diff --git a/bl31/aarch64/runtime_exceptions.S b/bl31/aarch64/runtime_exceptions.S
index 5b37388..bfe13f3 100644
--- a/bl31/aarch64/runtime_exceptions.S
+++ b/bl31/aarch64/runtime_exceptions.S
@@ -12,6 +12,7 @@
 #include <bl31/interrupt_mgmt.h>
 #include <common/runtime_svc.h>
 #include <context.h>
+#include <el3_common_macros.S>
 #include <lib/el3_runtime/cpu_data.h>
 #include <lib/smccc.h>
 
@@ -285,21 +286,25 @@
 	 * to a valid cpu context where the general purpose and system register
 	 * state can be saved.
 	 */
+	apply_at_speculative_wa
 	check_and_unmask_ea
 	handle_sync_exception
 end_vector_entry sync_exception_aarch64
 
 vector_entry irq_aarch64
+	apply_at_speculative_wa
 	check_and_unmask_ea
 	handle_interrupt_exception irq_aarch64
 end_vector_entry irq_aarch64
 
 vector_entry fiq_aarch64
+	apply_at_speculative_wa
 	check_and_unmask_ea
 	handle_interrupt_exception fiq_aarch64
 end_vector_entry fiq_aarch64
 
 vector_entry serror_aarch64
+	apply_at_speculative_wa
 	msr	daifclr, #DAIF_ABT_BIT
 	b	enter_lower_el_async_ea
 end_vector_entry serror_aarch64
@@ -315,21 +320,25 @@
 	 * to a valid cpu context where the general purpose and system register
 	 * state can be saved.
 	 */
+	apply_at_speculative_wa
 	check_and_unmask_ea
 	handle_sync_exception
 end_vector_entry sync_exception_aarch32
 
 vector_entry irq_aarch32
+	apply_at_speculative_wa
 	check_and_unmask_ea
 	handle_interrupt_exception irq_aarch32
 end_vector_entry irq_aarch32
 
 vector_entry fiq_aarch32
+	apply_at_speculative_wa
 	check_and_unmask_ea
 	handle_interrupt_exception fiq_aarch32
 end_vector_entry fiq_aarch32
 
 vector_entry serror_aarch32
+	apply_at_speculative_wa
 	msr	daifclr, #DAIF_ABT_BIT
 	b	enter_lower_el_async_ea
 end_vector_entry serror_aarch32
@@ -455,6 +464,8 @@
 	b	el3_exit
 
 smc_prohibited:
+	restore_ptw_el1_sys_regs
+	ldp	x28, x29, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X28]
 	ldr	x30, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_LR]
 	mov	x0, #SMC_UNK
 	exception_return
diff --git a/docs/plat/qemu-sbsa.rst b/docs/plat/qemu-sbsa.rst
index 51fe414..bc82ae5 100644
--- a/docs/plat/qemu-sbsa.rst
+++ b/docs/plat/qemu-sbsa.rst
@@ -19,7 +19,6 @@
 Current limitations:
 
 -  Only cold boot is supported
--  No instructions for how to load a BL32 (Secure Payload)
 
 To build TF-A:
 
@@ -27,9 +26,18 @@
 
     git clone https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git tfa
     cd tfa
-    export CROSS_COMPILE=aarch64-linux-gnu-
+    export CROSS_COMPILE=aarch64-none-elf-
     make PLAT=qemu_sbsa all fip
 
+To build TF-A with BL32 and SPM enabled(StandaloneMM as a Secure Payload):
+
+::
+
+    git clone https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git tfa
+    cd tfa
+    export CROSS_COMPILE=aarch64-none-elf-
+    make PLAT=qemu_sbsa BL32=../STANDALONE_MM.fd SPM_MM=1 EL3_EXCEPTION_HANDLING=1 all fip
+
 Images will be placed at build/qemu_sbsa/release (bl1.bin and fip.bin).
 Need to copy them into top directory for EDK2 compilation.
 
diff --git a/include/arch/aarch64/el3_common_macros.S b/include/arch/aarch64/el3_common_macros.S
index 0708de6..17a4efa 100644
--- a/include/arch/aarch64/el3_common_macros.S
+++ b/include/arch/aarch64/el3_common_macros.S
@@ -9,6 +9,7 @@
 
 #include <arch.h>
 #include <asm_macros.S>
+#include <context.h>
 #include <lib/xlat_tables/xlat_tables_defs.h>
 
 	/*
@@ -443,4 +444,42 @@
 #endif
 	.endm
 
+	.macro	apply_at_speculative_wa
+#if ERRATA_SPECULATIVE_AT
+	/*
+	 * Explicitly save x30 so as to free up a register and to enable
+	 * branching and also, save x29 which will be used in the called
+	 * function
+	 */
+	stp	x29, x30, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X29]
+	bl	save_and_update_ptw_el1_sys_regs
+	ldp	x29, x30, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X29]
+#endif
+	.endm
+
+	.macro	restore_ptw_el1_sys_regs
+#if ERRATA_SPECULATIVE_AT
+	/* -----------------------------------------------------------
+	 * In case of ERRATA_SPECULATIVE_AT, must follow below order
+	 * to ensure that page table walk is not enabled until
+	 * restoration of all EL1 system registers. TCR_EL1 register
+	 * should be updated at the end which restores previous page
+	 * table walk setting of stage1 i.e.(TCR_EL1.EPDx) bits. ISB
+	 * ensures that CPU does below steps in order.
+	 *
+	 * 1. Ensure all other system registers are written before
+	 *    updating SCTLR_EL1 using ISB.
+	 * 2. Restore SCTLR_EL1 register.
+	 * 3. Ensure SCTLR_EL1 written successfully using ISB.
+	 * 4. Restore TCR_EL1 register.
+	 * -----------------------------------------------------------
+	 */
+	isb
+	ldp	x28, x29, [sp, #CTX_EL1_SYSREGS_OFFSET + CTX_SCTLR_EL1]
+	msr	sctlr_el1, x28
+	isb
+	msr	tcr_el1, x29
+#endif
+	.endm
+
 #endif /* EL3_COMMON_MACROS_S */
diff --git a/include/lib/el3_runtime/aarch64/context.h b/include/lib/el3_runtime/aarch64/context.h
index 90807ce..3490414 100644
--- a/include/lib/el3_runtime/aarch64/context.h
+++ b/include/lib/el3_runtime/aarch64/context.h
@@ -72,7 +72,7 @@
 #define CTX_SPSR_EL1		U(0x0)
 #define CTX_ELR_EL1		U(0x8)
 #define CTX_SCTLR_EL1		U(0x10)
-#define CTX_ACTLR_EL1		U(0x18)
+#define CTX_TCR_EL1		U(0x18)
 #define CTX_CPACR_EL1		U(0x20)
 #define CTX_CSSELR_EL1		U(0x28)
 #define CTX_SP_EL1		U(0x30)
@@ -81,7 +81,7 @@
 #define CTX_TTBR1_EL1		U(0x48)
 #define CTX_MAIR_EL1		U(0x50)
 #define CTX_AMAIR_EL1		U(0x58)
-#define CTX_TCR_EL1		U(0x60)
+#define CTX_ACTLR_EL1		U(0x60)
 #define CTX_TPIDR_EL1		U(0x68)
 #define CTX_TPIDR_EL0		U(0x70)
 #define CTX_TPIDRRO_EL0		U(0x78)
diff --git a/lib/el3_runtime/aarch64/context.S b/lib/el3_runtime/aarch64/context.S
index 1568ef0..1cb527d 100644
--- a/lib/el3_runtime/aarch64/context.S
+++ b/lib/el3_runtime/aarch64/context.S
@@ -8,6 +8,7 @@
 #include <asm_macros.S>
 #include <assert_macros.S>
 #include <context.h>
+#include <el3_common_macros.S>
 
 #if CTX_INCLUDE_EL2_REGS
 	.global	el2_sysregs_context_save
@@ -22,6 +23,7 @@
 #endif
 	.global	save_gp_pmcr_pauth_regs
 	.global	restore_gp_pmcr_pauth_regs
+	.global save_and_update_ptw_el1_sys_regs
 	.global	el3_exit
 
 #if CTX_INCLUDE_EL2_REGS
@@ -233,21 +235,6 @@
  */
 func el2_sysregs_context_restore
 
-#if ERRATA_SPECULATIVE_AT
-/* Clear EPD0 and EPD1 bit and M bit to disable PTW */
-	mrs	x9, hcr_el2
-	tst	x9, #HCR_E2H_BIT
-	bne	1f
-	mrs	x9, tcr_el2
-	orr	x9, x9, #TCR_EPD0_BIT
-	orr	x9, x9, #TCR_EPD1_BIT
-	msr	tcr_el2, x9
-1:	mrs	x9, sctlr_el2
-	bic	x9, x9, #SCTLR_M_BIT
-	msr	sctlr_el2, x9
-	isb
-#endif
-
 	ldp	x9, x10, [x0, #CTX_ACTLR_EL2]
 	msr	actlr_el2, x9
 	msr	afsr0_el2, x10
@@ -296,136 +283,127 @@
 	msr	mdcr_el2, x15
 	msr	PMSCR_EL2, x16
 
-	ldp	x17, x9, [x0, #CTX_SPSR_EL2]
-	msr	spsr_el2, x17
-	msr	sp_el2, x9
+	ldp	x17, x9, [x0, #CTX_SCTLR_EL2]
+	msr	sctlr_el2, x17
+	msr	spsr_el2, x9
 
-	ldp	x10, x11, [x0, #CTX_TPIDR_EL2]
-	msr	tpidr_el2, x10
-	msr	ttbr0_el2, x11
+	ldp	x10, x11, [x0, #CTX_SP_EL2]
+	msr	sp_el2, x10
+	msr	tcr_el2, x11
 
-	ldp	x12, x13, [x0, #CTX_VBAR_EL2]
-	msr	vbar_el2, x12
-	msr	vmpidr_el2, x13
+	ldp	x12, x13, [x0, #CTX_TPIDR_EL2]
+	msr	tpidr_el2, x12
+	msr	ttbr0_el2, x13
 
-	ldp	x14, x15, [x0, #CTX_VPIDR_EL2]
-	msr	vpidr_el2, x14
-	msr	vtcr_el2, x15
+	ldp	x13, x14, [x0, #CTX_VBAR_EL2]
+	msr	vbar_el2, x13
+	msr	vmpidr_el2, x14
 
-	ldr	x16, [x0, #CTX_VTTBR_EL2]
-	msr	vttbr_el2, x16
+	ldp	x15, x16, [x0, #CTX_VPIDR_EL2]
+	msr	vpidr_el2, x15
+	msr	vtcr_el2, x16
+
+	ldr	x17, [x0, #CTX_VTTBR_EL2]
+	msr	vttbr_el2, x17
 
 #if CTX_INCLUDE_MTE_REGS
-	ldr	x17, [x0, #CTX_TFSR_EL2]
-	msr	TFSR_EL2, x17
+	ldr	x9, [x0, #CTX_TFSR_EL2]
+	msr	TFSR_EL2, x9
 #endif
 
 #if ENABLE_MPAM_FOR_LOWER_ELS
-	ldp	x9, x10, [x0, #CTX_MPAM2_EL2]
-	msr	MPAM2_EL2, x9
-	msr	MPAMHCR_EL2, x10
+	ldp	x10, x11, [x0, #CTX_MPAM2_EL2]
+	msr	MPAM2_EL2, x10
+	msr	MPAMHCR_EL2, x11
 
-	ldp	x11, x12, [x0, #CTX_MPAMVPM0_EL2]
-	msr	MPAMVPM0_EL2, x11
-	msr	MPAMVPM1_EL2, x12
+	ldp	x12, x13, [x0, #CTX_MPAMVPM0_EL2]
+	msr	MPAMVPM0_EL2, x12
+	msr	MPAMVPM1_EL2, x13
 
-	ldp	x13, x14, [x0, #CTX_MPAMVPM2_EL2]
-	msr	MPAMVPM2_EL2, x13
-	msr	MPAMVPM3_EL2, x14
+	ldp	x14, x15, [x0, #CTX_MPAMVPM2_EL2]
+	msr	MPAMVPM2_EL2, x14
+	msr	MPAMVPM3_EL2, x15
 
-	ldp	x15, x16, [x0, #CTX_MPAMVPM4_EL2]
-	msr	MPAMVPM4_EL2, x15
-	msr	MPAMVPM5_EL2, x16
+	ldp	x16, x17, [x0, #CTX_MPAMVPM4_EL2]
+	msr	MPAMVPM4_EL2, x16
+	msr	MPAMVPM5_EL2, x17
 
-	ldp	x17, x9, [x0, #CTX_MPAMVPM6_EL2]
-	msr	MPAMVPM6_EL2, x17
-	msr	MPAMVPM7_EL2, x9
+	ldp	x9, x10, [x0, #CTX_MPAMVPM6_EL2]
+	msr	MPAMVPM6_EL2, x9
+	msr	MPAMVPM7_EL2, x10
 
-	ldr	x10, [x0, #CTX_MPAMVPMV_EL2]
-	msr	MPAMVPMV_EL2, x10
+	ldr	x11, [x0, #CTX_MPAMVPMV_EL2]
+	msr	MPAMVPMV_EL2, x11
 #endif
 
 #if ARM_ARCH_AT_LEAST(8, 6)
-	ldp	x11, x12, [x0, #CTX_HAFGRTR_EL2]
-	msr	HAFGRTR_EL2, x11
-	msr	HDFGRTR_EL2, x12
+	ldp	x12, x13, [x0, #CTX_HAFGRTR_EL2]
+	msr	HAFGRTR_EL2, x12
+	msr	HDFGRTR_EL2, x13
 
-	ldp	x13, x14, [x0, #CTX_HDFGWTR_EL2]
-	msr	HDFGWTR_EL2, x13
-	msr	HFGITR_EL2, x14
+	ldp	x14, x15, [x0, #CTX_HDFGWTR_EL2]
+	msr	HDFGWTR_EL2, x14
+	msr	HFGITR_EL2, x15
 
-	ldp	x15, x16, [x0, #CTX_HFGRTR_EL2]
-	msr	HFGRTR_EL2, x15
-	msr	HFGWTR_EL2, x16
+	ldp	x16, x17, [x0, #CTX_HFGRTR_EL2]
+	msr	HFGRTR_EL2, x16
+	msr	HFGWTR_EL2, x17
 
-	ldr	x17, [x0, #CTX_CNTPOFF_EL2]
-	msr	CNTPOFF_EL2, x17
+	ldr	x9, [x0, #CTX_CNTPOFF_EL2]
+	msr	CNTPOFF_EL2, x9
 #endif
 
 #if ARM_ARCH_AT_LEAST(8, 4)
-	ldp	x9, x10, [x0, #CTX_CNTHPS_CTL_EL2]
-	msr	cnthps_ctl_el2, x9
-	msr	cnthps_cval_el2, x10
+	ldp	x10, x11, [x0, #CTX_CNTHPS_CTL_EL2]
+	msr	cnthps_ctl_el2, x10
+	msr	cnthps_cval_el2, x11
 
-	ldp	x11, x12, [x0, #CTX_CNTHPS_TVAL_EL2]
-	msr	cnthps_tval_el2, x11
-	msr	cnthvs_ctl_el2, x12
+	ldp	x12, x13, [x0, #CTX_CNTHPS_TVAL_EL2]
+	msr	cnthps_tval_el2, x12
+	msr	cnthvs_ctl_el2, x13
 
-	ldp	x13, x14, [x0, #CTX_CNTHVS_CVAL_EL2]
-	msr	cnthvs_cval_el2, x13
-	msr	cnthvs_tval_el2, x14
+	ldp	x14, x15, [x0, #CTX_CNTHVS_CVAL_EL2]
+	msr	cnthvs_cval_el2, x14
+	msr	cnthvs_tval_el2, x15
 
-	ldp	x15, x16, [x0, #CTX_CNTHV_CTL_EL2]
-	msr	cnthv_ctl_el2, x15
-	msr	cnthv_cval_el2, x16
+	ldp	x16, x17, [x0, #CTX_CNTHV_CTL_EL2]
+	msr	cnthv_ctl_el2, x16
+	msr	cnthv_cval_el2, x17
 
-	ldp	x17, x9, [x0, #CTX_CNTHV_TVAL_EL2]
-	msr	cnthv_tval_el2, x17
-	msr	contextidr_el2, x9
+	ldp	x9, x10, [x0, #CTX_CNTHV_TVAL_EL2]
+	msr	cnthv_tval_el2, x9
+	msr	contextidr_el2, x10
 
-	ldr	x10, [x0, #CTX_SDER32_EL2]
-	msr	sder32_el2, x10
+	ldr	x11, [x0, #CTX_SDER32_EL2]
+	msr	sder32_el2, x11
 
-	ldr	x11, [x0, #CTX_TTBR1_EL2]
-	msr	ttbr1_el2, x11
+	ldr	x12, [x0, #CTX_TTBR1_EL2]
+	msr	ttbr1_el2, x12
 
-	ldr	x12, [x0, #CTX_VDISR_EL2]
-	msr	vdisr_el2, x12
+	ldr	x13, [x0, #CTX_VDISR_EL2]
+	msr	vdisr_el2, x13
 
-	ldr	x13, [x0, #CTX_VNCR_EL2]
-	msr	vncr_el2, x13
+	ldr	x14, [x0, #CTX_VNCR_EL2]
+	msr	vncr_el2, x14
 
-	ldr	x14, [x0, #CTX_VSESR_EL2]
-	msr	vsesr_el2, x14
+	ldr	x15, [x0, #CTX_VSESR_EL2]
+	msr	vsesr_el2, x15
 
-	ldr	x15, [x0, #CTX_VSTCR_EL2]
-	msr	vstcr_el2, x15
+	ldr	x16, [x0, #CTX_VSTCR_EL2]
+	msr	vstcr_el2, x16
 
-	ldr	x16, [x0, #CTX_VSTTBR_EL2]
-	msr	vsttbr_el2, x16
+	ldr	x17, [x0, #CTX_VSTTBR_EL2]
+	msr	vsttbr_el2, x17
 
-	ldr	x17, [x0, #CTX_TRFCR_EL2]
-	msr	TRFCR_EL2, x17
+	ldr	x9, [x0, #CTX_TRFCR_EL2]
+	msr	TRFCR_EL2, x9
 #endif
 
 #if ARM_ARCH_AT_LEAST(8, 5)
-	ldr	x9, [x0, #CTX_SCXTNUM_EL2]
-	msr	scxtnum_el2, x9
+	ldr	x10, [x0, #CTX_SCXTNUM_EL2]
+	msr	scxtnum_el2, x10
 #endif
 
-#if ERRATA_SPECULATIVE_AT
-/*
- * Make sure all registers are stored successfully except
- * SCTLR_EL2 and TCR_EL2
- */
-	isb
-#endif
-
-	ldr	x9, [x0, #CTX_SCTLR_EL2]
-	msr	sctlr_el2, x9
-	ldr	x9, [x0, #CTX_TCR_EL2]
-	msr	tcr_el2, x9
-
 	ret
 endfunc el2_sysregs_context_restore
 
@@ -444,9 +422,11 @@
 	mrs	x10, elr_el1
 	stp	x9, x10, [x0, #CTX_SPSR_EL1]
 
+#if !ERRATA_SPECULATIVE_AT
 	mrs	x15, sctlr_el1
-	mrs	x16, actlr_el1
+	mrs	x16, tcr_el1
 	stp	x15, x16, [x0, #CTX_SCTLR_EL1]
+#endif
 
 	mrs	x17, cpacr_el1
 	mrs	x9, csselr_el1
@@ -464,9 +444,9 @@
 	mrs	x15, amair_el1
 	stp	x14, x15, [x0, #CTX_MAIR_EL1]
 
-	mrs	x16, tcr_el1
+	mrs	x16, actlr_el1
 	mrs	x17, tpidr_el1
-	stp	x16, x17, [x0, #CTX_TCR_EL1]
+	stp	x16, x17, [x0, #CTX_ACTLR_EL1]
 
 	mrs	x9, tpidr_el0
 	mrs	x10, tpidrro_el0
@@ -537,23 +517,15 @@
  */
 func el1_sysregs_context_restore
 
-#if ERRATA_SPECULATIVE_AT
-	mrs	x9, tcr_el1
-	orr	x9, x9, #TCR_EPD0_BIT
-	orr	x9, x9, #TCR_EPD1_BIT
-	msr	tcr_el1, x9
-	mrs	x9, sctlr_el1
-	bic	x9, x9, #SCTLR_M_BIT
-	msr	sctlr_el1, x9
-	isb
-#endif
-
 	ldp	x9, x10, [x0, #CTX_SPSR_EL1]
 	msr	spsr_el1, x9
 	msr	elr_el1, x10
 
-	ldr	x16, [x0, #CTX_ACTLR_EL1]
-	msr	actlr_el1, x16
+#if !ERRATA_SPECULATIVE_AT
+	ldp	x15, x16, [x0, #CTX_SCTLR_EL1]
+	msr	sctlr_el1, x15
+	msr	tcr_el1, x16
+#endif
 
 	ldp	x17, x9, [x0, #CTX_CPACR_EL1]
 	msr	cpacr_el1, x17
@@ -571,8 +543,9 @@
 	msr	mair_el1, x14
 	msr	amair_el1, x15
 
-	ldr	x16,[x0, #CTX_TPIDR_EL1]
-	msr	tpidr_el1, x16
+	ldp 	x16, x17, [x0, #CTX_ACTLR_EL1]
+	msr	actlr_el1, x16
+	msr	tpidr_el1, x17
 
 	ldp	x9, x10, [x0, #CTX_TPIDR_EL0]
 	msr	tpidr_el0, x9
@@ -628,19 +601,6 @@
 	msr	GCR_EL1, x14
 #endif
 
-#if ERRATA_SPECULATIVE_AT
-/*
- * Make sure all registers are stored successfully except
- * SCTLR_EL1 and TCR_EL1
- */
-	isb
-#endif
-
-	ldr	x9, [x0, #CTX_SCTLR_EL1]
-	msr	sctlr_el1, x9
-	ldr	x9, [x0, #CTX_TCR_EL1]
-	msr	tcr_el1, x9
-
 	/* No explict ISB required here as ERET covers it */
 	ret
 endfunc el1_sysregs_context_restore
@@ -905,6 +865,48 @@
 	ret
 endfunc restore_gp_pmcr_pauth_regs
 
+/*
+ * In case of ERRATA_SPECULATIVE_AT, save SCTLR_EL1 and TCR_EL1
+ * registers and update EL1 registers to disable stage1 and stage2
+ * page table walk
+ */
+func save_and_update_ptw_el1_sys_regs
+	/* ----------------------------------------------------------
+	 * Save only sctlr_el1 and tcr_el1 registers
+	 * ----------------------------------------------------------
+	 */
+	mrs	x29, sctlr_el1
+	str	x29, [sp, #(CTX_EL1_SYSREGS_OFFSET + CTX_SCTLR_EL1)]
+	mrs	x29, tcr_el1
+	str	x29, [sp, #(CTX_EL1_SYSREGS_OFFSET + CTX_TCR_EL1)]
+
+	/* ------------------------------------------------------------
+	 * Must follow below order in order to disable page table
+	 * walk for lower ELs (EL1 and EL0). First step ensures that
+	 * page table walk is disabled for stage1 and second step
+	 * ensures that page table walker should use TCR_EL1.EPDx
+	 * bits to perform address translation. ISB ensures that CPU
+	 * does these 2 steps in order.
+	 *
+	 * 1. Update TCR_EL1.EPDx bits to disable page table walk by
+	 *    stage1.
+	 * 2. Enable MMU bit to avoid identity mapping via stage2
+	 *    and force TCR_EL1.EPDx to be used by the page table
+	 *    walker.
+	 * ------------------------------------------------------------
+	 */
+	orr	x29, x29, #(TCR_EPD0_BIT)
+	orr	x29, x29, #(TCR_EPD1_BIT)
+	msr	tcr_el1, x29
+	isb
+	mrs	x29, sctlr_el1
+	orr	x29, x29, #SCTLR_M_BIT
+	msr	sctlr_el1, x29
+	isb
+
+	ret
+endfunc save_and_update_ptw_el1_sys_regs
+
 /* ------------------------------------------------------------------
  * This routine assumes that the SP_EL3 is pointing to a valid
  * context structure from where the gp regs and other special
@@ -949,6 +951,8 @@
 	blr	x17
 1:
 #endif
+	restore_ptw_el1_sys_regs
+
 	/* ----------------------------------------------------------
 	 * Restore general purpose (including x30), PMCR_EL0 and
 	 * ARMv8.3-PAuth registers.
diff --git a/plat/arm/board/fvp/fvp_common.c b/plat/arm/board/fvp/fvp_common.c
index 6f439b8..6e479ac 100644
--- a/plat/arm/board/fvp/fvp_common.c
+++ b/plat/arm/board/fvp/fvp_common.c
@@ -13,16 +13,18 @@
 #include <drivers/arm/sp804_delay_timer.h>
 #include <drivers/generic_delay_timer.h>
 #include <lib/mmio.h>
+#include <lib/smccc.h>
 #include <lib/xlat_tables/xlat_tables_compat.h>
-#include <plat/arm/common/arm_config.h>
-#include <plat/arm/common/plat_arm.h>
-#include <plat/common/platform.h>
 #include <platform_def.h>
-
+#include <services/arm_arch_svc.h>
 #if SPM_MM
 #include <services/spm_mm_partition.h>
 #endif
 
+#include <plat/arm/common/arm_config.h>
+#include <plat/arm/common/plat_arm.h>
+#include <plat/common/platform.h>
+
 #include "fvp_private.h"
 
 /* Defines for GIC Driver build time selection */
@@ -437,3 +439,40 @@
 			CNTCR_FCREQ(0U) | CNTCR_EN);
 #endif /* USE_SP804_TIMER */
 }
+
+/*****************************************************************************
+ * plat_is_smccc_feature_available() - This function checks whether SMCCC
+ *                                     feature is availabile for platform.
+ * @fid: SMCCC function id
+ *
+ * Return SMC_ARCH_CALL_SUCCESS if SMCCC feature is available and
+ * SMC_ARCH_CALL_NOT_SUPPORTED otherwise.
+ *****************************************************************************/
+int32_t plat_is_smccc_feature_available(u_register_t fid)
+{
+	switch (fid) {
+	case SMCCC_ARCH_SOC_ID:
+		return SMC_ARCH_CALL_SUCCESS;
+	default:
+		return SMC_ARCH_CALL_NOT_SUPPORTED;
+	}
+}
+
+/* Get SOC version */
+int32_t plat_get_soc_version(void)
+{
+	return (int32_t)
+		((ARM_SOC_IDENTIFICATION_CODE << ARM_SOC_IDENTIFICATION_SHIFT)
+		 | (ARM_SOC_CONTINUATION_CODE << ARM_SOC_CONTINUATION_SHIFT)
+		 | FVP_SOC_ID);
+}
+
+/* Get SOC revision */
+int32_t plat_get_soc_revision(void)
+{
+	unsigned int sys_id;
+
+	sys_id = mmio_read_32(V2M_SYSREGS_BASE + V2M_SYS_ID);
+	return (int32_t)((sys_id >> V2M_SYS_ID_REV_SHIFT) &
+			V2M_SYS_ID_REV_MASK);
+}
diff --git a/plat/arm/board/fvp/fvp_def.h b/plat/arm/board/fvp/fvp_def.h
index c5d1568..4efe692 100644
--- a/plat/arm/board/fvp/fvp_def.h
+++ b/plat/arm/board/fvp/fvp_def.h
@@ -27,6 +27,11 @@
 #define FVP_CCI			1
 #define FVP_CCN			2
 
+/******************************************************************************
+ * Definition of platform soc id
+ *****************************************************************************/
+#define FVP_SOC_ID      0
+
 /*******************************************************************************
  * FVP memory map related constants
  ******************************************************************************/
diff --git a/plat/arm/board/juno/juno_common.c b/plat/arm/board/juno/juno_common.c
index 9570d2d..da4918c 100644
--- a/plat/arm/board/juno/juno_common.c
+++ b/plat/arm/board/juno/juno_common.c
@@ -1,10 +1,13 @@
 /*
- * Copyright (c) 2015-2019, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
 
+#include <lib/smccc.h>
 #include <platform_def.h>
+#include <services/arm_arch_svc.h>
+
 #include <plat/arm/common/plat_arm.h>
 
 /*
@@ -91,3 +94,40 @@
 #endif
 
 ARM_CASSERT_MMAP
+
+/*****************************************************************************
+ * plat_is_smccc_feature_available() - This function checks whether SMCCC
+ *                                     feature is availabile for platform.
+ * @fid: SMCCC function id
+ *
+ * Return SMC_ARCH_CALL_SUCCESS if SMCCC feature is available and
+ * SMC_ARCH_CALL_NOT_SUPPORTED otherwise.
+ *****************************************************************************/
+int32_t plat_is_smccc_feature_available(u_register_t fid)
+{
+	switch (fid) {
+	case SMCCC_ARCH_SOC_ID:
+		return SMC_ARCH_CALL_SUCCESS;
+	default:
+		return SMC_ARCH_CALL_NOT_SUPPORTED;
+	}
+}
+
+/* Get SOC version */
+int32_t plat_get_soc_version(void)
+{
+	return (int32_t)
+		((ARM_SOC_IDENTIFICATION_CODE << ARM_SOC_IDENTIFICATION_SHIFT)
+		 | (ARM_SOC_CONTINUATION_CODE << ARM_SOC_CONTINUATION_SHIFT)
+		 | JUNO_SOC_ID);
+}
+
+/* Get SOC revision */
+int32_t plat_get_soc_revision(void)
+{
+	unsigned int sys_id;
+
+	sys_id = mmio_read_32(V2M_SYSREGS_BASE + V2M_SYS_ID);
+	return (int32_t)((sys_id >> V2M_SYS_ID_REV_SHIFT) &
+			V2M_SYS_ID_REV_MASK);
+}
diff --git a/plat/arm/board/juno/juno_def.h b/plat/arm/board/juno/juno_def.h
index 3b34a9f..ddf99dc 100644
--- a/plat/arm/board/juno/juno_def.h
+++ b/plat/arm/board/juno/juno_def.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2019, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2014-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -9,6 +9,11 @@
 
 #include <lib/utils_def.h>
 
+/******************************************************************************
+ * Definition of platform soc id
+ *****************************************************************************/
+#define JUNO_SOC_ID     1
+
 /*******************************************************************************
  * Juno memory map related constants
  ******************************************************************************/
diff --git a/plat/arm/common/arm_common.c b/plat/arm/common/arm_common.c
index e2b99a3..f7ee7a8 100644
--- a/plat/arm/common/arm_common.c
+++ b/plat/arm/common/arm_common.c
@@ -237,38 +237,3 @@
 }
 #endif
 
-/*****************************************************************************
- * plat_is_smccc_feature_available() - This function checks whether SMCCC
- *                                     feature is availabile for platform.
- * @fid: SMCCC function id
- *
- * Return SMC_OK if SMCCC feature is available and SMC_ARCH_CALL_NOT_SUPPORTED
- * otherwise.
- *****************************************************************************/
-int32_t plat_is_smccc_feature_available(u_register_t fid)
-{
-	switch (fid) {
-	case SMCCC_ARCH_SOC_ID:
-	default:
-		return SMC_ARCH_CALL_NOT_SUPPORTED;
-	}
-}
-
-/*
- * Weak function to get ARM platform SOC-ID, Always return SOC-ID=0
- * ToDo: Get proper SOC-ID for every ARM platform and define this
- *       function separately for every ARM platform.
- */
-uint32_t plat_arm_get_soc_id(void)
-{
-	return 0U;
-}
-
-/* Get SOC version */
-int32_t plat_get_soc_version(void)
-{
-	return (int32_t)
-		((ARM_SOC_IDENTIFICATION_CODE << ARM_SOC_IDENTIFICATION_SHIFT)
-		 | (ARM_SOC_CONTINUATION_CODE << ARM_SOC_CONTINUATION_SHIFT)
-		 | plat_arm_get_soc_id());
-}
diff --git a/plat/imx/imx8m/gpc_common.c b/plat/imx/imx8m/gpc_common.c
index eb2801c..babcecf 100644
--- a/plat/imx/imx8m/gpc_common.c
+++ b/plat/imx/imx8m/gpc_common.c
@@ -16,7 +16,7 @@
 #include <imx8m_psci.h>
 #include <plat_imx8.h>
 
-static uint32_t gpc_imr_offset[] = { 0x30, 0x40, 0x1c0, 0x1d0, };
+static uint32_t gpc_imr_offset[] = { IMR1_CORE0_A53, IMR1_CORE1_A53, IMR1_CORE2_A53, IMR1_CORE3_A53, };
 
 #pragma weak imx_set_cpu_pwr_off
 #pragma weak imx_set_cpu_pwr_on
@@ -133,14 +133,12 @@
 		val = mmio_read_32(IMX_GPC_BASE + LPCR_A53_AD);
 		val &= ~EN_L2_WFI_PDN;
 		/* L2 cache memory is on in WAIT mode */
-		if (is_local_state_off(power_state))
+		if (is_local_state_off(power_state)) {
 			val |= (L2PGE | EN_PLAT_PDN);
-		else
-			val |= EN_PLAT_PDN;
+			imx_a53_plat_slot_config(true);
+		}
 
 		mmio_write_32(IMX_GPC_BASE + LPCR_A53_AD, val);
-
-		imx_a53_plat_slot_config(true);
 	} else {
 		/* clear the slot and ack for cluster power down */
 		imx_a53_plat_slot_config(false);
diff --git a/plat/imx/imx8m/imx8m_psci_common.c b/plat/imx/imx8m/imx8m_psci_common.c
index d641628..dbb772d 100644
--- a/plat/imx/imx8m/imx8m_psci_common.c
+++ b/plat/imx/imx8m/imx8m_psci_common.c
@@ -192,7 +192,7 @@
 	 * drived by the 32K OSC, so delay 30us to make sure the counter
 	 * is really running.
 	 */
-	if (!is_local_state_run(CLUSTER_PWR_STATE(target_state))) {
+	if (is_local_state_off(CLUSTER_PWR_STATE(target_state))) {
 		imx_set_rbc_count();
 		udelay(30);
 	}
diff --git a/plat/imx/imx8m/imx8mm/include/gpc_reg.h b/plat/imx/imx8m/imx8mm/include/gpc_reg.h
index c697af2..1a4eae5 100644
--- a/plat/imx/imx8m/imx8mm/include/gpc_reg.h
+++ b/plat/imx/imx8m/imx8mm/include/gpc_reg.h
@@ -124,4 +124,6 @@
 #define VPU_G2_PGC			0xf00
 #define VPU_H1_PGC			0xf40
 
+#define IRQ_IMR_NUM			U(4)
+
 #endif /* GPC_REG_H */
diff --git a/plat/imx/imx8m/imx8mn/include/gpc_reg.h b/plat/imx/imx8m/imx8mn/include/gpc_reg.h
index fd10438..8a81368 100644
--- a/plat/imx/imx8m/imx8mn/include/gpc_reg.h
+++ b/plat/imx/imx8m/imx8mn/include/gpc_reg.h
@@ -106,4 +106,6 @@
 #define GPUMIX_PGC			0xdc0
 #define DISPMIX_PGC			0xe80
 
+#define IRQ_IMR_NUM			U(4)
+
 #endif /* GPC_REG_H */
diff --git a/plat/imx/imx8m/imx8mp/include/gpc_reg.h b/plat/imx/imx8m/imx8mp/include/gpc_reg.h
index 12da6ac..7909937 100644
--- a/plat/imx/imx8m/imx8mp/include/gpc_reg.h
+++ b/plat/imx/imx8m/imx8mp/include/gpc_reg.h
@@ -146,4 +146,6 @@
 #define MEDIAMIX_ISPDWP_PGC		0xf80
 #define DDRMIX_PGC			0xfc0
 
+#define IRQ_IMR_NUM			U(5)
+
 #endif /* GPC_REG_H */
diff --git a/plat/imx/imx8m/imx8mq/include/gpc_reg.h b/plat/imx/imx8m/imx8mq/include/gpc_reg.h
index 9f472d6..f171bd9 100644
--- a/plat/imx/imx8m/imx8mq/include/gpc_reg.h
+++ b/plat/imx/imx8m/imx8mq/include/gpc_reg.h
@@ -84,4 +84,6 @@
 #define MASTER1_MAPPING			BIT(1)
 #define MASTER2_MAPPING			BIT(2)
 
+#define IRQ_IMR_NUM			U(4)
+
 #endif /* GPC_REG_H */
diff --git a/plat/imx/imx8m/include/gpc.h b/plat/imx/imx8m/include/gpc.h
index 89a0b9d..6f86e1d 100644
--- a/plat/imx/imx8m/include/gpc.h
+++ b/plat/imx/imx8m/include/gpc.h
@@ -25,7 +25,6 @@
 #define SLTx_CFG(n)			((SLT0_CFG + ((n) * 4)))
 #define SLT_COREx_PUP(core_id)		(0x2 << ((core_id) * 2))
 
-#define IRQ_IMR_NUM	4
 #define IMR_MASK_ALL	0xffffffff
 
 #define IMX_PD_DOMAIN(name, on)				\
diff --git a/plat/nvidia/tegra/common/tegra_platform.c b/plat/nvidia/tegra/common/tegra_platform.c
index 0804135..7c73e8f 100644
--- a/plat/nvidia/tegra/common/tegra_platform.c
+++ b/plat/nvidia/tegra/common/tegra_platform.c
@@ -108,6 +108,13 @@
 	return (tegra_chipid_is_t210() && (tegra_get_chipid_major() == 0x2U));
 }
 
+bool tegra_chipid_is_t194(void)
+{
+	uint32_t chip_id = (tegra_get_chipid() >> CHIP_ID_SHIFT) & CHIP_ID_MASK;
+
+	return (chip_id == TEGRA_CHIPID_TEGRA19);
+}
+
 /*
  * Read the chip ID value and derive the platform
  */
diff --git a/plat/nvidia/tegra/common/tegra_pm.c b/plat/nvidia/tegra/common/tegra_pm.c
index 78e96cf..6019182 100644
--- a/plat/nvidia/tegra/common/tegra_pm.c
+++ b/plat/nvidia/tegra/common/tegra_pm.c
@@ -34,7 +34,7 @@
  * the appropriate State-ID field within the `power_state` parameter which can
  * be utilized in `pwr_domain_suspend()` to suspend to system affinity level.
 ******************************************************************************/
-void tegra_get_sys_suspend_power_state(psci_power_state_t *req_state)
+static void tegra_get_sys_suspend_power_state(psci_power_state_t *req_state)
 {
 	/* all affinities use system suspend state id */
 	for (uint32_t i = MPIDR_AFFLVL0; i <= PLAT_MAX_PWR_LVL; i++) {
@@ -45,7 +45,7 @@
 /*******************************************************************************
  * Handler called when an affinity instance is about to enter standby.
  ******************************************************************************/
-void tegra_cpu_standby(plat_local_state_t cpu_state)
+static void tegra_cpu_standby(plat_local_state_t cpu_state)
 {
 	u_register_t saved_scr_el3;
 
@@ -84,7 +84,7 @@
  * Handler called when an affinity instance is about to be turned on. The
  * level and mpidr determine the affinity instance.
  ******************************************************************************/
-int32_t tegra_pwr_domain_on(u_register_t mpidr)
+static int32_t tegra_pwr_domain_on(u_register_t mpidr)
 {
 	return tegra_soc_pwr_domain_on(mpidr);
 }
@@ -93,7 +93,7 @@
  * Handler called when a power domain is about to be turned off. The
  * target_state encodes the power state that each level should transition to.
  ******************************************************************************/
-void tegra_pwr_domain_off(const psci_power_state_t *target_state)
+static void tegra_pwr_domain_off(const psci_power_state_t *target_state)
 {
 	(void)tegra_soc_pwr_domain_off(target_state);
 }
@@ -113,7 +113,7 @@
  * Handler called when a power domain is about to be suspended. The
  * target_state encodes the power state that each level should transition to.
  ******************************************************************************/
-void tegra_pwr_domain_suspend(const psci_power_state_t *target_state)
+static void tegra_pwr_domain_suspend(const psci_power_state_t *target_state)
 {
 	(void)tegra_soc_pwr_domain_suspend(target_state);
 
@@ -132,7 +132,7 @@
  * Handler called at the end of the power domain suspend sequence. The
  * target_state encodes the power state that each level should transition to.
  ******************************************************************************/
-__dead2 void tegra_pwr_domain_power_down_wfi(const psci_power_state_t
+static __dead2 void tegra_pwr_domain_power_down_wfi(const psci_power_state_t
 					     *target_state)
 {
 	/* call the chip's power down handler */
@@ -147,7 +147,7 @@
  * being turned off earlier. The target_state encodes the low power state that
  * each level has woken up from.
  ******************************************************************************/
-void tegra_pwr_domain_on_finish(const psci_power_state_t *target_state)
+static void tegra_pwr_domain_on_finish(const psci_power_state_t *target_state)
 {
 	const plat_params_from_bl2_t *plat_params;
 
@@ -198,7 +198,7 @@
  * having been suspended earlier. The target_state encodes the low power state
  * that each level has woken up from.
  ******************************************************************************/
-void tegra_pwr_domain_suspend_finish(const psci_power_state_t *target_state)
+static void tegra_pwr_domain_suspend_finish(const psci_power_state_t *target_state)
 {
 	tegra_pwr_domain_on_finish(target_state);
 }
@@ -206,7 +206,7 @@
 /*******************************************************************************
  * Handler called when the system wants to be powered off
  ******************************************************************************/
-__dead2 void tegra_system_off(void)
+static __dead2 void tegra_system_off(void)
 {
 	INFO("Powering down system...\n");
 
@@ -216,7 +216,7 @@
 /*******************************************************************************
  * Handler called when the system wants to be restarted.
  ******************************************************************************/
-__dead2 void tegra_system_reset(void)
+static __dead2 void tegra_system_reset(void)
 {
 	INFO("Restarting system...\n");
 
@@ -232,7 +232,7 @@
 /*******************************************************************************
  * Handler called to check the validity of the power state parameter.
  ******************************************************************************/
-int32_t tegra_validate_power_state(uint32_t power_state,
+static int32_t tegra_validate_power_state(uint32_t power_state,
 				   psci_power_state_t *req_state)
 {
 	assert(req_state != NULL);
@@ -243,7 +243,7 @@
 /*******************************************************************************
  * Platform handler called to check the validity of the non secure entrypoint.
  ******************************************************************************/
-int32_t tegra_validate_ns_entrypoint(uintptr_t entrypoint)
+static int32_t tegra_validate_ns_entrypoint(uintptr_t entrypoint)
 {
 	int32_t ret = PSCI_E_INVALID_ADDRESS;
 
diff --git a/plat/nvidia/tegra/include/tegra_platform.h b/plat/nvidia/tegra/include/tegra_platform.h
index 7dfa4d0..b8297fd 100644
--- a/plat/nvidia/tegra/include/tegra_platform.h
+++ b/plat/nvidia/tegra/include/tegra_platform.h
@@ -30,6 +30,7 @@
 #define TEGRA_CHIPID_TEGRA13		U(0x13)
 #define TEGRA_CHIPID_TEGRA21		U(0x21)
 #define TEGRA_CHIPID_TEGRA18		U(0x18)
+#define TEGRA_CHIPID_TEGRA19		U(0x19)
 
 /*******************************************************************************
  * JEDEC Standard Manufacturer's Identification Code and Bank ID
@@ -52,6 +53,7 @@
 bool tegra_chipid_is_t186(void);
 bool tegra_chipid_is_t210(void);
 bool tegra_chipid_is_t210_b01(void);
+bool tegra_chipid_is_t194(void);
 
 /*
  * Tegra platform identifiers
diff --git a/plat/nvidia/tegra/include/tegra_private.h b/plat/nvidia/tegra/include/tegra_private.h
index c181c36..b638c81 100644
--- a/plat/nvidia/tegra/include/tegra_private.h
+++ b/plat/nvidia/tegra/include/tegra_private.h
@@ -112,19 +112,6 @@
 plat_local_state_t tegra_soc_get_target_pwr_state(uint32_t lvl,
 					     const plat_local_state_t *states,
 					     uint32_t ncpu);
-void tegra_get_sys_suspend_power_state(psci_power_state_t *req_state);
-void tegra_cpu_standby(plat_local_state_t cpu_state);
-int32_t tegra_pwr_domain_on(u_register_t mpidr);
-void tegra_pwr_domain_off(const psci_power_state_t *target_state);
-void tegra_pwr_domain_suspend(const psci_power_state_t *target_state);
-void __dead2 tegra_pwr_domain_power_down_wfi(const psci_power_state_t *target_state);
-void tegra_pwr_domain_on_finish(const psci_power_state_t *target_state);
-void tegra_pwr_domain_suspend_finish(const psci_power_state_t *target_state);
-__dead2 void tegra_system_off(void);
-__dead2 void tegra_system_reset(void);
-int32_t tegra_validate_power_state(uint32_t power_state,
-				   psci_power_state_t *req_state);
-int32_t tegra_validate_ns_entrypoint(uintptr_t entrypoint);
 
 /* Declarations for tegraXXX_pm.c */
 int tegra_prepare_cpu_suspend(unsigned int id, unsigned int afflvl);
diff --git a/plat/qemu/common/qemu_common.c b/plat/qemu/common/qemu_common.c
index 365cfb7..7f8e4c4 100644
--- a/plat/qemu/common/qemu_common.c
+++ b/plat/qemu/common/qemu_common.c
@@ -1,5 +1,6 @@
+
 /*
- * Copyright (c) 2015-2019, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -77,7 +78,11 @@
 	MAP_DEVICE2,
 #endif
 	MAP_NS_DRAM0,
+#if SPM_MM
+	QEMU_SP_IMAGE_MMAP,
+#else
 	MAP_BL32_MEM,
+#endif
 	{0}
 };
 #endif
@@ -88,7 +93,11 @@
 #ifdef MAP_DEVICE1
 	MAP_DEVICE1,
 #endif
+#if SPM_MM
+	QEMU_SPM_BUF_EL3_MMAP,
+#else
 	MAP_BL32_MEM,
+#endif
 	{0}
 };
 #endif
diff --git a/plat/qemu/common/qemu_spm.c b/plat/qemu/common/qemu_spm.c
new file mode 100644
index 0000000..e9ab1a5
--- /dev/null
+++ b/plat/qemu/common/qemu_spm.c
@@ -0,0 +1,81 @@
+/* SPDX-License-Identifier: BSD-3-Clause
+ *
+ * Copyright (c) 2020, Linaro Limited and Contributors. All rights reserved.
+ */
+
+#include <bl31/ehf.h>
+#include <lib/xlat_tables/xlat_tables_compat.h>
+#include <services/spm_mm_partition.h>
+
+#include <platform_def.h>
+
+/* Region equivalent to MAP_DEVICE1 suitable for mapping at EL0 */
+#define MAP_DEVICE1_EL0	MAP_REGION_FLAT(DEVICE1_BASE,			\
+					DEVICE1_SIZE,			\
+					MT_DEVICE | MT_RW | MT_SECURE | MT_USER)
+
+const mmap_region_t plat_qemu_secure_partition_mmap[] = {
+	MAP_DEVICE1_EL0, /* for the UART */
+	QEMU_SP_IMAGE_MMAP,
+	QEMU_SPM_BUF_EL0_MMAP,
+	QEMU_SP_IMAGE_NS_BUF_MMAP,
+	QEMU_SP_IMAGE_RW_MMAP,
+	{0}
+};
+
+/*
+ * Boot information passed to a secure partition during initialisation.
+ * Linear indices in MP information will be filled at runtime.
+ */
+static spm_mm_mp_info_t sp_mp_info[] = {
+	[0] = {0x80000000, 0},
+	[1] = {0x80000001, 0},
+	[2] = {0x80000002, 0},
+	[3] = {0x80000003, 0},
+	[4] = {0x80000004, 0},
+	[5] = {0x80000005, 0},
+	[6] = {0x80000006, 0},
+	[7] = {0x80000007, 0}
+};
+
+const spm_mm_boot_info_t plat_qemu_secure_partition_boot_info = {
+	.h.type              = PARAM_SP_IMAGE_BOOT_INFO,
+	.h.version           = VERSION_1,
+	.h.size              = sizeof(spm_mm_boot_info_t),
+	.h.attr              = 0,
+	.sp_mem_base         = PLAT_QEMU_SP_IMAGE_BASE,
+	.sp_mem_limit        = BL32_LIMIT,
+	.sp_image_base       = PLAT_QEMU_SP_IMAGE_BASE,
+	.sp_stack_base       = PLAT_SP_IMAGE_STACK_BASE,
+	.sp_heap_base        = PLAT_QEMU_SP_IMAGE_HEAP_BASE,
+	.sp_ns_comm_buf_base = PLAT_QEMU_SP_IMAGE_NS_BUF_BASE,
+	.sp_shared_buf_base  = PLAT_SPM_BUF_BASE,
+	.sp_image_size       = PLAT_QEMU_SP_IMAGE_SIZE,
+	.sp_pcpu_stack_size  = PLAT_SP_IMAGE_STACK_PCPU_SIZE,
+	.sp_heap_size        = PLAT_QEMU_SP_IMAGE_HEAP_SIZE,
+	.sp_ns_comm_buf_size = PLAT_QEMU_SP_IMAGE_NS_BUF_SIZE,
+	.sp_shared_buf_size  = PLAT_SPM_BUF_SIZE,
+	.num_sp_mem_regions  = PLAT_QEMU_SP_IMAGE_NUM_MEM_REGIONS,
+	.num_cpus            = PLATFORM_CORE_COUNT,
+	.mp_info             = sp_mp_info
+};
+
+/* Enumeration of priority levels on QEMU platforms. */
+ehf_pri_desc_t qemu_exceptions[] = {
+	EHF_PRI_DESC(QEMU_PRI_BITS, PLAT_SP_PRI)
+};
+
+/* Plug in QEMU exceptions to Exception Handling Framework. */
+EHF_REGISTER_PRIORITIES(qemu_exceptions, ARRAY_SIZE(qemu_exceptions),
+			QEMU_PRI_BITS);
+
+const mmap_region_t *plat_get_secure_partition_mmap(void *cookie)
+{
+	return plat_qemu_secure_partition_mmap;
+}
+
+const spm_mm_boot_info_t *
+plat_get_secure_partition_boot_info(void *cookie)
+{
+	return &plat_qemu_secure_partition_boot_info;
+}
diff --git a/plat/qemu/qemu_sbsa/include/platform_def.h b/plat/qemu/qemu_sbsa/include/platform_def.h
index d0a56cf..7634005 100644
--- a/plat/qemu/qemu_sbsa/include/platform_def.h
+++ b/plat/qemu/qemu_sbsa/include/platform_def.h
@@ -1,10 +1,11 @@
 /* SPDX-License-Identifier: BSD-3-Clause
  *
- * Copyright (c) 2019, Linaro Limited and Contributors. All rights reserved.
+ * Copyright (c) 2019-2020, Linaro Limited and Contributors.
+ * All rights reserved.
  */
 
-#ifndef __PLATFORM_DEF_H__
-#define __PLATFORM_DEF_H__
+#ifndef PLATFORM_DEF_H
+#define PLATFORM_DEF_H
 
 #include <arch.h>
 #include <plat/common/common_def.h>
@@ -107,9 +108,10 @@
  * Put BL1 RW at the top of the Secure SRAM. BL1_RW_BASE is calculated using
  * the current BL1 RW debug size plus a little space for growth.
  */
+#define BL1_SIZE			0x12000
 #define BL1_RO_BASE			SEC_ROM_BASE
 #define BL1_RO_LIMIT			(SEC_ROM_BASE + SEC_ROM_SIZE)
-#define BL1_RW_BASE			(BL1_RW_LIMIT - 0x12000)
+#define BL1_RW_BASE			(BL1_RW_LIMIT - BL1_SIZE)
 #define BL1_RW_LIMIT			(BL_RAM_BASE + BL_RAM_SIZE)
 
 /*
@@ -118,7 +120,8 @@
  * Put BL2 just below BL3-1. BL2_BASE is calculated using the current BL2 debug
  * size plus a little space for growth.
  */
-#define BL2_BASE			(BL31_BASE - 0x1D000)
+#define BL2_SIZE			0x1D000
+#define BL2_BASE			(BL31_BASE - BL2_SIZE)
 #define BL2_LIMIT			BL31_BASE
 
 /*
@@ -127,8 +130,9 @@
  * Put BL3-1 at the top of the Trusted SRAM. BL31_BASE is calculated using the
  * current BL3-1 debug size plus a little space for growth.
  */
-#define BL31_BASE			(BL31_LIMIT - 0x20000)
-#define BL31_LIMIT			(BL_RAM_BASE + BL_RAM_SIZE)
+#define BL31_SIZE			0x50000
+#define BL31_BASE			(BL31_LIMIT - BL31_SIZE)
+#define BL31_LIMIT			(BL1_RW_BASE)
 #define BL31_PROGBITS_LIMIT		BL1_RW_BASE
 
 
@@ -138,12 +142,11 @@
  * BL3-2 can execute from Secure SRAM, or Secure DRAM.
  */
 #define BL32_SRAM_BASE			BL_RAM_BASE
-#define BL32_SRAM_LIMIT			BL31_BASE
-#define BL32_DRAM_BASE			SEC_DRAM_BASE
-#define BL32_DRAM_LIMIT			(SEC_DRAM_BASE + SEC_DRAM_SIZE)
+#define BL32_SRAM_LIMIT			BL2_BASE
 
 #define BL32_MEM_BASE			BL_RAM_BASE
-#define BL32_MEM_SIZE			BL_RAM_SIZE
+#define BL32_MEM_SIZE			(BL_RAM_SIZE - BL1_SIZE - \
+					BL2_SIZE - BL31_SIZE)
 #define BL32_BASE			BL32_SRAM_BASE
 #define BL32_LIMIT			BL32_SRAM_LIMIT
 
@@ -152,11 +155,21 @@
 
 #define PLAT_PHY_ADDR_SPACE_SIZE	(1ull << 42)
 #define PLAT_VIRT_ADDR_SPACE_SIZE	(1ull << 42)
+#if SPM_MM
+#define MAX_MMAP_REGIONS		12
+#define MAX_XLAT_TABLES			11
+#else
 #define MAX_MMAP_REGIONS		11
 #define MAX_XLAT_TABLES			10
+#endif
 #define MAX_IO_DEVICES			3
 #define MAX_IO_HANDLES			4
 
+#if SPM_MM && defined(IMAGE_BL31)
+# define PLAT_SP_IMAGE_MMAP_REGIONS	30
+# define PLAT_SP_IMAGE_MAX_XLAT_TABLES	20
+#endif
+
 /*
  * PL011 related constants
  */
@@ -165,6 +178,10 @@
 #define UART0_CLK_IN_HZ			1
 #define UART1_CLK_IN_HZ			1
 
+/* Secure UART */
+#define UART2_BASE			0x60040000
+#define UART2_CLK_IN_HZ			1
+
 #define PLAT_QEMU_BOOT_UART_BASE	UART0_BASE
 #define PLAT_QEMU_BOOT_UART_CLK_IN_HZ	UART0_CLK_IN_HZ
 
@@ -179,7 +196,7 @@
 #define QEMU_FLASH1_SIZE		0x10000000
 
 #define PLAT_QEMU_FIP_BASE		0x00008000
-#define PLAT_QEMU_FIP_MAX_SIZE		0x00020000
+#define PLAT_QEMU_FIP_MAX_SIZE		0x00400000
 
 /* This is map from GIC_DIST up to last CPU (255) GIC_REDISTR */
 #define DEVICE0_BASE			0x40000000
@@ -240,4 +257,99 @@
  */
 #define SYS_COUNTER_FREQ_IN_TICKS	((1000 * 1000 * 1000) / 16)
 
+#if SPM_MM
+#define PLAT_QEMU_SP_IMAGE_BASE		BL_RAM_BASE
+#define PLAT_QEMU_SP_IMAGE_SIZE		ULL(0x300000)
+
+#ifdef IMAGE_BL2
+/* In BL2 all memory allocated to the SPM Payload image is marked as RW. */
+# define QEMU_SP_IMAGE_MMAP		MAP_REGION_FLAT( \
+						PLAT_QEMU_SP_IMAGE_BASE, \
+						PLAT_QEMU_SP_IMAGE_SIZE, \
+						MT_MEMORY | MT_RW | \
+						MT_SECURE)
+#elif IMAGE_BL31
+/* All SPM Payload memory is marked as code in S-EL0 */
+# define QEMU_SP_IMAGE_MMAP		MAP_REGION2(PLAT_QEMU_SP_IMAGE_BASE, \
+						PLAT_QEMU_SP_IMAGE_BASE, \
+						PLAT_QEMU_SP_IMAGE_SIZE, \
+						MT_CODE | MT_SECURE | \
+						MT_USER,		\
+						PAGE_SIZE)
+#endif
+
+/*
+ * EL3 -> S-EL0 secure shared memory
+ */
+#define PLAT_SPM_BUF_PCPU_SIZE		ULL(0x10000)
+#define PLAT_SPM_BUF_SIZE		(PLATFORM_CORE_COUNT * \
+					PLAT_SPM_BUF_PCPU_SIZE)
+#define PLAT_SPM_BUF_BASE		(BL32_LIMIT - PLAT_SPM_BUF_SIZE)
+
+#define QEMU_SPM_BUF_EL3_MMAP		MAP_REGION_FLAT(PLAT_SPM_BUF_BASE, \
+						PLAT_SPM_BUF_SIZE, \
+						MT_RW_DATA | MT_SECURE)
+
+#define QEMU_SPM_BUF_EL0_MMAP		MAP_REGION2(PLAT_SPM_BUF_BASE,	\
+						PLAT_SPM_BUF_BASE,	\
+						PLAT_SPM_BUF_SIZE,	\
+						MT_RO_DATA | MT_SECURE | \
+						MT_USER,		\
+						PAGE_SIZE)
+
+/*
+ * Shared memory between Normal world and S-EL0 for
+ * passing data during service requests. It will be marked as RW and NS.
+ */
+#define PLAT_QEMU_SP_IMAGE_NS_BUF_BASE	(PLAT_QEMU_DT_BASE +		\
+						PLAT_QEMU_DT_MAX_SIZE)
+#define PLAT_QEMU_SP_IMAGE_NS_BUF_SIZE	ULL(0x10000)
+#define QEMU_SP_IMAGE_NS_BUF_MMAP	MAP_REGION2( \
+					PLAT_QEMU_SP_IMAGE_NS_BUF_BASE, \
+					PLAT_QEMU_SP_IMAGE_NS_BUF_BASE, \
+					PLAT_QEMU_SP_IMAGE_NS_BUF_SIZE, \
+					MT_RW_DATA | MT_NS | \
+					MT_USER, \
+					PAGE_SIZE)
+
+#define PLAT_SP_IMAGE_NS_BUF_BASE	PLAT_QEMU_SP_IMAGE_NS_BUF_BASE
+#define PLAT_SP_IMAGE_NS_BUF_SIZE	PLAT_QEMU_SP_IMAGE_NS_BUF_SIZE
+
+#define PLAT_QEMU_SP_IMAGE_HEAP_BASE	(PLAT_QEMU_SP_IMAGE_BASE + \
+					PLAT_QEMU_SP_IMAGE_SIZE)
+#define PLAT_QEMU_SP_IMAGE_HEAP_SIZE	ULL(0x800000)
+
+#define PLAT_SP_IMAGE_STACK_BASE	(PLAT_QEMU_SP_IMAGE_HEAP_BASE + \
+						PLAT_QEMU_SP_IMAGE_HEAP_SIZE)
+#define PLAT_SP_IMAGE_STACK_PCPU_SIZE	ULL(0x10000)
+#define QEMU_SP_IMAGE_STACK_TOTAL_SIZE	(PLATFORM_CORE_COUNT * \
+						PLAT_SP_IMAGE_STACK_PCPU_SIZE)
+
+#define QEMU_SP_IMAGE_RW_MMAP		MAP_REGION2( \
+					PLAT_QEMU_SP_IMAGE_HEAP_BASE, \
+					PLAT_QEMU_SP_IMAGE_HEAP_BASE, \
+					(QEMU_SP_IMAGE_STACK_TOTAL_SIZE + \
+					PLAT_QEMU_SP_IMAGE_HEAP_SIZE), \
+					MT_RW_DATA | MT_SECURE | \
+					MT_USER, \
+					PAGE_SIZE)
+
+/* Total number of memory regions with distinct properties */
+#define PLAT_QEMU_SP_IMAGE_NUM_MEM_REGIONS	6
+
+/*
+ * Name of the section to put the translation tables used by the S-EL1/S-EL0
+ * context of a Secure Partition.
+ */
+#define PLAT_SP_IMAGE_XLAT_SECTION_NAME		"qemu_sp_xlat_table"
+#define PLAT_SP_IMAGE_BASE_XLAT_SECTION_NAME	"qemu_sp_xlat_table"
+
+/* Cookies passed to the Secure Partition at boot. Not used by QEMU platforms.*/
+#define PLAT_SPM_COOKIE_0		ULL(0)
+#define PLAT_SPM_COOKIE_1		ULL(0)
+#endif
+
+#define QEMU_PRI_BITS		2
+#define PLAT_SP_PRI		0x20
+
-#endif /* __PLATFORM_DEF_H__ */
+#endif /* PLATFORM_DEF_H */
diff --git a/plat/qemu/qemu_sbsa/platform.mk b/plat/qemu/qemu_sbsa/platform.mk
index 09856d6..3aa7cbe 100644
--- a/plat/qemu/qemu_sbsa/platform.mk
+++ b/plat/qemu/qemu_sbsa/platform.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2019, Linaro Limited and Contributors. All rights reserved.
+# Copyright (c) 2019-2020, Linaro Limited and Contributors. All rights reserved.
 #
 # SPDX-License-Identifier: BSD-3-Clause
 #
@@ -8,6 +8,12 @@
 
 include lib/libfdt/libfdt.mk
 
+ifeq (${SPM_MM},1)
+NEED_BL32		:=	yes
+EL3_EXCEPTION_HANDLING	:=	1
+GICV2_G0_FOR_EL3	:=	1
+endif
+
 # Enable new version of image loading on QEMU platforms
 LOAD_IMAGE_V2		:=	1
 
@@ -80,6 +86,9 @@
 				${PLAT_QEMU_COMMON_PATH}/aarch64/plat_helpers.S	\
 				${PLAT_QEMU_COMMON_PATH}/qemu_bl31_setup.c	\
 				${QEMU_GIC_SOURCES}
+ifeq (${SPM_MM},1)
+	BL31_SOURCES		+=	${PLAT_QEMU_COMMON_PATH}/qemu_spm.c
+endif
 
 SEPARATE_CODE_AND_RODATA	:= 1
 ENABLE_STACK_PROTECTOR		:= 0