diff --git a/bl2/bl2_main.c b/bl2/bl2_main.c
index e7ab7bb..7d8d60c 100644
--- a/bl2/bl2_main.c
+++ b/bl2/bl2_main.c
@@ -21,6 +21,7 @@
 #define NEXT_IMAGE	"BL31"
 #endif
 
+#if !BL2_AT_EL3
 /*******************************************************************************
  * Setup function for BL2.
  ******************************************************************************/
@@ -43,6 +44,31 @@
 	/* Perform late platform-specific setup */
 	bl2_plat_arch_setup();
 }
+
+#else /* if BL2_AT_EL3 */
+/*******************************************************************************
+ * Setup function for BL2 when BL2_AT_EL3=1.
+ ******************************************************************************/
+void bl2_el3_setup(u_register_t arg0, u_register_t arg1, u_register_t arg2,
+		   u_register_t arg3)
+{
+	/* Perform early platform-specific setup */
+	bl2_el3_early_platform_setup(arg0, arg1, arg2, arg3);
+
+#ifdef AARCH64
+	/*
+	 * Update pointer authentication key before the MMU is enabled. It is
+	 * saved in the rodata section, that can be writen before enabling the
+	 * MMU. This function must be called after the console is initialized
+	 * in the early platform setup.
+	 */
+	bl_handle_pauth();
+#endif /* AARCH64 */
+
+	/* Perform late platform-specific setup */
+	bl2_el3_plat_arch_setup();
+}
+#endif /* BL2_AT_EL3 */
 
 /*******************************************************************************
  * The only thing to do in BL2 is to load further images and pass control to
@@ -88,11 +114,11 @@
 	 * be passed to next BL image as an argument.
 	 */
 	smc(BL1_SMC_RUN_IMAGE, (unsigned long)next_bl_ep_info, 0, 0, 0, 0, 0, 0);
-#else
+#else /* if BL2_AT_EL3 */
 	NOTICE("BL2: Booting " NEXT_IMAGE "\n");
 	print_entry_point_info(next_bl_ep_info);
 	console_flush();
 
 	bl2_run_next_image(next_bl_ep_info);
-#endif
+#endif /* BL2_AT_EL3 */
 }