diff --git a/docs/design_documents/measured_boot.rst b/docs/design_documents/measured_boot.rst
index 8130d7d..c4e5213 100644
--- a/docs/design_documents/measured_boot.rst
+++ b/docs/design_documents/measured_boot.rst
@@ -204,6 +204,28 @@
    In FVP, Non volatile counters get measured and recorded as Critical data
    using the backend via this interface.
 
+#. **Function : plat_mboot_measure_key()**
+
+   .. code-block:: c
+
+      int plat_mboot_measure_key(const void *pk_oid, const void *pk_ptr,
+                                 size_t pk_len);
+
+   - This function is used by the platform to measure the passed key and
+     publicise it using any of the supported backends.
+   - The authentication module within the trusted boot framework calls this
+     function for every ROTPK involved in verifying the signature of a root
+     certificate and for every subsidiary key that gets extracted from a key
+     certificate for later authentication of a content certificate.
+   - A cookie, passed as the first argument, serves as a key-OID pointer
+     associated with the public key data, passed as the second argument.
+   - Public key data size is passed as the third argument to this function.
+   - This function must return 0 on success, a signed integer error code
+     otherwise.
+   - In FVP platform, this function is used to calculate the hash of the given
+     key and forward this hash to RSS alongside the measurement of the image
+     which the key signs.
+
 --------------
 
 *Copyright (c) 2023, Arm Limited. All rights reserved.*
diff --git a/docs/design_documents/rss.rst b/docs/design_documents/rss.rst
index 2be8067..2ad2ee7 100644
--- a/docs/design_documents/rss.rst
+++ b/docs/design_documents/rss.rst
@@ -262,7 +262,8 @@
 - ``SW type``: Optional. Short text description (e.g.: BL1, BL2, BL31, etc.)
 
 .. Note::
-    Signer-id and version info is not implemented in TF-A yet.
+    Version info is not implemented in TF-A yet.
+
 
 The caller must specify in which measurement slot to extend a certain
 measurement and metadata. A measurement slot can be extended by multiple
@@ -321,9 +322,38 @@
             size_t  version_size;
             uint8_t sw_type[SW_TYPE_MAX_SIZE];
             size_t  sw_type_size;
+            void    *pk_oid;
             bool    lock_measurement;
     };
 
+Signer-ID API
+^^^^^^^^^^^^^
+
+This function calculates the hash of a public key (signer-ID) using the
+``Measurement algorithm`` and stores it in the ``rss_mboot_metadata`` field
+named ``signer_id``.
+Prior to calling this function, the caller must ensure that the ``signer_id``
+field points to the zero-filled buffer.
+
+Defined here:
+
+- ``include/drivers/measured_boot/rss/rss_measured_boot.h``
+
+.. code-block:: c
+
+   int rss_mboot_set_signer_id(struct rss_mboot_metadata *metadata_ptr,
+                               const void *pk_oid,
+                               const void *pk_ptr,
+                               size_t pk_len)
+
+
+- First parameter is the pointer to the ``rss_mboot_metadata`` structure.
+- Second parameter is the pointer to the key-OID of the public key.
+- Third parameter is the pointer to the public key buffer.
+- Fourth parameter is the size of public key buffer.
+- This function returns 0 on success, a signed integer error code
+  otherwise.
+
 Build time config options
 ^^^^^^^^^^^^^^^^^^^^^^^^^
 
@@ -361,8 +391,8 @@
     INFO:    Image id=24 loaded: 0x4001300 - 0x400153a
     INFO:    Measured boot extend measurement:
     INFO:     - slot        : 7
-    INFO:     - signer_id   : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
-    INFO:                   : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+    INFO:     - signer_id   : b0 f3 82 09 12 97 d8 3a 37 7a 72 47 1b ec 32 73
+    INFO:                   : e9 92 32 e2 49 59 f6 5e 8b 4a 4a 46 d8 22 9a da
     INFO:     - version     :
     INFO:     - version_size: 0
     INFO:     - sw_type     : TB_FW_CONFIG
@@ -377,8 +407,8 @@
     INFO:    Image id=1 loaded: 0x404d000 - 0x406412a
     INFO:    Measured boot extend measurement:
     INFO:     - slot        : 8
-    INFO:     - signer_id   : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
-    INFO:                   : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+    INFO:     - signer_id   : b0 f3 82 09 12 97 d8 3a 37 7a 72 47 1b ec 32 73
+    INFO:                   : e9 92 32 e2 49 59 f6 5e 8b 4a 4a 46 d8 22 9a da
     INFO:     - version     :
     INFO:     - version_size: 0
     INFO:     - sw_type     : BL_2
@@ -483,31 +513,31 @@
     INFO:            a2 6a df 34 c3 29 48 9a dc 38 04 67 31 2e 35 2e
     INFO:            30 2b 30 01 60 02 58 20 b8 01 65 a7 78 8b c6 59
     INFO:            42 8d 33 10 85 d1 49 0a dc 9e c3 ee df 85 1b d2
-    INFO:            f0 73 73 6a 0c 07 11 b8 a4 05 58 20 00 00 00 00
-    INFO:            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
-    INFO:            00 00 00 00 00 00 00 00 00 00 00 00 04 60 01 6a
+    INFO:            f0 73 73 6a 0c 07 11 b8 a4 05 58 20 b0 f3 82 09
+    INFO:            12 97 d8 3a 37 7a 72 47 1b ec 32 73 e9 92 32 e2
+    INFO:            49 59 f6 5e 8b 4a 4a 46 d8 22 9a da 04 60 01 6a
     INFO:            46 57 5f 43 4f 4e 46 49 47 00 02 58 20 21 9e a0
     INFO:            13 82 e6 d7 97 5a 11 13 a3 5f 45 39 68 b1 d9 a3
     INFO:            ea 6a ab 84 23 3b 8c 06 16 98 20 ba b9 a4 05 58
-    INFO:            20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
-    INFO:            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
-    INFO:            00 04 60 01 6d 54 42 5f 46 57 5f 43 4f 4e 46 49
+    INFO:            20 b0 f3 82 09 12 97 d8 3a 37 7a 72 47 1b ec 32
+    INFO:            73 e9 92 32 e2 49 59 f6 5e 8b 4a 4a 46 d8 22 9a
+    INFO:            da 04 60 01 6d 54 42 5f 46 57 5f 43 4f 4e 46 49
     INFO:            47 00 02 58 20 41 39 f6 c2 10 84 53 c5 17 ae 9a
     INFO:            e5 be c1 20 7b cc 24 24 f3 9d 20 a8 fb c7 b3 10
-    INFO:            e3 ee af 1b 05 a4 05 58 20 00 00 00 00 00 00 00
-    INFO:            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
-    INFO:            00 00 00 00 00 00 00 00 00 04 60 01 65 42 4c 5f
+    INFO:            e3 ee af 1b 05 a4 05 58 20 b0 f3 82 09 12 97 d8
+    INFO:            3a 37 7a 72 47 1b ec 32 73 e9 92 32 e2 49 59 f6
+    INFO:            5e 8b 4a 4a 46 d8 22 9a da 04 60 01 65 42 4c 5f
     INFO:            32 00 02 58 20 5c 96 20 e1 e3 3b 0f 2c eb c1 8e
     INFO:            1a 02 a6 65 86 dd 34 97 a7 4c 98 13 bf 74 14 45
-    INFO:            2d 30 28 05 c3 a4 05 58 20 00 00 00 00 00 00 00
-    INFO:            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
-    INFO:            00 00 00 00 00 00 00 00 00 04 60 01 6e 53 45 43
+    INFO:            2d 30 28 05 c3 a4 05 58 20 b0 f3 82 09 12 97 d8
+    INFO:            3a 37 7a 72 47 1b ec 32 73 e9 92 32 e2 49 59 f6
+    INFO:            5e 8b 4a 4a 46 d8 22 9a da 04 60 01 6e 53 45 43
     INFO:            55 52 45 5f 52 54 5f 45 4c 33 00 02 58 20 f6 fb
     INFO:            62 99 a5 0c df db 02 0b 72 5b 1c 0b 63 6e 94 ee
     INFO:            66 50 56 3a 29 9c cb 38 f0 ec 59 99 d4 2e a4 05
-    INFO:            58 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00
-    INFO:            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
-    INFO:            00 00 04 60 01 6a 48 57 5f 43 4f 4e 46 49 47 00
+    INFO:            58 20 b0 f3 82 09 12 97 d8 3a 37 7a 72 47 1b ec
+    INFO:            32 73 e9 92 32 e2 49 59 f6 5e 8b 4a 4a 46 d8 22
+    INFO:            9a da 04 60 01 6a 48 57 5f 43 4f 4e 46 49 47 00
     INFO:            02 58 20 98 5d 87 21 84 06 33 9d c3 1f 91 f5 68
     INFO:            8d a0 5a f0 d7 7e 20 51 ce 3b f2 a5 c3 05 2e 3c
     INFO:            8b 52 31 19 01 09 78 1c 68 74 74 70 3a 2f 2f 61
@@ -559,31 +589,31 @@
                 "MEASUREMENT_VALUE": "b'B80165A7788BC659428D331085D1490ADC9EC3EEDF851BD2F073736A0C0711B8'"
             },
             {
-                "SIGNER_ID": "b'0000000000000000000000000000000000000000000000000000000000000000'",
+                "SIGNER_ID": "b'b0f382091297d83a377a72471bec3273e99232e24959f65e8b4a4a46d8229ada'",
                 "SW_COMPONENT_VERSION": "",
                 "SW_COMPONENT_TYPE": "FW_CONFIG\u0000",
                 "MEASUREMENT_VALUE": "b'219EA01382E6D7975A1113A35F453968B1D9A3EA6AAB84233B8C06169820BAB9'"
             },
             {
-                "SIGNER_ID": "b'0000000000000000000000000000000000000000000000000000000000000000'",
+                "SIGNER_ID": "b'b0f382091297d83a377a72471bec3273e99232e24959f65e8b4a4a46d8229ada'",
                 "SW_COMPONENT_VERSION": "",
                 "SW_COMPONENT_TYPE": "TB_FW_CONFIG\u0000",
                 "MEASUREMENT_VALUE": "b'4139F6C2108453C517AE9AE5BEC1207BCC2424F39D20A8FBC7B310E3EEAF1B05'"
             },
             {
-                "SIGNER_ID": "b'0000000000000000000000000000000000000000000000000000000000000000'",
+                "SIGNER_ID": "b'b0f382091297d83a377a72471bec3273e99232e24959f65e8b4a4a46d8229ada'",
                 "SW_COMPONENT_VERSION": "",
                 "SW_COMPONENT_TYPE": "BL_2\u0000",
                 "MEASUREMENT_VALUE": "b'5C9620E1E33B0F2CEBC18E1A02A66586DD3497A74C9813BF7414452D302805C3'"
             },
             {
-                "SIGNER_ID": "b'0000000000000000000000000000000000000000000000000000000000000000'",
+                "SIGNER_ID": "b'b0f382091297d83a377a72471bec3273e99232e24959f65e8b4a4a46d8229ada'",
                 "SW_COMPONENT_VERSION": "",
                 "SW_COMPONENT_TYPE": "SECURE_RT_EL3\u0000",
                 "MEASUREMENT_VALUE": "b'F6FB6299A50CDFDB020B725B1C0B636E94EE6650563A299CCB38F0EC5999D42E'"
             },
             {
-                "SIGNER_ID": "b'0000000000000000000000000000000000000000000000000000000000000000'",
+                "SIGNER_ID": "b'b0f382091297d83a377a72471bec3273e99232e24959f65e8b4a4a46d8229ada'",
                 "SW_COMPONENT_VERSION": "",
                 "SW_COMPONENT_TYPE": "HW_CONFIG\u0000",
                 "MEASUREMENT_VALUE": "b'985D87218406339DC31F91F5688DA05AF0D77E2051CE3BF2A5C3052E3C8B5231'"
diff --git a/docs/getting_started/build-options.rst b/docs/getting_started/build-options.rst
index c410a8e..953a92e 100644
--- a/docs/getting_started/build-options.rst
+++ b/docs/getting_started/build-options.rst
@@ -519,6 +519,20 @@
    Firmware as error. It can take the value 1 (flag the use of deprecated
    APIs as error) or 0. The default is 0.
 
+-  ``ETHOSN_NPU_DRIVER``: boolean option to enable a SiP service that can
+   configure an Arm® Ethos™-N NPU. To use this service the target platform's
+   ``HW_CONFIG`` must include the device tree nodes for the NPU. Currently, only
+   the Arm Juno platform has this included in its ``HW_CONFIG`` and the platform
+   only loads the ``HW_CONFIG`` in AArch64 builds. Default is 0.
+
+-  ``ETHOSN_NPU_TZMP1``: boolean option to enable TZMP1 support for the
+   Arm® Ethos™-N NPU. Requires ``ETHOSN_NPU_DRIVER`` and
+   ``TRUSTED_BOARD_BOOT`` to be enabled.
+
+-  ``ETHOSN_NPU_FW``: location of the NPU firmware binary
+   (```ethosn.bin```). This firmware image will be included in the FIP and
+   loaded at runtime.
+
 -  ``EL3_EXCEPTION_HANDLING``: When set to ``1``, enable handling of exceptions
    targeted at EL3. When set ``0`` (default), no exceptions are expected or
    handled at EL3, and a panic will result. The exception to this rule is when
diff --git a/docs/plat/arm/arm-build-options.rst b/docs/plat/arm/arm-build-options.rst
index 3179267..e81052b 100644
--- a/docs/plat/arm/arm-build-options.rst
+++ b/docs/plat/arm/arm-build-options.rst
@@ -95,20 +95,6 @@
    platforms. If this option is specified, then the path to the CryptoCell
    SBROM library must be specified via ``CCSBROM_LIB_PATH`` flag.
 
--  ``ARM_ETHOSN_NPU_DRIVER``: boolean option to enable a SiP service that can
-   configure an Arm® Ethos™-N NPU. To use this service the target platform's
-   ``HW_CONFIG`` must include the device tree nodes for the NPU. Currently, only
-   the Arm Juno platform has this included in its ``HW_CONFIG`` and the platform
-   only loads the ``HW_CONFIG`` in AArch64 builds. Default is 0.
-
--  ``ARM_ETHOSN_NPU_TZMP1``: boolean option to enable TZMP1 support for the
-   Arm® Ethos™-N NPU. Requires ``ARM_ETHOSN_NPU_DRIVER`` and
-   ``TRUSTED_BOARD_BOOT`` to be enabled.
-
--  ``ARM_ETHOSN_NPU_FW``: location of the NPU firmware binary
-   (```ethosn.bin```). This firmware image will be included in the FIP and
-   loaded at runtime.
-
 -  ``ARM_GPT_SUPPORT``: Enable GPT parser to get the entry address and length of
    the various partitions present in the GPT image. This support is available
    only for the BL2 component, and it is disabled by default.
diff --git a/docs/porting-guide.rst b/docs/porting-guide.rst
index f074021..5a017ce 100644
--- a/docs/porting-guide.rst
+++ b/docs/porting-guide.rst
@@ -591,32 +591,32 @@
 If the platform port uses the Arm® Ethos™-N NPU driver with TZMP1 support
 enabled, the following constants and configuration must also be defined:
 
-- **ARM_ETHOSN_NPU_PROT_FW_NSAID**
+- **ETHOSN_NPU_PROT_FW_NSAID**
 
   Defines the Non-secure Access IDentity (NSAID) that the NPU shall use to
   access the protected memory that contains the NPU's firmware.
 
-- **ARM_ETHOSN_NPU_PROT_DATA_RW_NSAID**
+- **ETHOSN_NPU_PROT_DATA_RW_NSAID**
 
   Defines the Non-secure Access IDentity (NSAID) that the NPU shall use for
   read/write access to the protected memory that contains inference data.
 
-- **ARM_ETHOSN_NPU_PROT_DATA_RO_NSAID**
+- **ETHOSN_NPU_PROT_DATA_RO_NSAID**
 
   Defines the Non-secure Access IDentity (NSAID) that the NPU shall use for
   read-only access to the protected memory that contains inference data.
 
-- **ARM_ETHOSN_NPU_NS_RW_DATA_NSAID**
+- **ETHOSN_NPU_NS_RW_DATA_NSAID**
 
   Defines the Non-secure Access IDentity (NSAID) that the NPU shall use for
   read/write access to the non-protected memory.
 
-- **ARM_ETHOSN_NPU_NS_RO_DATA_NSAID**
+- **ETHOSN_NPU_NS_RO_DATA_NSAID**
 
   Defines the Non-secure Access IDentity (NSAID) that the NPU shall use for
   read-only access to the non-protected memory.
 
-- **ARM_ETHOSN_NPU_FW_IMAGE_BASE** and **ARM_ETHOSN_NPU_FW_IMAGE_LIMIT**
+- **ETHOSN_NPU_FW_IMAGE_BASE** and **ETHOSN_NPU_FW_IMAGE_LIMIT**
 
   Defines the physical address range that the NPU's firmware will be loaded
   into and executed from.
@@ -634,10 +634,10 @@
 - Add MMU mappings such that:
 
  - BL2 can write the NPU firmware into the region defined by
-   ``ARM_ETHOSN_NPU_FW_IMAGE_BASE`` and ``ARM_ETHOSN_NPU_FW_IMAGE_LIMIT``
+   ``ETHOSN_NPU_FW_IMAGE_BASE`` and ``ETHOSN_NPU_FW_IMAGE_LIMIT``
  - BL31 (SiP service) can read the NPU firmware from the same region
 
-- Add the firmware image ID ``ARM_ETHOSN_NPU_FW_IMAGE_ID`` to the list of images
+- Add the firmware image ID ``ETHOSN_NPU_FW_IMAGE_ID`` to the list of images
   loaded by BL2.
 
 Please see the reference implementation code for the Juno platform as an example.
diff --git a/drivers/arm/ethosn/ethosn_npu.mk b/drivers/arm/ethosn/ethosn_npu.mk
new file mode 100644
index 0000000..4a31b59
--- /dev/null
+++ b/drivers/arm/ethosn/ethosn_npu.mk
@@ -0,0 +1,49 @@
+#
+# Copyright (c) 2023, Arm Limited. All rights reserved.
+#
+# SPDX-License-Identifier: BSD-3-Clause
+#
+
+# Arm(R) Ethos(TM)-N NPU SiP service
+ETHOSN_NPU_DRIVER			:=	0
+
+$(eval $(call assert_boolean,ETHOSN_NPU_DRIVER))
+$(eval $(call add_define,ETHOSN_NPU_DRIVER))
+
+#Ethos-N NPU TZMP1
+ETHOSN_NPU_TZMP1			:=	0
+$(eval $(call assert_boolean,ETHOSN_NPU_TZMP1))
+$(eval $(call add_define,ETHOSN_NPU_TZMP1))
+ifeq (${ETHOSN_NPU_TZMP1},1)
+  ifeq (${ETHOSN_NPU_DRIVER},0)
+    $(error "ETHOSN_NPU_TZMP1 is only available if ETHOSN_NPU_DRIVER=1)
+  endif
+  ifeq (${PLAT},juno)
+    $(eval $(call add_define,JUNO_ETHOSN_TZMP1))
+  else
+    $(error "ETHOSN_NPU_TZMP1 only supported on Juno platform, not ", ${PLAT})
+  endif
+
+  ifeq (${TRUSTED_BOARD_BOOT},0)
+    # We rely on TRUSTED_BOARD_BOOT to prevent the firmware code from being
+    # tampered with, which is required to protect the confidentiality of protected
+    # inference data.
+    $(error "ETHOSN_NPU_TZMP1 is only available if TRUSTED_BOARD_BOOT is enabled)
+  endif
+
+  # We need the FW certificate and key certificate
+  $(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/npu_fw_key.crt,--npu-fw-key-cert))
+  $(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/npu_fw_content.crt,--npu-fw-cert))
+  # We need the firmware to be built into the FIP
+  $(eval $(call TOOL_ADD_IMG,ETHOSN_NPU_FW,--npu-fw))
+
+  # Needed for our OIDs to be available in tbbr_cot_bl2.c
+  $(eval $(call add_define, PLAT_DEF_OID))
+
+  # Needed so that UUIDs from the FIP are available in BL2
+  $(eval $(call add_define,PLAT_DEF_FIP_UUID))
+
+  PLAT_INCLUDES	+=	-I${PLAT_DIR}certificate/include
+  PLAT_INCLUDES	+=	-Iinclude/drivers/arm/
+  PLAT_INCLUDES	+=	-I${PLAT_DIR}fip
+endif
diff --git a/drivers/arm/ethosn/ethosn_smc.c b/drivers/arm/ethosn/ethosn_smc.c
index 85a12c5..42158e4 100644
--- a/drivers/arm/ethosn/ethosn_smc.c
+++ b/drivers/arm/ethosn/ethosn_smc.c
@@ -17,9 +17,9 @@
 
 #include <platform_def.h>
 
-#if ARM_ETHOSN_NPU_TZMP1
+#if ETHOSN_NPU_TZMP1
 #include "ethosn_big_fw.h"
-#endif
+#endif /* ETHOSN_NPU_TZMP1 */
 
 /*
  * Number of Arm(R) Ethos(TM)-N NPU (NPU) devices available
@@ -51,11 +51,11 @@
 #define SEC_AUXCTLR_STASHING_VAL	U(0xA5000000)
 
 #define SEC_DEL_REG			U(0x0004)
-#if ARM_ETHOSN_NPU_TZMP1
+#if ETHOSN_NPU_TZMP1
 #define SEC_DEL_VAL			U(0x808)
 #else
 #define SEC_DEL_VAL			U(0x80C)
-#endif
+#endif /* ETHOSN_NPU_TZMP1 */
 #define SEC_DEL_EXCC_MASK		U(0x20)
 
 #define SEC_SECCTLR_REG			U(0x0010)
@@ -69,7 +69,7 @@
 #define SEC_SYSCTRL0_CPU_WAIT		U(1)
 #define SEC_SYSCTRL0_SLEEPING		U(1U << 4)
 #define SEC_SYSCTRL0_INITVTOR_MASK	U(0x1FFFFF80)
-#define SEC_SYSCTRL0_SOFT_RESET		U(3U << 29)
+#define SEC_SYSCTRL0_SOFT_RESET		U(1U << 29)
 #define SEC_SYSCTRL0_HARD_RESET		U(1U << 31)
 
 #define SEC_SYSCTRL1_REG		U(0x001C)
@@ -104,8 +104,8 @@
 #define TO_EXTEND_ADDR(addr) \
 	((addr >> SEC_ADDR_EXT_SHIFT) & SEC_ADDR_EXT_MASK)
 
-#if ARM_ETHOSN_NPU_TZMP1
-CASSERT(ARM_ETHOSN_NPU_FW_IMAGE_BASE > 0U, assert_ethosn_invalid_fw_image_base);
+#if ETHOSN_NPU_TZMP1
+CASSERT(ETHOSN_NPU_FW_IMAGE_BASE > 0U, assert_ethosn_invalid_fw_image_base);
 static const struct ethosn_big_fw *big_fw;
 
 #define FW_INITVTOR_ADDR(big_fw) \
@@ -115,7 +115,7 @@
 #define SYSCTRL0_INITVTOR_ADDR(value) \
 	(value & SEC_SYSCTRL0_INITVTOR_MASK)
 
-#endif
+#endif /* ETHOSN_NPU_TZMP1 */
 
 static bool ethosn_get_device_and_core(uintptr_t core_addr,
 				       const struct ethosn_device_t **dev_match,
@@ -142,7 +142,7 @@
 	return false;
 }
 
-#if ARM_ETHOSN_NPU_TZMP1
+#if ETHOSN_NPU_TZMP1
 static uint32_t ethosn_core_read_arch_version(uintptr_t core_addr)
 {
 	uint32_t npu_id = mmio_read_32(ETHOSN_CORE_SEC_REG(core_addr,
@@ -155,23 +155,23 @@
 					  bool is_protected)
 {
 	size_t i;
-	uint32_t streams[9] = {[0 ... 8] = ARM_ETHOSN_NPU_NS_RO_DATA_NSAID};
+	uint32_t streams[9] = {[0 ... 8] = ETHOSN_NPU_NS_RO_DATA_NSAID};
 
-	streams[FIRMWARE_STREAM_INDEX] = ARM_ETHOSN_NPU_PROT_FW_NSAID;
-	streams[PLE_STREAM_INDEX] = ARM_ETHOSN_NPU_PROT_FW_NSAID;
+	streams[FIRMWARE_STREAM_INDEX] = ETHOSN_NPU_PROT_FW_NSAID;
+	streams[PLE_STREAM_INDEX] = ETHOSN_NPU_PROT_FW_NSAID;
 
-	streams[WORKING_STREAM_INDEX] = ARM_ETHOSN_NPU_NS_RW_DATA_NSAID;
+	streams[WORKING_STREAM_INDEX] = ETHOSN_NPU_NS_RW_DATA_NSAID;
 
 	if (is_protected) {
-		streams[INPUT_STREAM_INDEX] = ARM_ETHOSN_NPU_PROT_RO_DATA_NSAID;
+		streams[INPUT_STREAM_INDEX] = ETHOSN_NPU_PROT_RO_DATA_NSAID;
 		streams[INTERMEDIATE_STREAM_INDEX] =
-			ARM_ETHOSN_NPU_PROT_RW_DATA_NSAID;
-		streams[OUTPUT_STREAM_INDEX] = ARM_ETHOSN_NPU_PROT_RW_DATA_NSAID;
+			ETHOSN_NPU_PROT_RW_DATA_NSAID;
+		streams[OUTPUT_STREAM_INDEX] = ETHOSN_NPU_PROT_RW_DATA_NSAID;
 	} else {
-		streams[INPUT_STREAM_INDEX] = ARM_ETHOSN_NPU_NS_RO_DATA_NSAID;
+		streams[INPUT_STREAM_INDEX] = ETHOSN_NPU_NS_RO_DATA_NSAID;
 		streams[INTERMEDIATE_STREAM_INDEX] =
-			ARM_ETHOSN_NPU_NS_RW_DATA_NSAID;
-		streams[OUTPUT_STREAM_INDEX] = ARM_ETHOSN_NPU_NS_RW_DATA_NSAID;
+			ETHOSN_NPU_NS_RW_DATA_NSAID;
+		streams[OUTPUT_STREAM_INDEX] = ETHOSN_NPU_NS_RW_DATA_NSAID;
 	}
 
 	for (i = 0U; i < ARRAY_SIZE(streams); ++i) {
@@ -188,7 +188,7 @@
 			FW_INITVTOR_ADDR(big_fw));
 }
 
-#endif
+#endif /* ETHOSN_NPU_TZMP1 */
 
 static void ethosn_configure_events(uintptr_t core_addr)
 {
@@ -343,7 +343,7 @@
 
 static int ethosn_core_boot_fw(uintptr_t core_addr)
 {
-#if ARM_ETHOSN_NPU_TZMP1
+#if ETHOSN_NPU_TZMP1
 	const uintptr_t sysctrl0_reg = ETHOSN_CORE_SEC_REG(core_addr, SEC_SYSCTRL0_REG);
 	const uint32_t sysctrl0_val = mmio_read_32(sysctrl0_reg);
 	const bool waiting = (sysctrl0_val & SEC_SYSCTRL0_CPU_WAIT);
@@ -363,7 +363,7 @@
 	return ETHOSN_SUCCESS;
 #else
 	return ETHOSN_NOT_SUPPORTED;
-#endif
+#endif /* ETHOSN_NPU_TZMP1 */
 }
 
 static int ethosn_core_full_reset(const struct ethosn_device_t *device,
@@ -392,17 +392,17 @@
 	if (!device->has_reserved_memory) {
 		ethosn_configure_smmu_streams(device, core, asset_alloc_idx);
 
-#if ARM_ETHOSN_NPU_TZMP1
+#if ETHOSN_NPU_TZMP1
 		ethosn_configure_stream_nsaid(core, is_protected);
-#endif
+#endif /* ETHOSN_NPU_TZMP1 */
 	}
 
 	ethosn_configure_stream_addr_extends(device, core->addr);
 	ethosn_configure_stream_attr_ctlr(core->addr);
 
-#if ARM_ETHOSN_NPU_TZMP1
+#if ETHOSN_NPU_TZMP1
 	ethosn_configure_vector_table(core->addr);
-#endif
+#endif /* ETHOSN_NPU_TZMP1 */
 
 	ethosn_delegate_to_ns(core->addr);
 
@@ -481,7 +481,7 @@
 static uintptr_t ethosn_smc_fw_prop_handler(u_register_t fw_property,
 					    void *handle)
 {
-#if ARM_ETHOSN_NPU_TZMP1
+#if ETHOSN_NPU_TZMP1
 	switch (fw_property) {
 	case ETHOSN_FW_PROP_VERSION:
 		SMC_RET4(handle, ETHOSN_SUCCESS,
@@ -507,7 +507,7 @@
 	}
 #else
 	SMC_RET1(handle, ETHOSN_NOT_SUPPORTED);
-#endif
+#endif /* ETHOSN_NPU_TZMP1 */
 }
 
 uintptr_t ethosn_smc_handler(uint32_t smc_fid,
@@ -554,17 +554,17 @@
 
 int ethosn_smc_setup(void)
 {
-#if ARM_ETHOSN_NPU_TZMP1
+#if ETHOSN_NPU_TZMP1
 	struct ethosn_device_t *dev;
 	uint32_t arch_ver;
-#endif
+#endif /* ETHOSN_NPU_TZMP1 */
 
 	if (ETHOSN_NUM_DEVICES == 0U) {
 		ERROR("ETHOSN: No NPU found\n");
 		return ETHOSN_FAILURE;
 	}
 
-#if ARM_ETHOSN_NPU_TZMP1
+#if ETHOSN_NPU_TZMP1
 
 	/* Only one NPU core is supported in the TZMP1 setup */
 	if ((ETHOSN_NUM_DEVICES != 1U) ||
@@ -580,7 +580,7 @@
 	}
 
 	arch_ver = ethosn_core_read_arch_version(dev->cores[0U].addr);
-	big_fw = (struct ethosn_big_fw *)ARM_ETHOSN_NPU_FW_IMAGE_BASE;
+	big_fw = (struct ethosn_big_fw *)ETHOSN_NPU_FW_IMAGE_BASE;
 
 	if (!ethosn_big_fw_verify_header(big_fw, arch_ver)) {
 		return ETHOSN_FAILURE;
@@ -591,7 +591,7 @@
 	       big_fw->fw_ver_patch);
 #else
 	NOTICE("ETHOSN: Setup succeeded\n");
-#endif
+#endif /* ETHOSN_NPU_TZMP1 */
 
 	return 0;
 }
diff --git a/drivers/auth/auth_mod.c b/drivers/auth/auth_mod.c
index 7a9cca8..105dc05 100644
--- a/drivers/auth/auth_mod.c
+++ b/drivers/auth/auth_mod.c
@@ -20,6 +20,8 @@
 #include <lib/fconf/fconf_tbbr_getter.h>
 #include <plat/common/platform.h>
 
+#include <tools_share/zero_oid.h>
+
 /* ASN.1 tags */
 #define ASN1_INTEGER                 0x02
 
@@ -148,7 +150,7 @@
 			  const auth_img_desc_t *img_desc,
 			  void *img, unsigned int img_len)
 {
-	void *data_ptr, *pk_ptr, *pk_plat_ptr, *sig_ptr, *sig_alg_ptr;
+	void *data_ptr, *pk_ptr, *pk_plat_ptr, *sig_ptr, *sig_alg_ptr, *pk_oid;
 	unsigned int data_len, pk_len, pk_plat_len, sig_len, sig_alg_len;
 	unsigned int flags = 0;
 	int rc = 0;
@@ -226,6 +228,25 @@
 				return -1;
 			}
 		}
+
+		/*
+		 * Set Zero-OID for ROTPK(subject key) as a the certificate
+		 * does not hold Key-OID information for ROTPK.
+		 */
+		if (param->pk->cookie != NULL) {
+			pk_oid = param->pk->cookie;
+		} else {
+			pk_oid = ZERO_OID;
+		}
+
+		/*
+		 * Public key is verified at this stage, notify platform
+		 * to measure and publish it.
+		 */
+		rc = plat_mboot_measure_key(pk_oid, pk_ptr, pk_len);
+		if (rc != 0) {
+			WARN("Public Key measurement failure = %d\n", rc);
+		}
 	}
 
 	/* Ask the crypto module to verify the signature */
@@ -381,6 +402,7 @@
 			unsigned int img_len)
 {
 	const auth_img_desc_t *img_desc = NULL;
+	const auth_param_type_desc_t *type_desc = NULL;
 	const auth_method_desc_t *auth_method = NULL;
 	void *param_ptr;
 	unsigned int param_len;
@@ -462,6 +484,21 @@
 			/* Copy the parameter for later use */
 			memcpy((void *)img_desc->authenticated_data[i].data.ptr,
 					(void *)param_ptr, param_len);
+
+			/*
+			 * If this is a public key then measure and publicise
+			 * it.
+			 */
+			type_desc = img_desc->authenticated_data[i].type_desc;
+			if (type_desc->type == AUTH_PARAM_PUB_KEY) {
+				rc = plat_mboot_measure_key(type_desc->cookie,
+							    param_ptr,
+							    param_len);
+				if (rc != 0) {
+					WARN("Public Key measurement "
+					     "failure = %d\n", rc);
+				}
+			}
 		}
 	}
 
diff --git a/drivers/measured_boot/rss/rss_measured_boot.c b/drivers/measured_boot/rss/rss_measured_boot.c
index 1b2f177..258aa8d 100644
--- a/drivers/measured_boot/rss/rss_measured_boot.c
+++ b/drivers/measured_boot/rss/rss_measured_boot.c
@@ -32,6 +32,19 @@
 #  error Invalid Measured Boot algorithm.
 #endif /* MBOOT_ALG_ID */
 
+#if ENABLE_ASSERTIONS
+static bool null_arr(const uint8_t *signer_id, size_t signer_id_size)
+{
+	for (size_t i = 0U; i < signer_id_size; i++) {
+		if (signer_id[i] != 0U) {
+			return false;
+		}
+	}
+
+	return true;
+}
+#endif /* ENABLE_ASSERTIONS */
+
 /* Functions' declarations */
 void rss_measured_boot_init(struct rss_mboot_metadata *metadata_ptr)
 {
@@ -39,6 +52,7 @@
 
 	/* Init the non-const members of the metadata structure */
 	while (metadata_ptr->id != RSS_MBOOT_INVALID_ID) {
+		assert(null_arr(metadata_ptr->signer_id, MBOOT_DIGEST_SIZE));
 		metadata_ptr->sw_type_size =
 			strlen((const char *)&metadata_ptr->sw_type) + 1;
 		metadata_ptr++;
@@ -93,36 +107,53 @@
 }
 
 int rss_mboot_set_signer_id(struct rss_mboot_metadata *metadata_ptr,
-			    unsigned int img_id,
+			    const void *pk_oid,
 			    const void *pk_ptr,
 			    size_t pk_len)
 {
 	unsigned char hash_data[CRYPTO_MD_MAX_SIZE];
 	int rc;
+	bool hash_calc_done = false;
 
 	assert(metadata_ptr != NULL);
 
-	/* Get the metadata associated with this image. */
-	while ((metadata_ptr->id != RSS_MBOOT_INVALID_ID) &&
-		(metadata_ptr->id != img_id)) {
-		metadata_ptr++;
-	}
+	/*
+	 * Do an exhaustive search over the platform metadata to find
+	 * all images whose key OID matches the one passed in argument.
+	 *
+	 * Note that it is not an error if do not get any matches.
+	 * The platform may decide not to measure all of the images
+	 * in the system.
+	 */
+	while (metadata_ptr->id != RSS_MBOOT_INVALID_ID) {
+		/* Get the metadata associated with this key-oid */
+		if (metadata_ptr->pk_oid == pk_oid) {
+			if (!hash_calc_done) {
+				/* Calculate public key hash */
+				rc = crypto_mod_calc_hash(CRYPTO_MD_ID,
+							  (void *)pk_ptr,
+							  pk_len, hash_data);
+				if (rc != 0) {
+					return rc;
+				}
 
-	/* If image is not present in metadata array then skip */
-	if (metadata_ptr->id == RSS_MBOOT_INVALID_ID) {
-		return 0;
-	}
+				hash_calc_done = true;
+			}
 
-	/* Calculate public key hash */
-	rc = crypto_mod_calc_hash(CRYPTO_MD_ID, (void *)pk_ptr,
-				  pk_len, hash_data);
-	if (rc != 0) {
-		return rc;
-	}
+			/*
+			 * Fill the signer-ID field with the newly/already
+			 * computed hash of the public key and update its
+			 * signer ID size field with compile-time decided
+			 * digest size.
+			 */
+			(void)memcpy(metadata_ptr->signer_id,
+				     hash_data,
+				     MBOOT_DIGEST_SIZE);
+			metadata_ptr->signer_id_size = MBOOT_DIGEST_SIZE;
+		}
 
-	/* Update metadata struct with the received signer_id */
-	(void)memcpy(metadata_ptr->signer_id, hash_data, MBOOT_DIGEST_SIZE);
-	metadata_ptr->signer_id_size = MBOOT_DIGEST_SIZE;
+		metadata_ptr++;
+	}
 
 	return 0;
 }
diff --git a/fdts/juno.dts b/fdts/juno.dts
index 56fe167..8e373e7 100644
--- a/fdts/juno.dts
+++ b/fdts/juno.dts
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2021, Arm Limited. All rights reserved.
+ * Copyright (c) 2021-2023, Arm Limited. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -10,6 +10,6 @@
 
 };
 
-#if ARM_ETHOSN_NPU_DRIVER
+#if ETHOSN_NPU_DRIVER
 	#include "juno-ethosn.dtsi"
 #endif
diff --git a/include/drivers/measured_boot/rss/rss_measured_boot.h b/include/drivers/measured_boot/rss/rss_measured_boot.h
index 76affd8..7ab517c 100644
--- a/include/drivers/measured_boot/rss/rss_measured_boot.h
+++ b/include/drivers/measured_boot/rss/rss_measured_boot.h
@@ -40,6 +40,7 @@
 	size_t  version_size;
 	uint8_t sw_type[SW_TYPE_MAX_SIZE];
 	size_t  sw_type_size;
+	void    *pk_oid;
 	bool    lock_measurement;
 };
 
@@ -49,9 +50,8 @@
 				 uintptr_t data_base, uint32_t data_size,
 				 uint32_t data_id);
 
-/* TODO: These metadata are currently not available during TF-A boot */
 int rss_mboot_set_signer_id(struct rss_mboot_metadata *metadata_ptr,
-			    unsigned int img_id, const void *pk_ptr,
+			    const void *pk_oid, const void *pk_ptr,
 			    size_t pk_len);
 
 #endif /* RSS_MEASURED_BOOT_H */
diff --git a/include/plat/arm/common/fconf_ethosn_getter.h b/include/plat/arm/common/fconf_ethosn_getter.h
index cafbc3e..d45c269 100644
--- a/include/plat/arm/common/fconf_ethosn_getter.h
+++ b/include/plat/arm/common/fconf_ethosn_getter.h
@@ -57,8 +57,6 @@
 	struct ethosn_device_t devices[ETHOSN_DEV_NUM_MAX];
 };
 
-int fconf_populate_arm_ethosn(uintptr_t config);
-
 extern struct ethosn_config_t ethosn_config;
 
 #endif /* FCONF_ETHOSN_GETTER_H */
diff --git a/include/plat/common/platform.h b/include/plat/common/platform.h
index d146a29..e024d91 100644
--- a/include/plat/common/platform.h
+++ b/include/plat/common/platform.h
@@ -146,6 +146,8 @@
 int plat_mboot_measure_critical_data(unsigned int critical_data_id,
 				     const void *base,
 				     size_t size);
+int plat_mboot_measure_key(const void *pk_oid, const void *pk_ptr,
+			   size_t pk_len);
 #else
 static inline int plat_mboot_measure_image(unsigned int image_id __unused,
 					   image_info_t *image_data __unused)
@@ -159,6 +161,12 @@
 {
 	return 0;
 }
+static inline int plat_mboot_measure_key(const void *pk_oid __unused,
+					 const void *pk_ptr __unused,
+					 size_t pk_len __unused)
+{
+	return 0;
+}
 #endif /* MEASURED_BOOT */
 
 /*******************************************************************************
diff --git a/include/tools_share/cca_oid.h b/include/tools_share/cca_oid.h
index 2ca12c9..8c53ef9 100644
--- a/include/tools_share/cca_oid.h
+++ b/include/tools_share/cca_oid.h
@@ -28,4 +28,17 @@
 /* CCAFirmwareNVCounter - Non-volatile counter extension */
 #define CCA_FW_NVCOUNTER_OID			"1.3.6.1.4.1.4128.2100.3"
 
+/*
+ * First undef previous definitions from tbbr_oid.h.
+ * CCA ROTPK authenticates BL31 and its configuration image in
+ * CCA CoT.
+ **/
+#undef BL31_IMAGE_KEY_OID
+#undef SOC_FW_CONFIG_KEY_OID
+#undef HW_CONFIG_KEY_OID
+#define BL31_IMAGE_KEY_OID			ZERO_OID
+#define SOC_FW_CONFIG_KEY_OID			ZERO_OID
+#define HW_CONFIG_KEY_OID			ZERO_OID
+#define RMM_IMAGE_KEY_OID			ZERO_OID
+
 #endif /* CCA_OID_H */
diff --git a/include/tools_share/dualroot_oid.h b/include/tools_share/dualroot_oid.h
index 3e88a6d..3762c79 100644
--- a/include/tools_share/dualroot_oid.h
+++ b/include/tools_share/dualroot_oid.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020, Arm Limited. All rights reserved.
+ * Copyright (c) 2020-2023, Arm Limited. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
diff --git a/include/tools_share/tbbr_oid.h b/include/tools_share/tbbr_oid.h
index 52b43ab..9881d1a 100644
--- a/include/tools_share/tbbr_oid.h
+++ b/include/tools_share/tbbr_oid.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2020, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2023, Arm Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -7,6 +7,8 @@
 #ifndef TBBR_OID_H
 #define TBBR_OID_H
 
+#include "zero_oid.h"
+
 #define	MAX_OID_NAME_LEN	30
 
 /*
@@ -160,6 +162,14 @@
 #define SP_PKG7_HASH_OID			"1.3.6.1.4.1.4128.2100.1307"
 #define SP_PKG8_HASH_OID			"1.3.6.1.4.1.4128.2100.1308"
 
+/*
+ * Public Keys present in SOC FW content certificates authenticate BL31 and
+ * its configuration.
+ */
+#define BL31_IMAGE_KEY_OID			SOC_FW_CONTENT_CERT_PK_OID
+#define SOC_FW_CONFIG_KEY_OID			SOC_FW_CONTENT_CERT_PK_OID
+#define HW_CONFIG_KEY_OID			ZERO_OID
+
 #ifdef PLAT_DEF_OID
 #include <platform_oid.h>
 #endif
diff --git a/include/tools_share/zero_oid.h b/include/tools_share/zero_oid.h
new file mode 100644
index 0000000..9b83094
--- /dev/null
+++ b/include/tools_share/zero_oid.h
@@ -0,0 +1,12 @@
+/*
+ * Copyright (c) 2023, Arm Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#ifndef ZERO_OID_H
+#define ZERO_OID_H
+
+#define ZERO_OID                              "0.0.0.0.0.0.0.0.0"
+
+#endif /* ZERO_OID_H */
diff --git a/plat/arm/board/fvp/fvp_bl1_measured_boot.c b/plat/arm/board/fvp/fvp_bl1_measured_boot.c
index b8431c5..dc95ba1 100644
--- a/plat/arm/board/fvp/fvp_bl1_measured_boot.c
+++ b/plat/arm/board/fvp/fvp_bl1_measured_boot.c
@@ -9,6 +9,7 @@
 #include <drivers/measured_boot/event_log/event_log.h>
 #include <drivers/measured_boot/rss/rss_measured_boot.h>
 #include <plat/arm/common/plat_arm.h>
+#include <tools_share/zero_oid.h>
 
 /* Event Log data */
 static uint8_t event_log[PLAT_ARM_EVENT_LOG_MAX_SIZE];
@@ -31,18 +32,21 @@
 		.slot = U(6),
 		.signer_id_size = SIGNER_ID_MIN_SIZE,
 		.sw_type = RSS_MBOOT_FW_CONFIG_STRING,
+		.pk_oid = ZERO_OID,
 		.lock_measurement = true },
 	{
 		.id = TB_FW_CONFIG_ID,
 		.slot = U(7),
 		.signer_id_size = SIGNER_ID_MIN_SIZE,
 		.sw_type = RSS_MBOOT_TB_FW_CONFIG_STRING,
+		.pk_oid = ZERO_OID,
 		.lock_measurement = true },
 	{
 		.id = BL2_IMAGE_ID,
 		.slot = U(8),
 		.signer_id_size = SIGNER_ID_MIN_SIZE,
 		.sw_type = RSS_MBOOT_BL2_STRING,
+		.pk_oid = ZERO_OID,
 		.lock_measurement = true },
 
 	{
diff --git a/plat/arm/board/fvp/fvp_bl2_measured_boot.c b/plat/arm/board/fvp/fvp_bl2_measured_boot.c
index 564118e..349e064 100644
--- a/plat/arm/board/fvp/fvp_bl2_measured_boot.c
+++ b/plat/arm/board/fvp/fvp_bl2_measured_boot.c
@@ -9,7 +9,11 @@
 #include <common/tbbr/tbbr_img_def.h>
 #include <drivers/measured_boot/event_log/event_log.h>
 #include <drivers/measured_boot/rss/rss_measured_boot.h>
+#if defined(ARM_COT_cca)
+#include <tools_share/cca_oid.h>
+#else
 #include <tools_share/tbbr_oid.h>
+#endif /* ARM_COT_cca */
 #include <fvp_critical_data.h>
 
 #include <plat/arm/common/plat_arm.h>
@@ -62,25 +66,31 @@
 		.slot = U(9),
 		.signer_id_size = SIGNER_ID_MIN_SIZE,
 		.sw_type = RSS_MBOOT_BL31_STRING,
+		.pk_oid = BL31_IMAGE_KEY_OID,
 		.lock_measurement = true },
 	{
 		.id = HW_CONFIG_ID,
 		.slot = U(10),
 		.signer_id_size = SIGNER_ID_MIN_SIZE,
 		.sw_type = RSS_MBOOT_HW_CONFIG_STRING,
+		.pk_oid = HW_CONFIG_KEY_OID,
 		.lock_measurement = true },
 	{
 		.id = SOC_FW_CONFIG_ID,
 		.slot = U(11),
 		.signer_id_size = SIGNER_ID_MIN_SIZE,
 		.sw_type = RSS_MBOOT_SOC_FW_CONFIG_STRING,
+		.pk_oid = SOC_FW_CONFIG_KEY_OID,
 		.lock_measurement = true },
+#if ENABLE_RME
 	{
 		.id = RMM_IMAGE_ID,
 		.slot = U(12),
 		.signer_id_size = SIGNER_ID_MIN_SIZE,
 		.sw_type = RSS_MBOOT_RMM_STRING,
+		.pk_oid = RMM_IMAGE_KEY_OID,
 		.lock_measurement = true },
+#endif /* ENABLE_RME */
 	{
 		.id = RSS_MBOOT_INVALID_ID }
 };
diff --git a/plat/arm/board/fvp/fvp_common_measured_boot.c b/plat/arm/board/fvp/fvp_common_measured_boot.c
index 7419e5e..0c1d5e7 100644
--- a/plat/arm/board/fvp/fvp_common_measured_boot.c
+++ b/plat/arm/board/fvp/fvp_common_measured_boot.c
@@ -45,3 +45,10 @@
 
 	return rc;
 }
+
+int plat_mboot_measure_key(const void *pk_oid, const void *pk_ptr,
+			   size_t pk_len)
+{
+	return rss_mboot_set_signer_id(fvp_rss_mboot_metadata, pk_oid, pk_ptr,
+				       pk_len);
+}
diff --git a/plat/arm/board/juno/cert_create_tbbr.mk b/plat/arm/board/juno/cert_create_tbbr.mk
index c092fe0..4d133b2 100644
--- a/plat/arm/board/juno/cert_create_tbbr.mk
+++ b/plat/arm/board/juno/cert_create_tbbr.mk
@@ -7,7 +7,7 @@
 PLAT_DEF_OID := 1
 
 ifeq (${PLAT_DEF_OID},1)
-  ifeq (${ARM_ETHOSN_NPU_DRIVER},1)
+  ifeq (${ETHOSN_NPU_DRIVER},1)
     $(eval $(call add_define, PLAT_DEF_OID))
     $(eval $(call add_define, PDEF_CERTS))
     $(eval $(call add_define, PDEF_EXTS))
diff --git a/plat/arm/board/juno/fdts/juno_tb_fw_config.dts b/plat/arm/board/juno/fdts/juno_tb_fw_config.dts
index 986299e..ec72160 100644
--- a/plat/arm/board/juno/fdts/juno_tb_fw_config.dts
+++ b/plat/arm/board/juno/fdts/juno_tb_fw_config.dts
@@ -51,10 +51,10 @@
 			tos_fw_content_cert_uuid = "a49f4411-5e63-e411-8728-3f05722af33d";
 			nt_fw_content_cert_uuid = "8ec4c1f3-5d63-e411-a7a9-87ee40b23fa7";
 			plat_sp_content_cert_uuid = "776dfd44-8697-4c3b-91eb-c13e025a2a6f";
-#if ARM_ETHOSN_NPU_TZMP1
-			arm_ethosn_npu_fw_uuid = "cfd499b5-a3bc-4a7e-98cb-48a41cb8dae1";
-			arm_ethosn_npu_fw_key_cert_uuid = "5666d004-ab98-40aa-8988-b72a03a256e2";
-			arm_ethosn_npu_fw_content_cert_uuid = "a5c418da-430f-48b1-88cd-93f67889d9ed";
+#if ETHOSN_NPU_TZMP1
+			ethosn_npu_fw_uuid = "cfd499b5-a3bc-4a7e-98cb-48a41cb8dae1";
+			ethosn_npu_fw_key_cert_uuid = "5666d004-ab98-40aa-8988-b72a03a256e2";
+			ethosn_npu_fw_content_cert_uuid = "a5c418da-430f-48b1-88cd-93f67889d9ed";
 #endif
 		};
 	};
diff --git a/plat/arm/board/juno/fip/plat_def_fip_uuid.h b/plat/arm/board/juno/fip/plat_def_fip_uuid.h
index 0f0d11d..46adf24 100644
--- a/plat/arm/board/juno/fip/plat_def_fip_uuid.h
+++ b/plat/arm/board/juno/fip/plat_def_fip_uuid.h
@@ -7,8 +7,8 @@
 #ifndef PLAT_DEF_FIP_UUID_H
 #define PLAT_DEF_FIP_UUID_H
 
-#ifdef ARM_ETHOSN_NPU_TZMP1
+#ifdef ETHOSN_NPU_TZMP1
 #include <drivers/arm/ethosn_fip.h>
-#endif
+#endif /* ETHOSN_NPU_TZMP1 */
 
 #endif /* PLAT_DEF_FIP_UUID_H */
diff --git a/plat/arm/board/juno/fip/plat_def_uuid_config.c b/plat/arm/board/juno/fip/plat_def_uuid_config.c
index 8133927..705a8ca 100644
--- a/plat/arm/board/juno/fip/plat_def_uuid_config.c
+++ b/plat/arm/board/juno/fip/plat_def_uuid_config.c
@@ -12,11 +12,11 @@
 #include "plat_def_fip_uuid.h"
 
 toc_entry_t plat_def_toc_entries[] = {
-#ifdef ARM_ETHOSN_NPU_TZMP1
+#ifdef ETHOSN_NPU_TZMP1
 	ETHOSN_FW_KEY_CERTIFICATE_DEF,
 	ETHOSN_FW_CONTENT_CERTIFICATE_DEF,
 	ETHOSN_FW_DEF,
-#endif
+#endif /* ETHOSN_NPU_TZMP1 */
 	{
 		.name = NULL,
 		.uuid = { { 0 } },
diff --git a/plat/arm/board/juno/include/plat_tbbr_img_def.h b/plat/arm/board/juno/include/plat_tbbr_img_def.h
index 3e17ed3..5fbeb4e 100644
--- a/plat/arm/board/juno/include/plat_tbbr_img_def.h
+++ b/plat/arm/board/juno/include/plat_tbbr_img_def.h
@@ -7,12 +7,12 @@
 #ifndef JUNO_IMG_DEF_H
 #define JUNO_IMG_DEF_H
 
-#if ARM_ETHOSN_NPU_TZMP1
+#if ETHOSN_NPU_TZMP1
 /* Arm(R) Ethos(TM)-N NPU images */
-#define ARM_ETHOSN_NPU_FW_KEY_CERT_ID		U(MAX_IMG_IDS_WITH_SPMDS + 1)
-#define ARM_ETHOSN_NPU_FW_CONTENT_CERT_ID	U(MAX_IMG_IDS_WITH_SPMDS + 2)
-#define ARM_ETHOSN_NPU_FW_IMAGE_ID		U(MAX_IMG_IDS_WITH_SPMDS + 3)
+#define ETHOSN_NPU_FW_KEY_CERT_ID		U(MAX_IMG_IDS_WITH_SPMDS + 1)
+#define ETHOSN_NPU_FW_CONTENT_CERT_ID		U(MAX_IMG_IDS_WITH_SPMDS + 2)
+#define ETHOSN_NPU_FW_IMAGE_ID			U(MAX_IMG_IDS_WITH_SPMDS + 3)
 #define MAX_NUMBER_IDS				U(MAX_IMG_IDS_WITH_SPMDS + 4)
-#endif
+#endif /* ETHOSN_NPU_TZMP1 */
 
 #endif	/* JUNO_IMG_DEF_H */
diff --git a/plat/arm/board/juno/include/platform_def.h b/plat/arm/board/juno/include/platform_def.h
index 47258cb..aa96038 100644
--- a/plat/arm/board/juno/include/platform_def.h
+++ b/plat/arm/board/juno/include/platform_def.h
@@ -327,15 +327,15 @@
 
 /* Protected NSAIDs and memory regions for the Arm(R) Ethos(TM)-N NPU driver */
 #ifdef JUNO_ETHOSN_TZMP1
-#define ARM_ETHOSN_NPU_PROT_FW_NSAID		JUNO_ETHOSN_TZC400_NSAID_FW_PROT
-#define ARM_ETHOSN_NPU_PROT_RW_DATA_NSAID	JUNO_ETHOSN_TZC400_NSAID_DATA_RW_PROT
-#define ARM_ETHOSN_NPU_PROT_RO_DATA_NSAID	JUNO_ETHOSN_TZC400_NSAID_DATA_RO_PROT
+#define ETHOSN_NPU_PROT_FW_NSAID		JUNO_ETHOSN_TZC400_NSAID_FW_PROT
+#define ETHOSN_NPU_PROT_RW_DATA_NSAID		JUNO_ETHOSN_TZC400_NSAID_DATA_RW_PROT
+#define ETHOSN_NPU_PROT_RO_DATA_NSAID		JUNO_ETHOSN_TZC400_NSAID_DATA_RO_PROT
 
-#define ARM_ETHOSN_NPU_NS_RW_DATA_NSAID		JUNO_ETHOSN_TZC400_NSAID_DATA_RW_NS
-#define ARM_ETHOSN_NPU_NS_RO_DATA_NSAID		JUNO_ETHOSN_TZC400_NSAID_DATA_RO_NS
+#define ETHOSN_NPU_NS_RW_DATA_NSAID		JUNO_ETHOSN_TZC400_NSAID_DATA_RW_NS
+#define ETHOSN_NPU_NS_RO_DATA_NSAID		JUNO_ETHOSN_TZC400_NSAID_DATA_RO_NS
 
-#define ARM_ETHOSN_NPU_FW_IMAGE_BASE		JUNO_ETHOSN_FW_TZC_PROT_DRAM2_BASE
-#define ARM_ETHOSN_NPU_FW_IMAGE_LIMIT \
+#define ETHOSN_NPU_FW_IMAGE_BASE		JUNO_ETHOSN_FW_TZC_PROT_DRAM2_BASE
+#define ETHOSN_NPU_FW_IMAGE_LIMIT \
 	(JUNO_ETHOSN_FW_TZC_PROT_DRAM2_BASE + JUNO_ETHOSN_FW_TZC_PROT_DRAM2_SIZE)
 #endif
 
diff --git a/plat/arm/board/juno/juno_tbbr_cot_bl2.c b/plat/arm/board/juno/juno_tbbr_cot_bl2.c
index d48d2e6..8930dbb 100644
--- a/plat/arm/board/juno/juno_tbbr_cot_bl2.c
+++ b/plat/arm/board/juno/juno_tbbr_cot_bl2.c
@@ -32,9 +32,9 @@
 #if defined(SPD_spmd)
 static unsigned char sp_pkg_hash_buf[MAX_SP_IDS][HASH_DER_LEN];
 #endif /* SPD_spmd */
-#if ARM_ETHOSN_NPU_TZMP1
+#if ETHOSN_NPU_TZMP1
 static unsigned char npu_fw_image_hash_buf[HASH_DER_LEN];
-#endif /* ARM_ETHOSN_NPU_TZMP1 */
+#endif /* ETHOSN_NPU_TZMP1 */
 
 
 static auth_param_type_desc_t non_trusted_nv_ctr = AUTH_PARAM_TYPE_DESC(
@@ -87,12 +87,12 @@
 static auth_param_type_desc_t sp_pkg8_hash = AUTH_PARAM_TYPE_DESC(
 		AUTH_PARAM_HASH, SP_PKG8_HASH_OID);
 #endif /* SPD_spmd */
-#if ARM_ETHOSN_NPU_TZMP1
+#if ETHOSN_NPU_TZMP1
 static auth_param_type_desc_t npu_fw_cert_pk = AUTH_PARAM_TYPE_DESC(
 		AUTH_PARAM_PUB_KEY, ETHOSN_NPU_FW_CONTENT_CERT_PK_OID);
 static auth_param_type_desc_t npu_fw_image_hash = AUTH_PARAM_TYPE_DESC(
 		AUTH_PARAM_HASH, ETHOSN_NPU_FW_BINARY_OID);
-#endif /* ARM_ETHOSN_NPU_TZMP1 */
+#endif /* ETHOSN_NPU_TZMP1 */
 
 /*
  * Trusted key certificate
@@ -662,9 +662,9 @@
 DEFINE_SIP_SP_PKG(8);
 #endif /* SPD_spmd */
 
-#if ARM_ETHOSN_NPU_TZMP1
+#if ETHOSN_NPU_TZMP1
 static const auth_img_desc_t npu_fw_key_cert = {
-	.img_id = ARM_ETHOSN_NPU_FW_KEY_CERT_ID,
+	.img_id = ETHOSN_NPU_FW_KEY_CERT_ID,
 	.img_type = IMG_CERT,
 	.parent = &trusted_key_cert,
 	.img_auth_methods = (const auth_method_desc_t[AUTH_METHOD_NUM]) {
@@ -697,7 +697,7 @@
 };
 
 static const auth_img_desc_t npu_fw_content_cert = {
-	.img_id = ARM_ETHOSN_NPU_FW_CONTENT_CERT_ID,
+	.img_id = ETHOSN_NPU_FW_CONTENT_CERT_ID,
 	.img_type = IMG_CERT,
 	.parent = &npu_fw_key_cert,
 	.img_auth_methods = (const auth_method_desc_t[AUTH_METHOD_NUM]) {
@@ -730,7 +730,7 @@
 };
 
 static const auth_img_desc_t npu_fw_image = {
-	.img_id = ARM_ETHOSN_NPU_FW_IMAGE_ID,
+	.img_id = ETHOSN_NPU_FW_IMAGE_ID,
 	.img_type = IMG_RAW,
 	.parent = &npu_fw_content_cert,
 	.img_auth_methods = (const auth_method_desc_t[AUTH_METHOD_NUM]) {
@@ -743,7 +743,7 @@
 		}
 	}
 };
-#endif /* ARM_ETHOSN_NPU_TZMP1 */
+#endif /* ETHOSN_NPU_TZMP1 */
 
 
 static const auth_img_desc_t * const cot_desc[] = {
@@ -778,11 +778,11 @@
 	[SP_PKG7_ID]				=	&sp_pkg7,
 	[SP_PKG8_ID]				=       &sp_pkg8,
 #endif
-#if ARM_ETHOSN_NPU_TZMP1
-	[ARM_ETHOSN_NPU_FW_KEY_CERT_ID]		=	&npu_fw_key_cert,
-	[ARM_ETHOSN_NPU_FW_CONTENT_CERT_ID]	=	&npu_fw_content_cert,
-	[ARM_ETHOSN_NPU_FW_IMAGE_ID]		=	&npu_fw_image,
-#endif /* ARM_ETHOSN_NPU_TZMP1 */
+#if ETHOSN_NPU_TZMP1
+	[ETHOSN_NPU_FW_KEY_CERT_ID]		=	&npu_fw_key_cert,
+	[ETHOSN_NPU_FW_CONTENT_CERT_ID]		=	&npu_fw_content_cert,
+	[ETHOSN_NPU_FW_IMAGE_ID]		=	&npu_fw_image,
+#endif /* ETHOSN_NPU_TZMP1 */
 };
 
 /* Register the CoT in the authentication module */
diff --git a/plat/arm/board/juno/platform.mk b/plat/arm/board/juno/platform.mk
index a4e6407..19091f3 100644
--- a/plat/arm/board/juno/platform.mk
+++ b/plat/arm/board/juno/platform.mk
@@ -43,8 +43,8 @@
 JUNO_TZMP1		:=	0
 $(eval $(call assert_boolean,JUNO_TZMP1))
 ifeq (${JUNO_TZMP1}, 1)
-  ifeq (${ARM_ETHOSN_NPU_TZMP1},1)
-    $(error JUNO_TZMP1 cannot be used together with ARM_ETHOSN_NPU_TZMP1)
+  ifeq (${ETHOSN_NPU_TZMP1},1)
+    $(error JUNO_TZMP1 cannot be used together with ETHOSN_NPU_TZMP1)
   else
     $(eval $(call add_define,JUNO_TZMP1))
   endif
@@ -207,6 +207,7 @@
 # Add the HW_CONFIG to FIP and specify the same to certtool
 $(eval $(call TOOL_ADD_PAYLOAD,${HW_CONFIG},--hw-config,${HW_CONFIG}))
 
+include drivers/arm/ethosn/ethosn_npu.mk
 include plat/arm/board/common/board_common.mk
 include plat/arm/common/arm_common.mk
 include plat/arm/soc/common/soc_css.mk
diff --git a/plat/arm/board/tc/tc_bl1_measured_boot.c b/plat/arm/board/tc/tc_bl1_measured_boot.c
index 6d4bb07..6821a6a 100644
--- a/plat/arm/board/tc/tc_bl1_measured_boot.c
+++ b/plat/arm/board/tc/tc_bl1_measured_boot.c
@@ -9,6 +9,7 @@
 #include <drivers/arm/rss_comms.h>
 #include <drivers/measured_boot/rss/rss_measured_boot.h>
 #include <lib/psa/measured_boot.h>
+#include <tools_share/zero_oid.h>
 
 #include <plat/arm/common/plat_arm.h>
 #include <platform_def.h>
@@ -22,18 +23,21 @@
 		.slot = U(6),
 		.signer_id_size = SIGNER_ID_MIN_SIZE,
 		.sw_type = RSS_MBOOT_FW_CONFIG_STRING,
+		.pk_oid = ZERO_OID,
 		.lock_measurement = true },
 	{
 		.id = TB_FW_CONFIG_ID,
 		.slot = U(7),
 		.signer_id_size = SIGNER_ID_MIN_SIZE,
 		.sw_type = RSS_MBOOT_TB_FW_CONFIG_STRING,
+		.pk_oid = ZERO_OID,
 		.lock_measurement = true },
 	{
 		.id = BL2_IMAGE_ID,
 		.slot = U(8),
 		.signer_id_size = SIGNER_ID_MIN_SIZE,
 		.sw_type = RSS_MBOOT_BL2_STRING,
+		.pk_oid = ZERO_OID,
 		.lock_measurement = true },
 
 	{
diff --git a/plat/arm/board/tc/tc_bl2_measured_boot.c b/plat/arm/board/tc/tc_bl2_measured_boot.c
index 9039853..4b79170 100644
--- a/plat/arm/board/tc/tc_bl2_measured_boot.c
+++ b/plat/arm/board/tc/tc_bl2_measured_boot.c
@@ -9,6 +9,7 @@
 #include <drivers/arm/rss_comms.h>
 #include <drivers/measured_boot/rss/rss_measured_boot.h>
 #include <lib/psa/measured_boot.h>
+#include <tools_share/tbbr_oid.h>
 
 #include <plat/common/common_def.h>
 #include <platform_def.h>
@@ -22,18 +23,21 @@
 		.slot = U(9),
 		.signer_id_size = SIGNER_ID_MIN_SIZE,
 		.sw_type = RSS_MBOOT_BL31_STRING,
+		.pk_oid = BL31_IMAGE_KEY_OID,
 		.lock_measurement = true },
 	{
 		.id = HW_CONFIG_ID,
 		.slot = U(10),
 		.signer_id_size = SIGNER_ID_MIN_SIZE,
 		.sw_type = RSS_MBOOT_HW_CONFIG_STRING,
+		.pk_oid = HW_CONFIG_KEY_OID,
 		.lock_measurement = true },
 	{
 		.id = SOC_FW_CONFIG_ID,
 		.slot = U(11),
 		.signer_id_size = SIGNER_ID_MIN_SIZE,
 		.sw_type = RSS_MBOOT_SOC_FW_CONFIG_STRING,
+		.pk_oid = SOC_FW_CONFIG_KEY_OID,
 		.lock_measurement = true },
 	{
 		.id = RSS_MBOOT_INVALID_ID }
diff --git a/plat/arm/board/tc/tc_common_measured_boot.c b/plat/arm/board/tc/tc_common_measured_boot.c
index eddcc81..925a411 100644
--- a/plat/arm/board/tc/tc_common_measured_boot.c
+++ b/plat/arm/board/tc/tc_common_measured_boot.c
@@ -28,3 +28,9 @@
 
 	return err;
 }
+
+int plat_mboot_measure_key(void *pk_oid, void *pk_ptr, unsigned int pk_len)
+{
+	return rss_mboot_set_signer_id(tc_rss_mboot_metadata, pk_oid, pk_ptr,
+				       pk_len);
+}
diff --git a/plat/arm/common/aarch64/arm_bl2_mem_params_desc.c b/plat/arm/common/aarch64/arm_bl2_mem_params_desc.c
index e512192..9a65e7c 100644
--- a/plat/arm/common/aarch64/arm_bl2_mem_params_desc.c
+++ b/plat/arm/common/aarch64/arm_bl2_mem_params_desc.c
@@ -223,17 +223,17 @@
 	},
 #endif /* EL3_PAYLOAD_BASE */
 
-# if ARM_ETHOSN_NPU_TZMP1
+# if ETHOSN_NPU_TZMP1
 	{
-		.image_id = ARM_ETHOSN_NPU_FW_IMAGE_ID,
+		.image_id = ETHOSN_NPU_FW_IMAGE_ID,
 		SET_STATIC_PARAM_HEAD(image_info, PARAM_IMAGE_BINARY,
 				      VERSION_2, image_info_t, 0),
-		.image_info.image_base = ARM_ETHOSN_NPU_FW_IMAGE_BASE,
-		.image_info.image_max_size = ARM_ETHOSN_NPU_FW_IMAGE_LIMIT -
-			ARM_ETHOSN_NPU_FW_IMAGE_BASE,
+		.image_info.image_base = ETHOSN_NPU_FW_IMAGE_BASE,
+		.image_info.image_max_size = ETHOSN_NPU_FW_IMAGE_LIMIT -
+			ETHOSN_NPU_FW_IMAGE_BASE,
 		.next_handoff_image_id = INVALID_IMAGE_ID,
 	},
-# endif
+#endif /* ETHOSN_NPU_TZMP1 */
 };
 
 REGISTER_BL_IMAGE_DESCS(bl2_mem_params_descs)
diff --git a/plat/arm/common/arm_common.mk b/plat/arm/common/arm_common.mk
index 647a9d9..4914553 100644
--- a/plat/arm/common/arm_common.mk
+++ b/plat/arm/common/arm_common.mk
@@ -114,48 +114,6 @@
   endif
 endif
 
-# Arm(R) Ethos(TM)-N NPU SiP service
-ARM_ETHOSN_NPU_DRIVER			:=	0
-$(eval $(call assert_boolean,ARM_ETHOSN_NPU_DRIVER))
-$(eval $(call add_define,ARM_ETHOSN_NPU_DRIVER))
-
-# Arm(R) Ethos(TM)-N NPU TZMP1
-ARM_ETHOSN_NPU_TZMP1			:=	0
-$(eval $(call assert_boolean,ARM_ETHOSN_NPU_TZMP1))
-$(eval $(call add_define,ARM_ETHOSN_NPU_TZMP1))
-ifeq (${ARM_ETHOSN_NPU_TZMP1},1)
-  ifeq (${ARM_ETHOSN_NPU_DRIVER},0)
-    $(error ARM_ETHOSN_NPU_TZMP1 is only available if ARM_ETHOSN_NPU_DRIVER=1)
-  endif
-  ifeq (${PLAT},juno)
-    $(eval $(call add_define,JUNO_ETHOSN_TZMP1))
-  else
-    $(error ARM_ETHOSN_NPU_TZMP1 only supported on Juno platform, not ${PLAT})
-  endif
-
-  ifeq (${TRUSTED_BOARD_BOOT},0)
-    # We rely on TRUSTED_BOARD_BOOT to prevent the firmware code from being
-    # tampered with, which is required to protect the confidentiality of protected
-    # inference data.
-    $(error ARM_ETHOSN_NPU_TZMP1 is only available if TRUSTED_BOARD_BOOT is enabled)
-  endif
-
-  # We need the FW certificate and key certificate
-  $(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/npu_fw_key.crt,--npu-fw-key-cert))
-  $(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/npu_fw_content.crt,--npu-fw-cert))
-  # Needed for our OIDs to be available in tbbr_cot_bl2.c
-  $(eval $(call add_define, PLAT_DEF_OID))
-  PLAT_INCLUDES	+=	-I${PLAT_DIR}certificate/include
-  PLAT_INCLUDES	+=	-Iinclude/drivers/arm/
-
-  # We need the firmware to be built into the FIP
-  $(eval $(call TOOL_ADD_IMG,ARM_ETHOSN_NPU_FW,--npu-fw))
-
-  # Needed so that UUIDs from the FIP are available in BL2
-  $(eval $(call add_define,PLAT_DEF_FIP_UUID))
-  PLAT_INCLUDES		+=	-I${PLAT_DIR}fip
-endif # ARM_ETHOSN_NPU_TZMP1
-
 # Use an implementation of SHA-256 with a smaller memory footprint but reduced
 # speed.
 $(eval $(call add_define,MBEDTLS_SHA256_SMALLER))
@@ -348,18 +306,18 @@
 				plat/arm/common/arm_topology.c			\
 				plat/common/plat_psci_common.c
 
-ifneq ($(filter 1,${ENABLE_PMF} ${ARM_ETHOSN_NPU_DRIVER}),)
+ifneq ($(filter 1,${ENABLE_PMF} ${ETHOSN_NPU_DRIVER}),)
 ARM_SVC_HANDLER_SRCS :=
 
 ifeq (${ENABLE_PMF},1)
 ARM_SVC_HANDLER_SRCS	+=	lib/pmf/pmf_smc.c
 endif
 
-ifeq (${ARM_ETHOSN_NPU_DRIVER},1)
+ifeq (${ETHOSN_NPU_DRIVER},1)
 ARM_SVC_HANDLER_SRCS	+=	plat/arm/common/fconf/fconf_ethosn_getter.c	\
 				drivers/delay_timer/delay_timer.c		\
 				drivers/arm/ethosn/ethosn_smc.c
-ifeq (${ARM_ETHOSN_NPU_TZMP1},1)
+ifeq (${ETHOSN_NPU_TZMP1},1)
 ARM_SVC_HANDLER_SRCS	+=	drivers/arm/ethosn/ethosn_big_fw.c
 endif
 endif
diff --git a/plat/arm/common/arm_sip_svc.c b/plat/arm/common/arm_sip_svc.c
index af8a02f..6af23a7 100644
--- a/plat/arm/common/arm_sip_svc.c
+++ b/plat/arm/common/arm_sip_svc.c
@@ -34,13 +34,13 @@
 
 #endif /* USE_DEBUGFS */
 
-#if ARM_ETHOSN_NPU_DRIVER
+#if ETHOSN_NPU_DRIVER
 
 	if (ethosn_smc_setup() != 0) {
 		return 1;
 	}
 
-#endif /* ARM_ETHOSN_NPU_DRIVER */
+#endif /* ETHOSN_NPU_DRIVER */
 
 	return 0;
 }
@@ -81,14 +81,14 @@
 
 #endif /* USE_DEBUGFS */
 
-#if ARM_ETHOSN_NPU_DRIVER
+#if ETHOSN_NPU_DRIVER
 
 	if (is_ethosn_fid(smc_fid)) {
 		return ethosn_smc_handler(smc_fid, x1, x2, x3, x4, cookie,
 					  handle, flags);
 	}
 
-#endif /* ARM_ETHOSN_NPU_DRIVER */
+#endif /* ETHOSN_NPU_DRIVER */
 
 	switch (smc_fid) {
 	case ARM_SIP_SVC_EXE_STATE_SWITCH: {
@@ -114,10 +114,10 @@
 		/* PMF calls */
 		call_count += PMF_NUM_SMC_CALLS;
 
-#if ARM_ETHOSN_NPU_DRIVER
+#if ETHOSN_NPU_DRIVER
 		/* ETHOSN calls */
 		call_count += ETHOSN_NUM_SMC_CALLS;
-#endif /* ARM_ETHOSN_NPU_DRIVER */
+#endif          /* ETHOSN_NPU_DRIVER */
 
 		/* State switch call */
 		call_count += 1;
diff --git a/plat/arm/common/fconf/arm_fconf_io.c b/plat/arm/common/fconf/arm_fconf_io.c
index 743cc90..27acc3a 100644
--- a/plat/arm/common/fconf/arm_fconf_io.c
+++ b/plat/arm/common/fconf/arm_fconf_io.c
@@ -68,9 +68,9 @@
 	[TOS_FW_CONFIG_ID] = {UUID_TOS_FW_CONFIG},
 	[NT_FW_CONFIG_ID] = {UUID_NT_FW_CONFIG},
 	[RMM_IMAGE_ID] = {UUID_REALM_MONITOR_MGMT_FIRMWARE},
-#if ARM_ETHOSN_NPU_TZMP1
-	[ARM_ETHOSN_NPU_FW_IMAGE_ID] = {UUID_ETHOSN_FW},
-#endif /* ARM_ETHOSN_NPU_TZMP1 */
+#if ETHOSN_NPU_TZMP1
+	[ETHOSN_NPU_FW_IMAGE_ID] = {UUID_ETHOSN_FW},
+#endif /* ETHOSN_NPU_TZMP1 */
 #endif /* ARM_IO_IN_DTB */
 #if TRUSTED_BOARD_BOOT
 	[TRUSTED_BOOT_FW_CERT_ID] = {UUID_TRUSTED_BOOT_FW_CERT},
@@ -91,10 +91,10 @@
 	[SIP_SP_CONTENT_CERT_ID] = {UUID_SIP_SECURE_PARTITION_CONTENT_CERT},
 	[PLAT_SP_CONTENT_CERT_ID] = {UUID_PLAT_SECURE_PARTITION_CONTENT_CERT},
 #endif
-#if ARM_ETHOSN_NPU_TZMP1
-	[ARM_ETHOSN_NPU_FW_KEY_CERT_ID] = {UUID_ETHOSN_FW_KEY_CERTIFICATE},
-	[ARM_ETHOSN_NPU_FW_CONTENT_CERT_ID] = {UUID_ETHOSN_FW_CONTENT_CERTIFICATE},
-#endif /* ARM_ETHOSN_NPU_TZMP1 */
+#if ETHOSN_NPU_TZMP1
+	[ETHOSN_NPU_FW_KEY_CERT_ID] = {UUID_ETHOSN_FW_KEY_CERTIFICATE},
+	[ETHOSN_NPU_FW_CONTENT_CERT_ID] = {UUID_ETHOSN_FW_CONTENT_CERTIFICATE},
+#endif /* ETHOSN_NPU_TZMP1 */
 #endif /* ARM_IO_IN_DTB */
 #endif /* TRUSTED_BOARD_BOOT */
 };
@@ -198,13 +198,13 @@
 		(uintptr_t)&arm_uuid_spec[NT_FW_CONFIG_ID],
 		open_fip
 	},
-#if ARM_ETHOSN_NPU_TZMP1
-	[ARM_ETHOSN_NPU_FW_IMAGE_ID] = {
+#if ETHOSN_NPU_TZMP1
+	[ETHOSN_NPU_FW_IMAGE_ID] = {
 		&fip_dev_handle,
-		(uintptr_t)&arm_uuid_spec[ARM_ETHOSN_NPU_FW_IMAGE_ID],
+		(uintptr_t)&arm_uuid_spec[ETHOSN_NPU_FW_IMAGE_ID],
 		open_fip
 	},
-#endif /* ARM_ETHOSN_NPU_TZMP1 */
+#endif /* ETHOSN_NPU_TZMP1 */
 #endif /* ARM_IO_IN_DTB */
 #if TRUSTED_BOARD_BOOT
 	[TRUSTED_BOOT_FW_CERT_ID] = {
@@ -285,18 +285,18 @@
 		open_fip
 	},
 #endif
-#if ARM_ETHOSN_NPU_TZMP1
-	[ARM_ETHOSN_NPU_FW_KEY_CERT_ID] = {
+#if ETHOSN_NPU_TZMP1
+	[ETHOSN_NPU_FW_KEY_CERT_ID] = {
 		&fip_dev_handle,
-		(uintptr_t)&arm_uuid_spec[ARM_ETHOSN_NPU_FW_KEY_CERT_ID],
+		(uintptr_t)&arm_uuid_spec[ETHOSN_NPU_FW_KEY_CERT_ID],
 		open_fip
 	},
-	[ARM_ETHOSN_NPU_FW_CONTENT_CERT_ID] = {
+	[ETHOSN_NPU_FW_CONTENT_CERT_ID] = {
 		&fip_dev_handle,
-		(uintptr_t)&arm_uuid_spec[ARM_ETHOSN_NPU_FW_CONTENT_CERT_ID],
+		(uintptr_t)&arm_uuid_spec[ETHOSN_NPU_FW_CONTENT_CERT_ID],
 		open_fip
 	},
-#endif /* ARM_ETHOSN_NPU_TZMP1 */
+#endif /* ETHOSN_NPU_TZMP1 */
 #endif /* ARM_IO_IN_DTB */
 #endif /* TRUSTED_BOARD_BOOT */
 };
@@ -305,11 +305,11 @@
 
 #define FCONF_ARM_IO_UUID_NUM_BASE	U(10)
 
-#if ARM_ETHOSN_NPU_TZMP1
+#if ETHOSN_NPU_TZMP1
 #define FCONF_ARM_IO_UUID_NUM_NPU	U(1)
 #else
 #define FCONF_ARM_IO_UUID_NUM_NPU	U(0)
-#endif
+#endif /* ETHOSN_NPU_TZMP1 */
 
 #if TRUSTED_BOARD_BOOT
 #define FCONF_ARM_IO_UUID_NUM_TBB	U(12)
@@ -323,11 +323,11 @@
 #define FCONF_ARM_IO_UUID_NUM_SPD	U(0)
 #endif /* TRUSTED_BOARD_BOOT && defined(SPD_spmd) */
 
-#if TRUSTED_BOARD_BOOT && ARM_ETHOSN_NPU_TZMP1
+#if TRUSTED_BOARD_BOOT && ETHOSN_NPU_TZMP1
 #define FCONF_ARM_IO_UUID_NUM_NPU_TBB	U(2)
 #else
 #define FCONF_ARM_IO_UUID_NUM_NPU_TBB	U(0)
-#endif /* TRUSTED_BOARD_BOOT && ARM_ETHOSN_NPU_TZMP1 */
+#endif /* TRUSTED_BOARD_BOOT && ETHOSN_NPU_TZMP1 */
 
 #define FCONF_ARM_IO_UUID_NUMBER	FCONF_ARM_IO_UUID_NUM_BASE + \
 					FCONF_ARM_IO_UUID_NUM_NPU + \
@@ -355,9 +355,9 @@
 	{SOC_FW_CONFIG_ID, "soc_fw_cfg_uuid"},
 	{TOS_FW_CONFIG_ID, "tos_fw_cfg_uuid"},
 	{NT_FW_CONFIG_ID, "nt_fw_cfg_uuid"},
-#if ARM_ETHOSN_NPU_TZMP1
-	{ARM_ETHOSN_NPU_FW_IMAGE_ID, "arm_ethosn_npu_fw_uuid"},
-#endif /* ARM_ETHOSN_NPU_TZMP1 */
+#if ETHOSN_NPU_TZMP1
+	{ETHOSN_NPU_FW_IMAGE_ID, "ethosn_npu_fw_uuid"},
+#endif /* ETHOSN_NPU_TZMP1 */
 #if TRUSTED_BOARD_BOOT
 	{CCA_CONTENT_CERT_ID, "cca_cert_uuid"},
 	{CORE_SWD_KEY_CERT_ID, "core_swd_cert_uuid"},
@@ -375,10 +375,10 @@
 	{SIP_SP_CONTENT_CERT_ID, "sip_sp_content_cert_uuid"},
 	{PLAT_SP_CONTENT_CERT_ID, "plat_sp_content_cert_uuid"},
 #endif
-#if ARM_ETHOSN_NPU_TZMP1
-	{ARM_ETHOSN_NPU_FW_KEY_CERT_ID, "arm_ethosn_npu_fw_key_cert_uuid"},
-	{ARM_ETHOSN_NPU_FW_CONTENT_CERT_ID, "arm_ethosn_npu_fw_content_cert_uuid"},
-#endif /* ARM_ETHOSN_NPU_TZMP1 */
+#if ETHOSN_NPU_TZMP1
+	{ETHOSN_NPU_FW_KEY_CERT_ID, "ethosn_npu_fw_key_cert_uuid"},
+	{ETHOSN_NPU_FW_CONTENT_CERT_ID, "ethosn_npu_fw_content_cert_uuid"},
+#endif /* ETHOSN_NPU_TZMP1 */
 #endif /* TRUSTED_BOARD_BOOT */
 };
 
diff --git a/plat/imx/imx8m/imx8m_measured_boot.c b/plat/imx/imx8m/imx8m_measured_boot.c
index e9ea2d8..bfcd6ce 100644
--- a/plat/imx/imx8m/imx8m_measured_boot.c
+++ b/plat/imx/imx8m/imx8m_measured_boot.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2022, Arm Limited. All rights reserved.
+ * Copyright (c) 2022-2023, Arm Limited. All rights reserved.
  * Copyright (c) 2022, Linaro.
  *
  * SPDX-License-Identifier: BSD-3-Clause
@@ -79,3 +79,9 @@
 
 	dump_event_log((uint8_t *)event_log, event_log_cur_size);
 }
+
+int plat_mboot_measure_key(const void *pk_oid, const void *pk_ptr,
+			   size_t pk_len)
+{
+	return 0;
+}
diff --git a/plat/qemu/qemu/qemu_measured_boot.c b/plat/qemu/qemu/qemu_measured_boot.c
index 122bb23..077f7a4 100644
--- a/plat/qemu/qemu/qemu_measured_boot.c
+++ b/plat/qemu/qemu/qemu_measured_boot.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2022, Arm Limited. All rights reserved.
- * Copyright (c) 2022, Linaro.
+ * Copyright (c) 2022-2023, Linaro.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -118,3 +118,9 @@
 
 	return 0;
 }
+
+int plat_mboot_measure_key(const void *pk_oid, const void *pk_ptr,
+			   size_t pk_len)
+{
+	return 0;
+}
diff --git a/plat/st/common/bl2_io_storage.c b/plat/st/common/bl2_io_storage.c
index c935b7d..5b0a171 100644
--- a/plat/st/common/bl2_io_storage.c
+++ b/plat/st/common/bl2_io_storage.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2022, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2023, Arm Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -222,7 +222,7 @@
 static void boot_mmc(enum mmc_device_type mmc_dev_type,
 		     uint16_t boot_interface_instance)
 {
-	int io_result __unused;
+	int io_result __maybe_unused;
 	struct stm32_sdmmc2_params params;
 
 	zeromem(&params, sizeof(struct stm32_sdmmc2_params));
@@ -294,7 +294,7 @@
 #if STM32MP_SPI_NOR
 static void boot_spi_nor(boot_api_context_t *boot_context)
 {
-	int io_result __unused;
+	int io_result __maybe_unused;
 
 	io_result = stm32_qspi_init();
 	assert(io_result == 0);
@@ -313,7 +313,7 @@
 #if STM32MP_RAW_NAND
 static void boot_fmc2_nand(boot_api_context_t *boot_context)
 {
-	int io_result __unused;
+	int io_result __maybe_unused;
 
 	io_result = stm32_fmc2_init();
 	assert(io_result == 0);
@@ -332,7 +332,7 @@
 #if STM32MP_SPI_NAND
 static void boot_spi_nand(boot_api_context_t *boot_context)
 {
-	int io_result __unused;
+	int io_result __maybe_unused;
 
 	io_result = stm32_qspi_init();
 	assert(io_result == 0);
@@ -351,7 +351,7 @@
 #if STM32MP_UART_PROGRAMMER || STM32MP_USB_PROGRAMMER
 static void mmap_io_setup(void)
 {
-	int io_result __unused;
+	int io_result __maybe_unused;
 
 	io_result = register_io_dev_memmap(&memmap_dev_con);
 	assert(io_result == 0);
@@ -364,7 +364,7 @@
 #if STM32MP_UART_PROGRAMMER
 static void stm32cubeprogrammer_uart(void)
 {
-	int ret __unused;
+	int ret __maybe_unused;
 	boot_api_context_t *boot_context =
 		(boot_api_context_t *)stm32mp_get_boot_ctx_address();
 	uintptr_t uart_base;
@@ -378,7 +378,7 @@
 #if STM32MP_USB_PROGRAMMER
 static void stm32cubeprogrammer_usb(void)
 {
-	int ret __unused;
+	int ret __maybe_unused;
 	struct usb_handle *pdev;
 
 	/* Init USB on platform */
@@ -390,10 +390,9 @@
 #endif
 #endif /* STM32MP_UART_PROGRAMMER || STM32MP_USB_PROGRAMMER */
 
-
 void stm32mp_io_setup(void)
 {
-	int io_result __unused;
+	int io_result __maybe_unused;
 	boot_api_context_t *boot_context =
 		(boot_api_context_t *)stm32mp_get_boot_ctx_address();
 
@@ -473,7 +472,7 @@
 
 int bl2_plat_handle_pre_image_load(unsigned int image_id)
 {
-	static bool gpt_init_done __unused;
+	static bool gpt_init_done __maybe_unused;
 	uint16_t boot_itf = stm32mp_get_boot_itf_selected();
 
 	switch (boot_itf) {
@@ -516,6 +515,7 @@
 			gpt_init_done = true;
 		} else {
 			bl_mem_params_node_t *bl_mem_params = get_bl_mem_params_node(image_id);
+
 			assert(bl_mem_params != NULL);
 
 			mmc_block_dev_spec.buffer.offset = bl_mem_params->image_info.image_base;
@@ -538,7 +538,14 @@
 
 #if STM32MP_SPI_NOR
 	case BOOT_API_CTX_BOOT_INTERFACE_SEL_FLASH_NOR_QSPI:
+/*
+ * With FWU Multi Bank feature enabled, the selection of
+ * the image to boot will be done by fwu_init calling the
+ * platform hook, plat_fwu_set_images_source.
+ */
+#if !PSA_FWU_SUPPORT
 		image_block_spec.offset = STM32MP_NOR_FIP_OFFSET;
+#endif
 		break;
 #endif
 
@@ -591,7 +598,7 @@
 	return rc;
 }
 
-#if (STM32MP_SDMMC || STM32MP_EMMC) && PSA_FWU_SUPPORT
+#if (STM32MP_SDMMC || STM32MP_EMMC || STM32MP_SPI_NOR) && PSA_FWU_SUPPORT
 /*
  * In each boot in non-trial mode, we set the BKP register to
  * FWU_MAX_TRIAL_REBOOT, and return the active_index from metadata.
@@ -652,54 +659,108 @@
 {
 	unsigned int i;
 	uint32_t boot_idx;
-	const partition_entry_t *entry;
-	const uuid_t *img_type_uuid, *img_uuid;
+	const partition_entry_t *entry __maybe_unused;
+	const uuid_t *img_type_uuid;
+	const uuid_t *img_uuid __maybe_unused;
 	io_block_spec_t *image_spec;
+	const uint16_t boot_itf = stm32mp_get_boot_itf_selected();
 
 	boot_idx = plat_fwu_get_boot_idx();
 	assert(boot_idx < NR_OF_FW_BANKS);
 
 	for (i = 0U; i < NR_OF_IMAGES_IN_FW_BANK; i++) {
 		img_type_uuid = &metadata->img_entry[i].img_type_uuid;
+
+		img_uuid = &metadata->img_entry[i].img_props[boot_idx].img_uuid;
+
 		image_spec = stm32_get_image_spec(img_type_uuid);
 		if (image_spec == NULL) {
 			ERROR("Unable to get image spec for the image in the metadata\n");
 			panic();
 		}
 
-		img_uuid =
-			&metadata->img_entry[i].img_props[boot_idx].img_uuid;
+		switch (boot_itf) {
+#if (STM32MP_SDMMC || STM32MP_EMMC)
+		case BOOT_API_CTX_BOOT_INTERFACE_SEL_FLASH_SD:
+		case BOOT_API_CTX_BOOT_INTERFACE_SEL_FLASH_EMMC:
+			entry = get_partition_entry_by_uuid(img_uuid);
+			if (entry == NULL) {
+				ERROR("No partition with the uuid mentioned in metadata\n");
+				panic();
+			}
 
-		entry = get_partition_entry_by_uuid(img_uuid);
-		if (entry == NULL) {
-			ERROR("Unable to find the partition with the uuid mentioned in metadata\n");
+			image_spec->offset = entry->start;
+			image_spec->length = entry->length;
+			break;
+#endif
+#if STM32MP_SPI_NOR
+		case BOOT_API_CTX_BOOT_INTERFACE_SEL_FLASH_NOR_QSPI:
+			if (guidcmp(img_uuid, &STM32MP_NOR_FIP_A_GUID) == 0) {
+				image_spec->offset = STM32MP_NOR_FIP_A_OFFSET;
+			} else if (guidcmp(img_uuid, &STM32MP_NOR_FIP_B_GUID) == 0) {
+				image_spec->offset = STM32MP_NOR_FIP_B_OFFSET;
+			} else {
+				ERROR("Invalid uuid mentioned in metadata\n");
+				panic();
+			}
+			break;
+#endif
+		default:
 			panic();
+			break;
 		}
-
-		image_spec->offset = entry->start;
-		image_spec->length = entry->length;
 	}
 }
 
 static int plat_set_image_source(unsigned int image_id,
 				 uintptr_t *handle,
-				 uintptr_t *image_spec,
-				 const char *part_name)
+				 uintptr_t *image_spec)
 {
 	struct plat_io_policy *policy;
-	io_block_spec_t *spec;
-	const partition_entry_t *entry = get_partition_entry(part_name);
-
-	if (entry == NULL) {
-		ERROR("Unable to find the %s partition\n", part_name);
-		return -ENOENT;
-	}
+	io_block_spec_t *spec __maybe_unused;
+	const partition_entry_t *entry __maybe_unused;
+	const uint16_t boot_itf = stm32mp_get_boot_itf_selected();
 
 	policy = &policies[image_id];
-
 	spec = (io_block_spec_t *)policy->image_spec;
-	spec->offset = entry->start;
-	spec->length = entry->length;
+
+	switch (boot_itf) {
+#if (STM32MP_SDMMC || STM32MP_EMMC)
+	case BOOT_API_CTX_BOOT_INTERFACE_SEL_FLASH_SD:
+	case BOOT_API_CTX_BOOT_INTERFACE_SEL_FLASH_EMMC:
+		partition_init(GPT_IMAGE_ID);
+
+		if (image_id == FWU_METADATA_IMAGE_ID) {
+			entry = get_partition_entry(METADATA_PART_1);
+		} else {
+			entry = get_partition_entry(METADATA_PART_2);
+		}
+
+		if (entry == NULL) {
+			ERROR("Unable to find a metadata partition\n");
+			return -ENOENT;
+		}
+
+		spec->offset = entry->start;
+		spec->length = entry->length;
+		break;
+#endif
+
+#if STM32MP_SPI_NOR
+	case BOOT_API_CTX_BOOT_INTERFACE_SEL_FLASH_NOR_QSPI:
+		if (image_id == FWU_METADATA_IMAGE_ID) {
+			spec->offset = STM32MP_NOR_METADATA1_OFFSET;
+		} else {
+			spec->offset = STM32MP_NOR_METADATA2_OFFSET;
+		}
+
+		spec->length = sizeof(struct fwu_metadata);
+		break;
+#endif
+	default:
+		panic();
+		break;
+	}
 
 	*image_spec = policy->image_spec;
 	*handle = *policy->dev_handle;
@@ -711,20 +772,9 @@
 				       uintptr_t *handle,
 				       uintptr_t *image_spec)
 {
-	char *part_name;
-
 	assert((image_id == FWU_METADATA_IMAGE_ID) ||
 	       (image_id == BKUP_FWU_METADATA_IMAGE_ID));
 
-	partition_init(GPT_IMAGE_ID);
-
-	if (image_id == FWU_METADATA_IMAGE_ID) {
-		part_name = METADATA_PART_1;
-	} else {
-		part_name = METADATA_PART_2;
-	}
-
-	return plat_set_image_source(image_id, handle, image_spec,
-				     part_name);
+	return plat_set_image_source(image_id, handle, image_spec);
 }
-#endif /* (STM32MP_SDMMC || STM32MP_EMMC) && PSA_FWU_SUPPORT */
+#endif /* (STM32MP_SDMMC || STM32MP_EMMC || STM32MP_SPI_NOR) && PSA_FWU_SUPPORT */
diff --git a/plat/st/common/stm32mp_fconf_io.c b/plat/st/common/stm32mp_fconf_io.c
index 1a59f0b..5514c09 100644
--- a/plat/st/common/stm32mp_fconf_io.c
+++ b/plat/st/common/stm32mp_fconf_io.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2021-2022, STMicroelectronics - All Rights Reserved
+ * Copyright (c) 2021-2023, STMicroelectronics - All Rights Reserved
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -27,12 +27,12 @@
 };
 #endif
 
-#if (STM32MP_SDMMC || STM32MP_EMMC) && PSA_FWU_SUPPORT
+#if (STM32MP_SDMMC || STM32MP_EMMC || STM32MP_SPI_NOR) && PSA_FWU_SUPPORT
 static io_block_spec_t metadata_block_spec = {
 	.offset = 0,    /* To be filled at runtime */
 	.length = 0,    /* To be filled at runtime */
 };
-#endif /* (STM32MP_SDMMC || STM32MP_EMMC) && PSA_FWU_SUPPORT */
+#endif /* (STM32MP_SDMMC || STM32MP_EMMC || STM32MP_SPI_NOR) && PSA_FWU_SUPPORT */
 
 /* By default, STM32 platforms load images from the FIP */
 struct plat_io_policy policies[MAX_NUMBER_IDS] = {
@@ -58,7 +58,7 @@
 		.check = open_storage
 	},
 #endif
-#if (STM32MP_SDMMC || STM32MP_EMMC) && PSA_FWU_SUPPORT
+#if (STM32MP_SDMMC || STM32MP_EMMC || STM32MP_SPI_NOR) && PSA_FWU_SUPPORT
 	[FWU_METADATA_IMAGE_ID] = {
 		.dev_handle = &storage_dev_handle,
 		.image_spec = (uintptr_t)&metadata_block_spec,
@@ -71,7 +71,7 @@
 		.img_type_guid = NULL_GUID,
 		.check = open_storage
 	},
-#endif /* (STM32MP_SDMMC || STM32MP_EMMC) && PSA_FWU_SUPPORT */
+#endif /* (STM32MP_SDMMC || STM32MP_EMMC || STM32MP_SPI_NOR) && PSA_FWU_SUPPORT */
 };
 
 #define DEFAULT_UUID_NUMBER	U(7)
diff --git a/plat/st/stm32mp1/stm32mp1_fip_def.h b/plat/st/stm32mp1/stm32mp1_fip_def.h
index 4098386..fa2d20e 100644
--- a/plat/st/stm32mp1/stm32mp1_fip_def.h
+++ b/plat/st/stm32mp1/stm32mp1_fip_def.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2021-2022, STMicroelectronics - All Rights Reserved
+ * Copyright (C) 2021-2023, STMicroelectronics - All Rights Reserved
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -128,11 +128,26 @@
  * STM32MP1 RAW partition offset for devices without GPT
  ******************************************************************************/
 #define STM32MP_EMMC_BOOT_FIP_OFFSET	U(0x00040000)
+#if PSA_FWU_SUPPORT
+#define STM32MP_NOR_METADATA1_OFFSET	U(0x00080000)
+#define STM32MP_NOR_METADATA2_OFFSET	U(0x000C0000)
+#define STM32MP_NOR_FIP_A_OFFSET	U(0x00100000)
+#define STM32MP_NOR_FIP_A_GUID		(const struct efi_guid)EFI_GUID(0x4fd84c93,  \
+					0x54ef, 0x463f, 0xa7, 0xef, 0xae, 0x25, 0xff,\
+					0x88, 0x70, 0x87)
+
+#define STM32MP_NOR_FIP_B_OFFSET	U(0x00500000)
+#define STM32MP_NOR_FIP_B_GUID		(const struct efi_guid)EFI_GUID(0x09c54952,  \
+					0xd5bf, 0x45af, 0xac, 0xee, 0x33, 0x53, 0x03,\
+					0x76, 0x6f, 0xb3)
+
+#else /* PSA_FWU_SUPPORT */
 #ifndef STM32MP_NOR_FIP_OFFSET
 #define STM32MP_NOR_FIP_OFFSET		U(0x00080000)
 #endif
 #ifndef STM32MP_NAND_FIP_OFFSET
 #define STM32MP_NAND_FIP_OFFSET		U(0x00200000)
 #endif
+#endif /* PSA_FWU_SUPPORT */
 
 #endif /* STM32MP1_FIP_DEF_H */
diff --git a/plat/xilinx/common/plat_fdt.c b/plat/xilinx/common/plat_fdt.c
index 3d12d51..dc3e893 100644
--- a/plat/xilinx/common/plat_fdt.c
+++ b/plat/xilinx/common/plat_fdt.c
@@ -4,8 +4,10 @@
  * SPDX-License-Identifier: BSD-3-Clause
  *
  */
+#include <common/debug.h>
 #include <common/fdt_fixup.h>
 #include <common/fdt_wrappers.h>
+#include <libfdt.h>
 
 #include <plat_fdt.h>
 #include <platform_def.h>
diff --git a/plat/xilinx/common/plat_startup.c b/plat/xilinx/common/plat_startup.c
index f45c9f0..5beb765 100644
--- a/plat/xilinx/common/plat_startup.c
+++ b/plat/xilinx/common/plat_startup.c
@@ -157,10 +157,10 @@
 #endif /* PLAT_versal_net */
 
 /**
- * xbl_tfa_handover() - Populates the bl32 and bl33 image info structures.
+ * xbl_handover() - Populates the bl32 and bl33 image info structures.
  * @bl32: BL32 image info structure.
  * @bl33: BL33 image info structure.
- * @tfa_handoff_addr: TF-A handoff address.
+ * @handoff_addr: TF-A handoff address.
  *
  * Process the handoff parameters from the XBL and populate the BL32 and BL33
  * image info structures accordingly.
diff --git a/plat/xilinx/versal/aarch64/versal_helpers.S b/plat/xilinx/versal/aarch64/versal_helpers.S
index f868b18..350ddc4 100644
--- a/plat/xilinx/versal/aarch64/versal_helpers.S
+++ b/plat/xilinx/versal/aarch64/versal_helpers.S
@@ -4,9 +4,9 @@
  * SPDX-License-Identifier: BSD-3-Clause
  */
 
-#include <asm_macros.S>
 
 #include <arch.h>
+#include <asm_macros.S>
 #include <drivers/arm/gicv3.h>
 
 #include <platform_def.h>
diff --git a/plat/xilinx/versal_net/aarch64/versal_net_helpers.S b/plat/xilinx/versal_net/aarch64/versal_net_helpers.S
index bc62efc..ccebff2 100644
--- a/plat/xilinx/versal_net/aarch64/versal_net_helpers.S
+++ b/plat/xilinx/versal_net/aarch64/versal_net_helpers.S
@@ -6,9 +6,8 @@
  * SPDX-License-Identifier: BSD-3-Clause
  */
 
-#include <asm_macros.S>
-
 #include <arch.h>
+#include <asm_macros.S>
 #include <drivers/arm/gicv3.h>
 
 #include <platform_def.h>
diff --git a/plat/xilinx/zynqmp/aarch64/zynqmp_common.c b/plat/xilinx/zynqmp/aarch64/zynqmp_common.c
index a96c378..b584031 100644
--- a/plat/xilinx/zynqmp/aarch64/zynqmp_common.c
+++ b/plat/xilinx/zynqmp/aarch64/zynqmp_common.c
@@ -229,20 +229,9 @@
 	size_t i, j, len;
 	const char *name = "EG/EV";
 
-#ifdef IMAGE_BL32
-	/*
-	 * For BL32, get the chip id info directly by reading corresponding
-	 * registers instead of making pm call. This has limitation
-	 * that these registers should be configured to have access
-	 * from APU which is default case.
-	 */
-	chipid[0] = mmio_read_32(ZYNQMP_CSU_BASEADDR + ZYNQMP_CSU_IDCODE_OFFSET);
-	chipid[1] = mmio_read_32(EFUSE_BASEADDR + EFUSE_IPDISABLE_OFFSET);
-#else
 	if (pm_get_chipid(chipid) != PM_RET_SUCCESS) {
 		return "XCZUUNKN";
 	}
-#endif
 
 	id = chipid[0] & (ZYNQMP_CSU_IDCODE_DEVICE_CODE_MASK |
 			  ZYNQMP_CSU_IDCODE_SVD_MASK);
diff --git a/plat/xilinx/zynqmp/platform.mk b/plat/xilinx/zynqmp/platform.mk
index 36fa0f8..9c79855 100644
--- a/plat/xilinx/zynqmp/platform.mk
+++ b/plat/xilinx/zynqmp/platform.mk
@@ -20,7 +20,7 @@
 EL3_EXCEPTION_HANDLING := $(SDEI_SUPPORT)
 
 # pncd SPD requires secure SGI to be handled at EL1
-ifeq (${SPD},pncd)
+ifeq (${SPD}, $(filter ${SPD},pncd tspd))
 ifeq (${ZYNQMP_WDT_RESTART},1)
 $(error "Error: ZYNQMP_WDT_RESTART and SPD=pncd are incompatible")
 endif
diff --git a/plat/xilinx/zynqmp/tsp/tsp_plat_setup.c b/plat/xilinx/zynqmp/tsp/tsp_plat_setup.c
index ed3300b..02d0b23 100644
--- a/plat/xilinx/zynqmp/tsp/tsp_plat_setup.c
+++ b/plat/xilinx/zynqmp/tsp/tsp_plat_setup.c
@@ -28,9 +28,6 @@
 				       &tsp_boot_console);
 	console_set_scope(&tsp_boot_console,
 			  CONSOLE_FLAG_RUNTIME | CONSOLE_FLAG_BOOT);
-
-	/* Initialize the platform config for future decision making */
-	zynqmp_config_setup();
 }
 
 /*******************************************************************************
diff --git a/tools/fiptool/plat_fiptool/arm/board/juno/plat_fiptool.mk b/tools/fiptool/plat_fiptool/arm/board/juno/plat_fiptool.mk
index 46b5179..fef2116 100644
--- a/tools/fiptool/plat_fiptool/arm/board/juno/plat_fiptool.mk
+++ b/tools/fiptool/plat_fiptool/arm/board/juno/plat_fiptool.mk
@@ -8,8 +8,8 @@
 
 ifeq (${PLAT_DEF_UUID}, yes)
 HOSTCCFLAGS += -DPLAT_DEF_FIP_UUID
-ifeq (${ARM_ETHOSN_NPU_TZMP1},1)
-HOSTCCFLAGS += -DARM_ETHOSN_NPU_TZMP1
+ifeq (${ETHOSN_NPU_TZMP1},1)
+HOSTCCFLAGS += -DETHOSN_NPU_TZMP1
 endif
 INCLUDE_PATHS += -I./ -I${PLAT_DIR}fip -I../../include/
 OBJECTS += ${PLAT_DIR}fip/plat_def_uuid_config.o