diff --git a/bl2/bl2_image_load_v2.c b/bl2/bl2_image_load_v2.c
index dd53e1d..1fbdbab 100644
--- a/bl2/bl2_image_load_v2.c
+++ b/bl2/bl2_image_load_v2.c
@@ -68,7 +68,8 @@
 			err = load_auth_image(bl2_node_info->image_id,
 				bl2_node_info->image_info);
 			if (err) {
-				ERROR("BL2: Failed to load image (%i)\n", err);
+				ERROR("BL2: Failed to load image id %d (%i)\n",
+				      bl2_node_info->image_id, err);
 				plat_error_handler(err);
 			}
 		} else {
diff --git a/bl31/aarch64/bl31_entrypoint.S b/bl31/aarch64/bl31_entrypoint.S
index 665a05e..2d672dd 100644
--- a/bl31/aarch64/bl31_entrypoint.S
+++ b/bl31/aarch64/bl31_entrypoint.S
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2019, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2013-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -110,13 +110,17 @@
 	 * caches and participate in coherency.
 	 * --------------------------------------------------------------------
 	 */
-	adr	x0, __DATA_START__
-	adr	x1, __DATA_END__
+	adrp	x0, __DATA_START__
+	add	x0, x0, :lo12:__DATA_START__
+	adrp	x1, __DATA_END__
+	add	x1, x1, :lo12:__DATA_END__
 	sub	x1, x1, x0
 	bl	clean_dcache_range
 
-	adr	x0, __BSS_START__
-	adr	x1, __BSS_END__
+	adrp	x0, __BSS_START__
+	add	x0, x0, :lo12:__BSS_START__
+	adrp	x1, __BSS_END__
+	add	x1, x1, :lo12:__BSS_END__
 	sub	x1, x1, x0
 	bl	clean_dcache_range
 
diff --git a/bl31/aarch64/runtime_exceptions.S b/bl31/aarch64/runtime_exceptions.S
index 7f739a9..5b37388 100644
--- a/bl31/aarch64/runtime_exceptions.S
+++ b/bl31/aarch64/runtime_exceptions.S
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2019, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2013-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -414,7 +414,8 @@
 	orr	x16, x16, x15, lsl #FUNCID_OEN_WIDTH
 
 	/* Load descriptor index from array of indices */
-	adr	x14, rt_svc_descs_indices
+	adrp	x14, rt_svc_descs_indices
+	add	x14, x14, :lo12:rt_svc_descs_indices
 	ldrb	w15, [x14, x16]
 
 	/* Any index greater than 127 is invalid. Check bit 7. */
diff --git a/bl31/bl31.ld.S b/bl31/bl31.ld.S
index c7185a8..4a1c5f3 100644
--- a/bl31/bl31.ld.S
+++ b/bl31/bl31.ld.S
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2019, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2013-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -208,6 +208,7 @@
      * Define a linker symbol to mark end of the RW memory area for this
      * image.
      */
+    . = ALIGN(PAGE_SIZE);
     __RW_END__ = .;
     __BL31_END__ = .;
 
diff --git a/common/fdt_wrappers.c b/common/fdt_wrappers.c
index e67fdb0..ca5b455 100644
--- a/common/fdt_wrappers.c
+++ b/common/fdt_wrappers.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2018-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -103,6 +103,41 @@
 }
 
 /*
+ * Read bytes from a given property of the given node. Any number of
+ * bytes of the property can be read. The fdt pointer is updated.
+ * Returns 0 on success, and -1 on error.
+ */
+int fdtw_read_bytes(const void *dtb, int node, const char *prop,
+		    unsigned int length, void *value)
+{
+	const void *ptr;
+	int value_len;
+
+	assert(dtb != NULL);
+	assert(prop != NULL);
+	assert(value != NULL);
+	assert(node >= 0);
+
+	/* Access property and obtain its length (in bytes) */
+	ptr = fdt_getprop_namelen(dtb, node, prop, (int)strlen(prop),
+					&value_len);
+	if (ptr == NULL) {
+		WARN("Couldn't find property %s in dtb\n", prop);
+		return -1;
+	}
+
+	/* Verify that property length is not less than number of bytes */
+	if ((unsigned int)value_len < length) {
+		WARN("Property length mismatch\n");
+		return -1;
+	}
+
+	(void)memcpy(value, ptr, length);
+
+	return 0;
+}
+
+/*
  * Read string from a given property of the given node. Up to 'size - 1'
  * characters are read, and a NUL terminator is added. Returns 0 on success,
  * and -1 upon error.
@@ -167,3 +202,45 @@
 
 	return 0;
 }
+
+/*
+ * Write bytes in place to a given property of the given node.
+ * Any number of bytes of the property can be written.
+ * Returns 0 on success, and < 0 on error.
+ */
+int fdtw_write_inplace_bytes(void *dtb, int node, const char *prop,
+			     unsigned int length, const void *data)
+{
+	const void *ptr;
+	int namelen, value_len, err;
+
+	assert(dtb != NULL);
+	assert(prop != NULL);
+	assert(data != NULL);
+	assert(node >= 0);
+
+	namelen = (int)strlen(prop);
+
+	/* Access property and obtain its length in bytes */
+	ptr = fdt_getprop_namelen(dtb, node, prop, namelen, &value_len);
+	if (ptr == NULL) {
+		WARN("Couldn't find property %s in dtb\n", prop);
+		return -1;
+	}
+
+	/* Verify that property length is not less than number of bytes */
+	if ((unsigned int)value_len < length) {
+		WARN("Property length mismatch\n");
+		return -1;
+	}
+
+	/* Set property value in place */
+	err = fdt_setprop_inplace_namelen_partial(dtb, node, prop,
+						  namelen, 0,
+						  data, (int)length);
+	if (err != 0) {
+		WARN("Set property %s failed with error %d\n", prop, err);
+	}
+
+	return err;
+}
diff --git a/docs/plat/qemu.rst b/docs/plat/qemu.rst
index a4c5bec..88196bc 100644
--- a/docs/plat/qemu.rst
+++ b/docs/plat/qemu.rst
@@ -14,7 +14,7 @@
 via register x0, as expected by a Linux kernel. This allows a Linux kernel image
 to be booted directly as BL33 rather than using a bootloader.
 
-An ARM64 defconfig v4.5 Linux kernel is known to boot, FDT doesn't need to be
+An ARM64 defconfig v5.5 Linux kernel is known to boot, FDT doesn't need to be
 provided as it's generated by QEMU.
 
 Current limitations:
@@ -24,7 +24,7 @@
 -  No instructions for how to load a BL32 (Secure Payload)
 
 ``QEMU_EFI.fd`` can be dowloaded from
-http://snapshots.linaro.org/components/kernel/leg-virt-tianocore-edk2-upstream/latest/QEMU-KERNEL-AARCH64/RELEASE_GCC49/QEMU_EFI.fd
+http://snapshots.linaro.org/components/kernel/leg-virt-tianocore-edk2-upstream/latest/QEMU-KERNEL-AARCH64/RELEASE_GCC5/QEMU_EFI.fd
 
 Boot binaries, except BL1, are primarily loaded via semi-hosting so all
 binaries has to reside in the same directory as QEMU is started from. This
@@ -33,7 +33,7 @@
 -  ``bl2.bin`` -> BL2
 -  ``bl31.bin`` -> BL31
 -  ``bl33.bin`` -> BL33 (``QEMU_EFI.fd``)
--  ``Image`` -> linux/Image
+-  ``Image`` -> linux/arch/arm64/boot/Image
 
 To build:
 
@@ -41,12 +41,12 @@
 
     make CROSS_COMPILE=aarch64-none-elf- PLAT=qemu
 
-To start (QEMU v2.6.0):
+To start (QEMU v4.1.0):
 
 .. code:: shell
 
     qemu-system-aarch64 -nographic -machine virt,secure=on -cpu cortex-a57  \
         -kernel Image                           \
-        -append console=ttyAMA0,38400 keep_bootcon root=/dev/vda2   \
+        -append "console=ttyAMA0,38400 keep_bootcon root=/dev/vda2"   \
         -initrd rootfs-arm64.cpio.gz -smp 2 -m 1024 -bios bl1.bin   \
         -d unimp -semihosting-config enable,target=native
diff --git a/include/common/fdt_wrappers.h b/include/common/fdt_wrappers.h
index 79d001d..f467958 100644
--- a/include/common/fdt_wrappers.h
+++ b/include/common/fdt_wrappers.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2018-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -20,5 +20,9 @@
 		char *str, size_t size);
 int fdtw_write_inplace_cells(void *dtb, int node, const char *prop,
 		unsigned int cells, void *value);
+int fdtw_read_bytes(const void *dtb, int node, const char *prop,
+		unsigned int length, void *value);
+int fdtw_write_inplace_bytes(void *dtb, int node, const char *prop,
+		unsigned int length, const void *data);
 
 #endif /* FDT_WRAPPERS_H */
diff --git a/include/plat/arm/common/arm_def.h b/include/plat/arm/common/arm_def.h
index b419c85..5bd53f3 100644
--- a/include/plat/arm/common/arm_def.h
+++ b/include/plat/arm/common/arm_def.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2019, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -395,13 +395,21 @@
 /*******************************************************************************
  * BL31 specific defines.
  ******************************************************************************/
-#if ARM_BL31_IN_DRAM
+#if ARM_BL31_IN_DRAM || SEPARATE_NOBITS_REGION
 /*
  * Put BL31 at the bottom of TZC secured DRAM
  */
 #define BL31_BASE			ARM_AP_TZC_DRAM1_BASE
 #define BL31_LIMIT			(ARM_AP_TZC_DRAM1_BASE +	\
 						PLAT_ARM_MAX_BL31_SIZE)
+/*
+ * For SEPARATE_NOBITS_REGION, BL31 PROGBITS are loaded in TZC secured DRAM.
+ * And BL31 NOBITS are loaded in Trusted SRAM such that BL2 is overwritten.
+ */
+#if SEPARATE_NOBITS_REGION
+#define BL31_NOBITS_BASE		BL2_BASE
+#define BL31_NOBITS_LIMIT		BL2_LIMIT
+#endif /* SEPARATE_NOBITS_REGION */
 #elif (RESET_TO_BL31)
 /* Ensure Position Independent support (PIE) is enabled for this config.*/
 # if !ENABLE_PIE
diff --git a/lib/debugfs/devfip.c b/lib/debugfs/devfip.c
index 5581b21..fc14e70 100644
--- a/lib/debugfs/devfip.c
+++ b/lib/debugfs/devfip.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2019, Arm Limited. All rights reserved.
+ * Copyright (c) 2019-2020, Arm Limited. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -103,10 +103,6 @@
 		return -1;
 	}
 
-	if ((entry->size > LONG_MAX) || (entry->offset_address > LONG_MAX)) {
-		return -1;
-	}
-
 	if (entry->size == 0) {
 		return 0;
 	}
diff --git a/lib/el3_runtime/aarch64/cpu_data.S b/lib/el3_runtime/aarch64/cpu_data.S
index 2edf225..2392d6b 100644
--- a/lib/el3_runtime/aarch64/cpu_data.S
+++ b/lib/el3_runtime/aarch64/cpu_data.S
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2016, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2014-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -41,7 +41,8 @@
 func _cpu_data_by_index
 	mov_imm	x1, CPU_DATA_SIZE
 	mul	x0, x0, x1
-	adr	x1, percpu_data
+	adrp	x1, percpu_data
+	add	x1, x1, :lo12:percpu_data
 	add	x0, x0, x1
 	ret
 endfunc _cpu_data_by_index
diff --git a/lib/romlib/jmptbl.i b/lib/romlib/jmptbl.i
index a7280d0..33710f5 100644
--- a/lib/romlib/jmptbl.i
+++ b/lib/romlib/jmptbl.i
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2018, ARM Limited and Contributors. All rights reserved.
+# Copyright (c) 2018-2020, ARM Limited and Contributors. All rights reserved.
 #
 # SPDX-License-Identifier: BSD-3-Clause
 #
@@ -17,6 +17,7 @@
 fdt	fdt_setprop_inplace
 fdt	fdt_check_header
 fdt	fdt_node_offset_by_compatible
+fdt     fdt_setprop_inplace_namelen_partial
 mbedtls	mbedtls_asn1_get_alg
 mbedtls	mbedtls_asn1_get_alg_null
 mbedtls	mbedtls_asn1_get_bitstring_null
diff --git a/plat/arm/board/fvp/jmptbl.i b/plat/arm/board/fvp/jmptbl.i
index bfa9b56..6ccdd28 100644
--- a/plat/arm/board/fvp/jmptbl.i
+++ b/plat/arm/board/fvp/jmptbl.i
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2018-2019, ARM Limited and Contributors. All rights reserved.
+# Copyright (c) 2018-2020, ARM Limited and Contributors. All rights reserved.
 #
 # SPDX-License-Identifier: BSD-3-Clause
 #
@@ -19,6 +19,7 @@
 fdt     fdt_setprop_inplace
 fdt     fdt_check_header
 fdt     fdt_node_offset_by_compatible
+fdt     fdt_setprop_inplace_namelen_partial
 mbedtls mbedtls_asn1_get_alg
 mbedtls mbedtls_asn1_get_alg_null
 mbedtls mbedtls_asn1_get_bitstring_null
diff --git a/plat/arm/board/juno/jmptbl.i b/plat/arm/board/juno/jmptbl.i
index bfa9b56..6ccdd28 100644
--- a/plat/arm/board/juno/jmptbl.i
+++ b/plat/arm/board/juno/jmptbl.i
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2018-2019, ARM Limited and Contributors. All rights reserved.
+# Copyright (c) 2018-2020, ARM Limited and Contributors. All rights reserved.
 #
 # SPDX-License-Identifier: BSD-3-Clause
 #
@@ -19,6 +19,7 @@
 fdt     fdt_setprop_inplace
 fdt     fdt_check_header
 fdt     fdt_node_offset_by_compatible
+fdt     fdt_setprop_inplace_namelen_partial
 mbedtls mbedtls_asn1_get_alg
 mbedtls mbedtls_asn1_get_alg_null
 mbedtls mbedtls_asn1_get_bitstring_null
diff --git a/plat/arm/common/arm_bl31_setup.c b/plat/arm/common/arm_bl31_setup.c
index 466f535..c135d7f 100644
--- a/plat/arm/common/arm_bl31_setup.c
+++ b/plat/arm/common/arm_bl31_setup.c
@@ -55,6 +55,14 @@
 					MT_CODE | MT_SECURE)
 #endif
 
+#if SEPARATE_NOBITS_REGION
+#define MAP_BL31_NOBITS		MAP_REGION_FLAT(			\
+					BL31_NOBITS_BASE,		\
+					BL31_NOBITS_LIMIT 		\
+						- BL31_NOBITS_BASE,	\
+					MT_MEMORY | MT_RW | MT_SECURE)
+
+#endif
 /*******************************************************************************
  * Return a pointer to the 'entry_point_info' structure of the next image for the
  * security state specified. BL33 corresponds to the non-secure image type
@@ -294,6 +302,9 @@
 #if RECLAIM_INIT_CODE
 		MAP_BL_INIT_CODE,
 #endif
+#if SEPARATE_NOBITS_REGION
+		MAP_BL31_NOBITS,
+#endif
 		ARM_MAP_BL_RO,
 #if USE_ROMLIB
 		ARM_MAP_ROMLIB_CODE,
diff --git a/plat/arm/common/arm_common.mk b/plat/arm/common/arm_common.mk
index c8b7ab4..9f4bc21 100644
--- a/plat/arm/common/arm_common.mk
+++ b/plat/arm/common/arm_common.mk
@@ -125,6 +125,23 @@
 # mapping the former as executable and the latter as execute-never.
 SEPARATE_CODE_AND_RODATA	:=	1
 
+# On ARM platforms, disable SEPARATE_NOBITS_REGION by default. Both PROGBITS
+# and NOBITS sections of BL31 image are adjacent to each other and loaded
+# into Trusted SRAM.
+SEPARATE_NOBITS_REGION		:=	0
+
+# In order to support SEPARATE_NOBITS_REGION for Arm platforms, we need to load
+# BL31 PROGBITS into secure DRAM space and BL31 NOBITS into SRAM. Hence mandate
+# the build to require that ARM_BL31_IN_DRAM is enabled as well.
+ifeq ($(SEPARATE_NOBITS_REGION),1)
+    ifneq ($(ARM_BL31_IN_DRAM),1)
+         $(error For SEPARATE_NOBITS_REGION, ARM_BL31_IN_DRAM must be enabled)
+    endif
+    ifneq ($(RECLAIM_INIT_CODE),0)
+          $(error For SEPARATE_NOBITS_REGION, RECLAIM_INIT_CODE cannot be supported)
+    endif
+endif
+
 # Disable ARM Cryptocell by default
 ARM_CRYPTOCELL_INTEG		:=	0
 $(eval $(call assert_boolean,ARM_CRYPTOCELL_INTEG))
diff --git a/plat/intel/soc/agilex/bl31_plat_setup.c b/plat/intel/soc/agilex/bl31_plat_setup.c
index 375483d..13099b4 100644
--- a/plat/intel/soc/agilex/bl31_plat_setup.c
+++ b/plat/intel/soc/agilex/bl31_plat_setup.c
@@ -11,8 +11,10 @@
 #include <common/bl_common.h>
 #include <drivers/arm/gicv2.h>
 #include <drivers/ti/uart/uart_16550.h>
+#include <lib/mmio.h>
 #include <lib/xlat_tables/xlat_tables.h>
 
+#include "socfpga_private.h"
 
 static entry_point_info_t bl32_image_ep_info;
 static entry_point_info_t bl33_image_ep_info;
@@ -44,23 +46,33 @@
 	void *from_bl2 = (void *) arg0;
 
 	bl_params_t *params_from_bl2 = (bl_params_t *)from_bl2;
-
 	assert(params_from_bl2 != NULL);
-	assert(params_from_bl2->h.type == PARAM_BL_PARAMS);
-	assert(params_from_bl2->h.version >= VERSION_2);
 
 	/*
 	 * Copy BL32 (if populated by BL31) and BL33 entry point information.
 	 * They are stored in Secure RAM, in BL31's address space.
 	 */
 
+	if (params_from_bl2->h.type == PARAM_BL_PARAMS &&
+		params_from_bl2->h.version >= VERSION_2) {
+
-	bl_params_node_t *bl_params = params_from_bl2->head;
+		bl_params_node_t *bl_params = params_from_bl2->head;
 
-	while (bl_params) {
-		if (bl_params->image_id == BL33_IMAGE_ID)
-			bl33_image_ep_info = *bl_params->ep_info;
+		while (bl_params) {
+			if (bl_params->image_id == BL33_IMAGE_ID)
+				bl33_image_ep_info = *bl_params->ep_info;
 
-		bl_params = bl_params->next_params_info;
+			bl_params = bl_params->next_params_info;
+		}
+	} else {
+		struct socfpga_bl31_params *arg_from_bl2 =
+			(struct socfpga_bl31_params *) from_bl2;
+
+		assert(arg_from_bl2->h.type == PARAM_BL31);
+		assert(arg_from_bl2->h.version >= VERSION_1);
+
+		bl32_image_ep_info = *arg_from_bl2->bl32_ep_info;
+		bl33_image_ep_info = *arg_from_bl2->bl33_ep_info;
 	}
 	SET_SECURITY_STATE(bl33_image_ep_info.h.attr, NON_SECURE);
 }
@@ -91,6 +103,10 @@
 	gicv2_distif_init();
 	gicv2_pcpu_distif_init();
 	gicv2_cpuif_enable();
+
+	/* Signal secondary CPUs to jump to BL31 (BL2 = U-boot SPL) */
+	mmio_write_64(PLAT_CPU_RELEASE_ADDR,
+		(uint64_t)plat_secondary_cpus_bl31_entry);
 }
 
 const mmap_region_t plat_agilex_mmap[] = {