diff --git a/Makefile b/Makefile
index 1baacf0..cac3e12 100644
--- a/Makefile
+++ b/Makefile
@@ -1360,7 +1360,7 @@
 	${Q}set MAKEFLAGS= && ${MSVC_NMAKE} /nologo /f ${FIPTOOLPATH}/Makefile.msvc FIPTOOLPATH=$(subst /,\,$(FIPTOOLPATH)) FIPTOOL=$(subst /,\,$(FIPTOOL)) realclean
 endif
 	${Q}${MAKE} --no-print-directory -C ${SPTOOLPATH} clean
-	${Q}${MAKE} PLAT=${PLAT} --no-print-directory -C ${CRTTOOLPATH} clean
+	${Q}${MAKE} PLAT=${PLAT} --no-print-directory -C ${CRTTOOLPATH} realclean
 	${Q}${MAKE} PLAT=${PLAT} --no-print-directory -C ${ENCTOOLPATH} realclean
 	${Q}${MAKE} --no-print-directory -C ${ROMLIBPATH} clean
 
diff --git a/changelog.yaml b/changelog.yaml
index 4d38e37..fa42e96 100644
--- a/changelog.yaml
+++ b/changelog.yaml
@@ -185,6 +185,13 @@
                 deprecated:
                   - plat/tc0
 
+      - title: Intel
+        scope: intel
+
+        subsections:
+          - title: SoC
+            scope: soc
+
       - title: Marvell
         scope: marvell
 
diff --git a/docs/components/realm-management-extension.rst b/docs/components/realm-management-extension.rst
index 2c4e0b8..5fa5140 100644
--- a/docs/components/realm-management-extension.rst
+++ b/docs/components/realm-management-extension.rst
@@ -154,6 +154,8 @@
 
  git clone --recurse-submodules https://git.trustedfirmware.org/hafnium/hafnium.git
  cd hafnium
+ #  Use the default prebuilt LLVM/clang toolchain
+ PATH=$PWD/prebuilts/linux-x64/clang/bin:$PWD/prebuilts/linux-x64/dtc:$PATH
  make PROJECT=reference
 
 The Hafnium binary should be located at
@@ -254,6 +256,8 @@
                                                                 Passed
  > Test suite 'Realm payload tests'
                                                                 Passed
+ > Test suite 'Invalid memory access'
+                                                                Passed
  ...
 
 
diff --git a/docs/design/cpu-specific-build-macros.rst b/docs/design/cpu-specific-build-macros.rst
index 6029035..7aa7384 100644
--- a/docs/design/cpu-specific-build-macros.rst
+++ b/docs/design/cpu-specific-build-macros.rst
@@ -474,6 +474,38 @@
    Cortex-X2 CPU. This needs to be enabled only for revisions r0p0, r1p0 and
    r2p0 of the CPU, it is fixed in r2p1.
 
+For Cortex-A510, the following errata build flags are defined :
+
+-  ``ERRATA_A510_1922240``: This applies errata 1922240 workaround to
+   Cortex-A510 CPU. This needs to be enabled only for revision r0p0, it is
+   fixed in r0p1.
+
+-  ``ERRATA_A510_2288014``: This applies errata 2288014 workaround to
+   Cortex-A510 CPU. This needs to be enabled only for revisions r0p0, r0p1,
+   r0p2, r0p3 and r1p0, it is fixed in r1p1.
+
+-  ``ERRATA_A510_2042739``: This applies errata 2042739 workaround to
+   Cortex-A510 CPU. This needs to be enabled only for revisions r0p0, r0p1 and
+   r0p2, it is fixed in r0p3.
+
+-  ``ERRATA_A510_2041909``: This applies errata 2041909 workaround to
+   Cortex-A510 CPU. This needs to be enabled only for revision r0p2 and is fixed
+   in r0p3. The issue is also present in r0p0 and r0p1 but there is no
+   workaround for those revisions.
+
+-  ``ERRATA_A510_2250311``: This applies errata 2250311 workaround to
+   Cortex-A510 CPU. This needs to be enabled for revisions r0p0, r0p1, r0p2,
+   r0p3 and r1p0, it is fixed in r1p1. This workaround disables MPMM even if
+   ENABLE_MPMM=1.
+
+-  ``ERRATA_A510_2218950``: This applies errata 2218950 workaround to
+   Cortex-A510 CPU. This needs to be enabled for revisions r0p0, r0p1, r0p2,
+   r0p3 and r1p0, it is fixed in r1p1.
+
+-  ``ERRATA_A510_2172148``: This applies errata 2172148 workaround to
+   Cortex-A510 CPU. This needs to be enabled for revisions r0p0, r0p1, r0p2,
+   r0p3 and r1p0, it is fixed in r1p1.
+
 DSU Errata Workarounds
 ----------------------
 
diff --git a/docs/design_documents/context_mgmt_rework.rst b/docs/design_documents/context_mgmt_rework.rst
new file mode 100644
index 0000000..59f9d4e
--- /dev/null
+++ b/docs/design_documents/context_mgmt_rework.rst
@@ -0,0 +1,197 @@
+Enhance Context Management library for EL3 firmware
+===================================================
+
+:Authors: Soby Mathew & Zelalem Aweke
+:Organization: Arm Limited
+:Contact: Soby Mathew <soby.mathew@arm.com> & Zelalem Aweke <zelalem.aweke@arm.com>
+:Status: RFC
+
+.. contents:: Table of Contents
+
+Introduction
+------------
+The context management library in TF-A provides the basic CPU context
+initialization and management routines for use by different components
+in EL3 firmware. The original design of the library was done keeping in
+mind the 2 world switch and hence this design pattern has been extended to
+keep up with growing requirements of EL3 firmware. With the introduction
+of a new Realm world and a separate Root world for EL3 firmware, it is clear
+that this library needs to be refactored to cater for future enhancements and
+reduce chances of introducing error in code. This also aligns with the overall
+goal of reducing EL3 firmware complexity and footprint.
+
+It is expected that the suggestions below could have legacy implications and
+hence we are mainly targeting SPM/RMM based systems. It is expected that these
+legacy issues will need to be sorted out as part of implementation on a case
+by case basis.
+
+Design Principles
+-----------------
+The below section lays down the design principles for re-factoring the context
+management library :
+
+(1) **Decentralized model for context mgmt**
+
+    Both the Secure and Realm worlds have associated dispatcher component in
+    EL3 firmware to allow management of their respective worlds. Allowing the
+    dispatcher to own the context for their respective world and moving away
+    from a centralized policy management by context management library will
+    remove the world differentiation code in the library. This also means that
+    the library will not be responsible for CPU feature enablement for
+    Secure and Realm worlds. See point 3 and 4 for more details.
+
+    The Non Secure world does not have a dispatcher component and hence EL3
+    firmware (BL31)/context management library needs to have routines to help
+    initialize the Non Secure world context.
+
+(2) **EL3 should only initialize immediate used lower EL**
+
+    Due to the way TF-A evolved, from EL3 interacting with an S-EL1 payload to
+    SPM in S-EL2, there is some code initializing S-EL1 registers which is
+    probably redundant when SPM is present in S-EL2. As a principle, EL3
+    firmware should only initialize the next immediate lower EL in use.
+    If EL2 needs to be skipped and is not to be used at runtime, then
+    EL3 can do the bare minimal EL2 init and init EL1 to prepare for EL3 exit.
+    It is expected that this skip EL2 configuration is only needed for NS
+    world to support legacy Android deployments. It is worth removing this
+    `skip EL2 for Non Secure` config support if this is no longer used.
+
+(3) **Maintain EL3 sysregs which affect lower EL within CPU context**
+
+    The CPU context contains some EL3 sysregs and gets applied on a per-world
+    basis (eg: cptr_el3, scr_el3, zcr_el3 is part of the context
+    because different settings need to be applied between each world).
+    But this design pattern is not enforced in TF-A. It is possible to directly
+    modify EL3 sysreg dynamically during the transition between NS and Secure
+    worlds. Having multiple ways of manipulating EL3 sysregs for different
+    values between the worlds is flaky and error prone. The proposal is to
+    enforce the rule that any EL3 sysreg which can be different between worlds
+    is maintained in the CPU Context. Once the context is initialized the
+    EL3 sysreg values corresponding to the world being entered will be restored.
+
+(4) **Allow more flexibility for Dispatchers to select feature set to save and restore**
+
+    The current functions for EL2 CPU context save and restore is a single
+    function which takes care of saving and restoring all the registers for
+    EL2. This method is inflexible and it does not allow to dynamically detect
+    CPU features to select registers to save and restore. It also assumes that
+    both Realm and Secure world will have the same feature set enabled from
+    EL3 at runtime and makes it hard to enable different features for each
+    world. The framework should cater for selective save and restore of CPU
+    registers which can be controlled by the dispatcher.
+
+    For the implementation, this could mean that there is a separate assembly
+    save and restore routine corresponding to Arch feature. The memory allocation
+    within the CPU Context for each set of registers will be controlled by a
+    FEAT_xxx build option. It is a valid configuration to have
+    context memory allocated but not used at runtime based on feature detection
+    at runtime or the platform owner has decided not to enable the feature
+    for the particular world.
+
+Context Allocation and Initialization
+-------------------------------------
+
+|context_mgmt_abs|
+
+.. |context_mgmt_abs| image::
+   ../resources/diagrams/context_management_abs.png
+
+The above figure shows how the CPU context is allocated within TF-A. The
+allocation for Secure and Realm world is by the respective dispatcher. In the case
+of NS world, the context is allocated by the PSCI lib. This scheme allows TF-A
+to be built in various configurations (with or without Secure/Realm worlds) and
+will result in optimal memory footprint. The Secure and Realm world contexts are
+initialized by invoking context management library APIs which then initialize
+each world based on conditional evaluation of the security state of the
+context. The proposal here is to move the conditional initialization
+of context for Secure and Realm worlds to their respective dispatchers and
+have the library do only the common init needed. The library can export
+helpers to initialize registers corresponding to certain features but
+should not try to do different initialization between the worlds. The library
+can also export helpers for initialization of NS CPU Context since there is no
+dispatcher for that world.
+
+This implies that any world specific code in context mgmt lib should now be
+migrated to the respective "owners". To maintain compatibility with legacy, the
+current functions can be retained in the lib and perhaps define new ones for
+use by SPMD and RMMD. The details of this can be worked out during
+implementation.
+
+Introducing Root Context
+------------------------
+Till now, we have been ignoring the fact that Root world (or EL3) itself could
+have some settings which are distinct from NS/S/Realm worlds. In this case,
+Root world itself would need to maintain some sysregs settings for its own
+execution and would need to use sysregs of lower EL (eg: PAuth, pmcr) to enable
+some functionalities in EL3. The current sequence for context save and restore
+in TF-A is as given below:
+
+|context_mgmt_existing|
+
+.. |context_mgmt_existing| image::
+   ../resources/diagrams/context_mgmt_existing.png
+
+Note1: The EL3 CPU context is not a homogenous collection of EL3 sysregs but
+a collection of EL3 and some other lower EL registers. The save and restore
+is also not done homogenously but based on the objective of using the
+particular register.
+
+Note2: The EL1 context save and restore can possibly be removed when switching
+to S-EL2 as SPM can take care of saving the incoming NS EL1 context.
+
+It can be seen that the EL3 sysreg values applied while the execution is in Root
+world corresponds to the world it came from (eg: if entering EL3 from NS world,
+the sysregs correspond to the values in NS context). There is a case that EL3
+itself may have some settings to apply for various reasons. A good example for
+this is the cptr_el3 regsiter. Although FPU traps need to be disabled for
+Non Secure, Secure and Realm worlds, the EL3 execution itself may keep the trap
+enabled for the sake of robustness. Another example is, if the MTE feature
+is enabled for a particular world, this feature will be enabled for Root world
+as well when entering EL3 from that world. The firmware at EL3 may not
+be expecting this feature to be enabled and may cause unwanted side-effects
+which could be problematic. Thus it would be more robust if Root world is not
+subject to EL3 sysreg values from other worlds but maintains its own values
+which is stable and predictable throughout root world execution.
+
+There is also the case that when EL3 would like to make use of some
+Architectural feature(s) or do some security hardening, it might need
+programming of some lower EL sysregs. For example, if EL3 needs to make
+use of Pointer Authentication (PAuth) feature, it needs to program
+its own PAuth Keys during execution at EL3. Hence EL3 needs its
+own copy of PAuth registers which needs to be restored on every
+entry to EL3. A similar case can be made for DIT bit in PSTATE,
+or use of SP_EL0 for C Runtime Stack at EL3.
+
+The proposal here is to maintain a separate root world CPU context
+which gets applied for Root world execution. This is not the full
+CPU_Context, but subset of EL3 sysregs (`el3_sysreg`) and lower EL
+sysregs (`root_exc_context`) used by EL3. The save and restore
+sequence for this Root context would need to be done in
+an optimal way. The `el3_sysreg` does not need to be saved
+on EL3 Exit and possibly only some registers in `root_exc_context`
+of Root world context would need to be saved on EL3 exit (eg: SP_EL0).
+
+The new sequence for world switch including Root world context would
+be as given below :
+
+|context_mgmt_proposed|
+
+.. |context_mgmt_proposed| image::
+   ../resources/diagrams/context_mgmt_proposed.png
+
+Having this framework in place will allow Root world to make use of lower EL
+registers easily for its own purposes and also have a fixed EL3 sysreg setting
+which is not affected by the settings of other worlds. This will unify the
+Root world register usage pattern for its own execution and remove some
+of the adhoc usages in code.
+
+Conclusion
+----------
+Of all the proposals, the introduction of Root world context would likely need
+further prototyping to confirm the design and we will need to measure the
+performance and memory impact of this change. Other changes are incremental
+improvements which are thought to have negligible impact on EL3 performance.
+
+--------------
+
+*Copyright (c) 2022, Arm Limited and Contributors. All rights reserved.*
diff --git a/docs/design_documents/index.rst b/docs/design_documents/index.rst
index c82d2ee..257a510 100644
--- a/docs/design_documents/index.rst
+++ b/docs/design_documents/index.rst
@@ -7,6 +7,7 @@
    :numbered:
 
    cmake_framework
+   context_mgmt_rework
    measured_boot_poc
 
 --------------
diff --git a/docs/resources/diagrams/context_management_abs.png b/docs/resources/diagrams/context_management_abs.png
new file mode 100644
index 0000000..717ecec
--- /dev/null
+++ b/docs/resources/diagrams/context_management_abs.png
Binary files differ
diff --git a/docs/resources/diagrams/context_mgmt_existing.png b/docs/resources/diagrams/context_mgmt_existing.png
new file mode 100644
index 0000000..5170960
--- /dev/null
+++ b/docs/resources/diagrams/context_mgmt_existing.png
Binary files differ
diff --git a/docs/resources/diagrams/context_mgmt_proposed.png b/docs/resources/diagrams/context_mgmt_proposed.png
new file mode 100644
index 0000000..41ae92f
--- /dev/null
+++ b/docs/resources/diagrams/context_mgmt_proposed.png
Binary files differ
diff --git a/drivers/st/clk/stm32mp1_clk.c b/drivers/st/clk/stm32mp1_clk.c
index f525741..2288348 100644
--- a/drivers/st/clk/stm32mp1_clk.c
+++ b/drivers/st/clk/stm32mp1_clk.c
@@ -1564,7 +1564,7 @@
 	/* Wait PLL lock */
 	while ((mmio_read_32(pllxcr) & RCC_PLLNCR_PLLRDY) == 0U) {
 		if (timeout_elapsed(timeout)) {
-			ERROR("PLL%d start failed @ 0x%lx: 0x%x\n",
+			ERROR("PLL%u start failed @ 0x%lx: 0x%x\n",
 			      pll_id, pllxcr, mmio_read_32(pllxcr));
 			return -ETIMEDOUT;
 		}
@@ -1593,7 +1593,7 @@
 	/* Wait PLL stopped */
 	while ((mmio_read_32(pllxcr) & RCC_PLLNCR_PLLRDY) != 0U) {
 		if (timeout_elapsed(timeout)) {
-			ERROR("PLL%d stop failed @ 0x%lx: 0x%x\n",
+			ERROR("PLL%u stop failed @ 0x%lx: 0x%x\n",
 			      pll_id, pllxcr, mmio_read_32(pllxcr));
 			return -ETIMEDOUT;
 		}
@@ -1852,7 +1852,7 @@
 	for (i = (enum stm32mp1_pll_id)0; i < _PLL_NB; i++) {
 		char name[12];
 
-		snprintf(name, sizeof(name), "st,pll@%d", i);
+		snprintf(name, sizeof(name), "st,pll@%u", i);
 		plloff[i] = fdt_rcc_subnode_offset(name);
 
 		pllcfg_valid[i] = fdt_check_node(plloff[i]);
diff --git a/drivers/ufs/ufs.c b/drivers/ufs/ufs.c
index 5c20932..3d6d99f 100644
--- a/drivers/ufs/ufs.c
+++ b/drivers/ufs/ufs.c
@@ -702,7 +702,6 @@
 	       (ufs_params.desc_base != 0) &&
 	       (ufs_params.desc_size >= UFS_DESC_SIZE));
 
-	memset((void *)buf, 0, size);
 	get_utrd(&utrd);
 	ufs_prepare_cmd(&utrd, CDBCMD_READ_10, lun, lba, buf, size);
 	ufs_send_request(utrd.task_tag);
diff --git a/include/drivers/measured_boot/event_log/event_log.h b/include/drivers/measured_boot/event_log/event_log.h
index a687d41..0a19f8a 100644
--- a/include/drivers/measured_boot/event_log/event_log.h
+++ b/include/drivers/measured_boot/event_log/event_log.h
@@ -77,6 +77,7 @@
 #define EVLOG_STM32_STRING		"STM32"
 #define EVLOG_TB_FW_CONFIG_STRING	"TB_FW_CONFIG"
 #define	EVLOG_TOS_FW_CONFIG_STRING	"TOS_FW_CONFIG"
+#define EVLOG_RMM_STRING 		"RMM"
 
 typedef struct {
 	unsigned int id;
diff --git a/include/lib/cpus/aarch64/cortex_a510.h b/include/lib/cpus/aarch64/cortex_a510.h
index 6a4cfdf..2b8db14 100644
--- a/include/lib/cpus/aarch64/cortex_a510.h
+++ b/include/lib/cpus/aarch64/cortex_a510.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2021, ARM Limited. All rights reserved.
+ * Copyright (c) 2022, ARM Limited. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -13,6 +13,10 @@
  * CPU Extended Control register specific definitions
  ******************************************************************************/
 #define CORTEX_A510_CPUECTLR_EL1				S3_0_C15_C1_4
+#define CORTEX_A510_CPUECTLR_EL1_READPREFERUNIQUE_SHIFT		U(19)
+#define CORTEX_A510_CPUECTLR_EL1_READPREFERUNIQUE_DISABLE	U(1)
+#define CORTEX_A510_CPUECTLR_EL1_RSCTL_SHIFT			U(23)
+#define CORTEX_A510_CPUECTLR_EL1_NTCTL_SHIFT			U(46)
 
 /*******************************************************************************
  * CPU Power Control register specific definitions
@@ -20,4 +24,14 @@
 #define CORTEX_A510_CPUPWRCTLR_EL1				S3_0_C15_C2_7
 #define CORTEX_A510_CPUPWRCTLR_EL1_CORE_PWRDN_BIT		U(1)
 
+/*******************************************************************************
+ * Complex auxiliary control register specific definitions
+ ******************************************************************************/
+#define CORTEX_A510_CMPXACTLR_EL1				S3_0_C15_C1_3
+
+/*******************************************************************************
+ * Auxiliary control register specific definitions
+ ******************************************************************************/
+#define CORTEX_A510_CPUACTLR_EL1				S3_0_C15_C1_0
+
 #endif /* CORTEX_A510_H */
diff --git a/lib/cpus/aarch64/cortex_a510.S b/lib/cpus/aarch64/cortex_a510.S
index 3310322..34e1082 100644
--- a/lib/cpus/aarch64/cortex_a510.S
+++ b/lib/cpus/aarch64/cortex_a510.S
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2021, ARM Limited. All rights reserved.
+ * Copyright (c) 2022, ARM Limited. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -13,14 +13,257 @@
 
 /* Hardware handled coherency */
 #if HW_ASSISTED_COHERENCY == 0
-#error "Cortex A510 must be compiled with HW_ASSISTED_COHERENCY enabled"
+#error "Cortex-A510 must be compiled with HW_ASSISTED_COHERENCY enabled"
 #endif
 
 /* 64-bit only core */
 #if CTX_INCLUDE_AARCH32_REGS == 1
-#error "Cortex A510 supports only AArch64. Compile with CTX_INCLUDE_AARCH32_REGS=0"
+#error "Cortex-A510 supports only AArch64. Compile with CTX_INCLUDE_AARCH32_REGS=0"
 #endif
 
+	/* --------------------------------------------------
+	 * Errata Workaround for Cortex-A510 Errata #1922240.
+	 * This applies only to revision r0p0 (fixed in r0p1)
+	 * x0: variant[4:7] and revision[0:3] of current cpu.
+	 * Shall clobber: x0, x1, x17
+	 * --------------------------------------------------
+	 */
+func errata_cortex_a510_1922240_wa
+	/* Check workaround compatibility. */
+	mov	x17, x30
+	bl	check_errata_1922240
+	cbz	x0, 1f
+
+	/* Apply the workaround by setting IMP_CMPXACTLR_EL1[11:10] = 0b11. */
+	mrs	x0, CORTEX_A510_CMPXACTLR_EL1
+	mov	x1, #3
+	bfi	x0, x1, #10, #2
+	msr	CORTEX_A510_CMPXACTLR_EL1, x0
+
+1:
+	ret	x17
+endfunc errata_cortex_a510_1922240_wa
+
+func check_errata_1922240
+	/* Applies to r0p0 only */
+	mov	x1, #0x00
+	b	cpu_rev_var_ls
+endfunc check_errata_1922240
+
+	/* --------------------------------------------------
+	 * Errata Workaround for Cortex-A510 Errata #2288014.
+	 * This applies only to revisions r0p0, r0p1, r0p2,
+	 * r0p3 and r1p0. (fixed in r1p1)
+	 * x0: variant[4:7] and revision[0:3] of current cpu.
+	 * Shall clobber: x0, x1, x17
+	 * --------------------------------------------------
+	 */
+func errata_cortex_a510_2288014_wa
+	/* Check workaround compatibility. */
+	mov	x17, x30
+	bl	check_errata_2288014
+	cbz	x0, 1f
+
+	/* Apply the workaround by setting IMP_CPUACTLR_EL1[18] = 0b1. */
+	mrs	x0, CORTEX_A510_CPUACTLR_EL1
+	mov	x1, #1
+	bfi	x0, x1, #18, #1
+	msr	CORTEX_A510_CPUACTLR_EL1, x0
+
+1:
+	ret	x17
+endfunc errata_cortex_a510_2288014_wa
+
+func check_errata_2288014
+	/* Applies to r1p0 and below */
+	mov	x1, #0x10
+	b	cpu_rev_var_ls
+endfunc check_errata_2288014
+
+	/* --------------------------------------------------
+	 * Errata Workaround for Cortex-A510 Errata #2042739.
+	 * This applies only to revisions r0p0, r0p1 and r0p2.
+	 * (fixed in r0p3)
+	 * x0: variant[4:7] and revision[0:3] of current cpu.
+	 * Shall clobber: x0, x1, x17
+	 * --------------------------------------------------
+	 */
+func errata_cortex_a510_2042739_wa
+	/* Check workaround compatibility. */
+	mov	x17, x30
+	bl	check_errata_2042739
+	cbz	x0, 1f
+
+	/* Apply the workaround by disabling ReadPreferUnique. */
+	mrs	x0, CORTEX_A510_CPUECTLR_EL1
+	mov	x1, #CORTEX_A510_CPUECTLR_EL1_READPREFERUNIQUE_DISABLE
+	bfi	x0, x1, #CORTEX_A510_CPUECTLR_EL1_READPREFERUNIQUE_SHIFT, #1
+	msr	CORTEX_A510_CPUECTLR_EL1, x0
+
+1:
+	ret	x17
+endfunc errata_cortex_a510_2042739_wa
+
+func check_errata_2042739
+	/* Applies to revisions r0p0 - r0p2 */
+	mov	x1, #0x02
+	b	cpu_rev_var_ls
+endfunc check_errata_2042739
+
+	/* --------------------------------------------------
+	 * Errata Workaround for Cortex-A510 Errata #2041909.
+	 * This applies only to revision r0p2 and it is fixed in
+	 * r0p3. The issue is also present in r0p0 and r0p1 but
+	 * there is no workaround in those revisions.
+	 * x0: variant[4:7] and revision[0:3] of current cpu.
+	 * Shall clobber: x0, x1, x2, x17
+	 * --------------------------------------------------
+	 */
+func errata_cortex_a510_2041909_wa
+	/* Check workaround compatibility. */
+	mov	x17, x30
+	bl	check_errata_2041909
+	cbz	x0, 1f
+
+	/* Apply workaround */
+	mov	x0, xzr
+	msr	S3_6_C15_C4_0, x0
+	isb
+
+	mov	x0, #0x8500000
+	msr	S3_6_C15_C4_2, x0
+
+	mov	x0, #0x1F700000
+	movk	x0, #0x8, lsl #32
+	msr	S3_6_C15_C4_3, x0
+
+	mov	x0, #0x3F1
+	movk	x0, #0x110, lsl #16
+	msr	S3_6_C15_C4_1, x0
+	isb
+
+1:
+	ret	x17
+endfunc errata_cortex_a510_2041909_wa
+
+func check_errata_2041909
+	/* Applies only to revision r0p2 */
+	mov	x1, #0x02
+	mov	x2, #0x02
+	b	cpu_rev_var_range
+endfunc check_errata_2041909
+
+	/* --------------------------------------------------
+	 * Errata Workaround for Cortex-A510 Errata #2250311.
+	 * This applies only to revisions r0p0, r0p1, r0p2,
+	 * r0p3 and r1p0, and is fixed in r1p1.
+	 * This workaround is not a typical errata fix. MPMM
+	 * is disabled here, but this conflicts with the BL31
+	 * MPMM support. So in addition to simply disabling
+	 * the feature, a flag is set in the MPMM library
+	 * indicating that it should not be enabled even if
+	 * ENABLE_MPMM=1.
+	 * x0: variant[4:7] and revision[0:3] of current cpu.
+	 * Shall clobber: x0, x1, x17
+	 * --------------------------------------------------
+	 */
+func errata_cortex_a510_2250311_wa
+	/* Check workaround compatibility. */
+	mov	x17, x30
+	bl	check_errata_2250311
+	cbz	x0, 1f
+
+	/* Disable MPMM */
+	mrs	x0, CPUMPMMCR_EL3
+	bfm	x0, xzr, #0, #0 /* bfc instruction does not work in GCC */
+	msr	CPUMPMMCR_EL3, x0
+
+#if ENABLE_MPMM && IMAGE_BL31
+	/* If ENABLE_MPMM is set, tell the runtime lib to skip enabling it. */
+	bl mpmm_errata_disable
+#endif
+
+1:
+	ret x17
+endfunc errata_cortex_a510_2250311_wa
+
+func check_errata_2250311
+	/* Applies to r1p0 and lower */
+	mov	x1, #0x10
+	b	cpu_rev_var_ls
+endfunc check_errata_2250311
+
+	/* --------------------------------------------------
+	 * Errata Workaround for Cortex-A510 Errata #2218950.
+	 * This applies only to revisions r0p0, r0p1, r0p2,
+	 * r0p3 and r1p0, and is fixed in r1p1.
+	 * x0: variant[4:7] and revision[0:3] of current cpu.
+	 * Shall clobber: x0, x1, x17
+	 * --------------------------------------------------
+	 */
+func errata_cortex_a510_2218950_wa
+	/* Check workaround compatibility. */
+	mov	x17, x30
+	bl	check_errata_2218950
+	cbz	x0, 1f
+
+	/* Source register for BFI */
+	mov	x1, #1
+
+	/* Set bit 18 in CPUACTLR_EL1 */
+	mrs	x0, CORTEX_A510_CPUACTLR_EL1
+	bfi	x0, x1, #18, #1
+	msr	CORTEX_A510_CPUACTLR_EL1, x0
+
+	/* Set bit 25 in CMPXACTLR_EL1 */
+	mrs	x0, CORTEX_A510_CMPXACTLR_EL1
+	bfi	x0, x1, #25, #1
+	msr	CORTEX_A510_CMPXACTLR_EL1, x0
+
+1:
+	ret x17
+endfunc errata_cortex_a510_2218950_wa
+
+func check_errata_2218950
+	/* Applies to r1p0 and lower */
+	mov	x1, #0x10
+	b	cpu_rev_var_ls
+endfunc check_errata_2218950
+
+	/* --------------------------------------------------
+	 * Errata Workaround for Cortex-A510 Errata #2172148.
+	 * This applies only to revisions r0p0, r0p1, r0p2,
+	 * r0p3 and r1p0, and is fixed in r1p1.
+	 * x0: variant[4:7] and revision[0:3] of current cpu.
+	 * Shall clobber: x0, x1, x17
+	 * --------------------------------------------------
+	 */
+func errata_cortex_a510_2172148_wa
+	/* Check workaround compatibility. */
+	mov	x17, x30
+	bl	check_errata_2172148
+	cbz	x0, 1f
+
+	/*
+	 * Force L2 allocation of transient lines by setting
+	 * CPUECTLR_EL1.RSCTL=0b01 and CPUECTLR_EL1.NTCTL=0b01.
+	 */
+	mrs	x0, CORTEX_A510_CPUECTLR_EL1
+	mov	x1, #1
+	bfi	x0, x1, #CORTEX_A510_CPUECTLR_EL1_RSCTL_SHIFT, #2
+	bfi	x0, x1, #CORTEX_A510_CPUECTLR_EL1_NTCTL_SHIFT, #2
+	msr	CORTEX_A510_CPUECTLR_EL1, x0
+
+1:
+	ret x17
+endfunc errata_cortex_a510_2172148_wa
+
+func check_errata_2172148
+	/* Applies to r1p0 and lower */
+	mov	x1, #0x10
+	b	cpu_rev_var_ls
+endfunc check_errata_2172148
+
 	/* ----------------------------------------------------
 	 * HW will do the cache maintenance while powering down
 	 * ----------------------------------------------------
@@ -38,19 +281,79 @@
 endfunc cortex_a510_core_pwr_dwn
 
 	/*
-	 * Errata printing function for Cortex A510. Must follow AAPCS.
+	 * Errata printing function for Cortex-A510. Must follow AAPCS.
 	 */
 #if REPORT_ERRATA
 func cortex_a510_errata_report
+	stp	x8, x30, [sp, #-16]!
+
+	bl	cpu_get_rev_var
+	mov	x8, x0
+
+	/*
+	 * Report all errata. The revision-variant information is passed to
+	 * checking functions of each errata.
+	 */
+	report_errata ERRATA_A510_1922240, cortex_a510, 1922240
+	report_errata ERRATA_A510_2288014, cortex_a510, 2288014
+	report_errata ERRATA_A510_2042739, cortex_a510, 2042739
+	report_errata ERRATA_A510_2041909, cortex_a510, 2041909
+	report_errata ERRATA_A510_2250311, cortex_a510, 2250311
+	report_errata ERRATA_A510_2218950, cortex_a510, 2218950
+	report_errata ERRATA_A510_2172148, cortex_a510, 2172148
+
+	ldp	x8, x30, [sp], #16
 	ret
 endfunc cortex_a510_errata_report
 #endif
 
 func cortex_a510_reset_func
+	mov	x19, x30
+
 	/* Disable speculative loads */
 	msr	SSBS, xzr
 	isb
-	ret
+
+	/* Get the CPU revision and stash it in x18. */
+	bl	cpu_get_rev_var
+	mov	x18, x0
+
+#if ERRATA_A510_1922240
+	mov	x0, x18
+	bl	errata_cortex_a510_1922240_wa
+#endif
+
+#if ERRATA_A510_2288014
+	mov	x0, x18
+	bl	errata_cortex_a510_2288014_wa
+#endif
+
+#if ERRATA_A510_2042739
+	mov	x0, x18
+	bl	errata_cortex_a510_2042739_wa
+#endif
+
+#if ERRATA_A510_2041909
+	mov	x0, x18
+	bl	errata_cortex_a510_2041909_wa
+#endif
+
+#if ERRATA_A510_2250311
+	mov	x0, x18
+	bl	errata_cortex_a510_2250311_wa
+#endif
+
+#if ERRATA_A510_2218950
+	mov	x0, x18
+	bl	errata_cortex_a510_2218950_wa
+#endif
+
+#if ERRATA_A510_2172148
+	mov	x0, x18
+	bl	errata_cortex_a510_2172148_wa
+#endif
+
+	ret	x19
 endfunc cortex_a510_reset_func
 
 	/* ---------------------------------------------
diff --git a/lib/cpus/cpu-ops.mk b/lib/cpus/cpu-ops.mk
index e02aa01..62b67b6 100644
--- a/lib/cpus/cpu-ops.mk
+++ b/lib/cpus/cpu-ops.mk
@@ -7,27 +7,27 @@
 
 # Cortex A57 specific optimisation to skip L1 cache flush when
 # cluster is powered down.
-SKIP_A57_L1_FLUSH_PWR_DWN	?=0
+SKIP_A57_L1_FLUSH_PWR_DWN		?=0
 
 # Flag to disable the cache non-temporal hint.
 # It is enabled by default.
-A53_DISABLE_NON_TEMPORAL_HINT	?=1
+A53_DISABLE_NON_TEMPORAL_HINT		?=1
 
 # Flag to disable the cache non-temporal hint.
 # It is enabled by default.
-A57_DISABLE_NON_TEMPORAL_HINT	?=1
+A57_DISABLE_NON_TEMPORAL_HINT		?=1
 
 # Flag to enable higher performance non-cacheable load forwarding.
 # It is disabled by default.
 A57_ENABLE_NONCACHEABLE_LOAD_FWD	?= 0
 
-WORKAROUND_CVE_2017_5715	?=1
-WORKAROUND_CVE_2018_3639	?=1
+WORKAROUND_CVE_2017_5715		?=1
+WORKAROUND_CVE_2018_3639		?=1
 DYNAMIC_WORKAROUND_CVE_2018_3639	?=0
 
 # Flags to indicate internal or external Last level cache
 # By default internal
-NEOVERSE_Nx_EXTERNAL_LLC	?=0
+NEOVERSE_Nx_EXTERNAL_LLC		?=0
 
 # Process A57_ENABLE_NONCACHEABLE_LOAD_FWD flag
 $(eval $(call assert_boolean,A57_ENABLE_NONCACHEABLE_LOAD_FWD))
@@ -60,9 +60,9 @@
 $(eval $(call add_define,NEOVERSE_Nx_EXTERNAL_LLC))
 
 ifneq (${DYNAMIC_WORKAROUND_CVE_2018_3639},0)
-    ifeq (${WORKAROUND_CVE_2018_3639},0)
-        $(error "Error: WORKAROUND_CVE_2018_3639 must be 1 if DYNAMIC_WORKAROUND_CVE_2018_3639 is 1")
-    endif
+	ifeq (${WORKAROUND_CVE_2018_3639},0)
+		$(error "Error: WORKAROUND_CVE_2018_3639 must be 1 if DYNAMIC_WORKAROUND_CVE_2018_3639 is 1")
+	endif
 endif
 
 # CPU Errata Build flags.
@@ -108,7 +108,7 @@
 # only to revision <= r0p2 of the Cortex A53 cpu.
 ERRATA_A53_827319	?=0
 
-# Flag to apply erratum 835769 workaround at compile and link time.  This
+# Flag to apply erratum 835769 workaround at compile and link time. This
 # erratum applies to revision <= r0p4 of the Cortex A53 cpu. Enabling this
 # workaround can lead the linker to create "*.stub" sections.
 ERRATA_A53_835769	?=0
@@ -170,11 +170,11 @@
 # only to revision r0p0 of the Cortex A57 cpu.
 ERRATA_A57_813419	?=0
 
-# Flag to apply erratum 813420  workaround during reset. This erratum applies
+# Flag to apply erratum 813420 workaround during reset. This erratum applies
 # only to revision r0p0 of the Cortex A57 cpu.
 ERRATA_A57_813420	?=0
 
-# Flag to apply erratum 814670  workaround during reset. This erratum applies
+# Flag to apply erratum 814670 workaround during reset. This erratum applies
 # only to revision r0p0 of the Cortex A57 cpu.
 ERRATA_A57_814670	?=0
 
@@ -307,7 +307,7 @@
 ERRATA_A78_1941498	?=0
 
 # Flag to apply erratum 1951500 workaround during reset. This erratum applies
-# to revisions r1p0 and r1p1 of the A78 cpu.  The issue is present in r0p0 as
+# to revisions r1p0 and r1p1 of the A78 cpu. The issue is present in r0p0 as
 # well but there is no workaround for that revision.
 ERRATA_A78_1951500	?=0
 
@@ -317,11 +317,11 @@
 
 # Flag to apply erratum 1952683 workaround during reset. This erratum applies
 # to revision r0p0 of the A78 cpu and was fixed in the revision r1p0.
-ERRATA_A78_1952683  ?=0
+ERRATA_A78_1952683	?=0
 
 # Flag to apply erratum 2132060 workaround during reset. This erratum applies
 # to revisions r0p0, r1p0, r1p1, and r1p2 of the A78 cpu. It is still open.
-ERRATA_A78_2132060  ?=0
+ERRATA_A78_2132060	?=0
 
 # Flag to apply erratum 2242635 workaround during reset. This erratum applies
 # to revisions r1p0, r1p1, and r1p2 of the A78 cpu and is open. The issue is
@@ -389,7 +389,7 @@
 ERRATA_N1_1868343	?=0
 
 # Flag to apply erratum 1946160 workaround during reset. This erratum applies
-# to revisions r3p0, r3p1, r4p0, and r4p1 of the Neoverse N1 cpu.  The issue
+# to revisions r3p0, r3p1, r4p0, and r4p1 of the Neoverse N1 cpu. The issue
 # exists in revisions r0p0, r1p0, and r2p0 as well but there is no workaround.
 ERRATA_N1_1946160	?=0
 
@@ -397,19 +397,19 @@
 # to revisions r0p0 of the Neoverse-N2 cpu, it is still open.
 ERRATA_N2_2002655	?=0
 
-# Flag to apply erratum 1774420 workaround during reset.  This erratum applies
+# Flag to apply erratum 1774420 workaround during reset. This erratum applies
 # to revisions r0p0 and r1p0 of the Neoverse V1 core, and was fixed in r1p1.
 ERRATA_V1_1774420	?=0
 
-# Flag to apply erratum 1791573 workaround during reset.  This erratum applies
+# Flag to apply erratum 1791573 workaround during reset. This erratum applies
 # to revisions r0p0 and r1p0 of the Neoverse V1 core, and was fixed in r1p1.
 ERRATA_V1_1791573	?=0
 
-# Flag to apply erratum 1852267 workaround during reset.  This erratum applies
+# Flag to apply erratum 1852267 workaround during reset. This erratum applies
 # to revisions r0p0 and r1p0 of the Neoverse V1 core, and was fixed in r1p1.
 ERRATA_V1_1852267	?=0
 
-# Flag to apply erratum 1925756 workaround during reset.  This needs to be
+# Flag to apply erratum 1925756 workaround during reset. This needs to be
 # enabled for r0p0, r1p0, and r1p1 of the Neoverse V1 core, it is still open.
 ERRATA_V1_1925756	?=0
 
@@ -418,7 +418,7 @@
 ERRATA_V1_1940577	?=0
 
 # Flag to apply erratum 1966096 workaround during reset. This erratum applies
-# to revisions r1p0 and r1p1 of the Neoverse V1 CPU and is open.  This issue
+# to revisions r1p0 and r1p1 of the Neoverse V1 CPU and is open. This issue
 # exists in r0p0 as well but there is no workaround for that revision.
 ERRATA_V1_1966096	?=0
 
@@ -451,6 +451,22 @@
 # to revisions r0p0, r1p0 and r2p0 of the Cortex-A710 cpu and is still open.
 ERRATA_A710_2058056	?=0
 
+# Flag to apply erratum 2055002 workaround during reset. This erratum applies
+# to revision r1p0, r2p0 of the Cortex-A710 cpu and is still open.
+ERRATA_A710_2055002	?=0
+
+# Flag to apply erratum 2017096 workaround during reset. This erratum applies
+# to revision r0p0, r1p0 and r2p0 of the Cortex-A710 cpu and is still open.
+ERRATA_A710_2017096	?=0
+
+# Flag to apply erratum 2267065 workaround during reset. This erratum applies
+# to revision r0p0, r1p0 and r2p0 of the Cortex-A710 cpu and is fixed in r2p1.
+ERRATA_A710_2267065	?=0
+
+# Flag to apply erratum 2136059 workaround during reset. This erratum applies
+# to revision r0p0, r1p0 and r2p0 of the Cortex-A710 cpu and is fixed in r2p1.
+ERRATA_A710_2136059	?=0
+
 # Flag to apply erratum 2067956 workaround during reset. This erratum applies
 # to revision r0p0 of the Neoverse N2 cpu and is still open.
 ERRATA_N2_2067956	?=0
@@ -487,22 +503,6 @@
 # to revision r0p0 of the Neoverse N2 cpu and is still open.
 ERRATA_N2_2280757	?=0
 
-# Flag to apply erratum 2055002 workaround during reset. This erratum applies
-# to revision r1p0, r2p0 of the Cortex-A710 cpu and is still open.
-ERRATA_A710_2055002	?=0
-
-# Flag to apply erratum 2017096 workaround during reset. This erratum applies
-# to revision r0p0, r1p0 and r2p0 of the Cortex-A710 cpu and is still open.
-ERRATA_A710_2017096	?=0
-
-# Flag to apply erratum 2267065 workaround during reset. This erratum applies
-# to revision r0p0, r1p0 and r2p0 of the Cortex-A710 cpu and is fixed in r2p1.
-ERRATA_A710_2267065	?=0
-
-# Flag to apply erratum 2136059 workaround during reset. This erratum applies
-# to revision r0p0, r1p0 and r2p0 of the Cortex-A710 cpu and is fixed in r2p1.
-ERRATA_A710_2136059	?=0
-
 # Flag to apply erratum 2002765 workaround during reset. This erratum applies
 # to revisions r0p0, r1p0, and r2p0 of the Cortex-X2 cpu and is still open.
 ERRATA_X2_2002765	?=0
@@ -530,6 +530,36 @@
 # r2p1.
 ERRATA_X2_2216384	?=0
 
+# Flag to apply erratum 1922240 workaround during reset. This erratum applies
+# to revision r0p0 of the Cortex-A510 cpu and is fixed in r0p1.
+ERRATA_A510_1922240	?=0
+
+# Flag to apply erratum 2288014 workaround during reset. This erratum applies
+# to revisions r0p0, r0p1, r0p2, r0p3 and r1p0 of the Cortex-A510 cpu and is
+# fixed in r1p1.
+ERRATA_A510_2288014	?=0
+
+# Flag to apply erratum 2042739 workaround during reset. This erratum applies
+# to revisions r0p0, r0p1 and r0p2 of the Cortex-A510 cpu and is fixed in r0p3.
+ERRATA_A510_2042739	?=0
+
+# Flag to apply erratum 2041909 workaround during reset. This erratum applies
+# to revision r0p2 of the Cortex-A510 cpu and is fixed in r0p3. The issue is
+# present in r0p0 and r0p1 but there is no workaround for those revisions.
+ERRATA_A510_2041909	?=0
+
+# Flag to apply erratum 2250311 workaround during reset. This erratum applies
+# to revisions r0p0, r0p1, r0p2, r0p3 and r1p0, and is fixed in r1p1.
+ERRATA_A510_2250311	?=0
+
+# Flag to apply erratum 2218950 workaround during reset. This erratum applies
+# to revisions r0p0, r0p1, r0p2, r0p3 and r1p0, and is fixed in r1p1.
+ERRATA_A510_2218950	?=0
+
+# Flag to apply erratum 2172148 workaround during reset. This erratum applies
+# to revisions r0p0, r0p1, r0p2, r0p3 and r1p0, and is fixed in r1p1.
+ERRATA_A510_2172148	?=0
+
 # Flag to apply DSU erratum 798953. This erratum applies to DSUs revision r0p0.
 # Applying the workaround results in higher DSU power consumption on idle.
 ERRATA_DSU_798953	?=0
@@ -911,6 +941,22 @@
 $(eval $(call assert_boolean,ERRATA_A710_2058056))
 $(eval $(call add_define,ERRATA_A710_2058056))
 
+# Process ERRATA_A710_2055002 flag
+$(eval $(call assert_boolean,ERRATA_A710_2055002))
+$(eval $(call add_define,ERRATA_A710_2055002))
+
+# Process ERRATA_A710_2017096 flag
+$(eval $(call assert_boolean,ERRATA_A710_2017096))
+$(eval $(call add_define,ERRATA_A710_2017096))
+
+# Process ERRATA_A710_2267065 flag
+$(eval $(call assert_boolean,ERRATA_A710_2267065))
+$(eval $(call add_define,ERRATA_A710_2267065))
+
+# Process ERRATA_A710_2136059 flag
+$(eval $(call assert_boolean,ERRATA_A710_2136059))
+$(eval $(call add_define,ERRATA_A710_2136059))
+
 # Process ERRATA_N2_2067956 flag
 $(eval $(call assert_boolean,ERRATA_N2_2067956))
 $(eval $(call add_define,ERRATA_N2_2067956))
@@ -947,22 +993,6 @@
 $(eval $(call assert_boolean,ERRATA_N2_2280757))
 $(eval $(call add_define,ERRATA_N2_2280757))
 
-# Process ERRATA_A710_2055002 flag
-$(eval $(call assert_boolean,ERRATA_A710_2055002))
-$(eval $(call add_define,ERRATA_A710_2055002))
-
-# Process ERRATA_A710_2017096 flag
-$(eval $(call assert_boolean,ERRATA_A710_2017096))
-$(eval $(call add_define,ERRATA_A710_2017096))
-
-# Process ERRATA_A710_2267065 flag
-$(eval $(call assert_boolean,ERRATA_A710_2267065))
-$(eval $(call add_define,ERRATA_A710_2267065))
-
-# Process ERRATA_A710_2136059 flag
-$(eval $(call assert_boolean,ERRATA_A710_2136059))
-$(eval $(call add_define,ERRATA_A710_2136059))
-
 # Process ERRATA_X2_2002765 flag
 $(eval $(call assert_boolean,ERRATA_X2_2002765))
 $(eval $(call add_define,ERRATA_X2_2002765))
@@ -987,6 +1017,34 @@
 $(eval $(call assert_boolean,ERRATA_X2_2216384))
 $(eval $(call add_define,ERRATA_X2_2216384))
 
+# Process ERRATA_A510_1922240 flag
+$(eval $(call assert_boolean,ERRATA_A510_1922240))
+$(eval $(call add_define,ERRATA_A510_1922240))
+
+# Process ERRATA_A510_2288014 flag
+$(eval $(call assert_boolean,ERRATA_A510_2288014))
+$(eval $(call add_define,ERRATA_A510_2288014))
+
+# Process ERRATA_A510_2042739 flag
+$(eval $(call assert_boolean,ERRATA_A510_2042739))
+$(eval $(call add_define,ERRATA_A510_2042739))
+
+# Process ERRATA_A510_2041909 flag
+$(eval $(call assert_boolean,ERRATA_A510_2041909))
+$(eval $(call add_define,ERRATA_A510_2041909))
+
+# Process ERRATA_A510_2250311 flag
+$(eval $(call assert_boolean,ERRATA_A510_2250311))
+$(eval $(call add_define,ERRATA_A510_2250311))
+
+# Process ERRATA_A510_2218950 flag
+$(eval $(call assert_boolean,ERRATA_A510_2218950))
+$(eval $(call add_define,ERRATA_A510_2218950))
+
+# Process ERRATA_A510_2172148 flag
+$(eval $(call assert_boolean,ERRATA_A510_2172148))
+$(eval $(call add_define,ERRATA_A510_2172148))
+
 # Process ERRATA_DSU_798953 flag
 $(eval $(call assert_boolean,ERRATA_DSU_798953))
 $(eval $(call add_define,ERRATA_DSU_798953))
diff --git a/lib/mpmm/mpmm.c b/lib/mpmm/mpmm.c
index a66f2aa..dc61cf6 100644
--- a/lib/mpmm/mpmm.c
+++ b/lib/mpmm/mpmm.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2021, Arm Limited. All rights reserved.
+ * Copyright (c) 2021-2022, Arm Limited. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -62,11 +62,25 @@
 	return supported;
 }
 
+/* Defaults to false */
+static bool mpmm_disable_for_errata;
+
 void mpmm_enable(void)
 {
-	bool supported = mpmm_supported();
-
-	if (supported) {
+	if (mpmm_supported()) {
+		if (mpmm_disable_for_errata) {
+			WARN("MPMM: disabled by errata workaround\n");
+			return;
+		}
 		write_cpumpmmcr_el3_mpmm_en(1U);
 	}
 }
+
+/*
+ * This function is called from assembly code very early in BL31 so it must be
+ * small and simple.
+ */
+void mpmm_errata_disable(void)
+{
+	mpmm_disable_for_errata = true;
+}
diff --git a/plat/arm/board/fvp/fvp_bl2_measured_boot.c b/plat/arm/board/fvp/fvp_bl2_measured_boot.c
index af43065..1f38278 100644
--- a/plat/arm/board/fvp/fvp_bl2_measured_boot.c
+++ b/plat/arm/board/fvp/fvp_bl2_measured_boot.c
@@ -28,6 +28,7 @@
 	{ SCP_BL2_IMAGE_ID, EVLOG_SCP_BL2_STRING, PCR_0 },
 	{ SOC_FW_CONFIG_ID, EVLOG_SOC_FW_CONFIG_STRING, PCR_0 },
 	{ TOS_FW_CONFIG_ID, EVLOG_TOS_FW_CONFIG_STRING, PCR_0 },
+	{ RMM_IMAGE_ID, EVLOG_RMM_STRING, PCR_0},
 
 	{ CRITICAL_DATA_ID, EVLOG_CRITICAL_DATA_STRING, PCR_1 },
 
diff --git a/plat/intel/soc/agilex/bl2_plat_setup.c b/plat/intel/soc/agilex/bl2_plat_setup.c
index b6b3e16..6e67502 100644
--- a/plat/intel/soc/agilex/bl2_plat_setup.c
+++ b/plat/intel/soc/agilex/bl2_plat_setup.c
@@ -7,6 +7,7 @@
 
 #include <arch.h>
 #include <arch_helpers.h>
+#include <assert.h>
 #include <common/bl_common.h>
 #include <common/debug.h>
 #include <common/desc_image_load.h>
@@ -113,6 +114,9 @@
 	mmc_info.mmc_dev_type = MMC_IS_SD;
 	mmc_info.ocr_voltage = OCR_3_3_3_4 | OCR_3_2_3_3;
 
+	/* Request ownership and direct access to QSPI */
+	mailbox_hps_qspi_enable();
+
 	switch (boot_source) {
 	case BOOT_SOURCE_SDMMC:
 		dw_mmc_init(&params, &mmc_info);
@@ -120,8 +124,6 @@
 		break;
 
 	case BOOT_SOURCE_QSPI:
-		mailbox_set_qspi_open();
-		mailbox_set_qspi_direct();
 		cad_qspi_init(0, QSPI_CONFIG_CPHA, QSPI_CONFIG_CPOL,
 			QSPI_CONFIG_CSDA, QSPI_CONFIG_CSDADS,
 			QSPI_CONFIG_CSEOT, QSPI_CONFIG_CSSOT, 0);
@@ -161,6 +163,8 @@
 {
 	bl_mem_params_node_t *bl_mem_params = get_bl_mem_params_node(image_id);
 
+	assert(bl_mem_params);
+
 	switch (image_id) {
 	case BL33_IMAGE_ID:
 		bl_mem_params->ep_info.args.arg0 = 0xffff & read_mpidr();
diff --git a/plat/intel/soc/common/include/socfpga_mailbox.h b/plat/intel/soc/common/include/socfpga_mailbox.h
index 923c4f1..bc10dd8 100644
--- a/plat/intel/soc/common/include/socfpga_mailbox.h
+++ b/plat/intel/soc/common/include/socfpga_mailbox.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2019-2020, Intel Corporation. All rights reserved.
+ * Copyright (c) 2019-2022, Intel Corporation. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -69,6 +69,7 @@
 #define CMD_CASUAL			0
 #define CMD_URGENT			1
 
+#define MBOX_WORD_BYTE			4U
 #define MBOX_RESP_BUFFER_SIZE		16
 #define MBOX_CMD_BUFFER_SIZE		32
 
@@ -108,6 +109,9 @@
 
 /* Mailbox Macros */
 
+#define MBOX_ENTRY_TO_ADDR(_buf, ptr)	(MBOX_OFFSET + (MBOX_##_buf##_BUFFER) \
+						+ MBOX_WORD_BYTE * (ptr))
+
 /* Mailbox interrupt flags and masks */
 #define MBOX_INT_FLAG_COE		0x1
 #define MBOX_INT_FLAG_RIE		0x2
@@ -139,23 +143,22 @@
 void mailbox_set_int(uint32_t interrupt_input);
 int mailbox_init(void);
 void mailbox_set_qspi_close(void);
-void mailbox_set_qspi_open(void);
-void mailbox_set_qspi_direct(void);
+void mailbox_hps_qspi_enable(void);
 
 int mailbox_send_cmd(uint32_t job_id, uint32_t cmd, uint32_t *args,
 			unsigned int len, uint32_t urgent, uint32_t *response,
-			unsigned int resp_len);
+			unsigned int *resp_len);
 int mailbox_send_cmd_async(uint32_t *job_id, uint32_t cmd, uint32_t *args,
 			unsigned int len, unsigned int indirect);
 int mailbox_read_response(uint32_t *job_id, uint32_t *response,
-			unsigned int resp_len);
-unsigned int iterate_resp(uint32_t mbox_resp_len, uint32_t *resp_buf,
-			unsigned int resp_len);
+			unsigned int *resp_len);
+int iterate_resp(uint32_t mbox_resp_len, uint32_t *resp_buf,
+			unsigned int *resp_len);
 
 void mailbox_reset_cold(void);
 void mailbox_clear_response(void);
 
-int intel_mailbox_get_config_status(uint32_t cmd);
+int intel_mailbox_get_config_status(uint32_t cmd, bool init_done);
 int intel_mailbox_is_fpga_not_ready(void);
 
 int mailbox_rsu_get_spt_offset(uint32_t *resp_buf, uint32_t resp_buf_len);
diff --git a/plat/intel/soc/common/soc/socfpga_mailbox.c b/plat/intel/soc/common/soc/socfpga_mailbox.c
index aec94af..be900c9 100644
--- a/plat/intel/soc/common/soc/socfpga_mailbox.c
+++ b/plat/intel/soc/common/soc/socfpga_mailbox.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020, Intel Corporation. All rights reserved.
+ * Copyright (c) 2020-2022, Intel Corporation. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -59,9 +59,7 @@
 			}
 			mdelay(10U);
 		} else {
-			mmio_write_32(MBOX_OFFSET + MBOX_CMD_BUFFER +
-				      (*cin * 4), data);
-			(*cin)++;
+			mmio_write_32(MBOX_ENTRY_TO_ADDR(CMD, (*cin)++), data);
 			*cin %= MBOX_CMD_BUFFER_SIZE;
 			mmio_write_32(MBOX_OFFSET + MBOX_CIN, *cin);
 			break;
@@ -107,9 +105,7 @@
 		}
 	}
 
-	if (!is_doorbell_triggered) {
-		mmio_write_32(MBOX_OFFSET + MBOX_DOORBELL_TO_SDM, 1U);
-	}
+	mmio_write_32(MBOX_OFFSET + MBOX_DOORBELL_TO_SDM, 1U);
 
 	return MBOX_RET_OK;
 
@@ -131,7 +127,7 @@
 }
 
 int mailbox_read_response(unsigned int *job_id, uint32_t *response,
-				unsigned int resp_len)
+				unsigned int *resp_len)
 {
 	uint32_t rin;
 	uint32_t rout;
@@ -146,8 +142,7 @@
 	rout = mmio_read_32(MBOX_OFFSET + MBOX_ROUT);
 
 	if (rout != rin) {
-		resp_data = mmio_read_32(MBOX_OFFSET +
-				    MBOX_RESP_BUFFER + ((rout++)*4U));
+		resp_data = mmio_read_32(MBOX_ENTRY_TO_ADDR(RESP, (rout)++));
 
 		rout %= MBOX_RESP_BUFFER_SIZE;
 		mmio_write_32(MBOX_OFFSET + MBOX_ROUT, rout);
@@ -161,9 +156,9 @@
 
 		ret_resp_len = MBOX_RESP_LEN(resp_data);
 
-		if (ret_resp_len != 0U) {
-			ret_resp_len = iterate_resp(ret_resp_len, response,
-						    resp_len);
+		if (iterate_resp(ret_resp_len, response, resp_len)
+			!= MBOX_RET_OK) {
+			return MBOX_TIMEOUT;
 		}
 
 		if (MBOX_RESP_ERR(resp_data) > 0U) {
@@ -171,14 +166,14 @@
 			return -MBOX_RESP_ERR(resp_data);
 		}
 
-		return ret_resp_len;
+		return MBOX_RET_OK;
 	}
 	return MBOX_NO_RESPONSE;
 }
 
 
 int mailbox_poll_response(uint32_t job_id, uint32_t urgent, uint32_t *response,
-				unsigned int resp_len)
+				unsigned int *resp_len)
 {
 	unsigned int timeout = 40U;
 	unsigned int sdm_loop = 255U;
@@ -221,8 +216,8 @@
 		rout = mmio_read_32(MBOX_OFFSET + MBOX_ROUT);
 
 		while (rout != rin) {
-			resp_data = mmio_read_32(MBOX_OFFSET +
-					    MBOX_RESP_BUFFER + ((rout++)*4U));
+			resp_data = mmio_read_32(MBOX_ENTRY_TO_ADDR(RESP,
+								(rout)++));
 
 			rout %= MBOX_RESP_BUFFER_SIZE;
 			mmio_write_32(MBOX_OFFSET + MBOX_ROUT, rout);
@@ -234,10 +229,9 @@
 
 			ret_resp_len = MBOX_RESP_LEN(resp_data);
 
-			if (ret_resp_len != 0U) {
-				ret_resp_len = iterate_resp(ret_resp_len,
-							    response,
-							    resp_len);
+			if (iterate_resp(ret_resp_len, response, resp_len)
+				!= MBOX_RET_OK) {
+				return MBOX_TIMEOUT;
 			}
 
 			if (MBOX_RESP_ERR(resp_data) > 0U) {
@@ -245,7 +239,7 @@
 				return -MBOX_RESP_ERR(resp_data);
 			}
 
-			return ret_resp_len;
+			return MBOX_RET_OK;
 		}
 
 	sdm_loop--;
@@ -255,8 +249,8 @@
 	return MBOX_TIMEOUT;
 }
 
-unsigned int iterate_resp(uint32_t mbox_resp_len, uint32_t *resp_buf,
-			unsigned int resp_len)
+int iterate_resp(uint32_t mbox_resp_len, uint32_t *resp_buf,
+			unsigned int *resp_len)
 {
 	unsigned int timeout, total_resp_len = 0U;
 	uint32_t resp_data;
@@ -266,17 +260,15 @@
 	while (mbox_resp_len > 0U) {
 		timeout = 100U;
 		mbox_resp_len--;
-		resp_data = mmio_read_32(MBOX_OFFSET +
-					MBOX_RESP_BUFFER +
-					(rout)*4U);
+		resp_data = mmio_read_32(MBOX_ENTRY_TO_ADDR(RESP, (rout)++));
 
-		if ((resp_buf != NULL) && (resp_len != 0U)) {
+		if ((resp_buf != NULL) && (resp_len != NULL)
+			&& (*resp_len != 0U)) {
 			*(resp_buf + total_resp_len)
 					= resp_data;
-			resp_len--;
+			*resp_len = *resp_len - 1;
 			total_resp_len++;
 		}
-		rout++;
 		rout %= MBOX_RESP_BUFFER_SIZE;
 		mmio_write_32(MBOX_OFFSET + MBOX_ROUT, rout);
 
@@ -295,7 +287,11 @@
 			return MBOX_TIMEOUT;
 		}
 	}
-	return total_resp_len;
+
+	if (resp_len)
+		*resp_len = total_resp_len;
+
+	return MBOX_RET_OK;
 }
 
 int mailbox_send_cmd_async(uint32_t *job_id, uint32_t cmd, uint32_t *args,
@@ -320,7 +316,7 @@
 
 int mailbox_send_cmd(uint32_t job_id, uint32_t cmd, uint32_t *args,
 			unsigned int len, uint32_t urgent, uint32_t *response,
-			unsigned int resp_len)
+			unsigned int *resp_len)
 {
 	int status = 0;
 
@@ -366,20 +362,20 @@
 {
 	mailbox_set_int(MBOX_INT_FLAG_COE | MBOX_INT_FLAG_RIE);
 	mailbox_send_cmd(MBOX_JOB_ID, MBOX_CMD_QSPI_OPEN, NULL, 0U,
-				CMD_CASUAL, NULL, 0U);
+				CMD_CASUAL, NULL, NULL);
 }
 
 void mailbox_set_qspi_direct(void)
 {
 	mailbox_send_cmd(MBOX_JOB_ID, MBOX_CMD_QSPI_DIRECT, NULL, 0U,
-				CMD_CASUAL, NULL, 0U);
+				CMD_CASUAL, NULL, NULL);
 }
 
 void mailbox_set_qspi_close(void)
 {
 	mailbox_set_int(MBOX_INT_FLAG_COE | MBOX_INT_FLAG_RIE);
 	mailbox_send_cmd(MBOX_JOB_ID, MBOX_CMD_QSPI_CLOSE, NULL, 0U,
-				CMD_CASUAL, NULL, 0U);
+				CMD_CASUAL, NULL, NULL);
 }
 
 void mailbox_qspi_set_cs(uint32_t device_select)
@@ -390,21 +386,27 @@
 	cs_setting = (device_select << 28);
 	mailbox_set_int(MBOX_INT_FLAG_COE | MBOX_INT_FLAG_RIE);
 	mailbox_send_cmd(MBOX_JOB_ID, MBOX_CMD_QSPI_SET_CS, &cs_setting,
-				1U, CMD_CASUAL, NULL, 0U);
+				1U, CMD_CASUAL, NULL, NULL);
 }
 
+void mailbox_hps_qspi_enable(void)
+{
+	mailbox_set_qspi_open();
+	mailbox_set_qspi_direct();
+}
+
 void mailbox_reset_cold(void)
 {
 	mailbox_set_int(MBOX_INT_FLAG_COE | MBOX_INT_FLAG_RIE);
 	mailbox_send_cmd(MBOX_JOB_ID, MBOX_CMD_REBOOT_HPS, NULL, 0U,
-				CMD_CASUAL, NULL, 0U);
+				CMD_CASUAL, NULL, NULL);
 }
 
 int mailbox_rsu_get_spt_offset(uint32_t *resp_buf, unsigned int resp_buf_len)
 {
 	return mailbox_send_cmd(MBOX_JOB_ID, MBOX_GET_SUBPARTITION_TABLE,
 				NULL, 0U, CMD_CASUAL, resp_buf,
-				resp_buf_len);
+				&resp_buf_len);
 }
 
 struct rsu_status_info {
@@ -426,7 +428,7 @@
 
 	ret = mailbox_send_cmd(MBOX_JOB_ID, MBOX_RSU_STATUS, NULL, 0U,
 				CMD_CASUAL, resp_buf,
-				resp_buf_len);
+				&resp_buf_len);
 
 	if (ret < 0) {
 		return ret;
@@ -445,14 +447,14 @@
 {
 	return mailbox_send_cmd(MBOX_JOB_ID, MBOX_RSU_UPDATE,
 				flash_offset, 2U,
-				CMD_CASUAL, NULL, 0U);
+				CMD_CASUAL, NULL, NULL);
 }
 
 int mailbox_hps_stage_notify(uint32_t execution_stage)
 {
 	return mailbox_send_cmd(MBOX_JOB_ID, MBOX_HPS_STAGE_NOTIFY,
 				&execution_stage, 1U, CMD_CASUAL,
-				NULL, 0U);
+				NULL, NULL);
 }
 
 int mailbox_init(void)
@@ -465,7 +467,7 @@
 	mmio_write_32(MBOX_OFFSET + MBOX_DOORBELL_FROM_SDM, 0U);
 
 	status = mailbox_send_cmd(0U, MBOX_CMD_RESTART, NULL, 0U,
-					CMD_URGENT, NULL, 0U);
+					CMD_URGENT, NULL, NULL);
 
 	if (status != 0) {
 		return status;
@@ -477,13 +479,14 @@
 	return MBOX_RET_OK;
 }
 
-int intel_mailbox_get_config_status(uint32_t cmd)
+int intel_mailbox_get_config_status(uint32_t cmd, bool init_done)
 {
 	int status;
 	uint32_t res, response[6];
+	unsigned int resp_len = ARRAY_SIZE(response);
 
 	status = mailbox_send_cmd(MBOX_JOB_ID, cmd, NULL, 0U, CMD_CASUAL,
-				response, ARRAY_SIZE(response));
+				response, &resp_len);
 
 	if (status < 0) {
 		return status;
@@ -504,20 +507,22 @@
 		return MBOX_CFGSTAT_STATE_ERROR_HARDWARE;
 	}
 
-	if ((res & SOFTFUNC_STATUS_CONF_DONE) != 0U &&
-		(res & SOFTFUNC_STATUS_INIT_DONE) != 0U) {
-		return MBOX_RET_OK;
-	}
+	if ((res & SOFTFUNC_STATUS_CONF_DONE) == 0U)
+		return MBOX_CFGSTAT_STATE_CONFIG;
 
-	return MBOX_CFGSTAT_STATE_CONFIG;
+	if (init_done && (res & SOFTFUNC_STATUS_INIT_DONE) == 0U)
+		return MBOX_CFGSTAT_STATE_CONFIG;
+
+	return MBOX_RET_OK;
 }
 
 int intel_mailbox_is_fpga_not_ready(void)
 {
-	int ret = intel_mailbox_get_config_status(MBOX_RECONFIG_STATUS);
+	int ret = intel_mailbox_get_config_status(MBOX_RECONFIG_STATUS, true);
 
 	if ((ret != MBOX_RET_OK) && (ret != MBOX_CFGSTAT_STATE_CONFIG)) {
-		ret = intel_mailbox_get_config_status(MBOX_CONFIG_STATUS);
+		ret = intel_mailbox_get_config_status(MBOX_CONFIG_STATUS,
+							false);
 	}
 
 	return ret;
diff --git a/plat/intel/soc/common/socfpga_sip_svc.c b/plat/intel/soc/common/socfpga_sip_svc.c
index 86a4455..d53e8de 100644
--- a/plat/intel/soc/common/socfpga_sip_svc.c
+++ b/plat/intel/soc/common/socfpga_sip_svc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2019-2020, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2019-2022, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -83,9 +83,9 @@
 	uint32_t ret;
 
 	if (query_type == 1)
-		ret = intel_mailbox_get_config_status(MBOX_CONFIG_STATUS);
+		ret = intel_mailbox_get_config_status(MBOX_CONFIG_STATUS, false);
 	else
-		ret = intel_mailbox_get_config_status(MBOX_RECONFIG_STATUS);
+		ret = intel_mailbox_get_config_status(MBOX_RECONFIG_STATUS, true);
 
 	if (ret) {
 		if (ret == MBOX_CFGSTAT_STATE_CONFIG)
@@ -128,16 +128,16 @@
 static int intel_fpga_config_completed_write(uint32_t *completed_addr,
 					uint32_t *count, uint32_t *job_id)
 {
-	uint32_t status = INTEL_SIP_SMC_STATUS_OK;
-	*count = 0;
-	int resp_len = 0;
 	uint32_t resp[5];
+	unsigned int resp_len = ARRAY_SIZE(resp);
+	int status = INTEL_SIP_SMC_STATUS_OK;
 	int all_completed = 1;
+	*count = 0;
 
 	while (*count < 3) {
 
-		resp_len = mailbox_read_response(job_id,
-				resp, ARRAY_SIZE(resp));
+		status = mailbox_read_response(job_id,
+				resp, &resp_len);
 
 		if (resp_len < 0)
 			break;
@@ -183,17 +183,21 @@
 
 static int intel_fpga_config_start(uint32_t config_type)
 {
+	uint32_t argument = 0x1;
 	uint32_t response[3];
 	int status = 0;
+	unsigned int size = 0;
+	unsigned int resp_len = ARRAY_SIZE(response);
 
 	is_partial_reconfig = config_type;
 
 	mailbox_clear_response();
 
-	mailbox_send_cmd(1U, MBOX_CMD_CANCEL, NULL, 0U, CMD_CASUAL, NULL, 0U);
+	mailbox_send_cmd(MBOX_JOB_ID, MBOX_CMD_CANCEL, NULL, 0U,
+			CMD_CASUAL, NULL, NULL);
 
-	status = mailbox_send_cmd(1U, MBOX_RECONFIG, NULL, 0U, CMD_CASUAL,
-			response, ARRAY_SIZE(response));
+	status = mailbox_send_cmd(MBOX_JOB_ID, MBOX_RECONFIG, &argument, size,
+			CMD_CASUAL, response, &resp_len);
 
 	if (status < 0)
 		return status;
@@ -234,6 +238,9 @@
 
 bool is_address_in_ddr_range(uint64_t addr, uint64_t size)
 {
+	if (!addr && !size) {
+		return true;
+	}
 	if (size > (UINT64_MAX - addr))
 		return false;
 	if (addr < BL31_LIMIT)
@@ -341,7 +348,7 @@
 {
 	if (!intel_secure_reg_read(reg_addr, retval)) {
 		*retval &= ~mask;
-		*retval |= val;
+		*retval |= val & mask;
 		return intel_secure_reg_write(reg_addr, *retval, retval);
 	}
 
@@ -384,10 +391,11 @@
 }
 
 /* Mailbox services */
-static uint32_t intel_mbox_send_cmd(uint32_t cmd, uint32_t *args, uint32_t len,
-				    uint32_t urgent, uint32_t *response,
-				    uint32_t resp_len, int *mbox_status,
-				    int *len_in_resp)
+static uint32_t intel_mbox_send_cmd(uint32_t cmd, uint32_t *args,
+				unsigned int len,
+				uint32_t urgent, uint32_t *response,
+				unsigned int resp_len, int *mbox_status,
+				unsigned int *len_in_resp)
 {
 	*len_in_resp = 0;
 	*mbox_status = 0;
@@ -396,7 +404,7 @@
 		return INTEL_SIP_SMC_STATUS_REJECTED;
 
 	int status = mailbox_send_cmd(MBOX_JOB_ID, cmd, args, len, urgent,
-				      response, resp_len);
+				      response, &resp_len);
 
 	if (status < 0) {
 		*mbox_status = -status;
@@ -404,7 +412,7 @@
 	}
 
 	*mbox_status = 0;
-	*len_in_resp = status;
+	*len_in_resp = resp_len;
 	return INTEL_SIP_SMC_STATUS_OK;
 }
 
@@ -425,9 +433,9 @@
 	uint32_t status = INTEL_SIP_SMC_STATUS_OK;
 	uint32_t completed_addr[3];
 	uint64_t rsu_respbuf[9];
+	int mbox_status;
+	unsigned int len_in_resp;
 	u_register_t x5, x6;
-	int mbox_status, len_in_resp;
-
 
 	switch (smc_fid) {
 	case SIP_SVC_UID:
@@ -525,7 +533,7 @@
 		status = intel_mbox_send_cmd(x1, (uint32_t *)x2, x3, x4,
 					     (uint32_t *)x5, x6, &mbox_status,
 					     &len_in_resp);
-		SMC_RET4(handle, status, mbox_status, x5, len_in_resp);
+		SMC_RET3(handle, status, mbox_status, len_in_resp);
 
 	default:
 		return socfpga_sip_handler(smc_fid, x1, x2, x3, x4,
diff --git a/plat/intel/soc/stratix10/bl2_plat_setup.c b/plat/intel/soc/stratix10/bl2_plat_setup.c
index ecf1f01..a8026ea 100644
--- a/plat/intel/soc/stratix10/bl2_plat_setup.c
+++ b/plat/intel/soc/stratix10/bl2_plat_setup.c
@@ -7,6 +7,7 @@
 
 #include <arch.h>
 #include <arch_helpers.h>
+#include <assert.h>
 #include <common/bl_common.h>
 #include <common/debug.h>
 #include <common/desc_image_load.h>
@@ -109,6 +110,9 @@
 	mmc_info.mmc_dev_type = MMC_IS_SD;
 	mmc_info.ocr_voltage = OCR_3_3_3_4 | OCR_3_2_3_3;
 
+	/* Request ownership and direct access to QSPI */
+	mailbox_hps_qspi_enable();
+
 	switch (boot_source) {
 	case BOOT_SOURCE_SDMMC:
 		dw_mmc_init(&params, &mmc_info);
@@ -116,8 +120,6 @@
 		break;
 
 	case BOOT_SOURCE_QSPI:
-		mailbox_set_qspi_open();
-		mailbox_set_qspi_direct();
 		cad_qspi_init(0, QSPI_CONFIG_CPHA, QSPI_CONFIG_CPOL,
 			QSPI_CONFIG_CSDA, QSPI_CONFIG_CSDADS,
 			QSPI_CONFIG_CSEOT, QSPI_CONFIG_CSSOT, 0);
@@ -157,6 +159,8 @@
 {
 	bl_mem_params_node_t *bl_mem_params = get_bl_mem_params_node(image_id);
 
+	assert(bl_mem_params);
+
 	switch (image_id) {
 	case BL33_IMAGE_ID:
 		bl_mem_params->ep_info.args.arg0 = 0xffff & read_mpidr();
diff --git a/plat/st/stm32mp1/stm32mp1_shared_resources.c b/plat/st/stm32mp1/stm32mp1_shared_resources.c
index 2a518e1..a0ca697 100644
--- a/plat/st/stm32mp1/stm32mp1_shared_resources.c
+++ b/plat/st/stm32mp1/stm32mp1_shared_resources.c
@@ -164,7 +164,7 @@
 	    (id <= STM32MP1_SHRES_GPIOZ(7)) &&
 	    ((unsigned int)(id - STM32MP1_SHRES_GPIOZ(0)) >= get_gpioz_nbpin())) {
 		ERROR("Invalid GPIO pin %d, %u pin(s) available\n",
-		      id - STM32MP1_SHRES_GPIOZ(0), get_gpioz_nbpin());
+		      (int)(id - STM32MP1_SHRES_GPIOZ(0)), get_gpioz_nbpin());
 		panic();
 	}
 
diff --git a/plat/xilinx/versal/aarch64/versal_common.c b/plat/xilinx/versal/aarch64/versal_common.c
index 2fa8476..897ed59 100644
--- a/plat/xilinx/versal/aarch64/versal_common.c
+++ b/plat/xilinx/versal/aarch64/versal_common.c
@@ -39,26 +39,11 @@
 
 void versal_config_setup(void)
 {
-	uint32_t val;
-
 	/* Configure IPI data for versal */
 	versal_ipi_config_table_init();
 
 	versal_print_platform_name();
 
-	/* Global timer init - Program time stamp reference clk */
-	val = mmio_read_32(VERSAL_CRL_TIMESTAMP_REF_CTRL);
-	val |= VERSAL_CRL_APB_TIMESTAMP_REF_CTRL_CLKACT_BIT;
-	mmio_write_32(VERSAL_CRL_TIMESTAMP_REF_CTRL, val);
-
-	/* Clear reset of timestamp reg */
-	mmio_write_32(VERSAL_CRL_RST_TIMESTAMP_OFFSET, 0x0);
-
-	/* Program freq register in System counter and enable system counter. */
-	mmio_write_32(VERSAL_IOU_SCNTRS_BASE_FREQ, VERSAL_CPU_CLOCK);
-	mmio_write_32(VERSAL_IOU_SCNTRS_COUNTER_CONTROL_REG,
-		      VERSAL_IOU_SCNTRS_CONTROL_EN);
-
 	generic_delay_timer_init();
 }
 
diff --git a/plat/xilinx/zynqmp/include/platform_def.h b/plat/xilinx/zynqmp/include/platform_def.h
index 0c14315..1c4daa1 100644
--- a/plat/xilinx/zynqmp/include/platform_def.h
+++ b/plat/xilinx/zynqmp/include/platform_def.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2020, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2014-2022, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -38,7 +38,7 @@
 #ifndef ZYNQMP_ATF_MEM_BASE
 #if !DEBUG && defined(SPD_none) && !SDEI_SUPPORT
 # define BL31_BASE			0xfffea000
-# define BL31_LIMIT			0xffffffff
+# define BL31_LIMIT			0x100000000
 #else
 # define BL31_BASE			0x1000
 # define BL31_LIMIT			0x7ffff
@@ -91,10 +91,11 @@
 #define PLAT_VIRT_ADDR_SPACE_SIZE	(1ULL << 32)
 #if (BL31_LIMIT < PLAT_DDR_LOWMEM_MAX)
 #define MAX_MMAP_REGIONS		8
+#define MAX_XLAT_TABLES			6
 #else
 #define MAX_MMAP_REGIONS		7
-#endif
 #define MAX_XLAT_TABLES			5
+#endif
 
 #define CACHE_WRITEBACK_SHIFT   6
 #define CACHE_WRITEBACK_GRANULE (1 << CACHE_WRITEBACK_SHIFT)