diff --git a/meta-arm-integration/recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc b/meta-arm-integration/recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc
index 1d0f476e..43113a98 100644
--- a/meta-arm-integration/recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc
+++ b/meta-arm-integration/recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc
@@ -14,11 +14,28 @@ TFA_PLATFORM ?= "invalid"
 
 # Build for debug (set TFA_DEBUG to 1 to activate)
 TFA_DEBUG ?= "0"
-TFA_BUILD_DIR ?= "${@bb.utils.contains('TFA_DEBUG', '1', 'build/${TFA_PLATFORM}/debug', 'build/${TFA_PLATFORM}/release', d)}"
+
+# Sub-directory in which to build.
+# This must be coherent with BUILD_PLAT make parameter so that deploy can find
+# the produced binaries
+TFA_BUILD_DIR ?= "build-${TFA_PLATFORM}"
+# set BUILD_PLAT depending on configured BUILD_DIR
+EXTRA_OEMAKE += "BUILD_PLAT=${TFA_BUILD_DIR}"
 
 # mbed TLS support (set TFA_MBEDTLS to 1 to activate)
 TFA_MBEDTLS ?= "0"
+# sub-directory in which mbedtls will be downloaded
 TFA_MBEDTLS_DIR ?= "mbedtls"
+# This should be set to MBEDTLS download URL if MBEDTLS is needed
+SRC_URI_MBEDTLS ??= ""
+# This should be set to MBEDTLS LIC FILES checksum
+LIC_FILES_CHKSUM_MBEDTLS ??= ""
+# add MBEDTLS to our sources if activated
+SRC_URI += "${@bb.utils.contains('TFA_MBEDTLS', '1', '${SRC_URI_MBEDTLS}', '', d)}"
+# add mbed TLS chksum
+LIC_FILES_CHKSUM += "${@bb.utils.contains('TFA_MBEDTLS', '1', '${LIC_FILES_CHKSUM_MBEDTLS}', '', d)}"
+# add mbed TLS to version
+SRCREV_FORMAT_append = "${@bb.utils.contains('TFA_MBEDTLS', '1', '_mbedtls', '', d)}"
 
 # U-boot support (set TFA_UBOOT to 1 to activate)
 # When U-Boot support is activated BL33 is activated with u-boot.bin file
@@ -52,18 +69,18 @@ do_install[noexec] = "1"
 DEPENDS_append = " dtc-native openssl-native"
 
 # Add platform parameter
-EXTRA_OEMAKE_append = " PLAT=${TFA_PLATFORM}"
+EXTRA_OEMAKE += "PLAT=${TFA_PLATFORM}"
 
 # Handle TFA_DEBUG parameter
-EXTRA_OEMAKE_append = " ${@bb.utils.contains('TFA_DEBUG', '1', ' DEBUG=${TFA_DEBUG}', '', d)}"
+EXTRA_OEMAKE += "${@bb.utils.contains('TFA_DEBUG', '1', ' DEBUG=${TFA_DEBUG}', '', d)}"
 
 # Handle MBEDTLS
-EXTRA_OEMAKE_append = " ${@bb.utils.contains('TFA_MBEDTLS', '1', ' MBEDTLS_DIR=${TFA_MBEDTLS_DIR}', '', d)}"
+EXTRA_OEMAKE += "${@bb.utils.contains('TFA_MBEDTLS', '1', ' MBEDTLS_DIR=${TFA_MBEDTLS_DIR}', '', d)}"
 
 # Uboot support
 DEPENDS += " ${@bb.utils.contains('TFA_UBOOT', '1', 'u-boot', '', d)}"
 do_compile[depends] += " ${@bb.utils.contains('TFA_UBOOT', '1', 'u-boot:do_deploy', '', d)}"
-EXTRA_OEMAKE_append = " ${@bb.utils.contains('TFA_UBOOT', '1', ' BL33=${DEPLOY_DIR_IMAGE}/u-boot.bin', '',d)}"
+EXTRA_OEMAKE += "${@bb.utils.contains('TFA_UBOOT', '1', ' BL33=${DEPLOY_DIR_IMAGE}/u-boot.bin', '',d)}"
 
 do_clean() {
     if [ -f ${S}/Makefile ]; then
diff --git a/meta-arm-integration/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.1.bb b/meta-arm-integration/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.1.bb
index 55b17e0d..e8933fb1 100644
--- a/meta-arm-integration/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.1.bb
+++ b/meta-arm-integration/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.1.bb
@@ -1,29 +1,36 @@
 #
 # Trusted firmware-A 2.1
 #
-SRC_URI = " \
-    git://git.trustedfirmware.org/TF-A/trusted-firmware-a.git;protocol=https;name=tfa \
-    git://github.com/ARMmbed/mbedtls.git;name=mbedtls;protocol=https;destsuffix=git/mbedtls \
-    "
+SRC_URI = "git://git.trustedfirmware.org/TF-A/trusted-firmware-a.git;protocol=https;name=tfa"
 
-SRCREV_FORMAT = "tfa_mbedtls"
+# Use TF-A for version
+SRCREV_FORMAT = "tfa"
 
 # TF-A v2.1
 SRCREV_tfa = "e1286bdb968ee74fc52f96cf303a4218e1ae2950"
-# mbed TLS v2.16.2
-SRCREV_mbedtls = "d81c11b8ab61fd5b2da8133aa73c5fe33a0633eb"
-
 
 S = "${WORKDIR}/git"
 
-LIC_FILES_CHKSUM = " \
-    file://license.rst;md5=c709b197e22b81ede21109dbffd5f363 \
+LIC_FILES_CHKSUM = "file://license.rst;md5=c709b197e22b81ede21109dbffd5f363"
+
+SRC_URI[tfa.md5sum] = "75c8f4958fb493d9bd7a8e5a9636ec18"
+SRC_URI[tfa.sha256sum] = "7c4c00a4f28d3cfbb235fd1a1fb28c4d2fc1d657c9301686e7d8824ef575d059"
+
+#
+# mbed TLS source
+# Those are used in trusted-firmware-a.inc if TFA_MBEDTLS is set to 1
+#
+
+SRC_URI_MBEDTLS = "git://github.com/ARMmbed/mbedtls.git;name=mbedtls;protocol=https;destsuffix=git/mbedtls"
+
+# mbed TLS v2.16.2
+SRCREV_mbedtls = "d81c11b8ab61fd5b2da8133aa73c5fe33a0633eb"
+
+LIC_FILES_CHKSUM_MBEDTLS += " \
     file://mbedtls/apache-2.0.txt;md5=3b83ef96387f14655fc854ddc3c6bd57 \
     file://mbedtls/LICENSE;md5=302d50a6369f5f22efdb674db908167a \
     "
 
-SRC_URI[tfa.md5sum] = "75c8f4958fb493d9bd7a8e5a9636ec18"
-SRC_URI[tfa.sha256sum] = "7c4c00a4f28d3cfbb235fd1a1fb28c4d2fc1d657c9301686e7d8824ef575d059"
 SRC_URI[mbedtls.md5sum] = "37cdec398ae9ebdd4640df74af893c95"
 SRC_URI[mbedtls.sha256sum] = "a6834fcd7b7e64b83dfaaa6ee695198cb5019a929b2806cb0162e049f98206a4"