diff --git a/Makefile b/Makefile
index f4589d9..61593c1 100644
--- a/Makefile
+++ b/Makefile
@@ -914,6 +914,7 @@
 $(eval $(call assert_boolean,ERRATA_SPECULATIVE_AT))
 $(eval $(call assert_boolean,RAS_TRAP_LOWER_EL_ERR_ACCESS))
 $(eval $(call assert_boolean,COT_DESC_IN_DTB))
+$(eval $(call assert_boolean,USE_SP804_TIMER))
 
 $(eval $(call assert_numeric,ARM_ARCH_MAJOR))
 $(eval $(call assert_numeric,ARM_ARCH_MINOR))
@@ -995,6 +996,7 @@
 $(eval $(call add_define,ERRATA_SPECULATIVE_AT))
 $(eval $(call add_define,RAS_TRAP_LOWER_EL_ERR_ACCESS))
 $(eval $(call add_define,COT_DESC_IN_DTB))
+$(eval $(call add_define,USE_SP804_TIMER))
 
 ifeq (${SANITIZE_UB},trap)
         $(eval $(call add_define,MONITOR_TRAPS))
@@ -1135,7 +1137,7 @@
 # Add Secure Partition packages
 ifeq (${NEED_SP_PKG},yes)
 $(BUILD_PLAT)/sp_gen.mk: ${SP_MK_GEN} ${SP_LAYOUT_FILE} | ${BUILD_PLAT}
-	${Q}${PYTHON} "$<" "$@" $(filter-out $<,$^) $(BUILD_PLAT)
+	${Q}${PYTHON} "$<" "$@" $(filter-out $<,$^) $(BUILD_PLAT) ${COT}
 sp: $(SPTOOL) $(DTBS) $(BUILD_PLAT)/sp_gen.mk
 	${Q}$(SPTOOL) $(SPTOOL_ARGS)
 	@${ECHO_BLANK_LINE}
diff --git a/bl31/aarch64/runtime_exceptions.S b/bl31/aarch64/runtime_exceptions.S
index 5b37388..bfe13f3 100644
--- a/bl31/aarch64/runtime_exceptions.S
+++ b/bl31/aarch64/runtime_exceptions.S
@@ -12,6 +12,7 @@
 #include <bl31/interrupt_mgmt.h>
 #include <common/runtime_svc.h>
 #include <context.h>
+#include <el3_common_macros.S>
 #include <lib/el3_runtime/cpu_data.h>
 #include <lib/smccc.h>
 
@@ -285,21 +286,25 @@
 	 * to a valid cpu context where the general purpose and system register
 	 * state can be saved.
 	 */
+	apply_at_speculative_wa
 	check_and_unmask_ea
 	handle_sync_exception
 end_vector_entry sync_exception_aarch64
 
 vector_entry irq_aarch64
+	apply_at_speculative_wa
 	check_and_unmask_ea
 	handle_interrupt_exception irq_aarch64
 end_vector_entry irq_aarch64
 
 vector_entry fiq_aarch64
+	apply_at_speculative_wa
 	check_and_unmask_ea
 	handle_interrupt_exception fiq_aarch64
 end_vector_entry fiq_aarch64
 
 vector_entry serror_aarch64
+	apply_at_speculative_wa
 	msr	daifclr, #DAIF_ABT_BIT
 	b	enter_lower_el_async_ea
 end_vector_entry serror_aarch64
@@ -315,21 +320,25 @@
 	 * to a valid cpu context where the general purpose and system register
 	 * state can be saved.
 	 */
+	apply_at_speculative_wa
 	check_and_unmask_ea
 	handle_sync_exception
 end_vector_entry sync_exception_aarch32
 
 vector_entry irq_aarch32
+	apply_at_speculative_wa
 	check_and_unmask_ea
 	handle_interrupt_exception irq_aarch32
 end_vector_entry irq_aarch32
 
 vector_entry fiq_aarch32
+	apply_at_speculative_wa
 	check_and_unmask_ea
 	handle_interrupt_exception fiq_aarch32
 end_vector_entry fiq_aarch32
 
 vector_entry serror_aarch32
+	apply_at_speculative_wa
 	msr	daifclr, #DAIF_ABT_BIT
 	b	enter_lower_el_async_ea
 end_vector_entry serror_aarch32
@@ -455,6 +464,8 @@
 	b	el3_exit
 
 smc_prohibited:
+	restore_ptw_el1_sys_regs
+	ldp	x28, x29, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X28]
 	ldr	x30, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_LR]
 	mov	x0, #SMC_UNK
 	exception_return
diff --git a/common/backtrace/backtrace.c b/common/backtrace/backtrace.c
index ef57500..a07c066 100644
--- a/common/backtrace/backtrace.c
+++ b/common/backtrace/backtrace.c
@@ -70,7 +70,7 @@
 	} else if (el == 2U) {
 		ats1e2r(addr);
 	} else {
-		ats1e1r(addr);
+		AT(ats1e1r, addr);
 	}
 
 	isb();
diff --git a/docs/about/contact.rst b/docs/about/contact.rst
index 9cb25ef..4440a37 100644
--- a/docs/about/contact.rst
+++ b/docs/about/contact.rst
@@ -24,12 +24,21 @@
 
 You can see a `summary of all the lists`_ on the TrustedFirmware.org website.
 
+Open Tech Forum Call
+^^^^^^^^^^^^^^^^^^^^
+
+Every other week, we organize a call with all interested TF-A contributors.
+Anyone is welcome to join. This is an opportunity to discuss any technical
+topic within the community. More details can be found `here`_.
+
+.. _here: https://www.trustedfirmware.org/meetings/tf-a-technical-forum/
+
 Issue Tracker
 ^^^^^^^^^^^^^
 
-Specific issues may be raised using the `issue tracker`_ on the
-TrustedFirmware.org website. Using this tracker makes it easy for the
-maintainers to prioritise and respond to your ticket.
+Bug reports may be filed on the `issue tracker`_ on the TrustedFirmware.org
+website. Using this tracker gives everyone visibility of the known issues in
+TF-A.
 
 Arm Licensees
 ^^^^^^^^^^^^^
@@ -44,4 +53,4 @@
 
 --------------
 
-*Copyright (c) 2019, Arm Limited. All rights reserved.*
+*Copyright (c) 2019-2020, Arm Limited. All rights reserved.*
diff --git a/docs/design/cpu-specific-build-macros.rst b/docs/design/cpu-specific-build-macros.rst
index 6b6c639..33b5090 100644
--- a/docs/design/cpu-specific-build-macros.rst
+++ b/docs/design/cpu-specific-build-macros.rst
@@ -127,6 +127,9 @@
    Earlier revisions of the CPU have other errata which require the same
    workaround in software, so they should be covered anyway.
 
+-  ``ERRATA_A53_1530924``: This applies errata 1530924 workaround to all
+   revisions of Cortex-A53 CPU.
+
 For Cortex-A55, the following errata build flags are defined :
 
 -  ``ERRATA_A55_768277``: This applies errata 768277 workaround to Cortex-A55
@@ -147,6 +150,9 @@
 -  ``ERRATA_A55_1221012``: This applies errata 1221012 workaround to Cortex-A55
    CPU. This needs to be enabled only for revision <= r1p0 of the CPU.
 
+-  ``ERRATA_A55_1530923``: This applies errata 1530923 workaround to all
+   revisions of Cortex-A55 CPU.
+
 For Cortex-A57, the following errata build flags are defined :
 
 -  ``ERRATA_A57_806969``: This applies errata 806969 workaround to Cortex-A57
@@ -182,12 +188,17 @@
 -  ``ERRATA_A57_859972``: This applies errata 859972 workaround to Cortex-A57
    CPU. This needs to be enabled only for revision <= r1p3 of the CPU.
 
+-  ``ERRATA_A57_1319537``: This applies errata 1319537 workaround to all
+   revisions of Cortex-A57 CPU.
 
 For Cortex-A72, the following errata build flags are defined :
 
 -  ``ERRATA_A72_859971``: This applies errata 859971 workaround to Cortex-A72
    CPU. This needs to be enabled only for revision <= r0p3 of the CPU.
 
+-  ``ERRATA_A72_1319367``: This applies errata 1319367 workaround to all
+   revisions of Cortex-A72 CPU.
+
 For Cortex-A73, the following errata build flags are defined :
 
 -  ``ERRATA_A73_852427``: This applies errata 852427 workaround to Cortex-A73
@@ -233,6 +244,11 @@
 -  ``ERRATA_A76_1800710``: This applies errata 1800710 workaround to Cortex-A76
    CPU. This needs to be enabled only for revision <= r4p0 of the CPU.
 
+-  ``ERRATA_A76_1165522``: This applies errata 1165522 workaround to all
+   revisions of Cortex-A76 CPU. This errata is fixed in r3p0 but due to
+   limitation of errata framework this errata is applied to all revisions
+   of Cortex-A76 CPU.
+
 For Cortex-A77, the following errata build flags are defined :
 
 -  ``ERRATA_A77_1800714``: This applies errata 1800714 workaround to Cortex-A77
diff --git a/docs/getting_started/build-options.rst b/docs/getting_started/build-options.rst
index 0acc886..b4fe404 100644
--- a/docs/getting_started/build-options.rst
+++ b/docs/getting_started/build-options.rst
@@ -694,28 +694,36 @@
    default value of this flag is ``no``. Note this option must be enabled only
    for ARM architecture greater than Armv8.5-A.
 
--  ``ERRATA_SPECULATIVE_AT``: This flag enables/disables page table walk during
-   context restore as speculative AT instructions using an out-of-context
-   translation regime could cause subsequent requests to generate an incorrect
-   translation.
-   System registers are not updated during context save, hence this workaround
-   need not be applied in the context save path.
+-  ``ERRATA_SPECULATIVE_AT``: This flag determines whether to enable ``AT``
+   speculative errata workaround or not. It accepts 2 values: ``1`` and ``0``.
+   The default value of this flag is ``0``.
+
+   ``AT`` speculative errata workaround disables stage1 page table walk for
+   lower ELs (EL1 and EL0) in EL3 so that ``AT`` speculative fetch at any point
+   produces either the correct result or failure without TLB allocation.
 
    This boolean option enables errata for all below CPUs.
 
-   +---------+--------------+
-   | Errata  |      CPU     |
-   +=========+==============+
-   | 1165522 |  Cortex-A76  |
-   +---------+--------------+
-   | 1319367 |  Cortex-A72  |
-   +---------+--------------+
-   | 1319537 |  Cortex-A57  |
-   +---------+--------------+
-   | 1530923 |  Cortex-A55  |
-   +---------+--------------+
-   | 1530924 |  Cortex-A53  |
-   +---------+--------------+
+   +---------+--------------+-------------------------+
+   | Errata  |      CPU     |     Workaround Define   |
+   +=========+==============+=========================+
+   | 1165522 |  Cortex-A76  |  ``ERRATA_A76_1165522`` |
+   +---------+--------------+-------------------------+
+   | 1319367 |  Cortex-A72  |  ``ERRATA_A72_1319367`` |
+   +---------+--------------+-------------------------+
+   | 1319537 |  Cortex-A57  |  ``ERRATA_A57_1319537`` |
+   +---------+--------------+-------------------------+
+   | 1530923 |  Cortex-A55  |  ``ERRATA_A55_1530923`` |
+   +---------+--------------+-------------------------+
+   | 1530924 |  Cortex-A53  |  ``ERRATA_A53_1530924`` |
+   +---------+--------------+-------------------------+
+
+   .. note::
+      This option is enabled by build only if platform sets any of above defines
+      mentioned in ’Workaround Define' column in the table.
+      If this option is enabled for the EL3 software then EL2 software also must
+      implement this workaround due to the behaviour of the errata mentioned
+      in new SDEN document which will get published soon.
 
 - ``RAS_TRAP_LOWER_EL_ERR_ACCESS``: This flag enables/disables the SCR_EL3.TERR
   bit, to trap access to the RAS ERR and RAS ERX registers from lower ELs.
@@ -725,6 +733,10 @@
   path on the host machine which is used to build certificate generation and
   firmware encryption tool.
 
+- ``USE_SP804_TIMER``: Use the SP804 timer instead of the Generic Timer for
+  functions that wait for an arbitrary time length (udelay and mdelay). The
+  default value is 0.
+
 GICv3 driver options
 --------------------
 
diff --git a/docs/glossary.rst b/docs/glossary.rst
index e087079..08add3a 100644
--- a/docs/glossary.rst
+++ b/docs/glossary.rst
@@ -18,6 +18,9 @@
    API
       Application Programming Interface
 
+   AT
+      Address Translation
+
    BTI
       Branch Target Identification. An Armv8.5 extension providing additional
       control flow integrity around indirect branches and their targets.
diff --git a/docs/plat/arm/fvp/index.rst b/docs/plat/arm/fvp/index.rst
index 745e31f..e3bf42a 100644
--- a/docs/plat/arm/fvp/index.rst
+++ b/docs/plat/arm/fvp/index.rst
@@ -123,10 +123,6 @@
    -  ``FVP_GICV2`` : The GICv2 only driver is selected
    -  ``FVP_GICV3`` : The GICv3 only driver is selected (default option)
 
--  ``FVP_USE_SP804_TIMER`` : Use the SP804 timer instead of the Generic Timer
-   for functions that wait for an arbitrary time length (udelay and mdelay).
-   The default value is 0.
-
 -  ``FVP_HW_CONFIG_DTS`` : Specify the path to the DTS file to be compiled
    to DTB and packaged in FIP as the HW_CONFIG. See :ref:`Firmware Design` for
    details on HW_CONFIG. By default, this is initialized to a sensible DTS
diff --git a/docs/plat/qemu-sbsa.rst b/docs/plat/qemu-sbsa.rst
index 51fe414..bc82ae5 100644
--- a/docs/plat/qemu-sbsa.rst
+++ b/docs/plat/qemu-sbsa.rst
@@ -19,7 +19,6 @@
 Current limitations:
 
 -  Only cold boot is supported
--  No instructions for how to load a BL32 (Secure Payload)
 
 To build TF-A:
 
@@ -27,9 +26,18 @@
 
     git clone https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git tfa
     cd tfa
-    export CROSS_COMPILE=aarch64-linux-gnu-
+    export CROSS_COMPILE=aarch64-none-elf-
     make PLAT=qemu_sbsa all fip
 
+To build TF-A with BL32 and SPM enabled(StandaloneMM as a Secure Payload):
+
+::
+
+    git clone https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git tfa
+    cd tfa
+    export CROSS_COMPILE=aarch64-none-elf-
+    make PLAT=qemu_sbsa BL32=../STANDALONE_MM.fd SPM_MM=1 EL3_EXCEPTION_HANDLING=1 all fip
+
 Images will be placed at build/qemu_sbsa/release (bl1.bin and fip.bin).
 Need to copy them into top directory for EDK2 compilation.
 
diff --git a/docs/process/contributing.rst b/docs/process/contributing.rst
index 7886cf4..bdfb6d6 100644
--- a/docs/process/contributing.rst
+++ b/docs/process/contributing.rst
@@ -6,15 +6,20 @@
 
 -  Make sure you have a Github account and you are logged on both
    `developer.trustedfirmware.org`_ and `review.trustedfirmware.org`_.
--  Create an `issue`_ for your work if one does not already exist. This gives
-   everyone visibility of whether others are working on something similar.
 
-   -  If you intend to include Third Party IP in your contribution, please
-      raise a separate `issue`_ for this and ensure that the changes that
-      include Third Party IP are made on a separate topic branch.
+-  If you plan to contribute a major piece of work, it is usually a good idea to
+   start a discussion around it on the mailing list. This gives everyone
+   visibility of what is coming up, you might learn that somebody else is
+   already working on something similar or the community might be able to
+   provide some early input to help shaping the design of the feature.
+
+   If you intend to include Third Party IP in your contribution, please mention
+   it explicitly in the email thread and ensure that the changes that include
+   Third Party IP are made in a separate patch (or patch series).
 
 -  Clone `Trusted Firmware-A`_ on your own machine as described in
    :ref:`prerequisites_get_source`.
+
 -  Create a local topic branch based on the `Trusted Firmware-A`_ ``master``
    branch.
 
@@ -23,44 +28,51 @@
 
 -  Make commits of logical units. See these general `Git guidelines`_ for
    contributing to a project.
+
 -  Follow the :ref:`Coding Style` and :ref:`Coding Guidelines`.
 
    -  Use the checkpatch.pl script provided with the Linux source tree. A
       Makefile target is provided for convenience.
 
 -  Keep the commits on topic. If you need to fix another bug or make another
-   enhancement, please create a separate `issue`_ and address it on a separate
-   topic branch.
+   enhancement, please address it on a separate topic branch.
+
 -  Avoid long commit series. If you do have a long series, consider whether
    some commits should be squashed together or addressed in a separate topic.
+
 -  Make sure your commit messages are in the proper format. If a commit fixes
    an `issue`_, include a reference.
--  Where appropriate, please update the documentation.
-
-   -  Consider whether the :ref:`Porting Guide`,
-      :ref:`Firmware Design` document or other in-source documentation needs
-      updating.
-   -  Ensure that each changed file has the correct copyright and license
-      information. Files that entirely consist of contributions to this
-      project should have a copyright notice and BSD-3-Clause SPDX license
-      identifier of the form as shown in :ref:`license`. Files that contain
-      changes to imported Third Party IP files should retain their original
-      copyright and license notices. For significant contributions you may
-      add your own copyright notice in following format:
 
-      ::
+-  Where appropriate, please update the documentation.
 
-          Portions copyright (c) [XXXX-]YYYY, <OWNER>. All rights reserved.
+   -  Consider whether the :ref:`Porting Guide`, :ref:`Firmware Design` document
+      or other in-source documentation needs updating.
 
-      where XXXX is the year of first contribution (if different to YYYY) and
-      YYYY is the year of most recent contribution. <OWNER> is your name or
-      your company name.
    -  If you are submitting new files that you intend to be the code owner for
       (for example, a new platform port), then also update the
       :ref:`code owners` file.
-   -  For topics with multiple commits, you should make all documentation
-      changes (and nothing else) in the last commit of the series. Otherwise,
-      include the documentation changes within the single commit.
+
+   -  For topics with multiple commits, you should make all documentation changes
+      (and nothing else) in the last commit of the series. Otherwise, include
+      the documentation changes within the single commit.
+
+-  Ensure that each changed file has the correct copyright and license
+   information. Files that entirely consist of contributions to this project
+   should have a copyright notice and BSD-3-Clause SPDX license identifier of
+   the form as shown in :ref:`license`. Files that contain changes to imported
+   Third Party IP files should retain their original copyright and license
+   notices.
+
+   For significant contributions you may add your own copyright notice in the
+   following format:
+
+   ::
+
+       Portions copyright (c) [XXXX-]YYYY, <OWNER>. All rights reserved.
+
+   where XXXX is the year of first contribution (if different to YYYY) and YYYY
+   is the year of most recent contribution. <OWNER> is your name or your company
+   name.
 
 -  Please test your changes. As a minimum, ensure that Linux boots on the
    Foundation FVP. See :ref:`Arm Fixed Virtual Platforms (FVP)` for more
diff --git a/docs/process/security.rst b/docs/process/security.rst
index 516eb98..a3b9971 100644
--- a/docs/process/security.rst
+++ b/docs/process/security.rst
@@ -20,13 +20,15 @@
 Although we try to keep TF-A secure, we can only do so with the help of the
 community of developers and security researchers.
 
-If you think you have found a security vulnerability, please **do not** report
-it in the `issue tracker`_. Instead, please follow the `TrustedFirmware.org
-security incident process`_. One of the goals of this process is to ensure
-providers of products that use TF-A have a chance to consider the implications
-of the vulnerability and its remedy before it is made public. As such, please
-follow the disclosure plan outlined in the process. We do our best to respond
-and fix any issues quickly.
+.. warning::
+   If you think you have found a security vulnerability, please **do not**
+   report it in the `issue tracker`_ or on the `mailing list`_. Instead, please
+   follow the `TrustedFirmware.org security incident process`_.
+
+One of the goals of this process is to ensure providers of products that use
+TF-A have a chance to consider the implications of the vulnerability and its
+remedy before it is made public. As such, please follow the disclosure plan
+outlined in the process. We do our best to respond and fix any issues quickly.
 
 Afterwards, we encourage you to write-up your findings about the TF-A source
 code.
@@ -69,6 +71,7 @@
 +-----------+------------------------------------------------------------------+
 
 .. _issue tracker: https://developer.trustedfirmware.org/project/board/1/
+.. _mailing list: https://lists.trustedfirmware.org/mailman/listinfo/tf-a
 
 .. |TFV-1| replace:: :ref:`Advisory TFV-1 (CVE-2016-10319)`
 .. |TFV-2| replace:: :ref:`Advisory TFV-2 (CVE-2017-7564)`
diff --git a/drivers/allwinner/axp/common.c b/drivers/allwinner/axp/common.c
index 13437fe..e98b16f 100644
--- a/drivers/allwinner/axp/common.c
+++ b/drivers/allwinner/axp/common.c
@@ -105,6 +105,25 @@
 	return false;
 }
 
+static bool board_uses_usb0_host_mode(const void *fdt)
+{
+	int node, length;
+	const char *prop;
+
+	node = fdt_node_offset_by_compatible(fdt, -1,
+					     "allwinner,sun8i-a33-musb");
+	if (node < 0) {
+		return false;
+	}
+
+	prop = fdt_getprop(fdt, node, "dr_mode", &length);
+	if (!prop) {
+		return false;
+	}
+
+	return !strncmp(prop, "host", length);
+}
+
 void axp_setup_regulators(const void *fdt)
 {
 	int node;
@@ -121,7 +140,8 @@
 	}
 
 	/* This applies to AXP803 only. */
-	if (fdt_getprop(fdt, node, "x-powers,drive-vbus-en", NULL)) {
+	if (fdt_getprop(fdt, node, "x-powers,drive-vbus-en", NULL) &&
+	    board_uses_usb0_host_mode(fdt)) {
 		axp_clrbits(0x8f, BIT(4));
 		axp_setbits(0x30, BIT(2));
 		INFO("PMIC: Enabling DRIVEVBUS\n");
diff --git a/include/arch/aarch64/arch_helpers.h b/include/arch/aarch64/arch_helpers.h
index 4bff0f6..1f2f4a9 100644
--- a/include/arch/aarch64/arch_helpers.h
+++ b/include/arch/aarch64/arch_helpers.h
@@ -590,4 +590,24 @@
 #define read_clusterpwrdn()	read_clusterpwrdn_el1()
 #define write_clusterpwrdn(_v)	write_clusterpwrdn_el1(_v)
 
+#if ERRATA_SPECULATIVE_AT
+/*
+ * Assuming SCTLR.M bit is already enabled
+ * 1. Enable page table walk by clearing TCR_EL1.EPDx bits
+ * 2. Execute AT instruction for lower EL1/0
+ * 3. Disable page table walk by setting TCR_EL1.EPDx bits
+ */
+#define AT(_at_inst, _va)	\
+{	\
+	assert((read_sctlr_el1() & SCTLR_M_BIT) != 0ULL);	\
+	write_tcr_el1(read_tcr_el1() & ~(TCR_EPD0_BIT | TCR_EPD1_BIT));	\
+	isb();	\
+	_at_inst(_va);	\
+	write_tcr_el1(read_tcr_el1() | (TCR_EPD0_BIT | TCR_EPD1_BIT));	\
+	isb();	\
+}
+#else
+#define AT(_at_inst, _va)	_at_inst(_va);
+#endif
+
 #endif /* ARCH_HELPERS_H */
diff --git a/include/arch/aarch64/el3_common_macros.S b/include/arch/aarch64/el3_common_macros.S
index 0708de6..17a4efa 100644
--- a/include/arch/aarch64/el3_common_macros.S
+++ b/include/arch/aarch64/el3_common_macros.S
@@ -9,6 +9,7 @@
 
 #include <arch.h>
 #include <asm_macros.S>
+#include <context.h>
 #include <lib/xlat_tables/xlat_tables_defs.h>
 
 	/*
@@ -443,4 +444,42 @@
 #endif
 	.endm
 
+	.macro	apply_at_speculative_wa
+#if ERRATA_SPECULATIVE_AT
+	/*
+	 * Explicitly save x30 so as to free up a register and to enable
+	 * branching and also, save x29 which will be used in the called
+	 * function
+	 */
+	stp	x29, x30, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X29]
+	bl	save_and_update_ptw_el1_sys_regs
+	ldp	x29, x30, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X29]
+#endif
+	.endm
+
+	.macro	restore_ptw_el1_sys_regs
+#if ERRATA_SPECULATIVE_AT
+	/* -----------------------------------------------------------
+	 * In case of ERRATA_SPECULATIVE_AT, must follow below order
+	 * to ensure that page table walk is not enabled until
+	 * restoration of all EL1 system registers. TCR_EL1 register
+	 * should be updated at the end which restores previous page
+	 * table walk setting of stage1 i.e.(TCR_EL1.EPDx) bits. ISB
+	 * ensures that CPU does below steps in order.
+	 *
+	 * 1. Ensure all other system registers are written before
+	 *    updating SCTLR_EL1 using ISB.
+	 * 2. Restore SCTLR_EL1 register.
+	 * 3. Ensure SCTLR_EL1 written successfully using ISB.
+	 * 4. Restore TCR_EL1 register.
+	 * -----------------------------------------------------------
+	 */
+	isb
+	ldp	x28, x29, [sp, #CTX_EL1_SYSREGS_OFFSET + CTX_SCTLR_EL1]
+	msr	sctlr_el1, x28
+	isb
+	msr	tcr_el1, x29
+#endif
+	.endm
+
 #endif /* EL3_COMMON_MACROS_S */
diff --git a/include/lib/cpus/aarch64/denver.h b/include/lib/cpus/aarch64/denver.h
index b98abdf..b665bc7 100644
--- a/include/lib/cpus/aarch64/denver.h
+++ b/include/lib/cpus/aarch64/denver.h
@@ -13,6 +13,10 @@
 #define DENVER_MIDR_PN2			U(0x4E0F0020)
 #define DENVER_MIDR_PN3			U(0x4E0F0030)
 #define DENVER_MIDR_PN4			U(0x4E0F0040)
+#define DENVER_MIDR_PN5			U(0x4E0F0050)
+#define DENVER_MIDR_PN6			U(0x4E0F0060)
+#define DENVER_MIDR_PN7			U(0x4E0F0070)
+#define DENVER_MIDR_PN8			U(0x4E0F0080)
 
 /* Implementer code in the MIDR register */
 #define DENVER_IMPL			U(0x4E)
diff --git a/include/lib/el3_runtime/aarch64/context.h b/include/lib/el3_runtime/aarch64/context.h
index 90807ce..3490414 100644
--- a/include/lib/el3_runtime/aarch64/context.h
+++ b/include/lib/el3_runtime/aarch64/context.h
@@ -72,7 +72,7 @@
 #define CTX_SPSR_EL1		U(0x0)
 #define CTX_ELR_EL1		U(0x8)
 #define CTX_SCTLR_EL1		U(0x10)
-#define CTX_ACTLR_EL1		U(0x18)
+#define CTX_TCR_EL1		U(0x18)
 #define CTX_CPACR_EL1		U(0x20)
 #define CTX_CSSELR_EL1		U(0x28)
 #define CTX_SP_EL1		U(0x30)
@@ -81,7 +81,7 @@
 #define CTX_TTBR1_EL1		U(0x48)
 #define CTX_MAIR_EL1		U(0x50)
 #define CTX_AMAIR_EL1		U(0x58)
-#define CTX_TCR_EL1		U(0x60)
+#define CTX_ACTLR_EL1		U(0x60)
 #define CTX_TPIDR_EL1		U(0x68)
 #define CTX_TPIDR_EL0		U(0x70)
 #define CTX_TPIDRRO_EL0		U(0x78)
diff --git a/include/plat/arm/common/fconf_arm_sp_getter.h b/include/plat/arm/common/fconf_arm_sp_getter.h
index 236254b..c6315be 100644
--- a/include/plat/arm/common/fconf_arm_sp_getter.h
+++ b/include/plat/arm/common/fconf_arm_sp_getter.h
@@ -14,11 +14,13 @@
 #define arm__sp_getter(prop)	arm_sp.prop
 
 #define ARM_SP_MAX_SIZE		U(0x80000)
+#define ARM_SP_OWNER_NAME_LEN	U(8)
 
 struct arm_sp_t {
 	unsigned int		number_of_sp;
 	union uuid_helper_t	uuids[MAX_SP_IDS];
 	uintptr_t		load_addr[MAX_SP_IDS];
+	char			owner[MAX_SP_IDS][ARM_SP_OWNER_NAME_LEN];
 };
 
 int fconf_populate_arm_sp(uintptr_t config);
diff --git a/lib/cpus/aarch64/cortex_a53.S b/lib/cpus/aarch64/cortex_a53.S
index b105de2..df11d86 100644
--- a/lib/cpus/aarch64/cortex_a53.S
+++ b/lib/cpus/aarch64/cortex_a53.S
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2019, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2014-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -239,6 +239,20 @@
 	ret
 endfunc check_errata_843419
 
+	/* --------------------------------------------------
+	 * Errata workaround for Cortex A53 Errata #1530924.
+	 * This applies to all revisions of Cortex A53.
+	 * --------------------------------------------------
+	 */
+func check_errata_1530924
+#if ERRATA_A53_1530924
+	mov	x0, #ERRATA_APPLIES
+#else
+	mov	x0, #ERRATA_MISSING
+#endif
+	ret
+endfunc check_errata_1530924
+
 	/* -------------------------------------------------
 	 * The CPU Ops reset function for Cortex-A53.
 	 * Shall clobber: x0-x19
@@ -359,6 +373,7 @@
 	report_errata ERRATA_A53_836870, cortex_a53, disable_non_temporal_hint
 	report_errata ERRATA_A53_843419, cortex_a53, 843419
 	report_errata ERRATA_A53_855873, cortex_a53, 855873
+	report_errata ERRATA_A53_1530924, cortex_a53, 1530924
 
 	ldp	x8, x30, [sp], #16
 	ret
diff --git a/lib/cpus/aarch64/cortex_a55.S b/lib/cpus/aarch64/cortex_a55.S
index 8e13824..7838304 100644
--- a/lib/cpus/aarch64/cortex_a55.S
+++ b/lib/cpus/aarch64/cortex_a55.S
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017-2019, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2017-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -222,6 +222,20 @@
 	b	cpu_rev_var_ls
 endfunc check_errata_1221012
 
+	/* --------------------------------------------------
+	 * Errata workaround for Cortex A55 Errata #1530923.
+	 * This applies to all revisions of Cortex A55.
+	 * --------------------------------------------------
+	 */
+func check_errata_1530923
+#if ERRATA_A55_1530923
+	mov	x0, #ERRATA_APPLIES
+#else
+	mov	x0, #ERRATA_MISSING
+#endif
+	ret
+endfunc check_errata_1530923
+
 func cortex_a55_reset_func
 	mov	x19, x30
 
@@ -306,6 +320,7 @@
 	report_errata ERRATA_A55_846532, cortex_a55, 846532
 	report_errata ERRATA_A55_903758, cortex_a55, 903758
 	report_errata ERRATA_A55_1221012, cortex_a55, 1221012
+	report_errata ERRATA_A55_1530923, cortex_a55, 1530923
 
 	ldp	x8, x30, [sp], #16
 	ret
diff --git a/lib/cpus/aarch64/cortex_a57.S b/lib/cpus/aarch64/cortex_a57.S
index 3fee470..8ef0f92 100644
--- a/lib/cpus/aarch64/cortex_a57.S
+++ b/lib/cpus/aarch64/cortex_a57.S
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2019, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2014-2020, ARM Limited and Contributors. All rights reserved.
  * Copyright (c) 2020, NVIDIA Corporation. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
@@ -396,6 +396,20 @@
 	ret
 endfunc check_errata_cve_2018_3639
 
+	/* --------------------------------------------------
+	 * Errata workaround for Cortex A57 Errata #1319537.
+	 * This applies to all revisions of Cortex A57.
+	 * --------------------------------------------------
+	 */
+func check_errata_1319537
+#if ERRATA_A57_1319537
+	mov	x0, #ERRATA_APPLIES
+#else
+	mov	x0, #ERRATA_MISSING
+#endif
+	ret
+endfunc check_errata_1319537
+
 	/* -------------------------------------------------
 	 * The CPU Ops reset function for Cortex-A57.
 	 * Shall clobber: x0-x19
@@ -613,6 +627,7 @@
 	report_errata ERRATA_A57_829520, cortex_a57, 829520
 	report_errata ERRATA_A57_833471, cortex_a57, 833471
 	report_errata ERRATA_A57_859972, cortex_a57, 859972
+	report_errata ERRATA_A57_1319537, cortex_a57, 1319537
 	report_errata WORKAROUND_CVE_2017_5715, cortex_a57, cve_2017_5715
 	report_errata WORKAROUND_CVE_2018_3639, cortex_a57, cve_2018_3639
 
diff --git a/lib/cpus/aarch64/cortex_a72.S b/lib/cpus/aarch64/cortex_a72.S
index 38b76b9..aff6072 100644
--- a/lib/cpus/aarch64/cortex_a72.S
+++ b/lib/cpus/aarch64/cortex_a72.S
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2018, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -119,6 +119,20 @@
 	ret
 endfunc check_errata_cve_2018_3639
 
+	/* --------------------------------------------------
+	 * Errata workaround for Cortex A72 Errata #1319367.
+	 * This applies to all revisions of Cortex A72.
+	 * --------------------------------------------------
+	 */
+func check_errata_1319367
+#if ERRATA_A72_1319367
+	mov	x0, #ERRATA_APPLIES
+#else
+	mov	x0, #ERRATA_MISSING
+#endif
+	ret
+endfunc check_errata_1319367
+
 	/* -------------------------------------------------
 	 * The CPU Ops reset function for Cortex-A72.
 	 * -------------------------------------------------
@@ -282,6 +296,7 @@
 	 * checking functions of each errata.
 	 */
 	report_errata ERRATA_A72_859971, cortex_a72, 859971
+	report_errata ERRATA_A72_1319367, cortex_a72, 1319367
 	report_errata WORKAROUND_CVE_2017_5715, cortex_a72, cve_2017_5715
 	report_errata WORKAROUND_CVE_2018_3639, cortex_a72, cve_2018_3639
 
diff --git a/lib/cpus/aarch64/cortex_a76.S b/lib/cpus/aarch64/cortex_a76.S
index 10011f7..0895946 100644
--- a/lib/cpus/aarch64/cortex_a76.S
+++ b/lib/cpus/aarch64/cortex_a76.S
@@ -465,6 +465,23 @@
 	ret
 endfunc cortex_a76_disable_wa_cve_2018_3639
 
+	/* --------------------------------------------------------------
+	 * Errata Workaround for Cortex A76 Errata #1165522.
+	 * This applies only to revisions <= r3p0 of Cortex A76.
+	 * Due to the nature of the errata it is applied unconditionally
+	 * when built in, report it as applicable in this case
+	 * --------------------------------------------------------------
+	 */
+func check_errata_1165522
+#if ERRATA_A76_1165522
+	mov	x0, #ERRATA_APPLIES
+	ret
+#else
+	mov	x1, #0x30
+	b	cpu_rev_var_ls
+#endif
+endfunc check_errata_1165522
+
 	/* -------------------------------------------------
 	 * The CPU Ops reset function for Cortex-A76.
 	 * Shall clobber: x0-x19
@@ -597,6 +614,7 @@
 	report_errata ERRATA_A76_1286807, cortex_a76, 1286807
 	report_errata ERRATA_A76_1791580, cortex_a76, 1791580
 	report_errata ERRATA_A76_1800710, cortex_a76, 1800710
+	report_errata ERRATA_A76_1165522, cortex_a76, 1165522
 	report_errata WORKAROUND_CVE_2018_3639, cortex_a76, cve_2018_3639
 	report_errata ERRATA_DSU_798953, cortex_a76, dsu_798953
 	report_errata ERRATA_DSU_936184, cortex_a76, dsu_936184
diff --git a/lib/cpus/aarch64/denver.S b/lib/cpus/aarch64/denver.S
index bdca4c3..d662e7f 100644
--- a/lib/cpus/aarch64/denver.S
+++ b/lib/cpus/aarch64/denver.S
@@ -387,3 +387,31 @@
 	CPU_NO_EXTRA2_FUNC, \
 	denver_core_pwr_dwn, \
 	denver_cluster_pwr_dwn
+
+declare_cpu_ops_wa denver, DENVER_MIDR_PN5, \
+	denver_reset_func, \
+	check_errata_cve_2017_5715, \
+	CPU_NO_EXTRA2_FUNC, \
+	denver_core_pwr_dwn, \
+	denver_cluster_pwr_dwn
+
+declare_cpu_ops_wa denver, DENVER_MIDR_PN6, \
+	denver_reset_func, \
+	check_errata_cve_2017_5715, \
+	CPU_NO_EXTRA2_FUNC, \
+	denver_core_pwr_dwn, \
+	denver_cluster_pwr_dwn
+
+declare_cpu_ops_wa denver, DENVER_MIDR_PN7, \
+	denver_reset_func, \
+	check_errata_cve_2017_5715, \
+	CPU_NO_EXTRA2_FUNC, \
+	denver_core_pwr_dwn, \
+	denver_cluster_pwr_dwn
+
+declare_cpu_ops_wa denver, DENVER_MIDR_PN8, \
+	denver_reset_func, \
+	check_errata_cve_2017_5715, \
+	CPU_NO_EXTRA2_FUNC, \
+	denver_core_pwr_dwn, \
+	denver_cluster_pwr_dwn
diff --git a/lib/cpus/cpu-ops.mk b/lib/cpus/cpu-ops.mk
index e494375..8fc3b60 100644
--- a/lib/cpus/cpu-ops.mk
+++ b/lib/cpus/cpu-ops.mk
@@ -130,6 +130,10 @@
 # of by the rich OS.
 ERRATA_A53_855873	?=0
 
+# Flag to apply erratum 1530924 workaround during reset. This erratum applies
+# to all revisions of Cortex A53 cpu.
+ERRATA_A53_1530924	?=0
+
 # Flag to apply erratum 768277 workaround during reset. This erratum applies
 # only to revision r0p0 of the Cortex A55 cpu.
 ERRATA_A55_768277	?=0
@@ -154,6 +158,10 @@
 # only to revision <= r1p0 of the Cortex A55 cpu.
 ERRATA_A55_1221012	?=0
 
+# Flag to apply erratum 1530923 workaround during reset. This erratum applies
+# to all revisions of Cortex A55 cpu.
+ERRATA_A55_1530923	?=0
+
 # Flag to apply erratum 806969 workaround during reset. This erratum applies
 # only to revision r0p0 of the Cortex A57 cpu.
 ERRATA_A57_806969	?=0
@@ -198,10 +206,18 @@
 # only to revision <= r1p3 of the Cortex A57 cpu.
 ERRATA_A57_859972	?=0
 
+# Flag to apply erratum 1319537 workaround during reset. This erratum applies
+# to all revisions of Cortex A57 cpu.
+ERRATA_A57_1319537	?=0
+
 # Flag to apply erratum 855971 workaround during reset. This erratum applies
 # only to revision <= r0p3 of the Cortex A72 cpu.
 ERRATA_A72_859971	?=0
 
+# Flag to apply erratum 1319367 workaround during reset. This erratum applies
+# to all revisions of Cortex A72 cpu.
+ERRATA_A72_1319367	?=0
+
 # Flag to apply erratum 852427 workaround during reset. This erratum applies
 # only to revision r0p0 of the Cortex A73 cpu.
 ERRATA_A73_852427	?=0
@@ -258,6 +274,10 @@
 # only to revision <= r4p0 of the Cortex A76 cpu.
 ERRATA_A76_1800710	?=0
 
+# Flag to apply erratum 1165522 workaround during reset. This erratum applies
+# to all revisions of Cortex A76 cpu.
+ERRATA_A76_1165522	?=0
+
 # Flag to apply erratum 1800714 workaround during reset. This erratum applies
 # only to revision <= r1p1 of the Cortex A77 cpu.
 ERRATA_A77_1800714	?=0
@@ -379,6 +399,10 @@
 $(eval $(call assert_boolean,ERRATA_A53_855873))
 $(eval $(call add_define,ERRATA_A53_855873))
 
+# Process ERRATA_A53_1530924 flag
+$(eval $(call assert_boolean,ERRATA_A53_1530924))
+$(eval $(call add_define,ERRATA_A53_1530924))
+
 # Process ERRATA_A55_768277 flag
 $(eval $(call assert_boolean,ERRATA_A55_768277))
 $(eval $(call add_define,ERRATA_A55_768277))
@@ -403,6 +427,10 @@
 $(eval $(call assert_boolean,ERRATA_A55_1221012))
 $(eval $(call add_define,ERRATA_A55_1221012))
 
+# Process ERRATA_A55_1530923 flag
+$(eval $(call assert_boolean,ERRATA_A55_1530923))
+$(eval $(call add_define,ERRATA_A55_1530923))
+
 # Process ERRATA_A57_806969 flag
 $(eval $(call assert_boolean,ERRATA_A57_806969))
 $(eval $(call add_define,ERRATA_A57_806969))
@@ -447,10 +475,18 @@
 $(eval $(call assert_boolean,ERRATA_A57_859972))
 $(eval $(call add_define,ERRATA_A57_859972))
 
+# Process ERRATA_A57_1319537 flag
+$(eval $(call assert_boolean,ERRATA_A57_1319537))
+$(eval $(call add_define,ERRATA_A57_1319537))
+
 # Process ERRATA_A72_859971 flag
 $(eval $(call assert_boolean,ERRATA_A72_859971))
 $(eval $(call add_define,ERRATA_A72_859971))
 
+# Process ERRATA_A72_1319367 flag
+$(eval $(call assert_boolean,ERRATA_A72_1319367))
+$(eval $(call add_define,ERRATA_A72_1319367))
+
 # Process ERRATA_A73_852427 flag
 $(eval $(call assert_boolean,ERRATA_A73_852427))
 $(eval $(call add_define,ERRATA_A73_852427))
@@ -507,6 +543,10 @@
 $(eval $(call assert_boolean,ERRATA_A76_1800710))
 $(eval $(call add_define,ERRATA_A76_1800710))
 
+# Process ERRATA_A76_1165522 flag
+$(eval $(call assert_boolean,ERRATA_A76_1165522))
+$(eval $(call add_define,ERRATA_A76_1165522))
+
 # Process ERRATA_A77_1800714 flag
 $(eval $(call assert_boolean,ERRATA_A77_1800714))
 $(eval $(call add_define,ERRATA_A77_1800714))
@@ -580,3 +620,10 @@
 TF_CFLAGS_aarch64	+= -mfix-cortex-a53-835769
 TF_LDFLAGS_aarch64	+= --fix-cortex-a53-835769
 endif
+
+ifneq ($(filter 1,${ERRATA_A53_1530924} ${ERRATA_A55_1530923}	\
+	${ERRATA_A57_1319537} ${ERRATA_A72_1319367} ${ERRATA_A76_1165522}),)
+ERRATA_SPECULATIVE_AT	:= 1
+else
+ERRATA_SPECULATIVE_AT	:= 0
+endif
diff --git a/lib/el3_runtime/aarch64/context.S b/lib/el3_runtime/aarch64/context.S
index 1568ef0..1cb527d 100644
--- a/lib/el3_runtime/aarch64/context.S
+++ b/lib/el3_runtime/aarch64/context.S
@@ -8,6 +8,7 @@
 #include <asm_macros.S>
 #include <assert_macros.S>
 #include <context.h>
+#include <el3_common_macros.S>
 
 #if CTX_INCLUDE_EL2_REGS
 	.global	el2_sysregs_context_save
@@ -22,6 +23,7 @@
 #endif
 	.global	save_gp_pmcr_pauth_regs
 	.global	restore_gp_pmcr_pauth_regs
+	.global save_and_update_ptw_el1_sys_regs
 	.global	el3_exit
 
 #if CTX_INCLUDE_EL2_REGS
@@ -233,21 +235,6 @@
  */
 func el2_sysregs_context_restore
 
-#if ERRATA_SPECULATIVE_AT
-/* Clear EPD0 and EPD1 bit and M bit to disable PTW */
-	mrs	x9, hcr_el2
-	tst	x9, #HCR_E2H_BIT
-	bne	1f
-	mrs	x9, tcr_el2
-	orr	x9, x9, #TCR_EPD0_BIT
-	orr	x9, x9, #TCR_EPD1_BIT
-	msr	tcr_el2, x9
-1:	mrs	x9, sctlr_el2
-	bic	x9, x9, #SCTLR_M_BIT
-	msr	sctlr_el2, x9
-	isb
-#endif
-
 	ldp	x9, x10, [x0, #CTX_ACTLR_EL2]
 	msr	actlr_el2, x9
 	msr	afsr0_el2, x10
@@ -296,136 +283,127 @@
 	msr	mdcr_el2, x15
 	msr	PMSCR_EL2, x16
 
-	ldp	x17, x9, [x0, #CTX_SPSR_EL2]
-	msr	spsr_el2, x17
-	msr	sp_el2, x9
+	ldp	x17, x9, [x0, #CTX_SCTLR_EL2]
+	msr	sctlr_el2, x17
+	msr	spsr_el2, x9
 
-	ldp	x10, x11, [x0, #CTX_TPIDR_EL2]
-	msr	tpidr_el2, x10
-	msr	ttbr0_el2, x11
+	ldp	x10, x11, [x0, #CTX_SP_EL2]
+	msr	sp_el2, x10
+	msr	tcr_el2, x11
 
-	ldp	x12, x13, [x0, #CTX_VBAR_EL2]
-	msr	vbar_el2, x12
-	msr	vmpidr_el2, x13
+	ldp	x12, x13, [x0, #CTX_TPIDR_EL2]
+	msr	tpidr_el2, x12
+	msr	ttbr0_el2, x13
 
-	ldp	x14, x15, [x0, #CTX_VPIDR_EL2]
-	msr	vpidr_el2, x14
-	msr	vtcr_el2, x15
+	ldp	x13, x14, [x0, #CTX_VBAR_EL2]
+	msr	vbar_el2, x13
+	msr	vmpidr_el2, x14
 
-	ldr	x16, [x0, #CTX_VTTBR_EL2]
-	msr	vttbr_el2, x16
+	ldp	x15, x16, [x0, #CTX_VPIDR_EL2]
+	msr	vpidr_el2, x15
+	msr	vtcr_el2, x16
+
+	ldr	x17, [x0, #CTX_VTTBR_EL2]
+	msr	vttbr_el2, x17
 
 #if CTX_INCLUDE_MTE_REGS
-	ldr	x17, [x0, #CTX_TFSR_EL2]
-	msr	TFSR_EL2, x17
+	ldr	x9, [x0, #CTX_TFSR_EL2]
+	msr	TFSR_EL2, x9
 #endif
 
 #if ENABLE_MPAM_FOR_LOWER_ELS
-	ldp	x9, x10, [x0, #CTX_MPAM2_EL2]
-	msr	MPAM2_EL2, x9
-	msr	MPAMHCR_EL2, x10
+	ldp	x10, x11, [x0, #CTX_MPAM2_EL2]
+	msr	MPAM2_EL2, x10
+	msr	MPAMHCR_EL2, x11
 
-	ldp	x11, x12, [x0, #CTX_MPAMVPM0_EL2]
-	msr	MPAMVPM0_EL2, x11
-	msr	MPAMVPM1_EL2, x12
+	ldp	x12, x13, [x0, #CTX_MPAMVPM0_EL2]
+	msr	MPAMVPM0_EL2, x12
+	msr	MPAMVPM1_EL2, x13
 
-	ldp	x13, x14, [x0, #CTX_MPAMVPM2_EL2]
-	msr	MPAMVPM2_EL2, x13
-	msr	MPAMVPM3_EL2, x14
+	ldp	x14, x15, [x0, #CTX_MPAMVPM2_EL2]
+	msr	MPAMVPM2_EL2, x14
+	msr	MPAMVPM3_EL2, x15
 
-	ldp	x15, x16, [x0, #CTX_MPAMVPM4_EL2]
-	msr	MPAMVPM4_EL2, x15
-	msr	MPAMVPM5_EL2, x16
+	ldp	x16, x17, [x0, #CTX_MPAMVPM4_EL2]
+	msr	MPAMVPM4_EL2, x16
+	msr	MPAMVPM5_EL2, x17
 
-	ldp	x17, x9, [x0, #CTX_MPAMVPM6_EL2]
-	msr	MPAMVPM6_EL2, x17
-	msr	MPAMVPM7_EL2, x9
+	ldp	x9, x10, [x0, #CTX_MPAMVPM6_EL2]
+	msr	MPAMVPM6_EL2, x9
+	msr	MPAMVPM7_EL2, x10
 
-	ldr	x10, [x0, #CTX_MPAMVPMV_EL2]
-	msr	MPAMVPMV_EL2, x10
+	ldr	x11, [x0, #CTX_MPAMVPMV_EL2]
+	msr	MPAMVPMV_EL2, x11
 #endif
 
 #if ARM_ARCH_AT_LEAST(8, 6)
-	ldp	x11, x12, [x0, #CTX_HAFGRTR_EL2]
-	msr	HAFGRTR_EL2, x11
-	msr	HDFGRTR_EL2, x12
+	ldp	x12, x13, [x0, #CTX_HAFGRTR_EL2]
+	msr	HAFGRTR_EL2, x12
+	msr	HDFGRTR_EL2, x13
 
-	ldp	x13, x14, [x0, #CTX_HDFGWTR_EL2]
-	msr	HDFGWTR_EL2, x13
-	msr	HFGITR_EL2, x14
+	ldp	x14, x15, [x0, #CTX_HDFGWTR_EL2]
+	msr	HDFGWTR_EL2, x14
+	msr	HFGITR_EL2, x15
 
-	ldp	x15, x16, [x0, #CTX_HFGRTR_EL2]
-	msr	HFGRTR_EL2, x15
-	msr	HFGWTR_EL2, x16
+	ldp	x16, x17, [x0, #CTX_HFGRTR_EL2]
+	msr	HFGRTR_EL2, x16
+	msr	HFGWTR_EL2, x17
 
-	ldr	x17, [x0, #CTX_CNTPOFF_EL2]
-	msr	CNTPOFF_EL2, x17
+	ldr	x9, [x0, #CTX_CNTPOFF_EL2]
+	msr	CNTPOFF_EL2, x9
 #endif
 
 #if ARM_ARCH_AT_LEAST(8, 4)
-	ldp	x9, x10, [x0, #CTX_CNTHPS_CTL_EL2]
-	msr	cnthps_ctl_el2, x9
-	msr	cnthps_cval_el2, x10
+	ldp	x10, x11, [x0, #CTX_CNTHPS_CTL_EL2]
+	msr	cnthps_ctl_el2, x10
+	msr	cnthps_cval_el2, x11
 
-	ldp	x11, x12, [x0, #CTX_CNTHPS_TVAL_EL2]
-	msr	cnthps_tval_el2, x11
-	msr	cnthvs_ctl_el2, x12
+	ldp	x12, x13, [x0, #CTX_CNTHPS_TVAL_EL2]
+	msr	cnthps_tval_el2, x12
+	msr	cnthvs_ctl_el2, x13
 
-	ldp	x13, x14, [x0, #CTX_CNTHVS_CVAL_EL2]
-	msr	cnthvs_cval_el2, x13
-	msr	cnthvs_tval_el2, x14
+	ldp	x14, x15, [x0, #CTX_CNTHVS_CVAL_EL2]
+	msr	cnthvs_cval_el2, x14
+	msr	cnthvs_tval_el2, x15
 
-	ldp	x15, x16, [x0, #CTX_CNTHV_CTL_EL2]
-	msr	cnthv_ctl_el2, x15
-	msr	cnthv_cval_el2, x16
+	ldp	x16, x17, [x0, #CTX_CNTHV_CTL_EL2]
+	msr	cnthv_ctl_el2, x16
+	msr	cnthv_cval_el2, x17
 
-	ldp	x17, x9, [x0, #CTX_CNTHV_TVAL_EL2]
-	msr	cnthv_tval_el2, x17
-	msr	contextidr_el2, x9
+	ldp	x9, x10, [x0, #CTX_CNTHV_TVAL_EL2]
+	msr	cnthv_tval_el2, x9
+	msr	contextidr_el2, x10
 
-	ldr	x10, [x0, #CTX_SDER32_EL2]
-	msr	sder32_el2, x10
+	ldr	x11, [x0, #CTX_SDER32_EL2]
+	msr	sder32_el2, x11
 
-	ldr	x11, [x0, #CTX_TTBR1_EL2]
-	msr	ttbr1_el2, x11
+	ldr	x12, [x0, #CTX_TTBR1_EL2]
+	msr	ttbr1_el2, x12
 
-	ldr	x12, [x0, #CTX_VDISR_EL2]
-	msr	vdisr_el2, x12
+	ldr	x13, [x0, #CTX_VDISR_EL2]
+	msr	vdisr_el2, x13
 
-	ldr	x13, [x0, #CTX_VNCR_EL2]
-	msr	vncr_el2, x13
+	ldr	x14, [x0, #CTX_VNCR_EL2]
+	msr	vncr_el2, x14
 
-	ldr	x14, [x0, #CTX_VSESR_EL2]
-	msr	vsesr_el2, x14
+	ldr	x15, [x0, #CTX_VSESR_EL2]
+	msr	vsesr_el2, x15
 
-	ldr	x15, [x0, #CTX_VSTCR_EL2]
-	msr	vstcr_el2, x15
+	ldr	x16, [x0, #CTX_VSTCR_EL2]
+	msr	vstcr_el2, x16
 
-	ldr	x16, [x0, #CTX_VSTTBR_EL2]
-	msr	vsttbr_el2, x16
+	ldr	x17, [x0, #CTX_VSTTBR_EL2]
+	msr	vsttbr_el2, x17
 
-	ldr	x17, [x0, #CTX_TRFCR_EL2]
-	msr	TRFCR_EL2, x17
+	ldr	x9, [x0, #CTX_TRFCR_EL2]
+	msr	TRFCR_EL2, x9
 #endif
 
 #if ARM_ARCH_AT_LEAST(8, 5)
-	ldr	x9, [x0, #CTX_SCXTNUM_EL2]
-	msr	scxtnum_el2, x9
+	ldr	x10, [x0, #CTX_SCXTNUM_EL2]
+	msr	scxtnum_el2, x10
 #endif
 
-#if ERRATA_SPECULATIVE_AT
-/*
- * Make sure all registers are stored successfully except
- * SCTLR_EL2 and TCR_EL2
- */
-	isb
-#endif
-
-	ldr	x9, [x0, #CTX_SCTLR_EL2]
-	msr	sctlr_el2, x9
-	ldr	x9, [x0, #CTX_TCR_EL2]
-	msr	tcr_el2, x9
-
 	ret
 endfunc el2_sysregs_context_restore
 
@@ -444,9 +422,11 @@
 	mrs	x10, elr_el1
 	stp	x9, x10, [x0, #CTX_SPSR_EL1]
 
+#if !ERRATA_SPECULATIVE_AT
 	mrs	x15, sctlr_el1
-	mrs	x16, actlr_el1
+	mrs	x16, tcr_el1
 	stp	x15, x16, [x0, #CTX_SCTLR_EL1]
+#endif
 
 	mrs	x17, cpacr_el1
 	mrs	x9, csselr_el1
@@ -464,9 +444,9 @@
 	mrs	x15, amair_el1
 	stp	x14, x15, [x0, #CTX_MAIR_EL1]
 
-	mrs	x16, tcr_el1
+	mrs	x16, actlr_el1
 	mrs	x17, tpidr_el1
-	stp	x16, x17, [x0, #CTX_TCR_EL1]
+	stp	x16, x17, [x0, #CTX_ACTLR_EL1]
 
 	mrs	x9, tpidr_el0
 	mrs	x10, tpidrro_el0
@@ -537,23 +517,15 @@
  */
 func el1_sysregs_context_restore
 
-#if ERRATA_SPECULATIVE_AT
-	mrs	x9, tcr_el1
-	orr	x9, x9, #TCR_EPD0_BIT
-	orr	x9, x9, #TCR_EPD1_BIT
-	msr	tcr_el1, x9
-	mrs	x9, sctlr_el1
-	bic	x9, x9, #SCTLR_M_BIT
-	msr	sctlr_el1, x9
-	isb
-#endif
-
 	ldp	x9, x10, [x0, #CTX_SPSR_EL1]
 	msr	spsr_el1, x9
 	msr	elr_el1, x10
 
-	ldr	x16, [x0, #CTX_ACTLR_EL1]
-	msr	actlr_el1, x16
+#if !ERRATA_SPECULATIVE_AT
+	ldp	x15, x16, [x0, #CTX_SCTLR_EL1]
+	msr	sctlr_el1, x15
+	msr	tcr_el1, x16
+#endif
 
 	ldp	x17, x9, [x0, #CTX_CPACR_EL1]
 	msr	cpacr_el1, x17
@@ -571,8 +543,9 @@
 	msr	mair_el1, x14
 	msr	amair_el1, x15
 
-	ldr	x16,[x0, #CTX_TPIDR_EL1]
-	msr	tpidr_el1, x16
+	ldp 	x16, x17, [x0, #CTX_ACTLR_EL1]
+	msr	actlr_el1, x16
+	msr	tpidr_el1, x17
 
 	ldp	x9, x10, [x0, #CTX_TPIDR_EL0]
 	msr	tpidr_el0, x9
@@ -628,19 +601,6 @@
 	msr	GCR_EL1, x14
 #endif
 
-#if ERRATA_SPECULATIVE_AT
-/*
- * Make sure all registers are stored successfully except
- * SCTLR_EL1 and TCR_EL1
- */
-	isb
-#endif
-
-	ldr	x9, [x0, #CTX_SCTLR_EL1]
-	msr	sctlr_el1, x9
-	ldr	x9, [x0, #CTX_TCR_EL1]
-	msr	tcr_el1, x9
-
 	/* No explict ISB required here as ERET covers it */
 	ret
 endfunc el1_sysregs_context_restore
@@ -905,6 +865,48 @@
 	ret
 endfunc restore_gp_pmcr_pauth_regs
 
+/*
+ * In case of ERRATA_SPECULATIVE_AT, save SCTLR_EL1 and TCR_EL1
+ * registers and update EL1 registers to disable stage1 and stage2
+ * page table walk
+ */
+func save_and_update_ptw_el1_sys_regs
+	/* ----------------------------------------------------------
+	 * Save only sctlr_el1 and tcr_el1 registers
+	 * ----------------------------------------------------------
+	 */
+	mrs	x29, sctlr_el1
+	str	x29, [sp, #(CTX_EL1_SYSREGS_OFFSET + CTX_SCTLR_EL1)]
+	mrs	x29, tcr_el1
+	str	x29, [sp, #(CTX_EL1_SYSREGS_OFFSET + CTX_TCR_EL1)]
+
+	/* ------------------------------------------------------------
+	 * Must follow below order in order to disable page table
+	 * walk for lower ELs (EL1 and EL0). First step ensures that
+	 * page table walk is disabled for stage1 and second step
+	 * ensures that page table walker should use TCR_EL1.EPDx
+	 * bits to perform address translation. ISB ensures that CPU
+	 * does these 2 steps in order.
+	 *
+	 * 1. Update TCR_EL1.EPDx bits to disable page table walk by
+	 *    stage1.
+	 * 2. Enable MMU bit to avoid identity mapping via stage2
+	 *    and force TCR_EL1.EPDx to be used by the page table
+	 *    walker.
+	 * ------------------------------------------------------------
+	 */
+	orr	x29, x29, #(TCR_EPD0_BIT)
+	orr	x29, x29, #(TCR_EPD1_BIT)
+	msr	tcr_el1, x29
+	isb
+	mrs	x29, sctlr_el1
+	orr	x29, x29, #SCTLR_M_BIT
+	msr	sctlr_el1, x29
+	isb
+
+	ret
+endfunc save_and_update_ptw_el1_sys_regs
+
 /* ------------------------------------------------------------------
  * This routine assumes that the SP_EL3 is pointing to a valid
  * context structure from where the gp regs and other special
@@ -949,6 +951,8 @@
 	blr	x17
 1:
 #endif
+	restore_ptw_el1_sys_regs
+
 	/* ----------------------------------------------------------
 	 * Restore general purpose (including x30), PMCR_EL0 and
 	 * ARMv8.3-PAuth registers.
diff --git a/lib/el3_runtime/aarch64/context_mgmt.c b/lib/el3_runtime/aarch64/context_mgmt.c
index f4a34bf..e5434eb 100644
--- a/lib/el3_runtime/aarch64/context_mgmt.c
+++ b/lib/el3_runtime/aarch64/context_mgmt.c
@@ -585,7 +585,7 @@
 	 * S-EL2 context if S-EL2 is enabled.
 	 */
 	if ((security_state == NON_SECURE) ||
-	    ((scr_el3 & SCR_EEL2_BIT) != 0U)) {
+	    ((security_state == SECURE) && ((scr_el3 & SCR_EEL2_BIT) != 0U))) {
 		cpu_context_t *ctx;
 
 		ctx = cm_get_context(security_state);
@@ -607,7 +607,7 @@
 	 * S-EL2 context if S-EL2 is enabled.
 	 */
 	if ((security_state == NON_SECURE) ||
-	    ((scr_el3 & SCR_EEL2_BIT) != 0U)) {
+	    ((security_state == SECURE) && ((scr_el3 & SCR_EEL2_BIT) != 0U))) {
 		cpu_context_t *ctx;
 
 		ctx = cm_get_context(security_state);
diff --git a/lib/libc/aarch32/memset.S b/lib/libc/aarch32/memset.S
new file mode 100644
index 0000000..0b69897
--- /dev/null
+++ b/lib/libc/aarch32/memset.S
@@ -0,0 +1,74 @@
+/*
+ * Copyright (c) 2020, Arm Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <asm_macros.S>
+
+	.syntax unified
+	.global	memset
+
+/* -----------------------------------------------------------------------
+ * void memset(void *dst, int val, size_t count)
+ *
+ * Copy the value of 'val' (converted to an unsigned char) into
+ * each of the first 'count' characters of the object pointed to by 'dst'.
+ *
+ * Returns the value of 'dst'.
+ * -----------------------------------------------------------------------
+ */
+func memset
+	cmp	r2, #0
+	bxeq	lr			/* return if 'count' = 0 */
+	mov	r12, r0			/* keep r0 */
+	tst	r0, #3
+	beq	aligned			/* 4-bytes aligned */
+
+	/* Unaligned 'dst' */
+unaligned:
+	strb	r1, [r12], #1
+	subs	r2, r2, #1
+	bxeq	lr			/* return if 0 */
+	tst	r12, #3
+	bne	unaligned		/* continue while unaligned */
+
+	/* 4-bytes aligned */
+aligned:bfi	r1, r1, #8, #8		/* propagate 'val' */
+	bfi	r1, r1, #16, #16
+
+	mov	r3, r1
+
+	cmp	r2, #16
+	blo	less_16
+
+	push	{r4, lr}
+	mov	r4, r1
+	mov	lr, r1
+
+	cmp	r2, #32
+	blo	less_32
+
+write_32:
+	stmia	r12!, {r1, r3, r4, lr}	/* write 32 bytes in a loop */
+	stmia	r12!, {r1, r3, r4, lr}
+	subs	r2, r2, #32
+	popeq	{r4, pc}		/* return if 0 */
+	cmp	r2, #32
+	bhs	write_32
+
+less_32:cmp	r2, #16
+	stmiahs	r12!, {r1, r3, r4, lr}	/* write 16 bytes */
+	popeq	{r4, pc}		/* return if 16 */
+	pop	{r4, lr}
+
+less_16:lsls	r2, r2, #29		/* C = r2[3]; N = r2[2]; Z = r2[2:0] */
+	stmiacs	r12!, {r1, r3}		/* write 8 bytes */
+	bxeq	lr			/* return if 8 */
+	strmi	r1, [r12], #4		/* write 4 bytes */
+	lsls	r2, r2, #1		/* N = r2[1]; Z = r2[0] */
+	strhmi	r1, [r12], #2		/* write 2 bytes */
+	strbne	r1, [r12]		/* write 1 byte */
+	bx	lr
+
+endfunc memset
diff --git a/lib/libc/aarch64/memset.S b/lib/libc/aarch64/memset.S
new file mode 100644
index 0000000..8c65760
--- /dev/null
+++ b/lib/libc/aarch64/memset.S
@@ -0,0 +1,79 @@
+/*
+ * Copyright (c) 2020, Arm Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <asm_macros.S>
+
+	.global	memset
+
+/* -----------------------------------------------------------------------
+ * void memset(void *dst, int val, size_t count)
+ *
+ * Copy the value of 'val' (converted to an unsigned char) into
+ * each of the first 'count' characters of the object pointed to by 'dst'.
+ *
+ * Returns the value of 'dst'.
+ * -----------------------------------------------------------------------
+ */
+func memset
+	cbz	w2, exit		/* exit if 'count' = 0 */
+	mov	x3, x0			/* keep x0 */
+	tst	x0, #7
+	b.eq	aligned			/* 8-bytes aligned */
+
+	/* Unaligned 'dst' */
+unaligned:
+	strb	w1, [x3], #1
+	subs	w2, w2, #1
+	b.eq	exit			/* exit if 0 */
+	tst	x3, #7
+	b.ne	unaligned		/* continue while unaligned */
+
+	/* 8-bytes aligned */
+aligned:cbz	x1, x1_zero
+	bfi	w1, w1, #8, #8		/* propagate 'val' */
+	bfi	w1, w1, #16, #16
+	bfi	x1, x1, #32, #32
+
+x1_zero:ands	w4, w2, #~0x3f
+	b.eq	less_64
+
+write_64:
+	.rept	4
+	stp	x1, x1, [x3], #16	/* write 64 bytes in a loop */
+	.endr
+	subs	w4, w4, #64
+	b.ne	write_64
+	ands	w2, w2, #0x3f
+	b.eq	exit			/* exit if 0 */
+
+less_64:tbz	w2, #5, less_32		/* < 32 bytes */
+	stp	x1, x1, [x3], #16	/* write 32 bytes */
+	stp	x1, x1, [x3], #16
+	ands	w2, w2, #0x1f
+	b.eq	exit
+
+less_32:tbz	w2, #4, less_16		/* < 16 bytes */
+	stp	x1, x1, [x3], #16	/* write 16 bytes */
+	ands	w2, w2, #0xf
+	b.eq	exit
+
+less_16:tbz	w2, #3, less_8		/* < 8 bytes */
+	str	x1, [x3], #8		/* write 8 bytes */
+	ands	w2, w2, #7
+	b.eq	exit
+
+less_8:	tbz	w2, #2, less_4		/* < 4 bytes */
+	str	w1, [x3], #4		/* write 4 bytes */
+	ands	w2, w2, #3
+	b.eq	exit
+
+less_4:	tbz	w2, #1, less_2		/* < 2 bytes */
+	strh	w1, [x3], #2		/* write 2 bytes */
+	tbz	w2, #0, exit
+less_2:	strb	w1, [x3]		/* write 1 byte */
+exit:	ret
+
+endfunc	memset
diff --git a/lib/libc/libc.mk b/lib/libc/libc.mk
index 93d30d0..90a2a1e 100644
--- a/lib/libc/libc.mk
+++ b/lib/libc/libc.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2016-2019, ARM Limited and Contributors. All rights reserved.
+# Copyright (c) 2016-2020, ARM Limited and Contributors. All rights reserved.
 #
 # SPDX-License-Identifier: BSD-3-Clause
 #
@@ -13,7 +13,6 @@
 			memcpy.c			\
 			memmove.c			\
 			memrchr.c			\
-			memset.c			\
 			printf.c			\
 			putchar.c			\
 			puts.c				\
@@ -28,8 +27,14 @@
 
 ifeq (${ARCH},aarch64)
 LIBC_SRCS	+=	$(addprefix lib/libc/aarch64/,	\
+			memset.S			\
 			setjmp.S)
 endif
 
+ifeq (${ARCH},aarch32)
+LIBC_SRCS	+=	$(addprefix lib/libc/aarch32/,	\
+			memset.S)
+endif
+
 INCLUDES	+=	-Iinclude/lib/libc		\
 			-Iinclude/lib/libc/$(ARCH)	\
diff --git a/lib/libc/memset.c b/lib/libc/memset.c
deleted file mode 100644
index d8007d8..0000000
--- a/lib/libc/memset.c
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * Copyright (c) 2013-2019, ARM Limited and Contributors. All rights reserved.
- *
- * SPDX-License-Identifier: BSD-3-Clause
- */
-
-#include <stddef.h>
-#include <string.h>
-
-void *memset(void *dst, int val, size_t count)
-{
-	char *ptr = dst;
-
-	while (count--)
-		*ptr++ = val;
-
-	return dst;
-}
diff --git a/make_helpers/defaults.mk b/make_helpers/defaults.mk
index caf5990..27f8f2a 100644
--- a/make_helpers/defaults.mk
+++ b/make_helpers/defaults.mk
@@ -311,3 +311,6 @@
 
 # Build option to provide openssl directory path
 OPENSSL_DIR			:= /usr
+
+# Build option to use the SP804 timer instead of the generic one
+USE_SP804_TIMER			:= 0
diff --git a/plat/allwinner/common/allwinner-common.mk b/plat/allwinner/common/allwinner-common.mk
index e60ebc6..997aaa6 100644
--- a/plat/allwinner/common/allwinner-common.mk
+++ b/plat/allwinner/common/allwinner-common.mk
@@ -5,6 +5,8 @@
 #
 
 include lib/xlat_tables_v2/xlat_tables.mk
+include lib/libfdt/libfdt.mk
+include drivers/arm/gic/v2/gicv2.mk
 
 AW_PLAT			:=	plat/allwinner
 
@@ -12,8 +14,6 @@
 				-I${AW_PLAT}/common/include		\
 				-I${AW_PLAT}/${PLAT}/include
 
-include lib/libfdt/libfdt.mk
-
 PLAT_BL_COMMON_SOURCES	:=	drivers/ti/uart/${ARCH}/16550_console.S	\
 				${XLAT_TABLES_LIB_SRCS}			\
 				${AW_PLAT}/common/plat_helpers.S	\
@@ -22,9 +22,7 @@
 BL31_SOURCES		+=	drivers/allwinner/axp/common.c		\
 				drivers/allwinner/sunxi_msgbox.c	\
 				drivers/arm/css/scpi/css_scpi.c		\
-				drivers/arm/gic/common/gic_common.c	\
-				drivers/arm/gic/v2/gicv2_helpers.c	\
-				drivers/arm/gic/v2/gicv2_main.c		\
+				${GICV2_SOURCES}			\
 				drivers/delay_timer/delay_timer.c	\
 				drivers/delay_timer/generic_delay_timer.c \
 				lib/cpus/${ARCH}/cortex_a53.S		\
diff --git a/plat/arm/board/fvp/fdts/fvp_spmc_manifest.dts b/plat/arm/board/fvp/fdts/fvp_spmc_manifest.dts
index a1c9094..90fb347 100644
--- a/plat/arm/board/fvp/fdts/fvp_spmc_manifest.dts
+++ b/plat/arm/board/fvp/fdts/fvp_spmc_manifest.dts
@@ -38,6 +38,13 @@
 			vcpu_count = <2>;
 			mem_size = <1048576>;
 		};
+		vm3 {
+			is_ffa_partition;
+			debug_name = "cactus-tertiary";
+			load_address = <0x7200000>;
+			vcpu_count = <2>;
+			mem_size = <1048576>;
+		};
 	};
 
 	cpus {
diff --git a/plat/arm/board/fvp/fdts/fvp_tb_fw_config.dts b/plat/arm/board/fvp/fdts/fvp_tb_fw_config.dts
index 280a64a..692f5a9 100644
--- a/plat/arm/board/fvp/fdts/fvp_tb_fw_config.dts
+++ b/plat/arm/board/fvp/fdts/fvp_tb_fw_config.dts
@@ -84,11 +84,18 @@
 		cactus-primary {
 			uuid = <0x1e67b5b4 0xe14f904a 0x13fb1fb8 0xcbdae1da>;
 			load-address = <0x7000000>;
+			owner = "SiP";
 		};
 
 		cactus-secondary {
 			uuid = <0x092358d1 0xb94723f0 0x64447c82 0xc88f57f5>;
 			load-address = <0x7100000>;
+			owner = "Plat";
+		};
+
+		cactus-tertiary {
+			uuid = <0x735cb579 0xb9448c1d 0xe1619385 0xd2d80a77>;
+			load-address = <0x7200000>;
 		};
 #endif
 	};
diff --git a/plat/arm/board/fvp/fvp_common.c b/plat/arm/board/fvp/fvp_common.c
index cb717e0..6e479ac 100644
--- a/plat/arm/board/fvp/fvp_common.c
+++ b/plat/arm/board/fvp/fvp_common.c
@@ -13,16 +13,18 @@
 #include <drivers/arm/sp804_delay_timer.h>
 #include <drivers/generic_delay_timer.h>
 #include <lib/mmio.h>
+#include <lib/smccc.h>
 #include <lib/xlat_tables/xlat_tables_compat.h>
-#include <plat/arm/common/arm_config.h>
-#include <plat/arm/common/plat_arm.h>
-#include <plat/common/platform.h>
 #include <platform_def.h>
-
+#include <services/arm_arch_svc.h>
 #if SPM_MM
 #include <services/spm_mm_partition.h>
 #endif
 
+#include <plat/arm/common/arm_config.h>
+#include <plat/arm/common/plat_arm.h>
+#include <plat/common/platform.h>
+
 #include "fvp_private.h"
 
 /* Defines for GIC Driver build time selection */
@@ -420,7 +422,7 @@
 
 void fvp_timer_init(void)
 {
-#if FVP_USE_SP804_TIMER
+#if USE_SP804_TIMER
 	/* Enable the clock override for SP804 timer 0, which means that no
 	 * clock dividers are applied and the raw (35MHz) clock will be used.
 	 */
@@ -435,5 +437,42 @@
 	/* Enable System level generic timer */
 	mmio_write_32(ARM_SYS_CNTCTL_BASE + CNTCR_OFF,
 			CNTCR_FCREQ(0U) | CNTCR_EN);
-#endif /* FVP_USE_SP804_TIMER */
+#endif /* USE_SP804_TIMER */
+}
+
+/*****************************************************************************
+ * plat_is_smccc_feature_available() - This function checks whether SMCCC
+ *                                     feature is availabile for platform.
+ * @fid: SMCCC function id
+ *
+ * Return SMC_ARCH_CALL_SUCCESS if SMCCC feature is available and
+ * SMC_ARCH_CALL_NOT_SUPPORTED otherwise.
+ *****************************************************************************/
+int32_t plat_is_smccc_feature_available(u_register_t fid)
+{
+	switch (fid) {
+	case SMCCC_ARCH_SOC_ID:
+		return SMC_ARCH_CALL_SUCCESS;
+	default:
+		return SMC_ARCH_CALL_NOT_SUPPORTED;
+	}
+}
+
+/* Get SOC version */
+int32_t plat_get_soc_version(void)
+{
+	return (int32_t)
+		((ARM_SOC_IDENTIFICATION_CODE << ARM_SOC_IDENTIFICATION_SHIFT)
+		 | (ARM_SOC_CONTINUATION_CODE << ARM_SOC_CONTINUATION_SHIFT)
+		 | FVP_SOC_ID);
+}
+
+/* Get SOC revision */
+int32_t plat_get_soc_revision(void)
+{
+	unsigned int sys_id;
+
+	sys_id = mmio_read_32(V2M_SYSREGS_BASE + V2M_SYS_ID);
+	return (int32_t)((sys_id >> V2M_SYS_ID_REV_SHIFT) &
+			V2M_SYS_ID_REV_MASK);
 }
diff --git a/plat/arm/board/fvp/fvp_def.h b/plat/arm/board/fvp/fvp_def.h
index c5d1568..4efe692 100644
--- a/plat/arm/board/fvp/fvp_def.h
+++ b/plat/arm/board/fvp/fvp_def.h
@@ -27,6 +27,11 @@
 #define FVP_CCI			1
 #define FVP_CCN			2
 
+/******************************************************************************
+ * Definition of platform soc id
+ *****************************************************************************/
+#define FVP_SOC_ID      0
+
 /*******************************************************************************
  * FVP memory map related constants
  ******************************************************************************/
diff --git a/plat/arm/board/fvp/platform.mk b/plat/arm/board/fvp/platform.mk
index f75f556..a7d1825 100644
--- a/plat/arm/board/fvp/platform.mk
+++ b/plat/arm/board/fvp/platform.mk
@@ -7,9 +7,6 @@
 # Use the GICv3 driver on the FVP by default
 FVP_USE_GIC_DRIVER	:= FVP_GICV3
 
-# Use the SP804 timer instead of the generic one
-FVP_USE_SP804_TIMER	:= 0
-
 # Default cluster count for FVP
 FVP_CLUSTER_COUNT	:= 2
 
@@ -21,9 +18,6 @@
 
 FVP_DT_PREFIX		:= fvp-base-gicv3-psci
 
-$(eval $(call assert_boolean,FVP_USE_SP804_TIMER))
-$(eval $(call add_define,FVP_USE_SP804_TIMER))
-
 # The FVP platform depends on this macro to build with correct GIC driver.
 $(eval $(call add_define,FVP_USE_GIC_DRIVER))
 
@@ -155,7 +149,7 @@
 				${FVP_CPU_LIBS}					\
 				${FVP_INTERCONNECT_SOURCES}
 
-ifeq (${FVP_USE_SP804_TIMER},1)
+ifeq (${USE_SP804_TIMER},1)
 BL1_SOURCES		+=	drivers/arm/sp804/sp804_delay_timer.c
 else
 BL1_SOURCES		+=	drivers/delay_timer/generic_delay_timer.c
@@ -182,14 +176,14 @@
 				${FVP_INTERCONNECT_SOURCES}
 endif
 
-ifeq (${FVP_USE_SP804_TIMER},1)
+ifeq (${USE_SP804_TIMER},1)
 BL2_SOURCES		+=	drivers/arm/sp804/sp804_delay_timer.c
 endif
 
 BL2U_SOURCES		+=	plat/arm/board/fvp/fvp_bl2u_setup.c		\
 				${FVP_SECURITY_SOURCES}
 
-ifeq (${FVP_USE_SP804_TIMER},1)
+ifeq (${USE_SP804_TIMER},1)
 BL2U_SOURCES		+=	drivers/arm/sp804/sp804_delay_timer.c
 endif
 
@@ -223,7 +217,7 @@
 
 endif
 
-ifeq (${FVP_USE_SP804_TIMER},1)
+ifeq (${USE_SP804_TIMER},1)
 BL31_SOURCES		+=	drivers/arm/sp804/sp804_delay_timer.c
 else
 BL31_SOURCES		+=	drivers/delay_timer/generic_delay_timer.c
diff --git a/plat/arm/board/fvp_ve/fvp_ve_bl2_setup.c b/plat/arm/board/fvp_ve/fvp_ve_bl2_setup.c
index 25e0964..4ccae27 100644
--- a/plat/arm/board/fvp_ve/fvp_ve_bl2_setup.c
+++ b/plat/arm/board/fvp_ve/fvp_ve_bl2_setup.c
@@ -25,7 +25,7 @@
 {
 	arm_bl2_platform_setup();
 
-#ifdef FVP_VE_USE_SP804_TIMER
+#if USE_SP804_TIMER
 	/*
 	 * Enable the clock override for SP804 timer 0, which means that no
 	 * clock dividers are applied and the raw (35 MHz) clock will be used
@@ -37,5 +37,5 @@
 			SP804_TIMER_CLKMULT, SP804_TIMER_CLKDIV);
 #else
 	generic_delay_timer_init();
-#endif /* FVP_VE_USE_SP804_TIMER */
+#endif /* USE_SP804_TIMER */
 }
diff --git a/plat/arm/board/fvp_ve/platform.mk b/plat/arm/board/fvp_ve/platform.mk
index f8e38ff..0aa1de4 100644
--- a/plat/arm/board/fvp_ve/platform.mk
+++ b/plat/arm/board/fvp_ve/platform.mk
@@ -6,8 +6,7 @@
 
 ifdef ARM_CORTEX_A5
 # Use the SP804 timer instead of the generic one
-FVP_VE_USE_SP804_TIMER	:= 1
-$(eval $(call add_define,FVP_VE_USE_SP804_TIMER))
+USE_SP804_TIMER	:= 1
 BL2_SOURCES		+=	drivers/arm/sp804/sp804_delay_timer.c
 endif
 
diff --git a/plat/arm/board/juno/juno_common.c b/plat/arm/board/juno/juno_common.c
index 9570d2d..da4918c 100644
--- a/plat/arm/board/juno/juno_common.c
+++ b/plat/arm/board/juno/juno_common.c
@@ -1,10 +1,13 @@
 /*
- * Copyright (c) 2015-2019, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
 
+#include <lib/smccc.h>
 #include <platform_def.h>
+#include <services/arm_arch_svc.h>
+
 #include <plat/arm/common/plat_arm.h>
 
 /*
@@ -91,3 +94,40 @@
 #endif
 
 ARM_CASSERT_MMAP
+
+/*****************************************************************************
+ * plat_is_smccc_feature_available() - This function checks whether SMCCC
+ *                                     feature is availabile for platform.
+ * @fid: SMCCC function id
+ *
+ * Return SMC_ARCH_CALL_SUCCESS if SMCCC feature is available and
+ * SMC_ARCH_CALL_NOT_SUPPORTED otherwise.
+ *****************************************************************************/
+int32_t plat_is_smccc_feature_available(u_register_t fid)
+{
+	switch (fid) {
+	case SMCCC_ARCH_SOC_ID:
+		return SMC_ARCH_CALL_SUCCESS;
+	default:
+		return SMC_ARCH_CALL_NOT_SUPPORTED;
+	}
+}
+
+/* Get SOC version */
+int32_t plat_get_soc_version(void)
+{
+	return (int32_t)
+		((ARM_SOC_IDENTIFICATION_CODE << ARM_SOC_IDENTIFICATION_SHIFT)
+		 | (ARM_SOC_CONTINUATION_CODE << ARM_SOC_CONTINUATION_SHIFT)
+		 | JUNO_SOC_ID);
+}
+
+/* Get SOC revision */
+int32_t plat_get_soc_revision(void)
+{
+	unsigned int sys_id;
+
+	sys_id = mmio_read_32(V2M_SYSREGS_BASE + V2M_SYS_ID);
+	return (int32_t)((sys_id >> V2M_SYS_ID_REV_SHIFT) &
+			V2M_SYS_ID_REV_MASK);
+}
diff --git a/plat/arm/board/juno/juno_def.h b/plat/arm/board/juno/juno_def.h
index 3b34a9f..ddf99dc 100644
--- a/plat/arm/board/juno/juno_def.h
+++ b/plat/arm/board/juno/juno_def.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2019, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2014-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -9,6 +9,11 @@
 
 #include <lib/utils_def.h>
 
+/******************************************************************************
+ * Definition of platform soc id
+ *****************************************************************************/
+#define JUNO_SOC_ID     1
+
 /*******************************************************************************
  * Juno memory map related constants
  ******************************************************************************/
diff --git a/plat/arm/common/arm_common.c b/plat/arm/common/arm_common.c
index e2b99a3..296aaf8 100644
--- a/plat/arm/common/arm_common.c
+++ b/plat/arm/common/arm_common.c
@@ -216,7 +216,7 @@
 		 * Translate entry point to Physical Address using the EL1&0
 		 * translation regime, including stage 2.
 		 */
-		ats12e1r(ep);
+		AT(ats12e1r, ep);
 	}
 	isb();
 	par = read_par_el1();
@@ -237,38 +237,3 @@
 }
 #endif
 
-/*****************************************************************************
- * plat_is_smccc_feature_available() - This function checks whether SMCCC
- *                                     feature is availabile for platform.
- * @fid: SMCCC function id
- *
- * Return SMC_OK if SMCCC feature is available and SMC_ARCH_CALL_NOT_SUPPORTED
- * otherwise.
- *****************************************************************************/
-int32_t plat_is_smccc_feature_available(u_register_t fid)
-{
-	switch (fid) {
-	case SMCCC_ARCH_SOC_ID:
-	default:
-		return SMC_ARCH_CALL_NOT_SUPPORTED;
-	}
-}
-
-/*
- * Weak function to get ARM platform SOC-ID, Always return SOC-ID=0
- * ToDo: Get proper SOC-ID for every ARM platform and define this
- *       function separately for every ARM platform.
- */
-uint32_t plat_arm_get_soc_id(void)
-{
-	return 0U;
-}
-
-/* Get SOC version */
-int32_t plat_get_soc_version(void)
-{
-	return (int32_t)
-		((ARM_SOC_IDENTIFICATION_CODE << ARM_SOC_IDENTIFICATION_SHIFT)
-		 | (ARM_SOC_CONTINUATION_CODE << ARM_SOC_CONTINUATION_SHIFT)
-		 | plat_arm_get_soc_id());
-}
diff --git a/plat/arm/common/fconf/arm_fconf_io.c b/plat/arm/common/fconf/arm_fconf_io.c
index 350ecd1..5f125d3 100644
--- a/plat/arm/common/fconf/arm_fconf_io.c
+++ b/plat/arm/common/fconf/arm_fconf_io.c
@@ -52,6 +52,7 @@
 	[NON_TRUSTED_FW_CONTENT_CERT_ID] = {UUID_NON_TRUSTED_FW_CONTENT_CERT},
 #if defined(SPD_spmd)
 	[SIP_SP_CONTENT_CERT_ID] = {UUID_SIP_SECURE_PARTITION_CONTENT_CERT},
+	[PLAT_SP_CONTENT_CERT_ID] = {UUID_PLAT_SECURE_PARTITION_CONTENT_CERT},
 #endif
 #endif /* ARM_IO_IN_DTB */
 #endif /* TRUSTED_BOARD_BOOT */
@@ -189,6 +190,11 @@
 		(uintptr_t)&arm_uuid_spec[SIP_SP_CONTENT_CERT_ID],
 		open_fip
 	},
+	[PLAT_SP_CONTENT_CERT_ID] = {
+		&fip_dev_handle,
+		(uintptr_t)&arm_uuid_spec[PLAT_SP_CONTENT_CERT_ID],
+		open_fip
+	},
 #endif
 #endif /* ARM_IO_IN_DTB */
 #endif /* TRUSTED_BOARD_BOOT */
@@ -197,7 +203,7 @@
 #ifdef IMAGE_BL2
 
 #if TRUSTED_BOARD_BOOT
-#define FCONF_ARM_IO_UUID_NUMBER	U(20)
+#define FCONF_ARM_IO_UUID_NUMBER	U(21)
 #else
 #define FCONF_ARM_IO_UUID_NUMBER	U(10)
 #endif
@@ -234,6 +240,7 @@
 	{NON_TRUSTED_FW_CONTENT_CERT_ID, "nt_fw_content_cert_uuid"},
 #if defined(SPD_spmd)
 	{SIP_SP_CONTENT_CERT_ID, "sip_sp_content_cert_uuid"},
+	{PLAT_SP_CONTENT_CERT_ID, "plat_sp_content_cert_uuid"},
 #endif
 #endif /* TRUSTED_BOARD_BOOT */
 };
diff --git a/plat/arm/common/fconf/arm_fconf_sp.c b/plat/arm/common/fconf/arm_fconf_sp.c
index 4459264..50a9dd4 100644
--- a/plat/arm/common/fconf/arm_fconf_sp.c
+++ b/plat/arm/common/fconf/arm_fconf_sp.c
@@ -30,7 +30,13 @@
 	union uuid_helper_t uuid_helper;
 	unsigned int index = 0;
 	uint32_t val32;
-	const unsigned int sp_start_index = SP_PKG1_ID;
+	bool is_plat_owned = false;
+	const unsigned int sip_start = SP_PKG1_ID;
+	unsigned int sip_index = sip_start;
+	const unsigned int sip_end = sip_start + MAX_SP_IDS / 2;
+	const unsigned int plat_start = SP_PKG5_ID;
+	unsigned int plat_index = plat_start;
+	const unsigned int plat_end = plat_start + MAX_SP_IDS / 2;
 
 	/* As libfdt use void *, we can't avoid this cast */
 	const void *dtb = (void *)config;
@@ -45,27 +51,20 @@
 	}
 
 	fdt_for_each_subnode(sp_node, dtb, node) {
-		if (index == MAX_SP_IDS) {
+		if ((index == MAX_SP_IDS) || (sip_index == sip_end)
+		    || (plat_index == plat_end)) {
 			ERROR("FCONF: Reached max number of SPs\n");
 			return -1;
 		}
 
+		/* Read UUID */
 		err = fdt_read_uint32_array(dtb, sp_node, "uuid", 4,
 					    uuid_helper.word);
 		if (err < 0) {
 			ERROR("FCONF: cannot read SP uuid\n");
 			return -1;
 		}
-
 		arm_sp.uuids[index] = uuid_helper;
-
-		err = fdt_read_uint32(dtb, sp_node, "load-address", &val32);
-		if (err < 0) {
-			ERROR("FCONF: cannot read SP load address\n");
-			return -1;
-		}
-		arm_sp.load_addr[index] = val32;
-
 		VERBOSE("FCONF: %s UUID %x-%x-%x-%x load_addr=%lx\n",
 			__func__,
 			uuid_helper.word[0],
@@ -74,8 +73,52 @@
 			uuid_helper.word[3],
 			arm_sp.load_addr[index]);
 
+		/* Read Load address */
+		err = fdt_read_uint32(dtb, sp_node, "load-address", &val32);
+		if (err < 0) {
+			ERROR("FCONF: cannot read SP load address\n");
+			return -1;
+		}
+		arm_sp.load_addr[index] = val32;
+
-		/* Add SP information in mem param descriptor */
-		sp_mem_params_descs[index].image_id = sp_start_index + index;
+		/* Read owner field only for dualroot CoT */
+#if defined(ARM_COT_dualroot)
+		/* Owner is an optional field, no need to catch error */
+		fdtw_read_string(dtb, sp_node, "owner",
+				arm_sp.owner[index], ARM_SP_OWNER_NAME_LEN);
+#endif
+		/* If owner is empty mark it as SiP owned */
+		if ((strncmp(arm_sp.owner[index], "SiP",
+			     ARM_SP_OWNER_NAME_LEN) == 0) ||
+		    (strncmp(arm_sp.owner[index], "",
+			     ARM_SP_OWNER_NAME_LEN) == 0)) {
+			is_plat_owned = false;
+		} else if (strcmp(arm_sp.owner[index], "Plat") == 0) {
+			is_plat_owned = true;
+		} else {
+			ERROR("FCONF: %s is not a valid SP owner\n",
+			      arm_sp.owner[index]);
+			return -1;
+		}
+		/*
+		 * Add SP information in mem param descriptor and IO policies
+		 * structure.
+		 */
+		if (is_plat_owned) {
+			sp_mem_params_descs[index].image_id = plat_index;
+			policies[plat_index].image_spec =
+						(uintptr_t)&arm_sp.uuids[index];
+			policies[plat_index].dev_handle = &fip_dev_handle;
+			policies[plat_index].check = open_fip;
+			plat_index++;
+		} else {
+			sp_mem_params_descs[index].image_id = sip_index;
+			policies[sip_index].image_spec =
+						(uintptr_t)&arm_sp.uuids[index];
+			policies[sip_index].dev_handle = &fip_dev_handle;
+			policies[sip_index].check = open_fip;
+			sip_index++;
+		}
 		SET_PARAM_HEAD(&sp_mem_params_descs[index].image_info,
 					PARAM_IMAGE_BINARY, VERSION_2, 0);
 		sp_mem_params_descs[index].image_info.image_max_size =
@@ -84,13 +127,6 @@
 							INVALID_IMAGE_ID;
 		sp_mem_params_descs[index].image_info.image_base =
 							arm_sp.load_addr[index];
-
-		/* Add SP information in IO policies structure */
-		policies[sp_start_index + index].image_spec =
-						(uintptr_t)&arm_sp.uuids[index];
-		policies[sp_start_index + index].dev_handle = &fip_dev_handle;
-		policies[sp_start_index + index].check = open_fip;
-
 		index++;
 	}
 
diff --git a/plat/imx/imx8m/gpc_common.c b/plat/imx/imx8m/gpc_common.c
index eb2801c..1e55f05 100644
--- a/plat/imx/imx8m/gpc_common.c
+++ b/plat/imx/imx8m/gpc_common.c
@@ -16,7 +16,9 @@
 #include <imx8m_psci.h>
 #include <plat_imx8.h>
 
-static uint32_t gpc_imr_offset[] = { 0x30, 0x40, 0x1c0, 0x1d0, };
+static uint32_t gpc_imr_offset[] = { IMR1_CORE0_A53, IMR1_CORE1_A53, IMR1_CORE2_A53, IMR1_CORE3_A53, };
+
+DEFINE_BAKERY_LOCK(gpc_lock);
 
 #pragma weak imx_set_cpu_pwr_off
 #pragma weak imx_set_cpu_pwr_on
@@ -38,16 +40,27 @@
 
 void imx_set_cpu_pwr_off(unsigned int core_id)
 {
+
+	bakery_lock_get(&gpc_lock);
+
 	/* enable the wfi power down of the core */
 	mmio_setbits_32(IMX_GPC_BASE + LPCR_A53_AD, COREx_WFI_PDN(core_id));
+
+	bakery_lock_release(&gpc_lock);
+
 	/* assert the pcg pcr bit of the core */
 	mmio_setbits_32(IMX_GPC_BASE + COREx_PGC_PCR(core_id), 0x1);
 }
 
 void imx_set_cpu_pwr_on(unsigned int core_id)
 {
+	bakery_lock_get(&gpc_lock);
+
 	/* clear the wfi power down bit of the core */
 	mmio_clrbits_32(IMX_GPC_BASE + LPCR_A53_AD, COREx_WFI_PDN(core_id));
+
+	bakery_lock_release(&gpc_lock);
+
 	/* assert the ncpuporeset */
 	mmio_clrbits_32(IMX_SRC_BASE + SRC_A53RCR1, (1 << core_id));
 	/* assert the pcg pcr bit of the core */
@@ -67,6 +80,8 @@
 
 void imx_set_cpu_lpm(unsigned int core_id, bool pdn)
 {
+	bakery_lock_get(&gpc_lock);
+
 	if (pdn) {
 		/* enable the core WFI PDN & IRQ PUP */
 		mmio_setbits_32(IMX_GPC_BASE + LPCR_A53_AD, COREx_WFI_PDN(core_id) |
@@ -80,6 +95,8 @@
 		/* deassert the pcg pcr bit of the core */
 		mmio_clrbits_32(IMX_GPC_BASE + COREx_PGC_PCR(core_id), 0x1);
 	}
+
+	bakery_lock_release(&gpc_lock);
 }
 
 /*
@@ -133,14 +150,12 @@
 		val = mmio_read_32(IMX_GPC_BASE + LPCR_A53_AD);
 		val &= ~EN_L2_WFI_PDN;
 		/* L2 cache memory is on in WAIT mode */
-		if (is_local_state_off(power_state))
+		if (is_local_state_off(power_state)) {
 			val |= (L2PGE | EN_PLAT_PDN);
-		else
-			val |= EN_PLAT_PDN;
+			imx_a53_plat_slot_config(true);
+		}
 
 		mmio_write_32(IMX_GPC_BASE + LPCR_A53_AD, val);
-
-		imx_a53_plat_slot_config(true);
 	} else {
 		/* clear the slot and ack for cluster power down */
 		imx_a53_plat_slot_config(false);
diff --git a/plat/imx/imx8m/imx8m_psci_common.c b/plat/imx/imx8m/imx8m_psci_common.c
index d641628..dbb772d 100644
--- a/plat/imx/imx8m/imx8m_psci_common.c
+++ b/plat/imx/imx8m/imx8m_psci_common.c
@@ -192,7 +192,7 @@
 	 * drived by the 32K OSC, so delay 30us to make sure the counter
 	 * is really running.
 	 */
-	if (!is_local_state_run(CLUSTER_PWR_STATE(target_state))) {
+	if (is_local_state_off(CLUSTER_PWR_STATE(target_state))) {
 		imx_set_rbc_count();
 		udelay(30);
 	}
diff --git a/plat/imx/imx8m/imx8mm/include/gpc_reg.h b/plat/imx/imx8m/imx8mm/include/gpc_reg.h
index c697af2..1a4eae5 100644
--- a/plat/imx/imx8m/imx8mm/include/gpc_reg.h
+++ b/plat/imx/imx8m/imx8mm/include/gpc_reg.h
@@ -124,4 +124,6 @@
 #define VPU_G2_PGC			0xf00
 #define VPU_H1_PGC			0xf40
 
+#define IRQ_IMR_NUM			U(4)
+
 #endif /* GPC_REG_H */
diff --git a/plat/imx/imx8m/imx8mn/include/gpc_reg.h b/plat/imx/imx8m/imx8mn/include/gpc_reg.h
index fd10438..8a81368 100644
--- a/plat/imx/imx8m/imx8mn/include/gpc_reg.h
+++ b/plat/imx/imx8m/imx8mn/include/gpc_reg.h
@@ -106,4 +106,6 @@
 #define GPUMIX_PGC			0xdc0
 #define DISPMIX_PGC			0xe80
 
+#define IRQ_IMR_NUM			U(4)
+
 #endif /* GPC_REG_H */
diff --git a/plat/imx/imx8m/imx8mp/include/gpc_reg.h b/plat/imx/imx8m/imx8mp/include/gpc_reg.h
index 12da6ac..7909937 100644
--- a/plat/imx/imx8m/imx8mp/include/gpc_reg.h
+++ b/plat/imx/imx8m/imx8mp/include/gpc_reg.h
@@ -146,4 +146,6 @@
 #define MEDIAMIX_ISPDWP_PGC		0xf80
 #define DDRMIX_PGC			0xfc0
 
+#define IRQ_IMR_NUM			U(5)
+
 #endif /* GPC_REG_H */
diff --git a/plat/imx/imx8m/imx8mq/gpc.c b/plat/imx/imx8m/imx8mq/gpc.c
index 942ae45..367c941 100644
--- a/plat/imx/imx8m/imx8mq/gpc.c
+++ b/plat/imx/imx8m/imx8mq/gpc.c
@@ -19,9 +19,14 @@
 /* use wfi power down the core */
 void imx_set_cpu_pwr_off(unsigned int core_id)
 {
+	bakery_lock_get(&gpc_lock);
+
 	/* enable the wfi power down of the core */
 	mmio_setbits_32(IMX_GPC_BASE + LPCR_A53_AD, COREx_WFI_PDN(core_id) |
 			(1 << (core_id + 20)));
+
+	bakery_lock_release(&gpc_lock);
+
 	/* assert the pcg pcr bit of the core */
 	mmio_setbits_32(IMX_GPC_BASE + COREx_PGC_PCR(core_id), 0x1);
 };
@@ -29,6 +34,8 @@
 /* if out of lpm, we need to do reverse steps */
 void imx_set_cpu_lpm(unsigned int core_id, bool pdn)
 {
+	bakery_lock_get(&gpc_lock);
+
 	if (pdn) {
 		/* enable the core WFI PDN & IRQ PUP */
 		mmio_setbits_32(IMX_GPC_BASE + LPCR_A53_AD, COREx_WFI_PDN(core_id) |
@@ -42,6 +49,8 @@
 		/* deassert the pcg pcr bit of the core */
 		mmio_setbits_32(IMX_GPC_BASE + COREx_PGC_PCR(core_id), 0x1);
 	}
+
+	bakery_lock_release(&gpc_lock);
 }
 
 void imx_pup_pdn_slot_config(int last_core, bool pdn)
diff --git a/plat/imx/imx8m/imx8mq/include/gpc_reg.h b/plat/imx/imx8m/imx8mq/include/gpc_reg.h
index 9f472d6..f171bd9 100644
--- a/plat/imx/imx8m/imx8mq/include/gpc_reg.h
+++ b/plat/imx/imx8m/imx8mq/include/gpc_reg.h
@@ -84,4 +84,6 @@
 #define MASTER1_MAPPING			BIT(1)
 #define MASTER2_MAPPING			BIT(2)
 
+#define IRQ_IMR_NUM			U(4)
+
 #endif /* GPC_REG_H */
diff --git a/plat/imx/imx8m/include/gpc.h b/plat/imx/imx8m/include/gpc.h
index 89a0b9d..075da91 100644
--- a/plat/imx/imx8m/include/gpc.h
+++ b/plat/imx/imx8m/include/gpc.h
@@ -25,7 +25,6 @@
 #define SLTx_CFG(n)			((SLT0_CFG + ((n) * 4)))
 #define SLT_COREx_PUP(core_id)		(0x2 << ((core_id) * 2))
 
-#define IRQ_IMR_NUM	4
 #define IMR_MASK_ALL	0xffffffff
 
 #define IMX_PD_DOMAIN(name, on)				\
@@ -55,6 +54,8 @@
 	bool always_on;
 };
 
+DECLARE_BAKERY_LOCK(gpc_lock);
+
 /* function declare */
 void imx_gpc_init(void);
 void imx_set_cpu_secure_entry(unsigned int core_index, uintptr_t sec_entrypoint);
diff --git a/plat/nvidia/tegra/common/tegra_bl31_setup.c b/plat/nvidia/tegra/common/tegra_bl31_setup.c
index 40713b2..e56909d 100644
--- a/plat/nvidia/tegra/common/tegra_bl31_setup.c
+++ b/plat/nvidia/tegra/common/tegra_bl31_setup.c
@@ -248,12 +248,6 @@
 	tegra_memctrl_setup();
 
 	/*
-	 * Set up the TZRAM memory aperture to allow only secure world
-	 * access
-	 */
-	tegra_memctrl_tzram_setup(TEGRA_TZRAM_BASE, TEGRA_TZRAM_SIZE);
-
-	/*
 	 * Late setup handler to allow platforms to performs additional
 	 * functionality.
 	 * This handler gets called with MMU enabled.
diff --git a/plat/nvidia/tegra/common/tegra_common.mk b/plat/nvidia/tegra/common/tegra_common.mk
index f412a80..bb8bd7d 100644
--- a/plat/nvidia/tegra/common/tegra_common.mk
+++ b/plat/nvidia/tegra/common/tegra_common.mk
@@ -12,37 +12,46 @@
 include lib/xlat_tables_v2/xlat_tables.mk
 PLAT_BL_COMMON_SOURCES	+=	${XLAT_TABLES_LIB_SRCS}
 
-COMMON_DIR		:=	plat/nvidia/tegra/common
+TEGRA_COMMON		:=	plat/nvidia/tegra/common
+TEGRA_DRIVERS		:=	plat/nvidia/tegra/drivers
+TEGRA_LIBS		:=	plat/nvidia/tegra/lib
 
 # Include GICv3 driver files
 include drivers/arm/gic/v3/gicv3.mk
 TEGRA_GICv3_SOURCES	:=	$(GICV3_SOURCES)				\
 				plat/common/plat_gicv3.c			\
-				${COMMON_DIR}/tegra_gicv3.c
+				${TEGRA_COMMON}/tegra_gicv3.c
 
 # Include GICv2 driver files
 include drivers/arm/gic/v2/gicv2.mk
 
 TEGRA_GICv2_SOURCES	:=	${GICV2_SOURCES}				\
 				plat/common/plat_gicv2.c			\
-				${COMMON_DIR}/tegra_gicv2.c
+				${TEGRA_COMMON}/tegra_gicv2.c
+
+TEGRA_GICv3_SOURCES	:=	drivers/arm/gic/common/gic_common.c		\
+				drivers/arm/gic/v3/arm_gicv3_common.c		\
+				drivers/arm/gic/v3/gicv3_main.c			\
+				drivers/arm/gic/v3/gicv3_helpers.c		\
+				plat/common/plat_gicv3.c			\
+				${TEGRA_COMMON}/tegra_gicv3.c
 
 BL31_SOURCES		+=	drivers/delay_timer/delay_timer.c		\
 				drivers/io/io_storage.c				\
 				plat/common/aarch64/crash_console_helpers.S	\
 				${TEGRA_GICv2_SOURCES}				\
-				${COMMON_DIR}/aarch64/tegra_helpers.S		\
-				${COMMON_DIR}/lib/debug/profiler.c		\
-				${COMMON_DIR}/tegra_bl31_setup.c		\
-				${COMMON_DIR}/tegra_delay_timer.c		\
-				${COMMON_DIR}/tegra_ehf.c			\
-				${COMMON_DIR}/tegra_fiq_glue.c			\
-				${COMMON_DIR}/tegra_io_storage.c		\
-				${COMMON_DIR}/tegra_platform.c			\
-				${COMMON_DIR}/tegra_pm.c			\
-				${COMMON_DIR}/tegra_sip_calls.c			\
-				${COMMON_DIR}/tegra_sdei.c
+				${TEGRA_COMMON}/aarch64/tegra_helpers.S		\
+				${TEGRA_LIBS}/debug/profiler.c			\
+				${TEGRA_COMMON}/tegra_bl31_setup.c		\
+				${TEGRA_COMMON}/tegra_delay_timer.c		\
+				${TEGRA_COMMON}/tegra_ehf.c			\
+				${TEGRA_COMMON}/tegra_fiq_glue.c		\
+				${TEGRA_COMMON}/tegra_io_storage.c		\
+				${TEGRA_COMMON}/tegra_platform.c		\
+				${TEGRA_COMMON}/tegra_pm.c			\
+				${TEGRA_COMMON}/tegra_sip_calls.c		\
+				${TEGRA_COMMON}/tegra_sdei.c
 
 ifneq ($(ENABLE_STACK_PROTECTOR), 0)
-BL31_SOURCES		+=	${COMMON_DIR}/tegra_stack_protector.c
+BL31_SOURCES		+=	${TEGRA_COMMON}/tegra_stack_protector.c
 endif
diff --git a/plat/nvidia/tegra/common/tegra_platform.c b/plat/nvidia/tegra/common/tegra_platform.c
index 0804135..7c73e8f 100644
--- a/plat/nvidia/tegra/common/tegra_platform.c
+++ b/plat/nvidia/tegra/common/tegra_platform.c
@@ -108,6 +108,13 @@
 	return (tegra_chipid_is_t210() && (tegra_get_chipid_major() == 0x2U));
 }
 
+bool tegra_chipid_is_t194(void)
+{
+	uint32_t chip_id = (tegra_get_chipid() >> CHIP_ID_SHIFT) & CHIP_ID_MASK;
+
+	return (chip_id == TEGRA_CHIPID_TEGRA19);
+}
+
 /*
  * Read the chip ID value and derive the platform
  */
diff --git a/plat/nvidia/tegra/common/tegra_pm.c b/plat/nvidia/tegra/common/tegra_pm.c
index 0430048..6019182 100644
--- a/plat/nvidia/tegra/common/tegra_pm.c
+++ b/plat/nvidia/tegra/common/tegra_pm.c
@@ -34,7 +34,7 @@
  * the appropriate State-ID field within the `power_state` parameter which can
  * be utilized in `pwr_domain_suspend()` to suspend to system affinity level.
 ******************************************************************************/
-void tegra_get_sys_suspend_power_state(psci_power_state_t *req_state)
+static void tegra_get_sys_suspend_power_state(psci_power_state_t *req_state)
 {
 	/* all affinities use system suspend state id */
 	for (uint32_t i = MPIDR_AFFLVL0; i <= PLAT_MAX_PWR_LVL; i++) {
@@ -45,7 +45,7 @@
 /*******************************************************************************
  * Handler called when an affinity instance is about to enter standby.
  ******************************************************************************/
-void tegra_cpu_standby(plat_local_state_t cpu_state)
+static void tegra_cpu_standby(plat_local_state_t cpu_state)
 {
 	u_register_t saved_scr_el3;
 
@@ -84,7 +84,7 @@
  * Handler called when an affinity instance is about to be turned on. The
  * level and mpidr determine the affinity instance.
  ******************************************************************************/
-int32_t tegra_pwr_domain_on(u_register_t mpidr)
+static int32_t tegra_pwr_domain_on(u_register_t mpidr)
 {
 	return tegra_soc_pwr_domain_on(mpidr);
 }
@@ -93,7 +93,7 @@
  * Handler called when a power domain is about to be turned off. The
  * target_state encodes the power state that each level should transition to.
  ******************************************************************************/
-void tegra_pwr_domain_off(const psci_power_state_t *target_state)
+static void tegra_pwr_domain_off(const psci_power_state_t *target_state)
 {
 	(void)tegra_soc_pwr_domain_off(target_state);
 }
@@ -113,7 +113,7 @@
  * Handler called when a power domain is about to be suspended. The
  * target_state encodes the power state that each level should transition to.
  ******************************************************************************/
-void tegra_pwr_domain_suspend(const psci_power_state_t *target_state)
+static void tegra_pwr_domain_suspend(const psci_power_state_t *target_state)
 {
 	(void)tegra_soc_pwr_domain_suspend(target_state);
 
@@ -132,7 +132,7 @@
  * Handler called at the end of the power domain suspend sequence. The
  * target_state encodes the power state that each level should transition to.
  ******************************************************************************/
-__dead2 void tegra_pwr_domain_power_down_wfi(const psci_power_state_t
+static __dead2 void tegra_pwr_domain_power_down_wfi(const psci_power_state_t
 					     *target_state)
 {
 	/* call the chip's power down handler */
@@ -147,7 +147,7 @@
  * being turned off earlier. The target_state encodes the low power state that
  * each level has woken up from.
  ******************************************************************************/
-void tegra_pwr_domain_on_finish(const psci_power_state_t *target_state)
+static void tegra_pwr_domain_on_finish(const psci_power_state_t *target_state)
 {
 	const plat_params_from_bl2_t *plat_params;
 
@@ -180,11 +180,6 @@
 		tegra_memctrl_tzdram_setup(plat_params->tzdram_base,
 			(uint32_t)plat_params->tzdram_size);
 
-		/*
-		 * Set up the TZRAM memory aperture to allow only secure world
-		 * access
-		 */
-		tegra_memctrl_tzram_setup(TEGRA_TZRAM_BASE, TEGRA_TZRAM_SIZE);
 	} else {
 		/*
 		 * Initialize the GIC cpu and distributor interfaces
@@ -203,7 +198,7 @@
  * having been suspended earlier. The target_state encodes the low power state
  * that each level has woken up from.
  ******************************************************************************/
-void tegra_pwr_domain_suspend_finish(const psci_power_state_t *target_state)
+static void tegra_pwr_domain_suspend_finish(const psci_power_state_t *target_state)
 {
 	tegra_pwr_domain_on_finish(target_state);
 }
@@ -211,7 +206,7 @@
 /*******************************************************************************
  * Handler called when the system wants to be powered off
  ******************************************************************************/
-__dead2 void tegra_system_off(void)
+static __dead2 void tegra_system_off(void)
 {
 	INFO("Powering down system...\n");
 
@@ -221,7 +216,7 @@
 /*******************************************************************************
  * Handler called when the system wants to be restarted.
  ******************************************************************************/
-__dead2 void tegra_system_reset(void)
+static __dead2 void tegra_system_reset(void)
 {
 	INFO("Restarting system...\n");
 
@@ -237,7 +232,7 @@
 /*******************************************************************************
  * Handler called to check the validity of the power state parameter.
  ******************************************************************************/
-int32_t tegra_validate_power_state(uint32_t power_state,
+static int32_t tegra_validate_power_state(uint32_t power_state,
 				   psci_power_state_t *req_state)
 {
 	assert(req_state != NULL);
@@ -248,7 +243,7 @@
 /*******************************************************************************
  * Platform handler called to check the validity of the non secure entrypoint.
  ******************************************************************************/
-int32_t tegra_validate_ns_entrypoint(uintptr_t entrypoint)
+static int32_t tegra_validate_ns_entrypoint(uintptr_t entrypoint)
 {
 	int32_t ret = PSCI_E_INVALID_ADDRESS;
 
diff --git a/plat/nvidia/tegra/common/drivers/bpmp/bpmp.c b/plat/nvidia/tegra/drivers/bpmp/bpmp.c
similarity index 100%
rename from plat/nvidia/tegra/common/drivers/bpmp/bpmp.c
rename to plat/nvidia/tegra/drivers/bpmp/bpmp.c
diff --git a/plat/nvidia/tegra/common/drivers/bpmp_ipc/intf.c b/plat/nvidia/tegra/drivers/bpmp_ipc/intf.c
similarity index 100%
rename from plat/nvidia/tegra/common/drivers/bpmp_ipc/intf.c
rename to plat/nvidia/tegra/drivers/bpmp_ipc/intf.c
diff --git a/plat/nvidia/tegra/common/drivers/bpmp_ipc/intf.h b/plat/nvidia/tegra/drivers/bpmp_ipc/intf.h
similarity index 100%
rename from plat/nvidia/tegra/common/drivers/bpmp_ipc/intf.h
rename to plat/nvidia/tegra/drivers/bpmp_ipc/intf.h
diff --git a/plat/nvidia/tegra/common/drivers/bpmp_ipc/ivc.c b/plat/nvidia/tegra/drivers/bpmp_ipc/ivc.c
similarity index 100%
rename from plat/nvidia/tegra/common/drivers/bpmp_ipc/ivc.c
rename to plat/nvidia/tegra/drivers/bpmp_ipc/ivc.c
diff --git a/plat/nvidia/tegra/common/drivers/bpmp_ipc/ivc.h b/plat/nvidia/tegra/drivers/bpmp_ipc/ivc.h
similarity index 100%
rename from plat/nvidia/tegra/common/drivers/bpmp_ipc/ivc.h
rename to plat/nvidia/tegra/drivers/bpmp_ipc/ivc.h
diff --git a/plat/nvidia/tegra/common/drivers/flowctrl/flowctrl.c b/plat/nvidia/tegra/drivers/flowctrl/flowctrl.c
similarity index 100%
rename from plat/nvidia/tegra/common/drivers/flowctrl/flowctrl.c
rename to plat/nvidia/tegra/drivers/flowctrl/flowctrl.c
diff --git a/plat/nvidia/tegra/common/drivers/gpcdma/gpcdma.c b/plat/nvidia/tegra/drivers/gpcdma/gpcdma.c
similarity index 100%
rename from plat/nvidia/tegra/common/drivers/gpcdma/gpcdma.c
rename to plat/nvidia/tegra/drivers/gpcdma/gpcdma.c
diff --git a/plat/nvidia/tegra/common/drivers/memctrl/memctrl_v1.c b/plat/nvidia/tegra/drivers/memctrl/memctrl_v1.c
similarity index 95%
rename from plat/nvidia/tegra/common/drivers/memctrl/memctrl_v1.c
rename to plat/nvidia/tegra/drivers/memctrl/memctrl_v1.c
index c3f95db..b3dcd2a 100644
--- a/plat/nvidia/tegra/common/drivers/memctrl/memctrl_v1.c
+++ b/plat/nvidia/tegra/drivers/memctrl/memctrl_v1.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2015-2019, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2020, NVIDIA Corporation. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -92,20 +93,6 @@
 	tegra_mc_write_32(MC_SECURITY_CFG1_0, size_in_bytes >> 20);
 }
 
-/*
- * Secure the BL31 TZRAM aperture.
- *
- * phys_base = physical base of TZRAM aperture
- * size_in_bytes = size of aperture in bytes
- */
-void tegra_memctrl_tzram_setup(uint64_t phys_base, uint32_t size_in_bytes)
-{
-	/*
-	 * The v1 hardware controller does not have any registers
-	 * for setting up the on-chip TZRAM.
-	 */
-}
-
 static void tegra_clear_videomem(uintptr_t non_overlap_area_start,
 				 unsigned long long non_overlap_area_size)
 {
diff --git a/plat/nvidia/tegra/common/drivers/memctrl/memctrl_v2.c b/plat/nvidia/tegra/drivers/memctrl/memctrl_v2.c
similarity index 100%
rename from plat/nvidia/tegra/common/drivers/memctrl/memctrl_v2.c
rename to plat/nvidia/tegra/drivers/memctrl/memctrl_v2.c
diff --git a/plat/nvidia/tegra/common/drivers/pmc/pmc.c b/plat/nvidia/tegra/drivers/pmc/pmc.c
similarity index 100%
rename from plat/nvidia/tegra/common/drivers/pmc/pmc.c
rename to plat/nvidia/tegra/drivers/pmc/pmc.c
diff --git a/plat/nvidia/tegra/common/drivers/smmu/smmu.c b/plat/nvidia/tegra/drivers/smmu/smmu.c
similarity index 100%
rename from plat/nvidia/tegra/common/drivers/smmu/smmu.c
rename to plat/nvidia/tegra/drivers/smmu/smmu.c
diff --git a/plat/nvidia/tegra/common/drivers/spe/shared_console.S b/plat/nvidia/tegra/drivers/spe/shared_console.S
similarity index 100%
rename from plat/nvidia/tegra/common/drivers/spe/shared_console.S
rename to plat/nvidia/tegra/drivers/spe/shared_console.S
diff --git a/plat/nvidia/tegra/include/drivers/memctrl.h b/plat/nvidia/tegra/include/drivers/memctrl.h
index d5ef60d..cc85095 100644
--- a/plat/nvidia/tegra/include/drivers/memctrl.h
+++ b/plat/nvidia/tegra/include/drivers/memctrl.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2015-2017, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2020, NVIDIA Corporation. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -10,7 +11,6 @@
 void tegra_memctrl_setup(void);
 void tegra_memctrl_restore_settings(void);
 void tegra_memctrl_tzdram_setup(uint64_t phys_base, uint32_t size_in_bytes);
-void tegra_memctrl_tzram_setup(uint64_t phys_base, uint32_t size_in_bytes);
 void tegra_memctrl_videomem_setup(uint64_t phys_base, uint32_t size_in_bytes);
 void tegra_memctrl_disable_ahb_redirection(void);
 void tegra_memctrl_clear_pending_interrupts(void);
diff --git a/plat/nvidia/tegra/include/tegra_platform.h b/plat/nvidia/tegra/include/tegra_platform.h
index 7dfa4d0..b8297fd 100644
--- a/plat/nvidia/tegra/include/tegra_platform.h
+++ b/plat/nvidia/tegra/include/tegra_platform.h
@@ -30,6 +30,7 @@
 #define TEGRA_CHIPID_TEGRA13		U(0x13)
 #define TEGRA_CHIPID_TEGRA21		U(0x21)
 #define TEGRA_CHIPID_TEGRA18		U(0x18)
+#define TEGRA_CHIPID_TEGRA19		U(0x19)
 
 /*******************************************************************************
  * JEDEC Standard Manufacturer's Identification Code and Bank ID
@@ -52,6 +53,7 @@
 bool tegra_chipid_is_t186(void);
 bool tegra_chipid_is_t210(void);
 bool tegra_chipid_is_t210_b01(void);
+bool tegra_chipid_is_t194(void);
 
 /*
  * Tegra platform identifiers
diff --git a/plat/nvidia/tegra/include/tegra_private.h b/plat/nvidia/tegra/include/tegra_private.h
index c181c36..b638c81 100644
--- a/plat/nvidia/tegra/include/tegra_private.h
+++ b/plat/nvidia/tegra/include/tegra_private.h
@@ -112,19 +112,6 @@
 plat_local_state_t tegra_soc_get_target_pwr_state(uint32_t lvl,
 					     const plat_local_state_t *states,
 					     uint32_t ncpu);
-void tegra_get_sys_suspend_power_state(psci_power_state_t *req_state);
-void tegra_cpu_standby(plat_local_state_t cpu_state);
-int32_t tegra_pwr_domain_on(u_register_t mpidr);
-void tegra_pwr_domain_off(const psci_power_state_t *target_state);
-void tegra_pwr_domain_suspend(const psci_power_state_t *target_state);
-void __dead2 tegra_pwr_domain_power_down_wfi(const psci_power_state_t *target_state);
-void tegra_pwr_domain_on_finish(const psci_power_state_t *target_state);
-void tegra_pwr_domain_suspend_finish(const psci_power_state_t *target_state);
-__dead2 void tegra_system_off(void);
-__dead2 void tegra_system_reset(void);
-int32_t tegra_validate_power_state(uint32_t power_state,
-				   psci_power_state_t *req_state);
-int32_t tegra_validate_ns_entrypoint(uintptr_t entrypoint);
 
 /* Declarations for tegraXXX_pm.c */
 int tegra_prepare_cpu_suspend(unsigned int id, unsigned int afflvl);
diff --git a/plat/nvidia/tegra/common/lib/debug/profiler.c b/plat/nvidia/tegra/lib/debug/profiler.c
similarity index 100%
rename from plat/nvidia/tegra/common/lib/debug/profiler.c
rename to plat/nvidia/tegra/lib/debug/profiler.c
diff --git a/plat/nvidia/tegra/platform.mk b/plat/nvidia/tegra/platform.mk
index a4724e6..5cac46f 100644
--- a/plat/nvidia/tegra/platform.mk
+++ b/plat/nvidia/tegra/platform.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2015-2019, ARM Limited and Contributors. All rights reserved.
+# Copyright (c) 2015-2020, ARM Limited and Contributors. All rights reserved.
 # Copyright (c) 2020, NVIDIA Corporation. All rights reserved.
 #
 # SPDX-License-Identifier: BSD-3-Clause
@@ -69,11 +69,11 @@
 
 # override with necessary libc files for the Tegra platform
 override LIBC_SRCS :=	$(addprefix lib/libc/,		\
+			aarch64/memset.S		\
 			aarch64/setjmp.S		\
 			assert.c			\
 			memcpy.c			\
 			memmove.c			\
-			memset.c			\
 			printf.c			\
 			putchar.c			\
 			strlen.c			\
diff --git a/plat/nvidia/tegra/soc/t132/platform_t132.mk b/plat/nvidia/tegra/soc/t132/platform_t132.mk
index 16bd0ea..3d76be9 100644
--- a/plat/nvidia/tegra/soc/t132/platform_t132.mk
+++ b/plat/nvidia/tegra/soc/t132/platform_t132.mk
@@ -25,9 +25,9 @@
 
 BL31_SOURCES		+=	drivers/ti/uart/aarch64/16550_console.S		\
 				lib/cpus/aarch64/denver.S		\
-				${COMMON_DIR}/drivers/flowctrl/flowctrl.c	\
-				${COMMON_DIR}/drivers/memctrl/memctrl_v1.c	\
-				${COMMON_DIR}/drivers/pmc/pmc.c			\
+				${TEGRA_DRIVERS}/flowctrl/flowctrl.c	\
+				${TEGRA_DRIVERS}/memctrl/memctrl_v1.c	\
+				${TEGRA_DRIVERS}/pmc/pmc.c			\
 				${SOC_DIR}/plat_psci_handlers.c		\
 				${SOC_DIR}/plat_sip_calls.c		\
 				${SOC_DIR}/plat_setup.c			\
diff --git a/plat/nvidia/tegra/soc/t186/platform_t186.mk b/plat/nvidia/tegra/soc/t186/platform_t186.mk
index d320aac..6739c50 100644
--- a/plat/nvidia/tegra/soc/t186/platform_t186.mk
+++ b/plat/nvidia/tegra/soc/t186/platform_t186.mk
@@ -43,16 +43,16 @@
 BL31_SOURCES		+=	drivers/ti/uart/aarch64/16550_console.S	\
 				lib/cpus/aarch64/denver.S		\
 				lib/cpus/aarch64/cortex_a57.S		\
-				${COMMON_DIR}/drivers/bpmp_ipc/intf.c   \
-				${COMMON_DIR}/drivers/bpmp_ipc/ivc.c    \
-				${COMMON_DIR}/drivers/gpcdma/gpcdma.c	\
-				${COMMON_DIR}/drivers/memctrl/memctrl_v2.c \
-				${COMMON_DIR}/drivers/smmu/smmu.c	\
+				${TEGRA_DRIVERS}/bpmp_ipc/intf.c	\
+				${TEGRA_DRIVERS}/bpmp_ipc/ivc.c		\
+				${TEGRA_DRIVERS}/gpcdma/gpcdma.c	\
+				${TEGRA_DRIVERS}/memctrl/memctrl_v2.c	\
+				${TEGRA_DRIVERS}/smmu/smmu.c		\
 				${SOC_DIR}/drivers/mce/mce.c		\
 				${SOC_DIR}/drivers/mce/ari.c		\
 				${SOC_DIR}/drivers/mce/nvg.c		\
 				${SOC_DIR}/drivers/mce/aarch64/nvg_helpers.S \
-				$(SOC_DIR)/drivers/se/se.c \
+				$(SOC_DIR)/drivers/se/se.c		\
 				${SOC_DIR}/plat_memctrl.c		\
 				${SOC_DIR}/plat_psci_handlers.c		\
 				${SOC_DIR}/plat_setup.c			\
diff --git a/plat/nvidia/tegra/soc/t194/platform_t194.mk b/plat/nvidia/tegra/soc/t194/platform_t194.mk
index d7d15f5..7573ed2 100644
--- a/plat/nvidia/tegra/soc/t194/platform_t194.mk
+++ b/plat/nvidia/tegra/soc/t194/platform_t194.mk
@@ -40,11 +40,10 @@
 
 BL31_SOURCES		+=	drivers/ti/uart/aarch64/16550_console.S \
 				lib/cpus/aarch64/denver.S		\
-				${COMMON_DIR}/drivers/bpmp_ipc/intf.c	\
-				${COMMON_DIR}/drivers/bpmp_ipc/ivc.c	\
-				${COMMON_DIR}/drivers/gpcdma/gpcdma.c	\
-				${COMMON_DIR}/drivers/memctrl/memctrl_v2.c	\
-				${COMMON_DIR}/drivers/smmu/smmu.c	\
+				${TEGRA_DRIVERS}/bpmp_ipc/intf.c	\
+				${TEGRA_DRIVERS}/bpmp_ipc/ivc.c		\
+				${TEGRA_DRIVERS}/memctrl/memctrl_v2.c	\
+				${TEGRA_DRIVERS}/smmu/smmu.c		\
 				${SOC_DIR}/drivers/mce/mce.c		\
 				${SOC_DIR}/drivers/mce/nvg.c		\
 				${SOC_DIR}/drivers/mce/aarch64/nvg_helpers.S \
@@ -57,8 +56,12 @@
 				${SOC_DIR}/plat_smmu.c			\
 				${SOC_DIR}/plat_trampoline.S
 
+ifeq (${USE_GPC_DMA}, 1)
+BL31_SOURCES		+=	${TEGRA_DRIVERS}/gpcdma/gpcdma.c
+endif
+
 ifeq (${ENABLE_CONSOLE_SPE},1)
-BL31_SOURCES		+=	${COMMON_DIR}/drivers/spe/shared_console.S
+BL31_SOURCES		+=	${TEGRA_DRIVERS}/spe/shared_console.S
 endif
 
 # RAS sources
diff --git a/plat/nvidia/tegra/soc/t210/platform_t210.mk b/plat/nvidia/tegra/soc/t210/platform_t210.mk
index 14e3324..6c4c175 100644
--- a/plat/nvidia/tegra/soc/t210/platform_t210.mk
+++ b/plat/nvidia/tegra/soc/t210/platform_t210.mk
@@ -25,20 +25,20 @@
 
 ENABLE_TEGRA_WDT_LEGACY_FIQ_HANDLING	:= 1
 
-PLAT_INCLUDES		+=	-Iplat/nvidia/tegra/include/t210 \
+PLAT_INCLUDES		+=	-Iplat/nvidia/tegra/include/t210		\
 				-I${SOC_DIR}/drivers/se
 
 BL31_SOURCES		+=	drivers/ti/uart/aarch64/16550_console.S		\
 				lib/cpus/aarch64/cortex_a53.S			\
 				lib/cpus/aarch64/cortex_a57.S			\
-				${COMMON_DIR}/drivers/bpmp/bpmp.c		\
-				${COMMON_DIR}/drivers/flowctrl/flowctrl.c	\
-				${COMMON_DIR}/drivers/memctrl/memctrl_v1.c	\
-				${COMMON_DIR}/drivers/pmc/pmc.c			\
+				${TEGRA_DRIVERS}/bpmp/bpmp.c			\
+				${TEGRA_DRIVERS}/flowctrl/flowctrl.c		\
+				${TEGRA_DRIVERS}/memctrl/memctrl_v1.c		\
+				${TEGRA_DRIVERS}/pmc/pmc.c			\
 				${SOC_DIR}/plat_psci_handlers.c			\
 				${SOC_DIR}/plat_setup.c				\
 				${SOC_DIR}/drivers/se/security_engine.c		\
-				${SOC_DIR}/plat_secondary.c		\
+				${SOC_DIR}/plat_secondary.c			\
 				${SOC_DIR}/plat_sip_calls.c
 
 # Enable workarounds for selected Cortex-A57 erratas.
diff --git a/plat/qemu/common/qemu_common.c b/plat/qemu/common/qemu_common.c
index 365cfb7..7f8e4c4 100644
--- a/plat/qemu/common/qemu_common.c
+++ b/plat/qemu/common/qemu_common.c
@@ -1,5 +1,6 @@
+
 /*
- * Copyright (c) 2015-2019, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -77,7 +78,11 @@
 	MAP_DEVICE2,
 #endif
 	MAP_NS_DRAM0,
+#if SPM_MM
+	QEMU_SP_IMAGE_MMAP,
+#else
 	MAP_BL32_MEM,
+#endif
 	{0}
 };
 #endif
@@ -88,7 +93,11 @@
 #ifdef MAP_DEVICE1
 	MAP_DEVICE1,
 #endif
+#if SPM_MM
+	QEMU_SPM_BUF_EL3_MMAP,
+#else
 	MAP_BL32_MEM,
+#endif
 	{0}
 };
 #endif
diff --git a/plat/qemu/common/qemu_spm.c b/plat/qemu/common/qemu_spm.c
new file mode 100644
index 0000000..e9ab1a5
--- /dev/null
+++ b/plat/qemu/common/qemu_spm.c
@@ -0,0 +1,81 @@
+/* SPDX-License-Identifier: BSD-3-Clause
+ *
+ * Copyright (c) 2020, Linaro Limited and Contributors. All rights reserved.
+ */
+
+#include <bl31/ehf.h>
+#include <lib/xlat_tables/xlat_tables_compat.h>
+#include <services/spm_mm_partition.h>
+
+#include <platform_def.h>
+
+/* Region equivalent to MAP_DEVICE1 suitable for mapping at EL0 */
+#define MAP_DEVICE1_EL0	MAP_REGION_FLAT(DEVICE1_BASE,			\
+					DEVICE1_SIZE,			\
+					MT_DEVICE | MT_RW | MT_SECURE | MT_USER)
+
+const mmap_region_t plat_qemu_secure_partition_mmap[] = {
+	MAP_DEVICE1_EL0, /* for the UART */
+	QEMU_SP_IMAGE_MMAP,
+	QEMU_SPM_BUF_EL0_MMAP,
+	QEMU_SP_IMAGE_NS_BUF_MMAP,
+	QEMU_SP_IMAGE_RW_MMAP,
+	{0}
+};
+
+/*
+ * Boot information passed to a secure partition during initialisation.
+ * Linear indices in MP information will be filled at runtime.
+ */
+static spm_mm_mp_info_t sp_mp_info[] = {
+	[0] = {0x80000000, 0},
+	[1] = {0x80000001, 0},
+	[2] = {0x80000002, 0},
+	[3] = {0x80000003, 0},
+	[4] = {0x80000004, 0},
+	[5] = {0x80000005, 0},
+	[6] = {0x80000006, 0},
+	[7] = {0x80000007, 0}
+};
+
+const spm_mm_boot_info_t plat_qemu_secure_partition_boot_info = {
+	.h.type              = PARAM_SP_IMAGE_BOOT_INFO,
+	.h.version           = VERSION_1,
+	.h.size              = sizeof(spm_mm_boot_info_t),
+	.h.attr              = 0,
+	.sp_mem_base         = PLAT_QEMU_SP_IMAGE_BASE,
+	.sp_mem_limit        = BL32_LIMIT,
+	.sp_image_base       = PLAT_QEMU_SP_IMAGE_BASE,
+	.sp_stack_base       = PLAT_SP_IMAGE_STACK_BASE,
+	.sp_heap_base        = PLAT_QEMU_SP_IMAGE_HEAP_BASE,
+	.sp_ns_comm_buf_base = PLAT_QEMU_SP_IMAGE_NS_BUF_BASE,
+	.sp_shared_buf_base  = PLAT_SPM_BUF_BASE,
+	.sp_image_size       = PLAT_QEMU_SP_IMAGE_SIZE,
+	.sp_pcpu_stack_size  = PLAT_SP_IMAGE_STACK_PCPU_SIZE,
+	.sp_heap_size        = PLAT_QEMU_SP_IMAGE_HEAP_SIZE,
+	.sp_ns_comm_buf_size = PLAT_QEMU_SP_IMAGE_NS_BUF_SIZE,
+	.sp_shared_buf_size  = PLAT_SPM_BUF_SIZE,
+	.num_sp_mem_regions  = PLAT_QEMU_SP_IMAGE_NUM_MEM_REGIONS,
+	.num_cpus            = PLATFORM_CORE_COUNT,
+	.mp_info             = sp_mp_info
+};
+
+/* Enumeration of priority levels on QEMU platforms. */
+ehf_pri_desc_t qemu_exceptions[] = {
+	EHF_PRI_DESC(QEMU_PRI_BITS, PLAT_SP_PRI)
+};
+
+/* Plug in QEMU exceptions to Exception Handling Framework. */
+EHF_REGISTER_PRIORITIES(qemu_exceptions, ARRAY_SIZE(qemu_exceptions),
+			QEMU_PRI_BITS);
+
+const mmap_region_t *plat_get_secure_partition_mmap(void *cookie)
+{
+	return plat_qemu_secure_partition_mmap;
+}
+
+const spm_mm_boot_info_t *
+plat_get_secure_partition_boot_info(void *cookie)
+{
+	return &plat_qemu_secure_partition_boot_info;
+}
diff --git a/plat/qemu/qemu_sbsa/include/platform_def.h b/plat/qemu/qemu_sbsa/include/platform_def.h
index d0a56cf..7634005 100644
--- a/plat/qemu/qemu_sbsa/include/platform_def.h
+++ b/plat/qemu/qemu_sbsa/include/platform_def.h
@@ -1,10 +1,11 @@
 /* SPDX-License-Identifier: BSD-3-Clause
  *
- * Copyright (c) 2019, Linaro Limited and Contributors. All rights reserved.
+ * Copyright (c) 2019-2020, Linaro Limited and Contributors.
+ * All rights reserved.
  */
 
-#ifndef __PLATFORM_DEF_H__
-#define __PLATFORM_DEF_H__
+#ifndef PLATFORM_DEF_H
+#define PLATFORM_DEF_H
 
 #include <arch.h>
 #include <plat/common/common_def.h>
@@ -107,9 +108,10 @@
  * Put BL1 RW at the top of the Secure SRAM. BL1_RW_BASE is calculated using
  * the current BL1 RW debug size plus a little space for growth.
  */
+#define BL1_SIZE			0x12000
 #define BL1_RO_BASE			SEC_ROM_BASE
 #define BL1_RO_LIMIT			(SEC_ROM_BASE + SEC_ROM_SIZE)
-#define BL1_RW_BASE			(BL1_RW_LIMIT - 0x12000)
+#define BL1_RW_BASE			(BL1_RW_LIMIT - BL1_SIZE)
 #define BL1_RW_LIMIT			(BL_RAM_BASE + BL_RAM_SIZE)
 
 /*
@@ -118,7 +120,8 @@
  * Put BL2 just below BL3-1. BL2_BASE is calculated using the current BL2 debug
  * size plus a little space for growth.
  */
-#define BL2_BASE			(BL31_BASE - 0x1D000)
+#define BL2_SIZE			0x1D000
+#define BL2_BASE			(BL31_BASE - BL2_SIZE)
 #define BL2_LIMIT			BL31_BASE
 
 /*
@@ -127,8 +130,9 @@
  * Put BL3-1 at the top of the Trusted SRAM. BL31_BASE is calculated using the
  * current BL3-1 debug size plus a little space for growth.
  */
-#define BL31_BASE			(BL31_LIMIT - 0x20000)
-#define BL31_LIMIT			(BL_RAM_BASE + BL_RAM_SIZE)
+#define BL31_SIZE			0x50000
+#define BL31_BASE			(BL31_LIMIT - BL31_SIZE)
+#define BL31_LIMIT			(BL1_RW_BASE)
 #define BL31_PROGBITS_LIMIT		BL1_RW_BASE
 
 
@@ -138,12 +142,11 @@
  * BL3-2 can execute from Secure SRAM, or Secure DRAM.
  */
 #define BL32_SRAM_BASE			BL_RAM_BASE
-#define BL32_SRAM_LIMIT			BL31_BASE
-#define BL32_DRAM_BASE			SEC_DRAM_BASE
-#define BL32_DRAM_LIMIT			(SEC_DRAM_BASE + SEC_DRAM_SIZE)
+#define BL32_SRAM_LIMIT			BL2_BASE
 
 #define BL32_MEM_BASE			BL_RAM_BASE
-#define BL32_MEM_SIZE			BL_RAM_SIZE
+#define BL32_MEM_SIZE			(BL_RAM_SIZE - BL1_SIZE - \
+					BL2_SIZE - BL31_SIZE)
 #define BL32_BASE			BL32_SRAM_BASE
 #define BL32_LIMIT			BL32_SRAM_LIMIT
 
@@ -152,11 +155,21 @@
 
 #define PLAT_PHY_ADDR_SPACE_SIZE	(1ull << 42)
 #define PLAT_VIRT_ADDR_SPACE_SIZE	(1ull << 42)
+#if SPM_MM
+#define MAX_MMAP_REGIONS		12
+#define MAX_XLAT_TABLES			11
+#else
 #define MAX_MMAP_REGIONS		11
 #define MAX_XLAT_TABLES			10
+#endif
 #define MAX_IO_DEVICES			3
 #define MAX_IO_HANDLES			4
 
+#if SPM_MM && defined(IMAGE_BL31)
+# define PLAT_SP_IMAGE_MMAP_REGIONS	30
+# define PLAT_SP_IMAGE_MAX_XLAT_TABLES	20
+#endif
+
 /*
  * PL011 related constants
  */
@@ -165,6 +178,10 @@
 #define UART0_CLK_IN_HZ			1
 #define UART1_CLK_IN_HZ			1
 
+/* Secure UART */
+#define UART2_BASE			0x60040000
+#define UART2_CLK_IN_HZ			1
+
 #define PLAT_QEMU_BOOT_UART_BASE	UART0_BASE
 #define PLAT_QEMU_BOOT_UART_CLK_IN_HZ	UART0_CLK_IN_HZ
 
@@ -179,7 +196,7 @@
 #define QEMU_FLASH1_SIZE		0x10000000
 
 #define PLAT_QEMU_FIP_BASE		0x00008000
-#define PLAT_QEMU_FIP_MAX_SIZE		0x00020000
+#define PLAT_QEMU_FIP_MAX_SIZE		0x00400000
 
 /* This is map from GIC_DIST up to last CPU (255) GIC_REDISTR */
 #define DEVICE0_BASE			0x40000000
@@ -240,4 +257,99 @@
  */
 #define SYS_COUNTER_FREQ_IN_TICKS	((1000 * 1000 * 1000) / 16)
 
+#if SPM_MM
+#define PLAT_QEMU_SP_IMAGE_BASE		BL_RAM_BASE
+#define PLAT_QEMU_SP_IMAGE_SIZE		ULL(0x300000)
+
+#ifdef IMAGE_BL2
+/* In BL2 all memory allocated to the SPM Payload image is marked as RW. */
+# define QEMU_SP_IMAGE_MMAP		MAP_REGION_FLAT( \
+						PLAT_QEMU_SP_IMAGE_BASE, \
+						PLAT_QEMU_SP_IMAGE_SIZE, \
+						MT_MEMORY | MT_RW | \
+						MT_SECURE)
+#elif IMAGE_BL31
+/* All SPM Payload memory is marked as code in S-EL0 */
+# define QEMU_SP_IMAGE_MMAP		MAP_REGION2(PLAT_QEMU_SP_IMAGE_BASE, \
+						PLAT_QEMU_SP_IMAGE_BASE, \
+						PLAT_QEMU_SP_IMAGE_SIZE, \
+						MT_CODE | MT_SECURE | \
+						MT_USER,		\
+						PAGE_SIZE)
+#endif
+
+/*
+ * EL3 -> S-EL0 secure shared memory
+ */
+#define PLAT_SPM_BUF_PCPU_SIZE		ULL(0x10000)
+#define PLAT_SPM_BUF_SIZE		(PLATFORM_CORE_COUNT * \
+					PLAT_SPM_BUF_PCPU_SIZE)
+#define PLAT_SPM_BUF_BASE		(BL32_LIMIT - PLAT_SPM_BUF_SIZE)
+
+#define QEMU_SPM_BUF_EL3_MMAP		MAP_REGION_FLAT(PLAT_SPM_BUF_BASE, \
+						PLAT_SPM_BUF_SIZE, \
+						MT_RW_DATA | MT_SECURE)
+
+#define QEMU_SPM_BUF_EL0_MMAP		MAP_REGION2(PLAT_SPM_BUF_BASE,	\
+						PLAT_SPM_BUF_BASE,	\
+						PLAT_SPM_BUF_SIZE,	\
+						MT_RO_DATA | MT_SECURE | \
+						MT_USER,		\
+						PAGE_SIZE)
+
+/*
+ * Shared memory between Normal world and S-EL0 for
+ * passing data during service requests. It will be marked as RW and NS.
+ */
+#define PLAT_QEMU_SP_IMAGE_NS_BUF_BASE	(PLAT_QEMU_DT_BASE +		\
+						PLAT_QEMU_DT_MAX_SIZE)
+#define PLAT_QEMU_SP_IMAGE_NS_BUF_SIZE	ULL(0x10000)
+#define QEMU_SP_IMAGE_NS_BUF_MMAP	MAP_REGION2( \
+					PLAT_QEMU_SP_IMAGE_NS_BUF_BASE, \
+					PLAT_QEMU_SP_IMAGE_NS_BUF_BASE, \
+					PLAT_QEMU_SP_IMAGE_NS_BUF_SIZE, \
+					MT_RW_DATA | MT_NS | \
+					MT_USER, \
+					PAGE_SIZE)
+
+#define PLAT_SP_IMAGE_NS_BUF_BASE	PLAT_QEMU_SP_IMAGE_NS_BUF_BASE
+#define PLAT_SP_IMAGE_NS_BUF_SIZE	PLAT_QEMU_SP_IMAGE_NS_BUF_SIZE
+
+#define PLAT_QEMU_SP_IMAGE_HEAP_BASE	(PLAT_QEMU_SP_IMAGE_BASE + \
+					PLAT_QEMU_SP_IMAGE_SIZE)
+#define PLAT_QEMU_SP_IMAGE_HEAP_SIZE	ULL(0x800000)
+
+#define PLAT_SP_IMAGE_STACK_BASE	(PLAT_QEMU_SP_IMAGE_HEAP_BASE + \
+						PLAT_QEMU_SP_IMAGE_HEAP_SIZE)
+#define PLAT_SP_IMAGE_STACK_PCPU_SIZE	ULL(0x10000)
+#define QEMU_SP_IMAGE_STACK_TOTAL_SIZE	(PLATFORM_CORE_COUNT * \
+						PLAT_SP_IMAGE_STACK_PCPU_SIZE)
+
+#define QEMU_SP_IMAGE_RW_MMAP		MAP_REGION2( \
+					PLAT_QEMU_SP_IMAGE_HEAP_BASE, \
+					PLAT_QEMU_SP_IMAGE_HEAP_BASE, \
+					(QEMU_SP_IMAGE_STACK_TOTAL_SIZE + \
+					PLAT_QEMU_SP_IMAGE_HEAP_SIZE), \
+					MT_RW_DATA | MT_SECURE | \
+					MT_USER, \
+					PAGE_SIZE)
+
+/* Total number of memory regions with distinct properties */
+#define PLAT_QEMU_SP_IMAGE_NUM_MEM_REGIONS	6
+
+/*
+ * Name of the section to put the translation tables used by the S-EL1/S-EL0
+ * context of a Secure Partition.
+ */
+#define PLAT_SP_IMAGE_XLAT_SECTION_NAME		"qemu_sp_xlat_table"
+#define PLAT_SP_IMAGE_BASE_XLAT_SECTION_NAME	"qemu_sp_xlat_table"
+
+/* Cookies passed to the Secure Partition at boot. Not used by QEMU platforms.*/
+#define PLAT_SPM_COOKIE_0		ULL(0)
+#define PLAT_SPM_COOKIE_1		ULL(0)
+#endif
+
+#define QEMU_PRI_BITS		2
+#define PLAT_SP_PRI		0x20
+
-#endif /* __PLATFORM_DEF_H__ */
+#endif /* PLATFORM_DEF_H */
diff --git a/plat/qemu/qemu_sbsa/platform.mk b/plat/qemu/qemu_sbsa/platform.mk
index 09856d6..3aa7cbe 100644
--- a/plat/qemu/qemu_sbsa/platform.mk
+++ b/plat/qemu/qemu_sbsa/platform.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2019, Linaro Limited and Contributors. All rights reserved.
+# Copyright (c) 2019-2020, Linaro Limited and Contributors. All rights reserved.
 #
 # SPDX-License-Identifier: BSD-3-Clause
 #
@@ -8,6 +8,12 @@
 
 include lib/libfdt/libfdt.mk
 
+ifeq (${SPM_MM},1)
+NEED_BL32		:=	yes
+EL3_EXCEPTION_HANDLING	:=	1
+GICV2_G0_FOR_EL3	:=	1
+endif
+
 # Enable new version of image loading on QEMU platforms
 LOAD_IMAGE_V2		:=	1
 
@@ -80,6 +86,9 @@
 				${PLAT_QEMU_COMMON_PATH}/aarch64/plat_helpers.S	\
 				${PLAT_QEMU_COMMON_PATH}/qemu_bl31_setup.c	\
 				${QEMU_GIC_SOURCES}
+ifeq (${SPM_MM},1)
+	BL31_SOURCES		+=	${PLAT_QEMU_COMMON_PATH}/qemu_spm.c
+endif
 
 SEPARATE_CODE_AND_RODATA	:= 1
 ENABLE_STACK_PROTECTOR		:= 0
diff --git a/plat/qti/common/inc/qti_rng.h b/plat/qti/common/inc/qti_rng.h
index c933dea..62c31f3 100644
--- a/plat/qti/common/inc/qti_rng.h
+++ b/plat/qti/common/inc/qti_rng.h
@@ -7,7 +7,7 @@
 #ifndef QTI_RNG_H
 #define QTI_RNG_H
 
-#include <stdinit.h>
+#include <stdint.h>
 
 int qti_rng_get_data(uint8_t *out, uint32_t out_len);
 
diff --git a/plat/qti/common/src/qti_rng.c b/plat/qti/common/src/qti_rng.c
index a904209..f63f3b8 100644
--- a/plat/qti/common/src/qti_rng.c
+++ b/plat/qti/common/src/qti_rng.c
@@ -4,10 +4,10 @@
  * SPDX-License-Identifier: BSD-3-Clause
  */
 #include <stddef.h>
-#include <stdint.h>
 
 #include <lib/mmio.h>
 
+#include <qti_rng.h>
 #include <qti_rng_io.h>
 
 int qti_rng_get_data(uint8_t *out, uint32_t out_len)
diff --git a/plat/st/stm32mp1/sp_min/sp_min-stm32mp1.mk b/plat/st/stm32mp1/sp_min/sp_min-stm32mp1.mk
index 5d7d495..8866fb5 100644
--- a/plat/st/stm32mp1/sp_min/sp_min-stm32mp1.mk
+++ b/plat/st/stm32mp1/sp_min/sp_min-stm32mp1.mk
@@ -16,9 +16,9 @@
 				plat/st/stm32mp1/stm32mp1_topology.c
 
 # Generic GIC v2
-BL32_SOURCES		+=	drivers/arm/gic/common/gic_common.c	\
-				drivers/arm/gic/v2/gicv2_helpers.c	\
-				drivers/arm/gic/v2/gicv2_main.c		\
+include drivers/arm/gic/v2/gicv2.mk
+
+BL32_SOURCES		+=	${GICV2_SOURCES}			\
 				plat/common/plat_gicv2.c		\
 				plat/st/stm32mp1/stm32mp1_gic.c
 
diff --git a/services/spd/tlkd/tlkd_common.c b/services/spd/tlkd/tlkd_common.c
index dbe6c2e..820bd8a 100644
--- a/services/spd/tlkd/tlkd_common.c
+++ b/services/spd/tlkd/tlkd_common.c
@@ -38,16 +38,16 @@
 	int at = type & AT_MASK;
 	switch (at) {
 	case 0:
-		ats12e1r(va);
+		AT(ats12e1r, va);
 		break;
 	case 1:
-		ats12e1w(va);
+		AT(ats12e1w, va);
 		break;
 	case 2:
-		ats12e0r(va);
+		AT(ats12e0r, va);
 		break;
 	case 3:
-		ats12e0w(va);
+		AT(ats12e0w, va);
 		break;
 	default:
 		assert(0); /* Unreachable */
diff --git a/tools/sptool/sp_mk_generator.py b/tools/sptool/sp_mk_generator.py
index 2153a56..a37e702 100755
--- a/tools/sptool/sp_mk_generator.py
+++ b/tools/sptool/sp_mk_generator.py
@@ -19,6 +19,7 @@
 param1: Generated mk file "sp_gen.mk"
 param2: "SP_LAYOUT_FILE", json file containing platform provided information
 param3: plat out directory
+param4: CoT parameter
 
 Generated "sp_gen.mk" file contains triplet of following information for each
 Secure Partition entry
@@ -58,11 +59,39 @@
 gen_file = os.path.abspath(sys.argv[1])
 out_dir = os.path.abspath(sys.argv[3])
 dtb_dir = out_dir + "/fdts/"
+MAX_SP = 8
+dualroot = sys.argv[4].lower() == "dualroot"
+split = int(MAX_SP / 2)
 print(dtb_dir)
+platform_count = 1
+sip_count = 1
 
 with open(gen_file, 'w') as out_file:
     for idx, key in enumerate(data.keys()):
 
+        pkg_num = idx + 1
+
+        if (pkg_num > MAX_SP):
+            print("WARNING: Too many secure partitions\n")
+            exit(-1)
+
+        if dualroot:
+            owner = data[key].get('owner')
+            if owner == "Plat":
+                if (platform_count > split):
+                    print("WARNING: Maximum Secure partitions by Plat " +
+                    "have been exceeded (" + str(split) + ")\n")
+                    exit(-1)
+                pkg_num = split + platform_count
+                platform_count += 1
+            elif (sip_count > split):
+                print("WARNING: Maximum Secure partitions by SiP " +
+                "have been exceeded (" + str(split) + ")\n")
+                exit(-1)
+            else:
+                pkg_num = sip_count
+                sip_count += 1
+
         """
         Append FDT_SOURCES
         """
@@ -81,10 +110,10 @@
         Extract uuid from partition manifest
         """
         pm_file = open(dts)
-        key = "uuid"
+        uuid_key = "uuid"
 
         for line in pm_file:
-            if key in line:
+            if uuid_key in line:
                 uuid_hex = re.findall(r'\<(.+?)\>', line)[0];
 
         # PM has uuid in format 0xABC... 0x... 0x... 0x...
@@ -103,5 +132,6 @@
         """
         Append CRT_ARGS
         """
-        out_file.write("CRT_ARGS += --sp-pkg" + str(idx + 1) + " " + dst + "\n")
+
+        out_file.write("CRT_ARGS += --sp-pkg" + str(pkg_num) + " " + dst + "\n")
         out_file.write("\n")