Merge "fix(cpus): workaround for Cortex-A720 erratum 2940794" into integration
diff --git a/bl31/bl31_traps.c b/bl31/bl31_traps.c
index d14a91e..f1b1fa6 100644
--- a/bl31/bl31_traps.c
+++ b/bl31/bl31_traps.c
@@ -97,7 +97,7 @@
  * NOTE: This piece of code must be reviewed every release to ensure that
  * we keep up with new ARCH features which introduces a new SPSR bit.
  */
-static u_register_t create_spsr(u_register_t old_spsr, unsigned int target_el)
+u_register_t create_spsr(u_register_t old_spsr, unsigned int target_el)
 {
 	u_register_t new_spsr = 0;
 	u_register_t sctlr;
diff --git a/docs/about/release-information.rst b/docs/about/release-information.rst
index 654d65f..d814104 100644
--- a/docs/about/release-information.rst
+++ b/docs/about/release-information.rst
@@ -81,8 +81,6 @@
 |                                | Date        | after   |                                                         |
 |                                |             | Release |                                                         |
 +================================+=============+=========+=========================================================+
-| Mbedtls-2.x                    |     2.10    |   2.10  | Support for TF-A builds with Mbedtls-2.x will be removed|
-+--------------------------------+-------------+---------+---------------------------------------------------------+
 | STM32MP15_OPTEE_RSV_SHM        |     2.10    |   3.0   | OP-TEE manages its own memory on STM32MP15              |
 +--------------------------------+-------------+---------+---------------------------------------------------------+
 
@@ -103,4 +101,4 @@
 
 --------------
 
-*Copyright (c) 2018-2023, Arm Limited and Contributors. All rights reserved.*
+*Copyright (c) 2018-2024, Arm Limited and Contributors. All rights reserved.*
diff --git a/docs/design/cpu-specific-build-macros.rst b/docs/design/cpu-specific-build-macros.rst
index b152390..2f590b2 100644
--- a/docs/design/cpu-specific-build-macros.rst
+++ b/docs/design/cpu-specific-build-macros.rst
@@ -899,6 +899,11 @@
    Cortex-A715 CPU. This needs to be enabled for revisions r0p0 and r1p0. It is
    fixed in r1p1.
 
+-  ``ERRATA_A715_2413290``: This applies errata 2413290 workaround to
+   Cortex-A715 CPU. This needs to be enabled only for revision r1p0 and
+   when SPE(Statistical profiling extension)=True. The errata is fixed
+   in r1p1.
+
 -  ``ERRATA_A715_2420947``: This applies errata 2420947 workaround to
    Cortex-A715 CPU. This needs to be enabled only for revision r1p0.
    It is fixed in r1p1.
diff --git a/docs/plat/st/stm32mp1.rst b/docs/plat/st/stm32mp1.rst
index b6e4b0d..39a43ee 100644
--- a/docs/plat/st/stm32mp1.rst
+++ b/docs/plat/st/stm32mp1.rst
@@ -115,8 +115,9 @@
     make stm32mp15_trusted_defconfig
     make DEVICE_TREE=stm32mp157c-ev1 all
 
-OP-TEE (optional)
-_________________
+OP-TEE (recommended)
+____________________
+OP-TEE is the default BL32 supported for STMicroelectronics platforms.
 
 .. code:: bash
 
@@ -125,9 +126,10 @@
         CFG_EMBED_DTB_SOURCE_FILE=stm32mp157c-ev1.dts
 
 
-TF-A BL32 (SP_min)
-__________________
+TF-A BL32 (SP_min) (not recommended)
+____________________________________
 If you choose not to use OP-TEE, you can use TF-A SP_min.
+This is not the recommended BL32 to use, and will have very limited support.
 To build TF-A BL32, and its device tree file:
 
 .. code:: bash
@@ -217,4 +219,4 @@
 .. _STM32MP1 Series: https://www.st.com/en/microcontrollers-microprocessors/stm32mp1-series.html
 .. _STM32MP1 part number codification: https://wiki.st.com/stm32mpu/wiki/STM32MP15_microprocessor#Part_number_codification
 
-*Copyright (c) 2023, STMicroelectronics - All Rights Reserved*
+*Copyright (c) 2023-2024, STMicroelectronics - All Rights Reserved*
diff --git a/docs/plat/st/stm32mpus.rst b/docs/plat/st/stm32mpus.rst
index 931dd57..ab6d8fe 100644
--- a/docs/plat/st/stm32mpus.rst
+++ b/docs/plat/st/stm32mpus.rst
@@ -45,6 +45,8 @@
 - ``STM32MP_UART_PROGRAMMER``
 - ``STM32MP_USB_PROGRAMMER``
 
+Only one storage or serial device should be selected in the build command line,
+to save space and not overflow SYSRAM size, or else the platform won't build or boot.
 
 Other configuration flags:
 
@@ -75,4 +77,4 @@
 
 --------------
 
-*Copyright (c) 2023, STMicroelectronics - All Rights Reserved*
+*Copyright (c) 2023-2024, STMicroelectronics - All Rights Reserved*
diff --git a/docs/threat_model/firmware_threat_model/threat_model.rst b/docs/threat_model/firmware_threat_model/threat_model.rst
index 63bdc8a..f8e4f7d 100644
--- a/docs/threat_model/firmware_threat_model/threat_model.rst
+++ b/docs/threat_model/firmware_threat_model/threat_model.rst
@@ -623,6 +623,62 @@
 |                        |   UART interface(s).                                |
 +------------------------+-----------------------------------------------------+
 
++------------------------+-----------------------------------------------------+
+| ID                     | 16                                                  |
++========================+=====================================================+
+| Threat                 | | **An attacker could analyse the timing behaviour  |
+|                        |     of implemented methods in the system to infer   |
+|                        |     sensitive information.**                        |
+|                        |                                                     |
+|                        | | A timing side-channel attack is a type of attack  |
+|                        |   that exploits variations in the time it takes a   |
+|                        |   system to perform different operations. This      |
+|                        |   form of attack focuses on analyzing the time-     |
+|                        |   related information leakage that occurs during    |
+|                        |   the execution of cryptographic algorithms or      |
+|                        |   other security-sensitive processes. By observing  |
+|                        |   these timing differences, an attacker can gain    |
+|                        |   insights into the internal workings of a system   |
+|                        |   and potentially extract sensitive information.    |
+|                        |   Sensitive information that, when revealed even    |
+|                        |   partially, could heighten the susceptibility to   |
+|                        |   traditional attacks like brute-force attacks.     |
++------------------------+-----------------------------------------------------+
+| Diagram Elements       | DF2                                                 |
++------------------------+-----------------------------------------------------+
+| Affected TF-A          | BL1, BL2, BL31                                      |
+| Components             |                                                     |
++------------------------+-----------------------------------------------------+
+| Assets                 | Sensitive Data                                      |
++------------------------+-----------------------------------------------------+
+| Threat Agent           | AppDebug                                            |
++------------------------+-----------------------------------------------------+
+| Threat Type            | Information Disclosure                              |
++------------------------+------------------+----------------+-----------------+
+| Application            | Server           | IoT            | Mobile          |
++------------------------+------------------+----------------+-----------------+
+| Impact                 | Critical (5)     | Critical (5)   | Critical (5)    |
++------------------------+------------------+----------------+-----------------+
+| Likelihood             | Critical (5)     | Critical (5)   | Critical (5)    |
++------------------------+------------------+----------------+-----------------+
+| Total Risk Rating      | Critical (25)    | Critical (25)  | Critical (25)   |
++------------------------+------------------+----------------+-----------------+
+| Mitigations            | |  Ensure that the execution time of critical       |
+|                        |    operations is constant and independent of        |
+|                        |    secret data. This prevents attackers from        |
+|                        |    exploiting timing differences to infer           |
+|                        |    information about sensitive data.                |
+|                        |                                                     |
+|                        | |  Introduce random delays/timing jitter or dummy   |
+|                        |    operations to make the timing behavior of program|
+|                        |    execution less predictable. This can disrupt the |
+|                        |    correlation between the execution time and       |
+|                        |    sensitive data.                                  |
+|                        |                                                     |
++------------------------+-----------------------------------------------------+
+| Mitigations            | |  Not implemented                                  |
+| implemented?           |                                                     |
++------------------------+-----------------------------------------------------+
 
 .. _Boot Firmware Threats:
 
diff --git a/drivers/arm/gic/v3/gic600_multichip.c b/drivers/arm/gic/v3/gic600_multichip.c
index a4786bb..5e44aa9 100644
--- a/drivers/arm/gic/v3/gic600_multichip.c
+++ b/drivers/arm/gic/v3/gic600_multichip.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2019-2023, Arm Limited. All rights reserved.
+ * Copyright (c) 2019-2024, Arm Limited. All rights reserved.
  * Copyright (c) 2022-2023, NVIDIA Corporation. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
@@ -75,7 +75,7 @@
 		panic();
 	}
 
-	/* Poll till PUP is zero before intiating write */
+	/* Poll till PUP is zero before initiating write */
 	gicd_dchipr_wait_for_power_update_progress(base);
 
 	write_gicd_dchipr(base, read_gicd_dchipr(base) |
diff --git a/drivers/arm/mhu/mhu_v3_x.c b/drivers/arm/mhu/mhu_v3_x.c
new file mode 100644
index 0000000..118c608
--- /dev/null
+++ b/drivers/arm/mhu/mhu_v3_x.c
@@ -0,0 +1,475 @@
+/*
+ * Copyright (c) 2024, Arm Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <assert.h>
+#include <stdbool.h>
+#include <stdint.h>
+
+#include "mhu_v3_x.h"
+
+#include "mhu_v3_x_private.h"
+
+/*
+ * Get the device base from the device struct. Return an error if the dev is
+ * invalid.
+ */
+static enum mhu_v3_x_error_t get_dev_base(const struct mhu_v3_x_dev_t *dev,
+	 union _mhu_v3_x_frame_t **base)
+{
+	if (dev == NULL) {
+		return MHU_V_3_X_ERR_INVALID_PARAM;
+	}
+
+	/* Ensure driver has been initialized */
+	if (dev->is_initialized == false) {
+		return MHU_V_3_X_ERR_NOT_INIT;
+	}
+
+	*base = (union _mhu_v3_x_frame_t *)dev->base;
+
+	return MHU_V_3_X_ERR_NONE;
+}
+
+enum mhu_v3_x_error_t mhu_v3_x_driver_init(struct mhu_v3_x_dev_t *dev)
+{
+	uint32_t aidr = 0;
+	uint8_t mhu_major_rev;
+	union _mhu_v3_x_frame_t *p_mhu;
+
+	if (dev == NULL) {
+		return MHU_V_3_X_ERR_INVALID_PARAM;
+	}
+
+	/* Return if already initialized */
+	if (dev->is_initialized == true) {
+		return MHU_V_3_X_ERR_NONE;
+	}
+
+	p_mhu = (union _mhu_v3_x_frame_t *)dev->base;
+
+	/* Read revision from MHU hardware */
+	if (dev->frame == MHU_V3_X_PBX_FRAME) {
+		aidr = p_mhu->pbx_frame.pbx_ctrl_page.pbx_aidr;
+	} else if (dev->frame == MHU_V3_X_MBX_FRAME) {
+		aidr = p_mhu->mbx_frame.mbx_ctrl_page.mbx_aidr;
+	} else {
+		/* Only PBX and MBX frames are supported. */
+		return MHU_V_3_X_ERR_UNSUPPORTED;
+	}
+
+	/* Read the MHU Architecture Major Revision */
+	mhu_major_rev =
+		((aidr & MHU_ARCH_MAJOR_REV_MASK) >> MHU_ARCH_MAJOR_REV_OFF);
+
+	/* Return error if the MHU major revision is not 3 */
+	if (mhu_major_rev != MHU_MAJOR_REV_V3) {
+		/* Unsupported MHU version */
+		return MHU_V_3_X_ERR_UNSUPPORTED_VERSION;
+	}
+
+	/* Read the MHU Architecture Minor Revision */
+	dev->subversion =
+		((aidr & MHU_ARCH_MINOR_REV_MASK) >> MHU_ARCH_MINOR_REV_MASK);
+
+	/* Return error if the MHU minor revision is not 0 */
+	if (dev->subversion != MHU_MINOR_REV_3_0) {
+		/* Unsupported subversion */
+		return MHU_V_3_X_ERR_UNSUPPORTED_VERSION;
+	}
+
+	/* Initialize the Postbox/Mailbox to remain in operational state */
+	if (dev->frame == MHU_V3_X_PBX_FRAME) {
+		p_mhu->pbx_frame.pbx_ctrl_page.pbx_ctrl |= MHU_V3_OP_REQ;
+	} else if (dev->frame == MHU_V3_X_MBX_FRAME) {
+		p_mhu->mbx_frame.mbx_ctrl_page.mbx_ctrl |= MHU_V3_OP_REQ;
+	} else {
+		/* Only PBX and MBX frames are supported. */
+		return MHU_V_3_X_ERR_UNSUPPORTED;
+	}
+
+	dev->is_initialized = true;
+
+	return MHU_V_3_X_ERR_NONE;
+}
+
+enum mhu_v3_x_error_t mhu_v3_x_get_num_channel_implemented(
+	 const struct mhu_v3_x_dev_t *dev,
+	 enum mhu_v3_x_channel_type_t ch_type, uint8_t *num_ch)
+{
+	enum mhu_v3_x_error_t status;
+	union _mhu_v3_x_frame_t *p_mhu;
+
+	if (num_ch == NULL) {
+		return MHU_V_3_X_ERR_INVALID_PARAM;
+	}
+
+	/* Get dev->base if it is valid or return an error if dev is not */
+	status = get_dev_base(dev, &p_mhu);
+	if (status != MHU_V_3_X_ERR_NONE) {
+		return status;
+	}
+
+	/* Only doorbell channel is supported */
+	if (ch_type != MHU_V3_X_CHANNEL_TYPE_DBCH) {
+		return MHU_V_3_X_ERR_UNSUPPORTED;
+	}
+
+	/* Read the number of channels implemented in the MHU */
+	if (dev->frame == MHU_V3_X_PBX_FRAME) {
+		*num_ch = (p_mhu->pbx_frame.pbx_ctrl_page.pbx_dbch_cfg0 + 1);
+	} else if (dev->frame == MHU_V3_X_MBX_FRAME) {
+		*num_ch = (p_mhu->mbx_frame.mbx_ctrl_page.mbx_dbch_cfg0 + 1);
+	} else {
+		/* Only PBX and MBX frames are supported. */
+		return MHU_V_3_X_ERR_UNSUPPORTED;
+	}
+
+	return MHU_V_3_X_ERR_NONE;
+}
+
+enum mhu_v3_x_error_t mhu_v3_x_doorbell_clear(const struct mhu_v3_x_dev_t *dev,
+	 const uint32_t channel, uint32_t flags)
+{
+	union _mhu_v3_x_frame_t *p_mhu;
+	struct _mhu_v3_x_mdbcw_reg_t *mdbcw_reg;
+	enum mhu_v3_x_error_t status;
+
+	/* Get dev->base if it is valid or return an error if dev is not */
+	status = get_dev_base(dev, &p_mhu);
+	if (status != MHU_V_3_X_ERR_NONE) {
+		return status;
+	}
+
+	/* Only MBX can clear the Doorbell channel */
+	if (dev->frame != MHU_V3_X_MBX_FRAME) {
+		return MHU_V_3_X_ERR_INVALID_PARAM;
+	}
+
+	p_mhu = (union _mhu_v3_x_frame_t *)dev->base;
+	mdbcw_reg = (struct _mhu_v3_x_mdbcw_reg_t *)
+		&(p_mhu->mbx_frame.mdbcw_page);
+
+	/* Clear the bits in the doorbell channel */
+	mdbcw_reg[channel].mdbcw_clr |= flags;
+
+	return MHU_V_3_X_ERR_NONE;
+}
+
+enum mhu_v3_x_error_t mhu_v3_x_doorbell_write(const struct mhu_v3_x_dev_t *dev,
+	 const uint32_t channel, uint32_t flags)
+{
+	union _mhu_v3_x_frame_t *p_mhu;
+	struct _mhu_v3_x_pdbcw_reg_t *pdbcw_reg;
+	enum mhu_v3_x_error_t status;
+
+	/* Get dev->base if it is valid or return an error if dev is not */
+	status = get_dev_base(dev, &p_mhu);
+	if (status != MHU_V_3_X_ERR_NONE) {
+		return status;
+	}
+
+	/* Only PBX can set the Doorbell channel value */
+	if (dev->frame != MHU_V3_X_PBX_FRAME) {
+		return MHU_V_3_X_ERR_INVALID_PARAM;
+	}
+
+	p_mhu = (union _mhu_v3_x_frame_t *)dev->base;
+
+	pdbcw_reg = (struct _mhu_v3_x_pdbcw_reg_t *)
+		&(p_mhu->pbx_frame.pdbcw_page);
+
+	/* Write the value to the doorbell channel */
+	pdbcw_reg[channel].pdbcw_set |= flags;
+
+	return MHU_V_3_X_ERR_NONE;
+}
+
+enum mhu_v3_x_error_t mhu_v3_x_doorbell_read(const struct mhu_v3_x_dev_t *dev,
+	 const uint32_t channel, uint32_t *flags)
+{
+	union _mhu_v3_x_frame_t *p_mhu;
+	enum mhu_v3_x_error_t status;
+	struct _mhu_v3_x_mdbcw_reg_t *mdbcw_reg;
+	struct _mhu_v3_x_pdbcw_reg_t *pdbcw_reg;
+
+	if (flags == NULL) {
+		return MHU_V_3_X_ERR_INVALID_PARAM;
+	}
+
+	/* Get dev->base if it is valid or return an error if dev is not */
+	status = get_dev_base(dev, &p_mhu);
+	if (status != MHU_V_3_X_ERR_NONE) {
+		return status;
+	}
+
+	p_mhu = (union _mhu_v3_x_frame_t *)dev->base;
+
+	if (dev->frame == MHU_V3_X_PBX_FRAME) {
+		pdbcw_reg = (struct _mhu_v3_x_pdbcw_reg_t *)
+			&(p_mhu->pbx_frame.pdbcw_page);
+
+		/* Read the value from Postbox Doorbell status register */
+		*flags = pdbcw_reg[channel].pdbcw_st;
+	} else if (dev->frame == MHU_V3_X_MBX_FRAME) {
+		mdbcw_reg = (struct _mhu_v3_x_mdbcw_reg_t *)
+			&(p_mhu->mbx_frame.mdbcw_page);
+
+		/* Read the value from Mailbox Doorbell status register */
+		*flags = mdbcw_reg[channel].mdbcw_st;
+	} else {
+		/* Only PBX and MBX frames are supported. */
+		return MHU_V_3_X_ERR_UNSUPPORTED;
+	}
+
+	return MHU_V_3_X_ERR_NONE;
+}
+
+enum mhu_v3_x_error_t mhu_v3_x_doorbell_mask_set(
+	 const struct mhu_v3_x_dev_t *dev, const uint32_t channel,
+	 uint32_t flags)
+{
+	union _mhu_v3_x_frame_t *p_mhu;
+	struct _mhu_v3_x_mdbcw_reg_t *mdbcw_reg;
+	enum mhu_v3_x_error_t status;
+
+	/* Get dev->base if it is valid or return an error if dev is not */
+	status = get_dev_base(dev, &p_mhu);
+	if (status != MHU_V_3_X_ERR_NONE) {
+		return status;
+	}
+
+	/* Doorbell channel mask is not applicable for PBX */
+	if (dev->frame != MHU_V3_X_MBX_FRAME) {
+		return MHU_V_3_X_ERR_INVALID_PARAM;
+	}
+
+	p_mhu = (union _mhu_v3_x_frame_t *)dev->base;
+
+	mdbcw_reg = (struct _mhu_v3_x_mdbcw_reg_t *)
+		&(p_mhu->mbx_frame.mdbcw_page);
+
+	/* Set the Doorbell channel mask */
+	mdbcw_reg[channel].mdbcw_msk_set |= flags;
+
+	return MHU_V_3_X_ERR_NONE;
+}
+
+enum mhu_v3_x_error_t mhu_v3_x_doorbell_mask_clear(
+	 const struct mhu_v3_x_dev_t *dev, const uint32_t channel,
+	 uint32_t flags)
+{
+	union _mhu_v3_x_frame_t *p_mhu;
+	struct _mhu_v3_x_mdbcw_reg_t *mdbcw_reg;
+	enum mhu_v3_x_error_t status;
+
+	/* Get dev->base if it is valid or return an error if dev is not */
+	status = get_dev_base(dev, &p_mhu);
+	if (status != MHU_V_3_X_ERR_NONE) {
+		return status;
+	}
+
+	/* Doorbell channel mask is not applicable for PBX */
+	if (dev->frame != MHU_V3_X_MBX_FRAME) {
+		return MHU_V_3_X_ERR_INVALID_PARAM;
+	}
+
+	p_mhu = (union _mhu_v3_x_frame_t *)dev->base;
+
+	mdbcw_reg = (struct _mhu_v3_x_mdbcw_reg_t *)
+		&(p_mhu->mbx_frame.mdbcw_page);
+
+	/* Clear the Doorbell channel mask */
+	mdbcw_reg[channel].mdbcw_msk_clr = flags;
+
+	return MHU_V_3_X_ERR_NONE;
+}
+
+enum mhu_v3_x_error_t mhu_v3_x_doorbell_mask_get(
+	 const struct mhu_v3_x_dev_t *dev, const uint32_t channel,
+	 uint32_t *flags)
+{
+	union _mhu_v3_x_frame_t *p_mhu;
+	struct _mhu_v3_x_mdbcw_reg_t *mdbcw_reg;
+	enum mhu_v3_x_error_t status;
+
+	if (flags == NULL) {
+		return MHU_V_3_X_ERR_INVALID_PARAM;
+	}
+
+	/* Get dev->base if it is valid or return an error if dev is not */
+	status = get_dev_base(dev, &p_mhu);
+	if (status != MHU_V_3_X_ERR_NONE) {
+		return status;
+	}
+
+	/* Doorbell channel mask is not applicable for PBX */
+	if (dev->frame != MHU_V3_X_MBX_FRAME) {
+		return MHU_V_3_X_ERR_INVALID_PARAM;
+	}
+
+	p_mhu = (union _mhu_v3_x_frame_t *)dev->base;
+
+	mdbcw_reg = (struct _mhu_v3_x_mdbcw_reg_t *)
+		&(p_mhu->mbx_frame.mdbcw_page);
+
+	/* Save the Doorbell channel mask status */
+	*flags = mdbcw_reg[channel].mdbcw_msk_st;
+
+	return MHU_V_3_X_ERR_NONE;
+}
+
+enum mhu_v3_x_error_t mhu_v3_x_channel_interrupt_enable(
+	 const struct mhu_v3_x_dev_t *dev, const uint32_t channel,
+	 enum mhu_v3_x_channel_type_t ch_type)
+{
+	enum mhu_v3_x_error_t status;
+
+	union _mhu_v3_x_frame_t *p_mhu;
+	struct _mhu_v3_x_pdbcw_reg_t *pdbcw_reg;
+	struct _mhu_v3_x_mdbcw_reg_t *mdbcw_reg;
+
+	/* Get dev->base if it is valid or return an error if dev is not */
+	status = get_dev_base(dev, &p_mhu);
+	if (status != MHU_V_3_X_ERR_NONE) {
+		return status;
+	}
+
+	/* Only doorbell channel is supported */
+	if (ch_type != MHU_V3_X_CHANNEL_TYPE_DBCH) {
+		return MHU_V_3_X_ERR_UNSUPPORTED;
+	}
+
+	p_mhu = (union _mhu_v3_x_frame_t *)dev->base;
+
+	if (dev->frame == MHU_V3_X_PBX_FRAME) {
+		pdbcw_reg = (struct _mhu_v3_x_pdbcw_reg_t *)
+			&(p_mhu->pbx_frame.pdbcw_page);
+
+		/*
+		 * Enable this doorbell channel to generate interrupts for
+		 * transfer acknowledge events.
+		 */
+		pdbcw_reg[channel].pdbcw_int_en = MHU_V3_X_PDBCW_INT_X_TFR_ACK;
+
+		/*
+		 * Enable this doorbell channel to contribute to the PBX
+		 * combined interrupt.
+		 */
+		pdbcw_reg[channel].pdbcw_ctrl = MHU_V3_X_PDBCW_CTRL_PBX_COMB_EN;
+	} else if (dev->frame == MHU_V3_X_MBX_FRAME) {
+		mdbcw_reg = (struct _mhu_v3_x_mdbcw_reg_t *)
+			&(p_mhu->mbx_frame.mdbcw_page);
+
+		/*
+		 * Enable this doorbell channel to contribute to the MBX
+		 * combined interrupt.
+		 */
+		mdbcw_reg[channel].mdbcw_ctrl = MHU_V3_X_MDBCW_CTRL_MBX_COMB_EN;
+	} else {
+		/* Only PBX and MBX frames are supported. */
+		return MHU_V_3_X_ERR_UNSUPPORTED;
+	}
+
+	return MHU_V_3_X_ERR_NONE;
+}
+
+enum mhu_v3_x_error_t mhu_v3_x_channel_interrupt_disable(
+	 const struct mhu_v3_x_dev_t *dev, const uint32_t channel,
+	 enum mhu_v3_x_channel_type_t ch_type)
+{
+	enum mhu_v3_x_error_t status;
+
+	union _mhu_v3_x_frame_t *p_mhu;
+	struct _mhu_v3_x_pdbcw_reg_t *pdbcw_reg;
+	struct _mhu_v3_x_mdbcw_reg_t *mdbcw_reg;
+
+	/* Get dev->base if it is valid or return an error if dev is not */
+	status = get_dev_base(dev, &p_mhu);
+	if (status != MHU_V_3_X_ERR_NONE) {
+		return status;
+	}
+
+	/* Only doorbell channel is supported */
+	if (ch_type != MHU_V3_X_CHANNEL_TYPE_DBCH) {
+		return MHU_V_3_X_ERR_UNSUPPORTED;
+	}
+
+	p_mhu = (union _mhu_v3_x_frame_t *)dev->base;
+
+	if (dev->frame == MHU_V3_X_PBX_FRAME) {
+		pdbcw_reg = (struct _mhu_v3_x_pdbcw_reg_t *)
+			&(p_mhu->pbx_frame.pdbcw_page);
+
+		/* Clear channel transfer acknowledge event interrupt */
+		pdbcw_reg[channel].pdbcw_int_clr = MHU_V3_X_PDBCW_INT_X_TFR_ACK;
+
+		/* Disable channel transfer acknowledge event interrupt */
+		pdbcw_reg[channel].pdbcw_int_en &=
+			~(MHU_V3_X_PDBCW_INT_X_TFR_ACK);
+
+		/*
+		 * Disable this doorbell channel from contributing to the PBX
+		 * combined interrupt.
+		 */
+		pdbcw_reg[channel].pdbcw_ctrl &=
+			~(MHU_V3_X_PDBCW_CTRL_PBX_COMB_EN);
+	} else if (dev->frame == MHU_V3_X_MBX_FRAME) {
+		mdbcw_reg = (struct _mhu_v3_x_mdbcw_reg_t *)
+			&(p_mhu->mbx_frame.mdbcw_page);
+
+		/*
+		 * Disable this doorbell channel from contributing to the MBX
+		 * combined interrupt.
+		 */
+		mdbcw_reg[channel].mdbcw_ctrl &=
+			~(MHU_V3_X_MDBCW_CTRL_MBX_COMB_EN);
+	} else {
+		/* Only PBX and MBX frames are supported. */
+		return MHU_V_3_X_ERR_UNSUPPORTED;
+	}
+
+	return MHU_V_3_X_ERR_NONE;
+}
+
+enum mhu_v3_x_error_t mhu_v3_x_channel_interrupt_clear(
+	 const struct mhu_v3_x_dev_t *dev, const uint32_t channel,
+	 enum mhu_v3_x_channel_type_t ch_type)
+{
+	enum mhu_v3_x_error_t status;
+	union _mhu_v3_x_frame_t *p_mhu;
+	struct _mhu_v3_x_pdbcw_reg_t *pdbcw_reg;
+
+	/* Get dev->base if it is valid or return an error if dev is not */
+	status = get_dev_base(dev, &p_mhu);
+	if (status != MHU_V_3_X_ERR_NONE) {
+		return status;
+	}
+
+	/* Only doorbell channel is supported */
+	if (ch_type != MHU_V3_X_CHANNEL_TYPE_DBCH) {
+		return MHU_V_3_X_ERR_UNSUPPORTED;
+	}
+
+	/*
+	 * Only postbox doorbell channel transfer acknowledge interrupt can be
+	 * cleared manually.
+	 *
+	 * To clear MBX interrupt the unmasked status must be cleared using
+	 * mhu_v3_x_doorbell_clear.
+	 */
+	if (dev->frame != MHU_V3_X_PBX_FRAME) {
+		return MHU_V_3_X_ERR_INVALID_PARAM;
+	}
+
+	p_mhu = (union _mhu_v3_x_frame_t *)dev->base;
+	pdbcw_reg = (struct _mhu_v3_x_pdbcw_reg_t *)&(
+			p_mhu->pbx_frame.pdbcw_page);
+
+	/* Clear channel transfer acknowledge event interrupt */
+	pdbcw_reg[channel].pdbcw_int_clr |= 0x1;
+
+	return MHU_V_3_X_ERR_NONE;
+}
diff --git a/drivers/arm/mhu/mhu_v3_x.h b/drivers/arm/mhu/mhu_v3_x.h
new file mode 100644
index 0000000..a3a1950
--- /dev/null
+++ b/drivers/arm/mhu/mhu_v3_x.h
@@ -0,0 +1,226 @@
+/*
+ * Copyright (c) 2024, Arm Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#ifndef MHU_V3_X_H
+#define MHU_V3_X_H
+
+#include <stdbool.h>
+#include <stdint.h>
+
+/* MHU Architecture Major Revision 3 */
+#define MHU_MAJOR_REV_V3 U(0x2)
+/* MHU Architecture Minor Revision 0 */
+#define MHU_MINOR_REV_3_0 U(0x0)
+
+/* MHU Architecture Major Revision offset */
+#define MHU_ARCH_MAJOR_REV_OFF U(0x4)
+/* MHU Architecture Major Revision mask */
+#define MHU_ARCH_MAJOR_REV_MASK (U(0xf) << MHU_ARCH_MAJOR_REV_OFF)
+
+/* MHU Architecture Minor Revision offset */
+#define MHU_ARCH_MINOR_REV_OFF U(0x0)
+/* MHU Architecture Minor Revision mask */
+#define MHU_ARCH_MINOR_REV_MASK (U(0xf) << MHU_ARCH_MINOR_REV_OFF)
+
+/* MHUv3 PBX/MBX Operational Request offset */
+#define MHU_V3_OP_REQ_OFF U(0)
+/* MHUv3 PBX/MBX Operational Request */
+#define MHU_V3_OP_REQ (U(1) << MHU_V3_OP_REQ_OFF)
+
+/**
+ * MHUv3 error enumeration types
+ */
+enum mhu_v3_x_error_t {
+	/* No error */
+	MHU_V_3_X_ERR_NONE,
+	/* MHU driver not initialized */
+	MHU_V_3_X_ERR_NOT_INIT,
+	/* MHU driver alreary initialized */
+	MHU_V_3_X_ERR_ALREADY_INIT,
+	/* MHU Revision not supported error */
+	MHU_V_3_X_ERR_UNSUPPORTED_VERSION,
+	/* Operation not supported */
+	MHU_V_3_X_ERR_UNSUPPORTED,
+	/* Invalid parameter */
+	MHU_V_3_X_ERR_INVALID_PARAM,
+	/* General MHU driver error */
+	MHU_V_3_X_ERR_GENERAL,
+};
+
+/**
+ * MHUv3 channel types
+ */
+enum mhu_v3_x_channel_type_t {
+	/* Doorbell channel */
+	MHU_V3_X_CHANNEL_TYPE_DBCH,
+	/* Channel type count */
+	MHU_V3_X_CHANNEL_TYPE_COUNT,
+};
+
+/**
+ * MHUv3 frame types
+ */
+enum mhu_v3_x_frame_t {
+	/* MHUv3 postbox frame */
+	MHU_V3_X_PBX_FRAME,
+	/* MHUv3 mailbox frame */
+	MHU_V3_X_MBX_FRAME,
+};
+
+/**
+ * MHUv3 device structure
+ */
+struct mhu_v3_x_dev_t {
+	/* Base address of the MHUv3 frame */
+	uintptr_t base;
+	/* Type of the MHUv3 frame */
+	enum mhu_v3_x_frame_t frame;
+	/* Minor revision of the MHUv3 */
+	uint32_t subversion;
+	/* Flag to indicate if the MHUv3 is initialized */
+	bool is_initialized;
+};
+
+/**
+ * Initializes the MHUv3
+ *
+ * dev		MHU device struct mhu_v3_x_dev_t
+ *
+ * Returns mhu_v3_x_error_t error code
+ */
+enum mhu_v3_x_error_t mhu_v3_x_driver_init(struct mhu_v3_x_dev_t *dev);
+
+/**
+ * Returns the number of channels implemented
+ *
+ * dev		MHU device struct mhu_v3_x_dev_t
+ * ch_type	MHU channel type mhu_v3_x_channel_type_t
+ * num_ch	Pointer to the variable that will store the value
+ *
+ * Returns mhu_v3_x_error_t error code
+ */
+enum mhu_v3_x_error_t mhu_v3_x_get_num_channel_implemented(
+	 const struct mhu_v3_x_dev_t *dev, enum mhu_v3_x_channel_type_t ch_type,
+	 uint8_t *num_ch);
+
+/**
+ * Clear flags from a doorbell channel
+ *
+ * dev		MHU device struct mhu_v3_x_dev_t
+ * channel	Doorbell channel number
+ * flags	Flags to be cleared from the channel
+ *
+ * Returns mhu_v3_x_error_t error code
+ */
+enum mhu_v3_x_error_t mhu_v3_x_doorbell_clear(const struct mhu_v3_x_dev_t *dev,
+	 const uint32_t channel, uint32_t flags);
+
+/**
+ * Write flags to a doorbell channel
+ *
+ * dev		MHU device struct mhu_v3_x_dev_t
+ * channel	Doorbell channel number
+ * flags	Flags to be written to the channel
+ *
+ * Returns mhu_v3_x_error_t error code
+ */
+enum mhu_v3_x_error_t mhu_v3_x_doorbell_write(const struct mhu_v3_x_dev_t *dev,
+	 const uint32_t channel, uint32_t flags);
+
+/**
+ * Read value from a doorbell channel
+ *
+ * dev		MHU device struct mhu_v3_x_dev_t
+ * channel	Doorbell channel number
+ * flags	Pointer to the variable that will store the flags read from the
+ *		channel
+ *
+ * Returns mhu_v3_x_error_t error code
+ */
+enum mhu_v3_x_error_t mhu_v3_x_doorbell_read(const struct mhu_v3_x_dev_t *dev,
+	 const uint32_t channel, uint32_t *flags);
+
+/**
+ * Set bits in a doorbell channel mask which is used to disable interrupts for
+ * received flags corresponding to the mask
+ *
+ * dev		MHU device struct mhu_v3_x_dev_t
+ * channel	Doorbell channel number
+ * flags	Flags to set mask bits in this doorbell channel
+ *
+ * Returns mhu_v3_x_error_t error code
+ */
+enum mhu_v3_x_error_t mhu_v3_x_doorbell_mask_set(
+	 const struct mhu_v3_x_dev_t *dev, const uint32_t channel,
+	 uint32_t flags);
+
+/**
+ * Clear bits in a doorbell channel mask which is used to disable interrupts
+ * for received flags corresponding to the mask
+ *
+ * dev		MHU device struct mhu_v3_x_dev_t
+ * channel	Doorbell channel number
+ * flags	Flags to clear mask bits in this doorbell channel
+ *
+ * Returns mhu_v3_x_error_t error code
+ */
+enum mhu_v3_x_error_t mhu_v3_x_doorbell_mask_clear(
+	 const struct mhu_v3_x_dev_t *dev, const uint32_t channel, uint32_t flags);
+
+/**
+ * Get the mask of a doorbell channel which is used to disable interrupts for
+ * received flags corresponding to the mask
+ *
+ * dev		MHU device struct mhu_v3_x_dev_t
+ * channel	Doorbell channel number
+ * flags	Pointer to the variable that will store the flags read from the
+ *		mask value
+ *
+ * Returns mhu_v3_x_error_t error code
+ */
+enum mhu_v3_x_error_t mhu_v3_x_doorbell_mask_get(
+	 const struct mhu_v3_x_dev_t *dev, const uint32_t channel, uint32_t *flags);
+
+/**
+ * Enable the channel interrupt
+ *
+ * dev		MHU device struct mhu_v3_x_dev_t
+ * channel	Doorbell channel number
+ * ch_type	MHU channel type mhu_v3_x_channel_type_t
+ *
+ * Returns mhu_v3_x_error_t error code
+ */
+enum mhu_v3_x_error_t mhu_v3_x_channel_interrupt_enable(
+	 const struct mhu_v3_x_dev_t *dev, const uint32_t channel,
+	 enum mhu_v3_x_channel_type_t ch_type);
+
+/**
+ * Disable the channel interrupt
+ *
+ * dev		MHU device struct mhu_v3_x_dev_t
+ * channel	Doorbell channel number
+ * ch_type	MHU channel type mhu_v3_x_channel_type_t
+ *
+ * Returns mhu_v3_x_error_t error code
+ */
+enum mhu_v3_x_error_t mhu_v3_x_channel_interrupt_disable(
+	 const struct mhu_v3_x_dev_t *dev, const uint32_t channel,
+	 enum mhu_v3_x_channel_type_t ch_type);
+
+/**
+ * Clear the channel interrupt
+ *
+ * dev		MHU device struct mhu_v3_x_dev_t
+ * channel	Doorbell channel number
+ * ch_type	MHU channel type mhu_v3_x_channel_type_t
+ *
+ * Returns mhu_v3_x_error_t error code
+ */
+enum mhu_v3_x_error_t mhu_v3_x_channel_interrupt_clear(
+	 const struct mhu_v3_x_dev_t *dev, const uint32_t channel,
+	 enum mhu_v3_x_channel_type_t ch_type);
+
+#endif /* MHU_V3_X_H */
diff --git a/drivers/arm/mhu/mhu_v3_x_private.h b/drivers/arm/mhu/mhu_v3_x_private.h
new file mode 100644
index 0000000..9594a2a
--- /dev/null
+++ b/drivers/arm/mhu/mhu_v3_x_private.h
@@ -0,0 +1,222 @@
+/*
+ * Copyright (c) 2024, Arm Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#ifndef MHU_V3_X_PRIVATE_H
+#define MHU_V3_X_PRIVATE_H
+
+#include <stdint.h>
+
+/* Flag for PDBCW Interrupt Transfer Acknowledgment  */
+#define MHU_V3_X_PDBCW_INT_X_TFR_ACK 0x1
+
+/* Flag for PDBCW CTRL Postbox combined interrupts enable */
+#define MHU_V3_X_PDBCW_CTRL_PBX_COMB_EN 0x1
+
+/* Flag for MDBCW CTRL Mailbox combined interrupts enable */
+#define MHU_V3_X_MDBCW_CTRL_MBX_COMB_EN 0x1
+
+/**
+ * Postbox control page structure
+ */
+struct _mhu_v3_x_pbx_ctrl_reg_t {
+	/* Offset: 0x000 (R/ ) Postbox Block Identifier */
+	const volatile uint32_t pbx_blk_id;
+	/* Offset: 0x004 (R/ ) Reserved */
+	const volatile uint8_t reserved_0[0x10 - 0x04];
+	/* Offset: 0x010 (R/ ) Postbox Feature Support 0 */
+	const volatile uint32_t pbx_feat_spt0;
+	/* Offset: 0x014 (R/ ) Postbox Feature Support 1 */
+	const volatile uint32_t pbx_feat_spt1;
+	/* Offset: 0x018 (R/ ) Reserved */
+	const volatile uint8_t reserved_1[0x20 - 0x18];
+	/* Offset: 0x020 (R/ ) Postbox Doorbell Channel Configuration 0 */
+	const volatile uint32_t pbx_dbch_cfg0;
+	/* Offset: 0x024 (R/ ) Reserved */
+	const volatile uint8_t reserved_2[0x30 - 0x24];
+	/* Offset: 0x030 (R/ ) Postbox FIFO Channel Configuration 0 */
+	const volatile uint32_t pbx_ffch_cfg0;
+	/* Offset: 0x034 (R/ ) Reserved */
+	const volatile uint8_t reserved_3[0x40 - 0x34];
+	/* Offset: 0x040 (R/ ) Postbox Fast Channel Configuration 0 */
+	const volatile uint32_t pbx_fch_cfg0;
+	/* Offset: 0x044 (R/ ) Reserved */
+	const volatile uint8_t reserved_4[0x100 - 0x44];
+	/* Offset: 0x100 (R/W) Postbox control */
+	volatile uint32_t pbx_ctrl;
+	/* Offset: 0x164 (R/ ) Reserved */
+	const volatile uint8_t reserved_5[0x400 - 0x104];
+	/*
+	 * Offset: 0x400 (R/ ) Postbox Doorbell Channel Interrupt Status n,
+	 * where n is 0 - 3.
+	 */
+	const volatile uint32_t pbx_dbch_int_st[4];
+	/*
+	 * Offset: 0x410 (R/ ) Postbox FIFO Channel <n> Interrupt Status n,
+	 * where n is 0 - 1.
+	 */
+	const volatile uint32_t pbx_ffch_int_st[2];
+	/* Offset: 0x418 (R/ ) Reserved */
+	const uint8_t reserved_6[0xFC8 - 0x418];
+	/* Offset: 0xFC8 (R/ ) Postbox Implementer Identification Register */
+	const volatile uint32_t pbx_iidr;
+	/* Offset: 0xFCC (R/ ) Postbox Architecture Identification Register */
+	const volatile uint32_t pbx_aidr;
+	/*
+	 * Offset: 0xFD0 (R/ ) Postbox Implementation Defined Identification
+	 * Register n, where n is 0 - 11.
+	 */
+	const volatile uint32_t impl_def_id[12];
+};
+
+/**
+ * Postbox doorbell channel window page structure
+ */
+struct _mhu_v3_x_pdbcw_reg_t {
+	/* Offset: 0x000 (R/ ) Postbox Doorbell Channel Window Status */
+	const volatile uint32_t pdbcw_st;
+	/* Offset: 0x004 (R/ ) Reserved */
+	const uint8_t reserved_0[0xC - 0x4];
+	/* Offset: 0x00C ( /W) Postbox Doorbell Channel Window Set */
+	volatile uint32_t pdbcw_set;
+	/*
+	 * Offset: 0x010 (R/ ) Postbox Doorbell Channel Window Interrupt Status
+	 */
+	const volatile uint32_t pdbcw_int_st;
+	/*
+	 * Offset: 0x014 ( /W) Postbox Doorbell Channel Window Interrupt Clear
+	 */
+	volatile uint32_t pdbcw_int_clr;
+	/*
+	 * Offset: 0x018 (R/W) Postbox Doorbell Channel Window Interrupt Enable
+	 */
+	volatile uint32_t pdbcw_int_en;
+	/* Offset: 0x01C (R/W) Postbox Doorbell Channel Window Control */
+	volatile uint32_t pdbcw_ctrl;
+};
+
+/**
+ * Postbox structure
+ */
+struct _mhu_v3_x_pbx {
+	/* Postbox Control */
+	struct _mhu_v3_x_pbx_ctrl_reg_t pbx_ctrl_page;
+	/* Postbox Doorbell Channel Window */
+	struct _mhu_v3_x_pdbcw_reg_t pdbcw_page;
+};
+
+/**
+ * Mailbox control page structure
+ */
+struct _mhu_v3_x_mbx_ctrl_reg_t {
+	/* Offset: 0x000 (R/ ) Mailbox Block Identifier */
+	const volatile uint32_t mbx_blk_id;
+	/* Offset: 0x004 (R/ ) Reserved */
+	const volatile uint8_t reserved_0[0x10 - 0x04];
+	/* Offset: 0x010 (R/ ) Mailbox Feature Support 0 */
+	const volatile uint32_t mbx_feat_spt0;
+	/* Offset: 0x014 (R/ ) Mailbox Feature Support 1 */
+	const volatile uint32_t mbx_feat_spt1;
+	/* Offset: 0x018 (R/ ) Reserved */
+	const volatile uint8_t reserved_1[0x20 - 0x18];
+	/* Offset: 0x020 (R/ ) Mailbox Doorbell Channel Configuration 0 */
+	const volatile uint32_t mbx_dbch_cfg0;
+	/* Offset: 0x024 (R/ ) Reserved */
+	const volatile uint8_t reserved_2[0x30 - 0x24];
+	/* Offset: 0x030 (R/ ) Mailbox FIFO Channel Configuration 0 */
+	const volatile uint32_t mbx_ffch_cfg0;
+	/* Offset: 0x034 (R/ ) Reserved */
+	const volatile uint8_t reserved_4[0x40 - 0x34];
+	/* Offset: 0x040 (R/ ) Mailbox Fast Channel Configuration 0 */
+	const volatile uint32_t mbx_fch_cfg0;
+	/* Offset: 0x044 (R/ ) Reserved */
+	const volatile uint8_t reserved_5[0x100 - 0x44];
+	/* Offset: 0x100 (R/W) Mailbox control */
+	volatile uint32_t mbx_ctrl;
+	/* Offset: 0x104 (R/ ) Reserved */
+	const volatile uint8_t reserved_6[0x140 - 0x104];
+	/* Offset: 0x140 (R/W) Mailbox Fast Channel control */
+	volatile uint32_t mbx_fch_ctrl;
+	/* Offset: 0x144 (R/W) Mailbox Fast Channel Group Interrupt Enable */
+	volatile uint32_t mbx_fcg_int_en;
+	/* Offset: 0x148 (R/ ) Reserved */
+	const volatile uint8_t reserved_7[0x400 - 0x148];
+	/*
+	 * Offset: 0x400 (R/ ) Mailbox Doorbell Channel Interrupt Status n,
+	 * where n = 0 - 3.
+	 */
+	const volatile uint32_t mbx_dbch_int_st[4];
+	/*
+	 * Offset: 0x410 (R/ ) Mailbox FIFO Channel Interrupt Status n, where
+	 * n = 0 - 1.
+	 */
+	const volatile uint32_t mbx_ffch_int_st[2];
+	/* Offset: 0x418 (R/ ) Reserved */
+	const volatile uint8_t reserved_8[0x470 - 0x418];
+	/* Offset: 0x470 (R/ ) Mailbox Fast Channel Group Interrupt Status */
+	const volatile uint32_t mbx_fcg_int_st;
+	/* Offset: 0x474 (R/ ) Reserved */
+	const volatile uint8_t reserved_9[0x480 - 0x474];
+	/*
+	 * Offset: 0x480 (R/ ) Mailbox Fast Channel Group <n> Interrupt Status,
+	 * where n = 0 - 31.
+	 */
+	const volatile uint32_t mbx_fch_grp_int_st[32];
+	/* Offset: 0x500 (R/ ) Reserved */
+	const volatile uint8_t reserved_10[0xFC8 - 0x500];
+	/* Offset: 0xFC8 (R/ ) Mailbox Implementer Identification Register */
+	const volatile uint32_t mbx_iidr;
+	/* Offset: 0xFCC (R/ ) Mailbox Architecture Identification Register */
+	const volatile uint32_t mbx_aidr;
+	/*
+	 * Offset: 0xFD0 (R/ ) Mailbox Implementation Defined Identification
+	 * Register n, where n is 0 - 11.
+	 */
+	const volatile uint32_t impl_def_id[12];
+};
+
+/**
+ * Mailbox doorbell channel window page structure
+ */
+struct _mhu_v3_x_mdbcw_reg_t {
+	/* Offset: 0x000 (R/ ) Mailbox Doorbell Channel Window Status */
+	const volatile uint32_t mdbcw_st;
+	/* Offset: 0x004 (R/ ) Mailbox Doorbell Channel Window Status Masked */
+	const volatile uint32_t mdbcw_st_msk;
+	/* Offset: 0x008 ( /W) Mailbox Doorbell Channel Window Clear */
+	volatile uint32_t mdbcw_clr;
+	/* Offset: 0x00C (R/ ) Reserved */
+	const volatile uint8_t reserved_0[0x10 - 0x0C];
+	/* Offset: 0x010 (R/ ) Mailbox Doorbell Channel Window Mask Status */
+	const volatile uint32_t mdbcw_msk_st;
+	/* Offset: 0x014 ( /W) Mailbox Doorbell Channel Window Mask Set */
+	volatile uint32_t mdbcw_msk_set;
+	/* Offset: 0x018 ( /W) Mailbox Doorbell Channel Window Mask Clear */
+	volatile uint32_t mdbcw_msk_clr;
+	/* Offset: 0x01C (R/W) Mailbox Doorbell Channel Window Control */
+	volatile uint32_t mdbcw_ctrl;
+};
+
+/**
+ * Mailbox structure
+ */
+struct _mhu_v3_x_mbx {
+	/* Mailbox control */
+	struct _mhu_v3_x_mbx_ctrl_reg_t mbx_ctrl_page;
+	/* Mailbox Doorbell Channel Window */
+	struct _mhu_v3_x_mdbcw_reg_t mdbcw_page;
+};
+
+/**
+ * MHUv3 frame type
+ */
+union _mhu_v3_x_frame_t {
+	/* Postbox Frame */
+	struct _mhu_v3_x_pbx pbx_frame;
+	/* Mailbox Frame */
+	struct _mhu_v3_x_mbx mbx_frame;
+};
+
+#endif /* MHU_V3_X_PRIVATE_H */
diff --git a/drivers/arm/mhu/mhu_wrapper_v3_x.c b/drivers/arm/mhu/mhu_wrapper_v3_x.c
new file mode 100644
index 0000000..b3d51e3
--- /dev/null
+++ b/drivers/arm/mhu/mhu_wrapper_v3_x.c
@@ -0,0 +1,462 @@
+/*
+ * Copyright (c) 2024, Arm Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <assert.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+
+#include <drivers/arm/mhu.h>
+
+#include "mhu_v3_x.h"
+
+#define MHU_NOTIFY_VALUE	U(1234)
+
+#ifndef ALIGN_UP
+#define ALIGN_UP(num, align)	(((num) + ((align) - 1)) & ~((align) - 1))
+#endif
+
+/*
+ * MHUv3 Wrapper utility macros
+ */
+#define IS_ALIGNED(val, align)	(val == ALIGN_UP(val, align))
+
+/*
+ * MHU devices for host:
+ * HSE: Host to Secure Enclave (sender device)
+ * SEH: Secure Enclave to Host (receiver device)
+ */
+struct mhu_v3_x_dev_t mhu_hse_dev = {0, MHU_V3_X_PBX_FRAME};
+struct mhu_v3_x_dev_t mhu_seh_dev = {0, MHU_V3_X_MBX_FRAME};
+
+/* MHUv3 driver error to MHUv3 wrapper error mapping */
+static enum mhu_error_t error_mapping_to_mhu_error_t(enum mhu_v3_x_error_t err)
+{
+	switch (err) {
+	case MHU_V_3_X_ERR_NONE:
+		return MHU_ERR_NONE;
+
+	case MHU_V_3_X_ERR_NOT_INIT:
+		return MHU_ERR_NOT_INIT;
+
+	case MHU_V_3_X_ERR_UNSUPPORTED_VERSION:
+		return MHU_ERR_UNSUPPORTED_VERSION;
+
+	case MHU_V_3_X_ERR_UNSUPPORTED:
+		return MHU_ERR_UNSUPPORTED;
+
+	case MHU_V_3_X_ERR_INVALID_PARAM:
+		return MHU_ERR_INVALID_ARG;
+
+	default:
+		return MHU_ERR_GENERAL;
+	}
+}
+
+static enum mhu_error_t signal_and_wait_for_clear(
+	void *mhu_sender_dev, uint32_t value)
+{
+	enum mhu_v3_x_error_t err;
+	struct mhu_v3_x_dev_t *dev;
+	uint8_t num_channels;
+	uint32_t read_val;
+
+	dev = (struct mhu_v3_x_dev_t *)mhu_sender_dev;
+
+	if ((dev == NULL) || (dev->base == 0)) {
+		return MHU_ERR_INVALID_ARG;
+	}
+
+	err = mhu_v3_x_get_num_channel_implemented(dev,
+			MHU_V3_X_CHANNEL_TYPE_DBCH, &num_channels);
+	if (err != MHU_V_3_X_ERR_NONE) {
+		return error_mapping_to_mhu_error_t(err);
+	}
+
+	/* Wait for any pending acknowledgment from transmitter side */
+	do {
+		err = mhu_v3_x_doorbell_read(dev, num_channels - 1, &read_val);
+		if (err != MHU_V_3_X_ERR_NONE) {
+			return error_mapping_to_mhu_error_t(err);
+		}
+	} while ((read_val & value) == value);
+
+	/* Use the last channel to notify that a transfer is ready */
+	err = mhu_v3_x_doorbell_write(dev, num_channels - 1, value);
+	if (err != MHU_V_3_X_ERR_NONE) {
+		return error_mapping_to_mhu_error_t(err);
+	}
+
+	/* Wait until receiver side acknowledges the transfer */
+	do {
+		err = mhu_v3_x_doorbell_read(dev, num_channels - 1, &read_val);
+		if (err != MHU_V_3_X_ERR_NONE) {
+			return error_mapping_to_mhu_error_t(err);
+		}
+	} while ((read_val & value) == value);
+
+	return error_mapping_to_mhu_error_t(MHU_V_3_X_ERR_NONE);
+}
+
+static enum mhu_error_t wait_for_signal(
+	void *mhu_receiver_dev, uint32_t value)
+{
+	enum mhu_v3_x_error_t err;
+	struct mhu_v3_x_dev_t *dev;
+	uint32_t read_val;
+	uint8_t num_channels;
+
+	dev = (struct mhu_v3_x_dev_t *)mhu_receiver_dev;
+
+	if ((dev == NULL) || (dev->base == 0)) {
+		return MHU_ERR_INVALID_ARG;
+	}
+
+	err = mhu_v3_x_get_num_channel_implemented(dev,
+			MHU_V3_X_CHANNEL_TYPE_DBCH, &num_channels);
+	if (err != MHU_V_3_X_ERR_NONE) {
+		return error_mapping_to_mhu_error_t(err);
+	}
+
+	do {
+		err = mhu_v3_x_doorbell_read(dev, num_channels - 1, &read_val);
+		if (err != MHU_V_3_X_ERR_NONE) {
+			return error_mapping_to_mhu_error_t(err);
+		}
+	} while (read_val != value);
+
+	return error_mapping_to_mhu_error_t(err);
+}
+
+static enum mhu_error_t clear_and_wait_for_signal(
+	void *mhu_receiver_dev, uint32_t value)
+{
+	enum mhu_v3_x_error_t err;
+	struct mhu_v3_x_dev_t *dev;
+	uint8_t num_channels;
+
+	dev = (struct mhu_v3_x_dev_t *)mhu_receiver_dev;
+
+	if ((dev == NULL) || (dev->base == 0)) {
+		return MHU_ERR_INVALID_ARG;
+	}
+
+	err = mhu_v3_x_get_num_channel_implemented(dev,
+			MHU_V3_X_CHANNEL_TYPE_DBCH, &num_channels);
+	if (err != MHU_V_3_X_ERR_NONE) {
+		return error_mapping_to_mhu_error_t(err);
+	}
+
+	/* Clear all channels */
+	for (int i = 0; i < num_channels; i++) {
+		err = mhu_v3_x_doorbell_clear(dev, i, UINT32_MAX);
+		if (err != MHU_V_3_X_ERR_NONE) {
+			return error_mapping_to_mhu_error_t(err);
+		}
+	}
+
+	return wait_for_signal(mhu_receiver_dev, value);
+}
+
+static enum mhu_error_t validate_buffer_params(uintptr_t buf_addr)
+{
+	if ((buf_addr == 0) || (!IS_ALIGNED(buf_addr, sizeof(uint32_t)))) {
+		return MHU_ERR_INVALID_ARG;
+	}
+
+	return MHU_ERR_NONE;
+}
+
+enum mhu_error_t mhu_init_sender(uintptr_t mhu_sender_base)
+{
+	enum mhu_v3_x_error_t err;
+	struct mhu_v3_x_dev_t *dev;
+	uint8_t num_ch;
+	uint32_t ch;
+
+	assert(mhu_sender_base != (uintptr_t)NULL);
+
+	mhu_hse_dev.base = mhu_sender_base;
+	dev = (struct mhu_v3_x_dev_t *)&mhu_hse_dev;
+
+	/* Initialize MHUv3 */
+	err = mhu_v3_x_driver_init(dev);
+	if (err != MHU_V_3_X_ERR_NONE) {
+		return error_mapping_to_mhu_error_t(err);
+	}
+
+	/* Read the number of doorbell channels implemented in the MHU */
+	err = mhu_v3_x_get_num_channel_implemented(
+		dev, MHU_V3_X_CHANNEL_TYPE_DBCH, &num_ch);
+	if (err != MHU_V_3_X_ERR_NONE) {
+		return error_mapping_to_mhu_error_t(err);
+	} else if (num_ch < 2) {
+		/* This wrapper requires at least two channels implemented */
+		return MHU_ERR_UNSUPPORTED;
+	}
+
+	/*
+	 * The sender polls the postbox doorbell channel window status register
+	 * to get notified about successful transfer. So, disable the doorbell
+	 * channel's contribution to postbox combined interrupt.
+	 *
+	 * Also, clear and disable the postbox doorbell channel transfer
+	 * acknowledge interrupt.
+	 */
+	for (ch = 0; ch < num_ch; ch++) {
+		err = mhu_v3_x_channel_interrupt_disable(
+			dev, ch, MHU_V3_X_CHANNEL_TYPE_DBCH);
+		if (err != MHU_V_3_X_ERR_NONE) {
+			return error_mapping_to_mhu_error_t(err);
+		}
+	}
+
+	return MHU_ERR_NONE;
+}
+
+enum mhu_error_t mhu_init_receiver(uintptr_t mhu_receiver_base)
+{
+	enum mhu_v3_x_error_t err;
+	struct mhu_v3_x_dev_t *dev;
+	uint32_t ch;
+	uint8_t num_ch;
+
+	assert(mhu_receiver_base != (uintptr_t)NULL);
+
+	mhu_seh_dev.base = mhu_receiver_base;
+	dev = (struct mhu_v3_x_dev_t *)&mhu_seh_dev;
+
+	/* Initialize MHUv3 */
+	err = mhu_v3_x_driver_init(dev);
+	if (err != MHU_V_3_X_ERR_NONE) {
+		return error_mapping_to_mhu_error_t(err);
+	}
+
+	/* Read the number of doorbell channels implemented in the MHU */
+	err = mhu_v3_x_get_num_channel_implemented(
+		dev, MHU_V3_X_CHANNEL_TYPE_DBCH, &num_ch);
+	if (err != MHU_V_3_X_ERR_NONE) {
+		return error_mapping_to_mhu_error_t(err);
+	} else if (num_ch < 2) {
+		/* This wrapper requires at least two channels implemented */
+		return MHU_ERR_UNSUPPORTED;
+	}
+
+	/* Mask all channels except the notifying channel */
+	for (ch = 0; ch < (num_ch - 1); ch++) {
+		/* Mask interrupts on channels used for data */
+		err = mhu_v3_x_doorbell_mask_set(dev, ch, UINT32_MAX);
+		if (err != MHU_V_3_X_ERR_NONE) {
+			return error_mapping_to_mhu_error_t(err);
+		}
+	}
+
+	/* Unmask doorbell notification channel interrupt */
+	err = mhu_v3_x_doorbell_mask_clear(dev, (num_ch - 1), UINT32_MAX);
+	if (err != MHU_V_3_X_ERR_NONE) {
+		return error_mapping_to_mhu_error_t(err);
+	}
+
+	/*
+	 * Enable the doorbell channel's contribution to mailbox combined
+	 * interrupt.
+	 */
+	err = mhu_v3_x_channel_interrupt_enable(dev, (num_ch - 1),
+			MHU_V3_X_CHANNEL_TYPE_DBCH);
+	if (err != MHU_V_3_X_ERR_NONE) {
+		return error_mapping_to_mhu_error_t(err);
+	}
+
+	return MHU_ERR_NONE;
+}
+
+/*
+ * Public function. See mhu.h
+ *
+ * The basic steps of transferring a message:
+ * 1. Send the size of the payload on Channel 0. It is the very first Bytes of
+ *    the transfer. Continue with Channel 1.
+ * 2. Send the payload, writing the channels one after the other (4 Bytes
+ *    each). The last available channel is reserved for controlling the
+ *    transfer. When the last channel is reached or no more data is left, STOP.
+ * 3. Notify the receiver using the last channel and wait for acknowledge. If
+ *    there is still data to transfer, jump to step 2. Otherwise, proceed.
+ *
+ */
+enum mhu_error_t mhu_send_data(const uint8_t *send_buffer, size_t size)
+{
+	enum mhu_error_t mhu_err;
+	enum mhu_v3_x_error_t mhu_v3_err;
+	uint8_t num_channels;
+	uint8_t chan;
+	uint32_t *buffer;
+	struct mhu_v3_x_dev_t *dev;
+
+	if (size == 0) {
+		return MHU_ERR_NONE;
+	}
+
+	dev = (struct mhu_v3_x_dev_t *)&mhu_hse_dev;
+	chan = 0;
+
+	if ((dev == NULL) || (dev->base == 0)) {
+		return MHU_ERR_INVALID_ARG;
+	}
+
+	mhu_err = validate_buffer_params((uintptr_t)send_buffer);
+	if (mhu_err != MHU_ERR_NONE) {
+		return mhu_err;
+	}
+
+	mhu_v3_err = mhu_v3_x_get_num_channel_implemented(dev,
+			MHU_V3_X_CHANNEL_TYPE_DBCH, &num_channels);
+	if (mhu_v3_err != MHU_V_3_X_ERR_NONE) {
+		return error_mapping_to_mhu_error_t(mhu_v3_err);
+	}
+
+	/* First send the size of the actual message. */
+	mhu_v3_err = mhu_v3_x_doorbell_write(dev, chan, (uint32_t)size);
+	if (mhu_v3_err != MHU_V_3_X_ERR_NONE) {
+		return error_mapping_to_mhu_error_t(mhu_v3_err);
+	}
+	chan++;
+
+	buffer = (uint32_t *)send_buffer;
+	for (size_t i = 0; i < size; i += 4) {
+		mhu_v3_err = mhu_v3_x_doorbell_write(dev, chan, *buffer++);
+		if (mhu_v3_err != MHU_V_3_X_ERR_NONE) {
+			return error_mapping_to_mhu_error_t(mhu_v3_err);
+		}
+
+		if (++chan == (num_channels - 1)) {
+			/* Use the last channel to notify transfer complete */
+			mhu_err = signal_and_wait_for_clear(
+				dev, MHU_NOTIFY_VALUE);
+			if (mhu_err != MHU_ERR_NONE) {
+				return mhu_err;
+			}
+			chan = 0;
+		}
+	}
+
+	if (chan != 0) {
+		/* Use the last channel to notify transfer complete */
+		mhu_err = signal_and_wait_for_clear(dev, MHU_NOTIFY_VALUE);
+		if (mhu_err != MHU_ERR_NONE) {
+			return mhu_err;
+		}
+	}
+
+	return MHU_ERR_NONE;
+}
+
+/*
+ * Public function. See mhu.h
+ *
+ * The basic steps of receiving a message:
+ * 1. Read the size of the payload from Channel 0. It is the very first
+ *    4 Bytes of the transfer. Continue with Channel 1.
+ * 2. Receive the payload, read the channels one after the other
+ *    (4 Bytes each). The last available channel is reserved for controlling
+ *    the transfer.
+ *    When the last channel is reached clear all the channels
+ *    (also sending an acknowledge on the last channel).
+ * 3. If there is still data to receive wait for a notification on the last
+ *    channel and jump to step 2 as soon as it arrived. Otherwise, proceed.
+ *
+ */
+enum mhu_error_t mhu_receive_data(uint8_t *receive_buffer, size_t *size)
+{
+	enum mhu_error_t mhu_err;
+	enum mhu_v3_x_error_t mhu_v3_err;
+	uint32_t msg_len;
+	uint8_t num_channels;
+	uint8_t chan;
+	uint32_t *buffer;
+	struct mhu_v3_x_dev_t *dev;
+
+	dev = (struct mhu_v3_x_dev_t *)&mhu_seh_dev;
+	chan = 0;
+
+	mhu_err = validate_buffer_params((uintptr_t)receive_buffer);
+	if (mhu_err != MHU_ERR_NONE) {
+		return mhu_err;
+	}
+
+	mhu_v3_err = mhu_v3_x_get_num_channel_implemented(dev,
+			MHU_V3_X_CHANNEL_TYPE_DBCH, &num_channels);
+	if (mhu_v3_err != MHU_V_3_X_ERR_NONE) {
+		return error_mapping_to_mhu_error_t(mhu_v3_err);
+	}
+
+	/* Busy wait for incoming reply */
+	mhu_err = wait_for_signal(dev, MHU_NOTIFY_VALUE);
+	if (mhu_err != MHU_ERR_NONE) {
+		return mhu_err;
+	}
+
+	/* The first word is the length of the actual message. */
+	mhu_v3_err = mhu_v3_x_doorbell_read(dev, chan, &msg_len);
+	if (mhu_v3_err != MHU_V_3_X_ERR_NONE) {
+		return error_mapping_to_mhu_error_t(mhu_v3_err);
+	}
+	chan++;
+
+	if (*size < msg_len) {
+		/* Message buffer too small */
+		*size = msg_len;
+		return MHU_ERR_BUFFER_TOO_SMALL;
+	}
+
+	buffer = (uint32_t *)receive_buffer;
+	for (size_t i = 0; i < msg_len; i += 4) {
+		mhu_v3_err = mhu_v3_x_doorbell_read(dev, chan, buffer++);
+		if (mhu_v3_err != MHU_V_3_X_ERR_NONE) {
+			return error_mapping_to_mhu_error_t(mhu_v3_err);
+		}
+
+		/* Only wait for next transfer if still missing data. */
+		if (++chan == (num_channels - 1) && (msg_len - i) > 4) {
+			/* Busy wait for next transfer */
+			mhu_err = clear_and_wait_for_signal(
+				dev, MHU_NOTIFY_VALUE);
+			if (mhu_err != MHU_ERR_NONE) {
+				return mhu_err;
+			}
+			chan = 0;
+		}
+	}
+
+	/* Clear all channels */
+	for (uint8_t i = U(0); i < num_channels; i++) {
+		mhu_v3_err = mhu_v3_x_doorbell_clear(dev, i, UINT32_MAX);
+		if (mhu_v3_err != MHU_V_3_X_ERR_NONE) {
+			return error_mapping_to_mhu_error_t(mhu_v3_err);
+		}
+	}
+
+	*size = msg_len;
+
+	return MHU_ERR_NONE;
+}
+
+size_t mhu_get_max_message_size(void)
+{
+	enum mhu_v3_x_error_t err;
+	uint8_t num_channels;
+
+	err = mhu_v3_x_get_num_channel_implemented(&mhu_seh_dev,
+			MHU_V3_X_CHANNEL_TYPE_DBCH, &num_channels);
+
+	assert(err == MHU_V_3_X_ERR_NONE);
+	assert(num_channels != U(0));
+	/*
+	 * Returns only usable size of memory. As one channel is specifically
+	 * used to inform about the size of payload, discard it from available
+	 * memory size.
+	 */
+	return (num_channels - 1) * sizeof(uint32_t);
+}
diff --git a/drivers/arm/rss/rss_comms.mk b/drivers/arm/rss/rss_comms.mk
index c1c994b..0d1e308 100644
--- a/drivers/arm/rss/rss_comms.mk
+++ b/drivers/arm/rss/rss_comms.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2022, Arm Limited. All rights reserved.
+# Copyright (c) 2022-2024, Arm Limited. All rights reserved.
 #
 # SPDX-License-Identifier: BSD-3-Clause
 #
@@ -13,10 +13,22 @@
 					rss_comms_protocol_pointer_access.c	\
 				)
 
+# Default to MHUv2 if PLAT_MHU_VERSION undefined
+PLAT_MHU_VERSION ?= 2
+
+ifeq (${PLAT_MHU_VERSION}, 3)
+RSS_COMMS_SOURCES	+=	$(addprefix drivers/arm/mhu/,			\
+					mhu_v3_x.c				\
+					mhu_wrapper_v3_x.c			\
+				)
+else ifeq (${PLAT_MHU_VERSION}, 2)
 RSS_COMMS_SOURCES	+=	$(addprefix drivers/arm/mhu/,			\
 					mhu_v2_x.c				\
 					mhu_wrapper_v2_x.c			\
 				)
+else
+$(error Unsupported MHU version)
+endif
 
 PLAT_INCLUDES		+=	-Idrivers/arm/rss		\
 				-Idrivers/arm/mhu
diff --git a/drivers/auth/mbedtls/mbedtls_common.mk b/drivers/auth/mbedtls/mbedtls_common.mk
index a2c6430..2bb23f9 100644
--- a/drivers/auth/mbedtls/mbedtls_common.mk
+++ b/drivers/auth/mbedtls/mbedtls_common.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2015-2023, Arm Limited. All rights reserved.
+# Copyright (c) 2015-2024, Arm Limited. All rights reserved.
 #
 # SPDX-License-Identifier: BSD-3-Clause
 #
@@ -19,16 +19,15 @@
 MBEDTLS_MINOR=$(shell grep -hP "define MBEDTLS_VERSION_MINOR" ${MBEDTLS_DIR}/include/mbedtls/*.h | grep -oe '\([0-9.]*\)')
 $(info MBEDTLS_VERSION_MAJOR is [${MBEDTLS_MAJOR}] MBEDTLS_VERSION_MINOR is [${MBEDTLS_MINOR}])
 
+ifneq (${MBEDTLS_MAJOR}, 3)
+  $(error Error: TF-A only supports MbedTLS versions > 3.x)
+endif
+
 # Specify mbed TLS configuration file
-ifeq (${MBEDTLS_MAJOR}, 2)
-        $(info Deprecation Notice: Please migrate to Mbedtls version 3.x (refer to TF-A documentation for the exact version number))
-	MBEDTLS_CONFIG_FILE             ?=	"<drivers/auth/mbedtls/mbedtls_config-2.h>"
-else ifeq (${MBEDTLS_MAJOR}, 3)
-	ifeq (${PSA_CRYPTO},1)
-		MBEDTLS_CONFIG_FILE     ?=      "<drivers/auth/mbedtls/psa_mbedtls_config.h>"
-	else
-		MBEDTLS_CONFIG_FILE	?=	"<drivers/auth/mbedtls/mbedtls_config-3.h>"
-	endif
+ifeq (${PSA_CRYPTO},1)
+  MBEDTLS_CONFIG_FILE    ?=    "<drivers/auth/mbedtls/psa_mbedtls_config.h>"
+else
+  MBEDTLS_CONFIG_FILE    ?=    "<drivers/auth/mbedtls/mbedtls_config-3.h>"
 endif
 
 $(eval $(call add_define,MBEDTLS_CONFIG_FILE))
@@ -42,11 +41,13 @@
 					cipher.c 			\
 					cipher_wrap.c 			\
 					constant_time.c			\
+					hash_info.c			\
 					memory_buffer_alloc.c		\
 					oid.c 				\
 					platform.c 			\
 					platform_util.c			\
 					bignum.c			\
+					bignum_core.c			\
 					gcm.c 				\
 					md.c				\
 					pk.c 				\
@@ -59,28 +60,17 @@
 					ecp_curves.c			\
 					ecp.c				\
 					rsa.c				\
+					rsa_alt_helpers.c		\
 					x509.c 				\
 					x509_crt.c 			\
 					)
 
-ifeq (${MBEDTLS_MAJOR}, 2)
-	LIBMBEDTLS_SRCS +=  $(addprefix ${MBEDTLS_DIR}/library/,	\
-						rsa_internal.c		\
-						)
-else ifeq (${MBEDTLS_MAJOR}, 3)
-	LIBMBEDTLS_SRCS +=  $(addprefix ${MBEDTLS_DIR}/library/,	\
-						bignum_core.c		\
-						rsa_alt_helpers.c	\
-						hash_info.c		\
-						)
-
-	# Currently on Mbedtls-3 there is outstanding bug due to usage
-	# of redundant declaration[1], So disable redundant-decls
-	# compilation flag to avoid compilation error when compiling with
-	# Mbedtls-3.
-	# [1]: https://github.com/Mbed-TLS/mbedtls/issues/6910
-	LIBMBEDTLS_CFLAGS += -Wno-error=redundant-decls
-endif
+# Currently on Mbedtls-3 there is outstanding bug due to usage
+# of redundant declaration[1], So disable redundant-decls
+# compilation flag to avoid compilation error when compiling with
+# Mbedtls-3.
+# [1]: https://github.com/Mbed-TLS/mbedtls/issues/6910
+LIBMBEDTLS_CFLAGS += -Wno-error=redundant-decls
 
 ifeq (${PSA_CRYPTO},1)
 LIBMBEDTLS_SRCS         += $(addprefix ${MBEDTLS_DIR}/library/,    	\
diff --git a/drivers/partition/partition.c b/drivers/partition/partition.c
index 42e157b..888a824 100644
--- a/drivers/partition/partition.c
+++ b/drivers/partition/partition.c
@@ -190,11 +190,11 @@
 static int load_mbr_entries(uintptr_t image_handle)
 {
 	mbr_entry_t mbr_entry;
-	int i;
+	unsigned int i;
 
 	list.entry_count = MBR_PRIMARY_ENTRY_NUMBER;
 
-	for (i = 0; i < list.entry_count; i++) {
+	for (i = 0U; i < list.entry_count; i++) {
 		load_mbr_entry(image_handle, &mbr_entry, i);
 		list.list[i].start = mbr_entry.first_lba * 512;
 		list.list[i].length = mbr_entry.sector_nums * 512;
@@ -244,7 +244,7 @@
 		return result;
 	}
 
-	for (i = 0; i < (unsigned int)list.entry_count; i++) {
+	for (i = 0U; i < list.entry_count; i++) {
 		result = load_gpt_entry(image_handle, &entry);
 		if (result != 0) {
 			VERBOSE("Failed to load gpt entry data(%u) error is (%i)\n",
@@ -441,9 +441,9 @@
  */
 const partition_entry_t *get_partition_entry(const char *name)
 {
-	int i;
+	unsigned int i;
 
-	for (i = 0; i < list.entry_count; i++) {
+	for (i = 0U; i < list.entry_count; i++) {
 		if (strcmp(name, list.list[i].name) == 0) {
 			return &list.list[i];
 		}
@@ -457,9 +457,9 @@
 const partition_entry_t *get_partition_entry_by_type(
 	const struct efi_guid *type_guid)
 {
-	int i;
+	unsigned int i;
 
-	for (i = 0; i < list.entry_count; i++) {
+	for (i = 0U; i < list.entry_count; i++) {
 		if (guidcmp(type_guid, &list.list[i].type_guid) == 0) {
 			return &list.list[i];
 		}
@@ -474,9 +474,9 @@
 const partition_entry_t *get_partition_entry_by_guid(
 	const struct efi_guid *part_guid)
 {
-	int i;
+	unsigned int i;
 
-	for (i = 0; i < list.entry_count; i++) {
+	for (i = 0U; i < list.entry_count; i++) {
 		if (guidcmp(part_guid, &list.list[i].part_guid) == 0) {
 			return &list.list[i];
 		}
diff --git a/drivers/st/clk/stm32mp1_clk.c b/drivers/st/clk/stm32mp1_clk.c
index c9c3c5f..818fd85 100644
--- a/drivers/st/clk/stm32mp1_clk.c
+++ b/drivers/st/clk/stm32mp1_clk.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2018-2022, STMicroelectronics - All Rights Reserved
+ * Copyright (C) 2018-2024, STMicroelectronics - All Rights Reserved
  *
  * SPDX-License-Identifier: GPL-2.0+ OR BSD-3-Clause
  */
@@ -2326,6 +2326,17 @@
 }
 #endif /* STM32MP_SHARED_RESOURCES */
 
+void stm32mp1_clk_mcuss_protect(bool enable)
+{
+	uintptr_t rcc_base = stm32mp_rcc_base();
+
+	if (enable) {
+		mmio_setbits_32(rcc_base + RCC_TZCR, RCC_TZCR_MCKPROT);
+	} else {
+		mmio_clrbits_32(rcc_base + RCC_TZCR, RCC_TZCR_MCKPROT);
+	}
+}
+
 static void sync_earlyboot_clocks_state(void)
 {
 	unsigned int idx;
diff --git a/include/bl31/sync_handle.h b/include/bl31/sync_handle.h
index ae61f31..394252b 100644
--- a/include/bl31/sync_handle.h
+++ b/include/bl31/sync_handle.h
@@ -58,6 +58,8 @@
 /* Handler for injecting UNDEF exception to lower EL */
 void inject_undef64(cpu_context_t *ctx);
 
+u_register_t create_spsr(u_register_t old_spsr, unsigned int target_el);
+
 /* Prototypes for system register emulation handlers provided by platforms. */
 int plat_handle_impdef_trap(uint64_t esr_el3, cpu_context_t *ctx);
 int plat_handle_rng_trap(uint64_t esr_el3, cpu_context_t *ctx);
diff --git a/include/drivers/auth/mbedtls/mbedtls_config-2.h b/include/drivers/auth/mbedtls/mbedtls_config-2.h
deleted file mode 100644
index 01e261a..0000000
--- a/include/drivers/auth/mbedtls/mbedtls_config-2.h
+++ /dev/null
@@ -1,152 +0,0 @@
-/*
- * Copyright (c) 2015-2022, Arm Limited. All rights reserved.
- *
- * SPDX-License-Identifier: BSD-3-Clause
- */
-#ifndef MBEDTLS_CONFIG_H
-#define MBEDTLS_CONFIG_H
-
-/*
- * Key algorithms currently supported on mbed TLS libraries
- */
-#define TF_MBEDTLS_RSA			1
-#define TF_MBEDTLS_ECDSA		2
-#define TF_MBEDTLS_RSA_AND_ECDSA	3
-
-#define TF_MBEDTLS_USE_RSA (TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_RSA \
-		|| TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_RSA_AND_ECDSA)
-#define TF_MBEDTLS_USE_ECDSA (TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_ECDSA \
-		|| TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_RSA_AND_ECDSA)
-
-/*
- * Hash algorithms currently supported on mbed TLS libraries
- */
-#define TF_MBEDTLS_SHA256		1
-#define TF_MBEDTLS_SHA384		2
-#define TF_MBEDTLS_SHA512		3
-
-/*
- * Configuration file to build mbed TLS with the required features for
- * Trusted Boot
- */
-
-#define MBEDTLS_PLATFORM_MEMORY
-#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
-/* Prevent mbed TLS from using snprintf so that it can use tf_snprintf. */
-#define MBEDTLS_PLATFORM_SNPRINTF_ALT
-
-#define MBEDTLS_PKCS1_V21
-
-#define MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION
-#define MBEDTLS_X509_CHECK_KEY_USAGE
-#define MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE
-
-#define MBEDTLS_ASN1_PARSE_C
-#define MBEDTLS_ASN1_WRITE_C
-
-#define MBEDTLS_BASE64_C
-#define MBEDTLS_BIGNUM_C
-
-#define MBEDTLS_ERROR_C
-#define MBEDTLS_MD_C
-
-#define MBEDTLS_MEMORY_BUFFER_ALLOC_C
-#define MBEDTLS_OID_C
-
-#define MBEDTLS_PK_C
-#define MBEDTLS_PK_PARSE_C
-#define MBEDTLS_PK_WRITE_C
-
-#define MBEDTLS_PLATFORM_C
-
-#if TF_MBEDTLS_USE_ECDSA
-#define MBEDTLS_ECDSA_C
-#define MBEDTLS_ECP_C
-#define MBEDTLS_ECP_DP_SECP256R1_ENABLED
-#define MBEDTLS_ECP_NO_INTERNAL_RNG
-#endif
-#if TF_MBEDTLS_USE_RSA
-#define MBEDTLS_RSA_C
-#define MBEDTLS_X509_RSASSA_PSS_SUPPORT
-#endif
-
-#define MBEDTLS_SHA256_C
-
-/*
- * If either Trusted Boot or Measured Boot require a stronger algorithm than
- * SHA-256, pull in SHA-512 support.
- */
-#if (TF_MBEDTLS_HASH_ALG_ID != TF_MBEDTLS_SHA256) /* TBB hash algo */
-#define	MBEDTLS_SHA512_C
-#else
-   /* TBB uses SHA-256, what about measured boot? */
-#if defined(TF_MBEDTLS_MBOOT_USE_SHA512)
-#define MBEDTLS_SHA512_C
-#endif
-#endif
-
-#define MBEDTLS_VERSION_C
-
-#define MBEDTLS_X509_USE_C
-#define MBEDTLS_X509_CRT_PARSE_C
-
-#if TF_MBEDTLS_USE_AES_GCM
-#define MBEDTLS_AES_C
-#define MBEDTLS_CIPHER_C
-#define MBEDTLS_GCM_C
-#endif
-
-/* MPI / BIGNUM options */
-#define MBEDTLS_MPI_WINDOW_SIZE			2
-
-#if TF_MBEDTLS_USE_RSA
-#if TF_MBEDTLS_KEY_SIZE <= 2048
-#define MBEDTLS_MPI_MAX_SIZE			256
-#else
-#define MBEDTLS_MPI_MAX_SIZE			512
-#endif
-#else
-#define MBEDTLS_MPI_MAX_SIZE			256
-#endif
-
-/* Memory buffer allocator options */
-#define MBEDTLS_MEMORY_ALIGN_MULTIPLE		8
-
-/*
- * Prevent the use of 128-bit division which
- * creates dependency on external libraries.
- */
-#define MBEDTLS_NO_UDBL_DIVISION
-
-#ifndef __ASSEMBLER__
-/* System headers required to build mbed TLS with the current configuration */
-#include <stdlib.h>
-#include <mbedtls/check_config.h>
-#endif
-
-/*
- * Determine Mbed TLS heap size
- * 13312 = 13*1024
- * 11264 = 11*1024
- * 7168  = 7*1024
- */
-#if TF_MBEDTLS_USE_ECDSA
-#define TF_MBEDTLS_HEAP_SIZE		U(13312)
-#elif TF_MBEDTLS_USE_RSA
-#if TF_MBEDTLS_KEY_SIZE <= 2048
-#define TF_MBEDTLS_HEAP_SIZE		U(7168)
-#else
-#define TF_MBEDTLS_HEAP_SIZE		U(11264)
-#endif
-#endif
-
-/*
- * Warn if errors from certain functions are ignored.
- *
- * The warnings are always enabled (where supported) for critical functions
- * where ignoring the return value is almost always a bug. This macro extends
- * the warnings to more functions.
- */
-#define MBEDTLS_CHECK_RETURN_WARNING
-
-#endif /* MBEDTLS_CONFIG_H */
diff --git a/include/drivers/partition/partition.h b/include/drivers/partition/partition.h
index 4183570..9e22d34 100644
--- a/include/drivers/partition/partition.h
+++ b/include/drivers/partition/partition.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016-2023, Arm Limited and Contributors. All rights reserved.
+ * Copyright (c) 2016-2024, Arm Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -41,7 +41,7 @@
 
 typedef struct partition_entry_list {
 	partition_entry_t	list[PLAT_PARTITION_MAX_ENTRIES];
-	int			entry_count;
+	unsigned int		entry_count;
 } partition_entry_list_t;
 
 int load_partition_table(unsigned int image_id);
diff --git a/include/drivers/st/stm32mp1_clk.h b/include/drivers/st/stm32mp1_clk.h
index e2395bc..93ec1c5 100644
--- a/include/drivers/st/stm32mp1_clk.h
+++ b/include/drivers/st/stm32mp1_clk.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2022, STMicroelectronics - All Rights Reserved
+ * Copyright (c) 2018-2024, STMicroelectronics - All Rights Reserved
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -32,6 +32,8 @@
 void stm32mp1_clk_rcc_regs_lock(void);
 void stm32mp1_clk_rcc_regs_unlock(void);
 
+void stm32mp1_clk_mcuss_protect(bool enable);
+
 #ifdef STM32MP_SHARED_RESOURCES
 void stm32mp1_register_clock_parents_secure(unsigned long id);
 #endif
diff --git a/include/lib/cpus/aarch64/cortex_a715.h b/include/lib/cpus/aarch64/cortex_a715.h
index 525187c..c7f50db 100644
--- a/include/lib/cpus/aarch64/cortex_a715.h
+++ b/include/lib/cpus/aarch64/cortex_a715.h
@@ -13,6 +13,11 @@
 #define CORTEX_A715_BHB_LOOP_COUNT				U(38)
 
 /*******************************************************************************
+ * CPU Auxiliary Control register 1 specific definitions.
+ ******************************************************************************/
+#define CORTEX_A715_CPUACTLR_EL1				S3_0_C15_C1_0
+
+/*******************************************************************************
  * CPU Auxiliary Control register 2 specific definitions.
  ******************************************************************************/
 #define CORTEX_A715_CPUACTLR2_EL1				S3_0_C15_C1_1
diff --git a/lib/cpus/aarch64/cortex_a715.S b/lib/cpus/aarch64/cortex_a715.S
index cbdee66..abd649c 100644
--- a/lib/cpus/aarch64/cortex_a715.S
+++ b/lib/cpus/aarch64/cortex_a715.S
@@ -60,6 +60,19 @@
 
 check_erratum_ls cortex_a715, ERRATUM(2344187), CPU_REV(1, 0)
 
+/* Errata applies only when Static profiling extension is enabled. */
+workaround_reset_start cortex_a715, ERRATUM(2413290), ERRATA_A715_2413290
+	/* Apply the workaround by setting CPUACTLR_EL1[58:57] = 0b11. */
+	mrs x1, id_aa64dfr0_el1
+	ubfx x0, x1, ID_AA64DFR0_PMS_SHIFT, #4
+	cbz x0, 1f
+	sysreg_bit_set CORTEX_A715_CPUACTLR_EL1, BIT(57)
+	sysreg_bit_set CORTEX_A715_CPUACTLR_EL1, BIT(58)
+1:
+workaround_reset_end cortex_a715, ERRATUM(2413290)
+
+check_erratum_range cortex_a715, ERRATUM(2413290), CPU_REV(1,0), CPU_REV(1, 0)
+
 workaround_reset_start cortex_a715, ERRATUM(2420947), ERRATA_A715_2420947
         sysreg_bit_set CORTEX_A715_CPUACTLR2_EL1, BIT(33)
 workaround_reset_end cortex_a715, ERRATUM(2420947)
diff --git a/lib/cpus/cpu-ops.mk b/lib/cpus/cpu-ops.mk
index b7e4236..c87d53a 100644
--- a/lib/cpus/cpu-ops.mk
+++ b/lib/cpus/cpu-ops.mk
@@ -924,6 +924,10 @@
 # to revisions r0p0, and r1p0. It is fixed in r1p1.
 CPU_FLAG_LIST += ERRATA_A715_2344187
 
+# Flag to apply erratum 2413290 workaround during reset. This erratum applies
+# only to revision r1p0. It is fixed in r1p1.
+CPU_FLAG_LIST += ERRATA_A715_2413290
+
 # Flag to apply erratum 2420947 workaround during reset. This erratum applies
 # only to revision r1p0. It is fixed in r1p1.
 CPU_FLAG_LIST += ERRATA_A715_2420947
diff --git a/plat/arm/board/fvp/platform.mk b/plat/arm/board/fvp/platform.mk
index 5e9b1d7..569ac3f 100644
--- a/plat/arm/board/fvp/platform.mk
+++ b/plat/arm/board/fvp/platform.mk
@@ -204,6 +204,7 @@
 					lib/cpus/aarch64/cortex_a78_ae.S	\
 					lib/cpus/aarch64/cortex_a78c.S		\
 					lib/cpus/aarch64/cortex_a710.S		\
+					lib/cpus/aarch64/cortex_a715.S		\
 					lib/cpus/aarch64/neoverse_n_common.S	\
 					lib/cpus/aarch64/neoverse_n1.S		\
 					lib/cpus/aarch64/neoverse_n2.S		\
diff --git a/plat/common/aarch64/crash_console_helpers.S b/plat/common/aarch64/crash_console_helpers.S
index 75b4208..1a50091 100644
--- a/plat/common/aarch64/crash_console_helpers.S
+++ b/plat/common/aarch64/crash_console_helpers.S
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2019, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2018-2024, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -100,7 +100,7 @@
 	 * int plat_crash_console_putc(char c)
 	 * Prints the character on all consoles registered with the console
 	 * framework that have CONSOLE_FLAG_CRASH set. Note that this is only
-	 * helpful for crashes that occur after the platform intialization code
+	 * helpful for crashes that occur after the platform initialization code
 	 * has registered a console. Platforms using this implementation need to
 	 * ensure that all console drivers they use that have the CRASH flag set
 	 * support this (i.e. are written in assembly and comply to the register
diff --git a/plat/intel/soc/agilex5/bl31_plat_setup.c b/plat/intel/soc/agilex5/bl31_plat_setup.c
index 0d4f2cc..8d3928f 100644
--- a/plat/intel/soc/agilex5/bl31_plat_setup.c
+++ b/plat/intel/soc/agilex5/bl31_plat_setup.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2019-2020, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2019-2024, ARM Limited and Contributors. All rights reserved.
  * Copyright (c) 2019-2023, Intel Corporation. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
@@ -182,7 +182,7 @@
 
 /*******************************************************************************
  * Perform the very early platform specific architectural setup here. At the
- * moment this is only intializes the mmu in a quick and dirty way.
+ * moment this is only initializes the mmu in a quick and dirty way.
  ******************************************************************************/
 void bl31_plat_arch_setup(void)
 {
diff --git a/plat/st/common/common.mk b/plat/st/common/common.mk
index f49112d..b9b62c0 100644
--- a/plat/st/common/common.mk
+++ b/plat/st/common/common.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2023, STMicroelectronics - All Rights Reserved
+# Copyright (c) 2023-2024, STMicroelectronics - All Rights Reserved
 #
 # SPDX-License-Identifier: BSD-3-Clause
 #
@@ -183,12 +183,10 @@
 MBEDTLS_MAJOR=$(shell grep -hP "define MBEDTLS_VERSION_MAJOR" \
 ${MBEDTLS_DIR}/include/mbedtls/*.h | grep -oe '\([0-9.]*\)')
 
-ifeq (${MBEDTLS_MAJOR}, 2)
-MBEDTLS_CONFIG_FILE		?=	"<stm32mp_mbedtls_config-2.h>"
-endif
-
 ifeq (${MBEDTLS_MAJOR}, 3)
 MBEDTLS_CONFIG_FILE		?=	"<stm32mp_mbedtls_config-3.h>"
+else
+$(error Error: TF-A only supports MbedTLS versions > 3.x)
 endif
 endif
 
diff --git a/plat/st/common/include/stm32mp_mbedtls_config-2.h b/plat/st/common/include/stm32mp_mbedtls_config-2.h
deleted file mode 100644
index 66ff346..0000000
--- a/plat/st/common/include/stm32mp_mbedtls_config-2.h
+++ /dev/null
@@ -1,119 +0,0 @@
-/*
- * Copyright (c) 2022-2023, STMicroelectronics - All Rights Reserved
- *
- * SPDX-License-Identifier: BSD-3-Clause
- */
-#ifndef MBEDTLS_CONFIG_H
-#define MBEDTLS_CONFIG_H
-
-/*
- * Key algorithms currently supported on mbed TLS libraries
- */
-#define TF_MBEDTLS_USE_RSA	0
-#define TF_MBEDTLS_USE_ECDSA	1
-
-/*
- * Hash algorithms currently supported on mbed TLS libraries
- */
-#define TF_MBEDTLS_SHA256		1
-#define TF_MBEDTLS_SHA384		2
-#define TF_MBEDTLS_SHA512		3
-
-/*
- * Configuration file to build mbed TLS with the required features for
- * Trusted Boot
- */
-
-#define MBEDTLS_PLATFORM_MEMORY
-#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
-/* Prevent mbed TLS from using snprintf so that it can use tf_snprintf. */
-#define MBEDTLS_PLATFORM_SNPRINTF_ALT
-
-#define MBEDTLS_PKCS1_V21
-
-#define MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION
-#define MBEDTLS_X509_CHECK_KEY_USAGE
-#define MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE
-
-#define MBEDTLS_ASN1_PARSE_C
-#define MBEDTLS_ASN1_WRITE_C
-
-#define MBEDTLS_BASE64_C
-#define MBEDTLS_BIGNUM_C
-
-#define MBEDTLS_ERROR_C
-#define MBEDTLS_MD_C
-
-#define MBEDTLS_MEMORY_BUFFER_ALLOC_C
-#define MBEDTLS_OID_C
-
-#define MBEDTLS_PK_C
-#define MBEDTLS_PK_PARSE_C
-#define MBEDTLS_PK_WRITE_C
-
-#define MBEDTLS_PLATFORM_C
-
-#if TF_MBEDTLS_USE_ECDSA
-#define MBEDTLS_ECDSA_C
-#define MBEDTLS_ECP_C
-#define MBEDTLS_ECP_DP_SECP256R1_ENABLED
-#define MBEDTLS_ECP_NO_INTERNAL_RNG
-#endif
-#if TF_MBEDTLS_USE_RSA
-#define MBEDTLS_RSA_C
-#define MBEDTLS_X509_RSASSA_PSS_SUPPORT
-#endif
-
-#define MBEDTLS_SHA256_C
-#if (TF_MBEDTLS_HASH_ALG_ID != TF_MBEDTLS_SHA256)
-#define MBEDTLS_SHA512_C
-#endif
-
-#define MBEDTLS_VERSION_C
-
-#define MBEDTLS_X509_USE_C
-#define MBEDTLS_X509_CRT_PARSE_C
-
-#if TF_MBEDTLS_USE_AES_GCM
-#define MBEDTLS_AES_C
-#define MBEDTLS_CIPHER_C
-#define MBEDTLS_GCM_C
-#endif
-
-/* MPI / BIGNUM options */
-#define MBEDTLS_MPI_WINDOW_SIZE			2
-
-#if TF_MBEDTLS_USE_RSA
-#if TF_MBEDTLS_KEY_SIZE <= 2048
-#define MBEDTLS_MPI_MAX_SIZE			256
-#else
-#define MBEDTLS_MPI_MAX_SIZE			512
-#endif
-#else
-#define MBEDTLS_MPI_MAX_SIZE			256
-#endif
-
-/* Memory buffer allocator options */
-#define MBEDTLS_MEMORY_ALIGN_MULTIPLE		8
-
-/*
- * Prevent the use of 128-bit division which
- * creates dependency on external libraries.
- */
-#define MBEDTLS_NO_UDBL_DIVISION
-
-#ifndef __ASSEMBLER__
-/* System headers required to build mbed TLS with the current configuration */
-#include <stdlib.h>
-#include <mbedtls/check_config.h>
-#endif
-
-/*
- * Mbed TLS heap size is smal as we only use the asn1
- * parsing functions
- * digest, signature and crypto algorithm are done by
- * other library.
- */
-
-#define TF_MBEDTLS_HEAP_SIZE           U(5120)
-#endif /* MBEDTLS_CONFIG_H */
diff --git a/plat/st/stm32mp1/bl2_plat_setup.c b/plat/st/stm32mp1/bl2_plat_setup.c
index fd86020..798c033 100644
--- a/plat/st/stm32mp1/bl2_plat_setup.c
+++ b/plat/st/stm32mp1/bl2_plat_setup.c
@@ -255,11 +255,6 @@
 		mmio_clrbits_32(rcc_base + RCC_BDCR, RCC_BDCR_VSWRST);
 	}
 
-#if STM32MP15
-	/* Disable MCKPROT */
-	mmio_clrbits_32(rcc_base + RCC_TZCR, RCC_TZCR_MCKPROT);
-#endif
-
 	/*
 	 * Set minimum reset pulse duration to 31ms for discrete power
 	 * supplied boards.
diff --git a/plat/st/stm32mp1/sp_min/sp_min_setup.c b/plat/st/stm32mp1/sp_min/sp_min_setup.c
index b46f4af..245b2d3 100644
--- a/plat/st/stm32mp1/sp_min/sp_min_setup.c
+++ b/plat/st/stm32mp1/sp_min/sp_min_setup.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2023, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2024, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -182,6 +182,9 @@
 
 	stm32mp_gic_init();
 
+	/* Disable MCU subsystem protection */
+	stm32mp1_clk_mcuss_protect(false);
+
 	if (stm32_iwdg_init() < 0) {
 		panic();
 	}
diff --git a/services/std_svc/sdei/sdei_intr_mgmt.c b/services/std_svc/sdei/sdei_intr_mgmt.c
index 72bc33f..c58adba 100644
--- a/services/std_svc/sdei/sdei_intr_mgmt.c
+++ b/services/std_svc/sdei/sdei_intr_mgmt.c
@@ -13,6 +13,7 @@
 #include <arch_features.h>
 #include <bl31/ehf.h>
 #include <bl31/interrupt_mgmt.h>
+#include <bl31/sync_handle.h>
 #include <common/bl_common.h>
 #include <common/debug.h>
 #include <common/runtime_svc.h>
@@ -237,9 +238,7 @@
 /*
  * Prepare for ERET:
  * - Set the ELR to the registered handler address
- * - Set the SPSR register as described in the SDEI documentation and
- *   the AArch64.TakeException() pseudocode function in
- *   ARM DDI 0487F.c page J1-7635
+ * - Set the SPSR register by calling the common create_spsr() function
  */
 
 static void sdei_set_elr_spsr(sdei_entry_t *se, sdei_dispatch_context_t *disp_ctx)
@@ -250,57 +249,7 @@
 
 	u_register_t interrupted_pstate = disp_ctx->spsr_el3;
 
-	/* Check the SPAN bit in the client el SCTLR */
-	u_register_t client_el_sctlr;
-
-	if (client_el == MODE_EL2) {
-		client_el_sctlr = read_sctlr_el2();
-	} else {
-		client_el_sctlr = read_sctlr_el1();
-	}
-
-	/*
-	 * Check whether to force the PAN bit or use the value in the
-	 * interrupted EL according to the check described in
-	 * TakeException. Since the client can only be Non-Secure
-	 * EL2 or El1 some of the conditions in ElIsInHost() we know
-	 * will always be True.
-	 * When the client_el is EL2 we know that there will be a SPAN
-	 * bit in SCTLR_EL2 as we have already checked for the condition
-	 * HCR_EL2.E2H = 1 and HCR_EL2.TGE = 1
-	 */
-	u_register_t hcr_el2 = read_hcr();
-	bool el_is_in_host = (read_feat_vhe_id_field() != 0U) &&
-			     (hcr_el2 & HCR_TGE_BIT) &&
-			     (hcr_el2 & HCR_E2H_BIT);
-
-	if (is_feat_pan_supported() &&
-	    ((client_el == MODE_EL1) ||
-		(client_el == MODE_EL2 && el_is_in_host)) &&
-	    ((client_el_sctlr & SCTLR_SPAN_BIT) == 0U)) {
-		sdei_spsr |=  SPSR_PAN_BIT;
-	} else {
-		sdei_spsr |= (interrupted_pstate & SPSR_PAN_BIT);
-	}
-
-	/* If SSBS is implemented, take the value from the client el SCTLR */
-	u_register_t ssbs_enabled = (read_id_aa64pfr1_el1()
-					>> ID_AA64PFR1_EL1_SSBS_SHIFT)
-					& ID_AA64PFR1_EL1_SSBS_MASK;
-	if (ssbs_enabled != SSBS_UNAVAILABLE) {
-		u_register_t  ssbs_bit = ((client_el_sctlr & SCTLR_DSSBS_BIT)
-						>> SCTLR_DSSBS_SHIFT)
-						<< SPSR_SSBS_SHIFT_AARCH64;
-		sdei_spsr |= ssbs_bit;
-	}
-
-	/* If MTE is implemented in the client el set the TCO bit */
-	if (is_feat_mte_supported()) {
-		sdei_spsr |= SPSR_TCO_BIT_AARCH64;
-	}
-
-	/* Take the DIT field from the pstate of the interrupted el */
-	sdei_spsr |= (interrupted_pstate & SPSR_DIT_BIT);
+	sdei_spsr = create_spsr(interrupted_pstate, client_el);
 
 	cm_set_elr_spsr_el3(NON_SECURE, (uintptr_t) se->ep, sdei_spsr);
 }