diff --git a/ChangeLog.d/iar-4.1.0.txt b/ChangeLog.d/iar-4.1.0.txt
new file mode 100644
index 00000000000..d4c1417dadf
--- /dev/null
+++ b/ChangeLog.d/iar-4.1.0.txt
@@ -0,0 +1,2 @@
+Bugfix
+   * Fix some IAR warnings. Fixes #10648.
diff --git a/framework b/framework
index c3d65994650..d1a8b5b5969 160000
--- a/framework
+++ b/framework
@@ -1 +1 @@
-Subproject commit c3d659946503c3ef259bc424e1c3fd10d55df543
+Subproject commit d1a8b5b59697068f0cd419765ccd3a30cf885d4d
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index e8a44f834c8..eb5b6687092 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -8983,7 +8983,7 @@ int mbedtls_ssl_export_keying_material(mbedtls_ssl_context *ssl,
 
     int ciphersuite_id = mbedtls_ssl_get_ciphersuite_id_from_ssl(ssl);
     const mbedtls_ssl_ciphersuite_t *ciphersuite = mbedtls_ssl_ciphersuite_from_id(ciphersuite_id);
-    const mbedtls_md_type_t hash_alg = ciphersuite->mac;
+    const mbedtls_md_type_t hash_alg = (mbedtls_md_type_t) ciphersuite->mac;
 
     switch (mbedtls_ssl_get_version_number(ssl)) {
 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
diff --git a/tests/src/test_helpers/ssl_helpers.c b/tests/src/test_helpers/ssl_helpers.c
index 83dac174195..e545f467bd3 100644
--- a/tests/src/test_helpers/ssl_helpers.c
+++ b/tests/src/test_helpers/ssl_helpers.c
@@ -13,6 +13,15 @@
 
 #include <limits.h>
 
+#if defined(__IAR_SYSTEMS_ICC__)
+/* Suppress a very overeager warning from IAR: it dislikes a forward goto
+ * that bypasses the initialization of a variable, even if that variable
+ * is not used after the jump. (This is perfectly valid C; it would only
+ * be invalid C if jumping into a block from outside that block.)
+ */
+#pragma diag_suppress=Pe546 // transfer of control bypasses initialization
+#endif
+
 #if defined(MBEDTLS_SSL_TLS_C)
 int mbedtls_test_random(void *p_rng, unsigned char *output, size_t output_len)
 {
@@ -1358,16 +1367,18 @@ static void mbedtls_test_ssl_cipher_info_from_type(mbedtls_cipher_type_t cipher_
 
 int mbedtls_test_ssl_build_transforms(mbedtls_ssl_transform *t_in,
                                       mbedtls_ssl_transform *t_out,
-                                      int cipher_type, int hash_id,
+                                      int cipher_type_arg, int md_type_arg,
                                       int etm, int tag_mode,
                                       mbedtls_ssl_protocol_version tls_version,
                                       size_t cid0_len,
                                       size_t cid1_len)
 {
+    mbedtls_md_type_t md_type = (mbedtls_md_type_t) md_type_arg;
+    mbedtls_cipher_type_t cipher_type = (mbedtls_cipher_type_t) cipher_type_arg;
+
     mbedtls_cipher_mode_t cipher_mode = MBEDTLS_MODE_NONE;
     size_t key_bits = 0;
     int ret = 0;
-
     psa_key_type_t key_type;
     psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
     psa_algorithm_t alg;
@@ -1390,7 +1401,7 @@ int mbedtls_test_ssl_build_transforms(mbedtls_ssl_transform *t_in,
 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
 
     maclen = 0;
-    mbedtls_test_ssl_cipher_info_from_type((mbedtls_cipher_type_t) cipher_type,
+    mbedtls_test_ssl_cipher_info_from_type(cipher_type,
                                            &cipher_mode, &key_bits, &ivlen);
 
     /* Pick keys */
@@ -1407,7 +1418,7 @@ int mbedtls_test_ssl_build_transforms(mbedtls_ssl_transform *t_in,
 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
     if (cipher_mode == MBEDTLS_MODE_CBC ||
         cipher_mode == MBEDTLS_MODE_STREAM) {
-        maclen = mbedtls_md_get_size_from_type((mbedtls_md_type_t) hash_id);
+        maclen = mbedtls_md_get_size_from_type(md_type);
         CHK(maclen != 0);
         /* Pick hash keys */
         CHK((md0 = mbedtls_calloc(1, maclen)) != NULL);
@@ -1415,7 +1426,7 @@ int mbedtls_test_ssl_build_transforms(mbedtls_ssl_transform *t_in,
         memset(md0, 0x5, maclen);
         memset(md1, 0x6, maclen);
 
-        alg = mbedtls_md_psa_alg_from_type(hash_id);
+        alg = mbedtls_md_psa_alg_from_type(md_type);
 
         CHK(alg != 0);
 
@@ -1457,7 +1468,7 @@ int mbedtls_test_ssl_build_transforms(mbedtls_ssl_transform *t_in,
                            &t_out->psa_mac_dec) == PSA_SUCCESS);
     }
 #else
-    ((void) hash_id);
+    (void) md_type;
 #endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
 
 
diff --git a/tests/suites/test_suite_pkcs7.function b/tests/suites/test_suite_pkcs7.function
index 9eccabab22d..ae7476050c7 100644
--- a/tests/suites/test_suite_pkcs7.function
+++ b/tests/suites/test_suite_pkcs7.function
@@ -6,10 +6,14 @@
 #include "mbedtls/x509_crl.h"
 #include "x509_internal.h"
 #include "mbedtls/oid.h"
-#include "sys/types.h"
-#include "sys/stat.h"
 #include "mbedtls/private/rsa.h"
 #include "mbedtls/error.h"
+
+#if defined(MBEDTLS_FS_IO)
+#include "sys/types.h"
+#include "sys/stat.h"
+#endif
+
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
diff --git a/tf-psa-crypto b/tf-psa-crypto
index ed3c7d281e7..d8d303b3dbc 160000
--- a/tf-psa-crypto
+++ b/tf-psa-crypto
@@ -1 +1 @@
-Subproject commit ed3c7d281e710ef44264d29f3157fd572165a74d
+Subproject commit d8d303b3dbcf32664e460013407493edef6a63a3