diff --git a/bl31/aarch64/runtime_exceptions.S b/bl31/aarch64/runtime_exceptions.S
index 0283553..614ea71 100644
--- a/bl31/aarch64/runtime_exceptions.S
+++ b/bl31/aarch64/runtime_exceptions.S
@@ -493,15 +493,16 @@
 	msr	spsel, #MODE_SP_EL0
 
 	/*
-	 * Save the SPSR_EL3, ELR_EL3, & SCR_EL3 in case there is a world
+	 * Save the SPSR_EL3 and ELR_EL3 in case there is a world
 	 * switch during SMC handling.
 	 * TODO: Revisit if all system registers can be saved later.
 	 */
 	mrs	x16, spsr_el3
 	mrs	x17, elr_el3
-	mrs	x18, scr_el3
 	stp	x16, x17, [x6, #CTX_EL3STATE_OFFSET + CTX_SPSR_EL3]
-	str	x18, [x6, #CTX_EL3STATE_OFFSET + CTX_SCR_EL3]
+
+	/* Load SCR_EL3 */
+	mrs	x18, scr_el3
 
 	/* Clear flag register */
 	mov	x7, xzr
diff --git a/bl32/tsp/ffa_helpers.c b/bl32/tsp/ffa_helpers.c
index 3639c22..ad70c2b 100644
--- a/bl32/tsp/ffa_helpers.c
+++ b/bl32/tsp/ffa_helpers.c
@@ -149,13 +149,15 @@
 {
 	smc_args_t ret;
 	uint32_t descriptor_size;
-	struct ffa_mtd *memory_region = (struct ffa_mtd *)mb->tx_buffer;
+	struct ffa_mtd *memory_region;
 
 	if (retrieved == NULL || mb == NULL) {
 		ERROR("Invalid parameters!\n");
 		return false;
 	}
 
+	memory_region = (struct ffa_mtd *)mb->tx_buffer;
+
 	/* Clear TX buffer. */
 	memset(memory_region, 0, PAGE_SIZE);
 
diff --git a/bl32/tsp/tsp_ffa_main.c b/bl32/tsp/tsp_ffa_main.c
index 53dbd03..2c53977 100644
--- a/bl32/tsp/tsp_ffa_main.c
+++ b/bl32/tsp/tsp_ffa_main.c
@@ -216,10 +216,10 @@
 				(uint64_t)composite->address_range_array[i].address,
 				size, mem_attrs);
 
-			/* Remove mappings created in this transaction. */
-			for (i--; i >= 0U; i--) {
+			/* Remove mappings previously created in this transaction. */
+			for (i--; i >= 0; i--) {
 				ret = mmap_remove_dynamic_region(
-					(uint64_t)ptr,
+					(uint64_t)composite->address_range_array[i].address,
 					composite->address_range_array[i].page_count * PAGE_SIZE);
 
 				if (ret != 0) {
@@ -227,6 +227,7 @@
 					panic();
 				}
 			}
+
 			return FFA_ERROR_NO_MEMORY;
 		}
 
@@ -298,8 +299,8 @@
 	tsp_stats[linear_id].eret_count++;
 	tsp_stats[linear_id].cpu_off_count++;
 
-	INFO("TSP: cpu 0x%lx off request\n", read_mpidr());
-	INFO("TSP: cpu 0x%lx: %d smcs, %d erets %d cpu off requests\n",
+	VERBOSE("TSP: cpu 0x%lx off request\n", read_mpidr());
+	VERBOSE("TSP: cpu 0x%lx: %d smcs, %d erets %d cpu off requests\n",
 		read_mpidr(),
 		tsp_stats[linear_id].smc_count,
 		tsp_stats[linear_id].eret_count,
@@ -336,7 +337,7 @@
 	tsp_stats[linear_id].eret_count++;
 	tsp_stats[linear_id].cpu_suspend_count++;
 
-	INFO("TSP: cpu 0x%lx: %d smcs, %d erets %d cpu suspend requests\n",
+	VERBOSE("TSP: cpu 0x%lx: %d smcs, %d erets %d cpu suspend requests\n",
 		read_mpidr(),
 		tsp_stats[linear_id].smc_count,
 		tsp_stats[linear_id].eret_count,
@@ -369,9 +370,9 @@
 	tsp_stats[linear_id].eret_count++;
 	tsp_stats[linear_id].cpu_resume_count++;
 
-	INFO("TSP: cpu 0x%lx resumed. maximum off power level %" PRId64 "\n",
+	VERBOSE("TSP: cpu 0x%lx resumed. maximum off power level %" PRId64 "\n",
 	     read_mpidr(), max_off_pwrlvl);
-	INFO("TSP: cpu 0x%lx: %d smcs, %d erets %d cpu resume requests\n",
+	VERBOSE("TSP: cpu 0x%lx: %d smcs, %d erets %d cpu resume requests\n",
 		read_mpidr(),
 		tsp_stats[linear_id].smc_count,
 		tsp_stats[linear_id].eret_count,
@@ -611,7 +612,7 @@
 	tsp_stats[linear_id].eret_count++;
 	tsp_stats[linear_id].cpu_on_count++;
 
-	INFO("TSP: cpu 0x%lx: %d smcs, %d erets %d cpu on requests\n",
+	VERBOSE("TSP: cpu 0x%lx: %d smcs, %d erets %d cpu on requests\n",
 			read_mpidr(),
 			tsp_stats[linear_id].smc_count,
 			tsp_stats[linear_id].eret_count,
@@ -640,8 +641,8 @@
 	tsp_stats[linear_id].smc_count++;
 	tsp_stats[linear_id].eret_count++;
 	tsp_stats[linear_id].cpu_on_count++;
-	INFO("TSP: cpu 0x%lx turned on\n", read_mpidr());
-	INFO("TSP: cpu 0x%lx: %d smcs, %d erets %d cpu on requests\n",
+	VERBOSE("TSP: cpu 0x%lx turned on\n", read_mpidr());
+	VERBOSE("TSP: cpu 0x%lx: %d smcs, %d erets %d cpu on requests\n",
 			read_mpidr(),
 			tsp_stats[linear_id].smc_count,
 			tsp_stats[linear_id].eret_count,
diff --git a/docs/design/cpu-specific-build-macros.rst b/docs/design/cpu-specific-build-macros.rst
index d48f284..9311420 100644
--- a/docs/design/cpu-specific-build-macros.rst
+++ b/docs/design/cpu-specific-build-macros.rst
@@ -317,6 +317,10 @@
    CPU. This needs to be enabled for revisions r0p0, r1p0, r1p1, and r1p2, and
    it is still open.
 
+-  ``ERRATA_A78_2772019``: This applies errata 2772019 workaround to Cortex-A78
+   CPU. This needs to be enabled for revisions r0p0, r1p0, r1p1, and r1p2, and
+   it is still open.
+
 For Cortex-A78 AE, the following errata build flags are defined :
 
 - ``ERRATA_A78_AE_1941500`` : This applies errata 1941500 workaround to
@@ -460,6 +464,10 @@
    CPU. This needs to be enabled for revisions r0p0, r1p0 and r1p1 of the CPU.
    It is still open.
 
+-  ``ERRATA_V1_2743093``: This applies errata 2743093 workaround to Neoverse-V1
+   CPU. This needs to be enabled for revisions r0p0, r1p0, r1p1 and r1p2 of the
+   CPU. It is still open.
+
 For Cortex-A710, the following errata build flags are defined :
 
 -  ``ERRATA_A710_1987031``: This applies errata 1987031 workaround to
@@ -518,6 +526,10 @@
    Cortex-A710 CPU. This needs to be enabled for revisions r0p0, r1p0 and r2p0
    of the CPU and is fixed in r2p1.
 
+-  ``ERRATA_A710_2768515``: This applies errata 2768515 workaround to
+   Cortex-A710 CPU. This needs to be enabled for revisions r0p0, r1p0, r2p0 and
+   r2p1 of the CPU and is still open.
+
 For Neoverse N2, the following errata build flags are defined :
 
 -  ``ERRATA_N2_2002655``: This applies errata 2002655 workaround to Neoverse-N2
@@ -562,6 +574,10 @@
    CPU. This needs to be enabled for revision r0p0 of the CPU, it is fixed in
    r0p1.
 
+-  ``ERRATA_N2_2743089``: This applies errata 2743089 workaround to Neoverse-N2
+   CPU. This needs to be enabled for revisions r0p0, r0p1 and r0p2. It is fixed
+   in r0p3.
+
 For Cortex-X2, the following errata build flags are defined :
 
 -  ``ERRATA_X2_2002765``: This applies errata 2002765 workaround to Cortex-X2
@@ -595,6 +611,10 @@
    Cortex-X2 CPU. This needs to be enabled for revisions r0p0, r1p0 and r2p0
    of the CPU and is fixed in r2p1.
 
+-  ``ERRATA_X2_2768515``: This applies errata 2768515 workaround to
+   Cortex-X2 CPU. This needs to be enabled for revisions r0p0, r1p0, r2p0
+   and r2p1 of the CPU and is still open.
+
 For Cortex-X3, the following errata build flags are defined :
 
 - ``ERRATA_X3_2313909``: This applies errata 2313909 workaround to
diff --git a/docs/getting_started/build-options.rst b/docs/getting_started/build-options.rst
index 7cd9b2b..e54ff41 100644
--- a/docs/getting_started/build-options.rst
+++ b/docs/getting_started/build-options.rst
@@ -818,6 +818,11 @@
    disabled). This configuration supports pre-Armv8.4 platforms (aka not
    implementing the ``FEAT_SEL2`` extension). This is an experimental feature.
 
+-  ``SPMC_OPTEE`` : This boolean option is used jointly with the SPM
+   Dispatcher option (``SPD=spmd``) and with ``SPMD_SPM_AT_SEL2=0`` to
+   indicate that the SPMC at S-EL1 is OP-TEE and an OP-TEE specific loading
+   mechanism should be used.
+
 -  ``SPMD_SPM_AT_SEL2`` : This boolean option is used jointly with the SPM
    Dispatcher option (``SPD=spmd``). When enabled (1) it indicates the SPMC
    component runs at the S-EL2 exception level provided by the ``FEAT_SEL2``
diff --git a/drivers/arm/gic/v3/gicv3_main.c b/drivers/arm/gic/v3/gicv3_main.c
index bc93f93..f6c251d 100644
--- a/drivers/arm/gic/v3/gicv3_main.c
+++ b/drivers/arm/gic/v3/gicv3_main.c
@@ -12,6 +12,7 @@
 #include <common/interrupt_props.h>
 #include <drivers/arm/gicv3.h>
 #include <lib/spinlock.h>
+#include <plat/common/platform.h>
 
 #include "gicv3_private.h"
 
@@ -1287,12 +1288,14 @@
 
 	assert(gicv3_driver_data->gicr_base == 0U);
 
+	if (plat_can_cmo()) {
 	/* Ensure this function is called with Data Cache enabled */
 #ifndef __aarch64__
-	assert((read_sctlr() & SCTLR_C_BIT) != 0U);
+		assert((read_sctlr() & SCTLR_C_BIT) != 0U);
 #else
-	assert((read_sctlr_el3() & SCTLR_C_BIT) != 0U);
+		assert((read_sctlr_el3() & SCTLR_C_BIT) != 0U);
 #endif /* !__aarch64__ */
+	}
 
 	mpidr_self = read_mpidr_el1() & MPIDR_AFFINITY_MASK;
 	rdistif_base = gicr_frame;
diff --git a/drivers/nxp/auth/csf_hdr_parser/csf_hdr_parser.c b/drivers/nxp/auth/csf_hdr_parser/csf_hdr_parser.c
index b878082..4f31c6e 100644
--- a/drivers/nxp/auth/csf_hdr_parser/csf_hdr_parser.c
+++ b/drivers/nxp/auth/csf_hdr_parser/csf_hdr_parser.c
@@ -38,7 +38,7 @@
 
 /* Flag to indicate if values are there in rotpk_hash_table */
 bool rotpk_not_dpld =  true;
-uint8_t rotpk_hash_table[MAX_KEY_ENTRIES][SHA256_BYTES];
+uint8_t rotpk_hash_table[MAX_KEY_ENTRIES][SHA256_BYTES] __aligned(CACHE_WRITEBACK_GRANULE);
 uint32_t num_rotpk_hash_entries;
 
 /*
diff --git a/drivers/nxp/crypto/caam/src/jobdesc.c b/drivers/nxp/crypto/caam/src/jobdesc.c
index f559c4b..92fcb74 100644
--- a/drivers/nxp/crypto/caam/src/jobdesc.c
+++ b/drivers/nxp/crypto/caam/src/jobdesc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2017-2020 NXP
+ * Copyright 2017-2022 NXP
  *
  * SPDX-License-Identifier: BSD-3-Clause
  *
@@ -11,13 +11,13 @@
 #include <stdio.h>
 #include <stdlib.h>
 
+#include <assert.h>
 #include "caam.h"
 #include <common/debug.h>
 #include "jobdesc.h"
 #include "rsa.h"
 #include "sec_hw_specific.h"
 
-
 /* Return Length of desctiptr from first word */
 uint32_t desc_length(uint32_t *desc)
 {
@@ -41,6 +41,8 @@
 {
 	uint32_t len = desc_length(desc);
 
+	assert((len + 1) < MAX_DESC_SIZE_WORDS);
+
 	/* Add Word at Last */
 	uint32_t *last = desc + len;
 	*last = word;
@@ -54,6 +56,9 @@
 {
 	uint32_t len = desc_length(desc);
 
+	assert((len + (uint32_t) (sizeof(phys_addr_t) / sizeof(uint32_t)))
+		< MAX_DESC_SIZE_WORDS);
+
 	/* Add Word at Last */
 	phys_addr_t *last = (phys_addr_t *) (desc + len);
 
diff --git a/drivers/nxp/ddr/nxp-ddr/regs.c b/drivers/nxp/ddr/nxp-ddr/regs.c
index cedd7ca..26155ab 100644
--- a/drivers/nxp/ddr/nxp-ddr/regs.c
+++ b/drivers/nxp/ddr/nxp-ddr/regs.c
@@ -1302,7 +1302,7 @@
 		return 0;
 	}
 
-	if ((bin[i].taamin_ps[j] == 0) ||
+	if (((bin[i].taamin_ps[j] == 0) && j > 0) ||
 	    (bin[i].taamin_ps[j] > taamin_ps && j > 0)) {
 		j--;
 	}
diff --git a/drivers/nxp/ddr/phy-gen2/phy.c b/drivers/nxp/ddr/phy-gen2/phy.c
index 9e52145..2006c04 100644
--- a/drivers/nxp/ddr/phy-gen2/phy.c
+++ b/drivers/nxp/ddr/phy-gen2/phy.c
@@ -241,12 +241,6 @@
 				rwmax = tmp;
 			}
 
-			tmp = wrmax;
-			wrmax = cdd[56];
-			if (tmp > wrmax) {
-				wrmax = tmp;
-			}
-
 			break;
 
 		case 2U:
@@ -276,15 +270,7 @@
 				rwmax = tmp;
 			}
 
-			buf[0] = cdd[56];
-			buf[1] = cdd[55];
-			buf[2] = cdd[52];
-			buf[3] = cdd[51];
-			tmp = wrmax;
-			wrmax = findmax(buf, 4U);
-			if (tmp > wrmax) {
-				wrmax = tmp;
-			}
+			wrmax = wwmax;
 
 			break;
 
@@ -310,12 +296,7 @@
 				rwmax = tmp;
 			}
 
-			tmp = wrmax;
-			c = &cdd[41];
-			wrmax = findmax(c, 16U);
-			if (tmp > wrmax) {
-				wrmax = tmp;
-			}
+			wrmax = wwmax;
 
 			break;
 
@@ -390,7 +371,12 @@
 
 #ifdef NXP_WARM_BOOT
 int save_phy_training_values(uint16_t **phy_ptr, uint32_t address_to_store,
-		uint32_t num_of_phy, int train2d)
+		uint32_t num_of_phy, int train2d
+#ifdef NXP_APPLY_MAX_CDD
+			, struct ddr_ctrl_reg_values *ddrctrl_regs
+#endif
+		)
+
 {
 	uint16_t *phy = NULL, value = 0x0;
 	uint32_t size = 1U, num_of_regs = 1U, phy_store = 0U;
@@ -457,6 +443,15 @@
 			ret = xspi_write(phy_store, training_2D_values,
 					size);
 		}
+
+#ifdef NXP_APPLY_MAX_CDD
+		/* Save DDR control register Timing CFG 0 and 4 */
+		phy_store  += size;
+		size = sizeof(ddrctrl_regs);
+		if (ret != 0) {
+			ret = xspi_write(phy_store, ddrctrl_regs, size);
+		}
+#endif
 		/* Disable clocks in case they were disabled. */
 		phy_io_write16(phy, t_drtub |
 				csr_ucclk_hclk_enables_addr, 0x0);
@@ -472,7 +467,11 @@
 }
 
 int restore_phy_training_values(uint16_t **phy_ptr, uint32_t address_to_restore,
-		uint32_t num_of_phy, int train2d)
+		uint32_t num_of_phy, int train2d
+#ifdef NXP_APPLY_MAX_CDD
+		, struct ddr_ctrl_reg_values *ddrctrl_regs
+#endif
+		)
 {
 	uint16_t *phy = NULL;
 	uint32_t size = 1U, num_of_regs = 1U, phy_store = 0U;
@@ -504,6 +503,14 @@
 		/* Reading 1D training values from flash*/
 		ret = xspi_read(phy_store, (uint32_t *)training_1D_values,
 				size);
+		if (ret != 0) {
+#ifdef DEBUG_WARM_RESET
+			debug("Unable to Read 1D training values %d\n",
+					ret);
+#endif
+			return -EINVAL;
+		}
+
 		debug("Restoring 1D Training reg val at:%08x\n", phy_store);
 		for (i = 0; i < num_of_regs; i++) {
 			phy_io_write16(phy, training_1D_values[i].addr,
@@ -523,6 +530,15 @@
 			/* Reading 2D training values from flash */
 			ret = xspi_read(phy_store,
 					(uint32_t *)training_2D_values,	size);
+
+			if (ret != 0) {
+#ifdef DEBUG_WARM_RESET
+				debug("Unable to Read 2D training values %d\n",
+						ret);
+#endif
+				return -EINVAL;
+			}
+
 			debug("Restoring 2D Training reg val at:%08x\n",
 					phy_store);
 			for (i = 0; i < num_of_regs; i++) {
@@ -537,6 +553,11 @@
 #endif
 			}
 		}
+#ifdef NXP_APPLY_MAX_CDD
+		phy_store = phy_store + size;
+		size = sizeof(ddrctrl_regs);
+		ret = xspi_read(phy_store, (uint32_t *)ddrctrl_regs, size);
+#endif
 		/* Disable clocks in case they were disabled. */
 		phy_io_write16(phy, t_drtub |
 				csr_ucclk_hclk_enables_addr, 0x0);
@@ -2292,6 +2313,7 @@
 
 	if (i < 0 || i > 3) {
 		printf("Error: invalid chip-select value\n");
+		return;
 	}
 	switch (val) {
 	case DDR_ODT_CS:
@@ -2473,6 +2495,9 @@
 	__unused const soc_info_t *soc_info;
 #ifdef NXP_APPLY_MAX_CDD
 	unsigned int tcfg0, tcfg4, rank;
+#ifdef NXP_WARM_BOOT
+	struct ddr_ctrl_reg_values ddrctrl_regs;
+#endif
 #endif
 
 	if (dimm_param == NULL) {
@@ -2577,11 +2602,19 @@
 		ret = restore_phy_training_values(priv->phy,
 						  PHY_TRAINING_REGS_ON_FLASH,
 						  priv->num_ctlrs,
-						  input.basic.train2d);
+						  input.basic.train2d
+#ifdef NXP_APPLY_MAX_CDD
+						, &ddrctrl_regs
+#endif
+						);
 		if (ret != 0) {
 			ERROR("Restoring of training data failed %d\n", ret);
 			return ret;
 		}
+#ifdef NXP_APPLY_MAX_CDD
+		regs->timing_cfg[0] = ddrctrl_regs.timing_cfg0;
+		regs->timing_cfg[4] = ddrctrl_regs.timing_cfg4;
+#endif
 	} else {
 #endif
 		/* Mapping IMG buffer firstly */
@@ -2644,12 +2677,20 @@
 #ifdef NXP_WARM_BOOT
 		if (priv->warm_boot_flag != DDR_WRM_BOOT_NT_SUPPORTED &&
 		    ret == 0) {
+#ifdef NXP_APPLY_MAX_CDD
+			ddrctrl_regs.timing_cfg0 = regs->timing_cfg[0];
+			ddrctrl_regs.timing_cfg4 = regs->timing_cfg[4];
+#endif
 			debug("save the phy training data\n");
 			//Save training data TBD
 			ret = save_phy_training_values(priv->phy,
 						PHY_TRAINING_REGS_ON_FLASH,
 						priv->num_ctlrs,
-						input.basic.train2d);
+						input.basic.train2d
+#ifdef NXP_APPLY_MAX_CDD
+						, &ddrctrl_regs
+#endif
+						);
 			if (ret != 0) {
 				ERROR("Saving training data failed.");
 				ERROR("Warm boot will fail. Error=%d.\n", ret);
diff --git a/drivers/nxp/ddr/phy-gen2/phy.h b/drivers/nxp/ddr/phy-gen2/phy.h
index 15e80d1..5e80f36 100644
--- a/drivers/nxp/ddr/phy-gen2/phy.h
+++ b/drivers/nxp/ddr/phy-gen2/phy.h
@@ -11,11 +11,18 @@
 /* To store sector size to be erase on flash*/
 #define PHY_ERASE_SIZE F_SECTOR_ERASE_SZ
 
+/*Structure to save DDR controller timing register 0 and 4 values*/
+struct ddr_ctrl_reg_values {
+	uint32_t timing_cfg0;
+	uint32_t timing_cfg4;
+};
+
 /*Structure to implement address-data map tuples to store PHY training values*/
 struct phy_training_values {
 	uint32_t addr;
 	uint16_t data;
 };
+
 /* Saves PHY Training Register values after cold reset
  *@param[in] phy_ptr array to store addresses of PHYs
  *@param[in] address_to_store address to save PHY training register values
@@ -24,6 +31,8 @@
  *to be saved
  *@param[in] train2d flag to store whether 2D training registers are to
  *be saved or not
+ *@param[in] ddrctrl_regs to save ddr controller registers in case
+ *NXP_APPLY_MAX_CDD is applied
  *
  *PHY training values will be stored on flash at contigous memory in the order:
  *1D training registers, 2D training registers
@@ -31,9 +40,13 @@
  *
  *if train2d is false saving 2D training registers will be skipped
  */
-int save_phy_training_values(uint16_t **phy_ptr, uint32_t address_to_store,
-		uint32_t num_of_phy, int train2d);
 
+int save_phy_training_values(uint16_t **phy_ptr, uint32_t address_to_store,
+		uint32_t num_of_phy, int train2d
+#ifdef NXP_APPLY_MAX_CDD
+		, struct ddr_ctrl_reg_values *ddrctrl_regs
+#endif
+		);
 /*Restores PHY Training Register values after warm reset
  *@param[in] phy_ptr array to store addresses of PHYs
  *@param[in] address_to_store address to retrieve PHY training register
@@ -42,12 +55,17 @@
  *to be restored
  *@param[in] train2d flag to store whether 2D training registers are
  *to be restored or not
- *
+ *@param[in] ddrctrl_regs to restore  ddr controller registers in case
+ *NXP_APPLY_MAX_CDD is applied
  *if train2d is false saving 2D training registers will be skipped
  */
 
 int restore_phy_training_values(uint16_t **phy_ptr, uint32_t address_to_restore,
-		uint32_t num_of_phy, int train2d);
+		uint32_t num_of_phy, int train2d
+#ifdef NXP_APPLY_MAX_CDD
+		, struct ddr_ctrl_reg_values *ddrctrl_regs
+#endif
+		);
 
 /*
  * Address data tuples to store the PHY 1D
diff --git a/drivers/nxp/flexspi/nor/fspi.c b/drivers/nxp/flexspi/nor/fspi.c
index 7c919b8..1e8c5a2 100644
--- a/drivers/nxp/flexspi/nor/fspi.c
+++ b/drivers/nxp/flexspi/nor/fspi.c
@@ -123,6 +123,9 @@
 		cmd_id1 = FSPI_NOR_CMD_RDSR;
 		cmd_id2 = FSPI_NOR_CMD_RDSR;
 		break;
+	default:
+		ERROR("Unsupported command\n");
+		return;
 	}
 
 	x_addr = FSPI_LUTREG_OFFSET + (uint32_t)(0x10 * fspi_op_seq_id);
diff --git a/drivers/nxp/tzc/plat_tzc380.c b/drivers/nxp/tzc/plat_tzc380.c
index 13cf3b9..5b27563 100644
--- a/drivers/nxp/tzc/plat_tzc380.c
+++ b/drivers/nxp/tzc/plat_tzc380.c
@@ -91,20 +91,37 @@
 	}
 	/* Continue with list entries for index > 0 */
 	if (dram_idx == 0) {
-		/* TZC Region 1 on DRAM0 for Secure Memory*/
+		/*
+		 * Region 1: Secure Region on DRAM 1 for  2MB out of  2MB,
+		 * excluding 0 sub-region(=256KB).
+		 */
 		tzc380_reg_list[list_idx].secure = TZC_ATTR_SP_S_RW;
 		tzc380_reg_list[list_idx].enabled = TZC_ATTR_REGION_ENABLE;
 		tzc380_reg_list[list_idx].addr = dram_start_addr + dram_size;
-		tzc380_reg_list[list_idx].size = secure_dram_sz;
+		tzc380_reg_list[list_idx].size = TZC_REGION_SIZE_2M;
 		tzc380_reg_list[list_idx].sub_mask = 0x0; /* all enabled */
 		list_idx++;
 
-		/* TZC Region 2 on DRAM0 for Shared Memory*/
+		/*
+		 * Region 2: Secure Region on DRAM 1 for 54MB out of 64MB,
+		 * excluding 1 sub-rgion(=8MB) of 8MB.
+		 */
 		tzc380_reg_list[list_idx].secure = TZC_ATTR_SP_S_RW;
 		tzc380_reg_list[list_idx].enabled = TZC_ATTR_REGION_ENABLE;
+		tzc380_reg_list[list_idx].addr = dram_start_addr + dram_size + shrd_dram_sz;
+		tzc380_reg_list[list_idx].size = TZC_REGION_SIZE_64M;
+		tzc380_reg_list[list_idx].sub_mask = 0x80; /* Disable sub-region 7 */
+		list_idx++;
+
+		/*
+		 * Region 3: Secure Region on DRAM 1 for  6MB out of  8MB,
+		 * excluding 2 sub-rgion(=1MB) of 2MB.
+		 */
+		tzc380_reg_list[list_idx].secure = TZC_ATTR_SP_S_RW;
+		tzc380_reg_list[list_idx].enabled = TZC_ATTR_REGION_ENABLE;
 		tzc380_reg_list[list_idx].addr = dram_start_addr + dram_size + secure_dram_sz;
-		tzc380_reg_list[list_idx].size = shrd_dram_sz;
-		tzc380_reg_list[list_idx].sub_mask = 0x0; /* all enabled */
+		tzc380_reg_list[list_idx].size = TZC_REGION_SIZE_8M;
+		tzc380_reg_list[list_idx].sub_mask = 0xC0; /* Disable sub-region 6 & 7 */
 		list_idx++;
 
 	}
diff --git a/fdts/tc.dts b/fdts/tc.dts
index 5a8792e..fdde015 100644
--- a/fdts/tc.dts
+++ b/fdts/tc.dts
@@ -214,8 +214,8 @@
 		};
 
 		optee@0xfce00000 {
+			compatible = "restricted-dma-pool";
 			reg = <0x00000000 0xfce00000 0 0x00200000>;
-			no-map;
 		};
 	};
 
@@ -463,17 +463,18 @@
 		interrupt-names = "JOB", "MMU", "GPU";
 		clocks = <&soc_refclk100mhz>;
 		clock-names = "clk_mali";
+		iommus = <&smmu_700 0x200>;
 		operating-points = <
 			/* KHz uV */
 			50000 820000
 		>;
 	};
 
-	smmu: smmu@2ce00000 {
+	smmu_700: smmu_700@3f000000 {
 		#iommu-cells = <1>;
 		compatible = "arm,smmu-v3";
-		reg = <0x0 0x2ce00000 0x0 0x20000>;
-		status = "okay";
+		reg = <0x0 0x3f000000 0x0 0x5000000>;
+		dma-coherent;
 	};
 
 	dp0: display@2cc00000 {
@@ -485,9 +486,7 @@
 		interrupt-names = "DPU";
 		clocks = <&scmi_clk 0>;
 		clock-names = "aclk";
-		iommus = <&smmu 0>, <&smmu 1>, <&smmu 2>, <&smmu 3>,
-			<&smmu 4>, <&smmu 5>, <&smmu 6>, <&smmu 7>,
-			<&smmu 8>, <&smmu 9>;
+		iommus = <&smmu_700 0x100>;
 		pl0: pipeline@0 {
 			reg = <0>;
 			clocks = <&scmi_clk 1>;
diff --git a/include/drivers/nxp/smmu/nxp_smmu.h b/include/drivers/nxp/smmu/nxp_smmu.h
index d64c33b..bc17703 100644
--- a/include/drivers/nxp/smmu/nxp_smmu.h
+++ b/include/drivers/nxp/smmu/nxp_smmu.h
@@ -10,10 +10,13 @@
 
 #define SMMU_SCR0		(0x0)
 #define SMMU_NSCR0		(0x400)
+#define SMMU_SACR		(0x10)
 
 #define SCR0_CLIENTPD_MASK	0x00000001
 #define SCR0_USFCFG_MASK	0x00000400
 
+#define SMMU_SACR_CACHE_LOCK_ENABLE_BIT      (1ULL << 26U)
+
 static inline void bypass_smmu(uintptr_t smmu_base_addr)
 {
 	uint32_t val;
@@ -27,4 +30,13 @@
 	mmio_write_32((smmu_base_addr + SMMU_NSCR0), val);
 }
 
+static inline void smmu_cache_unlock(uintptr_t smmu_base_addr)
+{
+	uint32_t val;
+
+	val = mmio_read_32((smmu_base_addr + SMMU_SACR));
+	val &= (uint32_t)~SMMU_SACR_CACHE_LOCK_ENABLE_BIT;
+	mmio_write_32((smmu_base_addr + SMMU_SACR), val);
+}
+
 #endif
diff --git a/include/plat/common/platform.h b/include/plat/common/platform.h
index 8407bbd..3351036 100644
--- a/include/plat/common/platform.h
+++ b/include/plat/common/platform.h
@@ -421,4 +421,17 @@
 void plat_fwu_set_images_source(const struct fwu_metadata *metadata);
 uint32_t plat_fwu_get_boot_idx(void);
 
+/*
+ * Optional function to indicate if cache management operations can be
+ * performed.
+ */
+#if CONDITIONAL_CMO
+uint64_t plat_can_cmo(void);
+#else
+static inline uint64_t plat_can_cmo(void)
+{
+	return 1;
+}
+#endif /* CONDITIONAL_CMO */
+
 #endif /* PLATFORM_H */
diff --git a/lib/cpus/aarch64/cortex_a710.S b/lib/cpus/aarch64/cortex_a710.S
index fed3f33..3ea55df 100644
--- a/lib/cpus/aarch64/cortex_a710.S
+++ b/lib/cpus/aarch64/cortex_a710.S
@@ -482,6 +482,30 @@
 	b	cpu_rev_var_ls
 endfunc check_errata_2371105
 
+/* ----------------------------------------------------
+ * Errata Workaround for Cortex-A710 Errata #2768515
+ * This applies to revisions <= r2p1 and is still open.
+ * x0: variant[4:7] and revision[0:3] of current cpu.
+ * Shall clobber: x0-x17
+ * ----------------------------------------------------
+ */
+func errata_a710_2768515_wa
+	mov	x17, x30
+	bl	check_errata_2768515
+	cbz	x0, 1f
+
+	/* dsb before isb of power down sequence */
+	dsb	sy
+1:
+	ret	x17
+endfunc errata_a710_2768515_wa
+
+func check_errata_2768515
+	/* Applies to all revisions <= r2p1 */
+	mov	x1, #0x21
+	b	cpu_rev_var_ls
+endfunc check_errata_2768515
+
 func check_errata_cve_2022_23960
 #if WORKAROUND_CVE_2022_23960
 	mov	x0, #ERRATA_APPLIES
@@ -518,6 +542,12 @@
 	mrs	x0, CORTEX_A710_CPUPWRCTLR_EL1
 	orr	x0, x0, #CORTEX_A710_CPUPWRCTLR_EL1_CORE_PWRDN_BIT
 	msr	CORTEX_A710_CPUPWRCTLR_EL1, x0
+#if ERRATA_A710_2768515
+	mov	x15, x30
+	bl	cpu_get_rev_var
+	bl	errata_a710_2768515_wa
+	mov	x30, x15
+#endif /* ERRATA_A710_2768515 */
 	isb
 	ret
 endfunc cortex_a710_core_pwr_dwn
@@ -550,6 +580,7 @@
 	report_errata ERRATA_A710_2216384, cortex_a710, 2216384
 	report_errata ERRATA_A710_2291219, cortex_a710, 2291219
 	report_errata ERRATA_A710_2371105, cortex_a710, 2371105
+	report_errata ERRATA_A710_2768515, cortex_a710, 2768515
 	report_errata WORKAROUND_CVE_2022_23960, cortex_a710, cve_2022_23960
 	report_errata ERRATA_DSU_2313941, cortex_a710, dsu_2313941
 
diff --git a/lib/cpus/aarch64/cortex_a78.S b/lib/cpus/aarch64/cortex_a78.S
index dd3487a..38f58bb 100644
--- a/lib/cpus/aarch64/cortex_a78.S
+++ b/lib/cpus/aarch64/cortex_a78.S
@@ -326,6 +326,31 @@
 	b	cpu_rev_var_ls
 endfunc check_errata_2395406
 
+/* ----------------------------------------------------
+ * Errata Workaround for Cortex-A78 Errata 2772019
+ * This applies to revisions <= r1p2 and is still open.
+ * x0: variant[4:7] and revision[0:3] of current cpu.
+ * Shall clobber: x0-x17
+ * ----------------------------------------------------
+ */
+func errata_a78_2772019_wa
+	mov	x17, x30
+	bl	check_errata_2772019
+	cbz	x0, 1f
+
+
+	/* dsb before isb of power down sequence */
+	dsb	sy
+1:
+	ret	x17
+endfunc errata_a78_2772019_wa
+
+func check_errata_2772019
+	/* Applies to all revisions <= r1p2 */
+	mov	x1, #0x12
+	b	cpu_rev_var_ls
+endfunc check_errata_2772019
+
 func check_errata_cve_2022_23960
 #if WORKAROUND_CVE_2022_23960
 	mov	x0, #ERRATA_APPLIES
@@ -434,6 +459,12 @@
 	mrs	x0, CORTEX_A78_CPUPWRCTLR_EL1
 	orr	x0, x0, #CORTEX_A78_CPUPWRCTLR_EL1_CORE_PWRDN_EN_BIT
 	msr	CORTEX_A78_CPUPWRCTLR_EL1, x0
+#if ERRATA_A78_2772019
+	mov	x15, x30
+	bl	cpu_get_rev_var
+	bl	errata_a78_2772019_wa
+	mov	x30, x15
+#endif /* ERRATA_A78_2772019 */
 	isb
 	ret
 endfunc cortex_a78_core_pwr_dwn
@@ -461,6 +492,7 @@
 	report_errata ERRATA_A78_2242635, cortex_a78, 2242635
 	report_errata ERRATA_A78_2376745, cortex_a78, 2376745
 	report_errata ERRATA_A78_2395406, cortex_a78, 2395406
+	report_errata ERRATA_A78_2772019, cortex_a78, 2772019
 	report_errata WORKAROUND_CVE_2022_23960, cortex_a78, cve_2022_23960
 
 	ldp	x8, x30, [sp], #16
diff --git a/lib/cpus/aarch64/cortex_x2.S b/lib/cpus/aarch64/cortex_x2.S
index c810be6..f56d50a 100644
--- a/lib/cpus/aarch64/cortex_x2.S
+++ b/lib/cpus/aarch64/cortex_x2.S
@@ -295,6 +295,30 @@
 	b	cpu_rev_var_ls
 endfunc check_errata_2371105
 
+/* ----------------------------------------------------
+ * Errata Workaround for Cortex-X2 Errata #2768515
+ * This applies to revisions <= r2p1 and is still open.
+ * x0: variant[4:7] and revision[0:3] of current cpu.
+ * Shall clobber: x0-x17
+ * ----------------------------------------------------
+ */
+func errata_x2_2768515_wa
+	mov	x17, x30
+	bl	check_errata_2768515
+	cbz	x0, 1f
+
+	/* dsb before isb of power down sequence */
+	dsb	sy
+1:
+	ret	x17
+endfunc errata_x2_2768515_wa
+
+func check_errata_2768515
+	/* Applies to all revisions <= r2p1 */
+	mov	x1, #0x21
+	b	cpu_rev_var_ls
+endfunc check_errata_2768515
+
 	/* ----------------------------------------------------
 	 * HW will do the cache maintenance while powering down
 	 * ----------------------------------------------------
@@ -307,6 +331,12 @@
 	mrs	x0, CORTEX_X2_CPUPWRCTLR_EL1
 	orr	x0, x0, #CORTEX_X2_CPUPWRCTLR_EL1_CORE_PWRDN_BIT
 	msr	CORTEX_X2_CPUPWRCTLR_EL1, x0
+#if ERRATA_X2_2768515
+	mov	x15, x30
+	bl	cpu_get_rev_var
+	bl	errata_x2_2768515_wa
+	mov	x30, x15
+#endif /* ERRATA_X2_2768515 */
 	isb
 	ret
 endfunc cortex_x2_core_pwr_dwn
@@ -333,6 +363,7 @@
 	report_errata ERRATA_X2_2147715, cortex_x2, 2147715
 	report_errata ERRATA_X2_2216384, cortex_x2, 2216384
 	report_errata ERRATA_X2_2371105, cortex_x2, 2371105
+	report_errata ERRATA_X2_2768515, cortex_x2, 2768515
 	report_errata WORKAROUND_CVE_2022_23960, cortex_x2, cve_2022_23960
 	report_errata ERRATA_DSU_2313941, cortex_x2, dsu_2313941
 
diff --git a/lib/cpus/aarch64/neoverse_n2.S b/lib/cpus/aarch64/neoverse_n2.S
index 5861dec..dbf5941 100644
--- a/lib/cpus/aarch64/neoverse_n2.S
+++ b/lib/cpus/aarch64/neoverse_n2.S
@@ -428,6 +428,30 @@
 	b	cpu_rev_var_ls
 endfunc check_errata_2388450
 
+/* -------------------------------------------------------
+ * Errata Workaround for Neoverse N2 Erratum 2743089.
+ * This applies to revisions <= r0p2 and is fixed in r0p3.
+ * x0: variant[4:7] and revision[0:3] of current cpu.
+ * Shall clobber: x0-x17
+ * -------------------------------------------------------
+ */
+func errata_n2_2743089_wa
+	mov	x17, x30
+	bl	check_errata_2743089
+	cbz	x0, 1f
+
+	/* dsb before isb of power down sequence */
+	dsb	sy
+1:
+	ret	x17
+endfunc errata_n2_2743089_wa
+
+func check_errata_2743089
+	/* Applies to all revisions <= r0p2 */
+	mov	x1, #0x02
+	b	cpu_rev_var_ls
+endfunc check_errata_2743089
+
 func check_errata_cve_2022_23960
 #if WORKAROUND_CVE_2022_23960
 	mov	x0, #ERRATA_APPLIES
@@ -576,6 +600,12 @@
 	mrs	x0, NEOVERSE_N2_CPUPWRCTLR_EL1
 	orr	x0, x0, #NEOVERSE_N2_CORE_PWRDN_EN_BIT
 	msr	NEOVERSE_N2_CPUPWRCTLR_EL1, x0
+#if ERRATA_N2_2743089
+	mov	x15, x30
+	bl	cpu_get_rev_var
+	bl	errata_n2_2743089_wa
+	mov	x30, x15
+#endif /* ERRATA_N2_2743089 */
 	isb
 	ret
 endfunc neoverse_n2_core_pwr_dwn
@@ -607,6 +637,7 @@
 	report_errata ERRATA_N2_2326639, neoverse_n2, 2326639
 	report_errata ERRATA_N2_2376738, neoverse_n2, 2376738
 	report_errata ERRATA_N2_2388450, neoverse_n2, 2388450
+	report_errata ERRATA_N2_2743089, neoverse_n2, 2743089
 	report_errata WORKAROUND_CVE_2022_23960, neoverse_n2, cve_2022_23960
 	report_errata ERRATA_DSU_2313941, neoverse_n2, dsu_2313941
 
diff --git a/lib/cpus/aarch64/neoverse_v1.S b/lib/cpus/aarch64/neoverse_v1.S
index 3282fbc..c3a70ca 100644
--- a/lib/cpus/aarch64/neoverse_v1.S
+++ b/lib/cpus/aarch64/neoverse_v1.S
@@ -462,6 +462,30 @@
 	b	cpu_rev_var_ls
 endfunc check_errata_2372203
 
+	/* ----------------------------------------------------
+	 * Errata Workaround for Neoverse V1 Errata #2743093.
+	 * This applies to revisions <= r1p2 and is still open.
+	 * x0: variant[4:7] and revision[0:3] of current cpu.
+	 * Shall clobber: x0-x17
+	 * ----------------------------------------------------
+	 */
+func errata_neoverse_v1_2743093_wa
+	mov	x17, x30
+	bl	check_errata_2743093
+	cbz	x0, 1f
+
+	/* dsb before isb of power down sequence */
+	dsb	sy
+1:
+	ret	x17
+endfunc errata_neoverse_v1_2743093_wa
+
+func check_errata_2743093
+	/* Applies to all revisions <= r1p2 */
+	mov	x1, #0x12
+	b	cpu_rev_var_ls
+endfunc check_errata_2743093
+
 func check_errata_cve_2022_23960
 #if WORKAROUND_CVE_2022_23960
 	mov	x0, #ERRATA_APPLIES
@@ -483,6 +507,12 @@
 	mrs	x0, NEOVERSE_V1_CPUPWRCTLR_EL1
 	orr	x0, x0, #NEOVERSE_V1_CPUPWRCTLR_EL1_CORE_PWRDN_BIT
 	msr	NEOVERSE_V1_CPUPWRCTLR_EL1, x0
+#if ERRATA_V1_2743093
+	mov	x15, x30
+	bl	cpu_get_rev_var
+	bl	errata_neoverse_v1_2743093_wa
+	mov	x30, x15
+#endif /* ERRATA_V1_2743093 */
 	isb
 	ret
 endfunc neoverse_v1_core_pwr_dwn
@@ -513,6 +543,7 @@
 	report_errata ERRATA_V1_2216392, neoverse_v1, 2216392
 	report_errata ERRATA_V1_2294912, neoverse_v1, 2294912
 	report_errata ERRATA_V1_2372203, neoverse_v1, 2372203
+	report_errata ERRATA_V1_2743093, neoverse_v1, 2743093
 	report_errata WORKAROUND_CVE_2022_23960, neoverse_v1, cve_2022_23960
 
 	ldp	x8, x30, [sp], #16
diff --git a/lib/cpus/cpu-ops.mk b/lib/cpus/cpu-ops.mk
index 8ef794b..b1f7d27 100644
--- a/lib/cpus/cpu-ops.mk
+++ b/lib/cpus/cpu-ops.mk
@@ -357,6 +357,11 @@
 # to revisions r0p0, r1p0, r1p1, and r1p2 of the A78 cpu. It is still open.
 ERRATA_A78_2395406	?=0
 
+# Flag to apply erratum 2772019 workaround during powerdown. This erratum
+# applies to revisions r0p0, r1p0, r1p1 and r1p2 of the A78 cpu. It is still
+# open.
+ERRATA_A78_2772019	?=0
+
 # Flag to apply erratum 1941500 workaround during reset. This erratum applies
 # to revisions r0p0 and r0p1 of the A78 AE cpu. It is still open.
 ERRATA_A78_AE_1941500	?=0
@@ -462,10 +467,6 @@
 # applies to all revisions <= r4p1 of the Neoverse N1 cpu and is still open.
 ERRATA_N1_2743102	?=0
 
-# Flag to apply erratum 2002655 workaround during reset. This erratum applies
-# to revisions r0p0 of the Neoverse-N2 cpu, it is still open.
-ERRATA_N2_2002655	?=0
-
 # Flag to apply erratum 1618635 workaround during reset. This erratum applies
 # to revision r0p0 of the Neoverse V1 cpu and was fixed in the revision r1p0.
 ERRATA_V1_1618635	?=0
@@ -516,6 +517,11 @@
 # to revisions r0p0, r1p0 and r1p1 of the Neoverse V1 cpu and is still open.
 ERRATA_V1_2372203	?=0
 
+# Flag to apply erratum 2743093 workaround during powerdown. This erratum
+# applies to revisions r0p0, r1p0, r1p1 and r1p2  of the Neoverse V1 cpu and is
+# still open.
+ERRATA_V1_2743093	?=0
+
 # Flag to apply erratum 1987031 workaround during reset. This erratum applies
 # to revisions r0p0, r1p0 and r2p0 of the Cortex-A710 cpu and is still open.
 ERRATA_A710_1987031	?=0
@@ -572,6 +578,15 @@
 # to revision r0p0, r1p0 and r2p0 of the Cortex-A710 cpu and is fixed in r2p1.
 ERRATA_A710_2371105	?=0
 
+# Flag to apply erratum 2768515 workaround during power down. This erratum
+# applies to revision r0p0, r1p0, r2p0 and r2p1 of the Cortex-A710 cpu and is
+# still open.
+ERRATA_A710_2768515	?=0
+
+# Flag to apply erratum 2002655 workaround during reset. This erratum applies
+# to revisions r0p0 of the Neoverse-N2 cpu, it is still open.
+ERRATA_N2_2002655	?=0
+
 # Flag to apply erratum 2067956 workaround during reset. This erratum applies
 # to revision r0p0 of the Neoverse N2 cpu and is still open.
 ERRATA_N2_2067956	?=0
@@ -620,6 +635,10 @@
 # to revision r0p0 of the Neoverse N2 cpu, it is fixed in r0p1.
 ERRATA_N2_2388450	?=0
 
+# Flag to apply erratum 2743089 workaround during during powerdown. This erratum
+# applies to all revisions <= r0p2 of the Neoverse N2 cpu, it is fixed in r0p3.
+ERRATA_N2_2743089	?=0
+
 # Flag to apply erratum 2002765 workaround during reset. This erratum applies
 # to revisions r0p0, r1p0, and r2p0 of the Cortex-X2 cpu and is still open.
 ERRATA_X2_2002765	?=0
@@ -655,6 +674,11 @@
 # to revision r0p0, r1p0 and r2p0 of the Cortex-X2 cpu and is fixed in r2p1.
 ERRATA_X2_2371105	?=0
 
+# Flag to apply erratum 2768515 workaround during power down. This erratum
+# applies to revision r0p0, r1p0, r2p0 and r2p1 of the Cortex-X2 cpu and is
+# still open.
+ERRATA_X2_2768515	?=0
+
 # Flag to apply erratum 2313909 workaround on powerdown. This erratum applies
 # to revisions r0p0 and r1p0 of the Cortex-X3 cpu, it is fixed in r1p1.
 ERRATA_X3_2313909	?=0
@@ -996,6 +1020,10 @@
 $(eval $(call assert_boolean,ERRATA_A78_2395406))
 $(eval $(call add_define,ERRATA_A78_2395406))
 
+# Process ERRATA_A78_2772019 flag
+$(eval $(call assert_boolean,ERRATA_A78_2772019))
+$(eval $(call add_define,ERRATA_A78_2772019))
+
 # Process ERRATA_A78_AE_1941500 flag
 $(eval $(call assert_boolean,ERRATA_A78_AE_1941500))
 $(eval $(call add_define,ERRATA_A78_AE_1941500))
@@ -1099,10 +1127,6 @@
 # Process ERRATA_N1_2743102 flag
 $(eval $(call assert_boolean,ERRATA_N1_2743102))
 $(eval $(call add_define,ERRATA_N1_2743102))
-#
-# Process ERRATA_N2_2002655 flag
-$(eval $(call assert_boolean,ERRATA_N2_2002655))
-$(eval $(call add_define,ERRATA_N2_2002655))
 
 # Process ERRATA_V1_1618635 flag
 $(eval $(call assert_boolean,ERRATA_V1_1618635))
@@ -1152,6 +1176,10 @@
 $(eval $(call assert_boolean,ERRATA_V1_2372203))
 $(eval $(call add_define,ERRATA_V1_2372203))
 
+# Process ERRATA_V1_2743093 flag
+$(eval $(call assert_boolean,ERRATA_V1_2743093))
+$(eval $(call add_define,ERRATA_V1_2743093))
+
 # Process ERRATA_A710_1987031 flag
 $(eval $(call assert_boolean,ERRATA_A710_1987031))
 $(eval $(call add_define,ERRATA_A710_1987031))
@@ -1208,6 +1236,14 @@
 $(eval $(call assert_boolean,ERRATA_A710_2371105))
 $(eval $(call add_define,ERRATA_A710_2371105))
 
+# Process ERRATA_A710_2768515 flag
+$(eval $(call assert_boolean,ERRATA_A710_2768515))
+$(eval $(call add_define,ERRATA_A710_2768515))
+
+# Process ERRATA_N2_2002655 flag
+$(eval $(call assert_boolean,ERRATA_N2_2002655))
+$(eval $(call add_define,ERRATA_N2_2002655))
+
 # Process ERRATA_N2_2067956 flag
 $(eval $(call assert_boolean,ERRATA_N2_2067956))
 $(eval $(call add_define,ERRATA_N2_2067956))
@@ -1256,6 +1292,10 @@
 $(eval $(call assert_boolean,ERRATA_N2_2388450))
 $(eval $(call add_define,ERRATA_N2_2388450))
 
+# Process ERRATA_N2_2743089 flag
+$(eval $(call assert_boolean,ERRATA_N2_2743089))
+$(eval $(call add_define,ERRATA_N2_2743089))
+
 # Process ERRATA_X2_2002765 flag
 $(eval $(call assert_boolean,ERRATA_X2_2002765))
 $(eval $(call add_define,ERRATA_X2_2002765))
@@ -1288,6 +1328,10 @@
 $(eval $(call assert_boolean,ERRATA_X2_2371105))
 $(eval $(call add_define,ERRATA_X2_2371105))
 
+# Process ERRATA_X2_2768515 flag
+$(eval $(call assert_boolean,ERRATA_X2_2768515))
+$(eval $(call add_define,ERRATA_X2_2768515))
+
 # Process ERRATA_X3_2313909 flag
 $(eval $(call assert_boolean,ERRATA_X3_2313909))
 $(eval $(call add_define,ERRATA_X3_2313909))
diff --git a/lib/el3_runtime/aarch64/context.S b/lib/el3_runtime/aarch64/context.S
index b126b9c..60501f6 100644
--- a/lib/el3_runtime/aarch64/context.S
+++ b/lib/el3_runtime/aarch64/context.S
@@ -788,6 +788,15 @@
 #endif /* CTX_INCLUDE_FPREGS */
 
 	/*
+	 * Set SCR_EL3.EA bit to enable SErrors at EL3
+	 */
+	.macro enable_serror_at_el3
+	mrs     x8, scr_el3
+	orr     x8, x8, #SCR_EA_BIT
+	msr     scr_el3, x8
+	.endm
+
+	/*
 	 * Set the PSTATE bits not set when the exception was taken as
 	 * described in the AArch64.TakeException() pseudocode function
 	 * in ARM DDI 0487F.c page J1-7635 to a default value.
@@ -917,6 +926,7 @@
  */
 func prepare_el3_entry
 	save_gp_pmcr_pauth_regs
+	enable_serror_at_el3
 	/*
 	 * Set the PSTATE bits not described in the Aarch64.TakeException
 	 * pseudocode to their default values.
diff --git a/lib/gpt_rme/gpt_rme.c b/lib/gpt_rme/gpt_rme.c
index a6e17a3..f5353cb 100644
--- a/lib/gpt_rme/gpt_rme.c
+++ b/lib/gpt_rme/gpt_rme.c
@@ -762,7 +762,7 @@
  * Return
  *   Negative Linux error code in the event of a failure, 0 for success.
  */
-int gpt_init_l0_tables(unsigned int pps, uintptr_t l0_mem_base,
+int gpt_init_l0_tables(gpccr_pps_e pps, uintptr_t l0_mem_base,
 		       size_t l0_mem_size)
 {
 	int ret;
diff --git a/plat/arm/board/common/board_common.mk b/plat/arm/board/common/board_common.mk
index 1f59a4f..d73c2e3 100644
--- a/plat/arm/board/common/board_common.mk
+++ b/plat/arm/board/common/board_common.mk
@@ -12,6 +12,7 @@
 BL2_SOURCES		+=	drivers/cfi/v2m/v2m_flash.c
 
 ifneq (${TRUSTED_BOARD_BOOT},0)
+ARM_ROTPK_S = plat/arm/board/common/rotpk/arm_dev_rotpk.S
 ifneq (${ARM_CRYPTOCELL_INTEG}, 1)
 # ROTPK hash location
 ifeq (${ARM_ROTPK_LOCATION}, regs)
@@ -20,7 +21,6 @@
 	CRYPTO_ALG=rsa
 	ARM_ROTPK_LOCATION_ID = ARM_ROTPK_DEVEL_RSA_ID
 	ARM_ROTPK_HASH = plat/arm/board/common/rotpk/arm_rotpk_rsa_sha256.bin
-	ARM_ROTPK_S = plat/arm/board/common/rotpk/arm_dev_rotpk.S
 $(eval $(call add_define_val,ARM_ROTPK_HASH,'"$(ARM_ROTPK_HASH)"'))
 $(BUILD_PLAT)/bl2/arm_dev_rotpk.o : $(ARM_ROTPK_HASH)
 $(warning Development keys support for FVP is deprecated. Use `regs` \
@@ -29,7 +29,6 @@
 	CRYPTO_ALG=ec
 	ARM_ROTPK_LOCATION_ID = ARM_ROTPK_DEVEL_ECDSA_ID
 	ARM_ROTPK_HASH = plat/arm/board/common/rotpk/arm_rotpk_ecdsa_sha256.bin
-	ARM_ROTPK_S = plat/arm/board/common/rotpk/arm_dev_rotpk.S
 $(eval $(call add_define_val,ARM_ROTPK_HASH,'"$(ARM_ROTPK_HASH)"'))
 $(BUILD_PLAT)/bl2/arm_dev_rotpk.o : $(ARM_ROTPK_HASH)
 $(warning Development keys support for FVP is deprecated. Use `regs` \
diff --git a/plat/arm/board/tc/include/platform_def.h b/plat/arm/board/tc/include/platform_def.h
index bc4f254..0fe4a0a 100644
--- a/plat/arm/board/tc/include/platform_def.h
+++ b/plat/arm/board/tc/include/platform_def.h
@@ -101,7 +101,7 @@
  * PLAT_ARM_MAX_BL1_RW_SIZE is calculated using the current BL1 RW debug size
  * plus a little space for growth.
  */
-#define PLAT_ARM_MAX_BL1_RW_SIZE	0xD000
+#define PLAT_ARM_MAX_BL1_RW_SIZE	0x12000
 
 /*
  * PLAT_ARM_MAX_ROMLIB_RW_SIZE is define to use a full page
@@ -129,7 +129,7 @@
  * BL2 and BL1-RW. Current size is considering that TRUSTED_BOARD_BOOT and
  * MEASURED_BOOT is enabled.
  */
-#define PLAT_ARM_MAX_BL31_SIZE		0x47000
+#define PLAT_ARM_MAX_BL31_SIZE		0x60000
 
 /*
  * Size of cacheable stacks
@@ -152,7 +152,7 @@
 # if SPM_MM
 #  define PLATFORM_STACK_SIZE		0x500
 # else
-#  define PLATFORM_STACK_SIZE		0x400
+#  define PLATFORM_STACK_SIZE		0xa00
 # endif
 #elif defined(IMAGE_BL32)
 # define PLATFORM_STACK_SIZE		0x440
diff --git a/plat/arm/board/tc/include/tc_plat.h b/plat/arm/board/tc/include/tc_plat.h
index 28c0308..f7ce2fe 100644
--- a/plat/arm/board/tc/include/tc_plat.h
+++ b/plat/arm/board/tc/include/tc_plat.h
@@ -9,4 +9,8 @@
 
 void tc_bl31_common_platform_setup(void);
 
+#ifdef PLATFORM_TEST
+void run_platform_tests(void);
+#endif
+
 #endif /* TC_PLAT_H */
diff --git a/plat/arm/board/tc/plat_tc_mbedtls_config.h b/plat/arm/board/tc/plat_tc_mbedtls_config.h
new file mode 100644
index 0000000..d776b63
--- /dev/null
+++ b/plat/arm/board/tc/plat_tc_mbedtls_config.h
@@ -0,0 +1,33 @@
+/*
+ * Copyright (c) 2022, Arm Ltd. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#ifndef PLAT_TC_MBEDTLS_CONFIG_H
+#define PLAT_TC_MBEDTLS_CONFIG_H
+
+#include <mbedtls_config.h>
+#include <export/lib/utils_def_exp.h>
+
+#ifndef TF_MBEDTLS_HEAP_SIZE
+#error TF_MBEDTLS_HEAP_SIZE is not defined
+#else
+#define PLATFORM_TEST_MIN_MBEDTLS_HEAP_SIZE	(8 * 1024)
+/* Only change heap size if it is less then the minimum required. */
+#if TF_MBEDTLS_HEAP_SIZE < PLATFORM_TEST_MIN_MBEDTLS_HEAP_SIZE
+#undef TF_MBEDTLS_HEAP_SIZE
+#define TF_MBEDTLS_HEAP_SIZE	PLATFORM_TEST_MIN_MBEDTLS_HEAP_SIZE
+#endif
+#endif
+
+#define MBEDTLS_PSA_CRYPTO_C
+#define MBEDTLS_HMAC_DRBG_C
+#define MBEDTLS_ENTROPY_C
+#define MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
+#define MBEDTLS_NO_PLATFORM_ENTROPY
+#define MBEDTLS_TEST_NULL_ENTROPY
+#define MBEDTLS_ECP_C
+#define MBEDTLS_ECP_DP_SECP384R1_ENABLED
+
+#endif /* PLAT_TC_MBEDTLS_CONFIG_H */
diff --git a/plat/arm/board/tc/platform.mk b/plat/arm/board/tc/platform.mk
index 37ba229..74c0f17 100644
--- a/plat/arm/board/tc/platform.mk
+++ b/plat/arm/board/tc/platform.mk
@@ -193,6 +193,11 @@
 
 endif
 
+# Add this include as first, before arm_common.mk. This is necessary because
+# arm_common.mk builds Mbed TLS, and platform_test.mk can change the list of
+# Mbed TLS files that are to be compiled (LIBMBEDTLS_SRCS).
+include plat/arm/board/tc/platform_test.mk
+
 include plat/arm/common/arm_common.mk
 include plat/arm/css/common/css_common.mk
 include plat/arm/soc/common/soc_css.mk
diff --git a/plat/arm/board/tc/platform_test.mk b/plat/arm/board/tc/platform_test.mk
new file mode 100644
index 0000000..c2ee69e
--- /dev/null
+++ b/plat/arm/board/tc/platform_test.mk
@@ -0,0 +1,80 @@
+# Copyright (c) 2022, Arm Limited. All rights reserved.
+#
+# SPDX-License-Identifier: BSD-3-Clause
+#
+
+ifeq (${PLATFORM_TEST},1)
+
+    # The variables need to be set to compile the platform test:
+    ifeq (${TF_M_TESTS_PATH},)
+        # Example: ../rss/tf-m-tests
+        $(error Error: TF_M_TESTS_PATH not set)
+    endif
+    ifeq (${TF_M_EXTRAS_PATH},)
+        # Example: ../rss/tf-m-extras
+        $(error Error: TF_M_EXTRAS_PATH not set)
+    endif
+    ifeq (${MEASUREMENT_VALUE_SIZE},)
+        MEASUREMENT_VALUE_SIZE	:=	32
+    endif
+    ifeq (${MEASURED_BOOT_HASH_ALG},)
+        MEASURED_BOOT_HASH_ALG	:=	"PSA_ALG_SHA_256"
+    endif
+
+    DELEGATED_ATTEST_TESTS_PATH	=	$(TF_M_EXTRAS_PATH)/partitions/delegated_attestation/test
+    MEASURED_BOOT_TESTS_PATH	=	$(TF_M_EXTRAS_PATH)/partitions/measured_boot/test
+
+    MBEDTLS_CONFIG_FILE		=	"<plat_tc_mbedtls_config.h>"
+
+    LIBMBEDTLS_SRCS		+= 	$(addprefix ${MBEDTLS_DIR}/library/,	\
+					entropy.c				\
+					entropy_poll.c				\
+					hmac_drbg.c				\
+					psa_crypto.c				\
+					psa_crypto_client.c			\
+					psa_crypto_driver_wrappers.c		\
+					psa_crypto_hash.c			\
+					psa_crypto_rsa.c			\
+					psa_crypto_ecp.c			\
+					psa_crypto_slot_management.c		\
+					)
+
+    BL31_SOURCES	+=	${RSS_COMMS_SOURCES} 				\
+				plat/arm/common/arm_dyn_cfg.c 			\
+				${TC_BASE}/rss_ap_tests.c 			\
+				${TC_BASE}/rss_ap_testsuites.c 			\
+				${TC_BASE}/rss_ap_test_stubs.c			\
+				$(TF_M_TESTS_PATH)/test/framework/test_framework.c \
+				$(MEASURED_BOOT_TESTS_PATH)/measured_boot_common.c \
+				$(MEASURED_BOOT_TESTS_PATH)/measured_boot_tests_common.c \
+				$(DELEGATED_ATTEST_TESTS_PATH)/delegated_attest_test.c \
+				drivers/auth/mbedtls/mbedtls_common.c 		\
+				lib/psa/measured_boot.c 			\
+				lib/psa/delegated_attestation.c
+
+    PLAT_INCLUDES	+=	-I$(TF_M_EXTRAS_PATH)/partitions/measured_boot/interface/include \
+				-I$(TF_M_EXTRAS_PATH)/partitions/delegated_attestation/interface/include \
+				-I$(TF_M_TESTS_PATH)/test/framework 		\
+				-I$(TF_M_TESTS_PATH)/log 			\
+				-I$(TF_M_TESTS_PATH)/test/secure_fw/suites/extra \
+				-I$(MEASURED_BOOT_TESTS_PATH)/non_secure 	\
+				-I$(DELEGATED_ATTEST_TESTS_PATH) 		\
+				-I$(DELEGATED_ATTEST_TESTS_PATH)/non_secure \
+				-Iplat/arm/board/tc 				\
+				-Iinclude/drivers/auth/mbedtls 			\
+				-Iinclude/drivers/arm
+
+    # Some of the PSA functions are declared in multiple header files, that
+    # triggers this warning.
+    TF_CFLAGS		+=	-Wno-error=redundant-decls
+
+    # TODO: Created patch for warning in tf-m-tests
+    TF_CFLAGS		+=	-Wno-error=return-type
+
+    # Define macros that are used by the code coming from the tf-m-extras repo.
+    $(eval $(call add_define,MEASUREMENT_VALUE_SIZE))
+    $(eval $(call add_define,MEASURED_BOOT_HASH_ALG))
+    $(eval $(call add_define,DELEG_ATTEST_DUMP_TOKEN_AND_KEY))
+
+    $(eval $(call add_define,PLATFORM_TEST))
+endif
diff --git a/plat/arm/board/tc/region_defs.h b/plat/arm/board/tc/region_defs.h
new file mode 100644
index 0000000..d3dfd13
--- /dev/null
+++ b/plat/arm/board/tc/region_defs.h
@@ -0,0 +1,12 @@
+/*
+ * Copyright (c) 2022, Arm Ltd. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#ifndef REGION_DEFS_H
+#define REGION_DEFS_H
+
+#define PSA_INITIAL_ATTEST_TOKEN_MAX_SIZE   0x800
+
+#endif /* REGION_DEFS_H */
diff --git a/plat/arm/board/tc/rss_ap_test_stubs.c b/plat/arm/board/tc/rss_ap_test_stubs.c
new file mode 100644
index 0000000..aa97476
--- /dev/null
+++ b/plat/arm/board/tc/rss_ap_test_stubs.c
@@ -0,0 +1,121 @@
+/*
+ * Copyright (c) 2022, Arm Ltd. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdio.h>
+
+#include <delegated_attestation.h>
+#include <measured_boot.h>
+#include <psa/error.h>
+
+
+psa_status_t
+tfm_measured_boot_extend_measurement(uint8_t index,
+				     const uint8_t *signer_id,
+				     size_t signer_id_size,
+				     const uint8_t *version,
+				     size_t version_size,
+				     uint32_t measurement_algo,
+				     const uint8_t *sw_type,
+				     size_t sw_type_size,
+				     const uint8_t *measurement_value,
+				     size_t measurement_value_size,
+				     bool lock_measurement)
+{
+	return rss_measured_boot_extend_measurement(index,
+						    signer_id,
+						    signer_id_size,
+						    version,
+						    version_size,
+						    measurement_algo,
+						    sw_type,
+						    sw_type_size,
+						    measurement_value,
+						    measurement_value_size,
+						    lock_measurement);
+}
+
+psa_status_t
+tfm_measured_boot_read_measurement(uint8_t index,
+				   uint8_t *signer_id,
+				   size_t signer_id_size,
+				   size_t *signer_id_len,
+				   uint8_t *version,
+				   size_t version_size,
+				   size_t *version_len,
+				   uint32_t *measurement_algo,
+				   uint8_t *sw_type,
+				   size_t sw_type_size,
+				   size_t *sw_type_len,
+				   uint8_t *measurement_value,
+				   size_t measurement_value_size,
+				   size_t *measurement_value_len,
+				   bool *is_locked)
+{
+	return rss_measured_boot_read_measurement(index,
+						  signer_id,
+						  signer_id_size,
+						  signer_id_len,
+						  version,
+						  version_size,
+						  version_len,
+						  measurement_algo,
+						  sw_type,
+						  sw_type_size,
+						  sw_type_len,
+						  measurement_value,
+						  measurement_value_size,
+						  measurement_value_len,
+						  is_locked);
+}
+
+psa_status_t
+tfm_delegated_attest_get_token(const uint8_t *dak_pub_hash,
+			       size_t         dak_pub_hash_size,
+			       uint8_t       *token_buf,
+			       size_t         token_buf_size,
+			       size_t        *token_size)
+{
+	return rss_delegated_attest_get_token(dak_pub_hash,
+					      dak_pub_hash_size,
+					      token_buf,
+					      token_buf_size,
+					      token_size);
+}
+
+psa_status_t
+tfm_delegated_attest_get_delegated_key(uint8_t   ecc_curve,
+				       uint32_t  key_bits,
+				       uint8_t  *key_buf,
+				       size_t    key_buf_size,
+				       size_t   *key_size,
+				       uint32_t  hash_algo)
+{
+	return rss_delegated_attest_get_delegated_key(ecc_curve,
+						      key_bits,
+						      key_buf,
+						      key_buf_size,
+						      key_size,
+						      hash_algo);
+}
+
+int tfm_log_printf(const char *fmt, ...)
+{
+	int count;
+	va_list ap;
+
+	va_start(ap, fmt);
+	count = vprintf(fmt, ap);
+	va_end(ap);
+
+	return count;
+}
+
+void printf_set_color(int color_id)
+{
+	(void)color_id;
+}
diff --git a/plat/arm/board/tc/rss_ap_tests.c b/plat/arm/board/tc/rss_ap_tests.c
new file mode 100644
index 0000000..b62043e
--- /dev/null
+++ b/plat/arm/board/tc/rss_ap_tests.c
@@ -0,0 +1,82 @@
+/*
+ * Copyright (c) 2022, Arm Ltd. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <assert.h>
+#include <stdio.h>
+
+#include <mbedtls_common.h>
+#include <plat/common/platform.h>
+#include <psa/crypto.h>
+#include <rss_comms.h>
+
+#include "rss_ap_testsuites.h"
+
+static struct test_suite_t test_suites[] = {
+	{.freg = register_testsuite_delegated_attest},
+	{.freg = register_testsuite_measured_boot},
+};
+
+static void run_tests(void)
+{
+	enum test_suite_err_t ret;
+	psa_status_t status;
+	size_t i;
+
+	rss_comms_init(PLAT_RSS_AP_SND_MHU_BASE, PLAT_RSS_AP_RCV_MHU_BASE);
+	mbedtls_init();
+	status = psa_crypto_init();
+	if (status != PSA_SUCCESS) {
+		printf("\n\npsa_crypto_init failed (status = %d)\n", status);
+		assert(false);
+		plat_error_handler(-1);
+	}
+
+	for (i = 0; i < ARRAY_SIZE(test_suites); ++i) {
+		struct test_suite_t *suite = &(test_suites[i]);
+
+		suite->freg(suite);
+		ret = run_testsuite(suite);
+		if (ret != TEST_SUITE_ERR_NO_ERROR) {
+			printf("\n\nError during executing testsuite '%s'.\n", suite->name);
+			assert(false);
+			plat_error_handler(-1);
+		}
+	}
+	printf("\nAll tests are run.\n");
+}
+
+void run_platform_tests(void)
+{
+	size_t i;
+
+	run_tests();
+
+	printf("\n\n");
+
+	/* Print a summary of all the tests that had been run. */
+	printf("SUMMARY:\n");
+	for (i = 0; i < ARRAY_SIZE(test_suites); ++i) {
+
+		struct test_suite_t *suite = &(test_suites[i]);
+
+		switch (suite->val) {
+		case TEST_PASSED:
+			printf("    %s PASSED.\n", suite->name);
+			break;
+		case TEST_FAILED:
+			printf("    %s FAILED.\n", suite->name);
+			break;
+		case TEST_SKIPPED:
+			printf("    %s SKIPPED.\n", suite->name);
+			break;
+		default:
+			assert(false);
+			break;
+		}
+	}
+
+	printf("\n\n");
+}
diff --git a/plat/arm/board/tc/rss_ap_testsuites.c b/plat/arm/board/tc/rss_ap_testsuites.c
new file mode 100644
index 0000000..aa47d4c
--- /dev/null
+++ b/plat/arm/board/tc/rss_ap_testsuites.c
@@ -0,0 +1,25 @@
+/*
+ * Copyright (c) 2022, Arm Ltd. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+/*
+ * `delegated_attest_ns_interface_testsuite.c` and
+ * `measured_boot_ns_interface_testsuite.c` are not added to the build directly.
+ * but are included in this file, and this file is added to the build. This is
+ * necessary because both files define the function `extra_tests_init`, so a
+ * linker error occurs when both are linked to BL31. This file defines a macro
+ * that renames the colliding function names to something unique.
+ * `plat/arm/board/tc/rss_ap_tests.c` can call the test init functions with
+ * their new name.
+ */
+
+#define register_testsuite_extra_ns_interface \
+	register_testsuite_delegated_attest
+#include <delegated_attest_ns_interface_testsuite.c>
+
+#undef register_testsuite_extra_ns_interface
+#define register_testsuite_extra_ns_interface \
+	register_testsuite_measured_boot
+#include <measured_boot_ns_interface_testsuite.c>
\ No newline at end of file
diff --git a/plat/arm/board/tc/rss_ap_testsuites.h b/plat/arm/board/tc/rss_ap_testsuites.h
new file mode 100644
index 0000000..58502ab
--- /dev/null
+++ b/plat/arm/board/tc/rss_ap_testsuites.h
@@ -0,0 +1,16 @@
+
+/*
+ * Copyright (c) 2022, Arm Ltd. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#ifndef RSS_AP_TESTSUITES_H
+#define RSS_AP_TESTSUITES_H
+
+#include <test_framework.h>
+
+void register_testsuite_measured_boot(struct test_suite_t *p_test_suite);
+void register_testsuite_delegated_attest(struct test_suite_t *p_test_suite);
+
+#endif /* RSS_AP_TESTSUITES_H */
diff --git a/plat/arm/board/tc/tc_bl31_setup.c b/plat/arm/board/tc/tc_bl31_setup.c
index 2cdf045..c79558d 100644
--- a/plat/arm/board/tc/tc_bl31_setup.c
+++ b/plat/arm/board/tc/tc_bl31_setup.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2021, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2020-2022, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -52,6 +52,12 @@
 void tc_bl31_common_platform_setup(void)
 {
 	arm_bl31_platform_setup();
+#ifdef PLATFORM_TEST
+	run_platform_tests();
+
+	/* Suspend booting */
+	plat_error_handler(-1);
+#endif
 }
 
 const plat_psci_ops_t *plat_arm_psci_override_pm_ops(plat_psci_ops_t *ops)
diff --git a/plat/imx/imx8m/imx8mq/imx8mq_bl31_setup.c b/plat/imx/imx8m/imx8mq/imx8mq_bl31_setup.c
index 59c3779..4706c20 100644
--- a/plat/imx/imx8m/imx8mq/imx8mq_bl31_setup.c
+++ b/plat/imx/imx8m/imx8mq/imx8mq_bl31_setup.c
@@ -124,6 +124,7 @@
 void bl31_early_platform_setup2(u_register_t arg0, u_register_t arg1,
 			u_register_t arg2, u_register_t arg3)
 {
+	static console_t console;
 	int i;
 	/* enable CSU NS access permission */
 	for (i = 0; i < 64; i++) {
@@ -132,12 +133,10 @@
 
 	imx_aipstz_init(aipstz);
 
-#if DEBUG_CONSOLE
-	static console_t console;
-
 	console_imx_uart_register(IMX_BOOT_UART_BASE, IMX_BOOT_UART_CLK_IN_HZ,
 		IMX_CONSOLE_BAUDRATE, &console);
-#endif
+	/* This console is only used for boot stage */
+	console_set_scope(&console, CONSOLE_FLAG_BOOT);
 
 	imx8m_caam_init();
 
@@ -176,23 +175,22 @@
 
 void bl31_plat_arch_setup(void)
 {
-	mmap_add_region(BL31_BASE, BL31_BASE, (BL31_LIMIT - BL31_BASE),
-		MT_MEMORY | MT_RW | MT_SECURE);
-	mmap_add_region(BL_CODE_BASE, BL_CODE_BASE, (BL_CODE_END - BL_CODE_BASE),
-		MT_MEMORY | MT_RO | MT_SECURE);
-
-	/* Map TEE memory */
-	mmap_add_region(BL32_BASE, BL32_BASE, BL32_SIZE, MT_MEMORY | MT_RW);
-
-	mmap_add(imx_mmap);
-
+	const mmap_region_t bl_regions[] = {
+		MAP_REGION_FLAT(BL31_START, BL31_SIZE,
+				MT_MEMORY | MT_RW | MT_SECURE),
+		MAP_REGION_FLAT(BL_CODE_BASE, BL_CODE_END - BL_CODE_BASE,
+				MT_MEMORY | MT_RO | MT_SECURE),
 #if USE_COHERENT_MEM
-	mmap_add_region(BL_COHERENT_RAM_BASE, BL_COHERENT_RAM_BASE,
-		BL_COHERENT_RAM_END - BL_COHERENT_RAM_BASE,
-		MT_DEVICE | MT_RW | MT_SECURE);
+		MAP_REGION_FLAT(BL_COHERENT_RAM_BASE,
+				BL_COHERENT_RAM_END - BL_COHERENT_RAM_BASE,
+				MT_DEVICE | MT_RW | MT_SECURE),
 #endif
-	/* setup xlat table */
-	init_xlat_tables();
+		/* Map TEE memory */
+		MAP_REGION_FLAT(BL32_BASE, BL32_SIZE, MT_MEMORY | MT_RW),
+		{0},
+	};
+
+	setup_page_tables(bl_regions, imx_mmap);
 	/* enable the MMU */
 	enable_mmu_el3(0);
 }
@@ -227,11 +225,6 @@
 	return COUNTER_FREQUENCY;
 }
 
-void bl31_plat_runtime_setup(void)
-{
-	return;
-}
-
 #ifdef SPD_trusty
 void plat_trusty_set_boot_args(aapcs64_params_t *args)
 {
diff --git a/plat/imx/imx8m/imx8mq/imx8mq_psci.c b/plat/imx/imx8m/imx8mq/imx8mq_psci.c
index 662017d..01582af 100644
--- a/plat/imx/imx8m/imx8mq/imx8mq_psci.c
+++ b/plat/imx/imx8m/imx8mq/imx8mq_psci.c
@@ -41,7 +41,7 @@
 
 void imx_domain_suspend(const psci_power_state_t *target_state)
 {
-	uint64_t base_addr = BL31_BASE;
+	uint64_t base_addr = BL31_START;
 	uint64_t mpidr = read_mpidr_el1();
 	unsigned int core_id = MPIDR_AFFLVL0_VAL(mpidr);
 
diff --git a/plat/imx/imx8m/imx8mq/include/platform_def.h b/plat/imx/imx8m/imx8mq/include/platform_def.h
index 1dd22d9..bb57074 100644
--- a/plat/imx/imx8m/imx8mq/include/platform_def.h
+++ b/plat/imx/imx8m/imx8mq/include/platform_def.h
@@ -4,6 +4,8 @@
  * SPDX-License-Identifier: BSD-3-Clause
  */
 
+#include <plat/common/common_def.h>
+
 #define PLATFORM_LINKER_FORMAT		"elf64-littleaarch64"
 #define PLATFORM_LINKER_ARCH		aarch64
 
@@ -31,7 +33,8 @@
 #define PLAT_STOP_OFF_STATE		U(3)
 
 #define BL31_BASE			U(0x910000)
-#define BL31_LIMIT			U(0x920000)
+#define BL31_SIZE			SZ_64K
+#define BL31_LIMIT			(BL31_BASE + BL31_SIZE)
 
 /* non-secure uboot base */
 #define PLAT_NS_IMAGE_OFFSET		U(0x40200000)
@@ -54,7 +57,6 @@
 
 #define HAB_RVT_BASE			U(0x00000880) /* HAB_RVT for i.MX8MQ */
 
-#define IMX_BOOT_UART_BASE		U(0x30860000)
 #define IMX_BOOT_UART_CLK_IN_HZ		25000000 /* Select 25Mhz oscillator */
 #define PLAT_CRASH_UART_BASE		IMX_BOOT_UART_BASE
 #define PLAT_CRASH_UART_CLK_IN_HZ	25000000
@@ -128,5 +130,4 @@
 
 #define COUNTER_FREQUENCY		8333333 /* 25MHz / 3 */
 
-#define DEBUG_CONSOLE			0
 #define IMX_WDOG_B_RESET
diff --git a/plat/imx/imx8m/imx8mq/platform.mk b/plat/imx/imx8m/imx8mq/platform.mk
index 7b6df92..901a974 100644
--- a/plat/imx/imx8m/imx8mq/platform.mk
+++ b/plat/imx/imx8m/imx8mq/platform.mk
@@ -38,6 +38,7 @@
 				${XLAT_TABLES_LIB_SRCS}				\
 				${IMX_GIC_SOURCES}
 
+ENABLE_PIE		:=	1
 USE_COHERENT_MEM	:=	1
 RESET_TO_BL31		:=	1
 A53_DISABLE_NON_TEMPORAL_HINT := 0
@@ -52,6 +53,9 @@
 BL32_SIZE		?=	0x2000000
 $(eval $(call add_define,BL32_SIZE))
 
+IMX_BOOT_UART_BASE	?=	0x30860000
+$(eval $(call add_define,IMX_BOOT_UART_BASE))
+
 ifeq (${SPD},trusty)
 	BL31_CFLAGS    +=      -DPLAT_XLAT_TABLES_DYNAMIC=1
 endif
diff --git a/plat/intel/soc/common/drivers/ccu/ncore_ccu.c b/plat/intel/soc/common/drivers/ccu/ncore_ccu.c
index d9a238e..99d48d2 100644
--- a/plat/intel/soc/common/drivers/ccu/ncore_ccu.c
+++ b/plat/intel/soc/common/drivers/ccu/ncore_ccu.c
@@ -40,7 +40,7 @@
 			dir_sf_en = DIRECTORY_UNIT(dir, NCORE_DIRUSFER);
 
 			/* Initialize All Entries */
-			mmio_write_32(dir_sf_mtn, SNOOP_FILTER_ID(dir));
+			mmio_write_32(dir_sf_mtn, SNOOP_FILTER_ID(sf));
 
 			/* Poll Active Bit */
 			ret = poll_active_bit(dir);
@@ -49,8 +49,9 @@
 				return -ETIMEDOUT;
 			}
 
-			/* Snoope Filter Enable */
-			mmio_setbits_32(dir_sf_en, BIT(sf));
+			/* Disable snoop filter, a bit per snoop filter */
+			mmio_clrbits_32(dir_sf_en, BIT(sf));
+
 		}
 	}
 
diff --git a/plat/intel/soc/common/include/socfpga_mailbox.h b/plat/intel/soc/common/include/socfpga_mailbox.h
index 3ab6f52..3abf39d 100644
--- a/plat/intel/soc/common/include/socfpga_mailbox.h
+++ b/plat/intel/soc/common/include/socfpga_mailbox.h
@@ -129,6 +129,10 @@
 #define MBOX_BUSY					-5
 #define MBOX_TIMEOUT					-2047
 
+/* Key Status */
+#define MBOX_RET_SDOS_DECRYPTION_ERROR_102		-258
+#define MBOX_RET_SDOS_DECRYPTION_ERROR_103		-259
+
 /* Reconfig Status Response */
 #define RECONFIG_STATUS_STATE				0
 #define RECONFIG_STATUS_PIN_STATUS			2
diff --git a/plat/intel/soc/common/sip/socfpga_sip_fcs.c b/plat/intel/soc/common/sip/socfpga_sip_fcs.c
index f18c3e4..3b0b370 100644
--- a/plat/intel/soc/common/sip/socfpga_sip_fcs.c
+++ b/plat/intel/soc/common/sip/socfpga_sip_fcs.c
@@ -411,7 +411,10 @@
 				(uint32_t *) &payload, payload_size,
 				CMD_CASUAL, resp_data, &resp_len);
 
-	if (status < 0) {
+	if (status == MBOX_RET_SDOS_DECRYPTION_ERROR_102 ||
+		status == MBOX_RET_SDOS_DECRYPTION_ERROR_103) {
+		*mbox_error = -status;
+	} else if (status < 0) {
 		*mbox_error = -status;
 		return INTEL_SIP_SMC_STATUS_ERROR;
 	}
diff --git a/plat/intel/soc/common/socfpga_sip_svc.c b/plat/intel/soc/common/socfpga_sip_svc.c
index a20e61c..79f743f 100644
--- a/plat/intel/soc/common/socfpga_sip_svc.c
+++ b/plat/intel/soc/common/socfpga_sip_svc.c
@@ -611,7 +611,10 @@
 	*ret_size = resp_len * MBOX_WORD_BYTE;
 	flush_dcache_range(addr, *ret_size);
 
-	if (status != MBOX_RET_OK) {
+	if (status == MBOX_RET_SDOS_DECRYPTION_ERROR_102 ||
+		status == MBOX_RET_SDOS_DECRYPTION_ERROR_103) {
+		*mbox_error = -status;
+	} else if (status != MBOX_RET_OK) {
 		*mbox_error = -status;
 		return INTEL_SIP_SMC_STATUS_ERROR;
 	}
diff --git a/plat/nxp/common/nv_storage/plat_nv_storage.c b/plat/nxp/common/nv_storage/plat_nv_storage.c
index af3b966..97d777e 100644
--- a/plat/nxp/common/nv_storage/plat_nv_storage.c
+++ b/plat/nxp/common/nv_storage/plat_nv_storage.c
@@ -93,7 +93,7 @@
 	uint8_t ready_to_write_val[sizeof(nv_app_data_t)];
 	uintptr_t nv_base_addr = NV_STORAGE_BASE_ADDR;
 
-	assert((nv_base_addr + data_offset + data_size) > (nv_base_addr + F_SECTOR_ERASE_SZ));
+	assert((nv_base_addr + data_offset + data_size) <= (nv_base_addr + F_SECTOR_ERASE_SZ));
 
 	ret = fspi_init(NXP_FLEXSPI_ADDR, NXP_FLEXSPI_FLASH_ADDR);
 
diff --git a/plat/nxp/soc-ls1028a/soc.def b/plat/nxp/soc-ls1028a/soc.def
index c23c1bb..93275b3 100644
--- a/plat/nxp/soc-ls1028a/soc.def
+++ b/plat/nxp/soc-ls1028a/soc.def
@@ -70,8 +70,8 @@
 BL2_HDR_LOC	:=	0x1800A000
 
 # SoC ERRATAS to be enabled
-ERRATA_SOC_A008850	:=	1
 
+# DDR ERRATA
 ERRATA_DDR_A009803	:=	1
 ERRATA_DDR_A009942	:=	1
 ERRATA_DDR_A010165	:=	1
diff --git a/plat/nxp/soc-ls1043a/soc.c b/plat/nxp/soc-ls1043a/soc.c
index 7badf8c..3e821d0 100644
--- a/plat/nxp/soc-ls1043a/soc.c
+++ b/plat/nxp/soc-ls1043a/soc.c
@@ -21,9 +21,7 @@
 #ifdef POLICY_FUSE_PROVISION
 #include <nxp_gpio.h>
 #endif
-#if TRUSTED_BOARD_BOOT
 #include <nxp_smmu.h>
-#endif
 #include <nxp_timer.h>
 #include <plat_console.h>
 #include <plat_gic.h>
@@ -174,6 +172,12 @@
 	get_cluster_info(soc_list, ARRAY_SIZE(soc_list), &num_clusters, &cores_per_cluster);
 	plat_ls_interconnect_enter_coherency(num_clusters);
 
+	/*
+	 * Unlock write access for SMMU SMMU_CBn_ACTLR in all Non-secure contexts.
+	 */
+	smmu_cache_unlock(NXP_SMMU_ADDR);
+	INFO("SMMU Cache Unlocking is Configured.\n");
+
 #if TRUSTED_BOARD_BOOT
 	uint32_t mode;
 
diff --git a/plat/nxp/soc-ls1043a/soc.mk b/plat/nxp/soc-ls1043a/soc.mk
index b6ce14e..0ebb377 100644
--- a/plat/nxp/soc-ls1043a/soc.mk
+++ b/plat/nxp/soc-ls1043a/soc.mk
@@ -19,8 +19,8 @@
 
 # For Security Features
 DISABLE_FUSE_WRITE	:= 1
-ifeq (${TRUSTED_BOARD_BOOT}, 1)
 $(eval $(call SET_NXP_MAKE_FLAG,SMMU_NEEDED,BL2))
+ifeq (${TRUSTED_BOARD_BOOT}, 1)
 $(eval $(call SET_NXP_MAKE_FLAG,SFP_NEEDED,BL2))
 $(eval $(call SET_NXP_MAKE_FLAG,SNVS_NEEDED,BL2))
 SECURE_BOOT	:= yes
diff --git a/plat/nxp/soc-ls1046a/soc.c b/plat/nxp/soc-ls1046a/soc.c
index d17e672..6dfea89 100644
--- a/plat/nxp/soc-ls1046a/soc.c
+++ b/plat/nxp/soc-ls1046a/soc.c
@@ -21,9 +21,7 @@
 #ifdef POLICY_FUSE_PROVISION
 #include <nxp_gpio.h>
 #endif
-#if TRUSTED_BOARD_BOOT
 #include <nxp_smmu.h>
-#endif
 #include <nxp_timer.h>
 #include <plat_console.h>
 #include <plat_gic.h>
@@ -168,6 +166,12 @@
 	get_cluster_info(soc_list, ARRAY_SIZE(soc_list), &num_clusters, &cores_per_cluster);
 	plat_ls_interconnect_enter_coherency(num_clusters);
 
+	/*
+	 * Unlock write access for SMMU SMMU_CBn_ACTLR in all Non-secure contexts.
+	 */
+	smmu_cache_unlock(NXP_SMMU_ADDR);
+	INFO("SMMU Cache Unlocking is Configured.\n");
+
 #if TRUSTED_BOARD_BOOT
 	uint32_t mode;
 
diff --git a/plat/nxp/soc-ls1046a/soc.def b/plat/nxp/soc-ls1046a/soc.def
index e6b37c0..50fc9c9 100644
--- a/plat/nxp/soc-ls1046a/soc.def
+++ b/plat/nxp/soc-ls1046a/soc.def
@@ -41,11 +41,11 @@
 DDRPHY		:=	NXP
 
 # Area of OCRAM reserved by ROM code
-NXP_ROM_RSVD	:= 0x5900
+NXP_ROM_RSVD	:= 0x8000
 
 # Max Size of CSF header. Required to define BL2 TEXT LIMIT in soc.def
 # Input to CST create_hdr_esbc tool
-CSF_HDR_SZ	:= 0x3000
+CSF_HDR_SZ	:= 0x4000
 
 # In IMAGE_BL2, compile time flag for handling Cache coherency
 # with CAAM for BL2 running from OCRAM
diff --git a/plat/nxp/soc-ls1046a/soc.mk b/plat/nxp/soc-ls1046a/soc.mk
index 8207dcd..7644027 100644
--- a/plat/nxp/soc-ls1046a/soc.mk
+++ b/plat/nxp/soc-ls1046a/soc.mk
@@ -19,8 +19,8 @@
 
 # For Security Features
 DISABLE_FUSE_WRITE	:= 1
-ifeq (${TRUSTED_BOARD_BOOT}, 1)
 $(eval $(call SET_NXP_MAKE_FLAG,SMMU_NEEDED,BL2))
+ifeq (${TRUSTED_BOARD_BOOT}, 1)
 $(eval $(call SET_NXP_MAKE_FLAG,SFP_NEEDED,BL2))
 $(eval $(call SET_NXP_MAKE_FLAG,SNVS_NEEDED,BL2))
 SECURE_BOOT	:= yes
diff --git a/plat/nxp/soc-ls1088a/ls1088aqds/ddr_init.c b/plat/nxp/soc-ls1088a/ls1088aqds/ddr_init.c
index b7397ba..705463b 100644
--- a/plat/nxp/soc-ls1088a/ls1088aqds/ddr_init.c
+++ b/plat/nxp/soc-ls1088a/ls1088aqds/ddr_init.c
@@ -78,7 +78,5 @@
 		ERROR("DDR init failed.\n");
 	}
 
-	erratum_a008850_post();
-
 	return dram_size;
 }
diff --git a/plat/nxp/soc-ls1088a/ls1088ardb/ddr_init.c b/plat/nxp/soc-ls1088a/ls1088ardb/ddr_init.c
index c88583f..107871a 100644
--- a/plat/nxp/soc-ls1088a/ls1088ardb/ddr_init.c
+++ b/plat/nxp/soc-ls1088a/ls1088ardb/ddr_init.c
@@ -80,7 +80,5 @@
 		ERROR("DDR init failed.\n");
 	}
 
-	erratum_a008850_post();
-
 	return dram_size;
 }
diff --git a/plat/nxp/soc-ls1088a/soc.c b/plat/nxp/soc-ls1088a/soc.c
index 5f9f313..02d62ea 100644
--- a/plat/nxp/soc-ls1088a/soc.c
+++ b/plat/nxp/soc-ls1088a/soc.c
@@ -17,9 +17,7 @@
 #include <lib/mmio.h>
 #include <lib/xlat_tables/xlat_tables_v2.h>
 #include <ls_interconnect.h>
-#if TRUSTED_BOARD_BOOT
 #include <nxp_smmu.h>
-#endif
 #include <nxp_timer.h>
 #include <plat_console.h>
 #include <plat_gic.h>
@@ -254,6 +252,12 @@
 				MT_DEVICE | MT_RW | MT_NS);
 	}
 
+	/*
+	 * Unlock write access for SMMU SMMU_CBn_ACTLR in all Non-secure contexts.
+	 */
+	smmu_cache_unlock(NXP_SMMU_ADDR);
+	INFO("SMMU Cache Unlocking is Configured.\n");
+
 #if TRUSTED_BOARD_BOOT
 	uint32_t mode;
 
diff --git a/plat/nxp/soc-ls1088a/soc.def b/plat/nxp/soc-ls1088a/soc.def
index 25d0847..17c59ff 100644
--- a/plat/nxp/soc-ls1088a/soc.def
+++ b/plat/nxp/soc-ls1088a/soc.def
@@ -62,7 +62,6 @@
 BL2_BASE		:=	0x1800a000
 
 # SoC ERRATUM to be enabled
-ERRATA_SOC_A008850	:=	1
 
 # ARM Erratum
 ERRATA_A53_855873	:=	1
diff --git a/plat/nxp/soc-ls1088a/soc.mk b/plat/nxp/soc-ls1088a/soc.mk
index 83ac9d0..6e39461 100644
--- a/plat/nxp/soc-ls1088a/soc.mk
+++ b/plat/nxp/soc-ls1088a/soc.mk
@@ -23,12 +23,12 @@
 
 # For Security Features
 DISABLE_FUSE_WRITE	:= 1
+$(eval $(call SET_NXP_MAKE_FLAG,SMMU_NEEDED,BL2))
 ifeq (${TRUSTED_BOARD_BOOT}, 1)
 ifeq (${GENERATE_COT},1)
 # Save Keys to be used by DDR FIP image
 SAVE_KEYS=1
 endif
-$(eval $(call SET_NXP_MAKE_FLAG,SMMU_NEEDED,BL2))
 $(eval $(call SET_NXP_MAKE_FLAG,SFP_NEEDED,BL2))
 $(eval $(call SET_NXP_MAKE_FLAG,SNVS_NEEDED,BL2))
 # Used by create_pbl tool to
diff --git a/plat/nxp/soc-lx2160a/include/soc.h b/plat/nxp/soc-lx2160a/include/soc.h
index 7cc4a03..b781ff8 100644
--- a/plat/nxp/soc-lx2160a/include/soc.h
+++ b/plat/nxp/soc-lx2160a/include/soc.h
@@ -54,8 +54,31 @@
 
 /* SVR Definition (not include major and minor rev) */
 #define SVR_LX2160A		0x873601
+#define SVR_LX2160E		0x873610
+#define SVR_LX2160C		0x873600
+#define SVR_LX2160N		0x873611
 #define SVR_LX2120A		0x873621
+#define SVR_LX2120E		0x873630
+#define SVR_LX2120C		0x873620
+#define SVR_LX2120N		0x873631
 #define SVR_LX2080A		0x873603
+#define SVR_LX2080E		0x873612
+#define SVR_LX2080C		0x873602
+#define SVR_LX2080N		0x873613
+
+/* SVR Definition of SoC LX2162A. */
+#define SVR_LX2162A		0x873609
+#define SVR_LX2162E		0x873618
+#define SVR_LX2162C		0x873608
+#define SVR_LX2162N		0x873619
+#define SVR_LX2122A		0x873629
+#define SVR_LX2122E		0x873638
+#define SVR_LX2122C		0x873628
+#define SVR_LX2122N		0x873639
+#define SVR_LX2082A		0x87360b
+#define SVR_LX2082E		0x87361a
+#define SVR_LX2082C		0x87360a
+#define SVR_LX2082N		0x87361b
 
 /* Number of cores in platform */
 /* Used by common code for array initialization */
diff --git a/plat/nxp/soc-lx2160a/soc.c b/plat/nxp/soc-lx2160a/soc.c
index 2209fda..427189d 100644
--- a/plat/nxp/soc-lx2160a/soc.c
+++ b/plat/nxp/soc-lx2160a/soc.c
@@ -23,9 +23,7 @@
 #ifdef POLICY_FUSE_PROVISION
 #include <nxp_gpio.h>
 #endif
-#if TRUSTED_BOARD_BOOT
 #include <nxp_smmu.h>
-#endif
 #include <nxp_timer.h>
 #include <plat_console.h>
 #include <plat_gic.h>
@@ -37,6 +35,9 @@
 
 #include <errata.h>
 #include <ls_interrupt_mgmt.h>
+#ifdef CONFIG_OCRAM_ECC_EN
+#include <ocram.h>
+#endif
 #include "plat_common.h"
 #ifdef NXP_NV_SW_MAINT_LAST_EXEC_DATA
 #include <plat_nv_storage.h>
@@ -48,9 +49,32 @@
 #include "soc.h"
 
 static struct soc_type soc_list[] =  {
+	/* SoC LX2160A */
 	SOC_ENTRY(LX2160A, LX2160A, 8, 2),
+	SOC_ENTRY(LX2160E, LX2160E, 8, 2),
+	SOC_ENTRY(LX2160C, LX2160C, 8, 2),
+	SOC_ENTRY(LX2160N, LX2160N, 8, 2),
 	SOC_ENTRY(LX2080A, LX2080A, 8, 1),
+	SOC_ENTRY(LX2080E, LX2080E, 8, 1),
+	SOC_ENTRY(LX2080C, LX2080C, 8, 1),
+	SOC_ENTRY(LX2080N, LX2080N, 8, 1),
 	SOC_ENTRY(LX2120A, LX2120A, 6, 2),
+	SOC_ENTRY(LX2120E, LX2120E, 6, 2),
+	SOC_ENTRY(LX2120C, LX2120C, 6, 2),
+	SOC_ENTRY(LX2120N, LX2120N, 6, 2),
+	/* SoC LX2162A */
+	SOC_ENTRY(LX2162A, LX2162A, 8, 2),
+	SOC_ENTRY(LX2162E, LX2162E, 8, 2),
+	SOC_ENTRY(LX2162C, LX2162C, 8, 2),
+	SOC_ENTRY(LX2162N, LX2162N, 8, 2),
+	SOC_ENTRY(LX2082A, LX2082A, 8, 1),
+	SOC_ENTRY(LX2082E, LX2082E, 8, 1),
+	SOC_ENTRY(LX2082C, LX2082C, 8, 1),
+	SOC_ENTRY(LX2082N, LX2082N, 8, 1),
+	SOC_ENTRY(LX2122A, LX2122A, 6, 2),
+	SOC_ENTRY(LX2122E, LX2122E, 6, 2),
+	SOC_ENTRY(LX2122C, LX2122C, 6, 2),
+	SOC_ENTRY(LX2122N, LX2122N, 6, 2),
 };
 
 static dcfg_init_info_t dcfg_init_data = {
@@ -215,6 +239,9 @@
  ******************************************************************************/
 void soc_early_init(void)
 {
+#ifdef CONFIG_OCRAM_ECC_EN
+	ocram_init(NXP_OCRAM_ADDR, NXP_OCRAM_SIZE);
+#endif
 	dcfg_init(&dcfg_init_data);
 #ifdef POLICY_FUSE_PROVISION
 	gpio_init(&gpio_init_data);
@@ -257,6 +284,12 @@
 	sfp_init(NXP_SFP_ADDR);
 #endif
 
+	/*
+	 * Unlock write access for SMMU SMMU_CBn_ACTLR in all Non-secure contexts.
+	 */
+	smmu_cache_unlock(NXP_SMMU_ADDR);
+	INFO("SMMU Cache Unlocking is Configured.\n");
+
 #if TRUSTED_BOARD_BOOT
 	uint32_t mode;
 
@@ -451,8 +484,8 @@
 
 	/* low-level init of the soc */
 	soc_init_start();
-	soc_init_percpu();
 	_init_global_data();
+	soc_init_percpu();
 	_initialize_psci();
 
 	if (ccn_get_part0_id(NXP_CCN_ADDR) != CCN_508_PART0_ID) {
diff --git a/plat/nxp/soc-lx2160a/soc.def b/plat/nxp/soc-lx2160a/soc.def
index 81d6744..0442962 100644
--- a/plat/nxp/soc-lx2160a/soc.def
+++ b/plat/nxp/soc-lx2160a/soc.def
@@ -114,3 +114,6 @@
 
 # enable dynamic memory mapping
 PLAT_XLAT_TABLES_DYNAMIC :=	1
+
+# OCRAM ECC Enabled
+OCRAM_ECC_EN            :=      yes
diff --git a/plat/nxp/soc-lx2160a/soc.mk b/plat/nxp/soc-lx2160a/soc.mk
index 75a3af2..239442c 100644
--- a/plat/nxp/soc-lx2160a/soc.mk
+++ b/plat/nxp/soc-lx2160a/soc.mk
@@ -36,12 +36,12 @@
 
  # For Security Features
 DISABLE_FUSE_WRITE	:= 1
+$(eval $(call SET_NXP_MAKE_FLAG,SMMU_NEEDED,BL2))
 ifeq (${TRUSTED_BOARD_BOOT}, 1)
 ifeq (${GENERATE_COT},1)
 # Save Keys to be used by DDR FIP image
 SAVE_KEYS=1
 endif
-$(eval $(call SET_NXP_MAKE_FLAG,SMMU_NEEDED,BL2))
 $(eval $(call SET_NXP_MAKE_FLAG,SFP_NEEDED,BL2))
 $(eval $(call SET_NXP_MAKE_FLAG,SNVS_NEEDED,BL2))
 # Used by create_pbl tool to
diff --git a/plat/qemu/common/qemu_bl2_mem_params_desc.c b/plat/qemu/common/qemu_bl2_mem_params_desc.c
index 5af3a22..bb1797d 100644
--- a/plat/qemu/common/qemu_bl2_mem_params_desc.c
+++ b/plat/qemu/common/qemu_bl2_mem_params_desc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017-2021, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2017-2022, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -9,6 +9,18 @@
 #include <common/desc_image_load.h>
 #include <plat/common/platform.h>
 
+#define SP_PKG_ENTRY(id) \
+	{ \
+		.image_id = (id), \
+		SET_STATIC_PARAM_HEAD(ep_info, PARAM_IMAGE_BINARY, VERSION_2, \
+				      entry_point_info_t, \
+				      SECURE | NON_EXECUTABLE), \
+		SET_STATIC_PARAM_HEAD(image_info, PARAM_IMAGE_BINARY, \
+				      VERSION_2, image_info_t, \
+				      IMAGE_ATTRIB_SKIP_LOADING), \
+		.next_handoff_image_id = INVALID_IMAGE_ID, \
+	}
+
 /*******************************************************************************
  * Following descriptor provides BL image/ep information that gets used
  * by BL2 to load the images and also subset of this information is
@@ -122,6 +134,48 @@
 #endif
 	   .next_handoff_image_id = INVALID_IMAGE_ID,
 	},
+
+#if defined(SPD_spmd)
+	/* Fill TOS_FW_CONFIG related information */
+	{
+	    .image_id = TOS_FW_CONFIG_ID,
+	    SET_STATIC_PARAM_HEAD(ep_info, PARAM_IMAGE_BINARY,
+		    VERSION_2, entry_point_info_t, SECURE | NON_EXECUTABLE),
+	    SET_STATIC_PARAM_HEAD(image_info, PARAM_IMAGE_BINARY,
+		    VERSION_2, image_info_t, 0),
+	    .image_info.image_base = TOS_FW_CONFIG_BASE,
+	    .image_info.image_max_size = TOS_FW_CONFIG_LIMIT -
+					 TOS_FW_CONFIG_BASE,
+	    .next_handoff_image_id = INVALID_IMAGE_ID,
+	},
+
+#if SPMD_SPM_AT_SEL2
+	/* Fill TB_FW_CONFIG related information */
+	{
+	    .image_id = TB_FW_CONFIG_ID,
+	    SET_STATIC_PARAM_HEAD(ep_info, PARAM_IMAGE_BINARY,
+		    VERSION_2, entry_point_info_t, SECURE | NON_EXECUTABLE),
+	    SET_STATIC_PARAM_HEAD(image_info, PARAM_IMAGE_BINARY,
+		    VERSION_2, image_info_t, 0),
+	    .image_info.image_base = TB_FW_CONFIG_BASE,
+	    .image_info.image_max_size = TB_FW_CONFIG_LIMIT - TB_FW_CONFIG_BASE,
+	    .next_handoff_image_id = INVALID_IMAGE_ID,
+	},
+
+	/*
+	 * Empty entries for SP packages to be filled in according to
+	 * TB_FW_CONFIG.
+	 */
+	SP_PKG_ENTRY(SP_PKG1_ID),
+	SP_PKG_ENTRY(SP_PKG2_ID),
+	SP_PKG_ENTRY(SP_PKG3_ID),
+	SP_PKG_ENTRY(SP_PKG4_ID),
+	SP_PKG_ENTRY(SP_PKG5_ID),
+	SP_PKG_ENTRY(SP_PKG6_ID),
+	SP_PKG_ENTRY(SP_PKG7_ID),
+	SP_PKG_ENTRY(SP_PKG8_ID),
+#endif
+#endif
 # endif /* QEMU_LOAD_BL32 */
 
 	/* Fill BL33 related information */
diff --git a/plat/qemu/common/qemu_bl2_setup.c b/plat/qemu/common/qemu_bl2_setup.c
index 2c0da15..be55877 100644
--- a/plat/qemu/common/qemu_bl2_setup.c
+++ b/plat/qemu/common/qemu_bl2_setup.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2021, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2022, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -16,6 +16,7 @@
 #include <common/debug.h>
 #include <common/desc_image_load.h>
 #include <common/fdt_fixup.h>
+#include <common/fdt_wrappers.h>
 #include <lib/optee_utils.h>
 #include <lib/utils.h>
 #include <plat/common/platform.h>
@@ -140,6 +141,48 @@
 	return spsr;
 }
 
+#if defined(SPD_spmd) && SPMD_SPM_AT_SEL2
+static int load_sps_from_tb_fw_config(struct image_info *image_info)
+{
+	void *dtb = (void *)image_info->image_base;
+	const char *compat_str = "arm,sp";
+	const struct fdt_property *uuid;
+	uint32_t load_addr;
+	const char *name;
+	int sp_node;
+	int node;
+
+	node = fdt_node_offset_by_compatible(dtb, -1, compat_str);
+	if (node < 0) {
+		ERROR("Can't find %s in TB_FW_CONFIG", compat_str);
+		return -1;
+	}
+
+	fdt_for_each_subnode(sp_node, dtb, node) {
+		name = fdt_get_name(dtb, sp_node, NULL);
+		if (name == NULL) {
+			ERROR("Can't get name of node in dtb\n");
+			return -1;
+		}
+		uuid = fdt_get_property(dtb, sp_node, "uuid", NULL);
+		if (uuid == NULL) {
+			ERROR("Can't find property uuid in node %s", name);
+			return -1;
+		}
+		if (fdt_read_uint32(dtb, sp_node, "load-address",
+				    &load_addr) < 0) {
+			ERROR("Can't read load-address in node %s", name);
+			return -1;
+		}
+		if (qemu_io_register_sp_pkg(name, uuid->data, load_addr) < 0) {
+			return -1;
+		}
+	}
+
+	return 0;
+}
+#endif /*defined(SPD_spmd) && SPMD_SPM_AT_SEL2*/
+
 static int qemu_bl2_handle_post_image_load(unsigned int image_id)
 {
 	int err = 0;
@@ -149,8 +192,7 @@
 	bl_mem_params_node_t *paged_mem_params = NULL;
 #endif
 #if defined(SPD_spmd)
-	unsigned int mode_rw = MODE_RW_64;
-	uint64_t pagable_part = 0;
+	bl_mem_params_node_t *bl32_mem_params = NULL;
 #endif
 
 	assert(bl_mem_params);
@@ -170,17 +212,18 @@
 		if (err != 0) {
 			WARN("OPTEE header parse error.\n");
 		}
-#if defined(SPD_spmd)
-		mode_rw = bl_mem_params->ep_info.args.arg0;
-		pagable_part = bl_mem_params->ep_info.args.arg1;
-#endif
 #endif
 
-#if defined(SPD_spmd)
-		bl_mem_params->ep_info.args.arg0 = ARM_PRELOADED_DTB_BASE;
-		bl_mem_params->ep_info.args.arg1 = pagable_part;
-		bl_mem_params->ep_info.args.arg2 = mode_rw;
-		bl_mem_params->ep_info.args.arg3 = 0;
+#if defined(SPMC_OPTEE)
+		/*
+		 * Explicit zeroes to unused registers since they may have
+		 * been populated by parse_optee_header() above.
+		 *
+		 * OP-TEE expects system DTB in x2 and TOS_FW_CONFIG in x0,
+		 * the latter is filled in below for TOS_FW_CONFIG_ID and
+		 * applies to any other SPMC too.
+		 */
+		bl_mem_params->ep_info.args.arg2 = ARM_PRELOADED_DTB_BASE;
 #elif defined(SPD_opteed)
 		/*
 		 * OP-TEE expect to receive DTB address in x2.
@@ -224,6 +267,19 @@
 
 		bl_mem_params->ep_info.spsr = qemu_get_spsr_for_bl33_entry();
 		break;
+#ifdef SPD_spmd
+#if SPMD_SPM_AT_SEL2
+	case TB_FW_CONFIG_ID:
+		err = load_sps_from_tb_fw_config(&bl_mem_params->image_info);
+		break;
+#endif
+	case TOS_FW_CONFIG_ID:
+		/* An SPMC expects TOS_FW_CONFIG in x0/r0 */
+		bl32_mem_params = get_bl_mem_params_node(BL32_IMAGE_ID);
+		bl32_mem_params->ep_info.args.arg0 =
+					bl_mem_params->image_info.image_base;
+		break;
+#endif
 	default:
 		/* Do nothing in default case */
 		break;
diff --git a/plat/qemu/common/qemu_common.c b/plat/qemu/common/qemu_common.c
index 0c184f4..23ac581 100644
--- a/plat/qemu/common/qemu_common.c
+++ b/plat/qemu/common/qemu_common.c
@@ -10,6 +10,7 @@
 #include <arch_helpers.h>
 #include <common/bl_common.h>
 #include <lib/xlat_tables/xlat_tables_v2.h>
+#include <services/el3_spmc_ffa_memory.h>
 
 #include <plat/common/platform.h>
 #include "qemu_private.h"
@@ -100,7 +101,7 @@
 #if SPM_MM
 	MAP_NS_DRAM0,
 	QEMU_SPM_BUF_EL3_MMAP,
-#else
+#elif !SPMC_AT_EL3
 	MAP_BL32_MEM,
 #endif
 	{0}
@@ -167,3 +168,30 @@
 	return get_mbedtls_heap_helper(heap_addr, heap_size);
 }
 #endif
+
+#if SPMC_AT_EL3
+/*
+ * When using the EL3 SPMC implementation allocate the datastore
+ * for tracking shared memory descriptors in normal memory.
+ */
+#define PLAT_SPMC_SHMEM_DATASTORE_SIZE 64 * 1024
+
+uint8_t plat_spmc_shmem_datastore[PLAT_SPMC_SHMEM_DATASTORE_SIZE];
+
+int plat_spmc_shmem_datastore_get(uint8_t **datastore, size_t *size)
+{
+	*datastore = plat_spmc_shmem_datastore;
+	*size = PLAT_SPMC_SHMEM_DATASTORE_SIZE;
+	return 0;
+}
+
+int plat_spmc_shmem_begin(struct ffa_mtd *desc)
+{
+	return 0;
+}
+
+int plat_spmc_shmem_reclaim(struct ffa_mtd *desc)
+{
+	return 0;
+}
+#endif
diff --git a/plat/qemu/common/qemu_io_storage.c b/plat/qemu/common/qemu_io_storage.c
index 1107e44..4c61b14 100644
--- a/plat/qemu/common/qemu_io_storage.c
+++ b/plat/qemu/common/qemu_io_storage.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2016, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2022, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -11,6 +11,8 @@
 
 #include <common/bl_common.h>
 #include <common/debug.h>
+#include <common/desc_image_load.h>
+#include <common/uuid.h>
 #include <drivers/io/io_driver.h>
 #include <drivers/io/io_encrypted.h>
 #include <drivers/io/io_fip.h>
@@ -20,10 +22,14 @@
 #include <lib/semihosting.h>
 #include <tools_share/firmware_image_package.h>
 
+#include "qemu_private.h"
+
 /* Semihosting filenames */
 #define BL2_IMAGE_NAME			"bl2.bin"
 #define BL31_IMAGE_NAME			"bl31.bin"
 #define BL32_IMAGE_NAME			"bl32.bin"
+#define TB_FW_CONFIG_NAME		"tb_fw_config.dtb"
+#define TOS_FW_CONFIG_NAME		"tos_fw_config.dtb"
 #define BL32_EXTRA1_IMAGE_NAME		"bl32_extra1.bin"
 #define BL32_EXTRA2_IMAGE_NAME		"bl32_extra2.bin"
 #define BL33_IMAGE_NAME			"bl33.bin"
@@ -78,6 +84,14 @@
 	.uuid = UUID_SECURE_PAYLOAD_BL32_EXTRA2,
 };
 
+static const io_uuid_spec_t tb_fw_config_uuid_spec = {
+	.uuid = UUID_TB_FW_CONFIG,
+};
+
+static const io_uuid_spec_t tos_fw_config_uuid_spec = {
+	.uuid = UUID_TOS_FW_CONFIG,
+};
+
 static const io_uuid_spec_t bl33_uuid_spec = {
 	.uuid = UUID_NON_TRUSTED_FIRMWARE_BL33,
 };
@@ -137,6 +151,14 @@
 		.path = BL32_EXTRA2_IMAGE_NAME,
 		.mode = FOPEN_MODE_RB
 	},
+	[TB_FW_CONFIG_ID] = {
+		.path = TB_FW_CONFIG_NAME,
+		.mode = FOPEN_MODE_RB
+	},
+	[TOS_FW_CONFIG_ID] = {
+		.path = TOS_FW_CONFIG_NAME,
+		.mode = FOPEN_MODE_RB
+	},
 	[BL33_IMAGE_ID] = {
 		.path = BL33_IMAGE_NAME,
 		.mode = FOPEN_MODE_RB
@@ -252,6 +274,16 @@
 		open_fip
 	},
 #endif
+	[TB_FW_CONFIG_ID] = {
+		&fip_dev_handle,
+		(uintptr_t)&tb_fw_config_uuid_spec,
+		open_fip
+	},
+	[TOS_FW_CONFIG_ID] = {
+		&fip_dev_handle,
+		(uintptr_t)&tos_fw_config_uuid_spec,
+		open_fip
+	},
 	[BL33_IMAGE_ID] = {
 		&fip_dev_handle,
 		(uintptr_t)&bl33_uuid_spec,
@@ -301,6 +333,80 @@
 #endif /* TRUSTED_BOARD_BOOT */
 };
 
+#if defined(SPD_spmd)
+static struct sp_pkg {
+	struct plat_io_policy policy;
+	io_file_spec_t sh_file_spec;
+	uint8_t uuid[UUID_BYTES_LENGTH];
+	char path[80];
+} sp_pkgs[MAX_SP_IDS];
+static unsigned int sp_pkg_count;
+
+int qemu_io_register_sp_pkg(const char *name, const char *uuid,
+			    uintptr_t load_addr)
+{
+	struct sp_pkg *pkg;
+	bl_mem_params_node_t *mem_params;
+
+	if (sp_pkg_count == MAX_SP_IDS) {
+		INFO("Reached Max number of SPs\n");
+		return -1;
+	}
+	mem_params = get_bl_mem_params_node(SP_PKG1_ID + sp_pkg_count);
+	if (mem_params == NULL) {
+		ERROR("Can't find SP_PKG ID %u (SP_PKG%u_ID)\n",
+		      SP_PKG1_ID + sp_pkg_count, sp_pkg_count);
+		return -1;
+	}
+	pkg = sp_pkgs + sp_pkg_count;
+
+	if (read_uuid(pkg->uuid, (char *)uuid)) {
+		return -1;
+	}
+
+	strlcpy(pkg->path, name, sizeof(pkg->path));
+	strlcat(pkg->path, ".pkg", sizeof(pkg->path));
+
+	pkg->policy.dev_handle = &fip_dev_handle;
+	pkg->policy.image_spec = (uintptr_t)&pkg->uuid;
+	pkg->policy.check = open_fip;
+	pkg->sh_file_spec.path = pkg->path;
+	pkg->sh_file_spec.mode = FOPEN_MODE_RB;
+
+	mem_params->image_info.image_base = load_addr;
+	mem_params->image_info.image_max_size = SZ_4M;
+	mem_params->image_info.h.attr &= ~IMAGE_ATTRIB_SKIP_LOADING;
+
+	sp_pkg_count++;
+
+	return 0;
+}
+#endif /*SPD_spmd*/
+
+static const io_file_spec_t *get_io_file_spec(unsigned int image_id)
+{
+#if defined(SPD_spmd)
+	if (image_id >= SP_PKG1_ID && image_id <= SP_PKG8_ID) {
+		return &sp_pkgs[image_id - SP_PKG1_ID].sh_file_spec;
+	}
+#endif
+
+	assert(image_id < ARRAY_SIZE(sh_file_spec));
+	return &sh_file_spec[image_id];
+}
+
+static const struct plat_io_policy *get_io_policy(unsigned int image_id)
+{
+#if defined(SPD_spmd)
+	if (image_id >= SP_PKG1_ID && image_id <= SP_PKG8_ID) {
+		return &sp_pkgs[image_id - SP_PKG1_ID].policy;
+	}
+#endif
+
+	assert(image_id < ARRAY_SIZE(policies));
+	return &policies[image_id];
+}
+
 static int open_fip(const uintptr_t spec)
 {
 	int result;
@@ -413,11 +519,13 @@
 static int get_alt_image_source(unsigned int image_id, uintptr_t *dev_handle,
 				  uintptr_t *image_spec)
 {
-	int result = open_semihosting((const uintptr_t)&sh_file_spec[image_id]);
+	const io_file_spec_t *spec = get_io_file_spec(image_id);
+	int result;
 
+	result = open_semihosting((const uintptr_t)spec);
 	if (result == 0) {
 		*dev_handle = sh_dev_handle;
-		*image_spec = (uintptr_t)&sh_file_spec[image_id];
+		*image_spec = (uintptr_t)spec;
 	}
 
 	return result;
@@ -430,12 +538,9 @@
 int plat_get_image_source(unsigned int image_id, uintptr_t *dev_handle,
 			  uintptr_t *image_spec)
 {
+	const struct plat_io_policy *policy = get_io_policy(image_id);
 	int result;
-	const struct plat_io_policy *policy;
-
-	assert(image_id < ARRAY_SIZE(policies));
 
-	policy = &policies[image_id];
 	result = policy->check(policy->image_spec);
 	if (result == 0) {
 		*image_spec = policy->image_spec;
diff --git a/plat/qemu/common/qemu_private.h b/plat/qemu/common/qemu_private.h
index c313cb6..159c44f 100644
--- a/plat/qemu/common/qemu_private.h
+++ b/plat/qemu/common/qemu_private.h
@@ -26,6 +26,8 @@
 			unsigned long coh_start, unsigned long coh_limit);
 
 void plat_qemu_io_setup(void);
+int qemu_io_register_sp_pkg(const char *name, const char *uuid,
+			    uintptr_t load_addr);
 unsigned int plat_qemu_calc_core_pos(u_register_t mpidr);
 
 void qemu_console_init(void);
diff --git a/plat/qemu/common/qemu_spmd_manifest.c b/plat/qemu/common/qemu_spmd_manifest.c
deleted file mode 100644
index fd46e26..0000000
--- a/plat/qemu/common/qemu_spmd_manifest.c
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Copyright (c) 2021, ARM Limited and Contributors. All rights reserved.
- *
- * SPDX-License-Identifier: BSD-3-Clause
- */
-
-#include <assert.h>
-
-#include <services/spm_core_manifest.h>
-
-#include <plat/common/platform.h>
-#include <platform_def.h>
-
-int plat_spm_core_manifest_load(spmc_manifest_attribute_t *manifest,
-				const void *pm_addr)
-{
-	entry_point_info_t *ep_info = bl31_plat_get_next_image_ep_info(SECURE);
-
-	assert(ep_info != NULL);
-	assert(manifest != NULL);
-
-	manifest->major_version = 1;
-	manifest->minor_version = 0;
-	manifest->exec_state = ep_info->args.arg2;
-	manifest->load_address = BL32_BASE;
-	manifest->entrypoint = BL32_BASE;
-	manifest->binary_size = BL32_LIMIT - BL32_BASE;
-	manifest->spmc_id = 0x8000;
-
-	return 0;
-}
diff --git a/plat/qemu/qemu/include/platform_def.h b/plat/qemu/qemu/include/platform_def.h
index a22fbe5..803f8e2 100644
--- a/plat/qemu/qemu/include/platform_def.h
+++ b/plat/qemu/qemu/include/platform_def.h
@@ -118,6 +118,11 @@
 #define BL_RAM_BASE			(SHARED_RAM_BASE + SHARED_RAM_SIZE)
 #define BL_RAM_SIZE			(SEC_SRAM_SIZE - SHARED_RAM_SIZE)
 
+#define TB_FW_CONFIG_BASE		BL_RAM_BASE
+#define TB_FW_CONFIG_LIMIT		(TB_FW_CONFIG_BASE + PAGE_SIZE)
+#define TOS_FW_CONFIG_BASE		TB_FW_CONFIG_LIMIT
+#define TOS_FW_CONFIG_LIMIT		(TOS_FW_CONFIG_BASE + PAGE_SIZE)
+
 /*
  * BL1 specific defines.
  *
@@ -183,8 +188,8 @@
 
 #define PLAT_PHY_ADDR_SPACE_SIZE	(1ULL << 32)
 #define PLAT_VIRT_ADDR_SPACE_SIZE	(1ULL << 32)
-#define MAX_MMAP_REGIONS		11
-#define MAX_XLAT_TABLES			6
+#define MAX_MMAP_REGIONS		(11 + MAX_MMAP_REGIONS_SPMC)
+#define MAX_XLAT_TABLES			(6 + MAX_XLAT_TABLES_SPMC)
 #define MAX_IO_DEVICES			4
 #define MAX_IO_HANDLES			4
 
@@ -275,4 +280,32 @@
  */
 #define	PLAT_EVENT_LOG_MAX_SIZE		UL(0x400)
 
+#if SPMC_AT_EL3
+/*
+ * Number of Secure Partitions supported.
+ * SPMC at EL3, uses this count to configure the maximum number of
+ * supported secure partitions.
+ */
+#define SECURE_PARTITION_COUNT		1
+
+/*
+ * Number of Logical Partitions supported.
+ * SPMC at EL3, uses this count to configure the maximum number of
+ * supported logical partitions.
+ */
+#define MAX_EL3_LP_DESCS_COUNT		0
+
+/*
+ * Number of Normal World Partitions supported.
+ * SPMC at EL3, uses this count to configure the maximum number of
+ * supported normal world partitions.
+ */
+#define NS_PARTITION_COUNT		1
+
+#define MAX_MMAP_REGIONS_SPMC		2
+#define MAX_XLAT_TABLES_SPMC		4
+#else
+#define MAX_MMAP_REGIONS_SPMC		0
+#define MAX_XLAT_TABLES_SPMC		0
+#endif
 #endif /* PLATFORM_DEF_H */
diff --git a/plat/qemu/qemu/platform.mk b/plat/qemu/qemu/platform.mk
index 2cf2b9a..4cbce9d 100644
--- a/plat/qemu/qemu/platform.mk
+++ b/plat/qemu/qemu/platform.mk
@@ -161,7 +161,8 @@
 				${PLAT_QEMU_COMMON_PATH}/qemu_image_load.c		\
 				common/fdt_fixup.c					\
 				common/fdt_wrappers.c					\
-				common/desc_image_load.c
+				common/desc_image_load.c				\
+				common/uuid.c
 
 ifeq ($(add-lib-optee),yes)
 BL2_SOURCES		+=	lib/optee/optee_utils.c
@@ -217,7 +218,10 @@
 endif
 
 ifeq (${SPD},spmd)
-BL31_SOURCES		+=	plat/qemu/common/qemu_spmd_manifest.c
+BL31_SOURCES		+=	plat/common/plat_spmd_manifest.c	\
+				common/uuid.c				\
+				${LIBFDT_SRCS} 				\
+				${FDT_WRAPPERS_SOURCES}
 endif
 endif
 
@@ -238,6 +242,20 @@
 endif
 endif
 
+ifneq ($(QEMU_TB_FW_CONFIG_DTS),)
+FDT_SOURCES		+=	${QEMU_TB_FW_CONFIG_DTS}
+QEMU_TB_FW_CONFIG	:=	${BUILD_PLAT}/fdts/$(notdir $(basename ${QEMU_TB_FW_CONFIG_DTS})).dtb
+# Add the TB_FW_CONFIG to FIP
+$(eval $(call TOOL_ADD_PAYLOAD,${QEMU_TB_FW_CONFIG},--tb-fw-config,${QEMU_TB_FW_CONFIG}))
+endif
+
+ifneq ($(QEMU_TOS_FW_CONFIG_DTS),)
+FDT_SOURCES		+=	${QEMU_TOS_FW_CONFIG_DTS}
+QEMU_TOS_FW_CONFIG	:=	${BUILD_PLAT}/fdts/$(notdir $(basename ${QEMU_TOS_FW_CONFIG_DTS})).dtb
+# Add the TOS_FW_CONFIG to FIP
+$(eval $(call TOOL_ADD_PAYLOAD,${QEMU_TOS_FW_CONFIG},--tos-fw-config,${QEMU_TOS_FW_CONFIG}))
+endif
+
 SEPARATE_CODE_AND_RODATA := 1
 ENABLE_STACK_PROTECTOR	 := 0
 ifneq ($(ENABLE_STACK_PROTECTOR), 0)
diff --git a/plat/qemu/qemu_sbsa/platform.mk b/plat/qemu/qemu_sbsa/platform.mk
index 5a6b1e1..2393b39 100644
--- a/plat/qemu/qemu_sbsa/platform.mk
+++ b/plat/qemu/qemu_sbsa/platform.mk
@@ -123,5 +123,6 @@
 ARM_PRELOADED_DTB_BASE := PLAT_QEMU_DT_BASE
 $(eval $(call add_define,ARM_PRELOADED_DTB_BASE))
 
-# Do not enable SVE
-ENABLE_SVE_FOR_NS	:= 0
+# Later QEMU versions support SME and SVE.
+ENABLE_SVE_FOR_NS	:= 1
+ENABLE_SME_FOR_NS	:= 1
diff --git a/plat/xilinx/common/ipi_mailbox_service/ipi_mailbox_svc.c b/plat/xilinx/common/ipi_mailbox_service/ipi_mailbox_svc.c
index 30b0176..8438aba 100644
--- a/plat/xilinx/common/ipi_mailbox_service/ipi_mailbox_svc.c
+++ b/plat/xilinx/common/ipi_mailbox_service/ipi_mailbox_svc.c
@@ -74,8 +74,12 @@
 	ipi_local_id = x1 & UNSIGNED32_MASK;
 	ipi_remote_id = x2 & UNSIGNED32_MASK;
 
-	if ((GET_SMC_OEN(smc_fid) >= OEN_TAP_START) &&
-	    (GET_SMC_OEN(smc_fid) <= OEN_TOS_END)) {
+	/* OEN Number 48 to 63 is for Trusted App and OS
+	 * GET_SMC_OEN limits the return value of OEN number to 63 by bitwise
+	 * AND operation with 0x3F.
+	 * Upper limit check for OEN value is not required.
+	 */
+	if (GET_SMC_OEN(smc_fid) >= OEN_TAP_START) {
 		is_secure = 1;
 	} else {
 		is_secure = 0;
diff --git a/services/std_svc/spm/el3_spmc/spmc.h b/services/std_svc/spm/el3_spmc/spmc.h
index 5233650..61afee3 100644
--- a/services/std_svc/spm/el3_spmc/spmc.h
+++ b/services/std_svc/spm/el3_spmc/spmc.h
@@ -228,6 +228,12 @@
 	uint32_t uuid[4];
 };
 
+/* FF-A Partition Info Get related macros. */
+#define FFA_PARTITION_INFO_GET_PROPERTIES_V1_0_MASK	U(0x7)
+#define FFA_PARTITION_INFO_GET_EXEC_STATE_SHIFT 	U(8)
+#define FFA_PARTITION_INFO_GET_AARCH32_STATE 		U(0)
+#define FFA_PARTITION_INFO_GET_AARCH64_STATE 		U(1)
+
 /* Reference to power management hooks */
 extern const spd_pm_ops_t spmc_pm;
 
diff --git a/services/std_svc/spm/el3_spmc/spmc.mk b/services/std_svc/spm/el3_spmc/spmc.mk
index c674e71..6442af0 100644
--- a/services/std_svc/spm/el3_spmc/spmc.mk
+++ b/services/std_svc/spm/el3_spmc/spmc.mk
@@ -20,7 +20,9 @@
                     ${PLAT}_el3_spmc_logical_sp.c)
 
 
+ifneq ($(wildcard $(SPMC_LP_SOURCES)),)
 SPMC_SOURCES += $(SPMC_LP_SOURCES)
+endif
 
 # Let the top-level Makefile know that we intend to include a BL32 image
 NEED_BL32		:=	yes
diff --git a/services/std_svc/spm/el3_spmc/spmc_main.c b/services/std_svc/spm/el3_spmc/spmc_main.c
index 9b8621a..08e7218 100644
--- a/services/std_svc/spm/el3_spmc/spmc_main.c
+++ b/services/std_svc/spm/el3_spmc/spmc_main.c
@@ -746,6 +746,27 @@
 }
 
 /*
+ * Helper function to populate the properties field of a Partition Info Get
+ * descriptor.
+ */
+static uint32_t
+partition_info_get_populate_properties(uint32_t sp_properties,
+				       enum sp_execution_state sp_ec_state)
+{
+	uint32_t properties = sp_properties;
+	uint32_t ec_state;
+
+	/* Determine the execution state of the SP. */
+	ec_state = sp_ec_state == SP_STATE_AARCH64 ?
+		   FFA_PARTITION_INFO_GET_AARCH64_STATE :
+		   FFA_PARTITION_INFO_GET_AARCH32_STATE;
+
+	properties |= ec_state << FFA_PARTITION_INFO_GET_EXEC_STATE_SHIFT;
+
+	return properties;
+}
+
+/*
  * Collate the partition information in a v1.1 partition information
  * descriptor format, this will be converter later if required.
  */
@@ -771,7 +792,12 @@
 			desc = &partitions[*partition_count];
 			desc->ep_id = el3_lp_descs[index].sp_id;
 			desc->execution_ctx_count = PLATFORM_CORE_COUNT;
-			desc->properties = el3_lp_descs[index].properties;
+			/* LSPs must be AArch64. */
+			desc->properties =
+				partition_info_get_populate_properties(
+					el3_lp_descs[index].properties,
+					SP_STATE_AARCH64);
+
 			if (null_uuid) {
 				copy_uuid(desc->uuid, el3_lp_descs[index].uuid);
 			}
@@ -794,7 +820,11 @@
 			 * S-EL1 SPs.
 			 */
 			desc->execution_ctx_count = PLATFORM_CORE_COUNT;
-			desc->properties = sp_desc[index].properties;
+			desc->properties =
+				partition_info_get_populate_properties(
+					sp_desc[index].properties,
+					sp_desc[index].execution_state);
+
 			if (null_uuid) {
 				copy_uuid(desc->uuid, sp_desc[index].uuid);
 			}
@@ -835,7 +865,7 @@
 
 /*
  * If the caller of the PARTITION_INFO_GET ABI was a v1.0 caller, populate
- * the coresponding descriptor format from the v1.1 descriptor array.
+ * the corresponding descriptor format from the v1.1 descriptor array.
  */
 static uint64_t partition_info_populate_v1_0(struct ffa_partition_info_v1_1
 					     *partitions,
@@ -860,8 +890,10 @@
 		v1_0_partitions[index].ep_id = partitions[index].ep_id;
 		v1_0_partitions[index].execution_ctx_count =
 			partitions[index].execution_ctx_count;
+		/* Only report v1.0 properties. */
 		v1_0_partitions[index].properties =
-			partitions[index].properties;
+			(partitions[index].properties &
+			FFA_PARTITION_INFO_GET_PROPERTIES_V1_0_MASK);
 	}
 	return 0;
 }
diff --git a/services/std_svc/spm/el3_spmc/spmc_shared_mem.c b/services/std_svc/spm/el3_spmc/spmc_shared_mem.c
index 89d7b31..c039350 100644
--- a/services/std_svc/spm/el3_spmc/spmc_shared_mem.c
+++ b/services/std_svc/spm/el3_spmc/spmc_shared_mem.c
@@ -274,13 +274,15 @@
  * spmc_shmem_obj_validate_id - Validate a partition ID is participating in
  *				a given memory transaction.
  * @sp_id:      Partition ID to validate.
- * @desc:       Descriptor of the memory transaction.
- *
+ * @obj:        The shared memory object containing the descriptor
+ *              of the memory transaction.
  * Return: true if ID is valid, else false.
  */
-bool spmc_shmem_obj_validate_id(const struct ffa_mtd *desc, uint16_t sp_id)
+bool spmc_shmem_obj_validate_id(struct spmc_shmem_obj *obj, uint16_t sp_id)
 {
 	bool found = false;
+	struct ffa_mtd *desc = &obj->desc;
+	size_t desc_size = obj->desc_size;
 
 	/* Validate the partition is a valid participant. */
 	for (unsigned int i = 0U; i < desc->emad_count; i++) {
@@ -290,6 +292,15 @@
 		emad = spmc_shmem_obj_get_emad(desc, i,
 					       MAKE_FFA_VERSION(1, 1),
 					       &emad_size);
+		/*
+		 * Validate the calculated emad address resides within the
+		 * descriptor.
+		 */
+		if ((emad == NULL) || (uintptr_t) emad >=
+		    (uintptr_t)((uint8_t *) desc + desc_size)) {
+			VERBOSE("Invalid emad.\n");
+			break;
+		}
 		if (sp_id == emad->mapd.endpoint_id) {
 			found = true;
 			break;
@@ -385,7 +396,8 @@
 	      emad_array[0].comp_mrd_offset);
 
 	/* Check the calculated address is within the memory descriptor. */
-	if ((uintptr_t) mrd >= (uintptr_t)((uint8_t *) orig + desc_size)) {
+	if (((uintptr_t) mrd + sizeof(struct ffa_comp_mrd)) >
+	    (uintptr_t)((uint8_t *) orig + desc_size)) {
 		return 0;
 	}
 	size += mrd->address_range_count * sizeof(struct ffa_cons_mrd);
@@ -424,7 +436,8 @@
 	      emad_array[0].comp_mrd_offset);
 
 	/* Check the calculated address is within the memory descriptor. */
-	if ((uintptr_t) mrd >= (uintptr_t)((uint8_t *) orig + desc_size)) {
+	if (((uintptr_t) mrd + sizeof(struct ffa_comp_mrd)) >
+	    (uintptr_t)((uint8_t *) orig + desc_size)) {
 		return 0;
 	}
 	size += mrd->address_range_count * sizeof(struct ffa_cons_mrd);
@@ -475,6 +488,12 @@
 
 	/* Copy across the emad structs. */
 	for (unsigned int i = 0U; i < out->emad_count; i++) {
+		/* Bound check for emad array. */
+		if (((uint8_t *)emad_array_in + sizeof(struct ffa_emad_v1_0)) >
+		    ((uint8_t *) mtd_orig + orig->desc_size)) {
+			VERBOSE("%s: Invalid mtd structure.\n", __func__);
+			return false;
+		}
 		memcpy(&emad_array_out[i], &emad_array_in[i],
 		       sizeof(struct ffa_emad_v1_0));
 	}
@@ -542,6 +561,7 @@
 	size_t mrd_out_offset;
 	size_t emad_out_array_size;
 	size_t mrd_size = 0;
+	size_t orig_desc_size = orig->desc_size;
 
 	/* Populate the v1.0 descriptor format from the v1.1 struct. */
 	out->sender_id = mtd_orig->sender_id;
@@ -559,6 +579,12 @@
 	/* Copy across the emad structs. */
 	emad_in = emad_array_in;
 	for (unsigned int i = 0U; i < out->emad_count; i++) {
+		/* Bound check for emad array. */
+		if (((uint8_t *)emad_in + sizeof(struct ffa_emad_v1_0)) >
+				((uint8_t *) mtd_orig + orig_desc_size)) {
+			VERBOSE("%s: Invalid mtd structure.\n", __func__);
+			return false;
+		}
 		memcpy(&emad_array_out[i], emad_in,
 		       sizeof(struct ffa_emad_v1_0));
 
@@ -1442,7 +1468,7 @@
 	}
 
 	/* Validate the caller is a valid participant. */
-	if (!spmc_shmem_obj_validate_id(&obj->desc, sp_ctx->sp_id)) {
+	if (!spmc_shmem_obj_validate_id(obj, sp_ctx->sp_id)) {
 		WARN("%s: Invalid endpoint ID (0x%x).\n",
 			__func__, sp_ctx->sp_id);
 		ret = FFA_ERROR_INVALID_PARAMETER;
@@ -1761,7 +1787,7 @@
 	}
 
 	/* Validate the caller is a valid participant. */
-	if (!spmc_shmem_obj_validate_id(&obj->desc, sp_ctx->sp_id)) {
+	if (!spmc_shmem_obj_validate_id(obj, sp_ctx->sp_id)) {
 		WARN("%s: Invalid endpoint ID (0x%x).\n",
 			__func__, req->endpoint_array[0]);
 		ret = FFA_ERROR_INVALID_PARAMETER;
diff --git a/tools/nxp/create_pbl/create_pbl.c b/tools/nxp/create_pbl/create_pbl.c
index 9457a00..792747f 100644
--- a/tools/nxp/create_pbl/create_pbl.c
+++ b/tools/nxp/create_pbl/create_pbl.c
@@ -823,7 +823,9 @@
 		}
 	}
 
-	if ((args & MAND_ARG_MASK) != MAND_ARG_MASK) {
+	if ((args & MAND_ARG_MASK) != MAND_ARG_MASK
+			|| pblimg.rcw_nm == NULL
+			|| pblimg.imagefile == NULL) {
 		print_usage();
 	}
 
diff --git a/tools/sptool/sp_mk_generator.py b/tools/sptool/sp_mk_generator.py
index f3af584..4067331 100644
--- a/tools/sptool/sp_mk_generator.py
+++ b/tools/sptool/sp_mk_generator.py
@@ -132,20 +132,21 @@
     sp_pkg = get_sp_pkg(sp, args)
     sp_dtb_name = os.path.basename(get_file_from_layout(sp_layout[sp]["pm"]))[:-1] + "b"
     sp_dtb = os.path.join(args["out_dir"], f"fdts/{sp_dtb_name}")
+    sp_img = get_sp_img_full_path(sp_layout[sp], args)
 
     # Do not generate rule if already there.
     if is_line_in_sp_gen(f'{sp_pkg}:', args):
         return args
     write_to_sp_mk_gen(f"SP_PKGS += {sp_pkg}\n", args)
 
-    sptool_args = f" -i {get_sp_img_full_path(sp_layout[sp], args)}:{sp_dtb}"
+    sptool_args = f" -i {sp_img}:{sp_dtb}"
     pm_offset = get_pm_offset(sp_layout[sp])
     sptool_args += f" --pm-offset {pm_offset}" if pm_offset is not None else ""
     image_offset = get_image_offset(sp_layout[sp])
     sptool_args += f" --img-offset {image_offset}" if image_offset is not None else ""
     sptool_args += f" -o {sp_pkg}"
     sppkg_rule = f'''
-{sp_pkg}: {sp_dtb}
+{sp_pkg}: {sp_dtb} {sp_img}
 \t$(Q)echo Generating {sp_pkg}
 \t$(Q)$(PYTHON) $(SPTOOL) {sptool_args}
 '''