Merge "docs(rme): minor update to 4 world execution instructions" into integration
diff --git a/Makefile b/Makefile
index 1baacf0..cac3e12 100644
--- a/Makefile
+++ b/Makefile
@@ -1360,7 +1360,7 @@
 	${Q}set MAKEFLAGS= && ${MSVC_NMAKE} /nologo /f ${FIPTOOLPATH}/Makefile.msvc FIPTOOLPATH=$(subst /,\,$(FIPTOOLPATH)) FIPTOOL=$(subst /,\,$(FIPTOOL)) realclean
 endif
 	${Q}${MAKE} --no-print-directory -C ${SPTOOLPATH} clean
-	${Q}${MAKE} PLAT=${PLAT} --no-print-directory -C ${CRTTOOLPATH} clean
+	${Q}${MAKE} PLAT=${PLAT} --no-print-directory -C ${CRTTOOLPATH} realclean
 	${Q}${MAKE} PLAT=${PLAT} --no-print-directory -C ${ENCTOOLPATH} realclean
 	${Q}${MAKE} --no-print-directory -C ${ROMLIBPATH} clean
 
diff --git a/changelog.yaml b/changelog.yaml
index 4d38e37..fa42e96 100644
--- a/changelog.yaml
+++ b/changelog.yaml
@@ -185,6 +185,13 @@
                 deprecated:
                   - plat/tc0
 
+      - title: Intel
+        scope: intel
+
+        subsections:
+          - title: SoC
+            scope: soc
+
       - title: Marvell
         scope: marvell
 
diff --git a/docs/design/cpu-specific-build-macros.rst b/docs/design/cpu-specific-build-macros.rst
index 71208a8..7aa7384 100644
--- a/docs/design/cpu-specific-build-macros.rst
+++ b/docs/design/cpu-specific-build-macros.rst
@@ -493,6 +493,19 @@
    in r0p3. The issue is also present in r0p0 and r0p1 but there is no
    workaround for those revisions.
 
+-  ``ERRATA_A510_2250311``: This applies errata 2250311 workaround to
+   Cortex-A510 CPU. This needs to be enabled for revisions r0p0, r0p1, r0p2,
+   r0p3 and r1p0, it is fixed in r1p1. This workaround disables MPMM even if
+   ENABLE_MPMM=1.
+
+-  ``ERRATA_A510_2218950``: This applies errata 2218950 workaround to
+   Cortex-A510 CPU. This needs to be enabled for revisions r0p0, r0p1, r0p2,
+   r0p3 and r1p0, it is fixed in r1p1.
+
+-  ``ERRATA_A510_2172148``: This applies errata 2172148 workaround to
+   Cortex-A510 CPU. This needs to be enabled for revisions r0p0, r0p1, r0p2,
+   r0p3 and r1p0, it is fixed in r1p1.
+
 DSU Errata Workarounds
 ----------------------
 
diff --git a/drivers/st/clk/stm32mp1_clk.c b/drivers/st/clk/stm32mp1_clk.c
index f525741..2288348 100644
--- a/drivers/st/clk/stm32mp1_clk.c
+++ b/drivers/st/clk/stm32mp1_clk.c
@@ -1564,7 +1564,7 @@
 	/* Wait PLL lock */
 	while ((mmio_read_32(pllxcr) & RCC_PLLNCR_PLLRDY) == 0U) {
 		if (timeout_elapsed(timeout)) {
-			ERROR("PLL%d start failed @ 0x%lx: 0x%x\n",
+			ERROR("PLL%u start failed @ 0x%lx: 0x%x\n",
 			      pll_id, pllxcr, mmio_read_32(pllxcr));
 			return -ETIMEDOUT;
 		}
@@ -1593,7 +1593,7 @@
 	/* Wait PLL stopped */
 	while ((mmio_read_32(pllxcr) & RCC_PLLNCR_PLLRDY) != 0U) {
 		if (timeout_elapsed(timeout)) {
-			ERROR("PLL%d stop failed @ 0x%lx: 0x%x\n",
+			ERROR("PLL%u stop failed @ 0x%lx: 0x%x\n",
 			      pll_id, pllxcr, mmio_read_32(pllxcr));
 			return -ETIMEDOUT;
 		}
@@ -1852,7 +1852,7 @@
 	for (i = (enum stm32mp1_pll_id)0; i < _PLL_NB; i++) {
 		char name[12];
 
-		snprintf(name, sizeof(name), "st,pll@%d", i);
+		snprintf(name, sizeof(name), "st,pll@%u", i);
 		plloff[i] = fdt_rcc_subnode_offset(name);
 
 		pllcfg_valid[i] = fdt_check_node(plloff[i]);
diff --git a/drivers/ufs/ufs.c b/drivers/ufs/ufs.c
index 5c20932..3d6d99f 100644
--- a/drivers/ufs/ufs.c
+++ b/drivers/ufs/ufs.c
@@ -702,7 +702,6 @@
 	       (ufs_params.desc_base != 0) &&
 	       (ufs_params.desc_size >= UFS_DESC_SIZE));
 
-	memset((void *)buf, 0, size);
 	get_utrd(&utrd);
 	ufs_prepare_cmd(&utrd, CDBCMD_READ_10, lun, lba, buf, size);
 	ufs_send_request(utrd.task_tag);
diff --git a/include/drivers/measured_boot/event_log/event_log.h b/include/drivers/measured_boot/event_log/event_log.h
index a687d41..0a19f8a 100644
--- a/include/drivers/measured_boot/event_log/event_log.h
+++ b/include/drivers/measured_boot/event_log/event_log.h
@@ -77,6 +77,7 @@
 #define EVLOG_STM32_STRING		"STM32"
 #define EVLOG_TB_FW_CONFIG_STRING	"TB_FW_CONFIG"
 #define	EVLOG_TOS_FW_CONFIG_STRING	"TOS_FW_CONFIG"
+#define EVLOG_RMM_STRING 		"RMM"
 
 typedef struct {
 	unsigned int id;
diff --git a/include/lib/cpus/aarch64/cortex_a510.h b/include/lib/cpus/aarch64/cortex_a510.h
index fcb821f..2b8db14 100644
--- a/include/lib/cpus/aarch64/cortex_a510.h
+++ b/include/lib/cpus/aarch64/cortex_a510.h
@@ -15,6 +15,8 @@
 #define CORTEX_A510_CPUECTLR_EL1				S3_0_C15_C1_4
 #define CORTEX_A510_CPUECTLR_EL1_READPREFERUNIQUE_SHIFT		U(19)
 #define CORTEX_A510_CPUECTLR_EL1_READPREFERUNIQUE_DISABLE	U(1)
+#define CORTEX_A510_CPUECTLR_EL1_RSCTL_SHIFT			U(23)
+#define CORTEX_A510_CPUECTLR_EL1_NTCTL_SHIFT			U(46)
 
 /*******************************************************************************
  * CPU Power Control register specific definitions
diff --git a/lib/cpus/aarch64/cortex_a510.S b/lib/cpus/aarch64/cortex_a510.S
index c288cb2..34e1082 100644
--- a/lib/cpus/aarch64/cortex_a510.S
+++ b/lib/cpus/aarch64/cortex_a510.S
@@ -153,6 +153,117 @@
 	b	cpu_rev_var_range
 endfunc check_errata_2041909
 
+	/* --------------------------------------------------
+	 * Errata Workaround for Cortex-A510 Errata #2250311.
+	 * This applies only to revisions r0p0, r0p1, r0p2,
+	 * r0p3 and r1p0, and is fixed in r1p1.
+	 * This workaround is not a typical errata fix. MPMM
+	 * is disabled here, but this conflicts with the BL31
+	 * MPMM support. So in addition to simply disabling
+	 * the feature, a flag is set in the MPMM library
+	 * indicating that it should not be enabled even if
+	 * ENABLE_MPMM=1.
+	 * x0: variant[4:7] and revision[0:3] of current cpu.
+	 * Shall clobber: x0, x1, x17
+	 * --------------------------------------------------
+	 */
+func errata_cortex_a510_2250311_wa
+	/* Check workaround compatibility. */
+	mov	x17, x30
+	bl	check_errata_2250311
+	cbz	x0, 1f
+
+	/* Disable MPMM */
+	mrs	x0, CPUMPMMCR_EL3
+	bfm	x0, xzr, #0, #0 /* bfc instruction does not work in GCC */
+	msr	CPUMPMMCR_EL3, x0
+
+#if ENABLE_MPMM && IMAGE_BL31
+	/* If ENABLE_MPMM is set, tell the runtime lib to skip enabling it. */
+	bl mpmm_errata_disable
+#endif
+
+1:
+	ret x17
+endfunc errata_cortex_a510_2250311_wa
+
+func check_errata_2250311
+	/* Applies to r1p0 and lower */
+	mov	x1, #0x10
+	b	cpu_rev_var_ls
+endfunc check_errata_2250311
+
+	/* --------------------------------------------------
+	 * Errata Workaround for Cortex-A510 Errata #2218950.
+	 * This applies only to revisions r0p0, r0p1, r0p2,
+	 * r0p3 and r1p0, and is fixed in r1p1.
+	 * x0: variant[4:7] and revision[0:3] of current cpu.
+	 * Shall clobber: x0, x1, x17
+	 * --------------------------------------------------
+	 */
+func errata_cortex_a510_2218950_wa
+	/* Check workaround compatibility. */
+	mov	x17, x30
+	bl	check_errata_2218950
+	cbz	x0, 1f
+
+	/* Source register for BFI */
+	mov	x1, #1
+
+	/* Set bit 18 in CPUACTLR_EL1 */
+	mrs	x0, CORTEX_A510_CPUACTLR_EL1
+	bfi	x0, x1, #18, #1
+	msr	CORTEX_A510_CPUACTLR_EL1, x0
+
+	/* Set bit 25 in CMPXACTLR_EL1 */
+	mrs	x0, CORTEX_A510_CMPXACTLR_EL1
+	bfi	x0, x1, #25, #1
+	msr	CORTEX_A510_CMPXACTLR_EL1, x0
+
+1:
+	ret x17
+endfunc errata_cortex_a510_2218950_wa
+
+func check_errata_2218950
+	/* Applies to r1p0 and lower */
+	mov	x1, #0x10
+	b	cpu_rev_var_ls
+endfunc check_errata_2218950
+
+	/* --------------------------------------------------
+	 * Errata Workaround for Cortex-A510 Errata #2172148.
+	 * This applies only to revisions r0p0, r0p1, r0p2,
+	 * r0p3 and r1p0, and is fixed in r1p1.
+	 * x0: variant[4:7] and revision[0:3] of current cpu.
+	 * Shall clobber: x0, x1, x17
+	 * --------------------------------------------------
+	 */
+func errata_cortex_a510_2172148_wa
+	/* Check workaround compatibility. */
+	mov	x17, x30
+	bl	check_errata_2172148
+	cbz	x0, 1f
+
+	/*
+	 * Force L2 allocation of transient lines by setting
+	 * CPUECTLR_EL1.RSCTL=0b01 and CPUECTLR_EL1.NTCTL=0b01.
+	 */
+	mrs	x0, CORTEX_A510_CPUECTLR_EL1
+	mov	x1, #1
+	bfi	x0, x1, #CORTEX_A510_CPUECTLR_EL1_RSCTL_SHIFT, #2
+	bfi	x0, x1, #CORTEX_A510_CPUECTLR_EL1_NTCTL_SHIFT, #2
+	msr	CORTEX_A510_CPUECTLR_EL1, x0
+
+1:
+	ret x17
+endfunc errata_cortex_a510_2172148_wa
+
+func check_errata_2172148
+	/* Applies to r1p0 and lower */
+	mov	x1, #0x10
+	b	cpu_rev_var_ls
+endfunc check_errata_2172148
+
 	/* ----------------------------------------------------
 	 * HW will do the cache maintenance while powering down
 	 * ----------------------------------------------------
@@ -187,6 +298,9 @@
 	report_errata ERRATA_A510_2288014, cortex_a510, 2288014
 	report_errata ERRATA_A510_2042739, cortex_a510, 2042739
 	report_errata ERRATA_A510_2041909, cortex_a510, 2041909
+	report_errata ERRATA_A510_2250311, cortex_a510, 2250311
+	report_errata ERRATA_A510_2218950, cortex_a510, 2218950
+	report_errata ERRATA_A510_2172148, cortex_a510, 2172148
 
 	ldp	x8, x30, [sp], #16
 	ret
@@ -224,6 +338,21 @@
 	bl	errata_cortex_a510_2041909_wa
 #endif
 
+#if ERRATA_A510_2250311
+	mov	x0, x18
+	bl	errata_cortex_a510_2250311_wa
+#endif
+
+#if ERRATA_A510_2218950
+	mov	x0, x18
+	bl	errata_cortex_a510_2218950_wa
+#endif
+
+#if ERRATA_A510_2172148
+	mov	x0, x18
+	bl	errata_cortex_a510_2172148_wa
+#endif
+
 	ret	x19
 endfunc cortex_a510_reset_func
 
diff --git a/lib/cpus/cpu-ops.mk b/lib/cpus/cpu-ops.mk
index 107753e..62b67b6 100644
--- a/lib/cpus/cpu-ops.mk
+++ b/lib/cpus/cpu-ops.mk
@@ -548,6 +548,18 @@
 # present in r0p0 and r0p1 but there is no workaround for those revisions.
 ERRATA_A510_2041909	?=0
 
+# Flag to apply erratum 2250311 workaround during reset. This erratum applies
+# to revisions r0p0, r0p1, r0p2, r0p3 and r1p0, and is fixed in r1p1.
+ERRATA_A510_2250311	?=0
+
+# Flag to apply erratum 2218950 workaround during reset. This erratum applies
+# to revisions r0p0, r0p1, r0p2, r0p3 and r1p0, and is fixed in r1p1.
+ERRATA_A510_2218950	?=0
+
+# Flag to apply erratum 2172148 workaround during reset. This erratum applies
+# to revisions r0p0, r0p1, r0p2, r0p3 and r1p0, and is fixed in r1p1.
+ERRATA_A510_2172148	?=0
+
 # Flag to apply DSU erratum 798953. This erratum applies to DSUs revision r0p0.
 # Applying the workaround results in higher DSU power consumption on idle.
 ERRATA_DSU_798953	?=0
@@ -1021,6 +1033,18 @@
 $(eval $(call assert_boolean,ERRATA_A510_2041909))
 $(eval $(call add_define,ERRATA_A510_2041909))
 
+# Process ERRATA_A510_2250311 flag
+$(eval $(call assert_boolean,ERRATA_A510_2250311))
+$(eval $(call add_define,ERRATA_A510_2250311))
+
+# Process ERRATA_A510_2218950 flag
+$(eval $(call assert_boolean,ERRATA_A510_2218950))
+$(eval $(call add_define,ERRATA_A510_2218950))
+
+# Process ERRATA_A510_2172148 flag
+$(eval $(call assert_boolean,ERRATA_A510_2172148))
+$(eval $(call add_define,ERRATA_A510_2172148))
+
 # Process ERRATA_DSU_798953 flag
 $(eval $(call assert_boolean,ERRATA_DSU_798953))
 $(eval $(call add_define,ERRATA_DSU_798953))
diff --git a/lib/mpmm/mpmm.c b/lib/mpmm/mpmm.c
index a66f2aa..dc61cf6 100644
--- a/lib/mpmm/mpmm.c
+++ b/lib/mpmm/mpmm.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2021, Arm Limited. All rights reserved.
+ * Copyright (c) 2021-2022, Arm Limited. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -62,11 +62,25 @@
 	return supported;
 }
 
+/* Defaults to false */
+static bool mpmm_disable_for_errata;
+
 void mpmm_enable(void)
 {
-	bool supported = mpmm_supported();
-
-	if (supported) {
+	if (mpmm_supported()) {
+		if (mpmm_disable_for_errata) {
+			WARN("MPMM: disabled by errata workaround\n");
+			return;
+		}
 		write_cpumpmmcr_el3_mpmm_en(1U);
 	}
 }
+
+/*
+ * This function is called from assembly code very early in BL31 so it must be
+ * small and simple.
+ */
+void mpmm_errata_disable(void)
+{
+	mpmm_disable_for_errata = true;
+}
diff --git a/plat/arm/board/fvp/fvp_bl2_measured_boot.c b/plat/arm/board/fvp/fvp_bl2_measured_boot.c
index af43065..1f38278 100644
--- a/plat/arm/board/fvp/fvp_bl2_measured_boot.c
+++ b/plat/arm/board/fvp/fvp_bl2_measured_boot.c
@@ -28,6 +28,7 @@
 	{ SCP_BL2_IMAGE_ID, EVLOG_SCP_BL2_STRING, PCR_0 },
 	{ SOC_FW_CONFIG_ID, EVLOG_SOC_FW_CONFIG_STRING, PCR_0 },
 	{ TOS_FW_CONFIG_ID, EVLOG_TOS_FW_CONFIG_STRING, PCR_0 },
+	{ RMM_IMAGE_ID, EVLOG_RMM_STRING, PCR_0},
 
 	{ CRITICAL_DATA_ID, EVLOG_CRITICAL_DATA_STRING, PCR_1 },
 
diff --git a/plat/intel/soc/agilex/bl2_plat_setup.c b/plat/intel/soc/agilex/bl2_plat_setup.c
index b6b3e16..6e67502 100644
--- a/plat/intel/soc/agilex/bl2_plat_setup.c
+++ b/plat/intel/soc/agilex/bl2_plat_setup.c
@@ -7,6 +7,7 @@
 
 #include <arch.h>
 #include <arch_helpers.h>
+#include <assert.h>
 #include <common/bl_common.h>
 #include <common/debug.h>
 #include <common/desc_image_load.h>
@@ -113,6 +114,9 @@
 	mmc_info.mmc_dev_type = MMC_IS_SD;
 	mmc_info.ocr_voltage = OCR_3_3_3_4 | OCR_3_2_3_3;
 
+	/* Request ownership and direct access to QSPI */
+	mailbox_hps_qspi_enable();
+
 	switch (boot_source) {
 	case BOOT_SOURCE_SDMMC:
 		dw_mmc_init(&params, &mmc_info);
@@ -120,8 +124,6 @@
 		break;
 
 	case BOOT_SOURCE_QSPI:
-		mailbox_set_qspi_open();
-		mailbox_set_qspi_direct();
 		cad_qspi_init(0, QSPI_CONFIG_CPHA, QSPI_CONFIG_CPOL,
 			QSPI_CONFIG_CSDA, QSPI_CONFIG_CSDADS,
 			QSPI_CONFIG_CSEOT, QSPI_CONFIG_CSSOT, 0);
@@ -161,6 +163,8 @@
 {
 	bl_mem_params_node_t *bl_mem_params = get_bl_mem_params_node(image_id);
 
+	assert(bl_mem_params);
+
 	switch (image_id) {
 	case BL33_IMAGE_ID:
 		bl_mem_params->ep_info.args.arg0 = 0xffff & read_mpidr();
diff --git a/plat/intel/soc/common/include/socfpga_mailbox.h b/plat/intel/soc/common/include/socfpga_mailbox.h
index 923c4f1..bc10dd8 100644
--- a/plat/intel/soc/common/include/socfpga_mailbox.h
+++ b/plat/intel/soc/common/include/socfpga_mailbox.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2019-2020, Intel Corporation. All rights reserved.
+ * Copyright (c) 2019-2022, Intel Corporation. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -69,6 +69,7 @@
 #define CMD_CASUAL			0
 #define CMD_URGENT			1
 
+#define MBOX_WORD_BYTE			4U
 #define MBOX_RESP_BUFFER_SIZE		16
 #define MBOX_CMD_BUFFER_SIZE		32
 
@@ -108,6 +109,9 @@
 
 /* Mailbox Macros */
 
+#define MBOX_ENTRY_TO_ADDR(_buf, ptr)	(MBOX_OFFSET + (MBOX_##_buf##_BUFFER) \
+						+ MBOX_WORD_BYTE * (ptr))
+
 /* Mailbox interrupt flags and masks */
 #define MBOX_INT_FLAG_COE		0x1
 #define MBOX_INT_FLAG_RIE		0x2
@@ -139,23 +143,22 @@
 void mailbox_set_int(uint32_t interrupt_input);
 int mailbox_init(void);
 void mailbox_set_qspi_close(void);
-void mailbox_set_qspi_open(void);
-void mailbox_set_qspi_direct(void);
+void mailbox_hps_qspi_enable(void);
 
 int mailbox_send_cmd(uint32_t job_id, uint32_t cmd, uint32_t *args,
 			unsigned int len, uint32_t urgent, uint32_t *response,
-			unsigned int resp_len);
+			unsigned int *resp_len);
 int mailbox_send_cmd_async(uint32_t *job_id, uint32_t cmd, uint32_t *args,
 			unsigned int len, unsigned int indirect);
 int mailbox_read_response(uint32_t *job_id, uint32_t *response,
-			unsigned int resp_len);
-unsigned int iterate_resp(uint32_t mbox_resp_len, uint32_t *resp_buf,
-			unsigned int resp_len);
+			unsigned int *resp_len);
+int iterate_resp(uint32_t mbox_resp_len, uint32_t *resp_buf,
+			unsigned int *resp_len);
 
 void mailbox_reset_cold(void);
 void mailbox_clear_response(void);
 
-int intel_mailbox_get_config_status(uint32_t cmd);
+int intel_mailbox_get_config_status(uint32_t cmd, bool init_done);
 int intel_mailbox_is_fpga_not_ready(void);
 
 int mailbox_rsu_get_spt_offset(uint32_t *resp_buf, uint32_t resp_buf_len);
diff --git a/plat/intel/soc/common/soc/socfpga_mailbox.c b/plat/intel/soc/common/soc/socfpga_mailbox.c
index aec94af..be900c9 100644
--- a/plat/intel/soc/common/soc/socfpga_mailbox.c
+++ b/plat/intel/soc/common/soc/socfpga_mailbox.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020, Intel Corporation. All rights reserved.
+ * Copyright (c) 2020-2022, Intel Corporation. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -59,9 +59,7 @@
 			}
 			mdelay(10U);
 		} else {
-			mmio_write_32(MBOX_OFFSET + MBOX_CMD_BUFFER +
-				      (*cin * 4), data);
-			(*cin)++;
+			mmio_write_32(MBOX_ENTRY_TO_ADDR(CMD, (*cin)++), data);
 			*cin %= MBOX_CMD_BUFFER_SIZE;
 			mmio_write_32(MBOX_OFFSET + MBOX_CIN, *cin);
 			break;
@@ -107,9 +105,7 @@
 		}
 	}
 
-	if (!is_doorbell_triggered) {
-		mmio_write_32(MBOX_OFFSET + MBOX_DOORBELL_TO_SDM, 1U);
-	}
+	mmio_write_32(MBOX_OFFSET + MBOX_DOORBELL_TO_SDM, 1U);
 
 	return MBOX_RET_OK;
 
@@ -131,7 +127,7 @@
 }
 
 int mailbox_read_response(unsigned int *job_id, uint32_t *response,
-				unsigned int resp_len)
+				unsigned int *resp_len)
 {
 	uint32_t rin;
 	uint32_t rout;
@@ -146,8 +142,7 @@
 	rout = mmio_read_32(MBOX_OFFSET + MBOX_ROUT);
 
 	if (rout != rin) {
-		resp_data = mmio_read_32(MBOX_OFFSET +
-				    MBOX_RESP_BUFFER + ((rout++)*4U));
+		resp_data = mmio_read_32(MBOX_ENTRY_TO_ADDR(RESP, (rout)++));
 
 		rout %= MBOX_RESP_BUFFER_SIZE;
 		mmio_write_32(MBOX_OFFSET + MBOX_ROUT, rout);
@@ -161,9 +156,9 @@
 
 		ret_resp_len = MBOX_RESP_LEN(resp_data);
 
-		if (ret_resp_len != 0U) {
-			ret_resp_len = iterate_resp(ret_resp_len, response,
-						    resp_len);
+		if (iterate_resp(ret_resp_len, response, resp_len)
+			!= MBOX_RET_OK) {
+			return MBOX_TIMEOUT;
 		}
 
 		if (MBOX_RESP_ERR(resp_data) > 0U) {
@@ -171,14 +166,14 @@
 			return -MBOX_RESP_ERR(resp_data);
 		}
 
-		return ret_resp_len;
+		return MBOX_RET_OK;
 	}
 	return MBOX_NO_RESPONSE;
 }
 
 
 int mailbox_poll_response(uint32_t job_id, uint32_t urgent, uint32_t *response,
-				unsigned int resp_len)
+				unsigned int *resp_len)
 {
 	unsigned int timeout = 40U;
 	unsigned int sdm_loop = 255U;
@@ -221,8 +216,8 @@
 		rout = mmio_read_32(MBOX_OFFSET + MBOX_ROUT);
 
 		while (rout != rin) {
-			resp_data = mmio_read_32(MBOX_OFFSET +
-					    MBOX_RESP_BUFFER + ((rout++)*4U));
+			resp_data = mmio_read_32(MBOX_ENTRY_TO_ADDR(RESP,
+								(rout)++));
 
 			rout %= MBOX_RESP_BUFFER_SIZE;
 			mmio_write_32(MBOX_OFFSET + MBOX_ROUT, rout);
@@ -234,10 +229,9 @@
 
 			ret_resp_len = MBOX_RESP_LEN(resp_data);
 
-			if (ret_resp_len != 0U) {
-				ret_resp_len = iterate_resp(ret_resp_len,
-							    response,
-							    resp_len);
+			if (iterate_resp(ret_resp_len, response, resp_len)
+				!= MBOX_RET_OK) {
+				return MBOX_TIMEOUT;
 			}
 
 			if (MBOX_RESP_ERR(resp_data) > 0U) {
@@ -245,7 +239,7 @@
 				return -MBOX_RESP_ERR(resp_data);
 			}
 
-			return ret_resp_len;
+			return MBOX_RET_OK;
 		}
 
 	sdm_loop--;
@@ -255,8 +249,8 @@
 	return MBOX_TIMEOUT;
 }
 
-unsigned int iterate_resp(uint32_t mbox_resp_len, uint32_t *resp_buf,
-			unsigned int resp_len)
+int iterate_resp(uint32_t mbox_resp_len, uint32_t *resp_buf,
+			unsigned int *resp_len)
 {
 	unsigned int timeout, total_resp_len = 0U;
 	uint32_t resp_data;
@@ -266,17 +260,15 @@
 	while (mbox_resp_len > 0U) {
 		timeout = 100U;
 		mbox_resp_len--;
-		resp_data = mmio_read_32(MBOX_OFFSET +
-					MBOX_RESP_BUFFER +
-					(rout)*4U);
+		resp_data = mmio_read_32(MBOX_ENTRY_TO_ADDR(RESP, (rout)++));
 
-		if ((resp_buf != NULL) && (resp_len != 0U)) {
+		if ((resp_buf != NULL) && (resp_len != NULL)
+			&& (*resp_len != 0U)) {
 			*(resp_buf + total_resp_len)
 					= resp_data;
-			resp_len--;
+			*resp_len = *resp_len - 1;
 			total_resp_len++;
 		}
-		rout++;
 		rout %= MBOX_RESP_BUFFER_SIZE;
 		mmio_write_32(MBOX_OFFSET + MBOX_ROUT, rout);
 
@@ -295,7 +287,11 @@
 			return MBOX_TIMEOUT;
 		}
 	}
-	return total_resp_len;
+
+	if (resp_len)
+		*resp_len = total_resp_len;
+
+	return MBOX_RET_OK;
 }
 
 int mailbox_send_cmd_async(uint32_t *job_id, uint32_t cmd, uint32_t *args,
@@ -320,7 +316,7 @@
 
 int mailbox_send_cmd(uint32_t job_id, uint32_t cmd, uint32_t *args,
 			unsigned int len, uint32_t urgent, uint32_t *response,
-			unsigned int resp_len)
+			unsigned int *resp_len)
 {
 	int status = 0;
 
@@ -366,20 +362,20 @@
 {
 	mailbox_set_int(MBOX_INT_FLAG_COE | MBOX_INT_FLAG_RIE);
 	mailbox_send_cmd(MBOX_JOB_ID, MBOX_CMD_QSPI_OPEN, NULL, 0U,
-				CMD_CASUAL, NULL, 0U);
+				CMD_CASUAL, NULL, NULL);
 }
 
 void mailbox_set_qspi_direct(void)
 {
 	mailbox_send_cmd(MBOX_JOB_ID, MBOX_CMD_QSPI_DIRECT, NULL, 0U,
-				CMD_CASUAL, NULL, 0U);
+				CMD_CASUAL, NULL, NULL);
 }
 
 void mailbox_set_qspi_close(void)
 {
 	mailbox_set_int(MBOX_INT_FLAG_COE | MBOX_INT_FLAG_RIE);
 	mailbox_send_cmd(MBOX_JOB_ID, MBOX_CMD_QSPI_CLOSE, NULL, 0U,
-				CMD_CASUAL, NULL, 0U);
+				CMD_CASUAL, NULL, NULL);
 }
 
 void mailbox_qspi_set_cs(uint32_t device_select)
@@ -390,21 +386,27 @@
 	cs_setting = (device_select << 28);
 	mailbox_set_int(MBOX_INT_FLAG_COE | MBOX_INT_FLAG_RIE);
 	mailbox_send_cmd(MBOX_JOB_ID, MBOX_CMD_QSPI_SET_CS, &cs_setting,
-				1U, CMD_CASUAL, NULL, 0U);
+				1U, CMD_CASUAL, NULL, NULL);
 }
 
+void mailbox_hps_qspi_enable(void)
+{
+	mailbox_set_qspi_open();
+	mailbox_set_qspi_direct();
+}
+
 void mailbox_reset_cold(void)
 {
 	mailbox_set_int(MBOX_INT_FLAG_COE | MBOX_INT_FLAG_RIE);
 	mailbox_send_cmd(MBOX_JOB_ID, MBOX_CMD_REBOOT_HPS, NULL, 0U,
-				CMD_CASUAL, NULL, 0U);
+				CMD_CASUAL, NULL, NULL);
 }
 
 int mailbox_rsu_get_spt_offset(uint32_t *resp_buf, unsigned int resp_buf_len)
 {
 	return mailbox_send_cmd(MBOX_JOB_ID, MBOX_GET_SUBPARTITION_TABLE,
 				NULL, 0U, CMD_CASUAL, resp_buf,
-				resp_buf_len);
+				&resp_buf_len);
 }
 
 struct rsu_status_info {
@@ -426,7 +428,7 @@
 
 	ret = mailbox_send_cmd(MBOX_JOB_ID, MBOX_RSU_STATUS, NULL, 0U,
 				CMD_CASUAL, resp_buf,
-				resp_buf_len);
+				&resp_buf_len);
 
 	if (ret < 0) {
 		return ret;
@@ -445,14 +447,14 @@
 {
 	return mailbox_send_cmd(MBOX_JOB_ID, MBOX_RSU_UPDATE,
 				flash_offset, 2U,
-				CMD_CASUAL, NULL, 0U);
+				CMD_CASUAL, NULL, NULL);
 }
 
 int mailbox_hps_stage_notify(uint32_t execution_stage)
 {
 	return mailbox_send_cmd(MBOX_JOB_ID, MBOX_HPS_STAGE_NOTIFY,
 				&execution_stage, 1U, CMD_CASUAL,
-				NULL, 0U);
+				NULL, NULL);
 }
 
 int mailbox_init(void)
@@ -465,7 +467,7 @@
 	mmio_write_32(MBOX_OFFSET + MBOX_DOORBELL_FROM_SDM, 0U);
 
 	status = mailbox_send_cmd(0U, MBOX_CMD_RESTART, NULL, 0U,
-					CMD_URGENT, NULL, 0U);
+					CMD_URGENT, NULL, NULL);
 
 	if (status != 0) {
 		return status;
@@ -477,13 +479,14 @@
 	return MBOX_RET_OK;
 }
 
-int intel_mailbox_get_config_status(uint32_t cmd)
+int intel_mailbox_get_config_status(uint32_t cmd, bool init_done)
 {
 	int status;
 	uint32_t res, response[6];
+	unsigned int resp_len = ARRAY_SIZE(response);
 
 	status = mailbox_send_cmd(MBOX_JOB_ID, cmd, NULL, 0U, CMD_CASUAL,
-				response, ARRAY_SIZE(response));
+				response, &resp_len);
 
 	if (status < 0) {
 		return status;
@@ -504,20 +507,22 @@
 		return MBOX_CFGSTAT_STATE_ERROR_HARDWARE;
 	}
 
-	if ((res & SOFTFUNC_STATUS_CONF_DONE) != 0U &&
-		(res & SOFTFUNC_STATUS_INIT_DONE) != 0U) {
-		return MBOX_RET_OK;
-	}
+	if ((res & SOFTFUNC_STATUS_CONF_DONE) == 0U)
+		return MBOX_CFGSTAT_STATE_CONFIG;
 
-	return MBOX_CFGSTAT_STATE_CONFIG;
+	if (init_done && (res & SOFTFUNC_STATUS_INIT_DONE) == 0U)
+		return MBOX_CFGSTAT_STATE_CONFIG;
+
+	return MBOX_RET_OK;
 }
 
 int intel_mailbox_is_fpga_not_ready(void)
 {
-	int ret = intel_mailbox_get_config_status(MBOX_RECONFIG_STATUS);
+	int ret = intel_mailbox_get_config_status(MBOX_RECONFIG_STATUS, true);
 
 	if ((ret != MBOX_RET_OK) && (ret != MBOX_CFGSTAT_STATE_CONFIG)) {
-		ret = intel_mailbox_get_config_status(MBOX_CONFIG_STATUS);
+		ret = intel_mailbox_get_config_status(MBOX_CONFIG_STATUS,
+							false);
 	}
 
 	return ret;
diff --git a/plat/intel/soc/common/socfpga_sip_svc.c b/plat/intel/soc/common/socfpga_sip_svc.c
index 86a4455..d53e8de 100644
--- a/plat/intel/soc/common/socfpga_sip_svc.c
+++ b/plat/intel/soc/common/socfpga_sip_svc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2019-2020, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2019-2022, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -83,9 +83,9 @@
 	uint32_t ret;
 
 	if (query_type == 1)
-		ret = intel_mailbox_get_config_status(MBOX_CONFIG_STATUS);
+		ret = intel_mailbox_get_config_status(MBOX_CONFIG_STATUS, false);
 	else
-		ret = intel_mailbox_get_config_status(MBOX_RECONFIG_STATUS);
+		ret = intel_mailbox_get_config_status(MBOX_RECONFIG_STATUS, true);
 
 	if (ret) {
 		if (ret == MBOX_CFGSTAT_STATE_CONFIG)
@@ -128,16 +128,16 @@
 static int intel_fpga_config_completed_write(uint32_t *completed_addr,
 					uint32_t *count, uint32_t *job_id)
 {
-	uint32_t status = INTEL_SIP_SMC_STATUS_OK;
-	*count = 0;
-	int resp_len = 0;
 	uint32_t resp[5];
+	unsigned int resp_len = ARRAY_SIZE(resp);
+	int status = INTEL_SIP_SMC_STATUS_OK;
 	int all_completed = 1;
+	*count = 0;
 
 	while (*count < 3) {
 
-		resp_len = mailbox_read_response(job_id,
-				resp, ARRAY_SIZE(resp));
+		status = mailbox_read_response(job_id,
+				resp, &resp_len);
 
 		if (resp_len < 0)
 			break;
@@ -183,17 +183,21 @@
 
 static int intel_fpga_config_start(uint32_t config_type)
 {
+	uint32_t argument = 0x1;
 	uint32_t response[3];
 	int status = 0;
+	unsigned int size = 0;
+	unsigned int resp_len = ARRAY_SIZE(response);
 
 	is_partial_reconfig = config_type;
 
 	mailbox_clear_response();
 
-	mailbox_send_cmd(1U, MBOX_CMD_CANCEL, NULL, 0U, CMD_CASUAL, NULL, 0U);
+	mailbox_send_cmd(MBOX_JOB_ID, MBOX_CMD_CANCEL, NULL, 0U,
+			CMD_CASUAL, NULL, NULL);
 
-	status = mailbox_send_cmd(1U, MBOX_RECONFIG, NULL, 0U, CMD_CASUAL,
-			response, ARRAY_SIZE(response));
+	status = mailbox_send_cmd(MBOX_JOB_ID, MBOX_RECONFIG, &argument, size,
+			CMD_CASUAL, response, &resp_len);
 
 	if (status < 0)
 		return status;
@@ -234,6 +238,9 @@
 
 bool is_address_in_ddr_range(uint64_t addr, uint64_t size)
 {
+	if (!addr && !size) {
+		return true;
+	}
 	if (size > (UINT64_MAX - addr))
 		return false;
 	if (addr < BL31_LIMIT)
@@ -341,7 +348,7 @@
 {
 	if (!intel_secure_reg_read(reg_addr, retval)) {
 		*retval &= ~mask;
-		*retval |= val;
+		*retval |= val & mask;
 		return intel_secure_reg_write(reg_addr, *retval, retval);
 	}
 
@@ -384,10 +391,11 @@
 }
 
 /* Mailbox services */
-static uint32_t intel_mbox_send_cmd(uint32_t cmd, uint32_t *args, uint32_t len,
-				    uint32_t urgent, uint32_t *response,
-				    uint32_t resp_len, int *mbox_status,
-				    int *len_in_resp)
+static uint32_t intel_mbox_send_cmd(uint32_t cmd, uint32_t *args,
+				unsigned int len,
+				uint32_t urgent, uint32_t *response,
+				unsigned int resp_len, int *mbox_status,
+				unsigned int *len_in_resp)
 {
 	*len_in_resp = 0;
 	*mbox_status = 0;
@@ -396,7 +404,7 @@
 		return INTEL_SIP_SMC_STATUS_REJECTED;
 
 	int status = mailbox_send_cmd(MBOX_JOB_ID, cmd, args, len, urgent,
-				      response, resp_len);
+				      response, &resp_len);
 
 	if (status < 0) {
 		*mbox_status = -status;
@@ -404,7 +412,7 @@
 	}
 
 	*mbox_status = 0;
-	*len_in_resp = status;
+	*len_in_resp = resp_len;
 	return INTEL_SIP_SMC_STATUS_OK;
 }
 
@@ -425,9 +433,9 @@
 	uint32_t status = INTEL_SIP_SMC_STATUS_OK;
 	uint32_t completed_addr[3];
 	uint64_t rsu_respbuf[9];
+	int mbox_status;
+	unsigned int len_in_resp;
 	u_register_t x5, x6;
-	int mbox_status, len_in_resp;
-
 
 	switch (smc_fid) {
 	case SIP_SVC_UID:
@@ -525,7 +533,7 @@
 		status = intel_mbox_send_cmd(x1, (uint32_t *)x2, x3, x4,
 					     (uint32_t *)x5, x6, &mbox_status,
 					     &len_in_resp);
-		SMC_RET4(handle, status, mbox_status, x5, len_in_resp);
+		SMC_RET3(handle, status, mbox_status, len_in_resp);
 
 	default:
 		return socfpga_sip_handler(smc_fid, x1, x2, x3, x4,
diff --git a/plat/intel/soc/stratix10/bl2_plat_setup.c b/plat/intel/soc/stratix10/bl2_plat_setup.c
index ecf1f01..a8026ea 100644
--- a/plat/intel/soc/stratix10/bl2_plat_setup.c
+++ b/plat/intel/soc/stratix10/bl2_plat_setup.c
@@ -7,6 +7,7 @@
 
 #include <arch.h>
 #include <arch_helpers.h>
+#include <assert.h>
 #include <common/bl_common.h>
 #include <common/debug.h>
 #include <common/desc_image_load.h>
@@ -109,6 +110,9 @@
 	mmc_info.mmc_dev_type = MMC_IS_SD;
 	mmc_info.ocr_voltage = OCR_3_3_3_4 | OCR_3_2_3_3;
 
+	/* Request ownership and direct access to QSPI */
+	mailbox_hps_qspi_enable();
+
 	switch (boot_source) {
 	case BOOT_SOURCE_SDMMC:
 		dw_mmc_init(&params, &mmc_info);
@@ -116,8 +120,6 @@
 		break;
 
 	case BOOT_SOURCE_QSPI:
-		mailbox_set_qspi_open();
-		mailbox_set_qspi_direct();
 		cad_qspi_init(0, QSPI_CONFIG_CPHA, QSPI_CONFIG_CPOL,
 			QSPI_CONFIG_CSDA, QSPI_CONFIG_CSDADS,
 			QSPI_CONFIG_CSEOT, QSPI_CONFIG_CSSOT, 0);
@@ -157,6 +159,8 @@
 {
 	bl_mem_params_node_t *bl_mem_params = get_bl_mem_params_node(image_id);
 
+	assert(bl_mem_params);
+
 	switch (image_id) {
 	case BL33_IMAGE_ID:
 		bl_mem_params->ep_info.args.arg0 = 0xffff & read_mpidr();
diff --git a/plat/st/stm32mp1/stm32mp1_shared_resources.c b/plat/st/stm32mp1/stm32mp1_shared_resources.c
index 2a518e1..a0ca697 100644
--- a/plat/st/stm32mp1/stm32mp1_shared_resources.c
+++ b/plat/st/stm32mp1/stm32mp1_shared_resources.c
@@ -164,7 +164,7 @@
 	    (id <= STM32MP1_SHRES_GPIOZ(7)) &&
 	    ((unsigned int)(id - STM32MP1_SHRES_GPIOZ(0)) >= get_gpioz_nbpin())) {
 		ERROR("Invalid GPIO pin %d, %u pin(s) available\n",
-		      id - STM32MP1_SHRES_GPIOZ(0), get_gpioz_nbpin());
+		      (int)(id - STM32MP1_SHRES_GPIOZ(0)), get_gpioz_nbpin());
 		panic();
 	}
 
diff --git a/plat/xilinx/zynqmp/include/platform_def.h b/plat/xilinx/zynqmp/include/platform_def.h
index 0c14315..0c5f621 100644
--- a/plat/xilinx/zynqmp/include/platform_def.h
+++ b/plat/xilinx/zynqmp/include/platform_def.h
@@ -38,7 +38,7 @@
 #ifndef ZYNQMP_ATF_MEM_BASE
 #if !DEBUG && defined(SPD_none) && !SDEI_SUPPORT
 # define BL31_BASE			0xfffea000
-# define BL31_LIMIT			0xffffffff
+# define BL31_LIMIT			0x100000000
 #else
 # define BL31_BASE			0x1000
 # define BL31_LIMIT			0x7ffff