diff --git a/changelog.yaml b/changelog.yaml
index 01e91b4..c4028c4 100644
--- a/changelog.yaml
+++ b/changelog.yaml
@@ -1051,6 +1051,13 @@
             deprecated:
               - fdts stm32mp1
 
+            subsections:
+              - title: STM32MP13
+                scope: stm32mp13-fdts
+
+              - title: STM32MP15
+                scope: stm32mp15-fdts
+
       - title: PIE
         scope: pie
 
diff --git a/docs/design/cpu-specific-build-macros.rst b/docs/design/cpu-specific-build-macros.rst
index b053647..3c0fb44 100644
--- a/docs/design/cpu-specific-build-macros.rst
+++ b/docs/design/cpu-specific-build-macros.rst
@@ -476,6 +476,10 @@
    Cortex-A710 CPU. This needs to be enabled for revisions r0p0, r1p0 and r2p0
    of the CPU and is fixed in r2p1.
 
+-  ``ERRATA_A710_2371105``: This applies errata 2371105 workaround to
+   Cortex-A710 CPU. This needs to be enabled for revisions r0p0, r1p0 and r2p0
+   of the CPU and is fixed in r2p1.
+
 For Neoverse N2, the following errata build flags are defined :
 
 -  ``ERRATA_N2_2002655``: This applies errata 2002655 workaround to Neoverse-N2
diff --git a/docs/design/trusted-board-boot-build.rst b/docs/design/trusted-board-boot-build.rst
index dd61b61..c3f3a2f 100644
--- a/docs/design/trusted-board-boot-build.rst
+++ b/docs/design/trusted-board-boot-build.rst
@@ -35,6 +35,13 @@
    By default, this will use the Chain of Trust described in the TBBR-client
    document. To select a different one, use the ``COT`` build option.
 
+   If using a custom build of OpenSSL, set the ``OPENSSL_DIR`` variable
+   accordingly so it points at the OpenSSL installation path, as explained in
+   :ref:`Build Options`. In addition, set the ``LD_LIBRARY_PATH`` variable
+   when running to point at the custom OpenSSL path, so the OpenSSL libraries
+   are loaded from that path instead of the default OS path. Export this
+   variable if necessary.
+
    In the case of Arm platforms, the location of the ROTPK hash must also be
    specified at build time. The following locations are currently supported (see
    ``ARM_ROTPK_LOCATION`` build option):
@@ -63,7 +70,7 @@
        make PLAT=<platform> TRUSTED_BOARD_BOOT=1 GENERATE_COT=1        \
        ARM_ROTPK_LOCATION=devel_rsa                                    \
        ROT_KEY=plat/arm/board/common/rotpk/arm_rotprivk_rsa.pem        \
-       BL33=<path-to>/<bl33_image>                                     \
+       BL33=<path-to>/<bl33_image> OPENSSL_DIR=<path-to>/<openssl>     \
        all fip
 
    The result of this build will be the bl1.bin and the fip.bin binaries. This
@@ -87,7 +94,7 @@
        make PLAT=juno TRUSTED_BOARD_BOOT=1 GENERATE_COT=1              \
        ARM_ROTPK_LOCATION=devel_rsa                                    \
        ROT_KEY=plat/arm/board/common/rotpk/arm_rotprivk_rsa.pem        \
-       BL33=<path-to>/<bl33_image>                                     \
+       BL33=<path-to>/<bl33_image> OPENSSL_DIR=<path-to>/<openssl>     \
        SCP_BL2=<path-to>/<scp_bl2_image>                               \
        SCP_BL2U=<path-to>/<scp_bl2u_image>                             \
        NS_BL2U=<path-to>/<ns_bl2u_image>                               \
@@ -109,7 +116,7 @@
 
 --------------
 
-*Copyright (c) 2019-2020, Arm Limited. All rights reserved.*
+*Copyright (c) 2019-2022, Arm Limited. All rights reserved.*
 
 .. _mbed TLS Repository: https://github.com/ARMmbed/mbedtls.git
 .. _mbed TLS Security Center: https://tls.mbed.org/security
diff --git a/docs/getting_started/build-options.rst b/docs/getting_started/build-options.rst
index 26d5458..b291d62 100644
--- a/docs/getting_started/build-options.rst
+++ b/docs/getting_started/build-options.rst
@@ -974,9 +974,10 @@
   bit, to trap access to the RAS ERR and RAS ERX registers from lower ELs.
   This flag is disabled by default.
 
-- ``OPENSSL_DIR``: This flag is used to provide the installed openssl directory
-  path on the host machine which is used to build certificate generation and
-  firmware encryption tool.
+- ``OPENSSL_DIR``: This option is used to provide the path to a directory on the
+  host machine where a custom installation of OpenSSL is located, which is used
+  to build the certificate generation, firmware encryption and FIP tools. If
+  this option is not set, the default OS installation will be used.
 
 - ``USE_SP804_TIMER``: Use the SP804 timer instead of the Generic Timer for
   functions that wait for an arbitrary time length (udelay and mdelay). The
diff --git a/docs/getting_started/porting-guide.rst b/docs/getting_started/porting-guide.rst
index d49ddeb..77ee897 100644
--- a/docs/getting_started/porting-guide.rst
+++ b/docs/getting_started/porting-guide.rst
@@ -1665,6 +1665,42 @@
 must return 0, otherwise it must return 1. The default implementation
 of this always returns 0.
 
+Function : bl2_plat_mboot_init() [optional]
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+::
+
+    Argument : void
+    Return   : void
+
+When the MEASURED_BOOT flag is enabled:
+
+-  This function is used to initialize the backend driver(s) of measured boot.
+-  On the Arm FVP port, this function is used to initialize the Event Log
+   backend driver with the Event Log buffer information (base address and
+   size) received from BL1. It results in panic on error.
+
+When the MEASURED_BOOT flag is disabled, this function doesn't do anything.
+
+Function : bl2_plat_mboot_finish() [optional]
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+::
+
+    Argument : void
+    Return   : void
+
+When the MEASURED_BOOT flag is enabled:
+
+-  This function is used to finalize the measured boot backend driver(s),
+   and also, set the information for the next bootloader component to extend
+   the measurement if needed.
+-  On the Arm FVP port, this function is used to pass the Event Log buffer
+   information (base address and size) to non-secure(BL33) and trusted OS(BL32)
+   via nt_fw and tos_fw config respectively. It results in panic on error.
+
+When the MEASURED_BOOT flag is disabled, this function doesn't do anything.
+
 Boot Loader Stage 2 (BL2) at EL3
 --------------------------------
 
@@ -1822,42 +1858,6 @@
 This function returns 0 on success, a negative error code otherwise.
 This function is included if SCP_BL2U_BASE is defined.
 
-Function : bl2_plat_mboot_init() [optional]
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-::
-
-    Argument : void
-    Return   : void
-
-When the MEASURED_BOOT flag is enabled:
-
--  This function is used to initialize the backend driver(s) of measured boot.
--  On the Arm FVP port, this function is used to initialize the Event Log
-   backend driver with the Event Log buffer information (base address and
-   size) received from BL1. It results in panic on error.
-
-When the MEASURED_BOOT flag is disabled, this function doesn't do anything.
-
-Function : bl2_plat_mboot_finish() [optional]
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-::
-
-    Argument : void
-    Return   : void
-
-When the MEASURED_BOOT flag is enabled:
-
--  This function is used to finalize the measured boot backend driver(s),
-   and also, set the information for the next bootloader component to extend
-   the measurement if needed.
--  On the Arm FVP port, this function is used to pass the Event Log buffer
-   information (base address and size) to non-secure(BL33) and trusted OS(BL32)
-   via nt_fw and tos_fw config respectively. It results in panic on error.
-
-When the MEASURED_BOOT flag is disabled, this function doesn't do anything.
-
 Boot Loader Stage 3-1 (BL31)
 ----------------------------
 
diff --git a/docs/getting_started/prerequisites.rst b/docs/getting_started/prerequisites.rst
index 179d17b..81c55a5 100644
--- a/docs/getting_started/prerequisites.rst
+++ b/docs/getting_started/prerequisites.rst
@@ -58,6 +58,12 @@
 
    Required to build the cert_create tool.
 
+   .. note::
+
+    OpenSSL 3.0 has to be built from source code, as it's not available in
+    the default package repositories in recent Ubuntu versions. Please refer
+    to the OpenSSL project documentation for more information.
+
 The following libraries are required for Trusted Board Boot and Measured Boot
 support:
 
@@ -90,7 +96,7 @@
 
 .. code:: shell
 
-    sudo apt install build-essential git libssl-dev
+    sudo apt install build-essential git
 
 The optional packages can be installed using:
 
diff --git a/docs/getting_started/tools-build.rst b/docs/getting_started/tools-build.rst
index c050f58..daf7e06 100644
--- a/docs/getting_started/tools-build.rst
+++ b/docs/getting_started/tools-build.rst
@@ -1,6 +1,16 @@
 Building Supporting Tools
 =========================
 
+.. note::
+
+    OpenSSL 3.0 is needed in order to build the tools. A custom installation
+    can be used if not updating the OpenSSL version on the OS. In order to do
+    this, use the ``OPENSSL_DIR`` variable after the ``make`` command to
+    indicate the location of the custom OpenSSL build. Then, to run the tools,
+    use the ``LD_LIBRARY_PATH`` to indicate the location of the built
+    libraries. More info about ``OPENSSL_DIR`` can be found at
+    :ref:`Build Options`.
+
 Building and using the FIP tool
 -------------------------------
 
@@ -164,4 +174,4 @@
 
 --------------
 
-*Copyright (c) 2019, Arm Limited. All rights reserved.*
+*Copyright (c) 2019-2022, Arm Limited. All rights reserved.*
diff --git a/drivers/ufs/ufs.c b/drivers/ufs/ufs.c
index 7db6c0b..47ff26b 100644
--- a/drivers/ufs/ufs.c
+++ b/drivers/ufs/ufs.c
@@ -225,8 +225,7 @@
 			}
 			continue;
 		}
-		while ((mmio_read_32(base + HCS) & HCS_DP) == 0)
-			;
+		assert((mmio_read_32(base + HCS) & HCS_DP) == 0);
 		data = mmio_read_32(base + IS);
 		if (data & UFS_INT_ULSS)
 			mmio_write_32(base + IS, UFS_INT_ULSS);
@@ -482,9 +481,7 @@
 	mmio_write_32(ufs_params.reg_base + IS, ~0);
 
 	mmio_write_32(ufs_params.reg_base + UTRLRSR, 1);
-	do {
-		data = mmio_read_32(ufs_params.reg_base + UTRLRSR);
-	} while (data == 0);
+	assert(mmio_read_32(ufs_params.reg_base + UTRLRSR) == 1);
 
 	data = UTRIACR_IAEN | UTRIACR_CTR | UTRIACR_IACTH(0x1F) |
 	       UTRIACR_IATOVAL(0xFF);
diff --git a/include/lib/cpus/aarch64/cortex_a710.h b/include/lib/cpus/aarch64/cortex_a710.h
index 09614ee..040f073 100644
--- a/include/lib/cpus/aarch64/cortex_a710.h
+++ b/include/lib/cpus/aarch64/cortex_a710.h
@@ -35,6 +35,7 @@
  * CPU Auxiliary Control register 2 specific definitions.
  ******************************************************************************/
 #define CORTEX_A710_CPUACTLR2_EL1				S3_0_C15_C1_1
+#define CORTEX_A710_CPUACTLR2_EL1_BIT_40			(ULL(1) << 40)
 
 /*******************************************************************************
  * CPU Auxiliary Control register 5 specific definitions.
diff --git a/include/lib/psci/psci_lib.h b/include/lib/psci/psci_lib.h
index 1ac45ad..43e2f96 100644
--- a/include/lib/psci/psci_lib.h
+++ b/include/lib/psci/psci_lib.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017-2018, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2017-2022, Arm Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -91,6 +91,8 @@
 			  entry_point_info_t *next_image_info);
 int psci_stop_other_cores(unsigned int wait_ms,
 			  void (*stop_func)(u_register_t mpidr));
+bool psci_is_last_on_cpu_safe(void);
+
 #endif /* __ASSEMBLER__ */
 
 #endif /* PSCI_LIB_H */
diff --git a/lib/cpus/aarch64/cortex_a710.S b/lib/cpus/aarch64/cortex_a710.S
index 5d8e9a6..8d02e7b 100644
--- a/lib/cpus/aarch64/cortex_a710.S
+++ b/lib/cpus/aarch64/cortex_a710.S
@@ -353,6 +353,34 @@
 	b       cpu_rev_var_ls
 endfunc check_errata_2008768
 
+/* -------------------------------------------------------
+ * Errata Workaround for Cortex-A710 Erratum 2371105.
+ * This applies to revisions <= r2p0 and is fixed in r2p1.
+ * x0: variant[4:7] and revision[0:3] of current cpu.
+ * Shall clobber: x0-x17
+ * -------------------------------------------------------
+ */
+func errata_a710_2371105_wa
+	/* Check workaround compatibility. */
+	mov	x17, x30
+	bl	check_errata_2371105
+	cbz	x0, 1f
+
+	/* Set bit 40 in CPUACTLR2_EL1 */
+	mrs	x1, CORTEX_A710_CPUACTLR2_EL1
+	orr	x1, x1, #CORTEX_A710_CPUACTLR2_EL1_BIT_40
+	msr	CORTEX_A710_CPUACTLR2_EL1, x1
+	isb
+1:
+	ret	x17
+endfunc errata_a710_2371105_wa
+
+func check_errata_2371105
+	/* Applies to <= r2p0. */
+	mov	x1, #0x20
+	b	cpu_rev_var_ls
+endfunc check_errata_2371105
+
 func check_errata_cve_2022_23960
 #if WORKAROUND_CVE_2022_23960
 	mov	x0, #ERRATA_APPLIES
@@ -410,6 +438,7 @@
 	report_errata ERRATA_A710_2136059, cortex_a710, 2136059
 	report_errata ERRATA_A710_2282622, cortex_a710, 2282622
 	report_errata ERRATA_A710_2008768, cortex_a710, 2008768
+	report_errata ERRATA_A710_2371105, cortex_a710, 2371105
 	report_errata WORKAROUND_CVE_2022_23960, cortex_a710, cve_2022_23960
 	report_errata ERRATA_DSU_2313941, cortex_a710, dsu_2313941
 
@@ -476,6 +505,11 @@
 	bl	errata_a710_2282622_wa
 #endif
 
+#if ERRATA_A710_2371105
+	mov	x0, x18
+	bl	errata_a710_2371105_wa
+#endif
+
 #if IMAGE_BL31 && WORKAROUND_CVE_2022_23960
 	/*
 	 * The Cortex-A710 generic vectors are overridden to apply errata
diff --git a/lib/cpus/cpu-ops.mk b/lib/cpus/cpu-ops.mk
index 2c08a27..02f92bb 100644
--- a/lib/cpus/cpu-ops.mk
+++ b/lib/cpus/cpu-ops.mk
@@ -528,6 +528,10 @@
 # to revision r0p0, r1p0 and r2p0 of the Cortex-A710 cpu and is fixed in r2p1.
 ERRATA_A710_2008768	?=0
 
+# Flag to apply erratum 2371105 workaround during reset. This erratum applies
+# to revision r0p0, r1p0 and r2p0 of the Cortex-A710 cpu and is fixed in r2p1.
+ERRATA_A710_2371105	?=0
+
 # Flag to apply erratum 2067956 workaround during reset. This erratum applies
 # to revision r0p0 of the Neoverse N2 cpu and is still open.
 ERRATA_N2_2067956	?=0
@@ -1087,6 +1091,10 @@
 $(eval $(call assert_boolean,ERRATA_A710_2008768))
 $(eval $(call add_define,ERRATA_A710_2008768))
 
+# Process ERRATA_A710_2371105 flag
+$(eval $(call assert_boolean,ERRATA_A710_2371105))
+$(eval $(call add_define,ERRATA_A710_2371105))
+
 # Process ERRATA_N2_2067956 flag
 $(eval $(call assert_boolean,ERRATA_N2_2067956))
 $(eval $(call add_define,ERRATA_N2_2067956))
diff --git a/lib/psci/psci_common.c b/lib/psci/psci_common.c
index 170777f..22d66bf 100644
--- a/lib/psci/psci_common.c
+++ b/lib/psci/psci_common.c
@@ -1022,3 +1022,56 @@
 
 	return PSCI_E_SUCCESS;
 }
+
+/*******************************************************************************
+ * This function verifies that all the other cores in the system have been
+ * turned OFF and the current CPU is the last running CPU in the system.
+ * Returns true if the current CPU is the last ON CPU or false otherwise.
+ *
+ * This API has following differences with psci_is_last_on_cpu
+ *  1. PSCI states are locked
+ *  2. It caters for "forest" topology instead of just "tree"
+ *  TODO : Revisit both API's and unify them
+ ******************************************************************************/
+bool psci_is_last_on_cpu_safe(void)
+{
+	unsigned int this_core = plat_my_core_pos();
+	unsigned int parent_nodes[PLAT_MAX_PWR_LVL] = {0};
+	unsigned int i = 0;
+
+	/*
+	 * Traverse the forest of PSCI nodes, nodes with no parents
+	 * (invalid-nodes) are the root nodes.
+	 */
+	while ((psci_non_cpu_pd_nodes[i].parent_node ==
+	       PSCI_PARENT_NODE_INVALID) &&
+	       (i < PSCI_NUM_NON_CPU_PWR_DOMAINS)) {
+		psci_get_parent_pwr_domain_nodes(
+				psci_non_cpu_pd_nodes[i].cpu_start_idx,
+				PLAT_MAX_PWR_LVL, parent_nodes);
+
+		psci_acquire_pwr_domain_locks(PLAT_MAX_PWR_LVL, parent_nodes);
+
+		for (unsigned int core = 0U;
+		     core < psci_non_cpu_pd_nodes[i].ncpus; core++) {
+			if (core == this_core) {
+				continue;
+			}
+
+			if (psci_get_aff_info_state_by_idx(core) !=
+			    AFF_STATE_OFF) {
+				psci_release_pwr_domain_locks(PLAT_MAX_PWR_LVL,
+							      parent_nodes);
+				VERBOSE("core=%u other than boot core=%u %s\n",
+				       core, this_core, "running in the system");
+
+				return false;
+			}
+		}
+
+		psci_release_pwr_domain_locks(PLAT_MAX_PWR_LVL, parent_nodes);
+		i++;
+	}
+
+	return true;
+}
diff --git a/lib/psci/psci_private.h b/lib/psci/psci_private.h
index 72bd6bd..61bd966 100644
--- a/lib/psci/psci_private.h
+++ b/lib/psci/psci_private.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2020, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2013-2022, Arm Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -47,6 +47,9 @@
  */
 #define PSCI_MAX_CPUS_INDEX	0xFFFFU
 
+/* Invalid parent */
+#define PSCI_PARENT_NODE_INVALID	0xFFFFFFFFU
+
 /*
  * Helper functions to get/set the fields of PSCI per-cpu data.
  */
diff --git a/plat/arm/board/fvp/include/fvp_critical_data.h b/plat/arm/board/fvp/include/fvp_critical_data.h
index 3010d21..04bd5b2 100644
--- a/plat/arm/board/fvp/include/fvp_critical_data.h
+++ b/plat/arm/board/fvp/include/fvp_critical_data.h
@@ -1,8 +1,10 @@
 /*
- * Copyright (c) 2021, Arm Limited. All rights reserved.
+ * Copyright (c) 2021-2022, Arm Limited. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
+#ifndef FVP_CRITICAL_DATA_H
+#define FVP_CRITICAL_DATA_H
 
 #include <common/nv_cntr_ids.h>
 #include <lib/utils_def.h>
@@ -17,3 +19,5 @@
 	/* platform NV counters */
 	unsigned int nv_ctr[MAX_NV_CTR_IDS];
 };
+
+#endif /* FVP_CRITICAL_DATA_H */
diff --git a/plat/arm/board/tc/include/platform_def.h b/plat/arm/board/tc/include/platform_def.h
index 745d91c..11762d4 100644
--- a/plat/arm/board/tc/include/platform_def.h
+++ b/plat/arm/board/tc/include/platform_def.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2021, Arm Limited. All rights reserved.
+ * Copyright (c) 2020-2022, Arm Limited. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -177,8 +177,14 @@
 
 #define PLAT_ARM_NSTIMER_FRAME_ID	0
 
+#if (TARGET_PLATFORM >= 2)
+#define PLAT_ARM_TRUSTED_ROM_BASE	0x1000
+#else
 #define PLAT_ARM_TRUSTED_ROM_BASE	0x0
-#define PLAT_ARM_TRUSTED_ROM_SIZE	0x00080000	/* 512KB */
+#endif
+
+/* PLAT_ARM_TRUSTED_ROM_SIZE 512KB minus ROM base. */
+#define PLAT_ARM_TRUSTED_ROM_SIZE	(0x00080000 - PLAT_ARM_TRUSTED_ROM_BASE)
 
 #define PLAT_ARM_NSRAM_BASE		0x06000000
 #define PLAT_ARM_NSRAM_SIZE		0x00080000	/* 512KB */
diff --git a/plat/arm/board/tc/platform.mk b/plat/arm/board/tc/platform.mk
index 3acd88e..18fcd54 100644
--- a/plat/arm/board/tc/platform.mk
+++ b/plat/arm/board/tc/platform.mk
@@ -1,4 +1,4 @@
-# Copyright (c) 2021, Arm Limited. All rights reserved.
+# Copyright (c) 2021-2022, Arm Limited. All rights reserved.
 #
 # SPDX-License-Identifier: BSD-3-Clause
 #
@@ -9,6 +9,8 @@
         $(error TARGET_PLATFORM must be 0 or 1)
 endif
 
+$(eval $(call add_define,TARGET_PLATFORM))
+
 CSS_LOAD_SCP_IMAGES	:=	1
 
 CSS_USE_SCMI_SDS_DRIVER	:=	1
diff --git a/plat/mediatek/mt8186/drivers/spm/notifier/mt_spm_sspm_notifier.c b/plat/mediatek/mt8186/drivers/spm/notifier/mt_spm_sspm_notifier.c
index 198bac5..20ef011 100644
--- a/plat/mediatek/mt8186/drivers/spm/notifier/mt_spm_sspm_notifier.c
+++ b/plat/mediatek/mt8186/drivers/spm/notifier/mt_spm_sspm_notifier.c
@@ -11,7 +11,7 @@
 #include <mt_spm_sspm_intc.h>
 #include <sspm_reg.h>
 
-#define MT_SPM_SSPM_MBOX_OFF(x)		(SSPM_MBOX_3_BASE + x)
+#define MT_SPM_SSPM_MBOX_OFF(x)		(SSPM_MBOX_BASE + x)
 #define MT_SPM_MBOX(slot)		MT_SPM_SSPM_MBOX_OFF((slot << 2UL))
 
 #define SSPM_MBOX_SPM_LP_LOOKUP1	MT_SPM_MBOX(0)
diff --git a/plat/mediatek/mt8186/include/platform_def.h b/plat/mediatek/mt8186/include/platform_def.h
index b8b877a..f3d15f3 100644
--- a/plat/mediatek/mt8186/include/platform_def.h
+++ b/plat/mediatek/mt8186/include/platform_def.h
@@ -1,6 +1,6 @@
 /*
- * Copyright (c) 2021, ARM Limited and Contributors. All rights reserved.
- * Copyright (c) 2021, MediaTek Inc. All rights reserved.
+ * Copyright (c) 2021-2022, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2021-2022, MediaTek Inc. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -26,6 +26,8 @@
 #define INFRACFG_AO_BASE        (IO_PHYS + 0x00001000)
 #define SPM_BASE		(IO_PHYS + 0x00006000)
 #define APMIXEDSYS              (IO_PHYS + 0x0000C000)
+#define SSPM_MCDI_SHARE_SRAM    (IO_PHYS + 0x00420000)
+#define SSPM_CFGREG_BASE        (IO_PHYS + 0x00440000)  /* SSPM view: 0x30040000 */
 #define SSPM_MBOX_BASE          (IO_PHYS + 0x00480000)
 #define PERICFG_AO_BASE         (IO_PHYS + 0x01003000)
 #define VPPSYS0_BASE            (IO_PHYS + 0x04000000)
diff --git a/plat/mediatek/mt8186/include/sspm_reg.h b/plat/mediatek/mt8186/include/sspm_reg.h
index 3e8c3e2..40b71ac 100644
--- a/plat/mediatek/mt8186/include/sspm_reg.h
+++ b/plat/mediatek/mt8186/include/sspm_reg.h
@@ -9,12 +9,8 @@
 
 #include "platform_def.h"
 
-#define SSPM_CFGREG_BASE	(IO_PHYS + 0x440000)     /* SSPM view: 0x30040000 */
 #define SSPM_CFGREG_ADDR(ofs)	(SSPM_CFGREG_BASE + (ofs))
 
-#define SSPM_MCDI_SHARE_SRAM	(IO_PHYS + 0x420000)
-#define SSPM_MBOX_3_BASE	(IO_PHYS + 0x480000)
-
 #define SSPM_HW_SEM		SSPM_CFGREG_ADDR(0x0048)
 #define SSPM_ACAO_INT_SET	SSPM_CFGREG_ADDR(0x00D8)
 #define SSPM_ACAO_INT_CLR	SSPM_CFGREG_ADDR(0x00DC)
diff --git a/plat/xilinx/common/include/plat_startup.h b/plat/xilinx/common/include/plat_startup.h
index 6799e21..5ccb774 100644
--- a/plat/xilinx/common/include/plat_startup.h
+++ b/plat/xilinx/common/include/plat_startup.h
@@ -15,6 +15,23 @@
 	FSBL_HANDOFF_TOO_MANY_PARTS
 };
 
+#define FSBL_MAX_PARTITIONS		8U
+
+/* Structure corresponding to each partition entry */
+struct xfsbl_partition {
+	uint64_t entry_point;
+	uint64_t flags;
+};
+
+/* Structure for handoff parameters to ARM Trusted Firmware (ATF) */
+struct xfsbl_atf_handoff_params {
+	uint8_t magic[4];
+	uint32_t num_entries;
+	struct xfsbl_partition partition[FSBL_MAX_PARTITIONS];
+};
+
+#define ATF_HANDOFF_PARAMS_MAX_SIZE	sizeof(struct xfsbl_atf_handoff_params)
+
 enum fsbl_handoff fsbl_atf_handover(entry_point_info_t *bl32,
 					entry_point_info_t *bl33,
 					uint64_t atf_handoff_addr);
diff --git a/plat/xilinx/common/plat_startup.c b/plat/xilinx/common/plat_startup.c
index a0900c4..de9cf4d 100644
--- a/plat/xilinx/common/plat_startup.c
+++ b/plat/xilinx/common/plat_startup.c
@@ -53,21 +53,6 @@
 #define FSBL_FLAGS_A53_2		2U
 #define FSBL_FLAGS_A53_3		3U
 
-#define FSBL_MAX_PARTITIONS		8U
-
-/* Structure corresponding to each partition entry */
-struct xfsbl_partition {
-	uint64_t entry_point;
-	uint64_t flags;
-};
-
-/* Structure for handoff parameters to ARM Trusted Firmware (ATF) */
-struct xfsbl_atf_handoff_params {
-	uint8_t magic[4];
-	uint32_t num_entries;
-	struct xfsbl_partition partition[FSBL_MAX_PARTITIONS];
-};
-
 /**
  * @partition: Pointer to partition struct
  *
@@ -161,8 +146,6 @@
 					uint64_t atf_handoff_addr)
 {
 	const struct xfsbl_atf_handoff_params *ATFHandoffParams;
-	assert((atf_handoff_addr < BL31_BASE) ||
-	       (atf_handoff_addr > (uint64_t)&__BL31_END__));
 	if (!atf_handoff_addr) {
 		WARN("BL31: No ATF handoff structure passed\n");
 		return FSBL_HANDOFF_NO_STRUCT;
diff --git a/plat/xilinx/versal/bl31_versal_setup.c b/plat/xilinx/versal/bl31_versal_setup.c
index 0d0d598..593cdc4 100644
--- a/plat/xilinx/versal/bl31_versal_setup.c
+++ b/plat/xilinx/versal/bl31_versal_setup.c
@@ -20,6 +20,9 @@
 #include <versal_def.h>
 #include <plat_private.h>
 #include <plat_startup.h>
+#include <pm_ipi.h>
+#include "pm_client.h"
+#include "pm_api_sys.h"
 
 static entry_point_info_t bl32_image_ep_info;
 static entry_point_info_t bl33_image_ep_info;
@@ -63,6 +66,9 @@
 				u_register_t arg2, u_register_t arg3)
 {
 	uint64_t atf_handoff_addr;
+	uint32_t payload[PAYLOAD_ARG_CNT], max_size = ATF_HANDOFF_PARAMS_MAX_SIZE;
+	enum pm_ret_status ret_status;
+	uint64_t addr[ATF_HANDOFF_PARAMS_MAX_SIZE];
 
 	if (VERSAL_CONSOLE_IS(pl011) || (VERSAL_CONSOLE_IS(pl011_1))) {
 		static console_t versal_runtime_console;
@@ -106,7 +112,17 @@
 	SET_PARAM_HEAD(&bl33_image_ep_info, PARAM_EP, VERSION_1, 0);
 	SET_SECURITY_STATE(bl33_image_ep_info.h.attr, NON_SECURE);
 
-	atf_handoff_addr = mmio_read_32(PMC_GLOBAL_GLOB_GEN_STORAGE4);
+	PM_PACK_PAYLOAD4(payload, LOADER_MODULE_ID, 1, PM_LOAD_GET_HANDOFF_PARAMS,
+			(uintptr_t)addr >> 32U, (uintptr_t)addr, max_size);
+	ret_status = pm_ipi_send_sync(primary_proc, payload, NULL, 0);
+	if (ret_status == PM_RET_SUCCESS) {
+		INFO("BL31: GET_HANDOFF_PARAMS call success=%d\n", ret_status);
+		atf_handoff_addr = (uintptr_t)&addr;
+	} else {
+		ERROR("BL31: GET_HANDOFF_PARAMS Failed, read atf_handoff_addr from reg\n");
+		atf_handoff_addr = mmio_read_32(PMC_GLOBAL_GLOB_GEN_STORAGE4);
+	}
+
 	enum fsbl_handoff ret = fsbl_atf_handover(&bl32_image_ep_info,
 						  &bl33_image_ep_info,
 						  atf_handoff_addr);
diff --git a/plat/xilinx/versal/include/plat_pm_common.h b/plat/xilinx/versal/include/plat_pm_common.h
index 22c9d11..fb4812d 100644
--- a/plat/xilinx/versal/include/plat_pm_common.h
+++ b/plat/xilinx/versal/include/plat_pm_common.h
@@ -19,8 +19,8 @@
 #define NON_SECURE_FLAG		1U
 #define SECURE_FLAG		0U
 
-#define VERSAL_TZ_VERSION_MAJOR		1
-#define VERSAL_TZ_VERSION_MINOR		0
-#define VERSAL_TZ_VERSION		((VERSAL_TZ_VERSION_MAJOR << 16) | \
+#define VERSAL_TZ_VERSION_MAJOR		1U
+#define VERSAL_TZ_VERSION_MINOR		0U
+#define VERSAL_TZ_VERSION		((VERSAL_TZ_VERSION_MAJOR << 16U) | \
 					VERSAL_TZ_VERSION_MINOR)
 #endif /* PLAT_PM_COMMON_H */
diff --git a/plat/xilinx/versal/include/platform_def.h b/plat/xilinx/versal/include/platform_def.h
index 83e5083..6d95fdc 100644
--- a/plat/xilinx/versal/include/platform_def.h
+++ b/plat/xilinx/versal/include/platform_def.h
@@ -15,7 +15,7 @@
  ******************************************************************************/
 
 /* Size of cacheable stacks */
-#define PLATFORM_STACK_SIZE	0x440
+#define PLATFORM_STACK_SIZE	U(0x440)
 
 #define PLATFORM_CORE_COUNT		U(2)
 #define PLAT_MAX_PWR_LVL		U(1)
diff --git a/plat/xilinx/versal/pm_service/pm_api_sys.c b/plat/xilinx/versal/pm_service/pm_api_sys.c
index db78049..e464d32 100644
--- a/plat/xilinx/versal/pm_service/pm_api_sys.c
+++ b/plat/xilinx/versal/pm_service/pm_api_sys.c
@@ -18,15 +18,6 @@
 #include "pm_svc_main.h"
 #include "../drivers/arm/gic/v3/gicv3_private.h"
 
-/*********************************************************************
- * Target module IDs macros
- ********************************************************************/
-#define LIBPM_MODULE_ID		0x2U
-#define LOADER_MODULE_ID	0x7U
-
-#define  MODE	0x80000000U
-#define MODULE_ID_MASK		0x0000ff00
-
 /* default shutdown/reboot scope is system(2) */
 static uint32_t pm_shutdown_scope = XPM_SHUTDOWN_SUBTYPE_RST_SYSTEM;
 
@@ -40,38 +31,6 @@
 	return pm_shutdown_scope;
 }
 
-/**
- * Assigning of argument values into array elements.
- */
-#define PM_PACK_PAYLOAD1(pl, mid, flag, arg0) {	\
-	pl[0] = (uint32_t)(((uint32_t)(arg0) & 0xFFU) | ((mid) << 8U) | ((flag) << 24U)); \
-}
-
-#define PM_PACK_PAYLOAD2(pl, mid, flag, arg0, arg1) {		\
-	pl[1] = (uint32_t)(arg1);				\
-	PM_PACK_PAYLOAD1(pl, (mid), (flag), (arg0));			\
-}
-
-#define PM_PACK_PAYLOAD3(pl, mid, flag, arg0, arg1, arg2) {	\
-	pl[2] = (uint32_t)(arg2);				\
-	PM_PACK_PAYLOAD2(pl, (mid), (flag), (arg0), (arg1));		\
-}
-
-#define PM_PACK_PAYLOAD4(pl, mid, flag, arg0, arg1, arg2, arg3) {	\
-	pl[3] = (uint32_t)(arg3);					\
-	PM_PACK_PAYLOAD3(pl, (mid), (flag), (arg0), (arg1), (arg2));		\
-}
-
-#define PM_PACK_PAYLOAD5(pl, mid, flag, arg0, arg1, arg2, arg3, arg4) {	\
-	pl[4] = (uint32_t)(arg4);					\
-	PM_PACK_PAYLOAD4(pl, (mid), (flag), (arg0), (arg1), (arg2), (arg3));	\
-}
-
-#define PM_PACK_PAYLOAD6(pl, mid, flag, arg0, arg1, arg2, arg3, arg4, arg5) {	\
-	pl[5] = (uint32_t)(arg5);						\
-	PM_PACK_PAYLOAD5(pl, (mid), (flag), (arg0), (arg1), (arg2), (arg3), (arg4));		\
-}
-
 /* PM API functions */
 
 /**
@@ -90,7 +49,7 @@
 	uint32_t payload[PAYLOAD_ARG_CNT] = {0};
 	uint32_t module_id;
 
-	module_id = (x0 & MODULE_ID_MASK) >> 8;
+	module_id = (x0 & MODULE_ID_MASK) >> 8U;
 
 	//default module id is for LIBPM
 	if (module_id == 0) {
@@ -438,7 +397,7 @@
 
 	ret = pm_feature_check(PM_QUERY_DATA, &version[0], flag);
 	if (ret == PM_RET_SUCCESS) {
-		fw_api_version = version[0] & 0xFFFF;
+		fw_api_version = version[0] & 0xFFFFU;
 		if ((fw_api_version == 2U) &&
 		    ((qid == XPM_QID_CLOCK_GET_NAME) ||
 		     (qid == XPM_QID_PINCTRL_GET_FUNCTION_NAME))) {
@@ -562,7 +521,7 @@
 		break;
 	}
 
-	module_id = (api_id & MODULE_ID_MASK) >> 8;
+	module_id = (api_id & MODULE_ID_MASK) >> 8U;
 
 	/*
 	 * feature check should be done only for LIBPM module
diff --git a/plat/xilinx/versal/pm_service/pm_api_sys.h b/plat/xilinx/versal/pm_service/pm_api_sys.h
index 8343533..6fa65c2 100644
--- a/plat/xilinx/versal/pm_service/pm_api_sys.h
+++ b/plat/xilinx/versal/pm_service/pm_api_sys.h
@@ -10,6 +10,14 @@
 #include <stdint.h>
 #include "pm_defs.h"
 
+/*********************************************************************
+ * Target module IDs macros
+ ********************************************************************/
+#define LIBPM_MODULE_ID		0x2U
+#define LOADER_MODULE_ID	0x7U
+
+#define  MODE			0x80000000U
+#define  MODULE_ID_MASK		0x0000ff00
 /**********************************************************
  * PM API function declarations
  **********************************************************/
@@ -56,4 +64,37 @@
 enum pm_ret_status pm_register_notifier(uint32_t device_id, uint32_t event,
 					uint32_t wake, uint32_t enable,
 					uint32_t flag);
+
+/**
+ * Assigning of argument values into array elements.
+ */
+#define PM_PACK_PAYLOAD1(pl, mid, flag, arg0) {	\
+	pl[0] = (uint32_t)(((uint32_t)(arg0) & 0xFFU) | ((mid) << 8U) | ((flag) << 24U)); \
+}
+
+#define PM_PACK_PAYLOAD2(pl, mid, flag, arg0, arg1) {		\
+	pl[1] = (uint32_t)(arg1);				\
+	PM_PACK_PAYLOAD1(pl, (mid), (flag), (arg0));			\
+}
+
+#define PM_PACK_PAYLOAD3(pl, mid, flag, arg0, arg1, arg2) {	\
+	pl[2] = (uint32_t)(arg2);				\
+	PM_PACK_PAYLOAD2(pl, (mid), (flag), (arg0), (arg1));		\
+}
+
+#define PM_PACK_PAYLOAD4(pl, mid, flag, arg0, arg1, arg2, arg3) {	\
+	pl[3] = (uint32_t)(arg3);					\
+	PM_PACK_PAYLOAD3(pl, (mid), (flag), (arg0), (arg1), (arg2));		\
+}
+
+#define PM_PACK_PAYLOAD5(pl, mid, flag, arg0, arg1, arg2, arg3, arg4) {	\
+	pl[4] = (uint32_t)(arg4);					\
+	PM_PACK_PAYLOAD4(pl, (mid), (flag), (arg0), (arg1), (arg2), (arg3));	\
+}
+
+#define PM_PACK_PAYLOAD6(pl, mid, flag, arg0, arg1, arg2, arg3, arg4, arg5) {	\
+	pl[5] = (uint32_t)(arg5);						\
+	PM_PACK_PAYLOAD5(pl, (mid), (flag), (arg0), (arg1), (arg2), (arg3), (arg4));		\
+}
+
 #endif /* PM_API_SYS_H */
diff --git a/plat/xilinx/versal/pm_service/pm_defs.h b/plat/xilinx/versal/pm_service/pm_defs.h
index 9206120..5491555 100644
--- a/plat/xilinx/versal/pm_service/pm_defs.h
+++ b/plat/xilinx/versal/pm_service/pm_defs.h
@@ -62,6 +62,7 @@
 
 /* Loader API ids */
 #define PM_LOAD_PDI			0x701U
+#define PM_LOAD_GET_HANDOFF_PARAMS	0x70BU
 
 /* IOCTL IDs for clock driver */
 #define IOCTL_SET_PLL_FRAC_MODE		8U
diff --git a/plat/xilinx/versal/pm_service/pm_svc_main.c b/plat/xilinx/versal/pm_service/pm_svc_main.c
index f4d04b8..4b0f5e0 100644
--- a/plat/xilinx/versal/pm_service/pm_svc_main.c
+++ b/plat/xilinx/versal/pm_service/pm_svc_main.c
@@ -156,8 +156,8 @@
 		ret = pm_query_data(pm_arg[0], pm_arg[1], pm_arg[2],
 				      pm_arg[3], data, security_flag);
 
-		SMC_RET2(handle, (uint64_t)ret  | ((uint64_t)data[0] << 32),
-				 (uint64_t)data[1] | ((uint64_t)data[2] << 32));
+		SMC_RET2(handle, (uint64_t)ret  | ((uint64_t)data[0] << 32U),
+				 (uint64_t)data[1] | ((uint64_t)data[2] << 32U));
 	}
 
 	case PM_FEATURE_CHECK:
@@ -165,8 +165,8 @@
 		uint32_t result[PAYLOAD_ARG_CNT] = {0U};
 
 		ret = pm_feature_check(pm_arg[0], result, security_flag);
-		SMC_RET2(handle, (uint64_t)ret | ((uint64_t)result[0] << 32),
-			 (uint64_t)result[1] | ((uint64_t)result[2] << 32));
+		SMC_RET2(handle, (uint64_t)ret | ((uint64_t)result[0] << 32U),
+			 (uint64_t)result[1] | ((uint64_t)result[2] << 32U));
 	}
 
 	case PM_LOAD_PDI:
@@ -255,13 +255,13 @@
 
 		pm_get_callbackdata(result, ARRAY_SIZE(result), security_flag);
 		SMC_RET2(handle,
-			(uint64_t)result[0] | ((uint64_t)result[1] << 32),
-			(uint64_t)result[2] | ((uint64_t)result[3] << 32));
+			(uint64_t)result[0] | ((uint64_t)result[1] << 32U),
+			(uint64_t)result[2] | ((uint64_t)result[3] << 32U));
 	}
 
 	case PM_GET_TRUSTZONE_VERSION:
 		SMC_RET1(handle, (uint64_t)PM_RET_SUCCESS |
-			 ((uint64_t)VERSAL_TZ_VERSION << 32));
+			 ((uint64_t)VERSAL_TZ_VERSION << 32U));
 
 	default:
 		return (uintptr_t)0;