diff --git a/changelog.yaml b/changelog.yaml
index 2d6986b..33e5e8c 100644
--- a/changelog.yaml
+++ b/changelog.yaml
@@ -609,6 +609,9 @@
           - plat/xilinx
 
         subsections:
+          - title: DCC (Debug Communication Channel)
+            scope: dcc
+
           - title: Versal
             scope: versal
 
diff --git a/docs/about/maintainers.rst b/docs/about/maintainers.rst
index 6042053..aca5ec0 100644
--- a/docs/about/maintainers.rst
+++ b/docs/about/maintainers.rst
@@ -422,6 +422,15 @@
 :|F|: lib/gpt_rme
 :|F|: include/lib/gpt_rme
 
+Firmware Handoff Library (Transfer List)
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+:|M|: Raymond Mao <raymond.mao@linaro.org>
+:|G|: `raymo200915`_
+:|M|: Harrison Mutai <harrison.mutai@arm.com>
+:|G|: `harrisonmutai-arm`_
+:|F|: lib/transfer_list
+:|F|: include/lib/transfer_list.h
+
 Platform Ports
 ~~~~~~~~~~~~~~
 
@@ -748,8 +757,6 @@
 
 Renesas rcar-gen3 platform port
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-:|M|: Jorge Ramirez-Ortiz  <jramirez@baylibre.com>
-:|G|: `ldts`_
 :|M|: Marek Vasut <marek.vasut@gmail.com>
 :|G|: `marex`_
 :|F|: docs/plat/rcar-gen3.rst
@@ -959,7 +966,6 @@
 .. _jwerner-chromium: https://github.com/jwerner-chromium
 .. _kostapr: https://github.com/kostapr
 .. _lachitp: https://github.com/lachitp
-.. _ldts: https://github.com/ldts
 .. _marex: https://github.com/marex
 .. _masahir0y: https://github.com/masahir0y
 .. _michalsimek: https://github.com/michalsimek
@@ -1028,3 +1034,5 @@
 .. _rutigl: https://github.com/rutigl
 .. _avifishman: https://github.com/avifishman
 .. _xueliang-zhong-arm: https://github.com/xueliang-zhong-arm
+.. _raymo200915: https://github.com/raymo200915
+.. _harrisonmutai-arm: https://github.com/harrisonmutai-arm
diff --git a/docs/getting_started/build-options.rst b/docs/getting_started/build-options.rst
index cf8002d..cd70a22 100644
--- a/docs/getting_started/build-options.rst
+++ b/docs/getting_started/build-options.rst
@@ -692,7 +692,7 @@
    +===========================+====================================+
    |           rsa             | 1024 , 2048 (default), 3072, 4096* |
    +---------------------------+------------------------------------+
-   |          ecdsa            |            unavailable             |
+   |          ecdsa            |         256 (default), 384         |
    +---------------------------+------------------------------------+
    |  ecdsa-brainpool-regular  |            unavailable             |
    +---------------------------+------------------------------------+
diff --git a/drivers/arm/dcc/dcc_console.c b/drivers/arm/dcc/dcc_console.c
index d8f9462..19c3450 100644
--- a/drivers/arm/dcc/dcc_console.c
+++ b/drivers/arm/dcc/dcc_console.c
@@ -137,7 +137,8 @@
 static struct dcc_console dcc_console = {
 	.console = {
 		.flags = CONSOLE_FLAG_BOOT |
-			CONSOLE_FLAG_RUNTIME,
+			CONSOLE_FLAG_RUNTIME |
+			CONSOLE_FLAG_CRASH,
 		.putc = dcc_console_putc,
 #if ENABLE_CONSOLE_GETC
 		.getc = dcc_console_getc,
diff --git a/drivers/auth/mbedtls/mbedtls_common.mk b/drivers/auth/mbedtls/mbedtls_common.mk
index 376b6b7..e380c86 100644
--- a/drivers/auth/mbedtls/mbedtls_common.mk
+++ b/drivers/auth/mbedtls/mbedtls_common.mk
@@ -107,11 +107,21 @@
 
 ifeq (${TF_MBEDTLS_KEY_SIZE},)
     ifneq ($(findstring rsa,${TF_MBEDTLS_KEY_ALG}),)
-	ifeq (${KEY_SIZE},)
+        ifeq (${KEY_SIZE},)
             TF_MBEDTLS_KEY_SIZE		:=	2048
-	else
+        else ifneq ($(filter $(KEY_SIZE), 1024 2048 3072 4096),)
+            TF_MBEDTLS_KEY_SIZE		:=	${KEY_SIZE}
+        else
+            $(error "Invalid value for KEY_SIZE: ${KEY_SIZE}")
+        endif
+    else ifneq ($(findstring ecdsa,${TF_MBEDTLS_KEY_ALG}),)
+        ifeq (${KEY_SIZE},)
+            TF_MBEDTLS_KEY_SIZE		:=	256
+        else ifneq ($(filter $(KEY_SIZE), 256 384),)
             TF_MBEDTLS_KEY_SIZE		:=	${KEY_SIZE}
-	endif
+        else
+            $(error "Invalid value for KEY_SIZE: ${KEY_SIZE}")
+        endif
     endif
 endif
 
diff --git a/include/common/tbbr/cot_def.h b/include/common/tbbr/cot_def.h
index 822c474..1d28772 100644
--- a/include/common/tbbr/cot_def.h
+++ b/include/common/tbbr/cot_def.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2023, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2023, Arm Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -46,7 +46,13 @@
 #error "Invalid value for TF_MBEDTLS_KEY_SIZE"
 #endif
 #else /* Only using ECDSA keys. */
+#if TF_MBEDTLS_KEY_SIZE == 384
+#define PK_DER_LEN                      120
+#elif TF_MBEDTLS_KEY_SIZE == 256
 #define PK_DER_LEN                      92
+#else
+#error "Invalid value for TF_MBEDTLS_KEY_SIZE"
+#endif
 #endif
 
 #if TF_MBEDTLS_HASH_ALG_ID == TF_MBEDTLS_SHA256
diff --git a/include/drivers/auth/mbedtls/mbedtls_config-3.h b/include/drivers/auth/mbedtls/mbedtls_config-3.h
index ba936a3..923fc54 100644
--- a/include/drivers/auth/mbedtls/mbedtls_config-3.h
+++ b/include/drivers/auth/mbedtls/mbedtls_config-3.h
@@ -62,8 +62,12 @@
 #if TF_MBEDTLS_USE_ECDSA
 #define MBEDTLS_ECDSA_C
 #define MBEDTLS_ECP_C
+#if TF_MBEDTLS_KEY_SIZE == 384
+#define MBEDTLS_ECP_DP_SECP384R1_ENABLED
+#else
 #define MBEDTLS_ECP_DP_SECP256R1_ENABLED
 #endif
+#endif
 #if TF_MBEDTLS_USE_RSA
 #define MBEDTLS_RSA_C
 #define MBEDTLS_X509_RSASSA_PSS_SUPPORT
diff --git a/include/plat/arm/common/arm_def.h b/include/plat/arm/common/arm_def.h
index 0ab0e82..314eb93 100644
--- a/include/plat/arm/common/arm_def.h
+++ b/include/plat/arm/common/arm_def.h
@@ -24,8 +24,6 @@
  */
 #define ARM_ROTPK_HEADER_LEN		19
 #define ARM_ROTPK_HASH_LEN		32
-/* ARM_ROTPK_KEY_LEN includes DER header + raw key material */
-#define ARM_ROTPK_KEY_LEN		294
 
 /* Special value used to verify platform parameters from BL2 to BL31 */
 #define ARM_BL31_PLAT_PARAM_VAL		ULL(0x0f1e2d3c4b5a6978)
diff --git a/include/plat/arm/common/arm_sip_svc.h b/include/plat/arm/common/arm_sip_svc.h
index 025d10e..266092e 100644
--- a/include/plat/arm/common/arm_sip_svc.h
+++ b/include/plat/arm/common/arm_sip_svc.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016-2019,2021-2022, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2016-2019,2021-2023, Arm Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -35,4 +35,21 @@
 #define ARM_SIP_SVC_VERSION_MAJOR		U(0x0)
 #define ARM_SIP_SVC_VERSION_MINOR		U(0x2)
 
+/*
+ * Arm SiP SMC calls that are primarily used for testing purposes.
+ */
+#if PLAT_TEST_SPM
+#define ARM_SIP_SET_INTERRUPT_PENDING	U(0x82000100)
+#endif
+
+/* SiP handler specific to each Arm platform. */
+uintptr_t plat_arm_sip_handler(uint32_t smc_fid,
+				u_register_t x1,
+				u_register_t x2,
+				u_register_t x3,
+				u_register_t x4,
+				void *cookie,
+				void *handle,
+				u_register_t flags);
+
 #endif /* ARM_SIP_SVC_H */
diff --git a/include/plat/arm/common/plat_arm.h b/include/plat/arm/common/plat_arm.h
index f71480f..0fb06a6 100644
--- a/include/plat/arm/common/plat_arm.h
+++ b/include/plat/arm/common/plat_arm.h
@@ -176,10 +176,17 @@
 #define STATE_SW_E_DENIED		(-3)
 
 /* plat_get_rotpk_info() flags */
-#define ARM_ROTPK_REGS_ID		1
-#define ARM_ROTPK_DEVEL_RSA_ID		2
-#define ARM_ROTPK_DEVEL_ECDSA_ID	3
+#define ARM_ROTPK_REGS_ID			1
+#define ARM_ROTPK_DEVEL_RSA_ID			2
+#define ARM_ROTPK_DEVEL_ECDSA_ID		3
 #define ARM_ROTPK_DEVEL_FULL_DEV_RSA_KEY_ID	4
+#define ARM_ROTPK_DEVEL_FULL_DEV_ECDSA_KEY_ID	5
+
+#define ARM_USE_DEVEL_ROTPK							\
+	(ARM_ROTPK_LOCATION_ID == ARM_ROTPK_DEVEL_RSA_ID) ||			\
+	(ARM_ROTPK_LOCATION_ID == ARM_ROTPK_DEVEL_ECDSA_ID) ||			\
+	(ARM_ROTPK_LOCATION_ID == ARM_ROTPK_DEVEL_FULL_DEV_RSA_KEY_ID) ||	\
+	(ARM_ROTPK_LOCATION_ID == ARM_ROTPK_DEVEL_FULL_DEV_ECDSA_KEY_ID)
 
 /* IO storage utility functions */
 int arm_io_setup(void);
diff --git a/make_helpers/build_macros.mk b/make_helpers/build_macros.mk
index a5c93a6..71cf18b 100644
--- a/make_helpers/build_macros.mk
+++ b/make_helpers/build_macros.mk
@@ -558,7 +558,7 @@
 $(ELF): $(OBJS) $(DEFAULT_LINKER_SCRIPT) $(LINKER_SCRIPTS) | $(1)_dirs libraries $(BL_LIBS)
 	$$(ECHO) "  LD      $$@"
 ifdef MAKE_BUILD_STRINGS
-	$(call MAKE_BUILD_STRINGS, $(BUILD_DIR)/build_message.o)
+	$(call MAKE_BUILD_STRINGS,$(BUILD_DIR)/build_message.o)
 else
 	@echo 'const char build_message[] = "Built : "$(BUILD_MESSAGE_TIMESTAMP); \
 	       const char version_string[] = "${VERSION_STRING}"; \
diff --git a/make_helpers/windows.mk b/make_helpers/windows.mk
index b6d6f0b..ac0f940 100644
--- a/make_helpers/windows.mk
+++ b/make_helpers/windows.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2016-2022, Arm Limited and Contributors. All rights reserved.
+# Copyright (c) 2016-2023, Arm Limited and Contributors. All rights reserved.
 #
 # SPDX-License-Identifier: BSD-3-Clause
 #
@@ -83,8 +83,9 @@
 VERSION_STRING_MESSAGE = const char version_string[] = "${VERSION_STRING}";
 VERSION_MESSAGE = const char version[] = "${VERSION}";
 define MAKE_BUILD_STRINGS
+	$$(file >$1.in,$$(TF_CFLAGS) $$(CFLAGS))
 	@echo $$(BUILT_TIME_DATE_STRING) $$(VERSION_STRING_MESSAGE) $$(VERSION_MESSAGE) | \
-		$$(CC) $$(TF_CFLAGS) $$(CFLAGS) -x c -c - -o $1
+		$$(CC) @$1.in -x c -c - -o $1
 endef
 
 MSVC_NMAKE := nmake.exe
diff --git a/plat/arm/board/common/board_arm_trusted_boot.c b/plat/arm/board/common/board_arm_trusted_boot.c
index 24d88ee..c4f15dd 100644
--- a/plat/arm/board/common/board_arm_trusted_boot.c
+++ b/plat/arm/board/common/board_arm_trusted_boot.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2022, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2023, Arm Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -94,20 +94,25 @@
 #endif
 
 #if (ARM_ROTPK_LOCATION_ID == ARM_ROTPK_DEVEL_RSA_ID) || \
-    (ARM_ROTPK_LOCATION_ID == ARM_ROTPK_DEVEL_ECDSA_ID) || \
-    (ARM_ROTPK_LOCATION_ID == ARM_ROTPK_DEVEL_FULL_DEV_RSA_KEY_ID)
+    (ARM_ROTPK_LOCATION_ID == ARM_ROTPK_DEVEL_ECDSA_ID)
 int arm_get_rotpk_info_dev(void **key_ptr, unsigned int *key_len,
 			unsigned int *flags)
 {
-	if (ARM_ROTPK_LOCATION_ID == ARM_ROTPK_DEVEL_FULL_DEV_RSA_KEY_ID) {
-		*key_ptr = arm_rotpk_key;
-		*key_len = arm_rotpk_key_end - arm_rotpk_key;
-		*flags = 0;
-	} else {
-		*key_ptr = arm_rotpk_header;
-		*key_len = arm_rotpk_hash_end - arm_rotpk_header;
-		*flags = ROTPK_IS_HASH;
-	}
+	*key_ptr = arm_rotpk_header;
+	*key_len = arm_rotpk_hash_end - arm_rotpk_header;
+	*flags = ROTPK_IS_HASH;
+	return 0;
+}
+#endif
+
+#if (ARM_ROTPK_LOCATION_ID == ARM_ROTPK_DEVEL_FULL_DEV_RSA_KEY_ID) || \
+    (ARM_ROTPK_LOCATION_ID == ARM_ROTPK_DEVEL_FULL_DEV_ECDSA_KEY_ID)
+int arm_get_rotpk_info_dev(void **key_ptr, unsigned int *key_len,
+			unsigned int *flags)
+{
+	*key_ptr = arm_rotpk_key;
+	*key_len = arm_rotpk_key_end - arm_rotpk_key;
+	*flags = 0;
 	return 0;
 }
 #endif
@@ -144,9 +149,7 @@
 	return arm_get_rotpk_info_cc(key_ptr, key_len, flags);
 #else
 
-#if (ARM_ROTPK_LOCATION_ID == ARM_ROTPK_DEVEL_RSA_ID) || \
-    (ARM_ROTPK_LOCATION_ID == ARM_ROTPK_DEVEL_ECDSA_ID) || \
-    (ARM_ROTPK_LOCATION_ID == ARM_ROTPK_DEVEL_FULL_DEV_RSA_KEY_ID)
+#if ARM_USE_DEVEL_ROTPK
 	return arm_get_rotpk_info_dev(key_ptr, key_len, flags);
 #elif (ARM_ROTPK_LOCATION_ID == ARM_ROTPK_REGS_ID)
 	return arm_get_rotpk_info_regs(key_ptr, key_len, flags);
diff --git a/plat/arm/board/common/board_common.mk b/plat/arm/board/common/board_common.mk
index 4665827..cbdbf70 100644
--- a/plat/arm/board/common/board_common.mk
+++ b/plat/arm/board/common/board_common.mk
@@ -39,6 +39,16 @@
 	ARM_ROTPK_S = plat/arm/board/common/rotpk/arm_full_dev_rsa_rotpk.S
 $(warning Development keys support for FVP is deprecated. Use `regs` \
 option instead)
+else ifeq (${ARM_ROTPK_LOCATION}, devel_full_dev_ecdsa_key)
+	CRYPTO_ALG=ec
+	ARM_ROTPK_LOCATION_ID = ARM_ROTPK_DEVEL_FULL_DEV_ECDSA_KEY_ID
+ifeq (${KEY_SIZE},384)
+	ARM_ROTPK_S = plat/arm/board/common/rotpk/arm_full_dev_ecdsa_p384_rotpk.S
+else
+	ARM_ROTPK_S = plat/arm/board/common/rotpk/arm_full_dev_ecdsa_p256_rotpk.S
+endif
+$(warning Development keys support for FVP is deprecated. Use `regs` \
+option instead)
 else
 $(error "Unsupported ARM_ROTPK_LOCATION value")
 endif
diff --git a/plat/arm/board/common/rotpk/arm_full_dev_ecdsa_p256_rotpk.S b/plat/arm/board/common/rotpk/arm_full_dev_ecdsa_p256_rotpk.S
new file mode 100644
index 0000000..690bdbc
--- /dev/null
+++ b/plat/arm/board/common/rotpk/arm_full_dev_ecdsa_p256_rotpk.S
@@ -0,0 +1,23 @@
+/*
+ * Copyright (c) 2023, Arm Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+	.global arm_rotpk_key
+	.global arm_rotpk_key_end
+
+	.section .rodata.arm_rotpk_key, "a"
+
+/* Derived from arm_rotprivk_ecdsa.pem private key file. */
+arm_rotpk_key:
+	.byte 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2A, 0x86, 0x48, 0xCE, 0x3D
+	.byte 0x02, 0x01, 0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01
+	.byte 0x07, 0x03, 0x42, 0x00, 0x04, 0x9B, 0xE6, 0x48, 0xBD, 0x34, 0x38
+	.byte 0xE1, 0xA2, 0xA4, 0xF3, 0x70, 0xE1, 0x54, 0xBB, 0x2F, 0xB0, 0x5A
+	.byte 0x4A, 0x0C, 0xFF, 0xC2, 0x87, 0xDB, 0xC0, 0xFB, 0x81, 0xE9, 0xF9
+	.byte 0xF9, 0x95, 0x7D, 0x7E, 0xA0, 0x0C, 0x7F, 0x0A, 0xD4, 0xE0, 0x62
+	.byte 0x4A, 0x94, 0x5F, 0xEC, 0x52, 0x7D, 0x44, 0x63, 0xC8, 0x9F, 0x61
+	.byte 0xFA, 0xC6, 0xCB, 0x7E, 0x6B, 0x53, 0xAD, 0x2C, 0xC5, 0x94, 0x0D
+	.byte 0x1A, 0x86, 0x91
+arm_rotpk_key_end:
diff --git a/plat/arm/board/common/rotpk/arm_full_dev_ecdsa_p384_rotpk.S b/plat/arm/board/common/rotpk/arm_full_dev_ecdsa_p384_rotpk.S
new file mode 100644
index 0000000..eaf2de4
--- /dev/null
+++ b/plat/arm/board/common/rotpk/arm_full_dev_ecdsa_p384_rotpk.S
@@ -0,0 +1,25 @@
+/*
+ * Copyright (c) 2023, Arm Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+	.global arm_rotpk_key
+	.global arm_rotpk_key_end
+
+	.section .rodata.arm_rotpk_key, "a"
+
+/* Derived from arm_rotprivk_ecdsa_secp384r1.pem private key file. */
+arm_rotpk_key:
+	.byte 0x30, 0x76, 0x30, 0x10, 0x06, 0x07, 0x2A, 0x86, 0x48, 0xCE, 0x3D
+	.byte 0x02, 0x01, 0x06, 0x05, 0x2B, 0x81, 0x04, 0x00, 0x22, 0x03, 0x62
+	.byte 0x00, 0x04, 0xB8, 0xB0, 0xC7, 0xC4, 0x57, 0x19, 0xB7, 0x5A, 0x06
+	.byte 0x36, 0xC5, 0xD8, 0x3C, 0x4E, 0xC3, 0xB5, 0xE1, 0x15, 0x60, 0x0E
+	.byte 0x63, 0xD8, 0xAF, 0x22, 0x2C, 0x6D, 0x79, 0x29, 0xDF, 0x46, 0xA9
+	.byte 0x30, 0x12, 0x16, 0x2D, 0x4F, 0x0F, 0x96, 0x6B, 0x1F, 0x87, 0x06
+	.byte 0xDB, 0x8F, 0xD7, 0x08, 0x46, 0xE4, 0x4C, 0x22, 0xF3, 0xDE, 0xCE
+	.byte 0x0F, 0x72, 0x27, 0x00, 0xAA, 0xD8, 0xC3, 0x79, 0x80, 0x5E, 0xF1
+	.byte 0x35, 0x1B, 0x33, 0xB6, 0x31, 0xC4, 0x59, 0xD4, 0xE9, 0x65, 0x91
+	.byte 0x22, 0x58, 0x2F, 0x87, 0xF1, 0x6C, 0x27, 0xBE, 0x99, 0x6F, 0x5F
+	.byte 0x6C, 0x14, 0xC5, 0x37, 0x0C, 0x73, 0xB4, 0xE4, 0x8A, 0x63
+arm_rotpk_key_end:
diff --git a/plat/arm/board/common/rotpk/arm_full_dev_rsa_rotpk.S b/plat/arm/board/common/rotpk/arm_full_dev_rsa_rotpk.S
index 4bb04dc..4532e53 100644
--- a/plat/arm/board/common/rotpk/arm_full_dev_rsa_rotpk.S
+++ b/plat/arm/board/common/rotpk/arm_full_dev_rsa_rotpk.S
@@ -1,32 +1,40 @@
 /*
- * Copyright (c) 2022, Arm Limited. All rights reserved.
+ * Copyright (c) 2022-2023, Arm Limited. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
 
-/* corstone1000 platform provides custom values for the macros defined in
- * arm_def.h , so only platform_def.h needs to be included
- */
-#if !defined(TARGET_PLATFORM_FVP) && !defined(TARGET_PLATFORM_FPGA)
-#include "plat/arm/common/arm_def.h"
-#else
-#include <platform_def.h>
-#endif
-
 	.global arm_rotpk_key
 	.global arm_rotpk_key_end
 
 	.section .rodata.arm_rotpk_key, "a"
 
 arm_rotpk_key:
-	.byte 0x30, 0x82, 0x01, 0x22, 0x30, 0x0D, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x01
-	.byte 0x05, 0x00, 0x03, 0x82, 0x01, 0x0F, 0x00, 0x30, 0x82, 0x01, 0x0A, 0x02, 0x82, 0x01, 0x01
-	.byte 0x00, 0xCB, 0x2C, 0x60, 0xD5, 0x8D, 0x63, 0xD4, 0x07, 0x79, 0x7E, 0xC7, 0x16, 0x96, 0xBD, 0x4D, 0x24, 0x4E, 0xAC, 0x86, 0xE6, 0xB7, 0x71, 0xE3, 0xC5, 0x54, 0x0B, 0xE7, 0x14, 0x1C, 0xBD, 0x29, 0x1A, 0xC1, 0x3F, 0x7A, 0xB6, 0x02, 0xAA, 0xAB, 0x36, 0xC4, 0xD9, 0x36, 0x69, 0x6C, 0xE2, 0x65, 0xC3, 0x9B, 0xB1, 0xBF, 0x3D, 0xA8, 0x56, 0x26, 0xCB, 0xFD, 0x04, 0x01, 0xBA, 0xAC, 0x3E, 0x54, 0x32, 0xCA, 0x79, 0x5E, 0xBB, 0xB2, 0x05, 0xEA, 0x06, 0x58, 0xF2, 0x74, 0xBA, 0xE1, 0xF4, 0x87, 0xC0, 0x19, 0x0A, 0x1F, 0x66, 0x07, 0x77, 0x84, 0x83, 0xA1, 0x1C, 0xEF, 0xFF, 0x28, 0x59, 0xE7, 0xC3, 0x68, 0x7D, 0x26, 0x20, 0x43, 0xEB, 0x56, 0x63, 0xF3, 0x39, 0x31, 0xD8, 0x2B, 0x51, 0xA9, 0xBC, 0x4F, 0xD0, 0xF6, 0xDE, 0x95, 0xDC, 0x5F, 0x5B, 0xC1, 0xED, 0x90, 0x6F, 0xEC, 0x28, 0x91, 0x7E, 0x17, 0xED, 0x78, 0x90, 0xF4, 0x60, 0xA7, 0xC4, 0xC7, 0x4F, 0x50, 0xED, 0x5D, 0x13, 0x3A, 0x21, 0x2B, 0x70, 0xC5, 0x61, 0x7B, 0x08, 0x21, 0x65, 0x3A, 0xCD, 0x82, 0x56, 0x8C, 0x7A, 0x47, 0xAC, 0x89, 0xE8, 0xA5, 0x48, 0x48
-	.byte 0x31, 0xD9, 0x1D, 0x46, 0xE5, 0x85, 0x86, 0x98, 0xA0, 0xE5, 0xC0, 0xA6, 0x6A, 0xBD, 0x07, 0xE4, 0x92, 0x57, 0x61, 0x07, 0x8F, 0x7D, 0x5A, 0x4D, 0xCA, 0xAE, 0x36, 0xB9, 0x56, 0x04, 0x10, 0xF2, 0x6C, 0xBE, 0xF6, 0x3B, 0x6C, 0x80, 0x3E, 0xBE , 0x0E, 0xA3, 0x4D , 0xC7 , 0xD4, 0x7E , 0xA7  , 0x49, 0xD4, 0xF2, 0xD2, 0xBC, 0xCF, 0x30, 0xA8, 0xE7, 0x74, 0x8F, 0x64, 0xDF, 0xBC, 0x5C, 0x47, 0x68, 0xCC, 0x40, 0x4C, 0xF8, 0x83, 0xCC, 0xCB, 0x40, 0x35, 0x04, 0x60, 0xCA, 0xB3, 0xA4, 0x17, 0x9F, 0x03, 0xCA, 0x1D, 0x5A, 0xFA, 0xD1, 0xAF, 0x21, 0x57, 0x10, 0xD3, 0x02, 0x03, 0x01, 0x00, 0x01
-
+	.byte 0x30, 0x82, 0x01, 0x22, 0x30, 0x0D, 0x06, 0x09, 0x2A, 0x86, 0x48
+	.byte 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01
+	.byte 0x0F, 0x00, 0x30, 0x82, 0x01, 0x0A, 0x02, 0x82, 0x01, 0x01, 0x00
+	.byte 0xCB, 0x2C, 0x60, 0xD5, 0x8D, 0x63, 0xD4, 0x07, 0x79, 0x7E, 0xC7
+	.byte 0x16, 0x96, 0xBD, 0x4D, 0x24, 0x4E, 0xAC, 0x86, 0xE6, 0xB7, 0x71
+	.byte 0xE3, 0xC5, 0x54, 0x0B, 0xE7, 0x14, 0x1C, 0xBD, 0x29, 0x1A, 0xC1
+	.byte 0x3F, 0x7A, 0xB6, 0x02, 0xAA, 0xAB, 0x36, 0xC4, 0xD9, 0x36, 0x69
+	.byte 0x6C, 0xE2, 0x65, 0xC3, 0x9B, 0xB1, 0xBF, 0x3D, 0xA8, 0x56, 0x26
+	.byte 0xCB, 0xFD, 0x04, 0x01, 0xBA, 0xAC, 0x3E, 0x54, 0x32, 0xCA, 0x79
+	.byte 0x5E, 0xBB, 0xB2, 0x05, 0xEA, 0x06, 0x58, 0xF2, 0x74, 0xBA, 0xE1
+	.byte 0xF4, 0x87, 0xC0, 0x19, 0x0A, 0x1F, 0x66, 0x07, 0x77, 0x84, 0x83
+	.byte 0xA1, 0x1C, 0xEF, 0xFF, 0x28, 0x59, 0xE7, 0xC3, 0x68, 0x7D, 0x26
+	.byte 0x20, 0x43, 0xEB, 0x56, 0x63, 0xF3, 0x39, 0x31, 0xD8, 0x2B, 0x51
+	.byte 0xA9, 0xBC, 0x4F, 0xD0, 0xF6, 0xDE, 0x95, 0xDC, 0x5F, 0x5B, 0xC1
+	.byte 0xED, 0x90, 0x6F, 0xEC, 0x28, 0x91, 0x7E, 0x17, 0xED, 0x78, 0x90
+	.byte 0xF4, 0x60, 0xA7, 0xC4, 0xC7, 0x4F, 0x50, 0xED, 0x5D, 0x13, 0x3A
+	.byte 0x21, 0x2B, 0x70, 0xC5, 0x61, 0x7B, 0x08, 0x21, 0x65, 0x3A, 0xCD
+	.byte 0x82, 0x56, 0x8C, 0x7A, 0x47, 0xAC, 0x89, 0xE8, 0xA5, 0x48, 0x48
+	.byte 0x31, 0xD9, 0x1D, 0x46, 0xE5, 0x85, 0x86, 0x98, 0xA0, 0xE5, 0xC0
+	.byte 0xA6, 0x6A, 0xBD, 0x07, 0xE4, 0x92, 0x57, 0x61, 0x07, 0x8F, 0x7D
+	.byte 0x5A, 0x4D, 0xCA, 0xAE, 0x36, 0xB9, 0x56, 0x04, 0x10, 0xF2, 0x6C
+	.byte 0xBE, 0xF6, 0x3B, 0x6C, 0x80, 0x3E, 0xBE, 0x0E, 0xA3, 0x4D, 0xC7
+	.byte 0xD4, 0x7E, 0xA7, 0x49, 0xD4, 0xF2, 0xD2, 0xBC, 0xCF, 0x30, 0xA8
+	.byte 0xE7, 0x74, 0x8F, 0x64, 0xDF, 0xBC, 0x5C, 0x47, 0x68, 0xCC, 0x40
+	.byte 0x4C, 0xF8, 0x83, 0xCC, 0xCB, 0x40, 0x35, 0x04, 0x60, 0xCA, 0xB3
+	.byte 0xA4, 0x17, 0x9F, 0x03, 0xCA, 0x1D, 0x5A, 0xFA, 0xD1, 0xAF, 0x21
+	.byte 0x57, 0x10, 0xD3, 0x02, 0x03, 0x01, 0x00, 0x01
 arm_rotpk_key_end:
-
-.if ARM_ROTPK_KEY_LEN != arm_rotpk_key_end - arm_rotpk_key
-.error "Invalid ROTPK length."
-.endif
-
diff --git a/plat/arm/board/common/rotpk/arm_rotprivk_ecdsa_secp384r1.pem b/plat/arm/board/common/rotpk/arm_rotprivk_ecdsa_secp384r1.pem
new file mode 100644
index 0000000..d40fc05
--- /dev/null
+++ b/plat/arm/board/common/rotpk/arm_rotprivk_ecdsa_secp384r1.pem
@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDAWrGXulAoVCrH3oRMC
+/AGvn2LA6+VI0xtd9eCWCzIcOSt+AC+/kULZnypuC8bdGJOhZANiAAS4sMfEVxm3
+WgY2xdg8TsO14RVgDmPYryIsbXkp30apMBIWLU8Plmsfhwbbj9cIRuRMIvPezg9y
+JwCq2MN5gF7xNRsztjHEWdTpZZEiWC+H8WwnvplvX2wUxTcMc7TkimM=
+-----END PRIVATE KEY-----
diff --git a/plat/arm/board/fvp/fdts/fvp_spmc_manifest.dts b/plat/arm/board/fvp/fdts/fvp_spmc_manifest.dts
index 4f97339..e159248 100644
--- a/plat/arm/board/fvp/fdts/fvp_spmc_manifest.dts
+++ b/plat/arm/board/fvp/fdts/fvp_spmc_manifest.dts
@@ -35,6 +35,11 @@
 			load_address = <0x7000000>;
 			vcpu_count = <8>;
 			mem_size = <1048576>;
+			/*
+			 * Platform specific SiP SMC call handled at EL3. Used
+			 * to pend an interrupt for testing purpose.
+			 */
+			smc_whitelist = <0x82000100>;
 		};
 		vm2 {
 			is_ffa_partition;
diff --git a/plat/arm/board/fvp/platform.mk b/plat/arm/board/fvp/platform.mk
index 3c02485..72f94b0 100644
--- a/plat/arm/board/fvp/platform.mk
+++ b/plat/arm/board/fvp/platform.mk
@@ -28,6 +28,9 @@
 # the FVP platform. This option defaults to 256.
 FVP_TRUSTED_SRAM_SIZE	:= 256
 
+# Macro to enable helpers for running SPM tests. Disabled by default.
+PLAT_TEST_SPM	:= 0
+
 # This is a very trickly TEMPORARY fix. Enabling ALL features exceeds BL31's
 # progbits limit. We need a way to build all useful configurations while waiting
 # on the fvp to increase its SRAM size. The problem is twofild:
@@ -535,3 +538,6 @@
 ifeq (${ERRATA_ABI_SUPPORT}, 1)
 include plat/arm/board/fvp/fvp_cpu_errata.mk
 endif
+
+# Build macro necessary for running SPM tests on FVP platform
+$(eval $(call add_define,PLAT_TEST_SPM))
diff --git a/plat/arm/common/arm_common.mk b/plat/arm/common/arm_common.mk
index 41d1b66..421c8e9 100644
--- a/plat/arm/common/arm_common.mk
+++ b/plat/arm/common/arm_common.mk
@@ -331,9 +331,11 @@
 ifeq (${ARCH}, aarch64)
 BL31_SOURCES		+=	plat/arm/common/aarch64/execution_state_switch.c\
 				plat/arm/common/arm_sip_svc.c			\
+				plat/arm/common/plat_arm_sip_svc.c		\
 				${ARM_SVC_HANDLER_SRCS}
 else
 BL32_SOURCES		+=	plat/arm/common/arm_sip_svc.c			\
+				plat/arm/common/plat_arm_sip_svc.c		\
 				${ARM_SVC_HANDLER_SRCS}
 endif
 endif
diff --git a/plat/arm/common/arm_sip_svc.c b/plat/arm/common/arm_sip_svc.c
index 352d477..09226f4 100644
--- a/plat/arm/common/arm_sip_svc.c
+++ b/plat/arm/common/arm_sip_svc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016-2023, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2016-2023, Arm Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -13,9 +13,6 @@
 #include <lib/pmf/pmf.h>
 #include <plat/arm/common/arm_sip_svc.h>
 #include <plat/arm/common/plat_arm.h>
-#if ENABLE_SPMD_LP
-#include <services/el3_spmd_logical_sp.h>
-#endif
 #include <tools_share/uuid.h>
 
 /* ARM SiP Service UUID */
@@ -136,15 +133,16 @@
 		SMC_RET2(handle, ARM_SIP_SVC_VERSION_MAJOR, ARM_SIP_SVC_VERSION_MINOR);
 
 	default:
-#if ENABLE_SPMD_LP
-		return plat_spmd_logical_sp_smc_handler(smc_fid, x1, x2, x3, x4,
-				cookie, handle, flags);
-#else
-		WARN("Unimplemented ARM SiP Service Call: 0x%x \n", smc_fid);
-		SMC_RET1(handle, SMC_UNK);
-#endif
+		break;
 	}
 
+	/*
+	 * Fall back to allow Arm platform specific handler.
+	 * TODO: Refactor needed to move out generic handlers from this file and
+	 * only keep Arm Platform specific handlers here.
+	 */
+	return plat_arm_sip_handler(smc_fid, x1, x2, x3, x4,
+					cookie, handle, flags);
 }
 
 
diff --git a/plat/arm/common/plat_arm_sip_svc.c b/plat/arm/common/plat_arm_sip_svc.c
new file mode 100644
index 0000000..b1dab16
--- /dev/null
+++ b/plat/arm/common/plat_arm_sip_svc.c
@@ -0,0 +1,57 @@
+/*
+ * Copyright (c) 2023, Arm Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <stdint.h>
+
+#include <common/debug.h>
+#include <common/runtime_svc.h>
+
+#include <plat/arm/common/arm_sip_svc.h>
+#include <plat/common/platform.h>
+
+#if ENABLE_SPMD_LP
+#include <services/el3_spmd_logical_sp.h>
+#endif
+
+uintptr_t plat_arm_sip_handler(uint32_t smc_fid,
+				u_register_t x1,
+				u_register_t x2,
+				u_register_t x3,
+				u_register_t x4,
+				void *cookie,
+				void *handle,
+				u_register_t flags)
+{
+#if PLAT_TEST_SPM
+	bool secure_origin;
+
+	/* Determine which security state this SMC originated from */
+	secure_origin = is_caller_secure(flags);
+
+	switch (smc_fid) {
+	case ARM_SIP_SET_INTERRUPT_PENDING:
+		if (!secure_origin) {
+			SMC_RET1(handle, SMC_UNK);
+		}
+
+		VERBOSE("SiP Call- Set interrupt pending %d\n", (uint32_t)x1);
+		plat_ic_set_interrupt_pending(x1);
+
+		SMC_RET1(handle, SMC_OK);
+		break; /* Not reached */
+	default:
+		break;
+	}
+#endif
+
+#if ENABLE_SPMD_LP
+	return plat_spmd_logical_sp_smc_handler(smc_fid, x1, x2, x3, x4,
+				cookie, handle, flags);
+#else
+	WARN("Unimplemented ARM SiP Service Call: 0x%x\n", smc_fid);
+	SMC_RET1(handle, SMC_UNK);
+#endif
+}
diff --git a/plat/mediatek/drivers/emi_mpu/mt8188/emi_mpu.c b/plat/mediatek/drivers/emi_mpu/mt8188/emi_mpu.c
index ae1b7ef..e8882f0 100644
--- a/plat/mediatek/drivers/emi_mpu/mt8188/emi_mpu.c
+++ b/plat/mediatek/drivers/emi_mpu/mt8188/emi_mpu.c
@@ -12,8 +12,51 @@
 
 void set_emi_mpu_regions(void)
 {
-	/* TODO: set emi mpu region */
-	INFO("%s, emi mpu is not setting currently\n", __func__);
+	struct emi_region_info_t region_info;
+
+	/* SCP core0 DRAM */
+	region_info.start = 0x50000000ULL;
+	region_info.end = 0x528FFFFFULL;
+	region_info.region = 2;
+	SET_ACCESS_PERMISSION(region_info.apc, 1,
+			      FORBIDDEN, FORBIDDEN, FORBIDDEN, FORBIDDEN,
+			      FORBIDDEN, FORBIDDEN, FORBIDDEN, NO_PROTECTION,
+			      FORBIDDEN, FORBIDDEN, FORBIDDEN, FORBIDDEN,
+			      FORBIDDEN, FORBIDDEN, FORBIDDEN, NO_PROTECTION);
+	emi_mpu_set_protection(&region_info);
+
+	/* SCP core1 DRAM */
+	region_info.start = 0x70000000ULL;
+	region_info.end = 0x729FFFFFULL;
+	region_info.region = 3;
+	SET_ACCESS_PERMISSION(region_info.apc, 1,
+			      FORBIDDEN, FORBIDDEN, FORBIDDEN, FORBIDDEN,
+			      FORBIDDEN, FORBIDDEN, FORBIDDEN, NO_PROTECTION,
+			      FORBIDDEN, FORBIDDEN, FORBIDDEN, FORBIDDEN,
+			      FORBIDDEN, FORBIDDEN, FORBIDDEN, NO_PROTECTION);
+	emi_mpu_set_protection(&region_info);
+
+	/* DSP protect address */
+	region_info.start = 0x60000000ULL;
+	region_info.end = 0x610FFFFFULL;
+	region_info.region = 4;
+	SET_ACCESS_PERMISSION(region_info.apc, 1,
+			      FORBIDDEN, FORBIDDEN, FORBIDDEN, FORBIDDEN,
+			      FORBIDDEN, FORBIDDEN, FORBIDDEN, FORBIDDEN,
+			      FORBIDDEN, FORBIDDEN, FORBIDDEN, NO_PROTECTION,
+			      FORBIDDEN, FORBIDDEN, FORBIDDEN, NO_PROTECTION);
+	emi_mpu_set_protection(&region_info);
+
+	/* All default settings */
+	region_info.start = 0x40000000ULL;
+	region_info.end = 0x1FFFF0000ULL;
+	region_info.region = 31;
+	SET_ACCESS_PERMISSION(region_info.apc, 1,
+			      FORBIDDEN, FORBIDDEN, NO_PROTECTION, NO_PROTECTION,
+			      NO_PROTECTION, FORBIDDEN, NO_PROTECTION, NO_PROTECTION,
+			      NO_PROTECTION, SEC_R_NSEC_RW, NO_PROTECTION, FORBIDDEN,
+			      NO_PROTECTION, NO_PROTECTION, NO_PROTECTION, NO_PROTECTION);
+	emi_mpu_set_protection(&region_info);
 }
 
 int set_apu_emi_mpu_region(void)
diff --git a/plat/nuvoton/npcm845x/platform.mk b/plat/nuvoton/npcm845x/platform.mk
index 5120cc6..cb5a553 100644
--- a/plat/nuvoton/npcm845x/platform.mk
+++ b/plat/nuvoton/npcm845x/platform.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2015-2023, ARM Limited and Contributors. All rights reserved.
+# Copyright (c) 2015-2023, Arm Limited and Contributors. All rights reserved.
 #
 # Copyright (c) 2017-2023 Nuvoton Ltd.
 #
@@ -273,9 +273,11 @@
 ifeq (${ARCH}, aarch64)
 BL31_SOURCES	+=	plat/arm/common/aarch64/execution_state_switch.c \
 		plat/arm/common/arm_sip_svc.c \
+		plat/arm/common/plat_arm_sip_svc.c \
 		lib/pmf/pmf_smc.c
 else
 BL32_SOURCES	+=	plat/arm/common/arm_sip_svc.c \
+		plat/arm/common/plat_arm_sip_svc.c \
 		lib/pmf/pmf_smc.c
 endif
 endif
diff --git a/plat/st/common/common.mk b/plat/st/common/common.mk
index d10f185..7f93961 100644
--- a/plat/st/common/common.mk
+++ b/plat/st/common/common.mk
@@ -165,7 +165,6 @@
 ifeq (${GENERATE_COT},1)
 TFW_NVCTR_VAL			:=	0
 NTFW_NVCTR_VAL			:=	0
-KEY_SIZE			:=
 KEY_ALG				:=	ecdsa
 HASH_ALG			:=	sha256
 
@@ -178,6 +177,7 @@
 
 endif
 TF_MBEDTLS_KEY_ALG		:=	ecdsa
+KEY_SIZE			:=	256
 
 ifneq (${MBEDTLS_DIR},)
 MBEDTLS_MAJOR=$(shell grep -hP "define MBEDTLS_VERSION_MAJOR" \
diff --git a/plat/xilinx/common/include/plat_console.h b/plat/xilinx/common/include/plat_console.h
new file mode 100644
index 0000000..0f8320e
--- /dev/null
+++ b/plat/xilinx/common/include/plat_console.h
@@ -0,0 +1,27 @@
+/*
+ * Copyright (c) 2023, Advanced Micro Devices, Inc. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#ifndef PLAT_DT_UART_H
+#define PLAT_DT_UART_H
+
+#define DT_UART_DCC_COMPAT	"arm,dcc"
+
+#if defined(PLAT_zynqmp)
+#define DT_UART_COMPAT	"xlnx,zynqmp-uart"
+#else
+#define DT_UART_COMPAT	"arm,pl011"
+#endif
+
+typedef struct dt_uart_info_s {
+	char compatible[30];
+	uintptr_t base;
+	uint32_t baud_rate;
+	int32_t status;
+} dt_uart_info_t;
+
+void setup_console(void);
+
+#endif /* PLAT_DT_UART_H */
diff --git a/plat/xilinx/common/plat_console.c b/plat/xilinx/common/plat_console.c
new file mode 100644
index 0000000..0c0e74b
--- /dev/null
+++ b/plat/xilinx/common/plat_console.c
@@ -0,0 +1,346 @@
+/*
+ * Copyright (c) 2023, Advanced Micro Devices, Inc. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <assert.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <common/debug.h>
+#include <common/fdt_fixup.h>
+#include <common/fdt_wrappers.h>
+#include <drivers/arm/dcc.h>
+#include <drivers/arm/pl011.h>
+#include <drivers/cadence/cdns_uart.h>
+#include <drivers/console.h>
+#include <libfdt.h>
+#include <plat_console.h>
+
+#include <platform_def.h>
+#include <plat_private.h>
+
+static console_t console;
+
+#if (defined(XILINX_OF_BOARD_DTB_ADDR) && !IS_TFA_IN_OCM(BL31_BASE))
+/**
+ * get_baudrate() - Get the baudrate form DTB.
+ * @dtb: Address of the Device Tree Blob (DTB).
+ *
+ * Return: On success returns the baudrate; on failure returns an error.
+ */
+static int32_t get_baudrate(void *dtb)
+{
+	int node;
+	int32_t ret = 0;
+	const char *prop, *path;
+	char *end;
+	int32_t baud_rate = 0;
+
+	node = fdt_path_offset(dtb, "/secure-chosen");
+	if (node < 0) {
+		node = fdt_path_offset(dtb, "/chosen");
+		if (node < 0) {
+			ret = -FDT_ERR_NOTFOUND;
+			goto error;
+		}
+	}
+
+	prop = fdt_getprop(dtb, node, "stdout-path", NULL);
+	if (prop == NULL) {
+		ret = -FDT_ERR_NOTFOUND;
+		goto error;
+	}
+
+	/* Parse string serial0:115200n8 */
+	path = strchr(prop, ':');
+	if (!path) {
+		ret = -FDT_ERR_NOTFOUND;
+		goto error;
+	} else {
+
+		baud_rate = strtoul(path + 1, &end, 10);
+		if (baud_rate == 0 && end == path) {
+			ERROR("Conversion error occurred: %d\n", baud_rate);
+			ret = -FDT_ERR_NOTFOUND;
+			goto error;
+		}
+		ret = baud_rate;
+	}
+
+error:
+	return ret;
+}
+
+/**
+ * get_node_status() - Get the DTB node status.
+ * @dtb: Address of the Device Tree Blob (DTB).
+ * @node: Node address in the device tree.
+ *
+ * Return: On success, it returns 1; on failure, it returns an 0.
+ */
+static uint32_t get_node_status(void *dtb, int node)
+{
+	const char *status_cell;
+	uint32_t status = 0;
+
+	status_cell = fdt_getprop(dtb, node, "status", NULL);
+	if (!status_cell || strcmp(status_cell, "okay") == 0) {
+		status = 1;
+	} else {
+		status = 0;
+	}
+
+	return status;
+}
+
+/**
+ * fdt_add_uart_info() - Add DTB information to a UART structure.
+ * @info: Pointer to the UART information structure.
+ * @node: Node address in the device tree.
+ * @dtb: Address of the Device Tree Blob(DTB).
+ *
+ * Return: On success, it returns 1; on failure, it returns an 0.
+ */
+static uint32_t fdt_add_uart_info(dt_uart_info_t *info, int node, void *dtb)
+{
+	uintptr_t base_addr;
+	const char *com;
+	uint32_t ret = 0;
+
+	com = fdt_getprop(dtb, node, "compatible", NULL);
+	if (com != NULL) {
+		strlcpy(info->compatible, com, sizeof(info->compatible));
+	} else {
+		ERROR("Compatible property not found in DTB node\n");
+		ret  = -FDT_ERR_NOTFOUND;
+		goto error;
+	}
+
+	ret = fdt_get_reg_props_by_index(dtb, node, 0, &base_addr, NULL);
+	if (ret >= 0) {
+		info->base = base_addr;
+	} else {
+		ERROR("Failed to retrieve base address. Error code: %d\n", ret);
+		ret  = -FDT_ERR_NOTFOUND;
+		goto error;
+	}
+
+	info->status = get_node_status(dtb, node);
+	info->baud_rate = get_baudrate(dtb);
+
+error:
+	return ret;
+}
+
+/**
+ * fdt_get_uart_info() - Get the uart information form DTB.
+ * @info: Pointer to the UART information structure.
+ *
+ * Return: On success, it returns 0; on failure, it returns an error+reason.
+ */
+static int fdt_get_uart_info(dt_uart_info_t *info)
+{
+	int node, ret = 0;
+	void *dtb = (void *)XILINX_OF_BOARD_DTB_ADDR;
+
+	if (fdt_check_header(dtb) != 0) {
+		ERROR("Can't read DT at %p\n", dtb);
+		ret  = -FDT_ERR_NOTFOUND;
+		goto error;
+	}
+
+	ret = fdt_open_into(dtb, dtb, XILINX_OF_BOARD_DTB_MAX_SIZE);
+	if (ret < 0) {
+		ERROR("Invalid Device Tree at %p: error %d\n", dtb, ret);
+		ret  = -FDT_ERR_NOTFOUND;
+		goto error;
+	}
+
+	node = fdt_get_stdout_node_offset(dtb);
+	if (node < 0) {
+		ERROR("DT get stdout node failed : %d\n", node);
+		ret  = -FDT_ERR_NOTFOUND;
+		goto error;
+	}
+
+	ret = fdt_add_uart_info(info, node, dtb);
+	if (ret < 0) {
+		ERROR("Failed to add DT UART info: %d\n", ret);
+		ret  = -FDT_ERR_NOTFOUND;
+		goto error;
+	}
+
+error:
+	return ret;
+}
+
+/**
+ * check_fdt_uart_info() - Check early uart info with DTB uart info.
+ * @info: Pointer to the UART information structure.
+ *
+ * Return: On success, it returns 0; on failure, it returns an error+reason.
+ */
+static int check_fdt_uart_info(dt_uart_info_t *info)
+{
+	uint32_t ret = 0;
+
+	if (info->status == 0) {
+		ret = -ENODEV;
+		goto error;
+	}
+
+	if ((info->base == console.base) &&
+	   (info->baud_rate == UART_BAUDRATE) && !CONSOLE_IS(dcc)) {
+		ret = -ENODEV;
+		goto error;
+	}
+
+error:
+	return ret;
+}
+
+/**
+ * console_boot_end() - Unregister the console_t instance form the console list.
+ * @boot_console: Pointer to the console information structure.
+ */
+static void console_boot_end(console_t *boot_console)
+{
+	if (CONSOLE_IS(dcc)) {
+		console_dcc_unregister();
+	} else {
+		console_flush();
+		(void)console_unregister(boot_console);
+	}
+}
+
+/**
+ * setup_runtime_console() - Registers the runtime uart with console list.
+ * @clock: UART clock.
+ * @info: Pointer to the UART information structure.
+ */
+static void setup_runtime_console(uint32_t clock, dt_uart_info_t *info)
+{
+	static console_t bl31_runtime_console;
+	uint32_t rc;
+
+#if defined(PLAT_zynqmp)
+	rc = console_cdns_register(info->base,
+				   clock,
+				   info->baud_rate,
+				   &bl31_runtime_console);
+#else
+	rc = console_pl011_register(info->base,
+				    clock,
+				    info->baud_rate,
+				    &bl31_runtime_console);
+#endif
+	if (rc == 0) {
+		panic();
+	}
+
+	console_set_scope(&bl31_runtime_console,
+			  CONSOLE_FLAG_BOOT | CONSOLE_FLAG_RUNTIME |
+			  CONSOLE_FLAG_CRASH);
+}
+
+
+/**
+ * runtime_console_init() - Initializes the run time console information.
+ * @uart_info: Pointer to the UART information structure.
+ * @bl31_boot_console: Pointer to the console information structure.
+ * @clock: UART clock.
+ *
+ * Return: On success, it returns 0; on failure, it returns an error+reason;
+ */
+static int32_t runtime_console_init(dt_uart_info_t *uart_info,
+			  console_t *bl31_boot_console,
+			  uint32_t clock)
+{
+	int32_t rc = 0;
+
+	/* Parse UART information from Device Tree Blob (DTB) */
+	rc = fdt_get_uart_info(uart_info);
+	if (rc < 0) {
+		rc = -FDT_ERR_NOTFOUND;
+	}
+
+	if (strncmp(uart_info->compatible, DT_UART_COMPAT,
+		   strlen(DT_UART_COMPAT)) == 0) {
+
+		if (check_fdt_uart_info(uart_info) == 0) {
+			setup_runtime_console(clock, uart_info);
+			console_boot_end(bl31_boot_console);
+			INFO("Runtime console setup\n");
+		} else {
+			INFO("Early console and DTB console are same\n");
+		}
+	} else if (strncmp(uart_info->compatible, DT_UART_DCC_COMPAT,
+			  strlen(DT_UART_DCC_COMPAT)) == 0) {
+		rc = console_dcc_register();
+		if (rc == 0) {
+			panic();
+		}
+		console_boot_end(bl31_boot_console);
+	} else {
+		WARN("BL31: No console device found in DT.\n");
+	}
+
+	return rc;
+}
+#endif
+
+void setup_console(void)
+{
+	uint32_t rc;
+	uint32_t uart_clk = get_uart_clk();
+
+#if defined(PLAT_zynqmp)
+	if (CONSOLE_IS(cadence) || (CONSOLE_IS(cadence1))) {
+		rc = console_cdns_register(UART_BASE,
+					   uart_clk,
+					   UART_BAUDRATE,
+					   &console);
+		if (rc == 0) {
+			panic();
+		}
+
+		console_set_scope(&console, CONSOLE_FLAG_BOOT |
+				  CONSOLE_FLAG_RUNTIME | CONSOLE_FLAG_CRASH);
+	}
+#else
+	if (CONSOLE_IS(pl011) || (CONSOLE_IS(pl011_1))) {
+		/* Initialize the console to provide early debug support */
+		rc = console_pl011_register((uint32_t)UART_BASE,
+					   uart_clk,
+					   (uint32_t)UART_BAUDRATE,
+					   &console);
+		if (rc == 0) {
+			panic();
+		}
+
+		console_set_scope(&console, CONSOLE_FLAG_BOOT |
+				  CONSOLE_FLAG_RUNTIME | CONSOLE_FLAG_CRASH);
+	}
+#endif
+	if (CONSOLE_IS(dcc)) {
+		/* Initialize the dcc console for debug */
+		rc = console_dcc_register();
+		if (rc == 0) {
+			panic();
+		}
+	}
+	INFO("BL31: Early console setup\n");
+
+#if (defined(XILINX_OF_BOARD_DTB_ADDR) && !IS_TFA_IN_OCM(BL31_BASE))
+	static dt_uart_info_t uart_info = {0};
+
+	/* Initialize the runtime console using UART information from the DTB */
+	rc = runtime_console_init(&uart_info, &console, uart_clk);
+	if (rc < 0) {
+		ERROR("Failed to initialize runtime console: %d\n", rc);
+	}
+#endif
+}
diff --git a/plat/xilinx/versal/aarch64/versal_common.c b/plat/xilinx/versal/aarch64/versal_common.c
index 93deedc..6541f27 100644
--- a/plat/xilinx/versal/aarch64/versal_common.c
+++ b/plat/xilinx/versal/aarch64/versal_common.c
@@ -73,3 +73,8 @@
 	platform_id = FIELD_GET(PLATFORM_MASK, plat_info[1]);
 	platform_version = FIELD_GET(PLATFORM_VERSION_MASK, plat_info[1]);
 }
+
+uint32_t get_uart_clk(void)
+{
+	return UART_CLOCK;
+}
diff --git a/plat/xilinx/versal/bl31_versal_setup.c b/plat/xilinx/versal/bl31_versal_setup.c
index 566415f..48f774d 100644
--- a/plat/xilinx/versal/bl31_versal_setup.c
+++ b/plat/xilinx/versal/bl31_versal_setup.c
@@ -12,13 +12,11 @@
 #include <bl31/bl31.h>
 #include <common/bl_common.h>
 #include <common/debug.h>
-#include <drivers/arm/dcc.h>
-#include <drivers/arm/pl011.h>
-#include <drivers/console.h>
 #include <lib/mmio.h>
 #include <lib/xlat_tables/xlat_tables_v2.h>
 #include <plat/common/platform.h>
 #include <plat_arm.h>
+#include <plat_console.h>
 
 #include <plat_fdt.h>
 #include <plat_private.h>
@@ -74,28 +72,7 @@
 	enum pm_ret_status ret_status;
 	uint64_t addr[HANDOFF_PARAMS_MAX_SIZE];
 
-	if (CONSOLE_IS(pl011) || (CONSOLE_IS(pl011_1))) {
-		static console_t versal_runtime_console;
-		/* Initialize the console to provide early debug support */
-		int32_t rc = console_pl011_register((uintptr_t)UART_BASE,
-						(uint32_t)UART_CLOCK,
-						(uint32_t)UART_BAUDRATE,
-						&versal_runtime_console);
-		if (rc == 0) {
-			panic();
-		}
-
-		console_set_scope(&versal_runtime_console, (uint32_t)(CONSOLE_FLAG_BOOT |
-				  CONSOLE_FLAG_RUNTIME | CONSOLE_FLAG_CRASH));
-	} else if (CONSOLE_IS(dcc)) {
-		/* Initialize the dcc console for debug */
-		int32_t rc = console_dcc_register();
-		if (rc == 0) {
-			panic();
-		}
-	} else {
-		/* No console device found. */
-	}
+	setup_console();
 
 	/* Initialize the platform config for future decision making */
 	versal_config_setup();
diff --git a/plat/xilinx/versal/include/plat_private.h b/plat/xilinx/versal/include/plat_private.h
index 48f64ea..26545ba 100644
--- a/plat/xilinx/versal/include/plat_private.h
+++ b/plat/xilinx/versal/include/plat_private.h
@@ -17,6 +17,7 @@
 	interrupt_type_handler_t handler;
 } versal_intr_info_type_el3_t;
 
+uint32_t get_uart_clk(void);
 void versal_config_setup(void);
 
 const mmap_region_t *plat_versal_get_mmap(void);
diff --git a/plat/xilinx/versal/platform.mk b/plat/xilinx/versal/platform.mk
index a052713..494c30d 100644
--- a/plat/xilinx/versal/platform.mk
+++ b/plat/xilinx/versal/platform.mk
@@ -88,9 +88,11 @@
 
 BL31_SOURCES		+=	drivers/arm/cci/cci.c				\
 				lib/cpus/aarch64/cortex_a72.S			\
+				common/fdt_wrappers.c                           \
 				plat/common/plat_psci_common.c			\
 				plat/xilinx/common/ipi.c			\
 				plat/xilinx/common/plat_fdt.c			\
+				plat/xilinx/common/plat_console.c               \
 				plat/xilinx/common/plat_startup.c		\
 				plat/xilinx/common/ipi_mailbox_service/ipi_mailbox_svc.c \
 				plat/xilinx/common/pm_service/pm_ipi.c		\
diff --git a/plat/xilinx/versal_net/aarch64/versal_net_common.c b/plat/xilinx/versal_net/aarch64/versal_net_common.c
index b2de411..df18814 100644
--- a/plat/xilinx/versal_net/aarch64/versal_net_common.c
+++ b/plat/xilinx/versal_net/aarch64/versal_net_common.c
@@ -88,6 +88,30 @@
 	      platform_version / 10U, platform_version % 10U);
 }
 
+uint32_t get_uart_clk(void)
+{
+	uint32_t uart_clock;
+
+	switch (platform_id) {
+	case VERSAL_NET_SPP:
+		uart_clock = 1000000;
+		break;
+	case VERSAL_NET_EMU:
+		uart_clock = 25000000;
+		break;
+	case VERSAL_NET_QEMU:
+		uart_clock = 25000000;
+		break;
+	case VERSAL_NET_SILICON:
+		uart_clock = 100000000;
+		break;
+	default:
+		panic();
+	}
+
+	return uart_clock;
+}
+
 void versal_net_config_setup(void)
 {
 	uint32_t val;
diff --git a/plat/xilinx/versal_net/bl31_versal_net_setup.c b/plat/xilinx/versal_net/bl31_versal_net_setup.c
index a70095d..08f79de 100644
--- a/plat/xilinx/versal_net/bl31_versal_net_setup.c
+++ b/plat/xilinx/versal_net/bl31_versal_net_setup.c
@@ -12,13 +12,11 @@
 #include <bl31/bl31.h>
 #include <common/bl_common.h>
 #include <common/debug.h>
-#include <drivers/arm/dcc.h>
-#include <drivers/arm/pl011.h>
-#include <drivers/console.h>
 #include <lib/mmio.h>
 #include <lib/xlat_tables/xlat_tables_v2.h>
 #include <plat/common/platform.h>
 #include <plat_arm.h>
+#include <plat_console.h>
 
 #include <plat_fdt.h>
 #include <plat_private.h>
@@ -69,8 +67,6 @@
 void bl31_early_platform_setup2(u_register_t arg0, u_register_t arg1,
 				u_register_t arg2, u_register_t arg3)
 {
-	uint32_t uart_clock;
-	int32_t rc;
 #if !(TFA_NO_PM)
 	uint64_t tfa_handoff_addr, buff[HANDOFF_PARAMS_MAX_SIZE] = {0};
 	uint32_t payload[PAYLOAD_ARG_CNT], max_size = HANDOFF_PARAMS_MAX_SIZE;
@@ -82,49 +78,22 @@
 	switch (platform_id) {
 	case VERSAL_NET_SPP:
 		cpu_clock = 1000000;
-		uart_clock = 1000000;
 		break;
 	case VERSAL_NET_EMU:
 		cpu_clock = 3660000;
-		uart_clock = 25000000;
 		break;
 	case VERSAL_NET_QEMU:
 		/* Random values now */
 		cpu_clock = 100000000;
-		uart_clock = 25000000;
 		break;
 	case VERSAL_NET_SILICON:
 		cpu_clock = 100000000;
-		uart_clock = 100000000;
 		break;
 	default:
 		panic();
 	}
 
-	if (CONSOLE_IS(pl011_0) || CONSOLE_IS(pl011_1)) {
-		static console_t versal_net_runtime_console;
-
-		/* Initialize the console to provide early debug support */
-		rc = console_pl011_register(UART_BASE, uart_clock,
-				    UART_BAUDRATE,
-				    &versal_net_runtime_console);
-		if (rc == 0) {
-			panic();
-		}
-
-		console_set_scope(&versal_net_runtime_console, CONSOLE_FLAG_BOOT |
-				CONSOLE_FLAG_RUNTIME | CONSOLE_FLAG_CRASH);
-	} else if (CONSOLE_IS(dcc)) {
-		/* Initialize the dcc console for debug.
-		 * dcc is over jtag and does not configures uart0 or uart1.
-		 */
-		rc = console_dcc_register();
-		if (rc == 0) {
-			panic();
-		}
-	} else {
-		/* No console device found. */
-	}
+	setup_console();
 
 	NOTICE("TF-A running on %s %d.%d\n", board_name_decode(),
 	       platform_version / 10U, platform_version % 10U);
diff --git a/plat/xilinx/versal_net/include/plat_private.h b/plat/xilinx/versal_net/include/plat_private.h
index be75bfd..3eb8052 100644
--- a/plat/xilinx/versal_net/include/plat_private.h
+++ b/plat/xilinx/versal_net/include/plat_private.h
@@ -18,6 +18,7 @@
 } versal_intr_info_type_el3_t;
 
 void versal_net_config_setup(void);
+uint32_t get_uart_clk(void);
 
 const mmap_region_t *plat_versal_net_get_mmap(void);
 
diff --git a/plat/xilinx/versal_net/platform.mk b/plat/xilinx/versal_net/platform.mk
index 9fa16fd..fb229bb 100644
--- a/plat/xilinx/versal_net/platform.mk
+++ b/plat/xilinx/versal_net/platform.mk
@@ -108,12 +108,14 @@
 endif
 BL31_SOURCES		+=	plat/xilinx/common/plat_fdt.c			\
 				plat/xilinx/common/plat_startup.c		\
+				plat/xilinx/common/plat_console.c		\
 				plat/xilinx/common/ipi.c			\
 				plat/xilinx/common/ipi_mailbox_service/ipi_mailbox_svc.c \
 				plat/xilinx/common/versal.c			\
 				${PLAT_PATH}/bl31_versal_net_setup.c		\
 				${PLAT_PATH}/plat_topology.c			\
 				common/fdt_fixup.c				\
+				common/fdt_wrappers.c				\
 				${LIBFDT_SRCS}					\
 				${PLAT_PATH}/sip_svc_setup.c			\
 				${PLAT_PATH}/versal_net_gicv3.c			\
diff --git a/plat/xilinx/zynqmp/bl31_zynqmp_setup.c b/plat/xilinx/zynqmp/bl31_zynqmp_setup.c
index 32bb982..8018535 100644
--- a/plat/xilinx/zynqmp/bl31_zynqmp_setup.c
+++ b/plat/xilinx/zynqmp/bl31_zynqmp_setup.c
@@ -13,12 +13,11 @@
 #include <common/debug.h>
 #include <common/fdt_fixup.h>
 #include <common/fdt_wrappers.h>
-#include <drivers/arm/dcc.h>
-#include <drivers/console.h>
 #include <lib/mmio.h>
 #include <libfdt.h>
 #include <plat/arm/common/plat_arm.h>
 #include <plat/common/platform.h>
+#include <plat_console.h>
 
 #include <custom_svc.h>
 #include <plat_fdt.h>
@@ -74,25 +73,8 @@
 {
 	uint64_t tfa_handoff_addr;
 
-	if (CONSOLE_IS(cadence) || (CONSOLE_IS(cadence1))) {
-		/* Register the console to provide early debug support */
-		static console_t bl31_boot_console;
-		(void)console_cdns_register(UART_BASE,
-					       get_uart_clk(),
-					       UART_BAUDRATE,
-					       &bl31_boot_console);
-		console_set_scope(&bl31_boot_console,
-				  CONSOLE_FLAG_RUNTIME | CONSOLE_FLAG_BOOT |
-				  CONSOLE_FLAG_CRASH);
-	} else if (CONSOLE_IS(dcc)) {
-		/* Initialize the dcc console for debug */
-		int32_t rc = console_dcc_register();
-		if (rc == 0) {
-			panic();
-		}
-	} else {
-		/* No console device found. */
-	}
+	setup_console();
+
 	/* Initialize the platform config for future decision making */
 	zynqmp_config_setup();
 
diff --git a/plat/xilinx/zynqmp/platform.mk b/plat/xilinx/zynqmp/platform.mk
index e20cb22..b778932 100644
--- a/plat/xilinx/zynqmp/platform.mk
+++ b/plat/xilinx/zynqmp/platform.mk
@@ -124,9 +124,11 @@
 				lib/cpus/aarch64/cortex_a53.S			\
 				plat/common/plat_psci_common.c			\
 				common/fdt_fixup.c				\
+				common/fdt_wrappers.c				\
 				${LIBFDT_SRCS}					\
 				plat/xilinx/common/ipi_mailbox_service/ipi_mailbox_svc.c \
 				plat/xilinx/common/plat_startup.c		\
+				plat/xilinx/common/plat_console.c		\
 				plat/xilinx/common/plat_fdt.c			\
 				plat/xilinx/zynqmp/bl31_zynqmp_setup.c		\
 				plat/xilinx/zynqmp/plat_psci.c			\
diff --git a/tools/cert_create/include/key.h b/tools/cert_create/include/key.h
index 312575b..e0ecdae 100644
--- a/tools/cert_create/include/key.h
+++ b/tools/cert_create/include/key.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2022, Arm Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2023, Arm Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -44,7 +44,7 @@
 static const unsigned int KEY_SIZES[KEY_ALG_MAX_NUM][KEY_SIZE_MAX_NUM] = {
 	{ 2048, 1024, 3072, 4096 },	/* KEY_ALG_RSA */
 #ifndef OPENSSL_NO_EC
-	{},				/* KEY_ALG_ECDSA_NIST */
+	{ 256, 384 },			/* KEY_ALG_ECDSA_NIST */
 	{},				/* KEY_ALG_ECDSA_BRAINPOOL_R */
 	{}				/* KEY_ALG_ECDSA_BRAINPOOL_T */
 #endif /* OPENSSL_NO_EC */
@@ -74,7 +74,7 @@
 int key_new(key_t *key);
 #endif
 int key_create(key_t *key, int type, int key_bits);
-int key_load(key_t *key, unsigned int *err_code);
+unsigned int key_load(key_t *key);
 int key_store(key_t *key);
 void key_cleanup(void);
 
diff --git a/tools/cert_create/src/key.c b/tools/cert_create/src/key.c
index 32229d1..04214aa 100644
--- a/tools/cert_create/src/key.c
+++ b/tools/cert_create/src/key.c
@@ -1,9 +1,10 @@
 /*
- * Copyright (c) 2015-2022, Arm Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2023, Arm Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
 
+#include <assert.h>
 #include <getopt.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -112,7 +113,12 @@
 
 static int key_create_ecdsa_nist(key_t *key, int key_bits)
 {
-	return key_create_ecdsa(key, key_bits, "prime256v1");
+	if (key_bits == 384) {
+		return key_create_ecdsa(key, key_bits, "secp384r1");
+	} else {
+		assert(key_bits == 256);
+		return key_create_ecdsa(key, key_bits, "prime256v1");
+	}
 }
 
 static int key_create_ecdsa_brainpool_r(key_t *key, int key_bits)
@@ -154,7 +160,12 @@
 
 static int key_create_ecdsa_nist(key_t *key, int key_bits)
 {
-	return key_create_ecdsa(key, key_bits, NID_X9_62_prime256v1);
+	if (key_bits == 384) {
+		return key_create_ecdsa(key, key_bits, NID_secp384r1);
+	} else {
+		assert(key_bits == 256);
+		return key_create_ecdsa(key, key_bits, NID_X9_62_prime256v1);
+	}
 }
 
 static int key_create_ecdsa_brainpool_r(key_t *key, int key_bits)
@@ -228,38 +239,34 @@
 
 }
 
-int key_load(key_t *key, unsigned int *err_code)
+unsigned int key_load(key_t *key)
 {
-	FILE *fp;
+	if (key->fn == NULL) {
+		VERBOSE("Key not specified\n");
+		return KEY_ERR_FILENAME;
+	}
 
-	if (key->fn) {
-		if (!strncmp(key->fn, "pkcs11:", 7)) {
-			/* Load key through pkcs11 */
-			key->key = key_load_pkcs11(key->fn);
-		} else {
-			/* Load key from file */
-			fp = fopen(key->fn, "r");
-			if (fp) {
-				key->key = PEM_read_PrivateKey(fp, NULL, NULL, NULL);
-				fclose(fp);
-			} else {
-				WARN("Cannot open file %s\n", key->fn);
-				*err_code = KEY_ERR_OPEN;
-			}
-		}
-		if (key->key) {
-			*err_code = KEY_ERR_NONE;
-			return 1;
-		} else {
-			ERROR("Cannot load key from %s\n", key->fn);
-			*err_code = KEY_ERR_LOAD;
-		}
+	if (strncmp(key->fn, "pkcs11:", 7) == 0) {
+		/* Load key through pkcs11 */
+		key->key = key_load_pkcs11(key->fn);
 	} else {
-		VERBOSE("Key not specified\n");
-		*err_code = KEY_ERR_FILENAME;
+		/* Load key from file */
+		FILE *fp = fopen(key->fn, "r");
+		if (fp == NULL) {
+			WARN("Cannot open file %s\n", key->fn);
+			return KEY_ERR_OPEN;
+		}
+
+		key->key = PEM_read_PrivateKey(fp, NULL, NULL, NULL);
+		fclose(fp);
 	}
 
-	return 0;
+	if (key->key == NULL) {
+		ERROR("Cannot load key from %s\n", key->fn);
+		return KEY_ERR_LOAD;
+	}
+
+	return KEY_ERR_NONE;
 }
 
 int key_store(key_t *key)
diff --git a/tools/cert_create/src/main.c b/tools/cert_create/src/main.c
index 2ab6bcf..f10a768 100644
--- a/tools/cert_create/src/main.c
+++ b/tools/cert_create/src/main.c
@@ -441,7 +441,8 @@
 #endif
 
 		/* First try to load the key from disk */
-		if (key_load(&keys[i], &err_code)) {
+		err_code = key_load(&keys[i]);
+		if (err_code == KEY_ERR_NONE) {
 			/* Key loaded successfully */
 			continue;
 		}