@ target_compile_definitions (teec
 ################################################################################
 # Optional flags
 ################################################################################
-if (CFG_TEE_BENCHMARK)
-	target_compile_definitions (teec PRIVATE -DCFG_TEE_BENCHMARK)
+if(CFG_TEE_BENCHMARK)
+	target_compile_definitions(teec PRIVATE -DCFG_TEE_BENCHMARK)
 endif()
 
 ################################################################################
 # Public and private header and library dependencies
 ################################################################################
-target_include_directories(teec PUBLIC include)
+target_include_directories(teec
+	PUBLIC include
+	PRIVATE src
+)
 
-target_link_libraries (teec
+target_link_libraries(teec
 	PUBLIC ${CMAKE_THREAD_LIBS_INIT} # this is pthreads
-	PRIVATE optee-client-headers)
+)
 
 ################################################################################
 # Install targets
 ################################################################################
 # FIXME: This should in someway harmonize with CFG_TEE_CLIENT_LOAD_PATH
 # FIXME: Should we change this to /usr/local/lib?
-install (TARGETS teec LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}"
+install(TARGETS teec LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}"
                       ARCHIVE DESTINATION "${CMAKE_INSTALL_LIBDIR}")
+
+install(DIRECTORY include
+	DESTINATION ${CMAKE_INSTALL_PREFIX}
+)
+
+install(FILES "${CMAKE_CURRENT_BINARY_DIR}/libteec.pc"
+	DESTINATION "${CMAKE_INSTALL_LIBDIR}/pkgconfig"
+)
diff --git a/libteec/Makefile b/libteec/Makefile
index 3b279ab131aba2732676332166e8b1e5fff92594..41a21bb64a9d226890948d73e8550ef83bd3935b 100644
--- a/libteec/Makefile
+++ b/libteec/Makefile
@@ -28,7 +28,7 @@ TEEC_OBJ_DIR	:= $(OUT_DIR)
 TEEC_OBJS 	:= $(patsubst %.c,$(TEEC_OBJ_DIR)/%.o, $(TEEC_SRCS))
 TEEC_INCLUDES 	:= \
 		   ${CURDIR}/include \
-		   ${CURDIR}/../public \
+		   ${CURDIR}/src
 
 TEEC_CFLAGS	:= $(addprefix -I, $(TEEC_INCLUDES)) $(CFLAGS) -D_GNU_SOURCE \
 		   -DDEBUGLEVEL_$(CFG_TEE_CLIENT_LOG_LEVEL) \
diff --git a/public/tee_bench.h b/libteec/include/tee_bench.h
similarity index 100%
rename from public/tee_bench.h
rename to libteec/include/tee_bench.h
diff --git a/public/tee_client_api.h b/libteec/include/tee_client_api.h
similarity index 100%
rename from public/tee_client_api.h
rename to libteec/include/tee_client_api.h
diff --git a/public/tee_client_api_extensions.h b/libteec/include/tee_client_api_extensions.h
similarity index 100%
rename from public/tee_client_api_extensions.h
rename to libteec/include/tee_client_api_extensions.h
diff --git a/public/tee_plugin_method.h b/libteec/include/tee_plugin_method.h
similarity index 100%
rename from public/tee_plugin_method.h
rename to libteec/include/tee_plugin_method.h
diff --git a/public/teec_trace.h b/libteec/include/teec_trace.h
similarity index 100%
rename from public/teec_trace.h
rename to libteec/include/teec_trace.h
diff --git a/libteec/libteec.pc.in b/libteec/libteec.pc.in
new file mode 100644
index 0000000000000000000000000000000000000000..e91e6909919e7e29a595a48b5b4ef915402ac084
--- /dev/null
+++ b/libteec/libteec.pc.in
@@ -0,0 +1,14 @@
+prefix="@CMAKE_INSTALL_PREFIX@"
+exec_prefix="${prefix}"
+libdir="${prefix}/lib"
+includedir="${prefix}/include"
+
+Name: @PROJECT_NAME@
+Description: @CMAKE_PROJECT_DESCRIPTION@
+URL: @CMAKE_PROJECT_HOMEPAGE_URL@
+Version: @PROJECT_VERSION@
+Requires: @pc_req_public@
+Requires.private: @pc_req_private@
+Cflags: -I"${includedir}"
+Libs: -L"${libdir}" -l@libteectgt@ 
+Libs.private: -L"${libdir}" -l@libteectgt@ @pc_libs_private@
diff --git a/libteec/include/linux/tee.h b/libteec/src/linux/tee.h
similarity index 100%
rename from libteec/include/linux/tee.h
rename to libteec/src/linux/tee.h
diff --git a/libteec/src/tee_client_api.c b/libteec/src/tee_client_api.c
index d8cc4b5b9947134d9407748995e6f42da7eeedb2..6d398ab95b3b50f306c44aa706833db962a1cd80 100644
--- a/libteec/src/tee_client_api.c
+++ b/libteec/src/tee_client_api.c
@@ -79,8 +79,10 @@ static void teec_mutex_unlock(pthread_mutex_t *mu)
 static void *teec_paged_aligned_alloc(size_t sz)
 {
 	void *p = NULL;
+	size_t page_sz = sysconf(_SC_PAGESIZE);
+	size_t aligned_sz = ((sz + page_sz - 1) / page_sz) * page_sz;
 
-	if (!posix_memalign(&p, sysconf(_SC_PAGESIZE), sz))
+	if (!posix_memalign(&p, page_sz, aligned_sz))
 		return p;
 
 	return NULL;
diff --git a/libteec/src/teec_benchmark.c b/libteec/src/teec_benchmark.c
index f7a82e03e920d56e9e09bb8f17780f545640b094..0d04c196ae7e6160be68f26e879c9246c5abbe4c 100644
--- a/libteec/src/teec_benchmark.c
+++ b/libteec/src/teec_benchmark.c
@@ -130,7 +130,7 @@ static void *mmap_paddr(intptr_t paddr, uint64_t size)
 	offset = (off_t)paddr % getpagesize();
 	page_addr = (off_t)(paddr - offset);
 
-	hw_addr = (intptr_t *)mmap(0, size, PROT_READ|PROT_WRITE,
+	hw_addr = (intptr_t *)mmap(0, size + offset, PROT_READ|PROT_WRITE,
 					MAP_SHARED, devmem, page_addr);
 	if (hw_addr == MAP_FAILED) {
 		close(devmem);
diff --git a/libteec/include/teec_benchmark.h b/libteec/src/teec_benchmark.h
similarity index 100%
rename from libteec/include/teec_benchmark.h
rename to libteec/src/teec_benchmark.h
diff --git a/public/CMakeLists.txt b/public/CMakeLists.txt
deleted file mode 100644
index 72b078a8b4211b49ca65bb80872c903bf4eb0fc9..0000000000000000000000000000000000000000
--- a/public/CMakeLists.txt
+++ /dev/null
@@ -1,25 +0,0 @@
-project (optee-client-headers C)
-
-################################################################################
-# Header files to be exported
-################################################################################
-FILE(GLOB INSTALL_HEADERS "*.h")
-
-################################################################################
-# Built library
-################################################################################
-add_library(${PROJECT_NAME} INTERFACE)
-
-################################################################################
-# Public and private header and library dependencies
-################################################################################
-target_include_directories(
-        teec
-        PUBLIC $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}>
-        $<INSTALL_INTERFACE:{CMAKE_INSTALL_INCLUDEDIR}>
-)
-
-################################################################################
-# Install targets
-################################################################################
-install (FILES ${INSTALL_HEADERS} DESTINATION ${CMAKE_INSTALL_INCLUDEDIR})
diff --git a/tee-supplicant/CMakeLists.txt b/tee-supplicant/CMakeLists.txt
index 57a3326da2fcaf9379ed2181d27e77d9d4051dfc..b98fe2e602f3f84f4312f80c99a98718c04f75f2 100644
--- a/tee-supplicant/CMakeLists.txt
+++ b/tee-supplicant/CMakeLists.txt
@@ -1,30 +1,30 @@
-project (tee-supplicant C)
+project(tee-supplicant C)
 
 ################################################################################
 # Configuration flags always included
 ################################################################################
-option (CFG_TA_TEST_PATH "Enable tee-supplicant to load from test/debug path" OFF)
-option (RPMB_EMU "Enable tee-supplicant to emulate RPMB" ON)
-option (CFG_TA_GPROF_SUPPORT "Enable tee-supplicant support for TAs instrumented with gprof" ON)
-option (CFG_FTRACE_SUPPORT "Enable tee-supplicant support for TAs instrumented with ftrace" ON)
-option (CFG_TEE_SUPP_PLUGINS "Enable tee-supplicant plugin support" ON)
+option(CFG_TA_TEST_PATH "Enable tee-supplicant to load from test/debug path" OFF)
+option(RPMB_EMU "Enable tee-supplicant to emulate RPMB" ON)
+option(CFG_TA_GPROF_SUPPORT "Enable tee-supplicant support for TAs instrumented with gprof" ON)
+option(CFG_FTRACE_SUPPORT "Enable tee-supplicant support for TAs instrumented with ftrace" ON)
+option(CFG_TEE_SUPP_PLUGINS "Enable tee-supplicant plugin support" ON)
 
-set (CFG_TEE_SUPP_LOG_LEVEL "1" CACHE STRING "tee-supplicant log level")
+set(CFG_TEE_SUPP_LOG_LEVEL "1" CACHE STRING "tee-supplicant log level")
 # FIXME: Question is, is this really needed? Should just use defaults from # GNUInstallDirs?
-set (CFG_TEE_CLIENT_LOAD_PATH "/lib" CACHE STRING "Colon-separated list of paths where to look for TAs (see also --ta-dir)")
-set (CFG_TEE_FS_PARENT_PATH "/data/tee" CACHE STRING "Location of TEE filesystem (secure storage)")
+set(CFG_TEE_CLIENT_LOAD_PATH "/lib" CACHE STRING "Colon-separated list of paths where to look for TAs (see also --ta-dir)")
+set(CFG_TEE_FS_PARENT_PATH "/data/tee" CACHE STRING "Location of TEE filesystem (secure storage)")
 # FIXME: Why do we have if defined(CFG_GP_SOCKETS) && CFG_GP_SOCKETS == 1 in the c-file?
-set (CFG_GP_SOCKETS "1" CACHE STRING "Enable GlobalPlatform Socket API support")
-set (CFG_TEE_PLUGIN_LOAD_PATH "/usr/lib/tee-supplicant/plugins/" CACHE STRING "tee-supplicant's plugins path")
+set(CFG_GP_SOCKETS "1" CACHE STRING "Enable GlobalPlatform Socket API support")
+set(CFG_TEE_PLUGIN_LOAD_PATH "/usr/lib/tee-supplicant/plugins/" CACHE STRING "tee-supplicant's plugins path")
 
-if (CFG_TEE_SUPP_PLUGINS)
-	set (CMAKE_INSTALL_RPATH "${CFG_TEE_PLUGIN_LOAD_PATH}")
+if(CFG_TEE_SUPP_PLUGINS)
+	set(CMAKE_INSTALL_RPATH "${CFG_TEE_PLUGIN_LOAD_PATH}")
 endif()
 
 ################################################################################
 # Source files
 ################################################################################
-set (SRC
+set(SRC
 	src/handle.c
 	src/hmac_sha2.c
 	src/rpmb.c
@@ -34,27 +34,27 @@ set (SRC
 	src/teec_ta_load.c
 )
 
-if (CFG_GP_SOCKETS)
-	set (SRC ${SRC} src/tee_socket.c)
+if(CFG_GP_SOCKETS)
+	set(SRC ${SRC} src/tee_socket.c)
 endif()
 
-if (CFG_TA_GPROF_SUPPORT OR CFG_FTRACE_SUPPORT)
-	set (SRC ${SRC} src/prof.c)
+if(CFG_TA_GPROF_SUPPORT OR CFG_FTRACE_SUPPORT)
+	set(SRC ${SRC} src/prof.c)
 endif()
 
-if (CFG_TEE_SUPP_PLUGINS)
-	set (SRC ${SRC} src/plugin.c)
+if(CFG_TEE_SUPP_PLUGINS)
+	set(SRC ${SRC} src/plugin.c)
 endif()
 
 ################################################################################
 # Built binary
 ################################################################################
-add_executable (${PROJECT_NAME} ${SRC})
+add_executable(${PROJECT_NAME} ${SRC})
 
 ################################################################################
 # Flags always set
 ################################################################################
-target_compile_definitions (${PROJECT_NAME}
+target_compile_definitions(${PROJECT_NAME}
 	PRIVATE -DDEBUGLEVEL_${CFG_TEE_SUPP_LOG_LEVEL}
 	PRIVATE -DTEEC_LOAD_PATH="${CFG_TEE_CLIENT_LOAD_PATH}"
 	PRIVATE -DTEE_FS_PARENT_PATH="${CFG_TEE_FS_PARENT_PATH}"
@@ -64,33 +64,33 @@ target_compile_definitions (${PROJECT_NAME}
 ################################################################################
 # Optional flags
 ################################################################################
-if (CFG_GP_SOCKETS)
-	target_compile_definitions (${PROJECT_NAME}
+if(CFG_GP_SOCKETS)
+	target_compile_definitions(${PROJECT_NAME}
 		PRIVATE -DCFG_GP_SOCKETS=${CFG_GP_SOCKETS})
 endif()
 
-if (CFG_TA_TEST_PATH)
-	target_compile_definitions (${PROJECT_NAME}
+if(CFG_TA_TEST_PATH)
+	target_compile_definitions(${PROJECT_NAME}
 		PRIVATE -DCFG_TA_TEST_PATH=${CFG_TA_TEST_PATH})
 endif()
 
-if (RPMB_EMU)
-	target_compile_definitions (${PROJECT_NAME}
+if(RPMB_EMU)
+	target_compile_definitions(${PROJECT_NAME}
 		PRIVATE -DRPMB_EMU=1)
 endif()
 
-if (CFG_TA_GPROF_SUPPORT)
-	target_compile_definitions (${PROJECT_NAME}
+if(CFG_TA_GPROF_SUPPORT)
+	target_compile_definitions(${PROJECT_NAME}
 		PRIVATE -DCFG_TA_GPROF_SUPPORT)
 endif()
 
-if (CFG_FTRACE_SUPPORT)
-	target_compile_definitions (${PROJECT_NAME}
+if(CFG_FTRACE_SUPPORT)
+	target_compile_definitions(${PROJECT_NAME}
 		PRIVATE -DCFG_FTRACE_SUPPORT)
 endif()
 
-if (CFG_TEE_SUPP_PLUGINS)
-	target_compile_definitions (${PROJECT_NAME}
+if(CFG_TEE_SUPP_PLUGINS)
+	target_compile_definitions(${PROJECT_NAME}
 		PRIVATE -DTEE_SUPP_PLUGINS
 		PRIVATE -DTEE_PLUGIN_LOAD_PATH="${CFG_TEE_PLUGIN_LOAD_PATH}"
 	)
@@ -101,13 +101,12 @@ endif()
 ################################################################################
 target_include_directories(${PROJECT_NAME} PRIVATE src)
 
-target_link_libraries (${PROJECT_NAME}
+target_link_libraries(${PROJECT_NAME}
 	PRIVATE teec
-	PRIVATE optee-client-headers
 )
 
-if (CFG_TEE_SUPP_PLUGINS)
-	target_link_libraries (${PROJECT_NAME}
+if(CFG_TEE_SUPP_PLUGINS)
+	target_link_libraries(${PROJECT_NAME}
 		PRIVATE dl
 	)
 endif()
@@ -115,4 +114,4 @@ endif()
 ################################################################################
 # Install targets
 ################################################################################
-install (TARGETS ${PROJECT_NAME} RUNTIME DESTINATION ${CMAKE_INSTALL_SBINDIR})
+install(TARGETS ${PROJECT_NAME} RUNTIME DESTINATION ${CMAKE_INSTALL_SBINDIR})
diff --git a/tee-supplicant/Makefile b/tee-supplicant/Makefile
index b862a7ef9d53a948756d7437d974109b5586eceb..6f59c8c951b741a03bb7cfd8a5b346dfbe9421a8 100644
--- a/tee-supplicant/Makefile
+++ b/tee-supplicant/Makefile
@@ -40,7 +40,7 @@ TEES_OBJ_DIR	:= $(OUT_DIR)
 TEES_OBJS 	:= $(patsubst %.c,$(TEES_OBJ_DIR)/%.o, $(TEES_SRCS))
 TEES_INCLUDES 	:= ${CURDIR}/../libteec/include \
 		   ${CURDIR}/src \
-		   ${CURDIR}/../public \
+		   ${CURDIR}/../libteec/include \
 
 TEES_CFLAGS	:= $(addprefix -I, $(TEES_INCLUDES)) $(CFLAGS) \
 		   -DDEBUGLEVEL_$(CFG_TEE_SUPP_LOG_LEVEL) \
diff --git a/tee-supplicant/src/plugin.c b/tee-supplicant/src/plugin.c
index 22c35dff5f84457b567c90ac289551fc9d7efd87..cca22a18f5c217d93526f33e65ee4ce6e4bbf527 100644
--- a/tee-supplicant/src/plugin.c
+++ b/tee-supplicant/src/plugin.c
@@ -80,12 +80,13 @@ static enum plugin_err load_plugin(const char *name, struct plugin *p)
 	if (!handle)
 		return PLUGIN_DL_OPEN_ERR;
 
-	p->handle = handle;
-
 	m = (struct plugin_method *)dlsym(handle, "plugin_method");
-	if (!m || !m->name || !m->invoke)
+	if (!m || !m->name || !m->invoke) {
+		dlclose(handle);
 		return PLUGIN_DL_SYM_ERR;
+	}
 
+	p->handle = handle;
 	p->method = m;
 
 	return PLUGIN_OK;
diff --git a/tee-supplicant/src/tee_supp_fs.c b/tee-supplicant/src/tee_supp_fs.c
index 04a89c780edcd9efbf9f7aecd2b10afc0d0d32ab..cc4120fdb182d2fc1357fb3f5cb6ea44da278ffc 100644
--- a/tee-supplicant/src/tee_supp_fs.c
+++ b/tee-supplicant/src/tee_supp_fs.c
@@ -89,6 +89,17 @@ static size_t tee_fs_get_absolute_filename(char *file, char *out,
 	return (size_t)s;
 }
 
+static void fs_fsync(void)
+{
+	int fd = 0;
+
+	fd = open(tee_fs_root, O_RDONLY | O_DIRECTORY);
+	if (fd > 0) {
+		fsync(fd);
+		close(fd);
+	}
+}
+
 static int do_mkdir(const char *path, mode_t mode)
 {
 	struct stat st;
@@ -101,6 +112,7 @@ static int do_mkdir(const char *path, mode_t mode)
 	if (stat(path, &st) != 0 && !S_ISDIR(st.st_mode))
 		return -1;
 
+	fs_fsync();
 	return 0;
 }
 
@@ -277,6 +289,7 @@ static TEEC_Result ree_fs_new_create(size_t num_params,
 	}
 
 out:
+	fs_fsync();
 	params[2].a = fd;
 	return TEEC_SUCCESS;
 }
@@ -491,6 +504,8 @@ static TEEC_Result ree_fs_new_rename(size_t num_params,
 		if (errno == ENOENT)
 			return TEEC_ERROR_ITEM_NOT_FOUND;
 	}
+
+	fs_fsync();
 	return TEEC_SUCCESS;
 }
 
@@ -628,7 +643,7 @@ TEEC_Result tee_supp_fs_process(size_t num_params,
 	if (!num_params || !tee_supp_param_is_value(params))
 		return TEEC_ERROR_BAD_PARAMETERS;
 
-	if (strlen(tee_fs_root) == 0) {
+	if (!tee_fs_root[0]) {
 		if (tee_supp_fs_init() != 0) {
 			EMSG("error tee_supp_fs_init: failed to create %s/",
 				tee_fs_root);
diff --git a/tee-supplicant/tee_supplicant_android.mk b/tee-supplicant/tee_supplicant_android.mk
index 49bc388a5f12baf6327968b0ebc325fda2104166..04eee2a471c0555d417c1f376c1a37756a35c07b 100644
--- a/tee-supplicant/tee_supplicant_android.mk
+++ b/tee-supplicant/tee_supplicant_android.mk
@@ -62,7 +62,7 @@ ifeq ($(CFG_FTRACE_SUPPORT),y)
 LOCAL_CFLAGS += -DCFG_FTRACE_SUPPORT
 endif
 
-LOCAL_C_INCLUDES := $(LOCAL_PATH)/../public \
+LOCAL_C_INCLUDES := $(LOCAL_PATH)/../libteec/include \
                     $(LOCAL_PATH)/../libteec/include \
                     $(LOCAL_PATH)/src