diff --git a/Makefile b/Makefile
index 160cd44..becbf03 100644
--- a/Makefile
+++ b/Makefile
@@ -197,10 +197,8 @@
 
 # Memory tagging is supported in architecture Armv8.5-A AArch64 and onwards
 ifeq ($(ARCH), aarch64)
-ifeq ($(shell test $(ARM_ARCH_MAJOR) -gt 8; echo $$?),0)
-mem_tag_arch_support	= 	yes
-else ifeq ($(shell test $(ARM_ARCH_MAJOR) -eq 8 -a $(ARM_ARCH_MINOR) -ge 5; \
-	   echo $$?),0)
+# Check if revision is greater than or equal to 8.5
+ifeq "8.5" "$(word 1, $(sort 8.5 $(ARM_ARCH_MAJOR).$(ARM_ARCH_MINOR)))"
 mem_tag_arch_support	= 	yes
 endif
 endif
diff --git a/bl2/bl2_el3.ld.S b/bl2/bl2_el3.ld.S
index 8c45d98..bc1794c 100644
--- a/bl2/bl2_el3.ld.S
+++ b/bl2/bl2_el3.ld.S
@@ -105,17 +105,7 @@
     __DATA_RAM_START__ = __DATA_START__;
     __DATA_RAM_END__ = __DATA_END__;
 
-    /*
-     * .rela.dyn needs to come after .data for the read-elf utility to parse
-     * this section correctly. Ensure 8-byte alignment so that the fields of
-     * RELA data structure are aligned.
-     */
-    . = ALIGN(8);
-    __RELA_START__ = .;
-    .rela.dyn . : {
-    } >RAM
-    __RELA_END__ = .;
-
+    RELA_SECTION >RAM
     STACK_SECTION >RAM
     BSS_SECTION >RAM
     XLAT_TABLE_SECTION >RAM
diff --git a/bl31/bl31.ld.S b/bl31/bl31.ld.S
index 11e86a3..5026500 100644
--- a/bl31/bl31.ld.S
+++ b/bl31/bl31.ld.S
@@ -115,17 +115,7 @@
     __RW_START__ = . ;
 
     DATA_SECTION >RAM
-
-    /*
-     * .rela.dyn needs to come after .data for the read-elf utility to parse
-     * this section correctly. Ensure 8-byte alignment so that the fields of
-     * RELA data structure are aligned.
-     */
-    . = ALIGN(8);
-    __RELA_START__ = .;
-    .rela.dyn . : {
-    } >RAM
-    __RELA_END__ = .;
+    RELA_SECTION >RAM
 
 #ifdef BL31_PROGBITS_LIMIT
     ASSERT(. <= BL31_PROGBITS_LIMIT, "BL31 progbits has exceeded its limit.")
diff --git a/bl32/tsp/tsp.ld.S b/bl32/tsp/tsp.ld.S
index bdcd2cf..d86ae55 100644
--- a/bl32/tsp/tsp.ld.S
+++ b/bl32/tsp/tsp.ld.S
@@ -71,17 +71,7 @@
     __RW_START__ = . ;
 
     DATA_SECTION >RAM
-
-    /*
-     * .rela.dyn needs to come after .data for the read-elf utility to parse
-     * this section correctly. Ensure 8-byte alignment so that the fields of
-     * RELA data structure are aligned.
-     */
-    . = ALIGN(8);
-    __RELA_START__ = .;
-    .rela.dyn . : {
-    } >RAM
-    __RELA_END__ = .;
+    RELA_SECTION >RAM
 
 #ifdef TSP_PROGBITS_LIMIT
     ASSERT(. <= TSP_PROGBITS_LIMIT, "TSP progbits has exceeded its limit.")
diff --git a/docs/components/exception-handling.rst b/docs/components/exception-handling.rst
index 4cca5f4..4c63a8b 100644
--- a/docs/components/exception-handling.rst
+++ b/docs/components/exception-handling.rst
@@ -176,6 +176,8 @@
 
 Dispatchers are assigned interrupt priority levels in two steps:
 
+.. _Partitioning priority levels:
+
 Partitioning priority levels
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
@@ -365,6 +367,8 @@
 
 See also the `Build-time flow`_ and the `Run-time flow`_.
 
+.. _Activating and Deactivating priorities:
+
 Activating and Deactivating priorities
 --------------------------------------
 
diff --git a/docs/components/fconf/index.rst b/docs/components/fconf/index.rst
index 0da56ec..9020633 100644
--- a/docs/components/fconf/index.rst
+++ b/docs/components/fconf/index.rst
@@ -49,8 +49,10 @@
 configuration properties which is usually a device tree file.
 
 Example:
+ - FW_CONFIG: properties related to base address, maximum size and image id
+   of other DTBs etc.
  - TB_FW: properties related to trusted firmware such as IO policies,
-   base address of other DTBs, mbedtls heap info etc.
+   mbedtls heap info etc.
  - HW_CONFIG: properties related to hardware configuration of the SoC
    such as topology, GIC controller, PSCI hooks, CPU ID etc.
 
@@ -88,9 +90,10 @@
 Loading the property device tree
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-The ``fconf_load_config()`` must be called to load the device tree containing
-the properties' values. This must be done after the io layer is initialized, as
-the |DTB| is stored on an external device (FIP).
+The ``fconf_load_config(image_id)`` must be called to load fw_config and
+tb_fw_config devices tree containing the properties' values. This must be done
+after the io layer is initialized, as the |DTB| is stored on an external
+device (FIP).
 
 .. uml:: ../../resources/diagrams/plantuml/fconf_bl1_load_config.puml
 
diff --git a/docs/components/ras.rst b/docs/components/ras.rst
index 86529d7..02207d8 100644
--- a/docs/components/ras.rst
+++ b/docs/components/ras.rst
@@ -9,10 +9,8 @@
 paradigm for handling platform errors: exceptions resulting from errors are
 routed to and handled in EL3. Said errors are Synchronous External Abort (SEA),
 Asynchronous External Abort (signalled as SErrors), Fault Handling and Error
-Recovery interrupts.  The |EHF| document mentions various `error handling
-use-cases`__.
-
-.. __: exception-handling.rst#delegation-use-cases
+Recovery interrupts.  The |EHF| document mentions various :ref:`error handling
+use-cases <delegation-use-cases>` .
 
 For the description of Arm RAS extensions, Standard Error Records, and the
 precise definition of RAS terminology, please refer to the Arm Architecture
@@ -46,9 +44,7 @@
 
 The RAS framework allows the platform to define handlers for External Abort,
 Uncontainable Errors, Double Fault, and errors rising from EL3 execution. Please
-refer to the porting guide for the `RAS platform API descriptions`__.
-
-.. __: ../getting_started/porting-guide.rst#external-abort-handling-and-ras-support
+refer to :ref:`RAS Porting Guide <External Abort handling and RAS Support>`.
 
 Registering RAS error records
 -----------------------------
@@ -114,9 +110,8 @@
 
 The ``data`` constant parameter describes the various properties of the error,
 including the reason for the error, exception syndrome, and also ``flags``,
-``cookie``, and ``handle`` parameters from the `top-level exception handler`__.
-
-.. __: interrupt-framework-design.rst#el3-interrupts
+``cookie``, and ``handle`` parameters from the :ref:`top-level exception handler
+<EL3 interrupts>`.
 
 The platform is expected populate an array using the macros above, and register
 the it with the RAS framework using the macro ``REGISTER_ERR_RECORD_INFO()``,
@@ -229,21 +224,17 @@
 
 As mentioned in earlier sections, RAS framework interacts with the |EHF| to
 arbitrate handling of RAS exceptions with others that are routed to EL3. This
-means that the platform must partition a `priority level`__ for handling RAS
-exceptions. The platform must then define the macro ``PLAT_RAS_PRI`` to the
-priority level used for RAS exceptions. Platforms would typically want to
-allocate the highest secure priority for RAS handling.
-
-.. __: exception-handling.rst#partitioning-priority-levels
-
-Handling of both `interrupt`__ and `non-interrupt`__ exceptions follow the
-sequences outlined in the |EHF| documentation. I.e., for interrupts, the
-priority management is implicit; but for non-interrupt exceptions, they're
-explicit using `EHF APIs`__.
+means that the platform must partition a :ref:`priority level <Partitioning
+priority levels>` for handling RAS exceptions. The platform must then define
+the macro ``PLAT_RAS_PRI`` to the priority level used for RAS exceptions.
+Platforms would typically want to allocate the highest secure priority for
+RAS handling.
 
-.. __: exception-handling.rst#interrupt-flow
-.. __: exception-handling.rst#non-interrupt-flow
-.. __: exception-handling.rst#activating-and-deactivating-priorities
+Handling of both :ref:`interrupt <interrupt-flow>` and :ref:`non-interrupt
+<non-interrupt-flow>` exceptions follow the sequences outlined in the |EHF|
+documentation. I.e., for interrupts, the priority management is implicit; but
+for non-interrupt exceptions, they're explicit using :ref:`EHF APIs
+<Activating and Deactivating priorities>`.
 
 --------------
 
diff --git a/docs/design/firmware-design.rst b/docs/design/firmware-design.rst
index b336b38..891a9a2 100644
--- a/docs/design/firmware-design.rst
+++ b/docs/design/firmware-design.rst
@@ -83,6 +83,10 @@
 platform. The Boot Loader stage may optionally specify a firmware
 configuration file and/or hardware configuration file as listed below:
 
+-  FW_CONFIG - The firmware configuration file. Holds properties shared across
+   all BLx images.
+   An example is the "dtb-registry" node, which contains the information about
+   the other device tree configurations (load-address, size, image_id).
 -  HW_CONFIG - The hardware configuration file. Can be shared by all Boot Loader
    stages and also by the Normal World Rich OS.
 -  TB_FW_CONFIG - Trusted Boot Firmware configuration file. Shared between BL1
@@ -109,8 +113,8 @@
    the generic hardware configuration is passed the next available argument.
    For example,
 
-   -  If TB_FW_CONFIG is loaded by BL1, then its address is passed in ``arg0``
-      to BL2.
+   -  FW_CONFIG is loaded by BL1, then its address is passed in ``arg0`` to BL2.
+   -  TB_FW_CONFIG address is retrieved by BL2 from FW_CONFIG device tree.
    -  If HW_CONFIG is loaded by BL1, then its address is passed in ``arg2`` to
       BL2. Note, ``arg1`` is already used for meminfo_t.
    -  If SOC_FW_CONFIG is loaded by BL2, then its address is passed in ``arg1``
@@ -1732,7 +1736,7 @@
 ``bl2_mem_params_descs`` contains parameters passed from BL2 to next the
 BL image during boot.
 
-``fw_configs`` includes soc_fw_config, tos_fw_config and tb_fw_config.
+``fw_configs`` includes soc_fw_config, tos_fw_config, tb_fw_config and fw_config.
 
 **FVP with TSP in Trusted SRAM with firmware configs :**
 (These diagrams only cover the AArch64 case)
@@ -1757,7 +1761,7 @@
                |          |  <<<<<<<<<<<<<  | BL31 PROGBITS  |
                |          |  <<<<<<<<<<<<<  |----------------|
                |          |  <<<<<<<<<<<<<  |     BL32       |
-    0x04002000 +----------+                 +----------------+
+    0x04003000 +----------+                 +----------------+
                |  CONFIG  |
     0x04001000 +----------+
                |  Shared  |
@@ -1794,7 +1798,7 @@
                |--------------|  <<<<<<<<<<<<<  |----------------|
                |              |  <<<<<<<<<<<<<  | BL31 PROGBITS  |
                |              |                 +----------------+
-               +--------------+
+    0x04003000 +--------------+
                |    CONFIG    |
     0x04001000 +--------------+
                |    Shared    |
@@ -1828,7 +1832,7 @@
                |----------|  <<<<<<<<<<<<<  |----------------|
                |          |  <<<<<<<<<<<<<  | BL31 PROGBITS  |
                |          |                 +----------------+
-    0x04002000 +----------+
+    0x04003000 +----------+
                |  CONFIG  |
     0x04001000 +----------+
                |  Shared  |
diff --git a/docs/design/interrupt-framework-design.rst b/docs/design/interrupt-framework-design.rst
index 14f7227..2e200aa 100644
--- a/docs/design/interrupt-framework-design.rst
+++ b/docs/design/interrupt-framework-design.rst
@@ -138,6 +138,8 @@
    reason to route the interrupt to EL3 software and then hand it back to
    non-secure software for handling.
 
+.. _EL3 interrupts:
+
 EL3 interrupts
 ^^^^^^^^^^^^^^
 
diff --git a/docs/getting_started/porting-guide.rst b/docs/getting_started/porting-guide.rst
index b7a93e4..c98f3cc 100644
--- a/docs/getting_started/porting-guide.rst
+++ b/docs/getting_started/porting-guide.rst
@@ -1424,7 +1424,7 @@
 
 On Arm standard platforms, the arguments received are :
 
-    arg0 - Points to load address of HW_CONFIG if present
+    arg0 - Points to load address of FW_CONFIG
 
     arg1 - ``meminfo`` structure populated by BL1. The platform copies
     the contents of ``meminfo`` as it may be subsequently overwritten by BL2.
@@ -1736,6 +1736,10 @@
     which is list of executable images following BL31,
 
     arg1 - Points to load address of SOC_FW_CONFIG if present
+           except in case of Arm FVP platform.
+
+           In case of Arm FVP platform, Points to load address
+           of FW_CONFIG.
 
     arg2 - Points to load address of HW_CONFIG if present
 
@@ -2725,6 +2729,8 @@
 registers x0 through x5 to do its work. The return value is 0 on successful
 completion; otherwise the return value is -1.
 
+.. _External Abort handling and RAS Support:
+
 External Abort handling and RAS Support
 ---------------------------------------
 
diff --git a/docs/plat/marvell/armada/build.rst b/docs/plat/marvell/armada/build.rst
index 6f28721..bec0bcb 100644
--- a/docs/plat/marvell/armada/build.rst
+++ b/docs/plat/marvell/armada/build.rst
@@ -77,6 +77,13 @@
 
         Flag defining the LLC (L3) cache state. The cache is enabled by default (``LLC_ENABLE=1``).
 
+- LLC_SRAM
+
+        Flag defining the LLC (L3) cache SRAM support. The feature is
+        disabled by default (``LLC_ENABLE=0``).
+        When LLC SRAM is enabled, the secure payload (BL32) is loaded into this
+        SRAM area instead of the DRAM.
+
 - MARVELL_SECURE_BOOT
 
         Build trusted(=1)/non trusted(=0) image, default is non trusted.
diff --git a/docs/resources/diagrams/plantuml/fconf_bl1_load_config.puml b/docs/resources/diagrams/plantuml/fconf_bl1_load_config.puml
index e613eef..e513ed4 100644
--- a/docs/resources/diagrams/plantuml/fconf_bl1_load_config.puml
+++ b/docs/resources/diagrams/plantuml/fconf_bl1_load_config.puml
@@ -13,6 +13,7 @@
 
 box "platform common code"
 	participant plat_bl1_common
+	participant fconf_dyn_cfg_getter
 	participant fconf
 end box
 
@@ -20,12 +21,17 @@
 fvp_bl1_setup -> arm_bl1_setup : arm_bl1_platform_setup()
 arm_bl1_setup -> arm_io_storage : plat_arm_io_setup()
 note over arm_io_storage : register and setup fip
-arm_bl1_setup -> fconf : fconf_load_config()
+arm_bl1_setup -> fconf : set_fw_config_info(fw_config_base, max_size)
+note over fconf
+	set fw_config information
+	(address, size, image_id)
+	in global dtb_infos array.
+end note
 activate fconf
-	note over fconf
-		create and populate an
-		image_desc_t for FW_CONFIG
-	end note
+	arm_bl1_setup -> fconf : fconf_load_config(FW_CONFIG_ID)
+	fconf -> fconf : FCONF_GET_PROPERTY(dyn_cfg, dtb, FW_CONFIG_ID)
+	fconf -> fconf_dyn_cfg_getter: dyn_cfg_dtb_info_getter(FW_CONFIG_ID)
+	fconf_dyn_cfg_getter -> fconf: fw_config_info
 	fconf -> bl_common : load_auth_image(FW_CONFIG_ID, &image_info)
 	activate bl_common
 	note over bl_common
@@ -33,18 +39,38 @@
 		with info from plat_io_policy
 	end note
 	bl_common -> arm_io_storage
+	arm_io_storage -> fconf: FCONF_GET_PROPERTY(arm, arm_io_policies, FW_CONFIG_ID)
+	note over fconf: use statically defined policies in bl1
+	fconf <- bl_common : image_info
+	deactivate bl_common
+	note over fconf : get fw_config_dtb from image_info
+	arm_bl1_setup -> fconf: FCONF_GET_PROPERTY(dyn_cfg, dtb, FW_CONFIG_ID)
+	fconf -> fconf_dyn_cfg_getter: dyn_cfg_dtb_info_getter(FW_CONFIG_ID)
+	fconf_dyn_cfg_getter -> arm_bl1_setup: fw_config_info
+	arm_bl1_setup -> fconf_dyn_cfg_getter: populate_dtb_registry(uintptr_t dtb)
+	arm_bl1_setup -> fconf: fconf_load_config(TB_FW_CONFIG_ID)
+	fconf -> fconf : FCONF_GET_PROPERTY(dyn_cfg, dtb, TB_FW_CONFIG_ID)
+	fconf -> fconf_dyn_cfg_getter: dyn_cfg_dtb_info_getter(TB_FW_CONFIG_ID)
+	fconf_dyn_cfg_getter -> fconf: tb_fw_config_info
+	fconf -> bl_common : load_auth_image(TB_FW_CONFIG_ID, &image_info)
+	activate bl_common
+	note over bl_common
+		load and auth image from fip
+		with info from plat_io_policy
+	end note
+	bl_common -> arm_io_storage
-	arm_io_storage -> fconf: FCONF_GET_PROPERTY(arm, arm_io_policies, tb_fw_cfg)
-	note over fconf: use staticaly defined policies in bl1
+	arm_io_storage -> fconf: FCONF_GET_PROPERTY(arm, arm_io_policies, TB_FW_CONFIG_ID)
+	note over fconf: use statically defined policies in bl1
 	fconf <- bl_common : image_info
 	deactivate bl_common
 	note over fconf : get tb_fw_config_dtb from image_info
-	fconf -> plat_bl1_common : bl1_plat_get_image_desc(BL2_IMAGE_ID)
-	fconf <- plat_bl1_common : BL2_IMAGE_DESC
-	note over fconf
-		set ep_info.args.arg0 of BL2_IMAGE_DESC
-		to FW_CONFIG base address
+	fconf -> arm_bl1_setup
+	arm_bl1_setup -> plat_bl1_common : bl1_plat_get_image_desc(BL2_IMAGE_ID)
+	arm_bl1_setup <- plat_bl1_common : BL2_IMAGE_DESC
+	note over arm_bl1_setup
+	set ep_info.args.arg0 of BL2_IMAGE_DESC
+	to FW_CONFIG base address
 	end note
-arm_bl1_setup <- fconf
 deactivate fconf
 
 == load & auth, prepare and jump to BL2 ==
diff --git a/docs/resources/diagrams/plantuml/fconf_bl2_populate.puml b/docs/resources/diagrams/plantuml/fconf_bl2_populate.puml
index 881f253..c536ee0 100644
--- a/docs/resources/diagrams/plantuml/fconf_bl2_populate.puml
+++ b/docs/resources/diagrams/plantuml/fconf_bl2_populate.puml
@@ -8,6 +8,7 @@
 box "platform common code"
 	participant fconf
 	participant fconf_tbbr_getter
+participant fconf_dyn_cfg_getter
 end box
 
 box "arm platform code" #LightBlue
@@ -25,10 +26,17 @@
 end note
 arm_bl2_setup -> arm_bl2_setup : arm_bl2_early_platform_setup(\n\t fw_config, mem_layout)
 activate arm_bl2_setup
-	arm_bl2_setup -> fconf: fconf_polulate("TB_FW", fw_config)
+	arm_bl2_setup -> fconf: fconf_populate("FW_CONFIG", fw_config)
 	activate fconf
+		fconf -> fconf_dyn_cfg_getter: populate_dtb_registry(uintptr_t dtb)
+		note over fconf_dyn_cfg_getter: read dtb_registry properties from dtb
+		fconf_dyn_cfg_getter -> arm_bl2_setup
+		arm_bl2_setup -> fconf: FCONF_GET_PROPERTY(dyn_cfg, dtb, TB_FW_CONFIG_ID)
+		fconf -> fconf_dyn_cfg_getter: dyn_cfg_dtb_info_getter(TB_FW_CONFIG_ID)
+		fconf_dyn_cfg_getter -> arm_bl2_setup: tb_fw_config_info
+		arm_bl2_setup -> fconf: fconf_populate("TB_FW_CONFIG", tb_fw_config)
 		fconf -> fconf_tbbr_getter: fconf_populate_tbbr_dyn_config(uintptr_t dtb)
-		note over fconf_tbbr_getter: read tbbr propeties from dtb
+		note over fconf_tbbr_getter: read tbbr properties from dtb
 		fconf -> arm_fconf_io: fconf_populate_arm_io_policies(uintptr_t dtb)
 		note over arm_fconf_io: read arm io propeties from dtb
 	deactivate fconf
diff --git a/drivers/arm/css/scp/css_bom_bootloader.c b/drivers/arm/css/scp/css_bom_bootloader.c
index 1fc1270..74121b4 100644
--- a/drivers/arm/css/scp/css_bom_bootloader.c
+++ b/drivers/arm/css/scp/css_bom_bootloader.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2018, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2014-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -51,13 +51,13 @@
  * All CSS platforms load SCP_BL2/SCP_BL2U just below BL2 (this is where BL31
  * usually resides except when ARM_BL31_IN_DRAM is
  * set). Ensure that SCP_BL2/SCP_BL2U do not overflow into shared RAM and
- * the tb_fw_config.
+ * the fw_config.
  */
 CASSERT(SCP_BL2_LIMIT <= BL2_BASE, assert_scp_bl2_overwrite_bl2);
 CASSERT(SCP_BL2U_LIMIT <= BL2_BASE, assert_scp_bl2u_overwrite_bl2);
 
-CASSERT(SCP_BL2_BASE >= ARM_TB_FW_CONFIG_LIMIT, assert_scp_bl2_overflow);
-CASSERT(SCP_BL2U_BASE >= ARM_TB_FW_CONFIG_LIMIT, assert_scp_bl2u_overflow);
+CASSERT(SCP_BL2_BASE >= ARM_FW_CONFIG_LIMIT, assert_scp_bl2_overflow);
+CASSERT(SCP_BL2U_BASE >= ARM_FW_CONFIG_LIMIT, assert_scp_bl2u_overflow);
 
 static void scp_boot_message_start(void)
 {
diff --git a/drivers/auth/dualroot/cot.c b/drivers/auth/dualroot/cot.c
index f28ddaa..31e5d65 100644
--- a/drivers/auth/dualroot/cot.c
+++ b/drivers/auth/dualroot/cot.c
@@ -16,6 +16,7 @@
  * Allocate static buffers to store the authentication parameters extracted from
  * the certificates.
  */
+static unsigned char fw_config_hash_buf[HASH_DER_LEN];
 static unsigned char tb_fw_hash_buf[HASH_DER_LEN];
 static unsigned char tb_fw_config_hash_buf[HASH_DER_LEN];
 static unsigned char hw_config_hash_buf[HASH_DER_LEN];
@@ -58,6 +59,8 @@
 		AUTH_PARAM_HASH, TRUSTED_BOOT_FW_CONFIG_HASH_OID);
 static auth_param_type_desc_t hw_config_hash = AUTH_PARAM_TYPE_DESC(
 		AUTH_PARAM_HASH, HW_CONFIG_HASH_OID);
+static auth_param_type_desc_t fw_config_hash = AUTH_PARAM_TYPE_DESC(
+		AUTH_PARAM_HASH, FW_CONFIG_HASH_OID);
 #ifdef IMAGE_BL1
 static auth_param_type_desc_t scp_bl2u_hash = AUTH_PARAM_TYPE_DESC(
 		AUTH_PARAM_HASH, SCP_FWU_CFG_HASH_OID);
@@ -165,6 +168,13 @@
 				.ptr = (void *)hw_config_hash_buf,
 				.len = (unsigned int)HASH_DER_LEN
 			}
+		},
+		[3] = {
+			.type_desc = &fw_config_hash,
+			.data = {
+				.ptr = (void *)fw_config_hash_buf,
+				.len = (unsigned int)HASH_DER_LEN
+			}
 		}
 	}
 };
@@ -218,6 +228,22 @@
 		}
 	}
 };
+
+static const auth_img_desc_t fw_config = {
+	.img_id = FW_CONFIG_ID,
+	.img_type = IMG_RAW,
+	.parent = &trusted_boot_fw_cert,
+	.img_auth_methods = (const auth_method_desc_t[AUTH_METHOD_NUM]) {
+		[0] = {
+			.type = AUTH_METHOD_HASH,
+			.param.hash = {
+				.data = &raw_data,
+				.hash = &fw_config_hash
+			}
+		}
+	}
+};
+
 #endif /* IMAGE_BL1 */
 
 #ifdef IMAGE_BL2
@@ -860,6 +886,7 @@
 	[BL2_IMAGE_ID]				=	&bl2_image,
 	[HW_CONFIG_ID]				=	&hw_config,
 	[TB_FW_CONFIG_ID]			=	&tb_fw_config,
+	[FW_CONFIG_ID]				=	&fw_config,
 	[FWU_CERT_ID]				=	&fwu_cert,
 	[SCP_BL2U_IMAGE_ID]			=	&scp_bl2u_image,
 	[BL2U_IMAGE_ID]				=	&bl2u_image,
diff --git a/drivers/auth/tbbr/tbbr_cot_bl1.c b/drivers/auth/tbbr/tbbr_cot_bl1.c
index f3bb376..e4c9221 100644
--- a/drivers/auth/tbbr/tbbr_cot_bl1.c
+++ b/drivers/auth/tbbr/tbbr_cot_bl1.c
@@ -150,6 +150,21 @@
 	}
 };
 
+static const auth_img_desc_t fw_config = {
+	.img_id = FW_CONFIG_ID,
+	.img_type = IMG_RAW,
+	.parent = &trusted_boot_fw_cert,
+	.img_auth_methods = (const auth_method_desc_t[AUTH_METHOD_NUM]) {
+		[0] = {
+			.type = AUTH_METHOD_HASH,
+			.param.hash = {
+				.data = &raw_data,
+				.hash = &fw_config_hash
+			}
+		}
+	}
+};
+
 /*
  * TBBR Chain of trust definition
  */
@@ -158,6 +173,7 @@
 	[BL2_IMAGE_ID]				=	&bl2_image,
 	[HW_CONFIG_ID]				=	&hw_config,
 	[TB_FW_CONFIG_ID]			=	&tb_fw_config,
+	[FW_CONFIG_ID]				=	&fw_config,
 	[FWU_CERT_ID]				=	&fwu_cert,
 	[SCP_BL2U_IMAGE_ID]			=	&scp_bl2u_image,
 	[BL2U_IMAGE_ID]				=	&bl2u_image,
diff --git a/drivers/auth/tbbr/tbbr_cot_common.c b/drivers/auth/tbbr/tbbr_cot_common.c
index 0a4b75e..ff3f22d 100644
--- a/drivers/auth/tbbr/tbbr_cot_common.c
+++ b/drivers/auth/tbbr/tbbr_cot_common.c
@@ -23,9 +23,10 @@
  * established, we can reuse some of the buffers on different stages
  */
 
+static unsigned char fw_config_hash_buf[HASH_DER_LEN];
+static unsigned char tb_fw_config_hash_buf[HASH_DER_LEN];
+static unsigned char hw_config_hash_buf[HASH_DER_LEN];
 unsigned char tb_fw_hash_buf[HASH_DER_LEN];
-unsigned char tb_fw_config_hash_buf[HASH_DER_LEN];
-unsigned char hw_config_hash_buf[HASH_DER_LEN];
 unsigned char scp_fw_hash_buf[HASH_DER_LEN];
 unsigned char nt_world_bl_hash_buf[HASH_DER_LEN];
 
@@ -48,7 +49,9 @@
 	AUTH_PARAM_HASH, TRUSTED_BOOT_FW_HASH_OID);
 auth_param_type_desc_t tb_fw_config_hash = AUTH_PARAM_TYPE_DESC(
 	AUTH_PARAM_HASH, TRUSTED_BOOT_FW_CONFIG_HASH_OID);
-auth_param_type_desc_t hw_config_hash = AUTH_PARAM_TYPE_DESC(
+auth_param_type_desc_t fw_config_hash = AUTH_PARAM_TYPE_DESC(
+	AUTH_PARAM_HASH, FW_CONFIG_HASH_OID);
+static auth_param_type_desc_t hw_config_hash = AUTH_PARAM_TYPE_DESC(
 	AUTH_PARAM_HASH, HW_CONFIG_HASH_OID);
 
 /* trusted_boot_fw_cert */
@@ -95,6 +98,13 @@
 				.ptr = (void *)hw_config_hash_buf,
 				.len = (unsigned int)HASH_DER_LEN
 			}
+		},
+		[3] = {
+			.type_desc = &fw_config_hash,
+			.data = {
+				.ptr = (void *)fw_config_hash_buf,
+				.len = (unsigned int)HASH_DER_LEN
+			}
 		}
 	}
 };
diff --git a/drivers/marvell/cache_llc.c b/drivers/marvell/cache_llc.c
index 3df93a4..836aae7 100644
--- a/drivers/marvell/cache_llc.c
+++ b/drivers/marvell/cache_llc.c
@@ -31,19 +31,19 @@
 
 void llc_flush_all(int ap_index)
 {
-	mmio_write_32(L2X0_CLEAN_INV_WAY(ap_index), LLC_WAY_MASK);
+	mmio_write_32(LLC_CLEAN_INV_WAY(ap_index), LLC_ALL_WAYS_MASK);
 	llc_cache_sync(ap_index);
 }
 
 void llc_clean_all(int ap_index)
 {
-	mmio_write_32(L2X0_CLEAN_WAY(ap_index), LLC_WAY_MASK);
+	mmio_write_32(LLC_CLEAN_WAY(ap_index), LLC_ALL_WAYS_MASK);
 	llc_cache_sync(ap_index);
 }
 
 void llc_inv_all(int ap_index)
 {
-	mmio_write_32(L2X0_INV_WAY(ap_index), LLC_WAY_MASK);
+	mmio_write_32(LLC_INV_WAY(ap_index), LLC_ALL_WAYS_MASK);
 	llc_cache_sync(ap_index);
 }
 
@@ -109,3 +109,41 @@
 	reg |= (0x1 << CCU_SET_POC_OFFSET);
 	mmio_write_32(CCU_HTC_CR(ap_index), reg);
 }
+
+#if LLC_SRAM
+void llc_sram_enable(int ap_index)
+{
+	uint32_t tc, way;
+	uint32_t way_addr;
+
+	/* Lockdown all available ways for all traffic classes */
+	for (tc = 0; tc < LLC_TC_NUM; tc++)
+		mmio_write_32(LLC_TCN_LOCK(ap_index, tc), LLC_WAY_MASK);
+
+	/* Clear the high bits of SRAM address */
+	mmio_write_32(LLC_BANKED_MNT_AHR(ap_index), 0);
+
+	way_addr = PLAT_MARVELL_TRUSTED_RAM_BASE;
+	for (way = 0; way < LLC_WAYS; way++) {
+		/* Trigger allocation block command */
+		mmio_write_32(LLC_BLK_ALOC(ap_index),
+			      LLC_BLK_ALOC_BASE_ADDR(way_addr) |
+			      LLC_BLK_ALOC_WAY_DATA_CLR |
+			      LLC_BLK_ALOC_WAY_ID(way));
+		way_addr += LLC_WAY_SIZE;
+	}
+	llc_enable(ap_index, 1);
+}
+
+void llc_sram_disable(int ap_index)
+{
+	uint32_t tc;
+
+	/* Disable the line lockings */
+	for (tc = 0; tc < LLC_TC_NUM; tc++)
+		mmio_write_32(LLC_TCN_LOCK(ap_index, tc), 0);
+
+	/* Invalidate all ways */
+	llc_inv_all(ap_index);
+}
+#endif /* LLC_SRAM */
diff --git a/drivers/marvell/ccu.c b/drivers/marvell/ccu.c
index 1e4ab44..c73516e 100644
--- a/drivers/marvell/ccu.c
+++ b/drivers/marvell/ccu.c
@@ -54,8 +54,8 @@
 							      win_id));
 			start = ((uint64_t)alr << ADDRESS_SHIFT);
 			end = (((uint64_t)ahr + 0x10) << ADDRESS_SHIFT);
-			printf("\tccu    %02x     0x%016llx 0x%016llx\n",
-			       target_id, start, end);
+			printf("\tccu%d    %02x     0x%016llx 0x%016llx\n",
+			       win_id, target_id, start, end);
 		}
 	}
 	win_cr = mmio_read_32(CCU_WIN_GCR_OFFSET(ap_index));
@@ -81,6 +81,12 @@
 	}
 }
 
+int ccu_is_win_enabled(int ap_index, uint32_t win_id)
+{
+	return mmio_read_32(CCU_WIN_CR_OFFSET(ap_index, win_id)) &
+			    WIN_ENABLE_BIT;
+}
+
 void ccu_enable_win(int ap_index, struct addr_map_win *win, uint32_t win_id)
 {
 	uint32_t ccu_win_reg;
diff --git a/drivers/marvell/comphy/comphy-cp110.h b/drivers/marvell/comphy/comphy-cp110.h
index 6eb7fd0..3678c90 100644
--- a/drivers/marvell/comphy/comphy-cp110.h
+++ b/drivers/marvell/comphy/comphy-cp110.h
@@ -659,18 +659,32 @@
 			(0x3f << HPIPE_SAVED_DFE_VALUES_SAV_F0D_OFFSET)
 
 #define HPIPE_CDR_CONTROL_REG			0x418
-#define HPIPE_CDR_RX_MAX_DFE_ADAPT_0_OFFSET	14
-#define HPIPE_CDR_RX_MAX_DFE_ADAPT_0_MASK	\
-			(0x3 << HPIPE_CDR_RX_MAX_DFE_ADAPT_0_OFFSET)
-#define HPIPE_CDR_RX_MAX_DFE_ADAPT_1_OFFSET	12
-#define HPIPE_CDR_RX_MAX_DFE_ADAPT_1_MASK	\
-			(0x3 << HPIPE_CDR_RX_MAX_DFE_ADAPT_1_OFFSET)
-#define HPIPE_CDR_MAX_DFE_ADAPT_0_OFFSET	9
-#define HPIPE_CDR_MAX_DFE_ADAPT_0_MASK		\
-			(0x7 << HPIPE_CDR_MAX_DFE_ADAPT_0_OFFSET)
+#define HPIPE_CRD_MIDPOINT_PHASE_OS_OFFSET	0
+#define HPIPE_CRD_MIDPOINT_PHASE_OS_MASK	\
+			(0x3f << HPIPE_CRD_MIDPOINT_PHASE_OS_OFFSET)
 #define HPIPE_CDR_MAX_DFE_ADAPT_1_OFFSET	6
 #define HPIPE_CDR_MAX_DFE_ADAPT_1_MASK		\
 			(0x7 << HPIPE_CDR_MAX_DFE_ADAPT_1_OFFSET)
+#define HPIPE_CDR_MAX_DFE_ADAPT_0_OFFSET	9
+#define HPIPE_CDR_MAX_DFE_ADAPT_0_MASK		\
+			(0x7 << HPIPE_CDR_MAX_DFE_ADAPT_0_OFFSET)
+#define HPIPE_CDR_RX_MAX_DFE_ADAPT_1_OFFSET	12
+#define HPIPE_CDR_RX_MAX_DFE_ADAPT_1_MASK	\
+			(0x3 << HPIPE_CDR_RX_MAX_DFE_ADAPT_1_OFFSET)
+#define HPIPE_CDR_RX_MAX_DFE_ADAPT_0_OFFSET	14
+#define HPIPE_CDR_RX_MAX_DFE_ADAPT_0_MASK	\
+			(0x3 << HPIPE_CDR_RX_MAX_DFE_ADAPT_0_OFFSET)
+
+
+#define HPIPE_CDR_CONTROL1_REG			0x41c
+#define HPIPE_CRD2_CRD_MIDPOINT_SMALL_THRES_K_OFF	12
+#define HPIPE_CRD2_CRD_MIDPOINT_SMALL_THRES_K_MASK	\
+			(0xf << HPIPE_CRD2_CRD_MIDPOINT_SMALL_THRES_K_OFF)
+
+#define HPIPE_CDR_CONTROL2_REG			0x420
+#define HPIPE_CRD2_CRD_MIDPOINT_LARGE_THRES_K_OFF	12
+#define HPIPE_CRD2_CRD_MIDPOINT_LARGE_THRES_K_MASK	\
+			(0xf << HPIPE_CRD2_CRD_MIDPOINT_LARGE_THRES_K_OFF)
 
 #define HPIPE_TX_TRAIN_CTRL_11_REG		0x438
 #define HPIPE_TX_STATUS_CHECK_MODE_OFFSET	6
@@ -749,6 +763,30 @@
 #define HPIPE_DFE_CTRL_28_PIPE4_MASK		\
 			(0x1 << HPIPE_DFE_CTRL_28_PIPE4_OFFSET)
 
+#define HPIPE_TRX0_REG				0x4cc /*in doc 0x133*4*/
+#define HPIPE_TRX0_GAIN_TRAIN_WITH_SAMPLER_OFF	2
+#define HPIPE_TRX0_GAIN_TRAIN_WITH_SAMPLER_MASK \
+			(0x1 << HPIPE_TRX0_GAIN_TRAIN_WITH_SAMPLER_OFF)
+#define HPIPE_TRX0_GAIN_TRAIN_WITH_C_OFF	0
+#define HPIPE_TRX0_GAIN_TRAIN_WITH_C_MASK	\
+			(0x1 << HPIPE_TRX0_GAIN_TRAIN_WITH_C_OFF)
+
+#define HPIPE_TRX_REG1				0x4d0 /*in doc 0x134*4*/
+#define HPIPE_TRX_REG1_MIN_BOOST_MODE_OFF	3
+#define HPIPE_TRX_REG1_MIN_BOOST_MODE_MASK	\
+			(0x1 << HPIPE_TRX_REG1_MIN_BOOST_MODE_OFF)
+#define HPIPE_TRX_REG1_SUMFTAP_EN_OFF		10
+#define HPIPE_TRX_REG1_SUMFTAP_EN_MASK		\
+			(0x3f << HPIPE_TRX_REG1_SUMFTAP_EN_OFF)
+
+#define HPIPE_TRX_REG2				0x4d8 /*in doc 0x136*4*/
+#define HPIPE_TRX_REG2_SUMF_BOOST_TARGET_C_OFF	11
+#define HPIPE_TRX_REG2_SUMF_BOOST_TARGET_C_MASK	\
+			(0x1f << HPIPE_TRX_REG2_SUMF_BOOST_TARGET_C_OFF)
+#define HPIPE_TRX_REG2_SUMF_BOOST_TARGET_K_OFF	7
+#define HPIPE_TRX_REG2_SUMF_BOOST_TARGET_K_MASK	\
+			(0xf << HPIPE_TRX_REG2_SUMF_BOOST_TARGET_K_OFF)
+
 #define HPIPE_G1_SETTING_5_REG			0x538
 #define HPIPE_G1_SETTING_5_G1_ICP_OFFSET	0
 #define HPIPE_G1_SETTING_5_G1_ICP_MASK		\
diff --git a/drivers/marvell/comphy/phy-comphy-cp110.c b/drivers/marvell/comphy/phy-comphy-cp110.c
index b682086..2760f46 100644
--- a/drivers/marvell/comphy/phy-comphy-cp110.c
+++ b/drivers/marvell/comphy/phy-comphy-cp110.c
@@ -209,8 +209,10 @@
 			   * as SFI1/XFI1 available only for CP115.
 			   */
 			if ((mode == COMPHY_SGMII_MODE ||
-			    mode == COMPHY_HS_SGMII_MODE ||
-			    mode == COMPHY_SFI_MODE || mode == COMPHY_XFI_MODE)
+			     mode == COMPHY_HS_SGMII_MODE ||
+			     mode == COMPHY_SFI_MODE ||
+			     mode == COMPHY_XFI_MODE ||
+			     mode == COMPHY_AP_MODE)
 			    && COMPHY_GET_ID(comphy_mode) == 1)
 				reg |= COMMON_SELECTOR_COMPHY4_PORT1 <<
 					comphy_offset;
@@ -2012,12 +2014,58 @@
 	return ret;
 }
 
+static void rx_pre_train(uint64_t comphy_base, uint8_t comphy_index)
+{
+	uintptr_t hpipe_addr;
+	uint32_t mask, data;
+
+	hpipe_addr = HPIPE_ADDR(COMPHY_PIPE_FROM_COMPHY_ADDR(comphy_base),
+				comphy_index);
+
+	debug("rx_training preparation\n\n");
+
+	mask = HPIPE_TRX0_GAIN_TRAIN_WITH_C_MASK;
+	data = (0x1 << HPIPE_TRX0_GAIN_TRAIN_WITH_C_OFF);
+	mask |= HPIPE_TRX0_GAIN_TRAIN_WITH_SAMPLER_MASK;
+	data |= (0x0 << HPIPE_TRX0_GAIN_TRAIN_WITH_SAMPLER_OFF);
+	reg_set(hpipe_addr + HPIPE_TRX0_REG, data, mask);
+
+
+	mask = HPIPE_TRX_REG2_SUMF_BOOST_TARGET_C_MASK;
+	data = (0x1e << HPIPE_TRX_REG2_SUMF_BOOST_TARGET_C_OFF);
+	mask |= HPIPE_TRX_REG2_SUMF_BOOST_TARGET_K_MASK;
+	data |= (0x0 << HPIPE_TRX_REG2_SUMF_BOOST_TARGET_K_OFF);
+	reg_set(hpipe_addr + HPIPE_TRX_REG2, data, mask);
+
+	mask = HPIPE_TRX_REG1_MIN_BOOST_MODE_MASK;
+	data = (0x1 << HPIPE_TRX_REG1_MIN_BOOST_MODE_OFF);
+	reg_set(hpipe_addr + HPIPE_TRX_REG1, data, mask);
+
+	mask = HPIPE_CRD2_CRD_MIDPOINT_SMALL_THRES_K_MASK;
+	data = (0x8 << HPIPE_CRD2_CRD_MIDPOINT_SMALL_THRES_K_OFF);
+	reg_set(hpipe_addr + HPIPE_CDR_CONTROL1_REG, data, mask);
+
+	mask = HPIPE_CRD2_CRD_MIDPOINT_LARGE_THRES_K_MASK;
+	data = (0x8 << HPIPE_CRD2_CRD_MIDPOINT_LARGE_THRES_K_OFF);
+	reg_set(hpipe_addr + HPIPE_CDR_CONTROL2_REG, data, mask);
+
+	mask = HPIPE_CRD_MIDPOINT_PHASE_OS_MASK;
+	data = (0x0 << HPIPE_CRD_MIDPOINT_PHASE_OS_OFFSET);
+	reg_set(hpipe_addr + HPIPE_CDR_CONTROL_REG, data, mask);
+
+	mask = HPIPE_TRX_REG1_SUMFTAP_EN_MASK;
+	data = (0x38 << HPIPE_TRX_REG1_SUMFTAP_EN_OFF);
+	mask |= HPIPE_TRX_REG2_SUMF_BOOST_TARGET_C_MASK;
+	data |= (0x1e << HPIPE_TRX_REG2_SUMF_BOOST_TARGET_C_OFF);
+	reg_set(hpipe_addr + HPIPE_TRX_REG1, data, mask);
+}
+
 int mvebu_cp110_comphy_xfi_rx_training(uint64_t comphy_base,
 					      uint8_t comphy_index)
 {
 	uint32_t mask, data, timeout;
 	uint32_t g1_ffe_cap_sel, g1_ffe_res_sel, align90, g1_dfe_res;
-	uintptr_t hpipe_addr, sd_ip_addr;
+	uintptr_t hpipe_addr;
 
 	uint8_t ap_nr, cp_nr;
 
@@ -2025,30 +2073,10 @@
 
 	hpipe_addr = HPIPE_ADDR(COMPHY_PIPE_FROM_COMPHY_ADDR(comphy_base),
 				comphy_index);
-	sd_ip_addr = SD_ADDR(COMPHY_PIPE_FROM_COMPHY_ADDR(comphy_base),
-			     comphy_index);
 
 	debug_enter();
 
-	debug("stage: RF Reset\n");
-
-	/* Release from hard reset */
-	mask = SD_EXTERNAL_CONFIG1_RESET_IN_MASK;
-	data = 0x0 << SD_EXTERNAL_CONFIG1_RESET_IN_OFFSET;
-	mask |= SD_EXTERNAL_CONFIG1_RESET_CORE_MASK;
-	data |= 0x0 << SD_EXTERNAL_CONFIG1_RESET_CORE_OFFSET;
-	mask |= SD_EXTERNAL_CONFIG1_RF_RESET_IN_MASK;
-	data |= 0x0 << SD_EXTERNAL_CONFIG1_RF_RESET_IN_OFFSET;
-	reg_set(sd_ip_addr + SD_EXTERNAL_CONFIG1_REG, data, mask);
-
-	mask = SD_EXTERNAL_CONFIG1_RESET_IN_MASK;
-	data = 0x1 << SD_EXTERNAL_CONFIG1_RESET_IN_OFFSET;
-	mask |= SD_EXTERNAL_CONFIG1_RESET_CORE_MASK;
-	data |= 0x1 << SD_EXTERNAL_CONFIG1_RESET_CORE_OFFSET;
-	reg_set(sd_ip_addr + SD_EXTERNAL_CONFIG1_REG, data, mask);
-
-	/* Wait 50ms - until band gap and ref clock ready */
-	mdelay(50);
+	rx_pre_train(comphy_base, comphy_index);
 
 	debug("Preparation for rx_training\n\n");
 
@@ -2068,34 +2096,10 @@
 	data = 0 << HPIPE_DFE_RES_FORCE_OFFSET;
 	reg_set(hpipe_addr + HPIPE_DFE_REG0, data, mask);
 
-	debug("PRBS31 loppback\n\n");
-
-	/* Configure PRBS counters */
-	mask = HPIPE_PHY_TEST_PATTERN_SEL_MASK;
-	data = 0xe << HPIPE_PHY_TEST_PATTERN_SEL_OFFSET;
-	reg_set(hpipe_addr + HPIPE_PHY_TEST_CONTROL_REG, data, mask);
-
-	mask = HPIPE_PHY_TEST_DATA_MASK;
-	data = 0xc4 << HPIPE_PHY_TEST_DATA_OFFSET;
-	reg_set(hpipe_addr + HPIPE_PHY_TEST_DATA_REG, data, mask);
-
-	mask = HPIPE_PHY_TEST_EN_MASK;
-	data = 0x1 << HPIPE_PHY_TEST_EN_OFFSET;
-	reg_set(hpipe_addr + HPIPE_PHY_TEST_CONTROL_REG, data, mask);
-
-	mdelay(10);
-	debug("Enable TX/RX training\n\n");
+	debug("Enable RX training\n\n");
 
 	mask = HPIPE_TRX_RX_TRAIN_EN_MASK;
 	data = 0x1 << HPIPE_TRX_RX_TRAIN_EN_OFFSET;
-	mask |= HPIPE_TRX_RX_ANA_IF_CLK_ENE_MASK;
-	data |= 0x1 << HPIPE_TRX_RX_ANA_IF_CLK_ENE_OFFSET;
-	mask |= HPIPE_TRX_TX_CTRL_CLK_EN_MASK;
-	data |= 0x1 << HPIPE_TRX_TX_CTRL_CLK_EN_OFFSET;
-	mask |= HPIPE_TRX_UPDATE_THEN_HOLD_MASK;
-	data |= 0x1 << HPIPE_TRX_UPDATE_THEN_HOLD_OFFSET;
-	mask |= HPIPE_TRX_TX_F0T_EO_BASED_MASK;
-	data |= 0x1 << HPIPE_TRX_TX_F0T_EO_BASED_OFFSET;
 	reg_set(hpipe_addr + HPIPE_TRX_TRAIN_CTRL_0_REG, data, mask);
 
 	/* Check the result of RX training */
@@ -2180,21 +2184,9 @@
 	data = 1 << HPIPE_G1_SETTINGS_3_G1_FFE_SETTING_FORCE_OFFSET;
 	reg_set(hpipe_addr + HPIPE_G1_SETTINGS_3_REG, data, mask);
 
-	/* Use the value from CAL_OS_PH_EXT */
-	mask = HPIPE_CAL_RXCLKALIGN_90_EXT_EN_MASK;
-	data = 1 << HPIPE_CAL_RXCLKALIGN_90_EXT_EN_OFFSET;
-	reg_set(hpipe_addr + HPIPE_RX_CLK_ALIGN90_AND_TX_IDLE_CALIB_CTRL_REG,
-		data, mask);
-
-	/* Update align90 */
-	mask = HPIPE_CAL_OS_PH_EXT_MASK;
-	data = align90 << HPIPE_CAL_OS_PH_EXT_OFFSET;
-	reg_set(hpipe_addr + HPIPE_RX_CLK_ALIGN90_AND_TX_IDLE_CALIB_CTRL_REG,
-		data, mask);
-
 	/* Force DFE resolution (use gen table value) */
 	mask = HPIPE_DFE_RES_FORCE_MASK;
-	data = 0x0 << HPIPE_DFE_RES_FORCE_OFFSET;
+	data = 0x1 << HPIPE_DFE_RES_FORCE_OFFSET;
 	reg_set(hpipe_addr + HPIPE_DFE_REG0, data, mask);
 
 	/* 0x111-G1 DFE_Setting_4 */
@@ -2202,38 +2194,6 @@
 	data = g1_dfe_res << HPIPE_G1_SETTINGS_4_G1_DFE_RES_OFFSET;
 	reg_set(hpipe_addr + HPIPE_G1_SETTINGS_4_REG, data, mask);
 
-	debug("PRBS31 loppback\n\n");
-
-	mask = HPIPE_PHY_TEST_PT_TESTMODE_MASK;
-	data = 0x1 << HPIPE_PHY_TEST_PT_TESTMODE_OFFSET;
-	reg_set(hpipe_addr + HPIPE_PHY_TEST_OOB_0_REGISTER, data, mask);
-
-	/* Configure PRBS counters */
-	mask = HPIPE_PHY_TEST_PATTERN_SEL_MASK;
-	data = 0xe << HPIPE_PHY_TEST_PATTERN_SEL_OFFSET;
-	reg_set(hpipe_addr + HPIPE_PHY_TEST_CONTROL_REG, data, mask);
-
-	mask = HPIPE_PHY_TEST_DATA_MASK;
-	data = 0xc4 << HPIPE_PHY_TEST_DATA_OFFSET;
-	reg_set(hpipe_addr + HPIPE_PHY_TEST_DATA_REG, data, mask);
-
-	mask = HPIPE_PHY_TEST_EN_MASK;
-	data = 0x1 << HPIPE_PHY_TEST_EN_OFFSET;
-	reg_set(hpipe_addr + HPIPE_PHY_TEST_CONTROL_REG, data, mask);
-
-	/* Reset PRBS error counter */
-	mask = HPIPE_PHY_TEST_PATTERN_SEL_MASK;
-	data = 0x1 << HPIPE_PHY_TEST_RESET_OFFSET;
-	reg_set(hpipe_addr + HPIPE_PHY_TEST_CONTROL_REG, data, mask);
-
-	mask = HPIPE_PHY_TEST_PATTERN_SEL_MASK;
-	data = 0x0 << HPIPE_PHY_TEST_RESET_OFFSET;
-	reg_set(hpipe_addr + HPIPE_PHY_TEST_CONTROL_REG, data, mask);
-
-	mask = HPIPE_PHY_TEST_PT_TESTMODE_MASK;
-	data = 0x1 << HPIPE_PHY_TEST_PT_TESTMODE_OFFSET;
-	reg_set(hpipe_addr + HPIPE_PHY_TEST_OOB_0_REGISTER, data, mask);
-
 	printf("########################################################\n");
 	printf("# To use trained values update the ATF sources:\n");
 	printf("# plat/marvell/armada/a8k/<board_type>/board/phy-porting-layer.h ");
@@ -2252,12 +2212,6 @@
 	printf("};\n\n");
 	printf("########################################################\n");
 
-	/* check */
-	debug("PRBS error counter[0x%lx] 0x%x\n\n",
-	      hpipe_addr + HPIPE_PHY_TEST_PRBS_ERROR_COUNTER_1_REG,
-	      mmio_read_32(hpipe_addr +
-			   HPIPE_PHY_TEST_PRBS_ERROR_COUNTER_1_REG));
-
 	rx_trainng_done[ap_nr][cp_nr][comphy_index] = 1;
 
 	return 0;
@@ -2273,12 +2227,16 @@
  * the network registers like: MG, AP, MAC, PCS, Serdes etc.)
  */
 static int mvebu_cp110_comphy_ap_power_on(uint64_t comphy_base,
-					  uint8_t comphy_index)
+					  uint8_t comphy_index,
+					  uint32_t comphy_mode)
 {
 	uint32_t mask, data;
 	uintptr_t comphy_addr = comphy_addr =
 				COMPHY_ADDR(comphy_base, comphy_index);
 
+	/* configure phy selector for XFI/SFI */
+	mvebu_cp110_comphy_set_phy_selector(comphy_base, comphy_index,
+					    comphy_mode);
 	debug_enter();
 	debug("stage: RFU configurations - hard reset comphy\n");
 	/* RFU configurations - hard reset comphy */
@@ -2371,7 +2329,8 @@
 						       comphy_mode);
 		break;
 	case (COMPHY_AP_MODE):
-		err = mvebu_cp110_comphy_ap_power_on(comphy_base, comphy_index);
+		err = mvebu_cp110_comphy_ap_power_on(comphy_base, comphy_index,
+						     comphy_mode);
 		break;
 	default:
 		ERROR("comphy%d: unsupported comphy mode\n", comphy_index);
diff --git a/include/common/bl_common.ld.h b/include/common/bl_common.ld.h
index 208e3d6..ab3391a 100644
--- a/include/common/bl_common.ld.h
+++ b/include/common/bl_common.ld.h
@@ -101,6 +101,17 @@
 		__DATA_END__ = .;			\
 	}
 
+/*
+ * .rela.dyn needs to come after .data for the read-elf utility to parse
+ * this section correctly.
+ */
+#define RELA_SECTION					\
+	.rela.dyn : ALIGN(STRUCT_ALIGN) {		\
+		__RELA_START__ = .;			\
+		*(.rela*)				\
+		__RELA_END__ = .;			\
+	}
+
 #if !(defined(IMAGE_BL31) && RECLAIM_INIT_CODE)
 #define STACK_SECTION					\
 	stacks (NOLOAD) : {				\
diff --git a/include/drivers/arm/css/css_scp.h b/include/drivers/arm/css/css_scp.h
index f3c08c5..2b506ea 100644
--- a/include/drivers/arm/css/css_scp.h
+++ b/include/drivers/arm/css/css_scp.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016-2018, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2016-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -40,13 +40,13 @@
 /*
  * All CSS platforms load SCP_BL2/SCP_BL2U just below BL2 (this is where BL31
  * usually resides except when ARM_BL31_IN_DRAM is
- * set). Ensure that SCP_BL2/SCP_BL2U do not overflow into tb_fw_config.
+ * set). Ensure that SCP_BL2/SCP_BL2U do not overflow into fw_config.
  */
 CASSERT(SCP_BL2_LIMIT <= BL2_BASE, assert_scp_bl2_overwrite_bl2);
 CASSERT(SCP_BL2U_LIMIT <= BL2_BASE, assert_scp_bl2u_overwrite_bl2);
 
-CASSERT(SCP_BL2_BASE >= ARM_TB_FW_CONFIG_LIMIT, assert_scp_bl2_overflow);
-CASSERT(SCP_BL2U_BASE >= ARM_TB_FW_CONFIG_LIMIT, assert_scp_bl2u_overflow);
+CASSERT(SCP_BL2_BASE >= ARM_FW_CONFIG_LIMIT, assert_scp_bl2_overflow);
+CASSERT(SCP_BL2U_BASE >= ARM_FW_CONFIG_LIMIT, assert_scp_bl2u_overflow);
 #endif
 
 #endif /* CSS_SCP_H */
diff --git a/include/drivers/auth/tbbr_cot_common.h b/include/drivers/auth/tbbr_cot_common.h
index 0ea5f65..a51faee 100644
--- a/include/drivers/auth/tbbr_cot_common.h
+++ b/include/drivers/auth/tbbr_cot_common.h
@@ -10,8 +10,6 @@
 #include <drivers/auth/auth_mod.h>
 
 extern unsigned char tb_fw_hash_buf[HASH_DER_LEN];
-extern unsigned char tb_fw_config_hash_buf[HASH_DER_LEN];
-extern unsigned char hw_config_hash_buf[HASH_DER_LEN];
 extern unsigned char scp_fw_hash_buf[HASH_DER_LEN];
 extern unsigned char nt_world_bl_hash_buf[HASH_DER_LEN];
 
@@ -23,7 +21,7 @@
 
 extern auth_param_type_desc_t tb_fw_hash;
 extern auth_param_type_desc_t tb_fw_config_hash;
-extern auth_param_type_desc_t hw_config_hash;
+extern auth_param_type_desc_t fw_config_hash;
 
 extern const auth_img_desc_t trusted_boot_fw_cert;
 extern const auth_img_desc_t hw_config;
diff --git a/include/drivers/marvell/cache_llc.h b/include/drivers/marvell/cache_llc.h
index 85babb8..b326474 100644
--- a/include/drivers/marvell/cache_llc.h
+++ b/include/drivers/marvell/cache_llc.h
@@ -13,19 +13,35 @@
 #define CACHE_LLC_H
 
 #define LLC_CTRL(ap)			(MVEBU_LLC_BASE(ap) + 0x100)
+#define LLC_SECURE_CTRL(ap)		(MVEBU_LLC_BASE(ap) + 0x10C)
 #define LLC_SYNC(ap)			(MVEBU_LLC_BASE(ap) + 0x700)
-#define L2X0_INV_WAY(ap)		(MVEBU_LLC_BASE(ap) + 0x77C)
-#define L2X0_CLEAN_WAY(ap)		(MVEBU_LLC_BASE(ap) + 0x7BC)
-#define L2X0_CLEAN_INV_WAY(ap)		(MVEBU_LLC_BASE(ap) + 0x7FC)
-#define LLC_TC0_LOCK(ap)		(MVEBU_LLC_BASE(ap) + 0x920)
+#define LLC_BANKED_MNT_AHR(ap)		(MVEBU_LLC_BASE(ap) + 0x724)
+#define LLC_INV_WAY(ap)			(MVEBU_LLC_BASE(ap) + 0x77C)
+#define LLC_BLK_ALOC(ap)		(MVEBU_LLC_BASE(ap) + 0x78c)
+#define LLC_CLEAN_WAY(ap)		(MVEBU_LLC_BASE(ap) + 0x7BC)
+#define LLC_CLEAN_INV_WAY(ap)		(MVEBU_LLC_BASE(ap) + 0x7FC)
+#define LLC_TCN_LOCK(ap, tc)		(MVEBU_LLC_BASE(ap) + 0x920 + 4 * (tc))
 
 #define MASTER_LLC_CTRL			LLC_CTRL(MVEBU_AP0)
-#define MASTER_L2X0_INV_WAY		L2X0_INV_WAY(MVEBU_AP0)
-#define MASTER_LLC_TC0_LOCK		LLC_TC0_LOCK(MVEBU_AP0)
+#define MASTER_LLC_INV_WAY		LLC_INV_WAY(MVEBU_AP0)
+#define MASTER_LLC_TC0_LOCK		LLC_TCN_LOCK(MVEBU_AP0, 0)
 
 #define LLC_CTRL_EN			1
 #define LLC_EXCLUSIVE_EN		0x100
-#define LLC_WAY_MASK			0xFFFFFFFF
+#define LLC_ALL_WAYS_MASK		0xFFFFFFFF
+
+/* AP806/AP807 - 1MB 8-ways LLC */
+#define LLC_WAYS			8
+#define LLC_WAY_MASK			((1 << LLC_WAYS) - 1)
+#define LLC_SIZE			(1024 * 1024)
+#define LLC_WAY_SIZE			(LLC_SIZE / LLC_WAYS)
+#define LLC_TC_NUM			15
+
+#define LLC_BLK_ALOC_WAY_ID(way)	((way) & 0x1f)
+#define LLC_BLK_ALOC_WAY_DATA_DSBL	(0x0 << 6)
+#define LLC_BLK_ALOC_WAY_DATA_CLR	(0x1 << 6)
+#define LLC_BLK_ALOC_WAY_DATA_SET	(0x3 << 6)
+#define LLC_BLK_ALOC_BASE_ADDR(addr)	((addr) & (LLC_WAY_SIZE - 1))
 
 #ifndef __ASSEMBLER__
 void llc_cache_sync(int ap_index);
@@ -36,6 +52,10 @@
 void llc_enable(int ap_index, int excl_mode);
 int llc_is_exclusive(int ap_index);
 void llc_runtime_enable(int ap_index);
-#endif
+#if LLC_SRAM
+void llc_sram_enable(int ap_index);
+void llc_sram_disable(int ap_index);
+#endif /* LLC_SRAM */
+#endif /* __ASSEMBLY__ */
 
 #endif /* CACHE_LLC_H */
diff --git a/include/drivers/marvell/ccu.h b/include/drivers/marvell/ccu.h
index b0d1ec9..413ffb9 100644
--- a/include/drivers/marvell/ccu.h
+++ b/include/drivers/marvell/ccu.h
@@ -46,6 +46,7 @@
 void ccu_dram_target_set(int ap_index, uint32_t target);
 void ccu_save_win_all(int ap_id);
 void ccu_restore_win_all(int ap_id);
+int ccu_is_win_enabled(int ap_index, uint32_t win_id);
 #endif
 
 #endif /* CCU_H */
diff --git a/include/export/common/tbbr/tbbr_img_def_exp.h b/include/export/common/tbbr/tbbr_img_def_exp.h
index a98c1b4..18f0125 100644
--- a/include/export/common/tbbr/tbbr_img_def_exp.h
+++ b/include/export/common/tbbr/tbbr_img_def_exp.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2019, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2019-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -88,7 +88,10 @@
 /* Encrypted image identifier */
 #define ENC_IMAGE_ID			U(30)
 
+/* FW_CONFIG */
+#define FW_CONFIG_ID			U(31)
+
 /* Max Images */
-#define MAX_IMAGE_IDS			U(31)
+#define MAX_IMAGE_IDS			U(32)
 
 #endif /* ARM_TRUSTED_FIRMWARE_EXPORT_COMMON_TBBR_TBBR_IMG_DEF_EXP_H */
diff --git a/include/lib/fconf/fconf.h b/include/lib/fconf/fconf.h
index 09d2b59..917e053 100644
--- a/include/lib/fconf/fconf.h
+++ b/include/lib/fconf/fconf.h
@@ -43,8 +43,8 @@
 	int (*populate)(uintptr_t config);
 };
 
-/* Load firmware configuration dtb */
-void fconf_load_config(void);
+/* This function supports to load tb_fw_config and fw_config dtb */
+int fconf_load_config(unsigned int image_id);
 
 /* Top level populate function
  *
diff --git a/include/lib/fconf/fconf_dyn_cfg_getter.h b/include/lib/fconf/fconf_dyn_cfg_getter.h
index 0fda8c9..9816d6f 100644
--- a/include/lib/fconf/fconf_dyn_cfg_getter.h
+++ b/include/lib/fconf/fconf_dyn_cfg_getter.h
@@ -21,4 +21,7 @@
 struct dyn_cfg_dtb_info_t *dyn_cfg_dtb_info_getter(unsigned int config_id);
 int fconf_populate_dtb_registry(uintptr_t config);
 
+/* Set fw_config information in global DTB array */
+void set_fw_config_info(uintptr_t config_addr, uint32_t config_max_size);
+
 #endif /* FCONF_DYN_CFG_GETTER_H */
diff --git a/include/plat/arm/common/arm_def.h b/include/plat/arm/common/arm_def.h
index 89f7c61..5c11e5f 100644
--- a/include/plat/arm/common/arm_def.h
+++ b/include/plat/arm/common/arm_def.h
@@ -346,24 +346,24 @@
 #define CACHE_WRITEBACK_GRANULE		(U(1) << ARM_CACHE_WRITEBACK_SHIFT)
 
 /*
- * To enable TB_FW_CONFIG to be loaded by BL1, define the corresponding base
+ * To enable FW_CONFIG to be loaded by BL1, define the corresponding base
  * and limit. Leave enough space of BL2 meminfo.
  */
-#define ARM_TB_FW_CONFIG_BASE		(ARM_BL_RAM_BASE + sizeof(meminfo_t))
-#define ARM_TB_FW_CONFIG_LIMIT		(ARM_BL_RAM_BASE + (PAGE_SIZE / 2U))
+#define ARM_FW_CONFIG_BASE		(ARM_BL_RAM_BASE + sizeof(meminfo_t))
+#define ARM_FW_CONFIG_LIMIT		(ARM_BL_RAM_BASE + PAGE_SIZE)
 
 /*
  * Boot parameters passed from BL2 to BL31/BL32 are stored here
  */
-#define ARM_BL2_MEM_DESC_BASE		ARM_TB_FW_CONFIG_LIMIT
+#define ARM_BL2_MEM_DESC_BASE		ARM_FW_CONFIG_LIMIT
 #define ARM_BL2_MEM_DESC_LIMIT		(ARM_BL2_MEM_DESC_BASE +	\
 							(PAGE_SIZE / 2U))
 
 /*
  * Define limit of firmware configuration memory:
- * ARM_TB_FW_CONFIG + ARM_BL2_MEM_DESC memory
+ * ARM_FW_CONFIG + ARM_BL2_MEM_DESC memory
  */
-#define ARM_FW_CONFIG_LIMIT		(ARM_BL_RAM_BASE + PAGE_SIZE)
+#define ARM_FW_CONFIGS_LIMIT		(ARM_BL_RAM_BASE + (PAGE_SIZE * 2))
 
 /*******************************************************************************
  * BL1 specific defines.
@@ -461,7 +461,7 @@
  * SP_MIN is the only BL image in SRAM. Allocate the whole of SRAM (excluding
  * the page reserved for fw_configs) to BL32
  */
-#  define BL32_BASE			ARM_FW_CONFIG_LIMIT
+#  define BL32_BASE			ARM_FW_CONFIGS_LIMIT
 #  define BL32_LIMIT			(ARM_BL_RAM_BASE + ARM_BL_RAM_SIZE)
 # else
 /* Put BL32 below BL2 in the Trusted SRAM.*/
@@ -505,7 +505,7 @@
 #  define TSP_SEC_MEM_BASE		ARM_BL_RAM_BASE
 #  define TSP_SEC_MEM_SIZE		ARM_BL_RAM_SIZE
 #  define TSP_PROGBITS_LIMIT		BL31_BASE
-#  define BL32_BASE			ARM_FW_CONFIG_LIMIT
+#  define BL32_BASE			ARM_FW_CONFIGS_LIMIT
 #  define BL32_LIMIT			BL31_BASE
 # elif ARM_TSP_RAM_LOCATION_ID == ARM_TRUSTED_DRAM_ID
 #  define TSP_SEC_MEM_BASE		PLAT_ARM_TRUSTED_DRAM_BASE
diff --git a/include/plat/arm/common/plat_arm.h b/include/plat/arm/common/plat_arm.h
index 1b59795..3625530 100644
--- a/include/plat/arm/common/plat_arm.h
+++ b/include/plat/arm/common/plat_arm.h
@@ -190,7 +190,7 @@
 void arm_bl1_plat_arch_setup(void);
 
 /* BL2 utility functions */
-void arm_bl2_early_platform_setup(uintptr_t tb_fw_config, struct meminfo *mem_layout);
+void arm_bl2_early_platform_setup(uintptr_t fw_config, struct meminfo *mem_layout);
 void arm_bl2_platform_setup(void);
 void arm_bl2_plat_arch_setup(void);
 uint32_t arm_get_spsr_for_bl32_entry(void);
diff --git a/include/plat/marvell/armada/a3700/common/armada_common.h b/include/plat/marvell/armada/a3k/common/armada_common.h
similarity index 100%
rename from include/plat/marvell/armada/a3700/common/armada_common.h
rename to include/plat/marvell/armada/a3k/common/armada_common.h
diff --git a/include/plat/marvell/armada/a3700/common/board_marvell_def.h b/include/plat/marvell/armada/a3k/common/board_marvell_def.h
similarity index 95%
rename from include/plat/marvell/armada/a3700/common/board_marvell_def.h
rename to include/plat/marvell/armada/a3k/common/board_marvell_def.h
index 1782596..bc3e04f 100644
--- a/include/plat/marvell/armada/a3700/common/board_marvell_def.h
+++ b/include/plat/marvell/armada/a3k/common/board_marvell_def.h
@@ -71,6 +71,4 @@
 #define MAX_IO_DEVICES			3
 #define MAX_IO_HANDLES			4
 
-#define PLAT_MARVELL_TRUSTED_SRAM_SIZE	0x80000	/* 512 KB */
-
 #endif /* BOARD_MARVELL_DEF_H */
diff --git a/include/plat/marvell/armada/a3700/common/marvell_def.h b/include/plat/marvell/armada/a3k/common/marvell_def.h
similarity index 89%
rename from include/plat/marvell/armada/a3700/common/marvell_def.h
rename to include/plat/marvell/armada/a3k/common/marvell_def.h
index eb13ba8..1394c05 100644
--- a/include/plat/marvell/armada/a3700/common/marvell_def.h
+++ b/include/plat/marvell/armada/a3k/common/marvell_def.h
@@ -49,15 +49,17 @@
  */
 #define MARVELL_LOCAL_STATE_OFF	2
 
+/* This leaves a gap between end of DRAM and start of ROM block */
+#define MARVELL_TRUSTED_DRAM_SIZE	0x80000	/* 512 KB */
+
 /* The first 4KB of Trusted SRAM are used as shared memory */
-#define MARVELL_TRUSTED_SRAM_BASE	PLAT_MARVELL_ATF_BASE
-#define MARVELL_SHARED_RAM_BASE		MARVELL_TRUSTED_SRAM_BASE
+#define MARVELL_SHARED_RAM_BASE		PLAT_MARVELL_ATF_BASE
 #define MARVELL_SHARED_RAM_SIZE		0x00001000	/* 4 KB */
 
 /* The remaining Trusted SRAM is used to load the BL images */
 #define MARVELL_BL_RAM_BASE		(MARVELL_SHARED_RAM_BASE + \
 					 MARVELL_SHARED_RAM_SIZE)
-#define MARVELL_BL_RAM_SIZE		(PLAT_MARVELL_TRUSTED_SRAM_SIZE - \
+#define MARVELL_BL_RAM_SIZE		(MARVELL_TRUSTED_DRAM_SIZE - \
 					 MARVELL_SHARED_RAM_SIZE)
 
 #define MARVELL_DRAM_BASE		ULL(0x0)
@@ -65,7 +67,7 @@
 #define MARVELL_DRAM_END		(MARVELL_DRAM_BASE + \
 					 MARVELL_DRAM_SIZE - 1)
 
-#define MARVELL_IRQ_SEC_PHY_TIMER		29
+#define MARVELL_IRQ_SEC_PHY_TIMER	29
 
 #define MARVELL_IRQ_SEC_SGI_0		8
 #define MARVELL_IRQ_SEC_SGI_1		9
@@ -86,7 +88,6 @@
 						MARVELL_DRAM_SIZE,	\
 						MT_MEMORY | MT_RW | MT_NS)
 
-
 /*
  * The number of regions like RO(code), coherent and data required by
  * different BL stages which need to be mapped in the MMU.
@@ -173,5 +174,15 @@
 #define BL31_LIMIT			(MARVELL_BL_RAM_BASE +	\
 					 MARVELL_BL_RAM_SIZE)
 
+/*****************************************************************************
+ * BL32 specific defines.
+ *****************************************************************************
+ */
+#define BL32_BASE		PLAT_MARVELL_TRUSTED_RAM_BASE
+#define BL32_LIMIT		(BL32_BASE + PLAT_MARVELL_TRUSTED_RAM_SIZE)
+
+#ifdef SPD_none
+#undef BL32_BASE
+#endif /* SPD_none */
 
 #endif /* MARVELL_DEF_H */
diff --git a/include/plat/marvell/armada/a3700/common/plat_marvell.h b/include/plat/marvell/armada/a3k/common/plat_marvell.h
similarity index 100%
rename from include/plat/marvell/armada/a3700/common/plat_marvell.h
rename to include/plat/marvell/armada/a3k/common/plat_marvell.h
diff --git a/include/plat/marvell/armada/a8k/common/board_marvell_def.h b/include/plat/marvell/armada/a8k/common/board_marvell_def.h
index 0da56e7..7e90f5f 100644
--- a/include/plat/marvell/armada/a8k/common/board_marvell_def.h
+++ b/include/plat/marvell/armada/a8k/common/board_marvell_def.h
@@ -71,7 +71,4 @@
 #define MAX_IO_DEVICES			3
 #define MAX_IO_HANDLES			4
 
-#define PLAT_MARVELL_TRUSTED_SRAM_SIZE	0x80000	/* 512 KB */
-
-
 #endif /* BOARD_MARVELL_DEF_H */
diff --git a/include/plat/marvell/armada/a8k/common/marvell_def.h b/include/plat/marvell/armada/a8k/common/marvell_def.h
index 4eda01f..1245b88 100644
--- a/include/plat/marvell/armada/a8k/common/marvell_def.h
+++ b/include/plat/marvell/armada/a8k/common/marvell_def.h
@@ -47,15 +47,17 @@
  */
 #define MARVELL_LOCAL_STATE_OFF	2
 
+/* This leaves a gap between end of DRAM and start of ROM block */
+#define MARVELL_TRUSTED_DRAM_SIZE	0x80000	/* 512 KB */
+
 /* The first 4KB of Trusted SRAM are used as shared memory */
-#define MARVELL_TRUSTED_SRAM_BASE	PLAT_MARVELL_ATF_BASE
-#define MARVELL_SHARED_RAM_BASE		MARVELL_TRUSTED_SRAM_BASE
+#define MARVELL_SHARED_RAM_BASE		PLAT_MARVELL_ATF_BASE
 #define MARVELL_SHARED_RAM_SIZE		0x00001000	/* 4 KB */
 
 /* The remaining Trusted SRAM is used to load the BL images */
 #define MARVELL_BL_RAM_BASE		(MARVELL_SHARED_RAM_BASE +	\
 					 MARVELL_SHARED_RAM_SIZE)
-#define MARVELL_BL_RAM_SIZE		(PLAT_MARVELL_TRUSTED_SRAM_SIZE - \
+#define MARVELL_BL_RAM_SIZE		(MARVELL_TRUSTED_DRAM_SIZE - \
 					 MARVELL_SHARED_RAM_SIZE)
 /* Non-shared DRAM */
 #define MARVELL_DRAM_BASE		ULL(0x0)
@@ -75,9 +77,40 @@
 #define MARVELL_IRQ_SEC_SGI_6		14
 #define MARVELL_IRQ_SEC_SGI_7		15
 
+#ifdef SPD_opteed
+/*
+ * BL2 needs to map 4MB at the end of TZC_DRAM1 in order to
+ * load/authenticate the trusted os extra image. The first 512KB of
+ * TZC_DRAM1 are reserved for trusted os (OPTEE). The extra image loading
+ * for OPTEE is paged image which only include the paging part using
+ * virtual memory but without "init" data. OPTEE will copy the "init" data
+ * (from pager image) to the first 512KB of TZC_DRAM, and then copy the
+ * extra image behind the "init" data.
+ */
+#define MARVELL_OPTEE_PAGEABLE_LOAD_BASE	\
+					(PLAT_MARVELL_TRUSTED_RAM_BASE + \
+					 PLAT_MARVELL_TRUSTED_RAM_SIZE - \
+					 MARVELL_OPTEE_PAGEABLE_LOAD_SIZE)
+#define MARVELL_OPTEE_PAGEABLE_LOAD_SIZE	0x400000
+#define MARVELL_OPTEE_PAGEABLE_LOAD_MEM		\
+					MAP_REGION_FLAT(		  \
+					MARVELL_OPTEE_PAGEABLE_LOAD_BASE, \
+					MARVELL_OPTEE_PAGEABLE_LOAD_SIZE, \
+					MT_MEMORY | MT_RW | MT_SECURE)
+
+/*
+ * Map the memory for the OP-TEE core (also known as OP-TEE pager when paging
+ * support is enabled).
+ */
+#define MARVELL_MAP_OPTEE_CORE_MEM	MAP_REGION_FLAT(		\
+						BL32_BASE,		\
+						BL32_LIMIT - BL32_BASE,	\
+						MT_MEMORY | MT_RW | MT_SECURE)
+#endif /* SPD_opteed */
+
-#define MARVELL_MAP_SHARED_RAM		MAP_REGION_FLAT(		\
-						MARVELL_SHARED_RAM_BASE,\
-						MARVELL_SHARED_RAM_SIZE,\
+#define MARVELL_MAP_SECURE_RAM		MAP_REGION_FLAT(		 \
+						MARVELL_SHARED_RAM_BASE, \
+						MARVELL_SHARED_RAM_SIZE, \
 						MT_MEMORY | MT_RW | MT_SECURE)
 
 #define MARVELL_MAP_DRAM		MAP_REGION_FLAT(		\
@@ -85,7 +118,6 @@
 						MARVELL_DRAM_SIZE,	\
 						MT_MEMORY | MT_RW | MT_NS)
 
-
 /*
  * The number of regions like RO(code), coherent and data required by
  * different BL stages which need to be mapped in the MMU.
@@ -177,5 +209,14 @@
 #define BL31_LIMIT			(MARVELL_BL_RAM_BASE +	\
 					 MARVELL_BL_RAM_SIZE)
 
+/*******************************************************************************
+ * BL32 specific defines.
+ ******************************************************************************/
+#define BL32_BASE		PLAT_MARVELL_TRUSTED_RAM_BASE
+#define BL32_LIMIT		(BL32_BASE + PLAT_MARVELL_TRUSTED_RAM_SIZE)
+
+#ifdef SPD_none
+#undef BL32_BASE
+#endif /* SPD_none */
 
 #endif /* MARVELL_DEF_H */
diff --git a/include/tools_share/firmware_image_package.h b/include/tools_share/firmware_image_package.h
index 75f3cc6..7342c0c 100644
--- a/include/tools_share/firmware_image_package.h
+++ b/include/tools_share/firmware_image_package.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2018, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2014-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -77,6 +77,8 @@
 	{{0x26,  0x25, 0x7c, 0x1a}, {0xdb, 0xc6}, {0x7f, 0x47}, 0x8d, 0x96, {0xc4, 0xc4, 0xb0, 0x24, 0x80, 0x21} }
 #define UUID_NT_FW_CONFIG \
 	{{0x28,  0xda, 0x98, 0x15}, {0x93, 0xe8}, {0x7e, 0x44}, 0xac, 0x66, {0x1a, 0xaf, 0x80, 0x15, 0x50, 0xf9} }
+#define UUID_FW_CONFIG \
+	{{0x58,  0x07, 0xe1, 0x6a}, {0x84, 0x59}, {0x47, 0xbe}, 0x8e, 0xd5, {0x64, 0x8e, 0x8d, 0xdd, 0xab, 0x0e} }
 
 typedef struct fip_toc_header {
 	uint32_t	name;
diff --git a/include/tools_share/tbbr_oid.h b/include/tools_share/tbbr_oid.h
index 24a8f39..37d87d3 100644
--- a/include/tools_share/tbbr_oid.h
+++ b/include/tools_share/tbbr_oid.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2018, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -43,6 +43,7 @@
 #define TRUSTED_BOOT_FW_HASH_OID		"1.3.6.1.4.1.4128.2100.201"
 #define TRUSTED_BOOT_FW_CONFIG_HASH_OID		"1.3.6.1.4.1.4128.2100.202"
 #define HW_CONFIG_HASH_OID			"1.3.6.1.4.1.4128.2100.203"
+#define FW_CONFIG_HASH_OID			"1.3.6.1.4.1.4128.2100.204"
 
 /*
  * Trusted Key Certificate
diff --git a/lib/debugfs/devfip.c b/lib/debugfs/devfip.c
index 70ac3bc..b0ee39a 100644
--- a/lib/debugfs/devfip.c
+++ b/lib/debugfs/devfip.c
@@ -73,6 +73,7 @@
 	{"soc-fw.cfg",		UUID_SOC_FW_CONFIG},
 	{"tos-fw.cfg",		UUID_TOS_FW_CONFIG},
 	{"nt-fw.cfg",		UUID_NT_FW_CONFIG},
+	{"fw.cfg",		UUID_FW_CONFIG},
 	{"rot-k.crt",		UUID_ROT_KEY_CERT},
 	{"nt-k.crt",		UUID_NON_TRUSTED_WORLD_KEY_CERT},
 	{"sip-sp.crt",		UUID_SIP_SECURE_PARTITION_CONTENT_CERT}
diff --git a/lib/fconf/fconf.c b/lib/fconf/fconf.c
index a5ec143..bc4fa8e 100644
--- a/lib/fconf/fconf.c
+++ b/lib/fconf/fconf.c
@@ -9,48 +9,43 @@
 #include <common/debug.h>
 #include <common/fdt_wrappers.h>
 #include <lib/fconf/fconf.h>
+#include <lib/fconf/fconf_dyn_cfg_getter.h>
 #include <libfdt.h>
 #include <plat/common/platform.h>
 #include <platform_def.h>
 
-struct fconf_dtb_info_t fconf_dtb_info;
-
-void fconf_load_config(void)
+int fconf_load_config(unsigned int image_id)
 {
 	int err;
-	/* fconf FW_CONFIG and TB_FW_CONFIG are currently the same DTB */
-	image_info_t arm_tb_fw_info = {
+	const struct dyn_cfg_dtb_info_t *config_info;
+
+	assert((image_id == FW_CONFIG_ID) || (image_id == TB_FW_CONFIG_ID));
+
+	image_info_t config_image_info = {
 		.h.type = (uint8_t)PARAM_IMAGE_BINARY,
 		.h.version = (uint8_t)VERSION_2,
 		.h.size = (uint16_t)sizeof(image_info_t),
-		.h.attr = 0,
-		.image_base = ARM_TB_FW_CONFIG_BASE,
-		.image_max_size = (uint32_t)
-				(ARM_TB_FW_CONFIG_LIMIT - ARM_TB_FW_CONFIG_BASE)
+		.h.attr = 0
 	};
 
-	VERBOSE("FCONF: Loading FW_CONFIG\n");
-	err = load_auth_image(TB_FW_CONFIG_ID, &arm_tb_fw_info);
-	if (err != 0) {
-		/* Return if FW_CONFIG is not loaded */
-		VERBOSE("FW_CONFIG not loaded, continuing without it\n");
-		return;
-	}
+	config_info = FCONF_GET_PROPERTY(dyn_cfg, dtb, image_id);
+	assert(config_info != NULL);
 
-	/* At this point we know that a DTB is indeed available */
-	fconf_dtb_info.base_addr = arm_tb_fw_info.image_base;
-	fconf_dtb_info.size = (size_t)arm_tb_fw_info.image_size;
+	config_image_info.image_base = config_info->config_addr;
+	config_image_info.image_max_size =
+		(uint32_t)config_info->config_max_size;
 
-#if !BL2_AT_EL3
-	image_desc_t *desc;
+	VERBOSE("FCONF: Loading config with image ID: %d\n", image_id);
+	err = load_auth_image(image_id, &config_image_info);
+	if (err != 0) {
+		VERBOSE("Failed to load config %d\n", image_id);
+		return err;
+	}
 
-	/* The BL2 ep_info arg0 is modified to point to FW_CONFIG */
-	desc = bl1_plat_get_image_desc(BL2_IMAGE_ID);
-	assert(desc != NULL);
-	desc->ep_info.args.arg0 = arm_tb_fw_info.image_base;
-#endif
+	INFO("FCONF: Config file with image ID:%d loaded at address = 0x%lx\n",
+		image_id, config_image_info.image_base);
 
-	INFO("FCONF: FW_CONFIG loaded at address = 0x%lx\n", arm_tb_fw_info.image_base);
+	return 0;
 }
 
 void fconf_populate(const char *config_type, uintptr_t config)
@@ -81,7 +76,4 @@
 			}
 		}
 	}
-
-	/* save local pointer to the config dtb */
-	fconf_dtb_info.base_addr = config;
 }
diff --git a/lib/fconf/fconf.mk b/lib/fconf/fconf.mk
index c087102..b01dc6f 100644
--- a/lib/fconf/fconf.mk
+++ b/lib/fconf/fconf.mk
@@ -8,5 +8,5 @@
 FCONF_SOURCES		:=	lib/fconf/fconf.c
 FCONF_DYN_SOURCES	:=	lib/fconf/fconf_dyn_cfg_getter.c
 
-BL1_SOURCES		+=	${FCONF_SOURCES}
+BL1_SOURCES		+=	${FCONF_SOURCES} ${FCONF_DYN_SOURCES}
 BL2_SOURCES		+=	${FCONF_SOURCES} ${FCONF_DYN_SOURCES}
diff --git a/lib/fconf/fconf_dyn_cfg_getter.c b/lib/fconf/fconf_dyn_cfg_getter.c
index 7b5bd6e..902c07d 100644
--- a/lib/fconf/fconf_dyn_cfg_getter.c
+++ b/lib/fconf/fconf_dyn_cfg_getter.c
@@ -12,12 +12,27 @@
 #include <lib/object_pool.h>
 #include <libfdt.h>
 
-/* We currently use TB_FW, SOC_FW, TOS_FW, NS_fw and HW configs  */
-#define MAX_DTB_INFO	U(5)
+/* We currently use FW, TB_FW, SOC_FW, TOS_FW, NS_fw and HW configs  */
+#define MAX_DTB_INFO	U(6)
 
 static struct dyn_cfg_dtb_info_t dtb_infos[MAX_DTB_INFO];
 static OBJECT_POOL_ARRAY(dtb_info_pool, dtb_infos);
 
+/*
+ * This function is used to alloc memory for fw config information from
+ * global pool and set fw configuration information.
+ * Specifically used by BL1 to set fw_config information in global array
+ */
+void set_fw_config_info(uintptr_t config_addr, uint32_t config_max_size)
+{
+	struct dyn_cfg_dtb_info_t *dtb_info;
+
+	dtb_info = pool_alloc(&dtb_info_pool);
+	dtb_info->config_addr = config_addr;
+	dtb_info->config_max_size = config_max_size;
+	dtb_info->config_id = FW_CONFIG_ID;
+}
+
 struct dyn_cfg_dtb_info_t *dyn_cfg_dtb_info_getter(unsigned int config_id)
 {
 	unsigned int index;
@@ -48,6 +63,30 @@
 	/* As libfdt use void *, we can't avoid this cast */
 	const void *dtb = (void *)config;
 
+	/*
+	 * Compile time assert if FW_CONFIG_ID is 0 which is more
+	 * unlikely as 0 is a valid image id for FIP as per the current
+	 * code but still to avoid code breakage in case of unlikely
+	 * event when image ids gets changed.
+	 */
+	CASSERT(FW_CONFIG_ID != 0, assert_invalid_fw_config_id);
+
+	/*
+	 * In case of BL1, fw_config dtb information is already
+	 * populated in global dtb_infos array by 'set_fw_config_info'
+	 * function, Below check is present to avoid re-population of
+	 * fw_config information.
+	 *
+	 * Other BLs, satisfy below check and populate fw_config information
+	 * in global dtb_infos array.
+	 */
+	if (dtb_infos[0].config_id == 0) {
+		dtb_info = pool_alloc(&dtb_info_pool);
+		dtb_info->config_addr = config;
+		dtb_info->config_max_size = fdt_totalsize(dtb);
+		dtb_info->config_id = FW_CONFIG_ID;
+	}
+
 	/* Find the node offset point to "fconf,dyn_cfg-dtb_registry" compatible property */
 	const char *compatible_str = "fconf,dyn_cfg-dtb_registry";
 	node = fdt_node_offset_by_compatible(dtb, -1, compatible_str);
@@ -98,4 +137,4 @@
 	return 0;
 }
 
-FCONF_REGISTER_POPULATOR(TB_FW, dyn_cfg, fconf_populate_dtb_registry);
+FCONF_REGISTER_POPULATOR(FW_CONFIG, dyn_cfg, fconf_populate_dtb_registry);
diff --git a/plat/allwinner/common/sunxi_security.c b/plat/allwinner/common/sunxi_security.c
index 1f16a0b..92c83b0 100644
--- a/plat/allwinner/common/sunxi_security.c
+++ b/plat/allwinner/common/sunxi_security.c
@@ -39,8 +39,8 @@
 	/* set MBUS clocks, bus clocks (AXI/AHB/APB) and PLLs to non-secure */
 	mmio_write_32(SUNXI_CCU_SEC_SWITCH_REG, 0x7);
 
-	/* set R_PRCM clocks to non-secure */
-	mmio_write_32(SUNXI_R_PRCM_BASE + R_PRCM_SEC_SWITCH_REG, 0x7);
+	/* Set R_PRCM bus clocks to non-secure */
+	mmio_write_32(SUNXI_R_PRCM_BASE + R_PRCM_SEC_SWITCH_REG, 0x1);
 
 	/* Set all DMA channels (16 max.) to non-secure */
 	mmio_write_32(SUNXI_DMA_BASE + DMA_SEC_REG, 0xffff);
diff --git a/plat/arm/board/a5ds/fdts/a5ds_fw_config.dts b/plat/arm/board/a5ds/fdts/a5ds_fw_config.dts
index b9d9053..b9ff8bf 100644
--- a/plat/arm/board/a5ds/fdts/a5ds_fw_config.dts
+++ b/plat/arm/board/a5ds/fdts/a5ds_fw_config.dts
@@ -12,9 +12,8 @@
 	dtb-registry {
 		compatible = "fconf,dyn_cfg-dtb_registry";
 
-		/* tb_fw_config is temporarily contained in this dtb */
 		tb_fw-config {
-			load-address = <0x0 0x2001010>;
+			load-address = <0x0 0x2001300>;
 			max-size = <0x200>;
 			id = <TB_FW_CONFIG_ID>;
 		};
@@ -25,11 +24,4 @@
 			id = <HW_CONFIG_ID>;
 		};
 	};
-
-	tb_fw-config {
-		compatible = "arm,tb_fw";
-
-		/* Disable authentication for development */
-		disable_auth = <0x0>;
-	};
 };
diff --git a/plat/arm/board/a5ds/fdts/a5ds_tb_fw_config.dts b/plat/arm/board/a5ds/fdts/a5ds_tb_fw_config.dts
new file mode 100644
index 0000000..c66186f
--- /dev/null
+++ b/plat/arm/board/a5ds/fdts/a5ds_tb_fw_config.dts
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2020, Arm Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+/dts-v1/;
+
+/ {
+	tb_fw-config {
+		compatible = "arm,tb_fw";
+
+		/* Disable authentication for development */
+		disable_auth = <0x0>;
+	};
+};
diff --git a/plat/arm/board/a5ds/include/platform_def.h b/plat/arm/board/a5ds/include/platform_def.h
index ab0ff58..0745316 100644
--- a/plat/arm/board/a5ds/include/platform_def.h
+++ b/plat/arm/board/a5ds/include/platform_def.h
@@ -188,11 +188,11 @@
 #define CACHE_WRITEBACK_GRANULE		(U(1) << ARM_CACHE_WRITEBACK_SHIFT)
 
 /*
- * To enable TB_FW_CONFIG to be loaded by BL1, define the corresponding base
+ * To enable FW_CONFIG to be loaded by BL1, define the corresponding base
  * and limit. Leave enough space of BL2 meminfo.
  */
-#define ARM_TB_FW_CONFIG_BASE		(ARM_BL_RAM_BASE + sizeof(meminfo_t))
-#define ARM_TB_FW_CONFIG_LIMIT		(ARM_BL_RAM_BASE + PAGE_SIZE)
+#define ARM_FW_CONFIG_BASE		(ARM_BL_RAM_BASE + sizeof(meminfo_t))
+#define ARM_FW_CONFIG_LIMIT		(ARM_BL_RAM_BASE + PAGE_SIZE)
 
 /*******************************************************************************
  * BL1 specific defines.
@@ -220,7 +220,7 @@
 #define BL2_LIMIT			BL1_RW_BASE
 
 /* Put BL32 below BL2 in NS DRAM.*/
-#define ARM_BL2_MEM_DESC_BASE		ARM_TB_FW_CONFIG_LIMIT
+#define ARM_BL2_MEM_DESC_BASE		ARM_FW_CONFIG_LIMIT
 
 #define BL32_BASE			((ARM_BL_RAM_BASE + ARM_BL_RAM_SIZE)\
 						- PLAT_ARM_MAX_BL32_SIZE)
diff --git a/plat/arm/board/a5ds/platform.mk b/plat/arm/board/a5ds/platform.mk
index 3a4d5e5..7693e46 100644
--- a/plat/arm/board/a5ds/platform.mk
+++ b/plat/arm/board/a5ds/platform.mk
@@ -72,10 +72,13 @@
 # Add the FDT_SOURCES and options for Dynamic Config (only for Unix env)
 ifdef UNIX_MK
 
-FVP_TB_FW_CONFIG	:=	${BUILD_PLAT}/fdts/a5ds_fw_config.dtb
+FW_CONFIG	:=      ${BUILD_PLAT}/fdts/a5ds_fw_config.dtb
+TB_FW_CONFIG	:=	${BUILD_PLAT}/fdts/a5ds_tb_fw_config.dtb
 
 # Add the TB_FW_CONFIG to FIP and specify the same to certtool
-$(eval $(call TOOL_ADD_PAYLOAD,${FVP_TB_FW_CONFIG},--tb-fw-config))
+$(eval $(call TOOL_ADD_PAYLOAD,${TB_FW_CONFIG},--tb-fw-config))
+# Add the FW_CONFIG to FIP and specify the same to certtool
+$(eval $(call TOOL_ADD_PAYLOAD,${FW_CONFIG},--fw-config))
 
 $(eval FVP_HW_CONFIG	:=	${BUILD_PLAT}/$(patsubst %.dts,%.dtb, \
 	fdts/$(notdir ${FVP_HW_CONFIG_DTS})))
@@ -83,6 +86,7 @@
 $(eval $(call TOOL_ADD_PAYLOAD,${FVP_HW_CONFIG},--hw-config))
 
 FDT_SOURCES		+=	plat/arm/board/a5ds/fdts/a5ds_fw_config.dts \
+				plat/arm/board/a5ds/fdts/a5ds_tb_fw_config.dts \
 					${FVP_HW_CONFIG_DTS}
 endif
 
diff --git a/plat/arm/board/corstone700/include/platform_def.h b/plat/arm/board/corstone700/include/platform_def.h
index cc4dc3a..7799cec 100644
--- a/plat/arm/board/corstone700/include/platform_def.h
+++ b/plat/arm/board/corstone700/include/platform_def.h
@@ -83,11 +83,11 @@
 #define ARM_CACHE_WRITEBACK_SHIFT	6
 
 /*
- * To enable TB_FW_CONFIG to be loaded by BL1, define the corresponding base
+ * To enable FW_CONFIG to be loaded by BL1, define the corresponding base
  * and limit. Leave enough space for BL2 meminfo.
  */
-#define ARM_TB_FW_CONFIG_BASE		(ARM_BL_RAM_BASE + sizeof(meminfo_t))
-#define ARM_TB_FW_CONFIG_LIMIT		(ARM_BL_RAM_BASE + (PAGE_SIZE / 2U))
+#define ARM_FW_CONFIG_BASE		(ARM_BL_RAM_BASE + sizeof(meminfo_t))
+#define ARM_FW_CONFIG_LIMIT		(ARM_BL_RAM_BASE + (PAGE_SIZE / 2U))
 
 /*
  * The max number of regions like RO(code), coherent and data required by
diff --git a/plat/arm/board/fvp/fdts/fvp_fw_config.dts b/plat/arm/board/fvp/fdts/fvp_fw_config.dts
index 5f89284..09f2730 100644
--- a/plat/arm/board/fvp/fdts/fvp_fw_config.dts
+++ b/plat/arm/board/fvp/fdts/fvp_fw_config.dts
@@ -12,9 +12,8 @@
 	dtb-registry {
 		compatible = "fconf,dyn_cfg-dtb_registry";
 
-		/* tb_fw_config is temporarily contained on this dtb */
 		tb_fw-config {
-			load-address = <0x0 0x4001010>;
+			load-address = <0x0 0x4001300>;
 			max-size = <0x200>;
 			id = <TB_FW_CONFIG_ID>;
 		};
@@ -32,14 +31,14 @@
 		 * is loaded at base of DRAM.
 		 */
 		soc_fw-config {
-			load-address = <0x0 0x04001000>;
+			load-address = <0x0 0x04001300>;
 			max-size = <0x200>;
 			id = <SOC_FW_CONFIG_ID>;
 		};
 
 		tos_fw-config {
-			load-address = <0x0 0x04001200>;
-			max-size = <0x1000>;
+			load-address = <0x0 0x04001500>;
+			max-size = <0xB00>;
 			id = <TOS_FW_CONFIG_ID>;
 		};
 
@@ -49,83 +48,4 @@
 			id = <NT_FW_CONFIG_ID>;
 		};
 	};
-
-	tb_fw-config {
-		compatible = "arm,tb_fw";
-
-		/* Disable authentication for development */
-		disable_auth = <0x0>;
-
-		/*
-		 * The following two entries are placeholders for Mbed TLS
-		 * heap information. The default values don't matter since
-		 * they will be overwritten by BL1.
-		 * In case of having shared Mbed TLS heap between BL1 and BL2,
-		 * BL1 will populate these two properties with the respective
-		 * info about the shared heap. This info will be available for
-		 * BL2 in order to locate and re-use the heap.
-		 */
-		mbedtls_heap_addr = <0x0 0x0>;
-		mbedtls_heap_size = <0x0>;
-
-#if MEASURED_BOOT
-		/* BL2 image hash calculated by BL1 */
-		bl2_hash_data = [
-			00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
-#if BL2_HASH_SIZE > 32
-			00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
-#if BL2_HASH_SIZE > 48
-			00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
-#endif /* > 48 */
-#endif /* > 32 */
-			00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00];
-#endif /* MEASURED_BOOT */
-	};
-
-	/*
-	 * Though TF-A is UUID RFC 4122 compliant meaning fields are stored in
-	 * network order (big endian), UUID's mentioned in this file are are
-	 * stored in machine order (little endian).
-	 * This will be fixed in future.
-	 */
-#if ARM_IO_IN_DTB
-	arm-io_policies {
-		fip-handles {
-			compatible = "arm,io-fip-handle";
-			scp_bl2_uuid = <0x3dfd6697 0x49e8be89 0xa1785dae 0x13826040>;
-			bl31_uuid = <0x6d08d447 0x4698fe4c 0x5029959b 0x005abdcb>;
-			bl32_uuid = <0x89e1d005 0x4713dc53 0xa502b8d 0x383e7a4b>;
-			bl32_extra1_uuid = <0x9bc2700b 0x40785a2a 0x560a659f 0x88827382>;
-			bl32_extra2_uuid = <0xb17ba88e 0x4d3fa2cf 0xbbe7fd85 0xd92002a5>;
-			bl33_uuid = <0xa7eed0d6 0x4bd5eafc 0x34998297 0xe4b634f2>;
-			hw_cfg_uuid = <0xd9f1b808 0x4993cfc9 0xbc6f62a9 0xcc65726b>;
-			soc_fw_cfg_uuid = <0x4b817999 0x46fb7603 0x268d8e8c 0xe059787f>;
-			tos_fw_cfg_uuid = <0x1a7c2526 0x477fc6db 0xc4c4968d 0x218024b0>;
-			nt_fw_cfg_uuid = <0x1598da28 0x447ee893 0xaf1a66ac 0xf9501580>;
-			t_key_cert_uuid = <0x90e87e82 0x11e460f8 0x7a77b4a1 0x4cf9b421>;
-			scp_fw_key_uuid = <0xa1214202 0x11e460f8 0x3cf39b8d 0x14a0150e>;
-			soc_fw_key_uuid = <0xccbeb88a 0x11e460f9 0x48ebd09a 0xf8dcd822>;
-			tos_fw_key_cert_uuid = <0x3d67794 0x11e460fb 0x10b7dd85 0x4ee8c5b>;
-			nt_fw_key_cert_uuid = <0x2a83d58a 0x11e460fb 0x30dfaf8a 0x5998c4bb>;
-			scp_fw_content_cert_uuid = <0x046fbe44 0x11e4635e 0xd8738bb2 0x5696aeea>;
-			soc_fw_content_cert_uuid = <0x200cb2e2 0x11e4635e 0xccabe89c 0x66b62bf9>;
-			tos_fw_content_cert_uuid = <0x11449fa4 0x11e4635e 0x53f2887 0x3df32a72>;
-			nt_fw_content_cert_uuid = <0xf3c1c48e 0x11e4635d 0xee87a9a7 0xa73fb240>;
-			sp_content_cert_uuid = <0x44fd6d77 0x3b4c9786 0x3ec1eb91 0x6f2a5a02>;
-		};
-	};
-#endif /* ARM_IO_IN_DTB */
-
-	secure-partitions {
-		compatible = "arm,sp";
-		cactus-primary {
-			uuid = <0x1e67b5b4 0xe14f904a 0x13fb1fb8 0xcbdae1da>;
-			load-address = <0x7000000>;
-		};
-
-		cactus-secondary {
-			uuid = <0x092358d1 0xb94723f0 0x64447c82 0xc88f57f5>;
-			load-address = <0x7100000>;
-		};
-	};
 };
diff --git a/plat/arm/board/fvp/fdts/fvp_tb_fw_config.dts b/plat/arm/board/fvp/fdts/fvp_tb_fw_config.dts
new file mode 100644
index 0000000..9cffad3
--- /dev/null
+++ b/plat/arm/board/fvp/fdts/fvp_tb_fw_config.dts
@@ -0,0 +1,88 @@
+/*
+ * Copyright (c) 2020, ARM Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+/dts-v1/;
+
+/ {
+	tb_fw-config {
+		compatible = "arm,tb_fw";
+
+		/* Disable authentication for development */
+		disable_auth = <0x0>;
+
+		/*
+		 * The following two entries are placeholders for Mbed TLS
+		 * heap information. The default values don't matter since
+		 * they will be overwritten by BL1.
+		 * In case of having shared Mbed TLS heap between BL1 and BL2,
+		 * BL1 will populate these two properties with the respective
+		 * info about the shared heap. This info will be available for
+		 * BL2 in order to locate and re-use the heap.
+		 */
+		mbedtls_heap_addr = <0x0 0x0>;
+		mbedtls_heap_size = <0x0>;
+
+#if MEASURED_BOOT
+		/* BL2 image hash calculated by BL1 */
+		bl2_hash_data = [
+			00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+#if BL2_HASH_SIZE > 32
+			00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+#if BL2_HASH_SIZE > 48
+			00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+#endif /* > 48 */
+#endif /* > 32 */
+			00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00];
+#endif /* MEASURED_BOOT */
+	};
+
+	/*
+	 * Though TF-A is UUID RFC 4122 compliant meaning fields are stored in
+	 * network order (big endian), UUID's mentioned in this file are are
+	 * stored in machine order (little endian).
+	 * This will be fixed in future.
+	 */
+#if ARM_IO_IN_DTB
+	arm-io_policies {
+		fip-handles {
+			compatible = "arm,io-fip-handle";
+			scp_bl2_uuid = <0x3dfd6697 0x49e8be89 0xa1785dae 0x13826040>;
+			bl31_uuid = <0x6d08d447 0x4698fe4c 0x5029959b 0x005abdcb>;
+			bl32_uuid = <0x89e1d005 0x4713dc53 0xa502b8d 0x383e7a4b>;
+			bl32_extra1_uuid = <0x9bc2700b 0x40785a2a 0x560a659f 0x88827382>;
+			bl32_extra2_uuid = <0xb17ba88e 0x4d3fa2cf 0xbbe7fd85 0xd92002a5>;
+			bl33_uuid = <0xa7eed0d6 0x4bd5eafc 0x34998297 0xe4b634f2>;
+			hw_cfg_uuid = <0xd9f1b808 0x4993cfc9 0xbc6f62a9 0xcc65726b>;
+			soc_fw_cfg_uuid = <0x4b817999 0x46fb7603 0x268d8e8c 0xe059787f>;
+			tos_fw_cfg_uuid = <0x1a7c2526 0x477fc6db 0xc4c4968d 0x218024b0>;
+			nt_fw_cfg_uuid = <0x1598da28 0x447ee893 0xaf1a66ac 0xf9501580>;
+			t_key_cert_uuid = <0x90e87e82 0x11e460f8 0x7a77b4a1 0x4cf9b421>;
+			scp_fw_key_uuid = <0xa1214202 0x11e460f8 0x3cf39b8d 0x14a0150e>;
+			soc_fw_key_uuid = <0xccbeb88a 0x11e460f9 0x48ebd09a 0xf8dcd822>;
+			tos_fw_key_cert_uuid = <0x3d67794 0x11e460fb 0x10b7dd85 0x4ee8c5b>;
+			nt_fw_key_cert_uuid = <0x2a83d58a 0x11e460fb 0x30dfaf8a 0x5998c4bb>;
+			scp_fw_content_cert_uuid = <0x046fbe44 0x11e4635e 0xd8738bb2 0x5696aeea>;
+			soc_fw_content_cert_uuid = <0x200cb2e2 0x11e4635e 0xccabe89c 0x66b62bf9>;
+			tos_fw_content_cert_uuid = <0x11449fa4 0x11e4635e 0x53f2887 0x3df32a72>;
+			nt_fw_content_cert_uuid = <0xf3c1c48e 0x11e4635d 0xee87a9a7 0xa73fb240>;
+			sp_content_cert_uuid = <0x44fd6d77 0x3b4c9786 0x3ec1eb91 0x6f2a5a02>;
+		};
+	};
+#endif /* ARM_IO_IN_DTB */
+
+	secure-partitions {
+		compatible = "arm,sp";
+		cactus-primary {
+			uuid = <0x1e67b5b4 0xe14f904a 0x13fb1fb8 0xcbdae1da>;
+			load-address = <0x7000000>;
+		};
+
+		cactus-secondary {
+			uuid = <0x092358d1 0xb94723f0 0x64447c82 0xc88f57f5>;
+			load-address = <0x7100000>;
+		};
+	};
+};
diff --git a/plat/arm/board/fvp/fvp_bl2_setup.c b/plat/arm/board/fvp/fvp_bl2_setup.c
index 43b1374..d5618d9 100644
--- a/plat/arm/board/fvp/fvp_bl2_setup.c
+++ b/plat/arm/board/fvp/fvp_bl2_setup.c
@@ -4,7 +4,13 @@
  * SPDX-License-Identifier: BSD-3-Clause
  */
 
+#include <assert.h>
+
+#include <common/desc_image_load.h>
 #include <drivers/arm/sp804_delay_timer.h>
+#include <lib/fconf/fconf.h>
+#include <lib/fconf/fconf_dyn_cfg_getter.h>
+
 #include <plat/arm/common/plat_arm.h>
 #include <plat/common/platform.h>
 #include <platform_def.h>
@@ -26,3 +32,40 @@
 	/* Initialize System level generic or SP804 timer */
 	fvp_timer_init();
 }
+
+/*******************************************************************************
+ * This function returns the list of executable images
+ ******************************************************************************/
+struct bl_params *plat_get_next_bl_params(void)
+{
+	struct bl_params *arm_bl_params;
+
+	arm_bl_params = arm_get_next_bl_params();
+
+#if __aarch64__ && !BL2_AT_EL3
+	const struct dyn_cfg_dtb_info_t *fw_config_info;
+	bl_mem_params_node_t *param_node;
+	uintptr_t fw_config_base = 0U;
+	entry_point_info_t *ep_info;
+
+	/* Get BL31 image node */
+	param_node = get_bl_mem_params_node(BL31_IMAGE_ID);
+	assert(param_node != NULL);
+
+	/* get fw_config load address */
+	fw_config_info = FCONF_GET_PROPERTY(dyn_cfg, dtb, FW_CONFIG_ID);
+	assert(fw_config_info != NULL);
+
+	fw_config_base = fw_config_info->config_addr;
+	assert(fw_config_base != 0U);
+
+	/*
+	 * Get the entry point info of BL31 image and override
+	 * arg1 of entry point info with fw_config base address
+	 */
+	ep_info = &param_node->ep_info;
+	ep_info->args.arg1 = (uint32_t)fw_config_base;
+#endif /* __aarch64__ && !BL2_AT_EL3 */
+
+	return arm_bl_params;
+}
diff --git a/plat/arm/board/fvp/fvp_bl31_setup.c b/plat/arm/board/fvp/fvp_bl31_setup.c
index 4cc1c1b..f9ee449 100644
--- a/plat/arm/board/fvp/fvp_bl31_setup.c
+++ b/plat/arm/board/fvp/fvp_bl31_setup.c
@@ -9,6 +9,7 @@
 #include <drivers/arm/smmu_v3.h>
 #include <fconf_hw_config_getter.h>
 #include <lib/fconf/fconf.h>
+#include <lib/fconf/fconf_dyn_cfg_getter.h>
 #include <lib/mmio.h>
 #include <plat/arm/common/arm_config.h>
 #include <plat/arm/common/plat_arm.h>
@@ -16,11 +17,22 @@
 
 #include "fvp_private.h"
 
-uintptr_t hw_config_dtb;
-
 void __init bl31_early_platform_setup2(u_register_t arg0,
 		u_register_t arg1, u_register_t arg2, u_register_t arg3)
 {
+#if !RESET_TO_BL31 && !BL2_AT_EL3
+	const struct dyn_cfg_dtb_info_t *soc_fw_config_info;
+
+	INFO("BL31 FCONF: FW_CONFIG address = %lx\n", (uintptr_t)arg1);
+	/* Fill the properties struct with the info from the config dtb */
+	fconf_populate("FW_CONFIG", arg1);
+
+	soc_fw_config_info = FCONF_GET_PROPERTY(dyn_cfg, dtb, SOC_FW_CONFIG_ID);
+	if (soc_fw_config_info != NULL) {
+		arg1 = soc_fw_config_info->config_addr;
+	}
+#endif /* !RESET_TO_BL31 && !BL2_AT_EL3 */
+
 	arm_bl31_early_platform_setup((void *)arg0, arg1, arg2, (void *)arg3);
 
 	/* Initialize the platform config for future decision making */
@@ -47,8 +59,6 @@
 	/* On FVP RevC, initialize SMMUv3 */
 	if ((arm_config.flags & ARM_CONFIG_FVP_HAS_SMMUV3) != 0U)
 		smmuv3_init(PLAT_FVP_SMMUV3_BASE);
-
-	hw_config_dtb = arg2;
 }
 
 void __init bl31_plat_arch_setup(void)
@@ -61,10 +71,13 @@
 	 * control is passed to BL31.
 	 */
 #if !RESET_TO_BL31 && !BL2_AT_EL3
-	assert(hw_config_dtb != 0U);
+	/* HW_CONFIG was also loaded by BL2 */
+	const struct dyn_cfg_dtb_info_t *hw_config_info;
+
+	hw_config_info = FCONF_GET_PROPERTY(dyn_cfg, dtb, HW_CONFIG_ID);
+	assert(hw_config_info != NULL);
 
-	INFO("BL31 FCONF: HW_CONFIG address = %p\n", (void *)hw_config_dtb);
-	fconf_populate("HW_CONFIG", hw_config_dtb);
+	fconf_populate("HW_CONFIG", hw_config_info->config_addr);
 #endif
 }
 
diff --git a/plat/arm/board/fvp/include/platform_def.h b/plat/arm/board/fvp/include/platform_def.h
index 62ede9a..7222c55 100644
--- a/plat/arm/board/fvp/include/platform_def.h
+++ b/plat/arm/board/fvp/include/platform_def.h
@@ -133,7 +133,7 @@
  * calculated using the current BL31 PROGBITS debug size plus the sizes of
  * BL2 and BL1-RW
  */
-#define PLAT_ARM_MAX_BL31_SIZE		UL(0x3E000)
+#define PLAT_ARM_MAX_BL31_SIZE		UL(0x3D000)
 #endif /* RESET_TO_BL31 */
 
 #ifndef __aarch64__
diff --git a/plat/arm/board/fvp/platform.mk b/plat/arm/board/fvp/platform.mk
index 7d670ac..c3b49bb 100644
--- a/plat/arm/board/fvp/platform.mk
+++ b/plat/arm/board/fvp/platform.mk
@@ -217,6 +217,7 @@
 ifeq ($(filter 1,${BL2_AT_EL3} ${RESET_TO_BL31}),)
 BL31_SOURCES		+=	common/fdt_wrappers.c				\
 				lib/fconf/fconf.c				\
+				lib/fconf/fconf_dyn_cfg_getter.c		\
 				plat/arm/board/fvp/fconf/fconf_hw_config_getter.c
 
 ifeq (${SEC_INT_DESC_IN_FCONF},1)
@@ -236,11 +237,13 @@
 FVP_HW_CONFIG_DTS	:=	fdts/${FVP_DT_PREFIX}.dts
 FDT_SOURCES		+=	$(addprefix plat/arm/board/fvp/fdts/,	\
 					${PLAT}_fw_config.dts		\
+					${PLAT}_tb_fw_config.dts	\
 					${PLAT}_soc_fw_config.dts	\
 					${PLAT}_nt_fw_config.dts	\
 				)
 
-FVP_TB_FW_CONFIG	:=	${BUILD_PLAT}/fdts/${PLAT}_fw_config.dtb
+FVP_FW_CONFIG		:=	${BUILD_PLAT}/fdts/${PLAT}_fw_config.dtb
+FVP_TB_FW_CONFIG	:=	${BUILD_PLAT}/fdts/${PLAT}_tb_fw_config.dtb
 FVP_SOC_FW_CONFIG	:=	${BUILD_PLAT}/fdts/${PLAT}_soc_fw_config.dtb
 FVP_NT_FW_CONFIG	:=	${BUILD_PLAT}/fdts/${PLAT}_nt_fw_config.dtb
 
@@ -260,6 +263,8 @@
 $(eval $(call TOOL_ADD_PAYLOAD,${FVP_TOS_FW_CONFIG},--tos-fw-config))
 endif
 
+# Add the FW_CONFIG to FIP and specify the same to certtool
+$(eval $(call TOOL_ADD_PAYLOAD,${FVP_FW_CONFIG},--fw-config))
 # Add the TB_FW_CONFIG to FIP and specify the same to certtool
 $(eval $(call TOOL_ADD_PAYLOAD,${FVP_TB_FW_CONFIG},--tb-fw-config))
 # Add the SOC_FW_CONFIG to FIP and specify the same to certtool
diff --git a/plat/arm/board/fvp_ve/fdts/fvp_ve_fw_config.dts b/plat/arm/board/fvp_ve/fdts/fvp_ve_fw_config.dts
index d4f98d9..6e5691b 100644
--- a/plat/arm/board/fvp_ve/fdts/fvp_ve_fw_config.dts
+++ b/plat/arm/board/fvp_ve/fdts/fvp_ve_fw_config.dts
@@ -12,9 +12,8 @@
 	dtb-registry {
 		compatible = "fconf,dyn_cfg-dtb_registry";
 
-		/* tb_fw_config is temporarily contained on this dtb */
 		tb_fw-config {
-			load-address = <0x0 0x80001010>;
+			load-address = <0x0 0x80001300>;
 			max-size = <0x200>;
 			id = <TB_FW_CONFIG_ID>;
 		};
@@ -25,11 +24,4 @@
 			id = <HW_CONFIG_ID>;
 		};
 	};
-
-	tb_fw-config {
-		compatible = "arm,tb_fw";
-
-		/* Disable authentication for development */
-		disable_auth = <0x0>;
-	};
 };
diff --git a/plat/arm/board/fvp_ve/fdts/fvp_ve_tb_fw_config.dts b/plat/arm/board/fvp_ve/fdts/fvp_ve_tb_fw_config.dts
new file mode 100644
index 0000000..c66186f
--- /dev/null
+++ b/plat/arm/board/fvp_ve/fdts/fvp_ve_tb_fw_config.dts
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2020, Arm Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+/dts-v1/;
+
+/ {
+	tb_fw-config {
+		compatible = "arm,tb_fw";
+
+		/* Disable authentication for development */
+		disable_auth = <0x0>;
+	};
+};
diff --git a/plat/arm/board/fvp_ve/include/platform_def.h b/plat/arm/board/fvp_ve/include/platform_def.h
index 70a12ea..3591b4d 100644
--- a/plat/arm/board/fvp_ve/include/platform_def.h
+++ b/plat/arm/board/fvp_ve/include/platform_def.h
@@ -169,11 +169,11 @@
 #define CACHE_WRITEBACK_GRANULE		(U(1) << ARM_CACHE_WRITEBACK_SHIFT)
 
 /*
- * To enable TB_FW_CONFIG to be loaded by BL1, define the corresponding base
+ * To enable FW_CONFIG to be loaded by BL1, define the corresponding base
  * and limit. Leave enough space of BL2 meminfo.
  */
-#define ARM_TB_FW_CONFIG_BASE		(ARM_BL_RAM_BASE + sizeof(meminfo_t))
-#define ARM_TB_FW_CONFIG_LIMIT		(ARM_BL_RAM_BASE + PAGE_SIZE)
+#define ARM_FW_CONFIG_BASE		(ARM_BL_RAM_BASE + sizeof(meminfo_t))
+#define ARM_FW_CONFIG_LIMIT		(ARM_BL_RAM_BASE + PAGE_SIZE)
 
 /*******************************************************************************
  * BL1 specific defines.
@@ -204,7 +204,7 @@
 
 
 /* Put BL32 below BL2 in NS DRAM.*/
-#define ARM_BL2_MEM_DESC_BASE		ARM_TB_FW_CONFIG_LIMIT
+#define ARM_BL2_MEM_DESC_BASE		ARM_FW_CONFIG_LIMIT
 
 #define BL32_BASE			((ARM_BL_RAM_BASE + ARM_BL_RAM_SIZE)\
 						- PLAT_ARM_MAX_BL32_SIZE)
diff --git a/plat/arm/board/fvp_ve/platform.mk b/plat/arm/board/fvp_ve/platform.mk
index 9ada86b..62981c5 100644
--- a/plat/arm/board/fvp_ve/platform.mk
+++ b/plat/arm/board/fvp_ve/platform.mk
@@ -74,10 +74,14 @@
 # Add the FDT_SOURCES and options for Dynamic Config (only for Unix env)
 ifdef UNIX_MK
 
-FDT_SOURCES		+=	plat/arm/board/fvp_ve/fdts/fvp_ve_fw_config.dts
+FDT_SOURCES		+=	plat/arm/board/fvp_ve/fdts/fvp_ve_fw_config.dts	\
+				plat/arm/board/fvp_ve/fdts/fvp_ve_tb_fw_config.dts
 
-FVP_TB_FW_CONFIG	:=	${BUILD_PLAT}/fdts/fvp_ve_fw_config.dtb
+FVP_FW_CONFIG		:=	${BUILD_PLAT}/fdts/fvp_ve_fw_config.dtb
+FVP_TB_FW_CONFIG	:=	${BUILD_PLAT}/fdts/fvp_ve_tb_fw_config.dtb
 
+# Add the FW_CONFIG to FIP and specify the same to certtool
+$(eval $(call TOOL_ADD_PAYLOAD,${FVP_FW_CONFIG},--fw-config))
 # Add the TB_FW_CONFIG to FIP and specify the same to certtool
 $(eval $(call TOOL_ADD_PAYLOAD,${FVP_TB_FW_CONFIG},--tb-fw-config))
 
diff --git a/plat/arm/board/juno/fdts/juno_fw_config.dts b/plat/arm/board/juno/fdts/juno_fw_config.dts
index 60ca60d..c0538f8 100644
--- a/plat/arm/board/juno/fdts/juno_fw_config.dts
+++ b/plat/arm/board/juno/fdts/juno_fw_config.dts
@@ -12,29 +12,10 @@
 	dtb-registry {
 		compatible = "fconf,dyn_cfg-dtb_registry";
 
-		/* tb_fw_config is temporarily contained on this dtb */
 		tb_fw-config {
-			load-address = <0x0 0x4001010>;
+			load-address = <0x0 0x4001300>;
 			max-size = <0x200>;
 			id = <TB_FW_CONFIG_ID>;
 		};
 	};
-
-	tb_fw-config {
-		/* Platform Config */
-		compatible = "arm,tb_fw";
-		/* Disable authentication for development */
-		disable_auth = <0x0>;
-		/*
-		 * The following two entries are placeholders for Mbed TLS
-		 * heap information. The default values don't matter since
-		 * they will be overwritten by BL1.
-		 * In case of having shared Mbed TLS heap between BL1 and BL2,
-		 * BL1 will populate these two properties with the respective
-		 * info about the shared heap. This info will be available for
-		 * BL2 in order to locate and re-use the heap.
-		 */
-		mbedtls_heap_addr = <0x0 0x0>;
-		mbedtls_heap_size = <0x0>;
-	};
 };
diff --git a/plat/arm/board/juno/fdts/juno_tb_fw_config.dts b/plat/arm/board/juno/fdts/juno_tb_fw_config.dts
new file mode 100644
index 0000000..80cfa3e
--- /dev/null
+++ b/plat/arm/board/juno/fdts/juno_tb_fw_config.dts
@@ -0,0 +1,26 @@
+/*
+ * Copyright (c) 2020, ARM Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+/dts-v1/;
+
+/ {
+	tb_fw-config {
+		compatible = "arm,tb_fw";
+		/* Disable authentication for development */
+		disable_auth = <0x0>;
+		/*
+		 * The following two entries are placeholders for Mbed TLS
+		 * heap information. The default values don't matter since
+		 * they will be overwritten by BL1.
+		 * In case of having shared Mbed TLS heap between BL1 and BL2,
+		 * BL1 will populate these two properties with the respective
+		 * info about the shared heap. This info will be available for
+		 * BL2 in order to locate and re-use the heap.
+		 */
+		mbedtls_heap_addr = <0x0 0x0>;
+		mbedtls_heap_size = <0x0>;
+	};
+};
diff --git a/plat/arm/board/juno/include/platform_def.h b/plat/arm/board/juno/include/platform_def.h
index 67802d4..91c3ae7 100644
--- a/plat/arm/board/juno/include/platform_def.h
+++ b/plat/arm/board/juno/include/platform_def.h
@@ -139,7 +139,7 @@
 # define PLAT_ARM_MAX_BL2_SIZE	(UL(0x1D000) - JUNO_BL2_ROMLIB_OPTIMIZATION)
 #endif
 #else
-# define PLAT_ARM_MAX_BL2_SIZE	(UL(0x11000) - JUNO_BL2_ROMLIB_OPTIMIZATION)
+# define PLAT_ARM_MAX_BL2_SIZE	(UL(0x13000) - JUNO_BL2_ROMLIB_OPTIMIZATION)
 #endif
 
 /*
@@ -148,7 +148,7 @@
  * BL2 and BL1-RW.  SCP_BL2 image is loaded into the space BL31 -> BL2_BASE.
  * Hence the BL31 PROGBITS size should be >= PLAT_CSS_MAX_SCP_BL2_SIZE.
  */
-#define PLAT_ARM_MAX_BL31_SIZE		UL(0x3E000)
+#define PLAT_ARM_MAX_BL31_SIZE		UL(0x3D000)
 
 #if JUNO_AARCH32_EL3_RUNTIME
 /*
@@ -157,7 +157,7 @@
  * BL2 and BL1-RW.  SCP_BL2 image is loaded into the space BL32 -> BL2_BASE.
  * Hence the BL32 PROGBITS size should be >= PLAT_CSS_MAX_SCP_BL2_SIZE.
  */
-#define PLAT_ARM_MAX_BL32_SIZE		UL(0x3E000)
+#define PLAT_ARM_MAX_BL32_SIZE		UL(0x3D000)
 #endif
 
 /*
@@ -254,7 +254,7 @@
  * BL31 is loaded over the top.
  */
 #define PLAT_CSS_MAX_SCP_BL2_SIZE \
-	((SCP_BL2_LIMIT - ARM_TB_FW_CONFIG_LIMIT) & ~PAGE_SIZE_MASK)
+	((SCP_BL2_LIMIT - ARM_FW_CONFIG_LIMIT) & ~PAGE_SIZE_MASK)
 
 #define PLAT_CSS_MAX_SCP_BL2U_SIZE	PLAT_CSS_MAX_SCP_BL2_SIZE
 
diff --git a/plat/arm/board/juno/platform.mk b/plat/arm/board/juno/platform.mk
index a871e81..8ca7f61 100644
--- a/plat/arm/board/juno/platform.mk
+++ b/plat/arm/board/juno/platform.mk
@@ -164,9 +164,14 @@
 endif
 
 # Add the FDT_SOURCES and options for Dynamic Config
-FDT_SOURCES		+=	plat/arm/board/juno/fdts/${PLAT}_fw_config.dts
-TB_FW_CONFIG		:=	${BUILD_PLAT}/fdts/${PLAT}_fw_config.dtb
+FDT_SOURCES		+=	plat/arm/board/juno/fdts/${PLAT}_fw_config.dts	\
+				plat/arm/board/juno/fdts/${PLAT}_tb_fw_config.dts
+
+FW_CONFIG		:=	${BUILD_PLAT}/fdts/${PLAT}_fw_config.dtb
+TB_FW_CONFIG		:=	${BUILD_PLAT}/fdts/${PLAT}_tb_fw_config.dtb
 
+# Add the FW_CONFIG to FIP and specify the same to certtool
+$(eval $(call TOOL_ADD_PAYLOAD,${FW_CONFIG},--fw-config))
 # Add the TB_FW_CONFIG to FIP and specify the same to certtool
 $(eval $(call TOOL_ADD_PAYLOAD,${TB_FW_CONFIG},--tb-fw-config))
 
diff --git a/plat/arm/board/rddaniel/fdts/rddaniel_fw_config.dts b/plat/arm/board/rddaniel/fdts/rddaniel_fw_config.dts
index b9265ad..9c9cefe 100644
--- a/plat/arm/board/rddaniel/fdts/rddaniel_fw_config.dts
+++ b/plat/arm/board/rddaniel/fdts/rddaniel_fw_config.dts
@@ -12,9 +12,8 @@
 	dtb-registry {
 		compatible = "fconf,dyn_cfg-dtb_registry";
 
-		/* tb_fw_config is temporarily contained on this dtb */
 		tb_fw-config {
-			load-address = <0x0 0x4001010>;
+			load-address = <0x0 0x4001300>;
 			max-size = <0x200>;
 			id = <TB_FW_CONFIG_ID>;
 		};
@@ -25,23 +24,4 @@
 			id = <NT_FW_CONFIG_ID>;
 		};
 	};
-
-	tb_fw-config {
-		compatible = "arm,tb_fw";
-
-		/* Disable authentication for development */
-		disable_auth = <0x0>;
-
-		/*
-		 * The following two entries are placeholders for Mbed TLS
-		 * heap information. The default values don't matter since
-		 * they will be overwritten by BL1.
-		 * In case of having shared Mbed TLS heap between BL1 and BL2,
-		 * BL1 will populate these two properties with the respective
-		 * info about the shared heap. This info will be available for
-		 * BL2 in order to locate and re-use the heap.
-		 */
-		mbedtls_heap_addr = <0x0 0x0>;
-		mbedtls_heap_size = <0x0>;
-	};
 };
diff --git a/plat/arm/board/rddaniel/fdts/rddaniel_tb_fw_config.dts b/plat/arm/board/rddaniel/fdts/rddaniel_tb_fw_config.dts
new file mode 100644
index 0000000..49eda27
--- /dev/null
+++ b/plat/arm/board/rddaniel/fdts/rddaniel_tb_fw_config.dts
@@ -0,0 +1,28 @@
+/*
+ * Copyright (c) 2020, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+/dts-v1/;
+
+/ {
+	tb_fw-config {
+		compatible = "arm,tb_fw";
+
+		/* Disable authentication for development */
+		disable_auth = <0x0>;
+
+		/*
+		 * The following two entries are placeholders for Mbed TLS
+		 * heap information. The default values don't matter since
+		 * they will be overwritten by BL1.
+		 * In case of having shared Mbed TLS heap between BL1 and BL2,
+		 * BL1 will populate these two properties with the respective
+		 * info about the shared heap. This info will be available for
+		 * BL2 in order to locate and re-use the heap.
+		 */
+		mbedtls_heap_addr = <0x0 0x0>;
+		mbedtls_heap_size = <0x0>;
+	};
+};
diff --git a/plat/arm/board/rddaniel/platform.mk b/plat/arm/board/rddaniel/platform.mk
index 94a3928..bdf20ca 100644
--- a/plat/arm/board/rddaniel/platform.mk
+++ b/plat/arm/board/rddaniel/platform.mk
@@ -33,9 +33,13 @@
 				plat/arm/common/arm_nor_psci_mem_protect.c
 
 # Add the FDT_SOURCES and options for Dynamic Config
-FDT_SOURCES		+=	${RDDANIEL_BASE}/fdts/${PLAT}_fw_config.dts
-TB_FW_CONFIG		:=	${BUILD_PLAT}/fdts/${PLAT}_fw_config.dtb
+FDT_SOURCES		+=	${RDDANIEL_BASE}/fdts/${PLAT}_fw_config.dts	\
+				${RDDANIEL_BASE}/fdts/${PLAT}_tb_fw_config.dts
+FW_CONFIG		:=	${BUILD_PLAT}/fdts/${PLAT}_fw_config.dtb
+TB_FW_CONFIG		:=	${BUILD_PLAT}/fdts/${PLAT}_tb_fw_config.dtb
 
+# Add the FW_CONFIG to FIP and specify the same to certtool
+$(eval $(call TOOL_ADD_PAYLOAD,${FW_CONFIG},--fw-config))
 # Add the TB_FW_CONFIG to FIP and specify the same to certtool
 $(eval $(call TOOL_ADD_PAYLOAD,${TB_FW_CONFIG},--tb-fw-config))
 
diff --git a/plat/arm/board/rddanielxlr/fdts/rddanielxlr_fw_config.dts b/plat/arm/board/rddanielxlr/fdts/rddanielxlr_fw_config.dts
index b9265ad..9c9cefe 100644
--- a/plat/arm/board/rddanielxlr/fdts/rddanielxlr_fw_config.dts
+++ b/plat/arm/board/rddanielxlr/fdts/rddanielxlr_fw_config.dts
@@ -12,9 +12,8 @@
 	dtb-registry {
 		compatible = "fconf,dyn_cfg-dtb_registry";
 
-		/* tb_fw_config is temporarily contained on this dtb */
 		tb_fw-config {
-			load-address = <0x0 0x4001010>;
+			load-address = <0x0 0x4001300>;
 			max-size = <0x200>;
 			id = <TB_FW_CONFIG_ID>;
 		};
@@ -25,23 +24,4 @@
 			id = <NT_FW_CONFIG_ID>;
 		};
 	};
-
-	tb_fw-config {
-		compatible = "arm,tb_fw";
-
-		/* Disable authentication for development */
-		disable_auth = <0x0>;
-
-		/*
-		 * The following two entries are placeholders for Mbed TLS
-		 * heap information. The default values don't matter since
-		 * they will be overwritten by BL1.
-		 * In case of having shared Mbed TLS heap between BL1 and BL2,
-		 * BL1 will populate these two properties with the respective
-		 * info about the shared heap. This info will be available for
-		 * BL2 in order to locate and re-use the heap.
-		 */
-		mbedtls_heap_addr = <0x0 0x0>;
-		mbedtls_heap_size = <0x0>;
-	};
 };
diff --git a/plat/arm/board/rddanielxlr/fdts/rddanielxlr_tb_fw_config.dts b/plat/arm/board/rddanielxlr/fdts/rddanielxlr_tb_fw_config.dts
new file mode 100644
index 0000000..49eda27
--- /dev/null
+++ b/plat/arm/board/rddanielxlr/fdts/rddanielxlr_tb_fw_config.dts
@@ -0,0 +1,28 @@
+/*
+ * Copyright (c) 2020, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+/dts-v1/;
+
+/ {
+	tb_fw-config {
+		compatible = "arm,tb_fw";
+
+		/* Disable authentication for development */
+		disable_auth = <0x0>;
+
+		/*
+		 * The following two entries are placeholders for Mbed TLS
+		 * heap information. The default values don't matter since
+		 * they will be overwritten by BL1.
+		 * In case of having shared Mbed TLS heap between BL1 and BL2,
+		 * BL1 will populate these two properties with the respective
+		 * info about the shared heap. This info will be available for
+		 * BL2 in order to locate and re-use the heap.
+		 */
+		mbedtls_heap_addr = <0x0 0x0>;
+		mbedtls_heap_size = <0x0>;
+	};
+};
diff --git a/plat/arm/board/rddanielxlr/platform.mk b/plat/arm/board/rddanielxlr/platform.mk
index 36a0099..1482c81 100644
--- a/plat/arm/board/rddanielxlr/platform.mk
+++ b/plat/arm/board/rddanielxlr/platform.mk
@@ -36,9 +36,13 @@
 BL31_CFLAGS		+=	-DPLAT_XLAT_TABLES_DYNAMIC
 
 # Add the FDT_SOURCES and options for Dynamic Config
-FDT_SOURCES		+=	${RDDANIELXLR_BASE}/fdts/${PLAT}_fw_config.dts
-TB_FW_CONFIG		:=	${BUILD_PLAT}/fdts/${PLAT}_fw_config.dtb
+FDT_SOURCES		+=	${RDDANIELXLR_BASE}/fdts/${PLAT}_fw_config.dts	\
+				${RDDANIELXLR_BASE}/fdts/${PLAT}_tb_fw_config.dts
+FW_CONFIG		:=	${BUILD_PLAT}/fdts/${PLAT}_fw_config.dtb
+TB_FW_CONFIG		:=	${BUILD_PLAT}/fdts/${PLAT}_tb_fw_config.dtb
 
+# Add the FW_CONFIG to FIP and specify the same to certtool
+$(eval $(call TOOL_ADD_PAYLOAD,${FW_CONFIG},--fw-config))
 # Add the TB_FW_CONFIG to FIP and specify the same to certtool
 $(eval $(call TOOL_ADD_PAYLOAD,${TB_FW_CONFIG},--tb-fw-config))
 
diff --git a/plat/arm/board/rde1edge/fdts/rde1edge_fw_config.dts b/plat/arm/board/rde1edge/fdts/rde1edge_fw_config.dts
index 09b9867..69fb0d4 100644
--- a/plat/arm/board/rde1edge/fdts/rde1edge_fw_config.dts
+++ b/plat/arm/board/rde1edge/fdts/rde1edge_fw_config.dts
@@ -12,9 +12,8 @@
 	dtb-registry {
 		compatible = "fconf,dyn_cfg-dtb_registry";
 
-		/* tb_fw_config is temporarily contained on this dtb */
 		tb_fw-config {
-			load-address = <0x0 0x4001010>;
+			load-address = <0x0 0x4001300>;
 			max-size = <0x200>;
 			id = <TB_FW_CONFIG_ID>;
 		};
@@ -25,23 +24,4 @@
 			id = <NT_FW_CONFIG_ID>;
 		};
 	};
-
-	tb_fw-config {
-		compatible = "arm,tb_fw";
-
-		/* Disable authentication for development */
-		disable_auth = <0x0>;
-
-		/*
-		 * The following two entries are placeholders for Mbed TLS
-		 * heap information. The default values don't matter since
-		 * they will be overwritten by BL1.
-		 * In case of having shared Mbed TLS heap between BL1 and BL2,
-		 * BL1 will populate these two properties with the respective
-		 * info about the shared heap. This info will be available for
-		 * BL2 in order to locate and re-use the heap.
-		 */
-		mbedtls_heap_addr = <0x0 0x0>;
-		mbedtls_heap_size = <0x0>;
-	};
 };
diff --git a/plat/arm/board/rde1edge/fdts/rde1edge_tb_fw_config.dts b/plat/arm/board/rde1edge/fdts/rde1edge_tb_fw_config.dts
new file mode 100644
index 0000000..dba91e5
--- /dev/null
+++ b/plat/arm/board/rde1edge/fdts/rde1edge_tb_fw_config.dts
@@ -0,0 +1,28 @@
+/*
+ * Copyright (c) 2020, ARM Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+/dts-v1/;
+
+/ {
+	tb_fw-config {
+		compatible = "arm,tb_fw";
+
+		/* Disable authentication for development */
+		disable_auth = <0x0>;
+
+		/*
+		 * The following two entries are placeholders for Mbed TLS
+		 * heap information. The default values don't matter since
+		 * they will be overwritten by BL1.
+		 * In case of having shared Mbed TLS heap between BL1 and BL2,
+		 * BL1 will populate these two properties with the respective
+		 * info about the shared heap. This info will be available for
+		 * BL2 in order to locate and re-use the heap.
+		 */
+		mbedtls_heap_addr = <0x0 0x0>;
+		mbedtls_heap_size = <0x0>;
+	};
+};
diff --git a/plat/arm/board/rde1edge/platform.mk b/plat/arm/board/rde1edge/platform.mk
index 1a4dd17..e09afca 100644
--- a/plat/arm/board/rde1edge/platform.mk
+++ b/plat/arm/board/rde1edge/platform.mk
@@ -35,9 +35,13 @@
 endif
 
 # Add the FDT_SOURCES and options for Dynamic Config
-FDT_SOURCES		+=	${RDE1EDGE_BASE}/fdts/${PLAT}_fw_config.dts
-TB_FW_CONFIG		:=	${BUILD_PLAT}/fdts/${PLAT}_fw_config.dtb
+FDT_SOURCES		+=	${RDE1EDGE_BASE}/fdts/${PLAT}_fw_config.dts	\
+				${RDE1EDGE_BASE}/fdts/${PLAT}_tb_fw_config.dts
+FW_CONFIG		:=	${BUILD_PLAT}/fdts/${PLAT}_fw_config.dtb
+TB_FW_CONFIG		:=	${BUILD_PLAT}/fdts/${PLAT}_tb_fw_config.dtb
 
+# Add the FW_CONFIG to FIP and specify the same to certtool
+$(eval $(call TOOL_ADD_PAYLOAD,${FW_CONFIG},--fw-config))
 # Add the TB_FW_CONFIG to FIP and specify the same to certtool
 $(eval $(call TOOL_ADD_PAYLOAD,${TB_FW_CONFIG},--tb-fw-config))
 
diff --git a/plat/arm/board/rdn1edge/fdts/rdn1edge_fw_config.dts b/plat/arm/board/rdn1edge/fdts/rdn1edge_fw_config.dts
index c9dee60..d3b7fba 100644
--- a/plat/arm/board/rdn1edge/fdts/rdn1edge_fw_config.dts
+++ b/plat/arm/board/rdn1edge/fdts/rdn1edge_fw_config.dts
@@ -11,9 +11,8 @@
 	dtb-registry {
 		compatible = "fconf,dyn_cfg-dtb_registry";
 
-		/* tb_fw_config is temporarily contained on this dtb */
 		tb_fw-config {
-			load-address = <0x0 0x4001010>;
+			load-address = <0x0 0x4001300>;
 			max-size = <0x200>;
 			id = <TB_FW_CONFIG_ID>;
 		};
@@ -24,24 +23,5 @@
 			id = <NT_FW_CONFIG_ID>;
 		};
 	};
-
-	tb_fw-config {
-		compatible = "arm,tb_fw";
-
-		/* Disable authentication for development */
-		disable_auth = <0x0>;
-
-		/*
-		 * The following two entries are placeholders for Mbed TLS
-		 * heap information. The default values don't matter since
-		 * they will be overwritten by BL1.
-		 * In case of having shared Mbed TLS heap between BL1 and BL2,
-		 * BL1 will populate these two properties with the respective
-		 * info about the shared heap. This info will be available for
-		 * BL2 in order to locate and re-use the heap.
-		 */
-		mbedtls_heap_addr = <0x0 0x0>;
-		mbedtls_heap_size = <0x0>;
-	};
 };
 
diff --git a/plat/arm/board/rdn1edge/fdts/rdn1edge_tb_fw_config.dts b/plat/arm/board/rdn1edge/fdts/rdn1edge_tb_fw_config.dts
new file mode 100644
index 0000000..257ef4a
--- /dev/null
+++ b/plat/arm/board/rdn1edge/fdts/rdn1edge_tb_fw_config.dts
@@ -0,0 +1,27 @@
+/*
+ * Copyright (c) 2020, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+/dts-v1/;
+/ {
+	tb_fw-config {
+		compatible = "arm,tb_fw";
+
+		/* Disable authentication for development */
+		disable_auth = <0x0>;
+
+		/*
+		 * The following two entries are placeholders for Mbed TLS
+		 * heap information. The default values don't matter since
+		 * they will be overwritten by BL1.
+		 * In case of having shared Mbed TLS heap between BL1 and BL2,
+		 * BL1 will populate these two properties with the respective
+		 * info about the shared heap. This info will be available for
+		 * BL2 in order to locate and re-use the heap.
+		 */
+		mbedtls_heap_addr = <0x0 0x0>;
+		mbedtls_heap_size = <0x0>;
+	};
+};
diff --git a/plat/arm/board/rdn1edge/platform.mk b/plat/arm/board/rdn1edge/platform.mk
index e436542..3f0cc7f 100644
--- a/plat/arm/board/rdn1edge/platform.mk
+++ b/plat/arm/board/rdn1edge/platform.mk
@@ -41,9 +41,13 @@
 BL31_CPPFLAGS		+=	-DPLAT_XLAT_TABLES_DYNAMIC
 
 # Add the FDT_SOURCES and options for Dynamic Config
-FDT_SOURCES		+=	${RDN1EDGE_BASE}/fdts/${PLAT}_fw_config.dts
-TB_FW_CONFIG		:=	${BUILD_PLAT}/fdts/${PLAT}_fw_config.dtb
+FDT_SOURCES		+=	${RDN1EDGE_BASE}/fdts/${PLAT}_fw_config.dts	\
+				${RDN1EDGE_BASE}/fdts/${PLAT}_tb_fw_config.dts
+FW_CONFIG		:=	${BUILD_PLAT}/fdts/${PLAT}_fw_config.dtb
+TB_FW_CONFIG		:=	${BUILD_PLAT}/fdts/${PLAT}_tb_fw_config.dtb
 
+# Add the FW_CONFIG to FIP and specify the same to certtool
+$(eval $(call TOOL_ADD_PAYLOAD,${FW_CONFIG},--fw-config))
 # Add the TB_FW_CONFIG to FIP and specify the same to certtool
 $(eval $(call TOOL_ADD_PAYLOAD,${TB_FW_CONFIG},--tb-fw-config))
 
diff --git a/plat/arm/board/sgi575/fdts/sgi575_fw_config.dts b/plat/arm/board/sgi575/fdts/sgi575_fw_config.dts
index 94d0e39..84fc1ad 100644
--- a/plat/arm/board/sgi575/fdts/sgi575_fw_config.dts
+++ b/plat/arm/board/sgi575/fdts/sgi575_fw_config.dts
@@ -12,9 +12,8 @@
 	dtb-registry {
 		compatible = "fconf,dyn_cfg-dtb_registry";
 
-		/* tb_fw_config is temporarily contained on this dtb */
 		tb_fw-config {
-			load-address = <0x0 0x4001010>;
+			load-address = <0x0 0x4001300>;
 			max-size = <0x200>;
 			id = <TB_FW_CONFIG_ID>;
 		};
@@ -25,23 +24,4 @@
 			id = <NT_FW_CONFIG_ID>;
 		};
 	};
-
-	tb_fw-config {
-		compatible = "arm,tb_fw";
-
-		/* Disable authentication for development */
-		disable_auth = <0x0>;
-
-		/*
-		 * The following two entries are placeholders for Mbed TLS
-		 * heap information. The default values don't matter since
-		 * they will be overwritten by BL1.
-		 * In case of having shared Mbed TLS heap between BL1 and BL2,
-		 * BL1 will populate these two properties with the respective
-		 * info about the shared heap. This info will be available for
-		 * BL2 in order to locate and re-use the heap.
-		 */
-		mbedtls_heap_addr = <0x0 0x0>;
-		mbedtls_heap_size = <0x0>;
-	};
 };
diff --git a/plat/arm/board/sgi575/fdts/sgi575_tb_fw_config.dts b/plat/arm/board/sgi575/fdts/sgi575_tb_fw_config.dts
new file mode 100644
index 0000000..49eda27
--- /dev/null
+++ b/plat/arm/board/sgi575/fdts/sgi575_tb_fw_config.dts
@@ -0,0 +1,28 @@
+/*
+ * Copyright (c) 2020, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+/dts-v1/;
+
+/ {
+	tb_fw-config {
+		compatible = "arm,tb_fw";
+
+		/* Disable authentication for development */
+		disable_auth = <0x0>;
+
+		/*
+		 * The following two entries are placeholders for Mbed TLS
+		 * heap information. The default values don't matter since
+		 * they will be overwritten by BL1.
+		 * In case of having shared Mbed TLS heap between BL1 and BL2,
+		 * BL1 will populate these two properties with the respective
+		 * info about the shared heap. This info will be available for
+		 * BL2 in order to locate and re-use the heap.
+		 */
+		mbedtls_heap_addr = <0x0 0x0>;
+		mbedtls_heap_size = <0x0>;
+	};
+};
diff --git a/plat/arm/board/sgi575/platform.mk b/plat/arm/board/sgi575/platform.mk
index d91f829..f5d547d 100644
--- a/plat/arm/board/sgi575/platform.mk
+++ b/plat/arm/board/sgi575/platform.mk
@@ -35,9 +35,14 @@
 endif
 
 # Add the FDT_SOURCES and options for Dynamic Config
-FDT_SOURCES		+=	${SGI575_BASE}/fdts/${PLAT}_fw_config.dts
-TB_FW_CONFIG		:=	${BUILD_PLAT}/fdts/${PLAT}_fw_config.dtb
+FDT_SOURCES		+=	${SGI575_BASE}/fdts/${PLAT}_fw_config.dts	\
+				${SGI575_BASE}/fdts/${PLAT}_tb_fw_config.dts
+
+FW_CONFIG		:=	${BUILD_PLAT}/fdts/${PLAT}_fw_config.dtb
+TB_FW_CONFIG		:=	${BUILD_PLAT}/fdts/${PLAT}_tb_fw_config.dtb
 
+# Add the FW_CONFIG to FIP and specify the same to certtool
+$(eval $(call TOOL_ADD_PAYLOAD,${FW_CONFIG},--fw-config))
 # Add the TB_FW_CONFIG to FIP and specify the same to certtool
 $(eval $(call TOOL_ADD_PAYLOAD,${TB_FW_CONFIG},--tb-fw-config))
 
diff --git a/plat/arm/board/sgm775/fdts/sgm775_fw_config.dts b/plat/arm/board/sgm775/fdts/sgm775_fw_config.dts
index c92c1d0..5d478e9 100644
--- a/plat/arm/board/sgm775/fdts/sgm775_fw_config.dts
+++ b/plat/arm/board/sgm775/fdts/sgm775_fw_config.dts
@@ -12,30 +12,10 @@
 	dtb-registry {
 		compatible = "fconf,dyn_cfg-dtb_registry";
 
-		/* tb_fw_config is temporarily contained on this dtb */
 		tb_fw-config {
-			load-address = <0x0 0x4001010>;
+			load-address = <0x0 0x4001300>;
 			max-size = <0x200>;
 			id = <TB_FW_CONFIG_ID>;
 		};
 	};
-
-	tb_fw-config {
-		compatible = "arm,tb_fw";
-
-		/* Disable authentication for development */
-		disable_auth = <0x0>;
-
-		/*
-		 * The following two entries are placeholders for Mbed TLS
-		 * heap information. The default values don't matter since
-		 * they will be overwritten by BL1.
-		 * In case of having shared Mbed TLS heap between BL1 and BL2,
-		 * BL1 will populate these two properties with the respective
-		 * info about the shared heap. This info will be available for
-		 * BL2 in order to locate and re-use the heap.
-		 */
-		mbedtls_heap_addr = <0x0 0x0>;
-		mbedtls_heap_size = <0x0>;
-	};
 };
diff --git a/plat/arm/board/sgm775/fdts/sgm775_tb_fw_config.dts b/plat/arm/board/sgm775/fdts/sgm775_tb_fw_config.dts
new file mode 100644
index 0000000..49eda27
--- /dev/null
+++ b/plat/arm/board/sgm775/fdts/sgm775_tb_fw_config.dts
@@ -0,0 +1,28 @@
+/*
+ * Copyright (c) 2020, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+/dts-v1/;
+
+/ {
+	tb_fw-config {
+		compatible = "arm,tb_fw";
+
+		/* Disable authentication for development */
+		disable_auth = <0x0>;
+
+		/*
+		 * The following two entries are placeholders for Mbed TLS
+		 * heap information. The default values don't matter since
+		 * they will be overwritten by BL1.
+		 * In case of having shared Mbed TLS heap between BL1 and BL2,
+		 * BL1 will populate these two properties with the respective
+		 * info about the shared heap. This info will be available for
+		 * BL2 in order to locate and re-use the heap.
+		 */
+		mbedtls_heap_addr = <0x0 0x0>;
+		mbedtls_heap_size = <0x0>;
+	};
+};
diff --git a/plat/arm/board/sgm775/platform.mk b/plat/arm/board/sgm775/platform.mk
index 57edb92..26bc25d 100644
--- a/plat/arm/board/sgm775/platform.mk
+++ b/plat/arm/board/sgm775/platform.mk
@@ -9,9 +9,13 @@
 SGM775_BASE= plat/arm/board/sgm775
 
 # Add the FDT_SOURCES and options for Dynamic Config
-FDT_SOURCES            +=      ${SGM775_BASE}/fdts/${PLAT}_fw_config.dts
-TB_FW_CONFIG           :=      ${BUILD_PLAT}/fdts/${PLAT}_fw_config.dtb
+FDT_SOURCES		+=      ${SGM775_BASE}/fdts/${PLAT}_fw_config.dts	\
+				${SGM775_BASE}/fdts/${PLAT}_tb_fw_config.dts
+FW_CONFIG		:=      ${BUILD_PLAT}/fdts/${PLAT}_fw_config.dtb
+TB_FW_CONFIG		:=      ${BUILD_PLAT}/fdts/${PLAT}_tb_fw_config.dtb
 
+# Add the FW_CONFIG to FIP and specify the same to certtool
+$(eval $(call TOOL_ADD_PAYLOAD,${FW_CONFIG},--fw-config))
 # Add the TB_FW_CONFIG to FIP and specify the same to certtool
 $(eval $(call TOOL_ADD_PAYLOAD,${TB_FW_CONFIG},--tb-fw-config))
 
diff --git a/plat/arm/board/tc0/fdts/tc0_fw_config.dts b/plat/arm/board/tc0/fdts/tc0_fw_config.dts
index 8458e08..381ce1f 100644
--- a/plat/arm/board/tc0/fdts/tc0_fw_config.dts
+++ b/plat/arm/board/tc0/fdts/tc0_fw_config.dts
@@ -12,9 +12,8 @@
 	dtb-registry {
 		compatible = "fconf,dyn_cfg-dtb_registry";
 
-		/* tb_fw_config is temporarily contained in this dtb */
 		tb_fw-config {
-			load-address = <0x0 0x4001010>;
+			load-address = <0x0 0x4001300>;
 			max-size = <0x200>;
 			id = <TB_FW_CONFIG_ID>;
 		};
@@ -25,22 +24,4 @@
 			id = <HW_CONFIG_ID>;
 		};
 	};
-
-	tb_fw-config {
-		compatible = "arm,tb_fw";
-
-		/* Disable authentication for development */
-		disable_auth = <0x0>;
-		/*
-		 * The following two entries are placeholders for Mbed TLS
-		 * heap information. The default values don't matter since
-		 * they will be overwritten by BL1.
-		 * In case of having shared Mbed TLS heap between BL1 and BL2,
-		 * BL1 will populate these two properties with the respective
-		 * info about the shared heap. This info will be available for
-		 * BL2 in order to locate and re-use the heap.
-		 */
-		mbedtls_heap_addr = <0x0 0x0>;
-		mbedtls_heap_size = <0x0>;
-	};
 };
diff --git a/plat/arm/board/tc0/fdts/tc0_tb_fw_config.dts b/plat/arm/board/tc0/fdts/tc0_tb_fw_config.dts
new file mode 100644
index 0000000..2fd25d9
--- /dev/null
+++ b/plat/arm/board/tc0/fdts/tc0_tb_fw_config.dts
@@ -0,0 +1,27 @@
+/*
+ * Copyright (c) 2020, Arm Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+/dts-v1/;
+
+/ {
+	tb_fw-config {
+		compatible = "arm,tb_fw";
+
+		/* Disable authentication for development */
+		disable_auth = <0x0>;
+		/*
+		 * The following two entries are placeholders for Mbed TLS
+		 * heap information. The default values don't matter since
+		 * they will be overwritten by BL1.
+		 * In case of having shared Mbed TLS heap between BL1 and BL2,
+		 * BL1 will populate these two properties with the respective
+		 * info about the shared heap. This info will be available for
+		 * BL2 in order to locate and re-use the heap.
+		 */
+		mbedtls_heap_addr = <0x0 0x0>;
+		mbedtls_heap_size = <0x0>;
+	};
+};
diff --git a/plat/arm/board/tc0/platform.mk b/plat/arm/board/tc0/platform.mk
index 7f514cc..0bf18e4 100644
--- a/plat/arm/board/tc0/platform.mk
+++ b/plat/arm/board/tc0/platform.mk
@@ -73,9 +73,13 @@
 				plat/arm/common/arm_nor_psci_mem_protect.c
 
 # Add the FDT_SOURCES and options for Dynamic Config
-FDT_SOURCES		+=	${TC0_BASE}/fdts/${PLAT}_fw_config.dts
-TB_FW_CONFIG		:=	${BUILD_PLAT}/fdts/${PLAT}_fw_config.dtb
+FDT_SOURCES		+=	${TC0_BASE}/fdts/${PLAT}_fw_config.dts	\
+				${TC0_BASE}/fdts/${PLAT}_tb_fw_config.dts
+FW_CONFIG		:=	${BUILD_PLAT}/fdts/${PLAT}_fw_config.dtb
+TB_FW_CONFIG		:=	${BUILD_PLAT}/fdts/${PLAT}_tb_fw_config.dtb
 
+# Add the FW_CONFIG to FIP and specify the same to certtool
+$(eval $(call TOOL_ADD_PAYLOAD,${FW_CONFIG},--fw-config))
 # Add the TB_FW_CONFIG to FIP and specify the same to certtool
 $(eval $(call TOOL_ADD_PAYLOAD,${TB_FW_CONFIG},--tb-fw-config))
 
diff --git a/plat/arm/common/arm_bl1_setup.c b/plat/arm/common/arm_bl1_setup.c
index c2f49c2..6b630b9 100644
--- a/plat/arm/common/arm_bl1_setup.c
+++ b/plat/arm/common/arm_bl1_setup.c
@@ -12,6 +12,7 @@
 #include <bl1/bl1.h>
 #include <common/bl_common.h>
 #include <lib/fconf/fconf.h>
+#include <lib/fconf/fconf_dyn_cfg_getter.h>
 #include <lib/utils.h>
 #include <lib/xlat_tables/xlat_tables_compat.h>
 #include <plat/arm/common/plat_arm.h>
@@ -142,11 +143,58 @@
  */
 void arm_bl1_platform_setup(void)
 {
+	const struct dyn_cfg_dtb_info_t *fw_config_info;
+	image_desc_t *desc;
+	uint32_t fw_config_max_size;
+	int err = -1;
+
 	/* Initialise the IO layer and register platform IO devices */
 	plat_arm_io_setup();
 
+	/* Check if we need FWU before further processing */
+	err = plat_arm_bl1_fwu_needed();
+	if (err) {
+		ERROR("Skip platform setup as FWU detected\n");
+		return;
+	}
+
+	/* Set global DTB info for fixed fw_config information */
+	fw_config_max_size = ARM_FW_CONFIG_LIMIT - ARM_FW_CONFIG_BASE;
+	set_fw_config_info(ARM_FW_CONFIG_BASE, fw_config_max_size);
+
+	/* Fill the device tree information struct with the info from the config dtb */
+	err = fconf_load_config(FW_CONFIG_ID);
+	if (err < 0) {
+		ERROR("Loading of FW_CONFIG failed %d\n", err);
+		plat_error_handler(err);
+	}
+
+	/*
+	 * FW_CONFIG loaded successfully. If FW_CONFIG device tree parsing
+	 * is successful then load TB_FW_CONFIG device tree.
+	 */
+	fw_config_info = FCONF_GET_PROPERTY(dyn_cfg, dtb, FW_CONFIG_ID);
+	if (fw_config_info != NULL) {
+		err = fconf_populate_dtb_registry(fw_config_info->config_addr);
+		if (err < 0) {
+			ERROR("Parsing of FW_CONFIG failed %d\n", err);
+			plat_error_handler(err);
+		}
+		/* load TB_FW_CONFIG */
+		err = fconf_load_config(TB_FW_CONFIG_ID);
+		if (err < 0) {
+			ERROR("Loading of TB_FW_CONFIG failed %d\n", err);
+			plat_error_handler(err);
+		}
+	} else {
+		ERROR("Invalid FW_CONFIG address\n");
+		plat_error_handler(err);
+	}
+
-	/* Load fw config */
-	fconf_load_config();
+	/* The BL2 ep_info arg0 is modified to point to FW_CONFIG */
+	desc = bl1_plat_get_image_desc(BL2_IMAGE_ID);
+	assert(desc != NULL);
+	desc->ep_info.args.arg0 = fw_config_info->config_addr;
 
 #if TRUSTED_BOARD_BOOT
 	/* Share the Mbed TLS heap info with other images */
diff --git a/plat/arm/common/arm_bl2_setup.c b/plat/arm/common/arm_bl2_setup.c
index 6c3f64f..fd60c2b 100644
--- a/plat/arm/common/arm_bl2_setup.c
+++ b/plat/arm/common/arm_bl2_setup.c
@@ -15,6 +15,7 @@
 #include <common/desc_image_load.h>
 #include <drivers/generic_delay_timer.h>
 #include <lib/fconf/fconf.h>
+#include <lib/fconf/fconf_dyn_cfg_getter.h>
 #ifdef SPD_opteed
 #include <lib/optee_utils.h>
 #endif
@@ -26,10 +27,10 @@
 static meminfo_t bl2_tzram_layout __aligned(CACHE_WRITEBACK_GRANULE);
 
 /*
- * Check that BL2_BASE is above ARM_TB_FW_CONFIG_LIMIT. This reserved page is
+ * Check that BL2_BASE is above ARM_FW_CONFIG_LIMIT. This reserved page is
  * for `meminfo_t` data structure and fw_configs passed from BL1.
  */
-CASSERT(BL2_BASE >= ARM_TB_FW_CONFIG_LIMIT, assert_bl2_base_overflows);
+CASSERT(BL2_BASE >= ARM_FW_CONFIG_LIMIT, assert_bl2_base_overflows);
 
 /* Weak definitions may be overridden in specific ARM standard platform */
 #pragma weak bl2_early_platform_setup2
@@ -50,9 +51,10 @@
  * in x0. This memory layout is sitting at the base of the free trusted SRAM.
  * Copy it to a safe location before its reclaimed by later BL2 functionality.
  ******************************************************************************/
-void arm_bl2_early_platform_setup(uintptr_t tb_fw_config,
+void arm_bl2_early_platform_setup(uintptr_t fw_config,
 				  struct meminfo *mem_layout)
 {
+	const struct dyn_cfg_dtb_info_t *tb_fw_config_info;
 	/* Initialize the console to provide early debug support */
 	arm_console_boot_init();
 
@@ -60,9 +62,13 @@
 	bl2_tzram_layout = *mem_layout;
 
 	/* Fill the properties struct with the info from the config dtb */
-	if (tb_fw_config != 0U) {
-		fconf_populate("TB_FW", tb_fw_config);
-	}
+	fconf_populate("FW_CONFIG", fw_config);
+
+	/* TB_FW_CONFIG was also loaded by BL1 */
+	tb_fw_config_info = FCONF_GET_PROPERTY(dyn_cfg, dtb, TB_FW_CONFIG_ID);
+	assert(tb_fw_config_info != NULL);
+
+	fconf_populate("TB_FW", tb_fw_config_info->config_addr);
 
 	/* Initialise the IO layer and register platform IO devices */
 	plat_arm_io_setup();
diff --git a/plat/arm/common/arm_bl31_setup.c b/plat/arm/common/arm_bl31_setup.c
index 85535c1..ded8f89 100644
--- a/plat/arm/common/arm_bl31_setup.c
+++ b/plat/arm/common/arm_bl31_setup.c
@@ -28,10 +28,10 @@
 
 #if !RESET_TO_BL31
 /*
- * Check that BL31_BASE is above ARM_TB_FW_CONFIG_LIMIT. The reserved page
+ * Check that BL31_BASE is above ARM_FW_CONFIG_LIMIT. The reserved page
  * is required for SOC_FW_CONFIG/TOS_FW_CONFIG passed from BL2.
  */
-CASSERT(BL31_BASE >= ARM_TB_FW_CONFIG_LIMIT, assert_bl31_base_overflows);
+CASSERT(BL31_BASE >= ARM_FW_CONFIG_LIMIT, assert_bl31_base_overflows);
 #endif
 
 /* Weak definitions may be overridden in specific ARM standard platform */
diff --git a/plat/arm/common/arm_dyn_cfg.c b/plat/arm/common/arm_dyn_cfg.c
index ffa2a64..633445b 100644
--- a/plat/arm/common/arm_dyn_cfg.c
+++ b/plat/arm/common/arm_dyn_cfg.c
@@ -77,6 +77,7 @@
 {
 	int err;
 	uintptr_t tb_fw_cfg_dtb;
+	const struct dyn_cfg_dtb_info_t *tb_fw_config_info;
 
 	/*
 	 * If tb_fw_cfg_dtb==NULL then DTB is not present for the current
@@ -91,8 +92,10 @@
 	 * the default heap's address and size.
 	 */
 
-	/* fconf FW_CONFIG and TB_FW_CONFIG are currently the same DTB */
-	tb_fw_cfg_dtb = FCONF_GET_PROPERTY(fconf, dtb, base_addr);
+	tb_fw_config_info = FCONF_GET_PROPERTY(dyn_cfg, dtb, TB_FW_CONFIG_ID);
+	assert(tb_fw_config_info != NULL);
+
+	tb_fw_cfg_dtb = tb_fw_config_info->config_addr;
 
 	if ((tb_fw_cfg_dtb != 0UL) && (mbedtls_heap_addr != NULL)) {
 		/* As libfdt use void *, we can't avoid this cast */
@@ -130,9 +133,12 @@
 	image_info_t image_info = image_desc->image_info;
 	uintptr_t tb_fw_cfg_dtb;
 	int err;
+	const struct dyn_cfg_dtb_info_t *tb_fw_config_info;
 
-	/* fconf FW_CONFIG and TB_FW_CONFIG are currently the same DTB */
-	tb_fw_cfg_dtb = FCONF_GET_PROPERTY(fconf, dtb, base_addr);
+	tb_fw_config_info = FCONF_GET_PROPERTY(dyn_cfg, dtb, TB_FW_CONFIG_ID);
+	assert(tb_fw_config_info != NULL);
+
+	tb_fw_cfg_dtb = tb_fw_config_info->config_addr;
 
 	/*
 	 * If tb_fw_cfg_dtb==NULL then DTB is not present for the current
@@ -170,8 +176,8 @@
 
 /*
  * BL2 utility function to initialize dynamic configuration specified by
- * TB_FW_CONFIG. Populate the bl_mem_params_node_t of other FW_CONFIGs if
- * specified in TB_FW_CONFIG.
+ * FW_CONFIG. Populate the bl_mem_params_node_t of other FW_CONFIGs if
+ * specified in FW_CONFIG.
  */
 void arm_bl2_dyn_cfg_init(void)
 {
diff --git a/plat/arm/common/fconf/arm_fconf_io.c b/plat/arm/common/fconf/arm_fconf_io.c
index 68cd9fb..48cc4fe 100644
--- a/plat/arm/common/fconf/arm_fconf_io.c
+++ b/plat/arm/common/fconf/arm_fconf_io.c
@@ -25,6 +25,7 @@
 const io_uuid_spec_t arm_uuid_spec[MAX_NUMBER_IDS] = {
 	[BL2_IMAGE_ID] = {UUID_TRUSTED_BOOT_FIRMWARE_BL2},
 	[TB_FW_CONFIG_ID] = {UUID_TB_FW_CONFIG},
+	[FW_CONFIG_ID] = {UUID_FW_CONFIG},
 #if !ARM_IO_IN_DTB
 	[SCP_BL2_IMAGE_ID] = {UUID_SCP_FIRMWARE_SCP_BL2},
 	[BL31_IMAGE_ID] = {UUID_EL3_RUNTIME_FIRMWARE_BL31},
@@ -73,6 +74,11 @@
 		(uintptr_t)&arm_uuid_spec[TB_FW_CONFIG_ID],
 		open_fip
 	},
+	[FW_CONFIG_ID] = {
+		&fip_dev_handle,
+		(uintptr_t)&arm_uuid_spec[FW_CONFIG_ID],
+		open_fip
+	},
 #if !ARM_IO_IN_DTB
 	[SCP_BL2_IMAGE_ID] = {
 		&fip_dev_handle,
diff --git a/plat/arm/common/sp_min/arm_sp_min_setup.c b/plat/arm/common/sp_min/arm_sp_min_setup.c
index 2904ad9..6100b78 100644
--- a/plat/arm/common/sp_min/arm_sp_min_setup.c
+++ b/plat/arm/common/sp_min/arm_sp_min_setup.c
@@ -29,10 +29,10 @@
 					MT_MEMORY | MT_RW | MT_SECURE)
 
 /*
- * Check that BL32_BASE is above ARM_TB_FW_CONFIG_LIMIT. The reserved page
+ * Check that BL32_BASE is above ARM_FW_CONFIG_LIMIT. The reserved page
  * is required for SOC_FW_CONFIG/TOS_FW_CONFIG passed from BL2.
  */
-CASSERT(BL32_BASE >= ARM_TB_FW_CONFIG_LIMIT, assert_bl32_base_overflows);
+CASSERT(BL32_BASE >= ARM_FW_CONFIG_LIMIT, assert_bl32_base_overflows);
 
 /*******************************************************************************
  * Return a pointer to the 'entry_point_info' structure of the next image for the
diff --git a/plat/arm/css/sgm/fdts/sgm_tb_fw_config.dts b/plat/arm/css/sgm/fdts/sgm_tb_fw_config.dts
index d481018..e416540 100644
--- a/plat/arm/css/sgm/fdts/sgm_tb_fw_config.dts
+++ b/plat/arm/css/sgm/fdts/sgm_tb_fw_config.dts
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
diff --git a/plat/arm/css/sgm/include/sgm_base_platform_def.h b/plat/arm/css/sgm/include/sgm_base_platform_def.h
index 8be0b34..2d8e677 100644
--- a/plat/arm/css/sgm/include/sgm_base_platform_def.h
+++ b/plat/arm/css/sgm/include/sgm_base_platform_def.h
@@ -138,7 +138,7 @@
  * BL31 is loaded over the top.
  */
 #define PLAT_CSS_MAX_SCP_BL2_SIZE \
-	((SCP_BL2_LIMIT - ARM_TB_FW_CONFIG_LIMIT) & ~PAGE_SIZE_MASK)
+	((SCP_BL2_LIMIT - ARM_FW_CONFIG_LIMIT) & ~PAGE_SIZE_MASK)
 
 #define PLAT_CSS_MAX_SCP_BL2U_SIZE	PLAT_CSS_MAX_SCP_BL2_SIZE
 
diff --git a/plat/marvell/armada/a3700/a3700/board/pm_src.c b/plat/marvell/armada/a3k/a3700/board/pm_src.c
similarity index 100%
rename from plat/marvell/armada/a3700/a3700/board/pm_src.c
rename to plat/marvell/armada/a3k/a3700/board/pm_src.c
diff --git a/plat/marvell/armada/a3700/a3700/mvebu_def.h b/plat/marvell/armada/a3k/a3700/mvebu_def.h
similarity index 100%
rename from plat/marvell/armada/a3700/a3700/mvebu_def.h
rename to plat/marvell/armada/a3k/a3700/mvebu_def.h
diff --git a/plat/marvell/armada/a3700/a3700/plat_bl31_setup.c b/plat/marvell/armada/a3k/a3700/plat_bl31_setup.c
similarity index 100%
rename from plat/marvell/armada/a3700/a3700/plat_bl31_setup.c
rename to plat/marvell/armada/a3k/a3700/plat_bl31_setup.c
diff --git a/plat/marvell/armada/a3700/a3700/platform.mk b/plat/marvell/armada/a3k/a3700/platform.mk
similarity index 75%
rename from plat/marvell/armada/a3700/a3700/platform.mk
rename to plat/marvell/armada/a3k/a3700/platform.mk
index bd9464a..050af41 100644
--- a/plat/marvell/armada/a3700/a3700/platform.mk
+++ b/plat/marvell/armada/a3k/a3700/platform.mk
@@ -5,6 +5,6 @@
 # https://spdx.org/licenses
 #
 
-include plat/marvell/armada/a3700/common/a3700_common.mk
+include plat/marvell/armada/a3k/common/a3700_common.mk
 
 include plat/marvell/armada/common/marvell_common.mk
diff --git a/plat/marvell/armada/a3700/common/a3700_common.mk b/plat/marvell/armada/a3k/common/a3700_common.mk
similarity index 99%
rename from plat/marvell/armada/a3700/common/a3700_common.mk
rename to plat/marvell/armada/a3k/common/a3700_common.mk
index 36865a8..9965567 100644
--- a/plat/marvell/armada/a3700/common/a3700_common.mk
+++ b/plat/marvell/armada/a3k/common/a3700_common.mk
@@ -7,7 +7,7 @@
 
 MARVELL_PLAT_BASE		:= plat/marvell/armada
 MARVELL_PLAT_INCLUDE_BASE	:= include/plat/marvell/armada
-PLAT_FAMILY			:= a3700
+PLAT_FAMILY			:= a3k
 PLAT_FAMILY_BASE		:= $(MARVELL_PLAT_BASE)/$(PLAT_FAMILY)
 PLAT_INCLUDE_BASE		:= $(MARVELL_PLAT_INCLUDE_BASE)/$(PLAT_FAMILY)
 PLAT_COMMON_BASE		:= $(PLAT_FAMILY_BASE)/common
diff --git a/plat/marvell/armada/a3700/common/a3700_ea.c b/plat/marvell/armada/a3k/common/a3700_ea.c
similarity index 100%
rename from plat/marvell/armada/a3700/common/a3700_ea.c
rename to plat/marvell/armada/a3k/common/a3700_ea.c
diff --git a/plat/marvell/armada/a3700/common/a3700_sip_svc.c b/plat/marvell/armada/a3k/common/a3700_sip_svc.c
similarity index 100%
rename from plat/marvell/armada/a3700/common/a3700_sip_svc.c
rename to plat/marvell/armada/a3k/common/a3700_sip_svc.c
diff --git a/plat/marvell/armada/a3700/common/aarch64/a3700_common.c b/plat/marvell/armada/a3k/common/aarch64/a3700_common.c
similarity index 100%
rename from plat/marvell/armada/a3700/common/aarch64/a3700_common.c
rename to plat/marvell/armada/a3k/common/aarch64/a3700_common.c
diff --git a/plat/marvell/armada/a3700/common/aarch64/plat_helpers.S b/plat/marvell/armada/a3k/common/aarch64/plat_helpers.S
similarity index 100%
rename from plat/marvell/armada/a3700/common/aarch64/plat_helpers.S
rename to plat/marvell/armada/a3k/common/aarch64/plat_helpers.S
diff --git a/plat/marvell/armada/a3700/common/dram_win.c b/plat/marvell/armada/a3k/common/dram_win.c
similarity index 100%
rename from plat/marvell/armada/a3700/common/dram_win.c
rename to plat/marvell/armada/a3k/common/dram_win.c
diff --git a/plat/marvell/armada/a3700/common/include/a3700_plat_def.h b/plat/marvell/armada/a3k/common/include/a3700_plat_def.h
similarity index 100%
rename from plat/marvell/armada/a3700/common/include/a3700_plat_def.h
rename to plat/marvell/armada/a3k/common/include/a3700_plat_def.h
diff --git a/plat/marvell/armada/a3700/common/include/a3700_pm.h b/plat/marvell/armada/a3k/common/include/a3700_pm.h
similarity index 100%
rename from plat/marvell/armada/a3700/common/include/a3700_pm.h
rename to plat/marvell/armada/a3k/common/include/a3700_pm.h
diff --git a/plat/marvell/armada/a3700/common/include/ddr_info.h b/plat/marvell/armada/a3k/common/include/ddr_info.h
similarity index 100%
rename from plat/marvell/armada/a3700/common/include/ddr_info.h
rename to plat/marvell/armada/a3k/common/include/ddr_info.h
diff --git a/plat/marvell/armada/a3700/common/include/dram_win.h b/plat/marvell/armada/a3k/common/include/dram_win.h
similarity index 100%
rename from plat/marvell/armada/a3700/common/include/dram_win.h
rename to plat/marvell/armada/a3k/common/include/dram_win.h
diff --git a/plat/marvell/armada/a3700/common/include/io_addr_dec.h b/plat/marvell/armada/a3k/common/include/io_addr_dec.h
similarity index 100%
rename from plat/marvell/armada/a3700/common/include/io_addr_dec.h
rename to plat/marvell/armada/a3k/common/include/io_addr_dec.h
diff --git a/plat/marvell/armada/a3700/common/include/plat_macros.S b/plat/marvell/armada/a3k/common/include/plat_macros.S
similarity index 100%
rename from plat/marvell/armada/a3700/common/include/plat_macros.S
rename to plat/marvell/armada/a3k/common/include/plat_macros.S
diff --git a/plat/marvell/armada/a3700/common/include/platform_def.h b/plat/marvell/armada/a3k/common/include/platform_def.h
similarity index 93%
rename from plat/marvell/armada/a3700/common/include/platform_def.h
rename to plat/marvell/armada/a3k/common/include/platform_def.h
index e6660d4..7f8f79a 100644
--- a/plat/marvell/armada/a3700/common/include/platform_def.h
+++ b/plat/marvell/armada/a3k/common/include/platform_def.h
@@ -81,11 +81,11 @@
 #define PLAT_MARVELL_CLUSTER_CORE_COUNT		U(2)
 /* DRAM[2MB..66MB] is used  as Trusted ROM */
 #define PLAT_MARVELL_TRUSTED_ROM_BASE		PLAT_MARVELL_ATF_LOAD_ADDR
-/* 64 MB TODO: reduce this to minimum needed according to fip image size*/
-#define PLAT_MARVELL_TRUSTED_ROM_SIZE		0x04000000
+/* 4 MB for FIP image */
+#define PLAT_MARVELL_TRUSTED_ROM_SIZE		0x00400000
 /* Reserve 16M for SCP (Secure PayLoad) Trusted DRAM */
-#define PLAT_MARVELL_TRUSTED_DRAM_BASE		0x04400000
-#define PLAT_MARVELL_TRUSTED_DRAM_SIZE		0x01000000	/* 16 MB */
+#define PLAT_MARVELL_TRUSTED_RAM_BASE		0x04400000
+#define PLAT_MARVELL_TRUSTED_RAM_SIZE		0x01000000	/* 16 MB */
 
 /*
  * PLAT_ARM_MAX_BL1_RW_SIZE is calculated using the current BL1 RW debug size
@@ -169,8 +169,7 @@
 #define PLAT_MARVELL_NSTIMER_FRAME_ID		1
 
 /* Mailbox base address */
-#define PLAT_MARVELL_MAILBOX_BASE		\
-			(MARVELL_TRUSTED_SRAM_BASE + 0x400)
+#define PLAT_MARVELL_MAILBOX_BASE	(MARVELL_SHARED_RAM_BASE + 0x400)
 #define PLAT_MARVELL_MAILBOX_SIZE		0x100
 #define PLAT_MARVELL_MAILBOX_MAGIC_NUM		0x6D72766C	/* mrvl */
 
@@ -221,12 +220,4 @@
 /* Securities */
 #define IRQ_SEC_OS_TICK_INT	MARVELL_IRQ_SEC_PHY_TIMER
 
-#define TRUSTED_DRAM_BASE	PLAT_MARVELL_TRUSTED_DRAM_BASE
-#define TRUSTED_DRAM_SIZE	PLAT_MARVELL_TRUSTED_DRAM_SIZE
-
-#ifdef BL32
-#define BL32_BASE		TRUSTED_DRAM_BASE
-#define BL32_LIMIT		TRUSTED_DRAM_SIZE
-#endif
-
 #endif /* PLATFORM_DEF_H */
diff --git a/plat/marvell/armada/a3700/common/io_addr_dec.c b/plat/marvell/armada/a3k/common/io_addr_dec.c
similarity index 100%
rename from plat/marvell/armada/a3700/common/io_addr_dec.c
rename to plat/marvell/armada/a3k/common/io_addr_dec.c
diff --git a/plat/marvell/armada/a3700/common/marvell_plat_config.c b/plat/marvell/armada/a3k/common/marvell_plat_config.c
similarity index 100%
rename from plat/marvell/armada/a3700/common/marvell_plat_config.c
rename to plat/marvell/armada/a3k/common/marvell_plat_config.c
diff --git a/plat/marvell/armada/a3700/common/plat_pm.c b/plat/marvell/armada/a3k/common/plat_pm.c
similarity index 100%
rename from plat/marvell/armada/a3700/common/plat_pm.c
rename to plat/marvell/armada/a3k/common/plat_pm.c
diff --git a/plat/marvell/armada/a8k/a70x0/board/marvell_plat_config.c b/plat/marvell/armada/a8k/a70x0/board/marvell_plat_config.c
index d126f55..7d30ebe 100644
--- a/plat/marvell/armada/a8k/a70x0/board/marvell_plat_config.c
+++ b/plat/marvell/armada/a8k/a70x0/board/marvell_plat_config.c
@@ -102,6 +102,9 @@
 #ifdef IMAGE_BLE
 	{0x00000000f2000000,	0x4000000,	IO_0_TID}, /* IO window */
 #else
+#if LLC_SRAM
+	{PLAT_MARVELL_LLC_SRAM_BASE, PLAT_MARVELL_LLC_SRAM_SIZE, SRAM_TID},
+#endif
 	{0x00000000f2000000,	0xe000000,	IO_0_TID},
 	{0x00000000c0000000,	0x30000000,	IO_0_TID}, /* IO window */
 	{0x0000000800000000,	0x100000000,	IO_0_TID}, /* IO window */
diff --git a/plat/marvell/armada/a8k/a70x0_amc/board/marvell_plat_config.c b/plat/marvell/armada/a8k/a70x0_amc/board/marvell_plat_config.c
index f8a1c40..7fc33f1 100644
--- a/plat/marvell/armada/a8k/a70x0_amc/board/marvell_plat_config.c
+++ b/plat/marvell/armada/a8k/a70x0_amc/board/marvell_plat_config.c
@@ -93,6 +93,9 @@
 #ifdef IMAGE_BLE
 	{0x00000000f2000000,	0x4000000,	IO_0_TID}, /* IO window */
 #else
+#if LLC_SRAM
+	{PLAT_MARVELL_LLC_SRAM_BASE, PLAT_MARVELL_LLC_SRAM_SIZE, SRAM_TID},
+#endif
 	{0x00000000f2000000,	0xe000000,	IO_0_TID},
 	{0x00000000c0000000,    0x30000000,	IO_0_TID}, /* IO window */
 	{0x0000000800000000,    0x200000000,	IO_0_TID}, /* IO window */
diff --git a/plat/marvell/armada/a8k/a80x0/board/marvell_plat_config.c b/plat/marvell/armada/a8k/a80x0/board/marvell_plat_config.c
index 7901dd2..856c07a 100644
--- a/plat/marvell/armada/a8k/a80x0/board/marvell_plat_config.c
+++ b/plat/marvell/armada/a8k/a80x0/board/marvell_plat_config.c
@@ -131,6 +131,9 @@
 #ifdef IMAGE_BLE
 	{0x00000000f2000000,	0x4000000,  IO_0_TID}, /* IO window */
 #else
+#if LLC_SRAM
+	{PLAT_MARVELL_LLC_SRAM_BASE, PLAT_MARVELL_LLC_SRAM_SIZE, SRAM_TID},
+#endif
 	{0x00000000f2000000,	0xe000000,  IO_0_TID}, /* IO window */
 	{0x00000000c0000000,	0x30000000,  IO_0_TID}, /* IO window */
 	{0x0000000800000000,	0x100000000,  IO_0_TID}, /* IO window */
diff --git a/plat/marvell/armada/a8k/a80x0_mcbin/board/marvell_plat_config.c b/plat/marvell/armada/a8k/a80x0_mcbin/board/marvell_plat_config.c
index fa4e144..0edc977 100644
--- a/plat/marvell/armada/a8k/a80x0_mcbin/board/marvell_plat_config.c
+++ b/plat/marvell/armada/a8k/a80x0_mcbin/board/marvell_plat_config.c
@@ -165,6 +165,9 @@
 #ifdef IMAGE_BLE
 	{0x00000000f2000000,	0x4000000,  IO_0_TID}, /* IO window */
 #else
+#if LLC_SRAM
+	{PLAT_MARVELL_LLC_SRAM_BASE, PLAT_MARVELL_LLC_SRAM_SIZE, SRAM_TID},
+#endif
 	{0x00000000f2000000,	0xe000000,  IO_0_TID}, /* IO window */
 	{0x00000000c0000000,	0x30000000,  IO_0_TID}, /* IO window */
 	{0x0000000800000000,	0x100000000,  IO_0_TID}, /* IO window */
diff --git a/plat/marvell/armada/a8k/common/a8k_common.mk b/plat/marvell/armada/a8k/common/a8k_common.mk
index 8731aa6..dcbf9a6 100644
--- a/plat/marvell/armada/a8k/common/a8k_common.mk
+++ b/plat/marvell/armada/a8k/common/a8k_common.mk
@@ -52,6 +52,7 @@
 				plat/common/plat_gicv2.c
 
 PLAT_INCLUDES		:=	-I$(BOARD_DIR)				\
+				-I$(BOARD_DIR)/board			\
 				-I$(PLAT_COMMON_BASE)/include		\
 				-I$(PLAT_INCLUDE_BASE)/common
 
diff --git a/plat/marvell/armada/a8k/common/aarch64/a8k_common.c b/plat/marvell/armada/a8k/common/aarch64/a8k_common.c
index 7c2bf31..4332a76 100644
--- a/plat/marvell/armada/a8k/common/aarch64/a8k_common.c
+++ b/plat/marvell/armada/a8k/common/aarch64/a8k_common.c
@@ -18,22 +18,27 @@
  */
 #if IMAGE_BL1
 const mmap_region_t plat_marvell_mmap[] = {
-	MARVELL_MAP_SHARED_RAM,
+	MARVELL_MAP_SECURE_RAM,
 	MAP_DEVICE0,
 	{0}
 };
 #endif
 #if IMAGE_BL2
 const mmap_region_t plat_marvell_mmap[] = {
-	MARVELL_MAP_SHARED_RAM,
+	MARVELL_MAP_SECURE_RAM,
 	MAP_DEVICE0,
 	MARVELL_MAP_DRAM,
+#ifdef SPD_opteed
+	MARVELL_MAP_OPTEE_CORE_MEM,
+	MARVELL_OPTEE_PAGEABLE_LOAD_MEM,
+#endif
 	{0}
 };
 #endif
 
 #if IMAGE_BL2U
 const mmap_region_t plat_marvell_mmap[] = {
+	MARVELL_MAP_SECURE_RAM,
 	MAP_DEVICE0,
 	{0}
 };
@@ -48,7 +53,7 @@
 
 #if IMAGE_BL31
 const mmap_region_t plat_marvell_mmap[] = {
-	MARVELL_MAP_SHARED_RAM,
+	MARVELL_MAP_SECURE_RAM,
 	MAP_DEVICE0,
 	MARVELL_MAP_DRAM,
 	{0}
@@ -56,6 +61,7 @@
 #endif
 #if IMAGE_BL32
 const mmap_region_t plat_marvell_mmap[] = {
+	MARVELL_MAP_SECURE_RAM,
 	MAP_DEVICE0,
 	{0}
 };
diff --git a/plat/marvell/armada/a8k/common/include/platform_def.h b/plat/marvell/armada/a8k/common/include/platform_def.h
index ec1c903..b26e3ea 100644
--- a/plat/marvell/armada/a8k/common/include/platform_def.h
+++ b/plat/marvell/armada/a8k/common/include/platform_def.h
@@ -92,13 +92,16 @@
 #define PLAT_MARVELL_CORE_COUNT			(PLAT_MARVELL_CLUSTER_COUNT * \
 						PLAT_MARVELL_CLUSTER_CORE_COUNT)
 
-/* DRAM[2MB..66MB] is used as Trusted ROM */
+/* Part of DRAM that is used as Trusted ROM */
 #define PLAT_MARVELL_TRUSTED_ROM_BASE		PLAT_MARVELL_ATF_LOAD_ADDR
-/* 64 MB TODO: reduce this to minimum needed according to fip image size */
-#define PLAT_MARVELL_TRUSTED_ROM_SIZE		0x04000000
-/* Reserve 16M for SCP (Secure PayLoad) Trusted DRAM */
-#define PLAT_MARVELL_TRUSTED_DRAM_BASE		0x04400000
-#define PLAT_MARVELL_TRUSTED_DRAM_SIZE		0x01000000	/* 16 MB */
+/* 4 MB for FIP image */
+#define PLAT_MARVELL_TRUSTED_ROM_SIZE		0x00400000
+/* Reserve 16M for SCP (Secure PayLoad) Trusted RAM */
+#define PLAT_MARVELL_TRUSTED_RAM_BASE		0x04400000
+#define PLAT_MARVELL_TRUSTED_RAM_SIZE		0x01000000	/* 16 MB DRAM */
+
+#define PLAT_MARVELL_LLC_SRAM_BASE		PLAT_MARVELL_TRUSTED_RAM_BASE
+#define PLAT_MARVELL_LLC_SRAM_SIZE		0x00100000	/* 1 MB SRAM */
 
 /*
  * PLAT_ARM_MAX_BL1_RW_SIZE is calculated using the current BL1 RW debug size
@@ -182,22 +185,14 @@
 /* Mailbox base address (note the lower memory space
  * is reserved for BLE data)
  */
-#define PLAT_MARVELL_MAILBOX_BASE		(MARVELL_TRUSTED_SRAM_BASE \
-							+ 0x400)
+#define PLAT_MARVELL_MAILBOX_BASE		(MARVELL_SHARED_RAM_BASE  \
+						+ 0x400)
 #define PLAT_MARVELL_MAILBOX_SIZE		0x100
 #define PLAT_MARVELL_MAILBOX_MAGIC_NUM		0x6D72766C	/* mrvl */
 
 /* Securities */
 #define IRQ_SEC_OS_TICK_INT			MARVELL_IRQ_SEC_PHY_TIMER
 
-#define TRUSTED_DRAM_BASE			PLAT_MARVELL_TRUSTED_DRAM_BASE
-#define TRUSTED_DRAM_SIZE			PLAT_MARVELL_TRUSTED_DRAM_SIZE
-
-#ifdef BL32
-#define BL32_BASE				TRUSTED_DRAM_BASE
-#define BL32_LIMIT				TRUSTED_DRAM_SIZE
-#endif
-
 #define MVEBU_PMU_IRQ_WA
 
 #endif /* PLATFORM_DEF_H */
diff --git a/plat/marvell/armada/a8k/common/mss/mss_bl2_setup.c b/plat/marvell/armada/a8k/common/mss/mss_bl2_setup.c
index 09b8446..c2cd933 100644
--- a/plat/marvell/armada/a8k/common/mss/mss_bl2_setup.c
+++ b/plat/marvell/armada/a8k/common/mss/mss_bl2_setup.c
@@ -10,6 +10,7 @@
 #include <common/bl_common.h>
 #include <common/debug.h>
 #include <drivers/marvell/ccu.h>
+#include <drivers/marvell/mochi/ap_setup.h>
 #include <drivers/marvell/mochi/cp110_setup.h>
 #include <lib/mmio.h>
 
@@ -18,9 +19,6 @@
 
 #include "mss_scp_bootloader.h"
 
-/* IO windows configuration */
-#define IOW_GCR_OFFSET		(0x70)
-
 /* MSS windows configuration */
 #define MSS_AEBR(base)			(base + 0x160)
 #define MSS_AIBR(base)			(base + 0x164)
@@ -51,7 +49,7 @@
  */
 static int bl2_plat_mmap_init(void)
 {
-	int cfg_num, win_id, cfg_idx;
+	int cfg_num, win_id, cfg_idx, cp;
 
 	cfg_num =  ARRAY_SIZE(ccu_mem_map);
 
@@ -65,20 +63,29 @@
 	 * Do not touch CCU window 0,
 	 * it's used for the internal registers access
 	 */
-	for (cfg_idx = 0, win_id = 1; cfg_idx < cfg_num; cfg_idx++, win_id++) {
+	for (cfg_idx = 0, win_id = 1;
+	     (win_id < MVEBU_CCU_MAX_WINS) && (cfg_idx < cfg_num); win_id++) {
+		/* Skip already enabled CCU windows */
+		if (ccu_is_win_enabled(MVEBU_AP0, win_id))
+			continue;
 		/* Enable required CCU windows */
 		ccu_win_check(&ccu_mem_map[cfg_idx]);
 		ccu_enable_win(MVEBU_AP0, &ccu_mem_map[cfg_idx], win_id);
+		cfg_idx++;
 	}
 
-	/* Set the default target id to PIDI */
-	mmio_write_32(MVEBU_IO_WIN_BASE(MVEBU_AP0) + IOW_GCR_OFFSET, PIDI_TID);
+	/* Config address for each cp other than cp0 */
+	for (cp = 1; cp < CP_COUNT; cp++)
+		update_cp110_default_win(cp);
 
-	/* Open AMB bridge required for MG access */
-	cp110_amb_init(MVEBU_CP_REGS_BASE(0));
+	/* There is need to configure IO_WIN windows again to overwrite
+	 * temporary configuration done during update_cp110_default_win
+	 */
+	init_io_win(MVEBU_AP0);
 
-	if (CP_COUNT == 2)
-		cp110_amb_init(MVEBU_CP_REGS_BASE(1));
+	/* Open AMB bridge required for MG access */
+	for (cp = 0; cp < CP_COUNT; cp++)
+		cp110_amb_init(MVEBU_CP_REGS_BASE(cp));
 
 	return 0;
 }
diff --git a/plat/marvell/armada/a8k/common/plat_bl31_setup.c b/plat/marvell/armada/a8k/common/plat_bl31_setup.c
index 621f43c..552c9b2 100644
--- a/plat/marvell/armada/a8k/common/plat_bl31_setup.c
+++ b/plat/marvell/armada/a8k/common/plat_bl31_setup.c
@@ -116,21 +116,12 @@
 		marvell_bl31_plat_arch_setup();
 
 	for (cp = 0; cp < CP_COUNT; cp++) {
-		if (cp >= 1)
-			update_cp110_default_win(cp);
-
 		cp110_init(MVEBU_CP_REGS_BASE(cp),
 			   STREAM_ID_BASE + (cp * MAX_STREAM_ID_PER_CP));
 
 		marvell_bl31_mpp_init(cp);
 	}
 
-	/*
-	 * There is need to configure IO_WIN windows again to overwrite
-	 * temporary configuration done during update_cp110_default_win
-	 */
-	init_io_win(MVEBU_AP0);
-
 	for (cp = 1; cp < CP_COUNT; cp++)
 		mci_link_tune(cp - 1);
 
diff --git a/plat/marvell/armada/common/aarch64/marvell_helpers.S b/plat/marvell/armada/common/aarch64/marvell_helpers.S
index 6f625b9..4ddc73d 100644
--- a/plat/marvell/armada/common/aarch64/marvell_helpers.S
+++ b/plat/marvell/armada/common/aarch64/marvell_helpers.S
@@ -185,7 +185,7 @@
 
 	/* Invalidate all ways */
 	ldr	w1, =LLC_WAY_MASK
-	ldr	x0, =MASTER_L2X0_INV_WAY
+	ldr	x0, =MASTER_LLC_INV_WAY
 	str	w1, [x0]
 
 	/* Finally disable LLC */
diff --git a/plat/marvell/armada/common/marvell_common.mk b/plat/marvell/armada/common/marvell_common.mk
index f5f0c41..fcc97ac 100644
--- a/plat/marvell/armada/common/marvell_common.mk
+++ b/plat/marvell/armada/common/marvell_common.mk
@@ -16,8 +16,21 @@
 # flag to switch from PLL to ARO
 ARO_ENABLE			:= 0
 $(eval $(call add_define,ARO_ENABLE))
+
+# Convert LLC to secure SRAM
+LLC_SRAM			:= 0
+$(eval $(call add_define,LLC_SRAM))
+
 # Enable/Disable LLC
+ifeq (${LLC_SRAM}, 0)
 LLC_ENABLE			:= 1
+else
+# When LLC_SRAM=1, the entire LLC converted to SRAM and enabled at BL1.
+# All existing cases activating LLC at BL31 stage should be disabled.
+# The below assignment does not allow changing the LLC_ENABLE
+# value in the command line.
+LLC_ENABLE			= 0
+endif
 $(eval $(call add_define,LLC_ENABLE))
 
 include lib/xlat_tables_v2/xlat_tables.mk
diff --git a/plat/st/stm32mp1/platform.mk b/plat/st/stm32mp1/platform.mk
index b0ba82a..9998236 100644
--- a/plat/st/stm32mp1/platform.mk
+++ b/plat/st/stm32mp1/platform.mk
@@ -16,6 +16,11 @@
 $(eval $(call assert_boolean,PLAT_XLAT_TABLES_DYNAMIC))
 $(eval $(call add_define,PLAT_XLAT_TABLES_DYNAMIC))
 
+ifeq ($(AARCH32_SP),sp_min)
+# Disable Neon support: sp_min runtime may conflict with non-secure world
+TF_CFLAGS		+=      -mfloat-abi=soft
+endif
+
 # Not needed for Cortex-A7
 WORKAROUND_CVE_2017_5715:=	0
 
diff --git a/plat/st/stm32mp1/stm32mp1_pm.c b/plat/st/stm32mp1/stm32mp1_pm.c
index cf9fa8e..31a9ae7 100644
--- a/plat/st/stm32mp1/stm32mp1_pm.c
+++ b/plat/st/stm32mp1/stm32mp1_pm.c
@@ -10,6 +10,7 @@
 #include <platform_def.h>
 
 #include <arch_helpers.h>
+#include <bl32/sp_min/platform_sp_min.h>
 #include <common/debug.h>
 #include <drivers/arm/gic_common.h>
 #include <drivers/arm/gicv2.h>
@@ -68,9 +69,8 @@
 		return PSCI_E_INVALID_PARAMS;
 	}
 
-	if ((stm32_sec_entrypoint < STM32MP_SYSRAM_BASE) ||
-	    (stm32_sec_entrypoint > (STM32MP_SYSRAM_BASE +
-				     (STM32MP_SYSRAM_SIZE - 1)))) {
+	/* Only one valid entry point */
+	if (stm32_sec_entrypoint != (uintptr_t)&sp_min_warm_entrypoint) {
 		return PSCI_E_INVALID_ADDRESS;
 	}
 
diff --git a/tools/cert_create/include/dualroot/cot.h b/tools/cert_create/include/dualroot/cot.h
index 47e371f..1d959d4 100644
--- a/tools/cert_create/include/dualroot/cot.h
+++ b/tools/cert_create/include/dualroot/cot.h
@@ -32,6 +32,7 @@
 	TRUSTED_BOOT_FW_HASH_EXT,
 	TRUSTED_BOOT_FW_CONFIG_HASH_EXT,
 	HW_CONFIG_HASH_EXT,
+	FW_CONFIG_HASH_EXT,
 	TRUSTED_WORLD_PK_EXT,
 	SCP_FW_CONTENT_CERT_PK_EXT,
 	SCP_FW_HASH_EXT,
diff --git a/tools/cert_create/include/tbbr/tbb_ext.h b/tools/cert_create/include/tbbr/tbb_ext.h
index 7ac97a5..692b2d4 100644
--- a/tools/cert_create/include/tbbr/tbb_ext.h
+++ b/tools/cert_create/include/tbbr/tbb_ext.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2018, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -15,6 +15,7 @@
 	TRUSTED_BOOT_FW_HASH_EXT,
 	TRUSTED_BOOT_FW_CONFIG_HASH_EXT,
 	HW_CONFIG_HASH_EXT,
+	FW_CONFIG_HASH_EXT,
 	TRUSTED_WORLD_PK_EXT,
 	NON_TRUSTED_WORLD_PK_EXT,
 	SCP_FW_CONTENT_CERT_PK_EXT,
diff --git a/tools/cert_create/src/dualroot/cot.c b/tools/cert_create/src/dualroot/cot.c
index 2965828..a12ea21 100644
--- a/tools/cert_create/src/dualroot/cot.c
+++ b/tools/cert_create/src/dualroot/cot.c
@@ -30,9 +30,10 @@
 			TRUSTED_FW_NVCOUNTER_EXT,
 			TRUSTED_BOOT_FW_HASH_EXT,
 			TRUSTED_BOOT_FW_CONFIG_HASH_EXT,
-			HW_CONFIG_HASH_EXT
+			HW_CONFIG_HASH_EXT,
+			FW_CONFIG_HASH_EXT
 		},
-		.num_ext = 4
+		.num_ext = 5
 	},
 
 	[TRUSTED_KEY_CERT] = {
@@ -239,6 +240,17 @@
 		.optional = 1
 	},
 
+	[FW_CONFIG_HASH_EXT] = {
+		.oid = FW_CONFIG_HASH_OID,
+		.opt = "fw-config",
+		.help_msg = "Firmware Config file",
+		.sn = "FirmwareConfigHash",
+		.ln = "Firmware Config hash",
+		.asn1_type = V_ASN1_OCTET_STRING,
+		.type = EXT_TYPE_HASH,
+		.optional = 1
+	},
+
 	[TRUSTED_WORLD_PK_EXT] = {
 		.oid = TRUSTED_WORLD_PK_OID,
 		.sn = "TrustedWorldPublicKey",
diff --git a/tools/cert_create/src/tbbr/tbb_cert.c b/tools/cert_create/src/tbbr/tbb_cert.c
index b614e2e..f4fe63d 100644
--- a/tools/cert_create/src/tbbr/tbb_cert.c
+++ b/tools/cert_create/src/tbbr/tbb_cert.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2018, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -28,9 +28,10 @@
 			TRUSTED_FW_NVCOUNTER_EXT,
 			TRUSTED_BOOT_FW_HASH_EXT,
 			TRUSTED_BOOT_FW_CONFIG_HASH_EXT,
-			HW_CONFIG_HASH_EXT
+			HW_CONFIG_HASH_EXT,
+			FW_CONFIG_HASH_EXT
 		},
-		.num_ext = 4
+		.num_ext = 5
 	},
 	[TRUSTED_KEY_CERT] = {
 		.id = TRUSTED_KEY_CERT,
diff --git a/tools/cert_create/src/tbbr/tbb_ext.c b/tools/cert_create/src/tbbr/tbb_ext.c
index 0068d3b..60bafb4 100644
--- a/tools/cert_create/src/tbbr/tbb_ext.c
+++ b/tools/cert_create/src/tbbr/tbb_ext.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2018, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -69,6 +69,16 @@
 		.type = EXT_TYPE_HASH,
 		.optional = 1
 	},
+	[FW_CONFIG_HASH_EXT] = {
+		.oid = FW_CONFIG_HASH_OID,
+		.opt = "fw-config",
+		.help_msg = "Firmware Config file",
+		.sn = "FirmwareConfigHash",
+		.ln = "Firmware Config hash",
+		.asn1_type = V_ASN1_OCTET_STRING,
+		.type = EXT_TYPE_HASH,
+		.optional = 1
+	},
 	[TRUSTED_WORLD_PK_EXT] = {
 		.oid = TRUSTED_WORLD_PK_OID,
 		.sn = "TrustedWorldPublicKey",
diff --git a/tools/fiptool/tbbr_config.c b/tools/fiptool/tbbr_config.c
index 1c5ef5f..bf721c1 100644
--- a/tools/fiptool/tbbr_config.c
+++ b/tools/fiptool/tbbr_config.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016-2018, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2016-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -69,6 +69,11 @@
 	},
 	/* Dynamic Configs */
 	{
+		.name = "FW_CONFIG",
+		.uuid = UUID_FW_CONFIG,
+		.cmdline_name = "fw-config"
+	},
+	{
 		.name = "HW_CONFIG",
 		.uuid = UUID_HW_CONFIG,
 		.cmdline_name = "hw-config"