diff --git a/changelog.yaml b/changelog.yaml
index 93785a9..c4ed59b 100644
--- a/changelog.yaml
+++ b/changelog.yaml
@@ -348,6 +348,9 @@
             deprecated:
               - plat/qti/sc7280
 
+          - title: MSM8916
+            scope: msm8916
+
       - title: Raspberry Pi
         scope: rpi
 
diff --git a/docs/about/maintainers.rst b/docs/about/maintainers.rst
index e0a7587..94c63f4 100644
--- a/docs/about/maintainers.rst
+++ b/docs/about/maintainers.rst
@@ -580,6 +580,15 @@
 :|F|: docs/plat/qti.rst
 :|F|: plat/qti/
 
+QTI MSM8916 platform port
+^^^^^^^^^^^^^^^^^^^^^^^^^
+:|M|: Stephan Gerhold <stephan@gerhold.net>
+:|G|: `stephan-gh`_
+:|M|: Nikita Travkin <nikita@trvn.ru>
+:|G|: `TravMurav`_
+:|F|: docs/plat/qti-msm8916.rst
+:|F|: plat/qti/msm8916/
+
 Raspberry Pi 3 platform port
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 :|M|: Ying-Chun Liu (PaulLiu) <paul.liu@linaro.org>
@@ -797,9 +806,11 @@
 .. _smaeul: https://github.com/smaeul
 .. _soby-mathew: https://github.com/soby-mathew
 .. _sreekare: https://github.com/sreekare
+.. _stephan-gh: https://github.com/stephan-gh
 .. _thloh85-intel: https://github.com/thloh85-intel
 .. _thomas-arm: https://github.com/thomas-arm
 .. _TonyXie06: https://github.com/TonyXie06
+.. _TravMurav: https://github.com/TravMurav
 .. _vwadekar: https://github.com/vwadekar
 .. _venkatesh: https://github.com/vabbarap
 .. _Yann-lms: https://github.com/Yann-lms
diff --git a/docs/plat/index.rst b/docs/plat/index.rst
index 57cc488..0cef16a 100644
--- a/docs/plat/index.rst
+++ b/docs/plat/index.rst
@@ -32,6 +32,7 @@
    qemu
    qemu-sbsa
    qti
+   qti-msm8916
    rpi3
    rpi4
    rcar-gen3
diff --git a/docs/plat/qti-msm8916.rst b/docs/plat/qti-msm8916.rst
new file mode 100644
index 0000000..09a79b7
--- /dev/null
+++ b/docs/plat/qti-msm8916.rst
@@ -0,0 +1,116 @@
+Qualcomm Snapdragon 410 (MSM8916/APQ8016)
+=========================================
+
+The `Qualcomm Snapdragon 410`_ is Qualcomm's first 64-bit SoC, released in 2014
+with four ARM Cortex-A53 cores. There are differents variants (MSM8916,
+APQ8016(E), ...) that are all very similar. A popular device based on APQ8016E
+is the `DragonBoard 410c`_ single-board computer, but the SoC is also used in
+various mid-range smartphones/tablets.
+
+The TF-A/BL31 port for MSM8916 provides a minimal, community-maintained
+EL3 firmware. It is primarily based on information from the public
+`Snapdragon 410E Technical Reference Manual`_ combined with a lot of
+trial and error to actually make it work.
+
+.. note::
+	Unlike the :doc:`QTI SC7180/SC7280 <qti>` ports, this port does **not**
+	make use of a proprietary binary components (QTISECLIB). It is fully
+	open-source but therefore limited to publicly documented hardware
+	components.
+
+Functionality
+-------------
+
+The BL31 port is much more minimal compared to the original firmware and
+therefore expects the non-secure world (e.g. Linux) to manage more hardware,
+such as the SMMUs and all remote processors (RPM, WCNSS, Venus, Modem).
+Everything except modem is currently functional with a slightly modified version
+of mainline Linux.
+
+.. warning::
+	This port is **not secure**. There is no special secure memory and the
+	used DRAM is available from both the non-secure and secure worlds.
+	Unfortunately, the hardware used for memory protection is not described
+	in the APQ8016E documentation.
+
+The port is primarily intended as a minimal PSCI implementation (without a
+separate secure world) where this limitation is not a big problem. Booting
+secondary CPU cores (PSCI ``CPU_ON``) is supported. Basic CPU core power
+management (``CPU_SUSPEND``) is functional but still work-in-progress and
+will be added later once ready.
+
+Boot Flow
+---------
+BL31 replaces the original ``tz`` firmware in the boot flow::
+
+	Boot ROM (PBL) -> SBL -> BL31 (EL3) -> U-Boot (EL2) -> Linux (EL2)
+
+By default, BL31 enters the non-secure world in EL2 AArch64 state at address
+``0x8f600000``. The original hypervisor firmware (``hyp``) is not used, you can
+use KVM or another hypervisor. The entry address is fixed in the BL31 binary
+but can be changed using the ``PRELOADED_BL33_BASE`` make file parameter.
+
+Using an AArch64 bootloader (such as `U-Boot for DragonBoard 410c`_) is
+recommended. AArch32 bootloaders (such as the original Little Kernel bootloader
+from Qualcomm) are not directly supported, although it is possible to use an EL2
+shim loader to temporarily switch to AArch32 state.
+
+Installation
+------------
+First, setup the cross compiler for AArch64 and build TF-A for ``msm8916``::
+
+	$ make CROSS_COMPILE=aarch64-linux-gnu- PLAT=msm8916
+
+The BL31 ELF image is generated in ``build/msm8916/release/bl31/bl31.elf``.
+This image must be "signed" before flashing it, even if the board has secure
+boot disabled. In this case the signature does not provide any security,
+but it provides the firmware with required metadata.
+
+The `DragonBoard 410c`_ does not have secure boot enabled by default. In this
+case you can simply sign the ELF image using a randomly generated key. You can
+use e.g. `qtestsign`_::
+
+	$ ./qtestsign.py tz build/msm8916/release/bl31/bl31.elf
+
+Then install the resulting ``build/msm8916/release/bl31/bl31-test-signed.mbn``
+to the ``tz`` partition on the device. BL31 should be running after a reboot.
+
+.. warning::
+	Do not flash incorrectly signed firmware on devices that have secure
+	boot enabled! Make sure that you have a way to recover the board in case
+	of problems (e.g. using EDL).
+
+Boot Trace
+----------
+BL31 prints some lines on the debug console UART2, which will usually look like
+this (with ``DEBUG=1``, otherwise only the ``NOTICE`` lines are shown)::
+
+	...
+	S - DDR Frequency, 400 MHz
+	NOTICE:  BL31: v2.6(debug):v2.6
+	NOTICE:  BL31: Built : 20:00:00, Dec 01 2021
+	INFO:    BL31: Platform setup start
+	INFO:    ARM GICv2 driver initialized
+	INFO:    BL31: Platform setup done
+	INFO:    BL31: Initializing runtime services
+	INFO:    BL31: cortex_a53: CPU workaround for 819472 was applied
+	INFO:    BL31: cortex_a53: CPU workaround for 824069 was applied
+	INFO:    BL31: cortex_a53: CPU workaround for 826319 was applied
+	INFO:    BL31: cortex_a53: CPU workaround for 827319 was applied
+	INFO:    BL31: cortex_a53: CPU workaround for 835769 was applied
+	INFO:    BL31: cortex_a53: CPU workaround for disable_non_temporal_hint was applied
+	INFO:    BL31: cortex_a53: CPU workaround for 843419 was applied
+	INFO:    BL31: cortex_a53: CPU workaround for 1530924 was applied
+	INFO:    BL31: Preparing for EL3 exit to normal world
+	INFO:    Entry point address = 0x8f600000
+	INFO:    SPSR = 0x3c9
+
+	U-Boot 2021.10 (Dec 01 2021 - 20:00:00 +0000)
+	Qualcomm-DragonBoard 410C
+	...
+
+.. _Qualcomm Snapdragon 410: https://www.qualcomm.com/products/snapdragon-processors-410
+.. _DragonBoard 410c: https://www.96boards.org/product/dragonboard410c/
+.. _Snapdragon 410E Technical Reference Manual: https://developer.qualcomm.com/download/sd410/snapdragon-410e-technical-reference-manual.pdf
+.. _U-Boot for DragonBoard 410c: https://u-boot.readthedocs.io/en/latest/board/qualcomm/dragonboard410c.html
+.. _qtestsign: https://github.com/msm8916-mainline/qtestsign
diff --git a/drivers/st/clk/stm32mp1_clk.c b/drivers/st/clk/stm32mp1_clk.c
index af8b71e..f525741 100644
--- a/drivers/st/clk/stm32mp1_clk.c
+++ b/drivers/st/clk/stm32mp1_clk.c
@@ -1837,11 +1837,6 @@
 		return -FDT_ERR_NOTFOUND;
 	}
 
-	/* Check status field to disable security */
-	if (!fdt_get_rcc_secure_status()) {
-		mmio_write_32(rcc_base + RCC_TZCR, 0);
-	}
-
 	ret = fdt_rcc_read_uint32_array("st,clksrc", (uint32_t)CLKSRC_NB,
 					clksrc);
 	if (ret < 0) {
@@ -2358,6 +2353,12 @@
 
 int stm32mp1_clk_probe(void)
 {
+#if defined(IMAGE_BL32)
+	if (!fdt_get_rcc_secure_state()) {
+		mmio_write_32(stm32mp_rcc_base() + RCC_TZCR, 0U);
+	}
+#endif
+
 	stm32mp1_osc_init();
 
 	sync_earlyboot_clocks_state();
diff --git a/drivers/st/clk/stm32mp_clkfunc.c b/drivers/st/clk/stm32mp_clkfunc.c
index a013a82..80c2f41 100644
--- a/drivers/st/clk/stm32mp_clkfunc.c
+++ b/drivers/st/clk/stm32mp_clkfunc.c
@@ -250,24 +250,22 @@
 }
 
 /*
- * Get the secure status for rcc node in device tree.
- * @return: true if rcc is available from secure world, false if not.
+ * Get the secure state for rcc node in device tree.
+ * @return: true if rcc is configured for secure world access, false if not.
  */
-bool fdt_get_rcc_secure_status(void)
+bool fdt_get_rcc_secure_state(void)
 {
-	int node;
 	void *fdt;
 
 	if (fdt_get_address(&fdt) == 0) {
 		return false;
 	}
 
-	node = fdt_get_rcc_node(fdt);
-	if (node < 0) {
+	if (fdt_node_offset_by_compatible(fdt, -1, DT_RCC_SEC_CLK_COMPAT) < 0) {
 		return false;
 	}
 
-	return !!(fdt_get_status(node) & DT_SECURE);
+	return true;
 }
 
 /*
diff --git a/include/drivers/arm/gicv2.h b/include/drivers/arm/gicv2.h
index ebcb216..b960194 100644
--- a/include/drivers/arm/gicv2.h
+++ b/include/drivers/arm/gicv2.h
@@ -8,6 +8,7 @@
 #define GICV2_H
 
 #include <drivers/arm/gic_common.h>
+#include <platform_def.h>
 
 /*******************************************************************************
  * GICv2 miscellaneous definitions
@@ -30,7 +31,14 @@
 #define GICD_SGIR		U(0xF00)
 #define GICD_CPENDSGIR		U(0xF10)
 #define GICD_SPENDSGIR		U(0xF20)
+
+/*
+ * Some GICv2 implementations violate the specification and have this register
+ * at a different address. Allow overriding it in platform_def.h as workaround.
+ */
+#ifndef GICD_PIDR2_GICV2
 #define GICD_PIDR2_GICV2	U(0xFE8)
+#endif
 
 #define ITARGETSR_SHIFT		2
 #define GIC_TARGET_CPU_MASK	U(0xff)
diff --git a/include/drivers/st/stm32mp_clkfunc.h b/include/drivers/st/stm32mp_clkfunc.h
index 9df38d6..61286b2 100644
--- a/include/drivers/st/stm32mp_clkfunc.h
+++ b/include/drivers/st/stm32mp_clkfunc.h
@@ -23,7 +23,7 @@
 			      uint32_t *array);
 int fdt_rcc_subnode_offset(const char *name);
 const fdt32_t *fdt_rcc_read_prop(const char *prop_name, int *lenp);
-bool fdt_get_rcc_secure_status(void);
+bool fdt_get_rcc_secure_state(void);
 
 int fdt_get_clock_id(int node);
 unsigned long fdt_get_uart_clock_freq(uintptr_t instance);
diff --git a/plat/arm/board/rdn2/include/platform_def.h b/plat/arm/board/rdn2/include/platform_def.h
index 194814f..e4015f7 100644
--- a/plat/arm/board/rdn2/include/platform_def.h
+++ b/plat/arm/board/rdn2/include/platform_def.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2020-2021, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -13,6 +13,8 @@
 
 #if (CSS_SGI_PLATFORM_VARIANT == 1)
 #define PLAT_ARM_CLUSTER_COUNT		U(8)
+#elif (CSS_SGI_PLATFORM_VARIANT == 2)
+#define PLAT_ARM_CLUSTER_COUNT		U(4)
 #else
 #define PLAT_ARM_CLUSTER_COUNT		U(16)
 #endif
@@ -34,6 +36,8 @@
 
 #if (CSS_SGI_PLATFORM_VARIANT == 1)
 #define TZC400_COUNT			U(2)
+#elif (CSS_SGI_PLATFORM_VARIANT == 2)
+#define TZC400_COUNT			U(4)
 #else
 #define TZC400_COUNT			U(8)
 #endif
@@ -64,8 +68,15 @@
  * Physical and virtual address space limits for MMU in AARCH64 & AARCH32 modes
  */
 #ifdef __aarch64__
+#if (CSS_SGI_PLATFORM_VARIANT == 2)
+#define PLAT_PHY_ADDR_SPACE_SIZE	CSS_SGI_REMOTE_CHIP_MEM_OFFSET( \
+						CSS_SGI_CHIP_COUNT)
+#define PLAT_VIRT_ADDR_SPACE_SIZE	CSS_SGI_REMOTE_CHIP_MEM_OFFSET( \
+						CSS_SGI_CHIP_COUNT)
+#else
 #define PLAT_PHY_ADDR_SPACE_SIZE	(1ULL << 42)
 #define PLAT_VIRT_ADDR_SPACE_SIZE	(1ULL << 42)
+#endif
 #else
 #define PLAT_PHY_ADDR_SPACE_SIZE	(1ULL << 32)
 #define PLAT_VIRT_ADDR_SPACE_SIZE	(1ULL << 32)
@@ -75,6 +86,9 @@
 #define PLAT_ARM_GICD_BASE		UL(0x30000000)
 #define PLAT_ARM_GICC_BASE		UL(0x2C000000)
 
+/* Virtual address used by dynamic mem_protect for chunk_base */
+#define PLAT_ARM_MEM_PROTEC_VA_FRAME	UL(0xC0000000)
+
 #if (CSS_SGI_PLATFORM_VARIANT == 1)
 #define PLAT_ARM_GICR_BASE		UL(0x30100000)
 #else
diff --git a/plat/arm/board/rdn2/platform.mk b/plat/arm/board/rdn2/platform.mk
index 5b24c32..753ba32 100644
--- a/plat/arm/board/rdn2/platform.mk
+++ b/plat/arm/board/rdn2/platform.mk
@@ -3,9 +3,27 @@
 # SPDX-License-Identifier: BSD-3-Clause
 #
 
+RD_N2_VARIANTS	:= 0 1 2
+ifneq ($(CSS_SGI_PLATFORM_VARIANT),\
+	$(filter $(CSS_SGI_PLATFORM_VARIANT),$(RD_N2_VARIANTS)))
+ $(error "CSS_SGI_PLATFORM_VARIANT for RD-N2 should be 0, 1 or 2, currently set \
+     to ${CSS_SGI_PLATFORM_VARIANT}.")
+endif
+
+$(eval $(call CREATE_SEQ,SEQ,4))
+ifneq ($(CSS_SGI_CHIP_COUNT),$(filter $(CSS_SGI_CHIP_COUNT),$(SEQ)))
+ $(error  "Chip count for RD-N2-MC should be either $(SEQ) \
+ currently it is set to ${CSS_SGI_CHIP_COUNT}.")
+endif
+
 # RD-N2 platform uses GIC-700 which is based on GICv4.1
 GIC_ENABLE_V4_EXTN	:=	1
 
+#Enable GIC Multichip Extension only for Multichip Platforms
+ifeq (${CSS_SGI_PLATFORM_VARIANT}, 2)
+GICV3_IMPL_GIC600_MULTICHIP	:=	1
+endif
+
 include plat/arm/css/sgi/sgi-common.mk
 
 RDN2_BASE		=	plat/arm/board/rdn2
@@ -39,6 +57,13 @@
 BL2_SOURCES		+=	${RDN2_BASE}/rdn2_trusted_boot.c
 endif
 
+ifeq (${CSS_SGI_PLATFORM_VARIANT}, 2)
+BL31_SOURCES	+=	drivers/arm/gic/v3/gic600_multichip.c
+
+# Enable dynamic addition of MMAP regions in BL31
+BL31_CFLAGS		+=	-DPLAT_XLAT_TABLES_DYNAMIC
+endif
+
 # Add the FDT_SOURCES and options for Dynamic Config
 FDT_SOURCES		+=	${RDN2_BASE}/fdts/${PLAT}_fw_config.dts	\
 				${RDN2_BASE}/fdts/${PLAT}_tb_fw_config.dts
@@ -58,10 +83,3 @@
 
 override CTX_INCLUDE_AARCH32_REGS	:= 0
 override ENABLE_AMU			:= 1
-
-RD_N2_VARIANTS	:= 0 1
-ifneq ($(CSS_SGI_PLATFORM_VARIANT),\
-	$(filter $(CSS_SGI_PLATFORM_VARIANT),$(RD_N2_VARIANTS)))
- $(error "CSS_SGI_PLATFORM_VARIANT for RD-N2 should be 0 or 1, currently set \
-     to ${CSS_SGI_PLATFORM_VARIANT}.")
-endif
diff --git a/plat/arm/board/rdn2/rdn2_plat.c b/plat/arm/board/rdn2/rdn2_plat.c
index 5bf14e3..8cf1929 100644
--- a/plat/arm/board/rdn2/rdn2_plat.c
+++ b/plat/arm/board/rdn2/rdn2_plat.c
@@ -1,12 +1,87 @@
 /*
- * Copyright (c) 2020, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2020-2021, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
 
+#include <common/debug.h>
+#include <drivers/arm/gic600_multichip.h>
+#include <plat/arm/common/plat_arm.h>
 #include <plat/common/platform.h>
+#include <sgi_soc_platform_def_v2.h>
 #include <sgi_plat.h>
 
+#if defined(IMAGE_BL31)
+#if (CSS_SGI_PLATFORM_VARIANT == 2)
+static const mmap_region_t rdn2mc_dynamic_mmap[] = {
+#if CSS_SGI_CHIP_COUNT > 1
+	ARM_MAP_SHARED_RAM_REMOTE_CHIP(1),
+	CSS_SGI_MAP_DEVICE_REMOTE_CHIP(1),
+#endif
+#if CSS_SGI_CHIP_COUNT > 2
+	ARM_MAP_SHARED_RAM_REMOTE_CHIP(2),
+	CSS_SGI_MAP_DEVICE_REMOTE_CHIP(2),
+#endif
+#if CSS_SGI_CHIP_COUNT > 3
+	ARM_MAP_SHARED_RAM_REMOTE_CHIP(3),
+	CSS_SGI_MAP_DEVICE_REMOTE_CHIP(3),
+#endif
+};
+#endif
+
+#if (CSS_SGI_PLATFORM_VARIANT == 2)
+static struct gic600_multichip_data rdn2mc_multichip_data __init = {
+	.rt_owner_base = PLAT_ARM_GICD_BASE,
+	.rt_owner = 0,
+	.chip_count = CSS_SGI_CHIP_COUNT,
+	.chip_addrs = {
+		PLAT_ARM_GICD_BASE >> 16,
+#if CSS_SGI_CHIP_COUNT > 1
+		(PLAT_ARM_GICD_BASE + CSS_SGI_REMOTE_CHIP_MEM_OFFSET(1)) >> 16,
+#endif
+#if CSS_SGI_CHIP_COUNT > 2
+		(PLAT_ARM_GICD_BASE + CSS_SGI_REMOTE_CHIP_MEM_OFFSET(2)) >> 16,
+#endif
+#if CSS_SGI_CHIP_COUNT > 3
+		(PLAT_ARM_GICD_BASE + CSS_SGI_REMOTE_CHIP_MEM_OFFSET(3)) >> 16,
+#endif
+	},
+	.spi_ids = {
+		{32, 479},
+	#if CSS_SGI_CHIP_COUNT > 1
+		{0, 0},
+	#endif
+	#if CSS_SGI_CHIP_COUNT > 2
+		{0, 0},
+	#endif
+	#if CSS_SGI_CHIP_COUNT > 3
+		{0, 0},
+	#endif
+	}
+};
+#endif
+
+#if (CSS_SGI_PLATFORM_VARIANT == 2)
+static uintptr_t rdn2mc_multichip_gicr_frames[] = {
+	/* Chip 0's GICR Base */
+	PLAT_ARM_GICR_BASE,
+#if CSS_SGI_CHIP_COUNT > 1
+	/* Chip 1's GICR BASE */
+	PLAT_ARM_GICR_BASE + CSS_SGI_REMOTE_CHIP_MEM_OFFSET(1),
+#endif
+#if CSS_SGI_CHIP_COUNT > 2
+	/* Chip 2's GICR BASE */
+	PLAT_ARM_GICR_BASE + CSS_SGI_REMOTE_CHIP_MEM_OFFSET(2),
+#endif
+#if CSS_SGI_CHIP_COUNT > 3
+	/* Chip 3's GICR BASE */
+	PLAT_ARM_GICR_BASE + CSS_SGI_REMOTE_CHIP_MEM_OFFSET(3),
+#endif
+	UL(0)	/* Zero Termination */
+};
+#endif
+#endif /* IMAGE_BL31 */
+
 unsigned int plat_arm_sgi_get_platform_id(void)
 {
 	return mmio_read_32(SID_REG_BASE + SID_SYSTEM_ID_OFFSET)
@@ -25,7 +100,39 @@
 			     SID_MULTI_CHIP_MODE_SHIFT;
 }
 
+#if defined(IMAGE_BL31)
 void bl31_platform_setup(void)
 {
+#if (CSS_SGI_PLATFORM_VARIANT == 2)
+	int ret;
+	unsigned int i;
+
+	if (plat_arm_sgi_get_multi_chip_mode() == 0) {
+		ERROR("Chip Count is set to %u but multi-chip mode is not "
+			"enabled\n", CSS_SGI_CHIP_COUNT);
+		panic();
+	} else {
+		INFO("Enabling multi-chip support for RD-N2 variant\n");
+
+		for (i = 0; i < ARRAY_SIZE(rdn2mc_dynamic_mmap); i++) {
+			ret = mmap_add_dynamic_region(
+					rdn2mc_dynamic_mmap[i].base_pa,
+					rdn2mc_dynamic_mmap[i].base_va,
+					rdn2mc_dynamic_mmap[i].size,
+					rdn2mc_dynamic_mmap[i].attr);
+			if (ret != 0) {
+				ERROR("Failed to add dynamic mmap entry for"
+					" i: %d " "(ret=%d)\n", i, ret);
+				panic();
+			}
+		}
+
+		plat_arm_override_gicr_frames(
+			rdn2mc_multichip_gicr_frames);
+		gic600_multichip_init(&rdn2mc_multichip_data);
+	}
+#endif
+
 	sgi_bl31_common_platform_setup();
 }
+#endif /* IMAGE_BL31 */
diff --git a/plat/arm/board/rdn2/rdn2_security.c b/plat/arm/board/rdn2/rdn2_security.c
index 9568b60..dff6a19 100644
--- a/plat/arm/board/rdn2/rdn2_security.c
+++ b/plat/arm/board/rdn2/rdn2_security.c
@@ -1,25 +1,63 @@
 /*
- * Copyright (c) 2020, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2020-2021, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
 
+#include <common/debug.h>
 #include <plat/arm/common/plat_arm.h>
 #include <platform_def.h>
 
-
 static const arm_tzc_regions_info_t tzc_regions[] = {
 	ARM_TZC_REGIONS_DEF,
 	{}
 };
+
+#if (CSS_SGI_PLATFORM_VARIANT == 2 && CSS_SGI_CHIP_COUNT > 1)
+static const arm_tzc_regions_info_t tzc_regions_mc[][CSS_SGI_CHIP_COUNT - 1] = {
+	{
+		/* TZC memory regions for second chip */
+		SGI_PLAT_TZC_NS_REMOTE_REGIONS_DEF(1),
+		{}
+	},
+#if CSS_SGI_CHIP_COUNT > 2
+	{
+		/* TZC memory regions for third chip */
+		SGI_PLAT_TZC_NS_REMOTE_REGIONS_DEF(2),
+		{}
+	},
+#endif
+#if CSS_SGI_CHIP_COUNT > 3
+	{
+		/* TZC memory regions for fourth chip */
+		SGI_PLAT_TZC_NS_REMOTE_REGIONS_DEF(3),
+		{}
+	},
+#endif
+};
+#endif /* CSS_SGI_PLATFORM_VARIANT && CSS_SGI_CHIP_COUNT */
 
 /* Initialize the secure environment */
 void plat_arm_security_setup(void)
 {
+	unsigned int i;
 
-	int i;
+	INFO("Configuring TrustZone Controller for Chip 0\n");
 
-	for (i = 0; i < TZC400_COUNT; i++)
+	for (i = 0; i < TZC400_COUNT; i++) {
 		arm_tzc400_setup(TZC400_BASE(i), tzc_regions);
+	}
+
+#if (CSS_SGI_PLATFORM_VARIANT == 2 && CSS_SGI_CHIP_COUNT > 1)
+	unsigned int j;
+
+	for (i = 1; i < CSS_SGI_CHIP_COUNT; i++) {
+		INFO("Configuring TrustZone Controller for Chip %u\n", i);
 
+		for (j = 0; j < TZC400_COUNT; j++) {
+			arm_tzc400_setup(CSS_SGI_REMOTE_CHIP_MEM_OFFSET(i)
+				+ TZC400_BASE(j), tzc_regions_mc[i-1]);
+		}
+	}
+#endif
 }
diff --git a/plat/arm/board/rdn2/rdn2_topology.c b/plat/arm/board/rdn2/rdn2_topology.c
index cad6c37..89300f8 100644
--- a/plat/arm/board/rdn2/rdn2_topology.c
+++ b/plat/arm/board/rdn2/rdn2_topology.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2020-2021, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -11,20 +11,24 @@
  * The power domain tree descriptor.
  ******************************************************************************/
 const unsigned char rd_n2_pd_tree_desc[] = {
-	PLAT_ARM_CLUSTER_COUNT,
+	(PLAT_ARM_CLUSTER_COUNT) * (CSS_SGI_CHIP_COUNT),
 	CSS_SGI_MAX_CPUS_PER_CLUSTER,
 	CSS_SGI_MAX_CPUS_PER_CLUSTER,
 	CSS_SGI_MAX_CPUS_PER_CLUSTER,
 	CSS_SGI_MAX_CPUS_PER_CLUSTER,
+#if (CSS_SGI_PLATFORM_VARIANT != 2 || (CSS_SGI_PLATFORM_VARIANT == 2 && CSS_SGI_CHIP_COUNT > 1))
 	CSS_SGI_MAX_CPUS_PER_CLUSTER,
 	CSS_SGI_MAX_CPUS_PER_CLUSTER,
 	CSS_SGI_MAX_CPUS_PER_CLUSTER,
 	CSS_SGI_MAX_CPUS_PER_CLUSTER,
-#if (CSS_SGI_PLATFORM_VARIANT == 0)
+#endif
+#if (CSS_SGI_PLATFORM_VARIANT == 0 || (CSS_SGI_PLATFORM_VARIANT == 2 && CSS_SGI_CHIP_COUNT > 2))
 	CSS_SGI_MAX_CPUS_PER_CLUSTER,
 	CSS_SGI_MAX_CPUS_PER_CLUSTER,
 	CSS_SGI_MAX_CPUS_PER_CLUSTER,
 	CSS_SGI_MAX_CPUS_PER_CLUSTER,
+#endif
+#if (CSS_SGI_PLATFORM_VARIANT == 0 || (CSS_SGI_PLATFORM_VARIANT == 2 && CSS_SGI_CHIP_COUNT > 3))
 	CSS_SGI_MAX_CPUS_PER_CLUSTER,
 	CSS_SGI_MAX_CPUS_PER_CLUSTER,
 	CSS_SGI_MAX_CPUS_PER_CLUSTER,
@@ -44,11 +48,37 @@
  * The array mapping platform core position (implemented by plat_my_core_pos())
  * to the SCMI power domain ID implemented by SCP.
  ******************************************************************************/
+#if (CSS_SGI_PLATFORM_VARIANT == 2)
 const uint32_t plat_css_core_pos_to_scmi_dmn_id_map[] = {
 	(SET_SCMI_CHANNEL_ID(0x0) | SET_SCMI_DOMAIN_ID(0x0)),
 	(SET_SCMI_CHANNEL_ID(0x0) | SET_SCMI_DOMAIN_ID(0x1)),
 	(SET_SCMI_CHANNEL_ID(0x0) | SET_SCMI_DOMAIN_ID(0x2)),
 	(SET_SCMI_CHANNEL_ID(0x0) | SET_SCMI_DOMAIN_ID(0x3)),
+#if (CSS_SGI_CHIP_COUNT > 1)
+	(SET_SCMI_CHANNEL_ID(0x1) | SET_SCMI_DOMAIN_ID(0x0)),
+	(SET_SCMI_CHANNEL_ID(0x1) | SET_SCMI_DOMAIN_ID(0x1)),
+	(SET_SCMI_CHANNEL_ID(0x1) | SET_SCMI_DOMAIN_ID(0x2)),
+	(SET_SCMI_CHANNEL_ID(0x1) | SET_SCMI_DOMAIN_ID(0x3)),
+#endif
+#if (CSS_SGI_CHIP_COUNT > 2)
+	(SET_SCMI_CHANNEL_ID(0x2) | SET_SCMI_DOMAIN_ID(0x0)),
+	(SET_SCMI_CHANNEL_ID(0x2) | SET_SCMI_DOMAIN_ID(0x1)),
+	(SET_SCMI_CHANNEL_ID(0x2) | SET_SCMI_DOMAIN_ID(0x2)),
+	(SET_SCMI_CHANNEL_ID(0x2) | SET_SCMI_DOMAIN_ID(0x3)),
+#endif
+#if (CSS_SGI_CHIP_COUNT > 3)
+	(SET_SCMI_CHANNEL_ID(0x3) | SET_SCMI_DOMAIN_ID(0x0)),
+	(SET_SCMI_CHANNEL_ID(0x3) | SET_SCMI_DOMAIN_ID(0x1)),
+	(SET_SCMI_CHANNEL_ID(0x3) | SET_SCMI_DOMAIN_ID(0x2)),
+	(SET_SCMI_CHANNEL_ID(0x3) | SET_SCMI_DOMAIN_ID(0x3)),
+#endif
+};
+#else
+const uint32_t plat_css_core_pos_to_scmi_dmn_id_map[] = {
+	(SET_SCMI_CHANNEL_ID(0x0) | SET_SCMI_DOMAIN_ID(0x0)),
+	(SET_SCMI_CHANNEL_ID(0x0) | SET_SCMI_DOMAIN_ID(0x1)),
+	(SET_SCMI_CHANNEL_ID(0x0) | SET_SCMI_DOMAIN_ID(0x2)),
+	(SET_SCMI_CHANNEL_ID(0x0) | SET_SCMI_DOMAIN_ID(0x3)),
 	(SET_SCMI_CHANNEL_ID(0x0) | SET_SCMI_DOMAIN_ID(0x4)),
 	(SET_SCMI_CHANNEL_ID(0x0) | SET_SCMI_DOMAIN_ID(0x5)),
 	(SET_SCMI_CHANNEL_ID(0x0) | SET_SCMI_DOMAIN_ID(0x6)),
@@ -64,3 +94,4 @@
 	(SET_SCMI_CHANNEL_ID(0x0) | SET_SCMI_DOMAIN_ID(0xF)),
 #endif
 };
+#endif
diff --git a/plat/arm/css/sgi/include/sgi_soc_css_def_v2.h b/plat/arm/css/sgi/include/sgi_soc_css_def_v2.h
index bebc597..639b687 100644
--- a/plat/arm/css/sgi/include/sgi_soc_css_def_v2.h
+++ b/plat/arm/css/sgi/include/sgi_soc_css_def_v2.h
@@ -92,6 +92,12 @@
 						SOC_MEMCNTRL_SIZE,		\
 						MT_DEVICE | MT_RW | MT_SECURE)
 
+#define SOC_MEMCNTRL_MAP_DEVICE_REMOTE_CHIP(n)					\
+		MAP_REGION_FLAT(						\
+			CSS_SGI_REMOTE_CHIP_MEM_OFFSET(n) + SOC_MEMCNTRL_BASE,	\
+			SOC_MEMCNTRL_SIZE,					\
+			MT_DEVICE | MT_RW | MT_SECURE)
+
 /*
  * The bootsec_bridge controls access to a bunch of peripherals, e.g. the UARTs.
  */
diff --git a/plat/arm/css/sgi/sgi_plat_v2.c b/plat/arm/css/sgi/sgi_plat_v2.c
index 131cdf2..1a2a966 100644
--- a/plat/arm/css/sgi/sgi_plat_v2.c
+++ b/plat/arm/css/sgi/sgi_plat_v2.c
@@ -42,6 +42,15 @@
 	SOC_PLATFORM_PERIPH_MAP_DEVICE,
 	SOC_SYSTEM_PERIPH_MAP_DEVICE,
 	ARM_MAP_NS_DRAM1,
+#if CSS_SGI_CHIP_COUNT > 1
+	SOC_MEMCNTRL_MAP_DEVICE_REMOTE_CHIP(1),
+#endif
+#if CSS_SGI_CHIP_COUNT > 2
+	SOC_MEMCNTRL_MAP_DEVICE_REMOTE_CHIP(2),
+#endif
+#if CSS_SGI_CHIP_COUNT > 3
+	SOC_MEMCNTRL_MAP_DEVICE_REMOTE_CHIP(3),
+#endif
 #if ARM_BL31_IN_DRAM
 	ARM_MAP_BL31_SEC_DRAM,
 #endif
diff --git a/plat/qti/msm8916/aarch64/msm8916_helpers.S b/plat/qti/msm8916/aarch64/msm8916_helpers.S
new file mode 100644
index 0000000..dad9968
--- /dev/null
+++ b/plat/qti/msm8916/aarch64/msm8916_helpers.S
@@ -0,0 +1,164 @@
+/*
+ * Copyright (c) 2021, Stephan Gerhold <stephan@gerhold.net>
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <arch.h>
+#include <asm_macros.S>
+
+#include <msm8916_mmap.h>
+
+#define APCS_TCM_START_ADDR	0x10
+#define APCS_TCM_REDIRECT_EN_0	BIT_32(0)
+
+	.globl	plat_crash_console_init
+	.globl	plat_crash_console_putc
+	.globl	plat_crash_console_flush
+	.globl	plat_panic_handler
+	.globl	plat_my_core_pos
+	.globl	plat_get_my_entrypoint
+	.globl	plat_reset_handler
+	.globl	platform_mem_init
+	.globl	msm8916_entry_point
+
+	/* -------------------------------------------------
+	 * int plat_crash_console_init(void)
+	 * Initialize the crash console.
+	 * Out: x0 - 1 on success, 0 on error
+	 * Clobber list : x0 - x4
+	 * -------------------------------------------------
+	 */
+func plat_crash_console_init
+	mov	x1, #BLSP_UART2_BASE
+
+	/*
+	 * If the non-secure world has been actively using the UART there might
+	 * be still some characters left to be sent in the FIFO. In that case,
+	 * resetting the transmitter too early might cause all output to become
+	 * corrupted. To avoid that, try to flush (wait until FIFO empty) first.
+	 */
+	mov	x4, lr
+	bl	console_uartdm_core_flush
+	mov	lr, x4
+
+	mov	x0, #1
+	b	console_uartdm_core_init
+endfunc plat_crash_console_init
+
+	/* -------------------------------------------------
+	 * int plat_crash_console_putc(int c)
+	 * Print a character on the crash console.
+	 * In : w0 - character to be printed
+	 * Out: w0 - printed character on success
+	 * Clobber list : x1, x2
+	 * -------------------------------------------------
+	 */
+func plat_crash_console_putc
+	mov	x1, #BLSP_UART2_BASE
+	b	console_uartdm_core_putc
+endfunc plat_crash_console_putc
+
+	/* -------------------------------------------------
+	 * void plat_crash_console_flush(void)
+	 * Force a write of all buffered data that has not
+	 * been output.
+	 * Clobber list : x1, x2
+	 * -------------------------------------------------
+	 */
+func plat_crash_console_flush
+	mov	x1, #BLSP_UART2_BASE
+	b	console_uartdm_core_flush
+endfunc plat_crash_console_flush
+
+	/* -------------------------------------------------
+	 * void plat_panic_handler(void) __dead
+	 * Called when an unrecoverable error occurs.
+	 * -------------------------------------------------
+	 */
+func plat_panic_handler
+	/* Try to shutdown/reset */
+	mov_imm	x0, MPM_PS_HOLD
+	str	wzr, [x0]
+1:	b	1b
+endfunc plat_panic_handler
+
+	/* -------------------------------------------------
+	 * unsigned int plat_my_core_pos(void)
+	 * Out: x0 - index of the calling CPU
+	 * -------------------------------------------------
+	 */
+func plat_my_core_pos
+	/* There is just a single cluster so this is very simple */
+	mrs	x0, mpidr_el1
+	and	x0, x0, #MPIDR_CPU_MASK
+	ret
+endfunc plat_my_core_pos
+
+	/* -------------------------------------------------
+	 * uintptr_t plat_get_my_entrypoint(void)
+	 * Distinguish cold and warm boot and return warm boot
+	 * entry address if available.
+	 * Out: x0 - warm boot entry point or 0 on cold boot
+	 * -------------------------------------------------
+	 */
+func plat_get_my_entrypoint
+	ldr	x0, msm8916_entry_point
+	ret
+endfunc plat_get_my_entrypoint
+
+	/* -------------------------------------------------
+	 * void plat_reset_handler(void)
+	 * Perform additional initialization after reset.
+	 * Clobber list : x0 - x18, x30
+	 * -------------------------------------------------
+	 */
+func plat_reset_handler
+	/*
+	 * Check if the CPU is running at the correct address.
+	 * During cold boot the CPU enters here at the wrong address
+	 * using the "boot remapper". (It remaps the BL31_BASE to
+	 * the CPU reset address 0x0).
+	 */
+	mov	x0, #BL31_BASE
+	adr	x1, bl31_entrypoint
+	cmp	x0, x1
+	b.ne	_remapped_cold_boot
+	/* Already running at correct address, just return directly */
+	ret
+
+_remapped_cold_boot:
+	/*
+	 * The previous boot stage seems to use the L2 cache as TCM.
+	 * Disable the TCM redirect before enabling caches to avoid
+	 * strange crashes.
+	 */
+	mov	x2, #APCS_CFG
+	ldr	w3, [x2, #APCS_TCM_START_ADDR]
+	and	w3, w3, #~APCS_TCM_REDIRECT_EN_0
+	str	w3, [x2, #APCS_TCM_START_ADDR]
+
+	/* Enter BL31 again at the real address */
+	br	x0
+endfunc plat_reset_handler
+
+	/* -------------------------------------------------
+	 * void platform_mem_init(void)
+	 * Performs additional memory initialization early
+	 * in the boot process.
+	 * -------------------------------------------------
+	 */
+func platform_mem_init
+	/* Nothing to do here, all memory is already initialized */
+	ret
+endfunc platform_mem_init
+
+	.data
+	.align	3
+
+	/* -------------------------------------------------
+	 * Warm boot entry point for CPU. Set by PSCI code.
+	 * -------------------------------------------------
+	 */
+msm8916_entry_point:
+	.quad	0
diff --git a/plat/qti/msm8916/aarch64/uartdm_console.S b/plat/qti/msm8916/aarch64/uartdm_console.S
new file mode 100644
index 0000000..c69c193
--- /dev/null
+++ b/plat/qti/msm8916/aarch64/uartdm_console.S
@@ -0,0 +1,154 @@
+/*
+ * Copyright (c) 2021, Stephan Gerhold <stephan@gerhold.net>
+ *
+ * Based on aarch64/skeleton_console.S:
+ * Copyright (c) 2015-2020, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <asm_macros.S>
+#include <console_macros.S>
+
+/* UART DM registers */
+#define UART_DM_DMEN		0x03c		/* DMA / data packing */
+#define UART_DM_SR		0x0a4		/* status register */
+#define UART_DM_CR		0x0a8		/* command register */
+#define UART_DM_TF		0x100		/* transmit FIFO */
+
+#define UART_DM_DMEN_TX_SC	BIT_32(4)	/* TX single character mode */
+
+#define UART_DM_SR_TXRDY_BIT	2		/* TX FIFO has space */
+#define UART_DM_SR_TXEMT_BIT	3		/* TX FIFO is empty */
+
+#define UART_DM_CR_RESET_RX	(U(0x01) << 4)	/* reset receiver */
+#define UART_DM_CR_RESET_TX	(U(0x02) << 4)	/* reset transmitter */
+#define UART_DM_CR_TX_ENABLE	BIT_32(2)	/* enable transmitter */
+
+	.globl	console_uartdm_register
+	.globl	console_uartdm_core_init
+	.globl	console_uartdm_putc
+	.globl	console_uartdm_core_putc
+	.globl	console_uartdm_flush
+	.globl	console_uartdm_core_flush
+
+	/* -----------------------------------------------------------
+	 * int console_uartdm_register(console_t *console,
+	 * 	uintptr_t base_addr)
+	 * Function to initialize and register the console. The caller
+	 * needs to pass an empty console_t structure in which *MUST*
+	 * be allocated in persistent memory (e.g. a global or static
+	 * local variable, *NOT* on the stack).
+	 * In : x0 - pointer to empty console_t structure
+	 *      x1 - base address
+	 * Out: x0 - 1 on success, 0 on error
+	 * Clobber list : x0 - x7
+	 * -----------------------------------------------------------
+	 */
+func console_uartdm_register
+	str	x1, [x0, #CONSOLE_T_BASE]
+	mov	x7, lr
+	bl	console_uartdm_core_init
+	mov	lr, x7
+
+	/* Register the new console */
+	finish_console_register uartdm putc=1, flush=1
+endfunc console_uartdm_register
+
+	/* -----------------------------------------------------------
+	 * void console_uartdm_core_init(unused, uintptr_t base_addr)
+	 * Function to initialize the console.
+	 * In : x0 - unused
+	 *      x1 - base address
+	 * Out: void
+	 * Clobber list : x1, x2, x3
+	 * -----------------------------------------------------------
+	 */
+func console_uartdm_core_init
+	/* Reset receiver */
+	mov	w3, #UART_DM_CR_RESET_RX
+	str	w3, [x1, #UART_DM_CR]
+
+	/* Reset transmitter */
+	mov	w3, #UART_DM_CR_RESET_TX
+	str	w3, [x1, #UART_DM_CR]
+
+	/*
+	 * Disable BAM/DMA modes but enable single-character mode for TX.
+	 * The single character mode allows simplifying the putc implementation
+	 * since characters can be written directly to the FIFO instead of
+	 * having to initiate a new transfer and waiting for its completion.
+	 */
+	mov	w3, #UART_DM_DMEN_TX_SC
+	str	w3, [x1, #UART_DM_DMEN]
+
+	/* Enable transmitter */
+	mov	w3, #UART_DM_CR_TX_ENABLE
+	str	w3, [x1, #UART_DM_CR]
+
+	ret
+endfunc console_uartdm_core_init
+
+	/* -----------------------------------------------------------
+	 * int console_uartdm_putc(int c, console_t *console)
+	 * Function to output a character over the console.
+	 * In : w0 - character to be printed
+	 *      x1 - pointer to console_t struct
+	 * Out: w0 - printed character on success, < 0 on error.
+	 * Clobber list : x0, x1, x2
+	 * -----------------------------------------------------------
+	 */
+func console_uartdm_putc
+	ldr	x1, [x1, #CONSOLE_T_BASE]
+	b	console_uartdm_core_putc
+endfunc console_uartdm_putc
+
+	/* -----------------------------------------------------------
+	 * int console_uartdm_core_putc(int c, uintptr_t base_addr)
+	 * Function to output a character over the console.
+	 * In : w0 - character to be printed
+	 *      x1 - base address
+	 * Out: w0 - printed character on success, < 0 on error.
+	 * Clobber list : x2
+	 * -----------------------------------------------------------
+	 */
+func console_uartdm_core_putc
+1:	/* Loop until TX FIFO has space */
+	ldr	w2, [x1, #UART_DM_SR]
+	tbz	w2, #UART_DM_SR_TXRDY_BIT, 1b
+
+	/* Write character to FIFO */
+	str	w0, [x1, #UART_DM_TF]
+	ret
+endfunc console_uartdm_core_putc
+
+	/* -----------------------------------------------------------
+	 * void console_uartdm_flush(console_t *console)
+	 * Function to force a write of all buffered data
+	 * that has not been output.
+	 * In : x0 - pointer to console_t struct
+	 * Out: void
+	 * Clobber list : x0, x1, x2, x3, x4, x5
+	 * -----------------------------------------------------------
+	 */
+func console_uartdm_flush
+	ldr	x1, [x0, #CONSOLE_T_BASE]
+	b	console_uartdm_core_flush
+endfunc console_uartdm_flush
+
+	/* -----------------------------------------------------------
+	 * void console_uartdm_core_flush(unused, uintptr_t base_addr)
+	 * Function to force a write of all buffered data
+	 * that has not been output.
+	 * In : x0 - unused
+	 *      x1 - base address
+	 * Out: void
+	 * Clobber list : x2
+	 * -----------------------------------------------------------
+	 */
+func console_uartdm_core_flush
+1:	/* Loop until TX FIFO is empty */
+	ldr	w2, [x1, #UART_DM_SR]
+	tbz	w2, #UART_DM_SR_TXEMT_BIT, 1b
+	ret
+endfunc console_uartdm_core_flush
diff --git a/plat/qti/msm8916/include/msm8916_mmap.h b/plat/qti/msm8916/include/msm8916_mmap.h
new file mode 100644
index 0000000..406ae6b
--- /dev/null
+++ b/plat/qti/msm8916/include/msm8916_mmap.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2021, Stephan Gerhold <stephan@gerhold.net>
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#ifndef MSM8916_MMAP_H
+#define MSM8916_MMAP_H
+
+#define PCNOC_BASE		0x00000000
+#define PCNOC_SIZE		0x8000000	/* 128 MiB */
+#define APCS_BASE		0x0b000000
+#define APCS_SIZE		0x800000	/* 8 MiB */
+
+#define MPM_BASE		(PCNOC_BASE + 0x04a0000)
+#define MPM_PS_HOLD		(MPM_BASE + 0xb000)
+
+#define TLMM_BASE		(PCNOC_BASE + 0x1000000)
+#define TLMM_GPIO_CFG(n)	(TLMM_BASE + ((n) * 0x1000))
+
+#define GCC_BASE		(PCNOC_BASE + 0x1800000)
+
+#define APPS_SMMU_BASE		(PCNOC_BASE + 0x1e00000)
+#define APPS_SMMU_QCOM		(APPS_SMMU_BASE + 0xf0000)
+
+#define BLSP_UART1_BASE		(PCNOC_BASE + 0x78af000)
+#define BLSP_UART2_BASE		(PCNOC_BASE + 0x78b0000)
+
+#define APCS_QGIC2_BASE		(APCS_BASE + 0x00000)
+#define APCS_QGIC2_GICD		(APCS_QGIC2_BASE + 0x0000)
+#define APCS_QGIC2_GICC		(APCS_QGIC2_BASE + 0x2000)
+#define APCS_BANKED_ACS		(APCS_BASE + 0x08000)
+#define APCS_BANKED_SAW2	(APCS_BASE + 0x09000)
+#define APCS_CFG		(APCS_BASE + 0x10000)
+#define APCS_GLB		(APCS_BASE + 0x11000)
+#define APCS_L2_SAW2		(APCS_BASE + 0x12000)
+#define APCS_QTMR		(APCS_BASE + 0x20000)
+#define APCS_ALIAS_ACS(cpu)	(APCS_BASE + 0x88000 + ((cpu) * 0x10000))
+#define APCS_ALIAS_SAW2(cpu)	(APCS_BASE + 0x89000 + ((cpu) * 0x10000))
+
+#endif /* MSM8916_MMAP_H */
diff --git a/plat/qti/msm8916/include/plat_macros.S b/plat/qti/msm8916/include/plat_macros.S
new file mode 100644
index 0000000..552add2
--- /dev/null
+++ b/plat/qti/msm8916/include/plat_macros.S
@@ -0,0 +1,27 @@
+/*
+ * Copyright (c) 2017-2021, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#ifndef PLAT_MACROS_S
+#define PLAT_MACROS_S
+
+#include <arm_macros.S>
+
+#include <msm8916_mmap.h>
+
+	/* ---------------------------------------------
+	 * The below required platform porting macro
+	 * prints out relevant GIC registers whenever
+	 * an unhandled exception is taken in BL31.
+	 * Clobbers: x0 - x10, x16, x17, sp
+	 * ---------------------------------------------
+	 */
+	.macro plat_crash_print_regs
+	mov_imm	x16, APCS_QGIC2_GICD
+	mov_imm	x17, APCS_QGIC2_GICC
+	arm_print_gic_regs
+	.endm
+
+#endif /* PLAT_MACROS_S */
diff --git a/plat/qti/msm8916/include/platform_def.h b/plat/qti/msm8916/include/platform_def.h
new file mode 100644
index 0000000..bfade70
--- /dev/null
+++ b/plat/qti/msm8916/include/platform_def.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (c) 2021, Stephan Gerhold <stephan@gerhold.net>
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+#ifndef PLATFORM_DEF_H
+#define PLATFORM_DEF_H
+
+#include <plat/common/common_def.h>
+
+/*
+ * There is at least 1 MiB available for BL31. However, at the moment the
+ * "msm8916_entry_point" variable in the data section is read through the
+ * 64 KiB region of the "boot remapper" after reset. For simplicity, limit
+ * the end of the data section (BL31_PROGBITS_LIMIT) to 64 KiB for now and
+ * the overall limit to 128 KiB. This could be increased if needed by placing
+ * the "msm8916_entry_point" variable explicitly in the first 64 KiB of BL31.
+ */
+#define BL31_LIMIT			(BL31_BASE + 0x20000)	/* 128 KiB */
+#define BL31_PROGBITS_LIMIT		(BL31_BASE + 0x10000)	/* 64 KiB */
+
+#define CACHE_WRITEBACK_GRANULE		U(64)
+#define PLATFORM_STACK_SIZE		U(0x1000)
+
+/* CPU topology: single cluster with 4 cores */
+#define PLATFORM_CLUSTER_COUNT		U(1)
+#define PLATFORM_MAX_CPUS_PER_CLUSTER	U(4)
+#define PLATFORM_CORE_COUNT		(PLATFORM_CLUSTER_COUNT * \
+					 PLATFORM_MAX_CPUS_PER_CLUSTER)
+
+/* Power management */
+#define PLATFORM_SYSTEM_COUNT		U(1)
+#define PLAT_NUM_PWR_DOMAINS		(PLATFORM_SYSTEM_COUNT + \
+					 PLATFORM_CLUSTER_COUNT + \
+					 PLATFORM_CORE_COUNT)
+#define PLAT_MAX_PWR_LVL		MPIDR_AFFLVL2
+#define PLAT_MAX_RET_STATE		U(2)
+#define PLAT_MAX_OFF_STATE		U(3)
+
+/* Translation tables */
+#define MAX_MMAP_REGIONS		8
+#define MAX_XLAT_TABLES			4
+
+#define PLAT_PHY_ADDR_SPACE_SIZE	(ULL(1) << 32)
+#define PLAT_VIRT_ADDR_SPACE_SIZE	(ULL(1) << 32)
+
+/* Timer frequency */
+#define PLAT_SYSCNT_FREQ		19200000
+
+/*
+ * The Qualcomm QGIC2 implementation seems to have PIDR0-4 and PIDR4-7
+ * erroneously swapped for some reason. PIDR2 is actually at 0xFD8.
+ * Override the address in <drivers/arm/gicv2.h> to avoid a failing assert().
+ */
+#define GICD_PIDR2_GICV2		U(0xFD8)
+
+#endif /* PLATFORM_DEF_H */
diff --git a/plat/qti/msm8916/include/uartdm_console.h b/plat/qti/msm8916/include/uartdm_console.h
new file mode 100644
index 0000000..0f09ba8
--- /dev/null
+++ b/plat/qti/msm8916/include/uartdm_console.h
@@ -0,0 +1,12 @@
+/*
+ * Copyright (c) 2021, Stephan Gerhold <stephan@gerhold.net>
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#ifndef UARTDM_CONSOLE_H
+#define UARTDM_CONSOLE_H
+
+int console_uartdm_register(console_t *console, uintptr_t base_addr);
+
+#endif /* UARTDM_CONSOLE_H */
diff --git a/plat/qti/msm8916/msm8916_bl31_setup.c b/plat/qti/msm8916/msm8916_bl31_setup.c
new file mode 100644
index 0000000..638cd09
--- /dev/null
+++ b/plat/qti/msm8916/msm8916_bl31_setup.c
@@ -0,0 +1,219 @@
+/*
+ * Copyright (c) 2021, Stephan Gerhold <stephan@gerhold.net>
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <assert.h>
+
+#include <arch.h>
+#include <common/debug.h>
+#include <drivers/console.h>
+#include <drivers/generic_delay_timer.h>
+#include <lib/mmio.h>
+#include <lib/xlat_tables/xlat_mmu_helpers.h>
+#include <lib/xlat_tables/xlat_tables_v2.h>
+#include <plat/common/platform.h>
+
+#include "msm8916_gicv2.h"
+#include <msm8916_mmap.h>
+#include <platform_def.h>
+#include <uartdm_console.h>
+
+static const mmap_region_t msm8916_mmap[] = {
+	MAP_REGION_FLAT(PCNOC_BASE, PCNOC_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE | MT_EXECUTE_NEVER),
+	MAP_REGION_FLAT(APCS_BASE, APCS_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE | MT_EXECUTE_NEVER),
+	{},
+};
+
+static struct {
+	entry_point_info_t bl32;
+	entry_point_info_t bl33;
+} image_ep_info = {
+	/* BL32 entry point */
+	SET_STATIC_PARAM_HEAD(bl32, PARAM_EP, VERSION_1,
+			      entry_point_info_t, SECURE),
+	.bl32.pc = BL32_BASE,
+
+	/* BL33 entry point */
+	SET_STATIC_PARAM_HEAD(bl33, PARAM_EP, VERSION_1,
+			      entry_point_info_t, NON_SECURE),
+	.bl33.pc = PRELOADED_BL33_BASE,
+	.bl33.spsr = SPSR_64(MODE_EL2, MODE_SP_ELX, DISABLE_ALL_EXCEPTIONS),
+};
+
+static console_t console;
+
+unsigned int plat_get_syscnt_freq2(void)
+{
+	return PLAT_SYSCNT_FREQ;
+}
+
+#define CLK_ENABLE			BIT_32(0)
+#define CLK_OFF				BIT_32(31)
+
+#define GPIO_BLSP_UART2_TX		4
+#define GPIO_BLSP_UART2_RX		5
+#define GPIO_CFG_FUNC_BLSP_UART2	(U(0x2) << 2)
+#define GPIO_CFG_DRV_STRENGTH_16MA	(U(0x7) << 6)
+
+#define GCC_BLSP1_AHB_CBCR		(GCC_BASE + 0x01008)
+#define GCC_BLSP1_UART2_APPS_CBCR	(GCC_BASE + 0x0302c)
+#define GCC_APCS_CLOCK_BRANCH_ENA_VOTE	(GCC_BASE + 0x45004)
+#define BLSP1_AHB_CLK_ENA		BIT_32(10)
+
+/*
+ * The previous boot stage seems to disable most of the UART setup before exit
+ * so it must be enabled here again before the UART console can be used.
+ */
+static void msm8916_enable_blsp_uart2(void)
+{
+	/* Route GPIOs to BLSP UART2 */
+	mmio_write_32(TLMM_GPIO_CFG(GPIO_BLSP_UART2_TX),
+		      GPIO_CFG_FUNC_BLSP_UART2 | GPIO_CFG_DRV_STRENGTH_16MA);
+	mmio_write_32(TLMM_GPIO_CFG(GPIO_BLSP_UART2_RX),
+		      GPIO_CFG_FUNC_BLSP_UART2 | GPIO_CFG_DRV_STRENGTH_16MA);
+
+	/* Enable AHB clock */
+	mmio_setbits_32(GCC_APCS_CLOCK_BRANCH_ENA_VOTE, BLSP1_AHB_CLK_ENA);
+	while (mmio_read_32(GCC_BLSP1_AHB_CBCR) & CLK_OFF)
+		;
+
+	/* Enable BLSP UART2 clock */
+	mmio_setbits_32(GCC_BLSP1_UART2_APPS_CBCR, CLK_ENABLE);
+	while (mmio_read_32(GCC_BLSP1_UART2_APPS_CBCR) & CLK_OFF)
+		;
+}
+
+void bl31_early_platform_setup2(u_register_t arg0, u_register_t arg1,
+				u_register_t arg2, u_register_t arg3)
+{
+	/* Initialize the debug console as early as possible */
+	msm8916_enable_blsp_uart2();
+	console_uartdm_register(&console, BLSP_UART2_BASE);
+}
+
+void bl31_plat_arch_setup(void)
+{
+	mmap_add_region(BL31_BASE, BL31_BASE, BL31_END - BL31_BASE,
+			MT_RW_DATA | MT_SECURE);
+	mmap_add_region(BL_CODE_BASE, BL_CODE_BASE,
+			BL_CODE_END - BL_CODE_BASE,
+			MT_CODE | MT_SECURE);
+	mmap_add_region(BL_RO_DATA_BASE, BL_RO_DATA_BASE,
+			BL_RO_DATA_END - BL_RO_DATA_BASE,
+			MT_RO_DATA | MT_SECURE);
+	mmap_add_region(BL_COHERENT_RAM_BASE, BL_COHERENT_RAM_BASE,
+			BL_COHERENT_RAM_END - BL_COHERENT_RAM_BASE,
+			MT_DEVICE | MT_RW | MT_SECURE | MT_EXECUTE_NEVER);
+
+	mmap_add(msm8916_mmap);
+	init_xlat_tables();
+	enable_mmu_el3(0);
+}
+
+static void msm8916_configure_timer(void)
+{
+	/* Set timer frequency */
+	mmio_write_32(APCS_QTMR + CNTCTLBASE_CNTFRQ, plat_get_syscnt_freq2());
+
+	/* Make frame 0 available to non-secure world */
+	mmio_write_32(APCS_QTMR + CNTNSAR, BIT_32(CNTNSAR_NS_SHIFT(0)));
+	mmio_write_32(APCS_QTMR + CNTACR_BASE(0),
+		      BIT_32(CNTACR_RPCT_SHIFT) | BIT_32(CNTACR_RVCT_SHIFT) |
+		      BIT_32(CNTACR_RFRQ_SHIFT) | BIT_32(CNTACR_RVOFF_SHIFT) |
+		      BIT_32(CNTACR_RWVT_SHIFT) | BIT_32(CNTACR_RWPT_SHIFT));
+}
+
+/*
+ * The APCS register regions always start with a SECURE register that should
+ * be cleared to 0 to only allow secure access. Since BL31 handles most of
+ * the CPU power management, most of them can be cleared to secure access only.
+ */
+#define APCS_GLB_SECURE_STS_NS		BIT_32(0)
+#define APCS_GLB_SECURE_PWR_NS		BIT_32(1)
+#define APCS_BOOT_START_ADDR_SEC	(APCS_CFG + 0x04)
+#define REMAP_EN			BIT_32(0)
+#define APCS_AA64NAA32_REG		(APCS_CFG + 0x0c)
+
+static void msm8916_configure_cpu_pm(void)
+{
+	unsigned int cpu;
+
+	/* Disallow non-secure access to boot remapper / TCM registers */
+	mmio_write_32(APCS_CFG, 0);
+
+	/*
+	 * Disallow non-secure access to power management registers.
+	 * However, allow STS and PWR since those also seem to control access
+	 * to CPU frequency related registers (e.g. APCS_CMD_RCGR). If these
+	 * bits are not set, CPU frequency control fails in the non-secure world.
+	 */
+	mmio_write_32(APCS_GLB, APCS_GLB_SECURE_STS_NS | APCS_GLB_SECURE_PWR_NS);
+
+	/* Disallow non-secure access to L2 SAW2 */
+	mmio_write_32(APCS_L2_SAW2, 0);
+
+	/* Disallow non-secure access to CPU ACS and SAW2 */
+	for (cpu = 0; cpu < PLATFORM_CORE_COUNT; cpu++) {
+		mmio_write_32(APCS_ALIAS_ACS(cpu), 0);
+		mmio_write_32(APCS_ALIAS_SAW2(cpu), 0);
+	}
+
+	/* Make sure all further warm boots end up in BL31 and aarch64 state */
+	CASSERT((BL31_BASE & 0xffff) == 0, assert_bl31_base_64k_aligned);
+	mmio_write_32(APCS_BOOT_START_ADDR_SEC, BL31_BASE | REMAP_EN);
+	mmio_write_32(APCS_AA64NAA32_REG, 1);
+}
+
+/*
+ * MSM8916 has a special "interrupt aggregation logic" in the APPS SMMU,
+ * which allows routing context bank interrupts to one of 3 interrupt numbers
+ * ("TZ/HYP/NS"). Route all interrupts to the non-secure interrupt number
+ * by default to avoid special setup on the non-secure side.
+ */
+#define GCC_SMMU_CFG_CBCR			(GCC_BASE + 0x12038)
+#define GCC_APCS_SMMU_CLOCK_BRANCH_ENA_VOTE	(GCC_BASE + 0x4500c)
+#define SMMU_CFG_CLK_ENA			BIT_32(12)
+#define APPS_SMMU_INTR_SEL_NS			(APPS_SMMU_QCOM + 0x2000)
+#define APPS_SMMU_INTR_SEL_NS_EN_ALL		U(0xffffffff)
+
+static void msm8916_configure_smmu(void)
+{
+	/* Enable SMMU configuration clock to enable register access */
+	mmio_setbits_32(GCC_APCS_SMMU_CLOCK_BRANCH_ENA_VOTE, SMMU_CFG_CLK_ENA);
+	while (mmio_read_32(GCC_SMMU_CFG_CBCR) & CLK_OFF)
+		;
+
+	/* Route all context bank interrupts to non-secure interrupt */
+	mmio_write_32(APPS_SMMU_INTR_SEL_NS, APPS_SMMU_INTR_SEL_NS_EN_ALL);
+
+	/* Disable configuration clock again */
+	mmio_clrbits_32(GCC_APCS_SMMU_CLOCK_BRANCH_ENA_VOTE, SMMU_CFG_CLK_ENA);
+}
+
+void bl31_platform_setup(void)
+{
+	INFO("BL31: Platform setup start\n");
+	generic_delay_timer_init();
+	msm8916_configure_timer();
+	msm8916_gicv2_init();
+	msm8916_configure_cpu_pm();
+	msm8916_configure_smmu();
+	INFO("BL31: Platform setup done\n");
+}
+
+entry_point_info_t *bl31_plat_get_next_image_ep_info(uint32_t type)
+{
+	switch (type) {
+	case SECURE:
+		return &image_ep_info.bl32;
+	case NON_SECURE:
+		return &image_ep_info.bl33;
+	default:
+		assert(sec_state_is_valid(type));
+		return NULL;
+	}
+}
diff --git a/plat/qti/msm8916/msm8916_cpu_boot.c b/plat/qti/msm8916/msm8916_cpu_boot.c
new file mode 100644
index 0000000..b3f51f6
--- /dev/null
+++ b/plat/qti/msm8916/msm8916_cpu_boot.c
@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2021, Stephan Gerhold <stephan@gerhold.net>
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <arch_helpers.h>
+#include <drivers/delay_timer.h>
+#include <lib/mmio.h>
+
+#include <msm8916_mmap.h>
+#include "msm8916_pm.h"
+
+#define CPU_PWR_CTL			0x4
+#define APC_PWR_GATE_CTL		0x14
+
+#define CPU_PWR_CTL_CLAMP		BIT_32(0)
+#define CPU_PWR_CTL_CORE_MEM_CLAMP	BIT_32(1)
+#define CPU_PWR_CTL_L1_RST_DIS		BIT_32(2)
+#define CPU_PWR_CTL_CORE_MEM_HS		BIT_32(3)
+#define CPU_PWR_CTL_CORE_RST		BIT_32(4)
+#define CPU_PWR_CTL_COREPOR_RST		BIT_32(5)
+#define CPU_PWR_CTL_GATE_CLK		BIT_32(6)
+#define CPU_PWR_CTL_CORE_PWRD_UP	BIT_32(7)
+
+#define APC_PWR_GATE_CTL_GHDS_EN	BIT_32(0)
+#define APC_PWR_GATE_CTL_GHDS_CNT(cnt)	((cnt) << 24)
+
+/* Boot a secondary CPU core for the first time. */
+void msm8916_cpu_boot(unsigned int core)
+{
+	uintptr_t acs = APCS_ALIAS_ACS(core);
+	uint32_t pwr_ctl;
+
+	pwr_ctl = CPU_PWR_CTL_CLAMP | CPU_PWR_CTL_CORE_MEM_CLAMP |
+		  CPU_PWR_CTL_CORE_RST | CPU_PWR_CTL_COREPOR_RST;
+	mmio_write_32(acs + CPU_PWR_CTL, pwr_ctl);
+	dsb();
+
+	mmio_write_32(acs + APC_PWR_GATE_CTL, APC_PWR_GATE_CTL_GHDS_EN |
+		      APC_PWR_GATE_CTL_GHDS_CNT(16));
+	dsb();
+	udelay(2);
+
+	pwr_ctl &= ~CPU_PWR_CTL_CORE_MEM_CLAMP;
+	mmio_write_32(acs + CPU_PWR_CTL, pwr_ctl);
+	dsb();
+
+	pwr_ctl |= CPU_PWR_CTL_CORE_MEM_HS;
+	mmio_write_32(acs + CPU_PWR_CTL, pwr_ctl);
+	dsb();
+	udelay(2);
+
+	pwr_ctl &= ~CPU_PWR_CTL_CLAMP;
+	mmio_write_32(acs + CPU_PWR_CTL, pwr_ctl);
+	dsb();
+	udelay(2);
+
+	pwr_ctl &= ~(CPU_PWR_CTL_CORE_RST | CPU_PWR_CTL_COREPOR_RST);
+	mmio_write_32(acs + CPU_PWR_CTL, pwr_ctl);
+	dsb();
+
+	pwr_ctl |= CPU_PWR_CTL_CORE_PWRD_UP;
+	mmio_write_32(acs + CPU_PWR_CTL, pwr_ctl);
+	dsb();
+}
diff --git a/plat/qti/msm8916/msm8916_gicv2.c b/plat/qti/msm8916/msm8916_gicv2.c
new file mode 100644
index 0000000..25a6628
--- /dev/null
+++ b/plat/qti/msm8916/msm8916_gicv2.c
@@ -0,0 +1,59 @@
+/*
+ * Copyright (c) 2021, Stephan Gerhold <stephan@gerhold.net>
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <common/debug.h>
+#include <drivers/arm/gicv2.h>
+#include <lib/mmio.h>
+
+#include "msm8916_gicv2.h"
+#include <msm8916_mmap.h>
+
+#define IRQ_SEC_SGI_0		8
+#define IRQ_SEC_SGI_1		9
+#define IRQ_SEC_SGI_2		10
+#define IRQ_SEC_SGI_3		11
+#define IRQ_SEC_SGI_4		12
+#define IRQ_SEC_SGI_5		13
+#define IRQ_SEC_SGI_6		14
+#define IRQ_SEC_SGI_7		15
+
+#define IRQ_SEC_PHY_TIMER	(16 + 2)	/* PPI #2 */
+
+static const interrupt_prop_t msm8916_interrupt_props[] = {
+	INTR_PROP_DESC(IRQ_SEC_SGI_0, GIC_HIGHEST_SEC_PRIORITY,
+		       GICV2_INTR_GROUP0, GIC_INTR_CFG_LEVEL),
+	INTR_PROP_DESC(IRQ_SEC_SGI_1, GIC_HIGHEST_SEC_PRIORITY,
+		       GICV2_INTR_GROUP0, GIC_INTR_CFG_LEVEL),
+	INTR_PROP_DESC(IRQ_SEC_SGI_2, GIC_HIGHEST_SEC_PRIORITY,
+		       GICV2_INTR_GROUP0, GIC_INTR_CFG_LEVEL),
+	INTR_PROP_DESC(IRQ_SEC_SGI_3, GIC_HIGHEST_SEC_PRIORITY,
+		       GICV2_INTR_GROUP0, GIC_INTR_CFG_LEVEL),
+	INTR_PROP_DESC(IRQ_SEC_SGI_4, GIC_HIGHEST_SEC_PRIORITY,
+		       GICV2_INTR_GROUP0, GIC_INTR_CFG_LEVEL),
+	INTR_PROP_DESC(IRQ_SEC_SGI_5, GIC_HIGHEST_SEC_PRIORITY,
+		       GICV2_INTR_GROUP0, GIC_INTR_CFG_LEVEL),
+	INTR_PROP_DESC(IRQ_SEC_SGI_6, GIC_HIGHEST_SEC_PRIORITY,
+		       GICV2_INTR_GROUP0, GIC_INTR_CFG_LEVEL),
+	INTR_PROP_DESC(IRQ_SEC_SGI_7, GIC_HIGHEST_SEC_PRIORITY,
+		       GICV2_INTR_GROUP0, GIC_INTR_CFG_LEVEL),
+	INTR_PROP_DESC(IRQ_SEC_PHY_TIMER, GIC_HIGHEST_SEC_PRIORITY,
+		       GICV2_INTR_GROUP0, GIC_INTR_CFG_LEVEL),
+};
+
+static const gicv2_driver_data_t msm8916_gic_data = {
+	.gicd_base		= APCS_QGIC2_GICD,
+	.gicc_base		= APCS_QGIC2_GICC,
+	.interrupt_props	= msm8916_interrupt_props,
+	.interrupt_props_num	= ARRAY_SIZE(msm8916_interrupt_props),
+};
+
+void msm8916_gicv2_init(void)
+{
+	gicv2_driver_init(&msm8916_gic_data);
+	gicv2_distif_init();
+	gicv2_pcpu_distif_init();
+	gicv2_cpuif_enable();
+}
diff --git a/plat/qti/msm8916/msm8916_gicv2.h b/plat/qti/msm8916/msm8916_gicv2.h
new file mode 100644
index 0000000..99db0d3
--- /dev/null
+++ b/plat/qti/msm8916/msm8916_gicv2.h
@@ -0,0 +1,12 @@
+/*
+ * Copyright (c) 2021, Stephan Gerhold <stephan@gerhold.net>
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#ifndef MSM8916_GICV2_H
+#define MSM8916_GICV2_H
+
+void msm8916_gicv2_init(void);
+
+#endif /* MSM8916_GICV2_H */
diff --git a/plat/qti/msm8916/msm8916_pm.c b/plat/qti/msm8916/msm8916_pm.c
new file mode 100644
index 0000000..6891e38
--- /dev/null
+++ b/plat/qti/msm8916/msm8916_pm.c
@@ -0,0 +1,59 @@
+/*
+ * Copyright (c) 2021, Stephan Gerhold <stephan@gerhold.net>
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <arch.h>
+#include <common/debug.h>
+#include <drivers/arm/gicv2.h>
+#include <drivers/delay_timer.h>
+#include <lib/mmio.h>
+#include <lib/psci/psci.h>
+#include <plat/common/platform.h>
+
+#include <msm8916_mmap.h>
+#include "msm8916_pm.h"
+
+static int msm8916_pwr_domain_on(u_register_t mpidr)
+{
+	unsigned int core = MPIDR_AFFLVL0_VAL(mpidr);
+
+	VERBOSE("PSCI: Booting CPU %d\n", core);
+	msm8916_cpu_boot(core);
+
+	return PSCI_E_SUCCESS;
+}
+
+static void msm8916_pwr_domain_on_finish(const psci_power_state_t *target_state)
+{
+	gicv2_pcpu_distif_init();
+	gicv2_cpuif_enable();
+}
+
+static void __dead2 msm8916_system_reset(void)
+{
+	mmio_write_32(MPM_PS_HOLD, 0);
+	mdelay(1000);
+
+	ERROR("PSCI: System reset failed\n");
+	panic();
+}
+
+static const plat_psci_ops_t msm8916_psci_ops = {
+	.pwr_domain_on			= msm8916_pwr_domain_on,
+	.pwr_domain_on_finish		= msm8916_pwr_domain_on_finish,
+	.system_off			= msm8916_system_reset,
+	.system_reset			= msm8916_system_reset,
+};
+
+/* Defined and used in msm8916_helpers.S */
+extern uintptr_t msm8916_entry_point;
+
+int plat_setup_psci_ops(uintptr_t sec_entrypoint,
+			const plat_psci_ops_t **psci_ops)
+{
+	msm8916_entry_point = sec_entrypoint;
+	*psci_ops = &msm8916_psci_ops;
+	return 0;
+}
diff --git a/plat/qti/msm8916/msm8916_pm.h b/plat/qti/msm8916/msm8916_pm.h
new file mode 100644
index 0000000..5473bfa
--- /dev/null
+++ b/plat/qti/msm8916/msm8916_pm.h
@@ -0,0 +1,12 @@
+/*
+ * Copyright (c) 2021, Stephan Gerhold <stephan@gerhold.net>
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#ifndef MSM8916_PM_H
+#define MSM8916_PM_H
+
+void msm8916_cpu_boot(unsigned int core);
+
+#endif /* MSM8916_PM_H */
diff --git a/plat/qti/msm8916/msm8916_topology.c b/plat/qti/msm8916/msm8916_topology.c
new file mode 100644
index 0000000..4d0ed8f
--- /dev/null
+++ b/plat/qti/msm8916/msm8916_topology.c
@@ -0,0 +1,35 @@
+/*
+ * Copyright (c) 2017-2021, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <arch.h>
+#include <plat/common/platform.h>
+
+#include <platform_def.h>
+
+static const unsigned char plat_power_domain_tree_desc[PLAT_MAX_PWR_LVL + 1] = {
+	PLATFORM_SYSTEM_COUNT,
+	PLATFORM_CLUSTER_COUNT,
+	PLATFORM_MAX_CPUS_PER_CLUSTER,
+};
+
+int plat_core_pos_by_mpidr(u_register_t mpidr)
+{
+	unsigned int core = MPIDR_AFFLVL0_VAL(mpidr);
+
+	if (MPIDR_AFFLVL3_VAL(mpidr) > 0 ||
+	    MPIDR_AFFLVL2_VAL(mpidr) > 0 ||
+	    MPIDR_AFFLVL1_VAL(mpidr) > 0 ||
+	    core >= PLATFORM_MAX_CPUS_PER_CLUSTER) {
+		return -1;
+	}
+
+	return core;
+}
+
+const unsigned char *plat_get_power_domain_tree_desc(void)
+{
+	return plat_power_domain_tree_desc;
+}
diff --git a/plat/qti/msm8916/platform.mk b/plat/qti/msm8916/platform.mk
new file mode 100644
index 0000000..e516cea
--- /dev/null
+++ b/plat/qti/msm8916/platform.mk
@@ -0,0 +1,62 @@
+#
+# Copyright (c) 2021, Stephan Gerhold <stephan@gerhold.net>
+#
+# SPDX-License-Identifier: BSD-3-Clause
+#
+
+include drivers/arm/gic/v2/gicv2.mk
+include lib/xlat_tables_v2/xlat_tables.mk
+
+PLAT_BL_COMMON_SOURCES	:= ${XLAT_TABLES_LIB_SRCS}
+
+PLAT_INCLUDES	:=	-Iinclude/plat/arm/common/${ARCH}		\
+			-Iplat/qti/msm8916/include
+
+BL31_SOURCES	+=	${GICV2_SOURCES}				\
+			drivers/delay_timer/delay_timer.c		\
+			drivers/delay_timer/generic_delay_timer.c	\
+			lib/cpus/${ARCH}/cortex_a53.S			\
+			plat/common/plat_gicv2.c			\
+			plat/common/plat_psci_common.c			\
+			plat/qti/msm8916/msm8916_bl31_setup.c		\
+			plat/qti/msm8916/msm8916_cpu_boot.c		\
+			plat/qti/msm8916/msm8916_gicv2.c		\
+			plat/qti/msm8916/msm8916_pm.c			\
+			plat/qti/msm8916/msm8916_topology.c		\
+			plat/qti/msm8916/${ARCH}/msm8916_helpers.S	\
+			plat/qti/msm8916/${ARCH}/uartdm_console.S
+
+# Only BL31 is supported at the moment and is entered on a single CPU
+RESET_TO_BL31			:= 1
+COLD_BOOT_SINGLE_CPU		:= 1
+
+# Build config flags
+# ------------------
+BL31_BASE			?= 0x86500000
+BL32_BASE			?= 0x86000000
+PRELOADED_BL33_BASE		?= 0x8f600000
+
+# Have different sections for code and rodata
+SEPARATE_CODE_AND_RODATA	:= 1
+
+# Single cluster
+WARMBOOT_ENABLE_DCACHE_EARLY	:= 1
+
+# Disable features unsupported in ARMv8.0
+ENABLE_AMU			:= 0
+ENABLE_SPE_FOR_LOWER_ELS	:= 0
+ENABLE_SVE_FOR_NS		:= 0
+
+# MSM8916 uses ARM Cortex-A53 r0p0 so likely all the errata apply
+ERRATA_A53_819472		:= 1
+ERRATA_A53_824069		:= 1
+ERRATA_A53_826319		:= 1
+ERRATA_A53_827319		:= 1
+ERRATA_A53_835769		:= 1
+ERRATA_A53_836870		:= 1
+ERRATA_A53_843419		:= 1
+ERRATA_A53_855873		:= 0	# Workaround works only for >= r0p3
+ERRATA_A53_1530924		:= 1
+
+$(eval $(call add_define,BL31_BASE))
+$(eval $(call add_define,BL32_BASE))
diff --git a/plat/st/common/include/stm32mp_common.h b/plat/st/common/include/stm32mp_common.h
index a13e9e5..d8d1c13 100644
--- a/plat/st/common/include/stm32mp_common.h
+++ b/plat/st/common/include/stm32mp_common.h
@@ -62,6 +62,14 @@
 /* Setup the UART console */
 int stm32mp_uart_console_setup(void);
 
+#if STM32MP_EARLY_CONSOLE
+void stm32mp_setup_early_console(void);
+#else
+static inline void stm32mp_setup_early_console(void)
+{
+}
+#endif
+
 /*
  * Platform util functions for the GPIO driver
  * @bank: Target GPIO bank ID as per DT bindings
diff --git a/plat/st/common/stm32mp_common.c b/plat/st/common/stm32mp_common.c
index 2297cd6..f99cad5 100644
--- a/plat/st/common/stm32mp_common.c
+++ b/plat/st/common/stm32mp_common.c
@@ -205,10 +205,27 @@
 }
 #endif
 
+static void set_console(uintptr_t base, uint32_t clk_rate)
+{
+	unsigned int console_flags;
+
+	if (console_stm32_register(base, clk_rate,
+				   STM32MP_UART_BAUDRATE, &console) == 0) {
+		panic();
+	}
+
+	console_flags = CONSOLE_FLAG_BOOT | CONSOLE_FLAG_CRASH |
+			CONSOLE_FLAG_TRANSLATE_CRLF;
+#if !defined(IMAGE_BL2) && defined(DEBUG)
+	console_flags |= CONSOLE_FLAG_RUNTIME;
+#endif
+
+	console_set_scope(&console, console_flags);
+}
+
 int stm32mp_uart_console_setup(void)
 {
 	struct dt_node_info dt_uart_info;
-	unsigned int console_flags;
 	uint32_t clk_rate = 0U;
 	int result;
 	uint32_t boot_itf __unused;
@@ -249,21 +266,19 @@
 	clk_rate = clk_get_rate((unsigned long)dt_uart_info.clock);
 #endif
 
-	if (console_stm32_register(dt_uart_info.base, clk_rate,
-				   STM32MP_UART_BAUDRATE, &console) == 0) {
-		panic();
-	}
-
-	console_flags = CONSOLE_FLAG_BOOT | CONSOLE_FLAG_CRASH |
-			CONSOLE_FLAG_TRANSLATE_CRLF;
-#if !defined(IMAGE_BL2) && defined(DEBUG)
-	console_flags |= CONSOLE_FLAG_RUNTIME;
-#endif
-	console_set_scope(&console, console_flags);
+	set_console(dt_uart_info.base, clk_rate);
 
 	return 0;
 }
 
+#if STM32MP_EARLY_CONSOLE
+void stm32mp_setup_early_console(void)
+{
+	plat_crash_console_init();
+	set_console(STM32MP_DEBUG_USART_BASE, STM32MP_DEBUG_USART_CLK_FRQ);
+}
+#endif /* STM32MP_EARLY_CONSOLE */
+
 /*****************************************************************************
  * plat_is_smccc_feature_available() - This function checks whether SMCCC
  *                                     feature is availabile for platform.
diff --git a/plat/st/stm32mp1/bl2_plat_setup.c b/plat/st/stm32mp1/bl2_plat_setup.c
index 1504360..33ad56f 100644
--- a/plat/st/stm32mp1/bl2_plat_setup.c
+++ b/plat/st/stm32mp1/bl2_plat_setup.c
@@ -139,6 +139,8 @@
 				  u_register_t arg2 __unused,
 				  u_register_t arg3 __unused)
 {
+	stm32mp_setup_early_console();
+
 	stm32mp_save_boot_ctx_address(arg0);
 }
 
diff --git a/plat/st/stm32mp1/platform.mk b/plat/st/stm32mp1/platform.mk
index 65eaa74..8d4320a 100644
--- a/plat/st/stm32mp1/platform.mk
+++ b/plat/st/stm32mp1/platform.mk
@@ -9,6 +9,8 @@
 BL2_AT_EL3		:=	1
 USE_COHERENT_MEM	:=	0
 
+STM32MP_EARLY_CONSOLE	?=	0
+
 # Allow TF-A to concatenate BL2 & BL32 binaries in a single file,
 # share DTB file between BL2 and BL32
 # If it is set to 0, then FIP is used
@@ -157,6 +159,7 @@
 		PLAT_XLAT_TABLES_DYNAMIC \
 		STM32MP_DDR_32BIT_INTERFACE \
 		STM32MP_DDR_DUAL_AXI_PORT \
+		STM32MP_EARLY_CONSOLE \
 		STM32MP_EMMC \
 		STM32MP_EMMC_BOOT \
 		STM32MP_RAW_NAND \
@@ -183,6 +186,7 @@
 		STM32_TF_VERSION \
 		STM32MP_DDR_32BIT_INTERFACE \
 		STM32MP_DDR_DUAL_AXI_PORT \
+		STM32MP_EARLY_CONSOLE \
 		STM32MP_EMMC \
 		STM32MP_EMMC_BOOT \
 		STM32MP_RAW_NAND \
diff --git a/plat/st/stm32mp1/stm32mp1_def.h b/plat/st/stm32mp1/stm32mp1_def.h
index 76f3585..fd12159 100644
--- a/plat/st/stm32mp1/stm32mp1_def.h
+++ b/plat/st/stm32mp1/stm32mp1_def.h
@@ -492,5 +492,6 @@
 #define DT_NVMEM_LAYOUT_COMPAT		"st,stm32-nvmem-layout"
 #define DT_PWR_COMPAT			"st,stm32mp1,pwr-reg"
 #define DT_RCC_CLK_COMPAT		"st,stm32mp1-rcc"
+#define DT_RCC_SEC_CLK_COMPAT		"st,stm32mp1-rcc-secure"
 
 #endif /* STM32MP1_DEF_H */