diff --git a/common/runtime_svc.c b/common/runtime_svc.c
index f997c74..ad564f5 100644
--- a/common/runtime_svc.c
+++ b/common/runtime_svc.c
@@ -20,7 +20,6 @@
  * 'rt_svc_descs' array which contains the SMC handler.
  ******************************************************************************/
 uint8_t rt_svc_descs_indices[MAX_RT_SVCS];
-static rt_svc_desc_t *rt_svc_descs;
 
 #define RT_SVC_DECS_NUM		((RT_SVC_DESCS_END - RT_SVC_DESCS_START)\
 					/ sizeof(rt_svc_desc_t))
@@ -98,6 +97,7 @@
 {
 	int rc = 0;
 	unsigned int index, start_idx, end_idx;
+	rt_svc_desc_t *rt_svc_descs;
 
 	/* Assert the number of descriptors detected are less than maximum indices */
 	assert((RT_SVC_DESCS_END >= RT_SVC_DESCS_START) &&
diff --git a/docs/cpu-specific-build-macros.rst b/docs/cpu-specific-build-macros.rst
index 151c99e..077d470 100644
--- a/docs/cpu-specific-build-macros.rst
+++ b/docs/cpu-specific-build-macros.rst
@@ -187,7 +187,8 @@
 
 *Copyright (c) 2014-2018, Arm Limited and Contributors. All rights reserved.*
 
-.. _CVE-2017-5715: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-5715
+.. _CVE-2017-5715: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5715
+.. _CVE-2018-3639: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3639
 .. _Cortex-A53 MPCore Software Developers Errata Notice: http://infocenter.arm.com/help/topic/com.arm.doc.epm048406/Cortex_A53_MPCore_Software_Developers_Errata_Notice.pdf
 .. _Cortex-A57 MPCore Software Developers Errata Notice: http://infocenter.arm.com/help/topic/com.arm.doc.epm049219/cortex_a57_mpcore_software_developers_errata_notice.pdf
 .. _Cortex-A72 MPCore Software Developers Errata Notice: http://infocenter.arm.com/help/topic/com.arm.doc.epm012079/index.html
diff --git a/docs/marvell/build.txt b/docs/marvell/build.txt
index 63a40a8..b354ab6 100644
--- a/docs/marvell/build.txt
+++ b/docs/marvell/build.txt
@@ -22,14 +22,14 @@
 
 	   u-boot.bin should be used and not u-boot-spl.bin
 
-	Set MSS/SCP image path (mandatory only for Armada80x0 and Aramada8xxy)::
+	Set MSS/SCP image path (mandatory only for Armada80x0)::
 
 		> export SCP_BL2=path/to/mrvl_scp_bl2*.img
 
 (3) Armada-37x0 build requires WTP tools installation.
 
-	See below in the section "Tools Installation for Armada37x0 Builds".
-	Install ARM 32-bit cross compiler, which is required by building WTMI image for CM3::
+	See below in the section "Tools and external components installation".
+	Install ARM 32-bit cross compiler, which is required for building WTMI image for CM3::
 
 		> sudo apt-get install gcc-arm-linux-gnueabi
 
@@ -42,6 +42,8 @@
 	There are several build options:
 
 	- DEBUG: default is without debug information (=0). in order to enable it use DEBUG=1
+		Must be disabled when building UART recovery images due to current console driver
+		implementation that is not compatible with Xmodem protocol used for boot image download.
 
 	- LOG_LEVEL: defines the level of logging which will be purged to the default output port.
 
@@ -55,13 +57,14 @@
 	- USE_COHERENT_MEM: This flag determines whether to include the coherent memory region in the
 		BL memory map or not.
 
-	-LLC_ENABLE: Flag defining the LLC (L3) cache state. The cache is enabled by default (LLC_ENABLE=1).
+	- LLC_ENABLE: Flag defining the LLC (L3) cache state. The cache is enabled by default (LLC_ENABLE=1).
 
 	- MARVELL_SECURE_BOOT: build trusted(=1)/non trusted(=0) image, default is non trusted.
 
 	- BLE_PATH:
-		Points to BLE (Binary ROM extension) sources folder. Only required for A8K and A8K+ builds.
+		Points to BLE (Binary ROM extension) sources folder. Only required for A8K builds.
 		The parameter is optional, its default value is "ble".
+		For the BLE source location, check the section "Tools and external components installation"
 
 	- MV_DDR_PATH:
 		For A7/8K, use this parameter to point to mv_ddr driver sources to allow BLE build. For A37x0,
@@ -70,6 +73,7 @@
 		The parameter is optional for A7/8K, when this parameter is not set, the mv_ddr
 		sources are expected to be located at: drivers/marvell/mv_ddr. However, the parameter
 		is necessary for A37x0.
+		For the mv_ddr source location, check the section "Tools and external components installation"
 
 	- DDR_TOPOLOGY: For Armada37x0 only, the DDR topology map index/name, default is 0.
 		Supported Options:
@@ -88,14 +92,14 @@
 			- CPU_1200_DDR_750	-	CPU at 1200 MHz, DDR at 750 MHz
 
 	- BOOTDEV: For Armada37x0 only, the flash boot device, default is SPINOR,
-			Currently, Armada37x0 only supports SPINOR, SPINAND, EMMCNORM and SATA:
+		Currently, Armada37x0 only supports SPINOR, SPINAND, EMMCNORM and SATA:
 
-				- SPINOR - SPI NOR flash boot
-				- SPINAND - SPI NAND flash boot
-				- EMMCNORM - eMMC Download Mode
-					Download boot loader or program code from eMMC flash into CM3 or CA53
-					Requires full initialization and command sequence
-				- SATA - SATA device boot
+			- SPINOR - SPI NOR flash boot
+			- SPINAND - SPI NAND flash boot
+			- EMMCNORM - eMMC Download Mode
+				Download boot loader or program code from eMMC flash into CM3 or CA53
+				Requires full initialization and command sequence
+			- SATA - SATA device boot
 
 	- PARTNUM: For Armada37x0 only, the boot partition number, default is 0. To boot from eMMC, the value
 		should be aligned with the parameter in U-Boot with name of CONFIG_SYS_MMC_ENV_PART, whose
@@ -106,45 +110,35 @@
 		nothing, an image which supports EFUSE or a customized CM3 firmware binary. The default image
 		is wtmi.bin that built from sources in WTP folder, which is the next option. If the default
 		image is OK, then this option should be skipped.
+
 	- WTP: For Armada37x0 only, use this parameter to point to wtptools source code directory, which
 		can be found as a3700_utils.zip in the release.
 		Usage example: WTP=/path/to/a3700_utils
 
-	- CP_NUM: Total amount of CPs (South Bridge) chips wired to the interconnected APs.
-		When the parameter is omitted, the build is uses the default number of CPs equal to 2.
-		The parameter is valid for Armada 8K-plus SoC family (PLAT=a8xxy) and results in a build of images
-		suitable for a8xxY SoC, where "Y" is a number of connected CPs and "xx" is a number of CPU cores.
-		Valid values with CP_NUM is in a range of 0 to 8.
-		The CPs defined by this parameter are evenly distributed across interconnected APs that in turn
-		are dynamically detected. For instance, if the CP_NUM=6 and the TF-A detects 2 interconnected
-		APs, each AP assumed to have 3 attached CPs. With the same amount of APs and CP_NUM=3, the AP0
-		will have 2 CPs connected and AP1 - a just single CP.
-
 	For example, in order to build the image in debug mode with log level up to 'notice' level run::
 
 		> make DEBUG=1 USE_COHERENT_MEM=0 LOG_LEVEL=20 PLAT=<MARVELL_PLATFORM> all fip
 
 	And if we want to build a Armada37x0 image in debug mode with log level up to 'notice' level,
-	the image has the preset CPU at 1000 MHz, preset DDR3 at 800 MHz, the DDR topology of DDR3 2CS,
+	the image has the preset CPU at 1000 MHz, preset DDR3 at 800 MHz, the DDR topology of DDR4 2CS,
 	the image boot from SPI NOR flash partition 0, and the image is non trusted in WTP, the command
 	line is as following::
 
 		> make DEBUG=1 USE_COHERENT_MEM=0 LOG_LEVEL=20 SECURE=0 CLOCKSPRESET=CPU_1000_DDR_800 \
-			DDR_TOPOLOGY=2 BOOTDEV=SPINOR PARTNUM=0 PLAT=a3700 all fip
+			DDR_TOPOLOGY=3 BOOTDEV=SPINOR PARTNUM=0 PLAT=a3700 all fip
 
 	Supported MARVELL_PLATFORM are:
-		- a3700
+		- a3700 (for both A3720 DB and EspressoBin)
 		- a70x0
 		- a70x0_amc (for AMC board)
-		- a70x0_cust (for customers)
 		- a80x0
 		- a80x0_mcbin (for MacciatoBin)
 
 Special Build Flags
 --------------------
 	- PLAT_RECOVERY_IMAGE_ENABLE: When set this option to enable secondary recovery function when build
-		atf. In order to build uart recovery image this operation should be disabled for a70x0 and a80x0
-                because of hardware limitation(boot from secondary image can interrupt uart recovery process).
+		atf. In order to build UART recovery image this operation should be disabled for a70x0 and a80x0
+                because of hardware limitation (boot from secondary image can interrupt UART recovery process).
 		This MACRO definition is set in plat/marvell/a8k/common/include/platform_def.h file
 
 (for more information about build options, please refer to section 'Summary of build options' in  TF-A user-guide:
@@ -160,22 +154,44 @@
 	- bl31.bin		- BL31 image
 	- fip.bin		- FIP image (contains BL2, BL31 & BL33 (U-Boot) images)
 	- boot-image.bin	- TF-A image (contains BL1 and FIP images)
-	- flash-image.bin	- Image which contains boot-image.bin and SPL image; should be placed on the boot flash/device.
+	- flash-image.bin	- Image which contains boot-image.bin and SPL image;
+				  should be placed on the boot flash/device.
 
 
-Tools Installation for Armada37x0 Builds
------------------------------------------
-Install a cross GNU ARM tool chain for building the WTMI binary.
-Any cross GNU ARM tool chain that is able to build ARM Cortex M3 binaries
-is suitable.
+Tools and external components installation
+==========================================
 
-On Debian/Uboot hosts the default GNU ARM tool chain can be installed
-using the following command::
+Armada37x0 Builds require installation of 3 components
+-------------------------------------------------------
+
+(1) ARM cross compiler capable of building images for the service CPU (CM3).
+    This component is usually included in the Linux host packages.
+    On Debian/Uboot hosts the default GNU ARM tool chain can be installed
+    using the following command::
 
 		> sudo apt-get install gcc-arm-linux-gnueabi
 
-If required, the default tool chain prefix "arm-linux-gnueabi-" can be
-overwritten using the environment variable CROSS_CM3.
-Example for BASH shell::
+    Only if required, the default tool chain prefix "arm-linux-gnueabi-" can be
+    overwritten using the environment variable CROSS_CM3.
+    Example for BASH shell::
 
 		> export CROSS_CM3=/opt/arm-cross/bin/arm-linux-gnueabi
+
+(2) DDR initialization library sources (mv_ddr) available at the following repository
+    (use the "mv_ddr-armada-atf-mainline" branch)::
+    https://github.com/MarvellEmbeddedProcessors/mv-ddr-marvell.git
+
+(3) Armada3700 tools available at the following repository (use the latest release branch)::
+    https://github.com/MarvellEmbeddedProcessors/A3700-utils-marvell.git
+
+Armada70x0 and Armada80x0 Builds require installation of 2 components
+---------------------------------------------------------------------
+
+(1) DDR initialization library sources (mv_ddr) available at the following repository
+    (use the "mv_ddr-armada-atf-mainline" branch)::
+    https://github.com/MarvellEmbeddedProcessors/mv-ddr-marvell.git
+
+(2) BLE sources available at the following repository (use the "atf-mainline" branch)::
+    https://github.com/MarvellEmbeddedProcessors/ble-marvell.git
+
+
diff --git a/docs/porting-guide.rst b/docs/porting-guide.rst
index de7b5db..84f4c9d 100644
--- a/docs/porting-guide.rst
+++ b/docs/porting-guide.rst
@@ -1055,7 +1055,7 @@
 to the next BL image, when LOAD\_IMAGE\_V2 is enabled.
 
 Function : plat\_log\_get\_prefix()
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 ::
 
@@ -1066,9 +1066,32 @@
 prepended to all the log output from TF-A. The `log_level` (argument) will
 correspond to one of the standard log levels defined in debug.h. The platform
 can override the common implementation to define a different prefix string for
-the log output.  The implementation should be robust to future changes that
+the log output. The implementation should be robust to future changes that
 increase the number of log levels.
 
+Function : plat\_get\_mbedtls\_heap()
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+::
+
+    Arguments : void **heap_addr, size_t *heap_size
+    Return    : int
+
+This function is invoked during Mbed TLS library initialisation to get
+a heap, by means of a starting address and a size. This heap will then be used
+internally by the Mbed TLS library. The heap is requested from the current BL
+stage, i.e. the current BL image inside which Mbed TLS is used.
+
+In the default implementation a heap is statically allocated inside every image
+(i.e. every BL stage) that utilises Mbed TLS. So, in this case, the function
+simply returns the address and size of this "pre-allocated" heap. However, by
+overriding the default implementation, platforms have the potential to optimise
+memory usage. For example, on some Arm platforms, the Mbed TLS heap is shared
+between BL1 and BL2 stages and, thus, the necessary space is not reserved
+twice.
+
+On success the function should return 0 and a negative error code otherwise.
+
 Modifications specific to a Boot Loader stage
 ---------------------------------------------
 
diff --git a/drivers/arm/gic/v2/gicv2_main.c b/drivers/arm/gic/v2/gicv2_main.c
index 311e77e..55897bf 100644
--- a/drivers/arm/gic/v2/gicv2_main.c
+++ b/drivers/arm/gic/v2/gicv2_main.c
@@ -597,3 +597,12 @@
 
 	return old_mask;
 }
+
+/*******************************************************************************
+ * This function updates single interrupt configuration to be level/edge
+ * triggered
+ ******************************************************************************/
+void gicv2_interrupt_set_cfg(unsigned int id, unsigned int cfg)
+{
+	gicd_set_icfgr(driver_data->gicd_base, id, cfg);
+}
diff --git a/drivers/arm/gic/v3/gicv3_main.c b/drivers/arm/gic/v3/gicv3_main.c
index d764eb2..8da4512 100644
--- a/drivers/arm/gic/v3/gicv3_main.c
+++ b/drivers/arm/gic/v3/gicv3_main.c
@@ -484,7 +484,7 @@
 		return INTR_GROUP1NS;
 
 	if (id < MIN_SPI_ID) {
-		assert(gicv3_driver_data->rdistif_base_addrs != 0U);
+		assert(gicv3_driver_data->rdistif_base_addrs != NULL);
 		gicr_base = gicv3_driver_data->rdistif_base_addrs[proc_num];
 		igroup = gicr_get_igroupr0(gicr_base, id);
 		grpmodr = gicr_get_igrpmodr0(gicr_base, id);
diff --git a/drivers/auth/mbedtls/mbedtls_common.c b/drivers/auth/mbedtls/mbedtls_common.c
index 7095fde..dbf45ba 100644
--- a/drivers/auth/mbedtls/mbedtls_common.c
+++ b/drivers/auth/mbedtls/mbedtls_common.c
@@ -4,26 +4,15 @@
  * SPDX-License-Identifier: BSD-3-Clause
  */
 
+#include <assert.h>
 #include <debug.h>
-#include <stdlib.h>
-#include <stdio.h>
-
 /* mbed TLS headers */
 #include <mbedtls/memory_buffer_alloc.h>
 #include <mbedtls/platform.h>
-#include <mbedtls_config.h>
 #include <mbedtls_common.h>
-
-/*
- * mbed TLS heap
- */
-#if (TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_ECDSA) \
-	|| (TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_RSA_AND_ECDSA)
-#define MBEDTLS_HEAP_SIZE		(13*1024)
-#elif (TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_RSA)
-#define MBEDTLS_HEAP_SIZE		(7*1024)
-#endif
-static unsigned char heap[MBEDTLS_HEAP_SIZE];
+#include <mbedtls_config.h>
+#include <platform.h>
+#include <stddef.h>
 
 static void cleanup(void)
 {
@@ -37,13 +26,25 @@
 void mbedtls_init(void)
 {
 	static int ready;
+	void *heap_addr;
+	size_t heap_size = 0;
+	int err;
 
 	if (!ready) {
 		if (atexit(cleanup))
 			panic();
 
+		err = plat_get_mbedtls_heap(&heap_addr, &heap_size);
+
+		/* Ensure heap setup is proper */
+		if (err < 0) {
+			ERROR("Mbed TLS failed to get a heap\n");
+			panic();
+		}
+		assert(heap_size >= TF_MBEDTLS_HEAP_SIZE);
+
 		/* Initialize the mbed TLS heap */
-		mbedtls_memory_buffer_alloc_init(heap, MBEDTLS_HEAP_SIZE);
+		mbedtls_memory_buffer_alloc_init(heap_addr, heap_size);
 
 #ifdef MBEDTLS_PLATFORM_SNPRINTF_ALT
 		mbedtls_platform_set_snprintf(snprintf);
diff --git a/drivers/marvell/amb_adec.c b/drivers/marvell/amb_adec.c
index 3fb2f38..16fe772 100644
--- a/drivers/marvell/amb_adec.c
+++ b/drivers/marvell/amb_adec.c
@@ -7,7 +7,7 @@
 
 /* AXI to M-Bridge decoding unit driver for Marvell Armada 8K and 8K+ SoCs */
 
-#include <a8k_common.h>
+#include <armada_common.h>
 #include <debug.h>
 #include <mmio.h>
 #include <mvebu.h>
diff --git a/drivers/marvell/ccu.c b/drivers/marvell/ccu.c
index 1502c3f..acb1c00 100644
--- a/drivers/marvell/ccu.c
+++ b/drivers/marvell/ccu.c
@@ -7,7 +7,7 @@
 
 /* CCU unit device driver for Marvell AP807, AP807 and AP810 SoCs */
 
-#include <a8k_common.h>
+#include <armada_common.h>
 #include <ccu.h>
 #include <debug.h>
 #include <mmio.h>
diff --git a/drivers/marvell/comphy/comphy-cp110.h b/drivers/marvell/comphy/comphy-cp110.h
index 925abb5..6afa2c2 100644
--- a/drivers/marvell/comphy/comphy-cp110.h
+++ b/drivers/marvell/comphy/comphy-cp110.h
@@ -217,9 +217,9 @@
 #define HPIPE_G1_SET_1_G1_RX_SELMUPI_OFFSET	0
 #define HPIPE_G1_SET_1_G1_RX_SELMUPI_MASK	\
 			(0x7 << HPIPE_G1_SET_1_G1_RX_SELMUPI_OFFSET)
-#define HPIPE_G1_SET_1_G1_RX_SELMUPP_OFFSET	3
-#define HPIPE_G1_SET_1_G1_RX_SELMUPP_MASK	\
-			(0x7 << HPIPE_G1_SET_1_G1_RX_SELMUPP_OFFSET)
+#define HPIPE_G1_SET_1_G1_RX_SELMUPF_OFFSET	3
+#define HPIPE_G1_SET_1_G1_RX_SELMUPF_MASK	\
+			(0x7 << HPIPE_G1_SET_1_G1_RX_SELMUPF_OFFSET)
 #define HPIPE_G1_SET_1_G1_RX_SELMUFI_OFFSET	6
 #define HPIPE_G1_SET_1_G1_RX_SELMUFI_MASK	\
 			(0x3 << HPIPE_G1_SET_1_G1_RX_SELMUFI_OFFSET)
@@ -251,9 +251,9 @@
 #define HPIPE_G2_SET_1_G2_RX_SELMUPI_OFFSET	0
 #define HPIPE_G2_SET_1_G2_RX_SELMUPI_MASK	\
 			(0x7 << HPIPE_G2_SET_1_G2_RX_SELMUPI_OFFSET)
-#define HPIPE_G2_SET_1_G2_RX_SELMUPP_OFFSET	3
-#define HPIPE_G2_SET_1_G2_RX_SELMUPP_MASK	\
-			(0x7 << HPIPE_G2_SET_1_G2_RX_SELMUPP_OFFSET)
+#define HPIPE_G2_SET_1_G2_RX_SELMUPF_OFFSET	3
+#define HPIPE_G2_SET_1_G2_RX_SELMUPF_MASK	\
+			(0x7 << HPIPE_G2_SET_1_G2_RX_SELMUPF_OFFSET)
 #define HPIPE_G2_SET_1_G2_RX_SELMUFI_OFFSET	6
 #define HPIPE_G2_SET_1_G2_RX_SELMUFI_MASK	\
 			(0x3 << HPIPE_G2_SET_1_G2_RX_SELMUFI_OFFSET)
diff --git a/drivers/marvell/comphy/phy-comphy-cp110.c b/drivers/marvell/comphy/phy-comphy-cp110.c
index 8b78280..19bd182 100644
--- a/drivers/marvell/comphy/phy-comphy-cp110.c
+++ b/drivers/marvell/comphy/phy-comphy-cp110.c
@@ -481,8 +481,8 @@
 	/* G1 settings */
 	mask = HPIPE_G1_SET_1_G1_RX_SELMUPI_MASK;
 	data = 0x0 << HPIPE_G1_SET_1_G1_RX_SELMUPI_OFFSET;
-	mask |= HPIPE_G1_SET_1_G1_RX_SELMUPP_MASK;
-	data |= 0x1 << HPIPE_G1_SET_1_G1_RX_SELMUPP_OFFSET;
+	mask |= HPIPE_G1_SET_1_G1_RX_SELMUPF_MASK;
+	data |= 0x1 << HPIPE_G1_SET_1_G1_RX_SELMUPF_OFFSET;
 	mask |= HPIPE_G1_SET_1_G1_RX_SELMUFI_MASK;
 	data |= 0x0 << HPIPE_G1_SET_1_G1_RX_SELMUFI_OFFSET;
 	mask |= HPIPE_G1_SET_1_G1_RX_SELMUFF_MASK;
@@ -506,8 +506,8 @@
 	/* G2 settings */
 	mask = HPIPE_G2_SET_1_G2_RX_SELMUPI_MASK;
 	data = 0x0 << HPIPE_G2_SET_1_G2_RX_SELMUPI_OFFSET;
-	mask |= HPIPE_G2_SET_1_G2_RX_SELMUPP_MASK;
-	data |= 0x1 << HPIPE_G2_SET_1_G2_RX_SELMUPP_OFFSET;
+	mask |= HPIPE_G2_SET_1_G2_RX_SELMUPF_MASK;
+	data |= 0x1 << HPIPE_G2_SET_1_G2_RX_SELMUPF_OFFSET;
 	mask |= HPIPE_G2_SET_1_G2_RX_SELMUFI_MASK;
 	data |= 0x0 << HPIPE_G2_SET_1_G2_RX_SELMUFI_OFFSET;
 	mask |= HPIPE_G2_SET_1_G2_RX_SELMUFF_MASK;
@@ -1000,13 +1000,13 @@
 	if (speed == COMPHY_SPEED_5_15625G) {
 		mask |= HPIPE_G1_SET_1_G1_RX_SELMUPI_MASK;
 		data |= 0x1 << HPIPE_G1_SET_1_G1_RX_SELMUPI_OFFSET;
-		mask |= HPIPE_G1_SET_1_G1_RX_SELMUPP_MASK;
-		data |= 0x1 << HPIPE_G1_SET_1_G1_RX_SELMUPP_OFFSET;
+		mask |= HPIPE_G1_SET_1_G1_RX_SELMUPF_MASK;
+		data |= 0x1 << HPIPE_G1_SET_1_G1_RX_SELMUPF_OFFSET;
 	} else {
 		mask |= HPIPE_G1_SET_1_G1_RX_SELMUPI_MASK;
 		data |= 0x2 << HPIPE_G1_SET_1_G1_RX_SELMUPI_OFFSET;
-		mask |= HPIPE_G1_SET_1_G1_RX_SELMUPP_MASK;
-		data |= 0x2 << HPIPE_G1_SET_1_G1_RX_SELMUPP_OFFSET;
+		mask |= HPIPE_G1_SET_1_G1_RX_SELMUPF_MASK;
+		data |= 0x2 << HPIPE_G1_SET_1_G1_RX_SELMUPF_OFFSET;
 		mask |= HPIPE_G1_SET_1_G1_RX_SELMUFI_MASK;
 		data |= 0x0 << HPIPE_G1_SET_1_G1_RX_SELMUFI_OFFSET;
 		mask |= HPIPE_G1_SET_1_G1_RX_SELMUFF_MASK;
@@ -1504,8 +1504,8 @@
 	/* Genration 2 setting 1*/
 	mask = HPIPE_G2_SET_1_G2_RX_SELMUPI_MASK;
 	data = 0x0 << HPIPE_G2_SET_1_G2_RX_SELMUPI_OFFSET;
-	mask |= HPIPE_G2_SET_1_G2_RX_SELMUPP_MASK;
-	data |= 0x1 << HPIPE_G2_SET_1_G2_RX_SELMUPP_OFFSET;
+	mask |= HPIPE_G2_SET_1_G2_RX_SELMUPF_MASK;
+	data |= 0x1 << HPIPE_G2_SET_1_G2_RX_SELMUPF_OFFSET;
 	mask |= HPIPE_G2_SET_1_G2_RX_SELMUFI_MASK;
 	data |= 0x0 << HPIPE_G2_SET_1_G2_RX_SELMUFI_OFFSET;
 	reg_set(hpipe_addr + HPIPE_G2_SET_1_REG, data, mask);
@@ -1741,8 +1741,8 @@
 	/* 0xE-G1_Setting_1 */
 	mask = HPIPE_G1_SET_1_G1_RX_SELMUPI_MASK;
 	data = 0x1 << HPIPE_G1_SET_1_G1_RX_SELMUPI_OFFSET;
-	mask |= HPIPE_G1_SET_1_G1_RX_SELMUPP_MASK;
-	data |= 0x1 << HPIPE_G1_SET_1_G1_RX_SELMUPP_OFFSET;
+	mask |= HPIPE_G1_SET_1_G1_RX_SELMUPF_MASK;
+	data |= 0x1 << HPIPE_G1_SET_1_G1_RX_SELMUPF_OFFSET;
 	mask |= HPIPE_G1_SET_1_G1_RX_DFE_EN_MASK;
 	data |= 0x1 << HPIPE_G1_SET_1_G1_RX_DFE_EN_OFFSET;
 	reg_set(hpipe_addr + HPIPE_G1_SET_1_REG, data, mask);
@@ -2201,7 +2201,7 @@
 	return 0;
 }
 
-int mvebu_cp110_comphy_power_on(uint64_t comphy_base, uint64_t comphy_index,
+int mvebu_cp110_comphy_power_on(uint64_t comphy_base, uint8_t comphy_index,
 				uint64_t comphy_mode)
 {
 	int mode = COMPHY_GET_MODE(comphy_mode);
@@ -2247,7 +2247,7 @@
 		err = mvebu_cp110_comphy_ap_power_on(comphy_base, comphy_index);
 		break;
 	default:
-		ERROR("comphy%lld: unsupported comphy mode\n", comphy_index);
+		ERROR("comphy%d: unsupported comphy mode\n", comphy_index);
 		err = -EINVAL;
 		break;
 	}
@@ -2257,7 +2257,7 @@
 	return err;
 }
 
-int mvebu_cp110_comphy_power_off(uint64_t comphy_base, uint64_t comphy_index)
+int mvebu_cp110_comphy_power_off(uint64_t comphy_base, uint8_t comphy_index)
 {
 	uintptr_t sd_ip_addr, comphy_ip_addr;
 	uint32_t mask, data;
diff --git a/drivers/marvell/comphy/phy-comphy-cp110.h b/drivers/marvell/comphy/phy-comphy-cp110.h
index ada6aec..2461e5c 100644
--- a/drivers/marvell/comphy/phy-comphy-cp110.h
+++ b/drivers/marvell/comphy/phy-comphy-cp110.h
@@ -8,11 +8,11 @@
 /* Marvell CP110 SoC COMPHY unit driver */
 
 int mvebu_cp110_comphy_is_pll_locked(uint64_t comphy_base,
-				     uint64_t comphy_index);
+				     uint8_t comphy_index);
 int mvebu_cp110_comphy_power_off(uint64_t comphy_base,
-				 uint64_t comphy_index);
+				 uint8_t comphy_index);
 int mvebu_cp110_comphy_power_on(uint64_t comphy_base,
-				uint64_t comphy_index, uint64_t comphy_mode);
+				uint8_t comphy_index, uint64_t comphy_mode);
 int mvebu_cp110_comphy_xfi_rx_training(uint64_t comphy_base,
 				       uint8_t comphy_index);
 int mvebu_cp110_comphy_digital_reset(uint64_t comphy_base, uint8_t comphy_index,
diff --git a/drivers/marvell/gwin.c b/drivers/marvell/gwin.c
index b5705f7..a4743eb 100644
--- a/drivers/marvell/gwin.c
+++ b/drivers/marvell/gwin.c
@@ -7,7 +7,7 @@
 
 /* GWIN unit device driver for Marvell AP810 SoC */
 
-#include <a8k_common.h>
+#include <armada_common.h>
 #include <debug.h>
 #include <gwin.h>
 #include <mmio.h>
diff --git a/drivers/marvell/i2c/a8k_i2c.c b/drivers/marvell/i2c/a8k_i2c.c
index 737dd0a..72a7731 100644
--- a/drivers/marvell/i2c/a8k_i2c.c
+++ b/drivers/marvell/i2c/a8k_i2c.c
@@ -442,7 +442,7 @@
 void i2c_init(void *i2c_base)
 {
 	/* For I2C speed and slave address, now we do not set them since
-	 * we just provide the working speed and slave address in plat_def.h
+	 * we just provide the working speed and slave address in mvebu_def.h
 	 * for i2c_init
 	 */
 	base = (struct marvell_i2c_regs *)i2c_base;
diff --git a/drivers/marvell/io_win.c b/drivers/marvell/io_win.c
index 40b1982..c0424e0 100644
--- a/drivers/marvell/io_win.c
+++ b/drivers/marvell/io_win.c
@@ -7,7 +7,7 @@
 
 /* IO Window unit device driver for Marvell AP807, AP807 and AP810 SoCs */
 
-#include <a8k_common.h>
+#include <armada_common.h>
 #include <debug.h>
 #include <io_win.h>
 #include <mmio.h>
diff --git a/drivers/marvell/iob.c b/drivers/marvell/iob.c
index acc4941..e88bc16 100644
--- a/drivers/marvell/iob.c
+++ b/drivers/marvell/iob.c
@@ -7,7 +7,7 @@
 
 /* IOW unit device driver for Marvell CP110 and CP115 SoCs */
 
-#include <a8k_common.h>
+#include <armada_common.h>
 #include <arch_helpers.h>
 #include <debug.h>
 #include <iob.h>
diff --git a/drivers/marvell/mc_trustzone/mc_trustzone.c b/drivers/marvell/mc_trustzone/mc_trustzone.c
new file mode 100644
index 0000000..0db3b8d
--- /dev/null
+++ b/drivers/marvell/mc_trustzone/mc_trustzone.c
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2018 Marvell International Ltd.
+ *
+ * SPDX-License-Identifier:     BSD-3-Clause
+ * https://spdx.org/licenses
+ */
+
+#include <addr_map.h>
+#include <debug.h>
+#include <mmio.h>
+#include <mvebu_def.h>
+#include "mc_trustzone.h"
+
+#define TZ_SIZE(x)		((x) >> 13)
+
+static int fls(int x)
+{
+	if (!x)
+		return 0;
+
+	return 32 - __builtin_clz(x);
+}
+
+/* To not duplicate types, the addr_map_win is used, but the "target"
+ * filed is referring to attributes instead of "target".
+ */
+void tz_enable_win(int ap_index, const struct addr_map_win *win, int win_id)
+{
+	int tz_size;
+	uint32_t val, base = win->base_addr;
+
+	if ((win_id < 0) || (win_id > MVEBU_TZ_MAX_WINS)) {
+		ERROR("Enabling wrong MC TrustZone window %d!\n", win_id);
+		return;
+	}
+
+	/* map the window size to trustzone register convention */
+	tz_size = fls(TZ_SIZE(win->win_size));
+
+	VERBOSE("%s: window size = 0x%llx maps to tz_size %d\n",
+		__func__, win->win_size, tz_size);
+	if (tz_size < 0 || tz_size > 31) {
+		ERROR("Using not allowed size for MC TrustZone window %d!\n",
+		      win_id);
+		return;
+	}
+
+	if (base & 0xfff) {
+		base = base & ~0xfff;
+		WARN("Attempt to open MC TZ win. at 0x%llx, truncate to 0x%x\n",
+		     win->base_addr, base);
+	}
+
+	val = base | (tz_size << 7) | win->target_id | TZ_VALID;
+
+	VERBOSE("%s: base 0x%x, tz_size moved 0x%x, attr 0x%x, val 0x%x\n",
+		__func__, base, (tz_size << 7), win->target_id, val);
+
+	mmio_write_32(MVEBU_AP_MC_TRUSTZONE_REG_LOW(ap_index, win_id), val);
+
+	VERBOSE("%s: Win%d[0x%x] configured to 0x%x\n", __func__, win_id,
+		MVEBU_AP_MC_TRUSTZONE_REG_LOW(ap_index, win_id),
+		mmio_read_32(MVEBU_AP_MC_TRUSTZONE_REG_LOW(ap_index, win_id)));
+
+	mmio_write_32(MVEBU_AP_MC_TRUSTZONE_REG_HIGH(ap_index, win_id),
+		     (win->base_addr >> 32));
+
+	VERBOSE("%s: Win%d[0x%x] configured to 0x%x\n", __func__, win_id,
+		MVEBU_AP_MC_TRUSTZONE_REG_HIGH(ap_index, win_id),
+		mmio_read_32(MVEBU_AP_MC_TRUSTZONE_REG_HIGH(ap_index, win_id)));
+}
diff --git a/drivers/marvell/mc_trustzone/mc_trustzone.h b/drivers/marvell/mc_trustzone/mc_trustzone.h
new file mode 100644
index 0000000..8a06923
--- /dev/null
+++ b/drivers/marvell/mc_trustzone/mc_trustzone.h
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) 2018 Marvell International Ltd.
+ *
+ * SPDX-License-Identifier:     BSD-3-Clause
+ * https://spdx.org/licenses
+ */
+
+#ifndef _MC_TRUSTZONE_H
+#define _MC_TRUSTZONE_H
+
+#include <addr_map.h>
+
+#define MVEBU_TZ_MAX_WINS	16
+
+#define TZ_VALID		(1 << 0)
+#define TZ_PERM(x)		((x) << 1)
+#define TZ_RZ_ENABLE		(1 << 3)
+
+/* tz attr definitions */
+#define TZ_PERM_RW		(TZ_PERM(0))
+#define TZ_PERM_RO		(TZ_PERM(1))
+#define TZ_PERM_WO		(TZ_PERM(2))
+#define TZ_PERM_ABORT		(TZ_PERM(3))
+
+void tz_enable_win(int ap_index, const struct addr_map_win *win, int win_id);
+
+#endif /* _MC_TRUSTZONE_H */
diff --git a/drivers/marvell/mochi/cp110_setup.c b/drivers/marvell/mochi/cp110_setup.c
index c4cb307..654bb62 100644
--- a/drivers/marvell/mochi/cp110_setup.c
+++ b/drivers/marvell/mochi/cp110_setup.c
@@ -341,10 +341,6 @@
 		mmio_write_32(base + MVEBU_RTC_TEST_CONFIG_REG, 0);
 		mdelay(500);
 
-		/* Reset Time register */
-		mmio_write_32(base + MVEBU_RTC_TIME_REG, 0);
-		udelay(62);
-
 		/* Reset Status register */
 		mmio_write_32(base + MVEBU_RTC_STATUS_REG,
 			      (MVEBU_RTC_STATUS_ALARM1_MASK |
@@ -361,10 +357,6 @@
 		mmio_write_32(base + MVEBU_RTC_CCR_REG,
 			      MVEBU_RTC_NOMINAL_TIMING);
 
-		/* Reset Time register */
-		mmio_write_32(base + MVEBU_RTC_TIME_REG, 0);
-		udelay(10);
-
 		/* Reset Status register */
 		mmio_write_32(base + MVEBU_RTC_STATUS_REG,
 			      (MVEBU_RTC_STATUS_ALARM1_MASK |
diff --git a/include/drivers/arm/gicv2.h b/include/drivers/arm/gicv2.h
index 02ffa02..d0480db 100644
--- a/include/drivers/arm/gicv2.h
+++ b/include/drivers/arm/gicv2.h
@@ -191,6 +191,7 @@
 void gicv2_set_interrupt_pending(unsigned int id);
 void gicv2_clear_interrupt_pending(unsigned int id);
 unsigned int gicv2_set_pmr(unsigned int mask);
+void gicv2_interrupt_set_cfg(unsigned int id, unsigned int cfg);
 
 #endif /* __ASSEMBLY__ */
 #endif /* __GICV2_H__ */
diff --git a/include/drivers/auth/mbedtls/mbedtls_config.h b/include/drivers/auth/mbedtls/mbedtls_config.h
index f8f2608..59aeea9 100644
--- a/include/drivers/auth/mbedtls/mbedtls_config.h
+++ b/include/drivers/auth/mbedtls/mbedtls_config.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2017, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2018, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -95,4 +95,16 @@
 #include "mbedtls/check_config.h"
 #endif
 
+/*
+ * Determine Mbed TLS heap size
+ * 13312 = 13*1024
+ * 7168 = 7*1024
+ */
+#if (TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_ECDSA) \
+	|| (TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_RSA_AND_ECDSA)
+#define TF_MBEDTLS_HEAP_SIZE		U(13312)
+#elif (TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_RSA)
+#define TF_MBEDTLS_HEAP_SIZE		U(7168)
+#endif
+
 #endif /* __MBEDTLS_CONFIG_H__ */
diff --git a/include/drivers/marvell/aro.h b/include/drivers/marvell/aro.h
index 3627a20..37e211f 100644
--- a/include/drivers/marvell/aro.h
+++ b/include/drivers/marvell/aro.h
@@ -29,6 +29,7 @@
 	CPU_1800_DDR_1050_RCLK_1050 = 0x7,
 	CPU_1600_DDR_900_RCLK_900   = 0x0B,
 	CPU_1600_DDR_1050_RCLK_1050 = 0x0D,
+	CPU_1600_DDR_1200_RCLK_1200 = 0x0D,
 	CPU_1600_DDR_900_RCLK_900_2 = 0x0E,
 	CPU_1000_DDR_650_RCLK_650   = 0x13,
 	CPU_1300_DDR_800_RCLK_800   = 0x14,
diff --git a/include/drivers/marvell/mochi/cp110_setup.h b/include/drivers/marvell/mochi/cp110_setup.h
index 1c88980..839efe1 100644
--- a/include/drivers/marvell/mochi/cp110_setup.h
+++ b/include/drivers/marvell/mochi/cp110_setup.h
@@ -20,6 +20,7 @@
 #define MVEBU_DEVICE_REV_MASK		(0xf << MVEBU_DEVICE_REV_OFFSET)
 #define MVEBU_70X0_DEV_ID		(0x7040)
 #define MVEBU_70X0_CP115_DEV_ID		(0x7045)
+#define MVEBU_3900_DEV_ID		(0x6025)
 #define MVEBU_80X0_DEV_ID		(0x8040)
 #define MVEBU_80X0_CP115_DEV_ID		(0x8045)
 #define MVEBU_CP110_SA_DEV_ID		(0x110)
diff --git a/include/lib/aarch64/arch.h b/include/lib/aarch64/arch.h
index cccb286..fed5944 100644
--- a/include/lib/aarch64/arch.h
+++ b/include/lib/aarch64/arch.h
@@ -753,7 +753,7 @@
 #define ERXCTLR_EL1		S3_0_C5_C4_1
 #define ERXSTATUS_EL1		S3_0_C5_C4_2
 #define ERXADDR_EL1		S3_0_C5_C4_3
-#define ERXMISC0_EL1		S3_0_C5_C4_4
-#define ERXMISC1_EL1		S3_0_C5_C4_5
+#define ERXMISC0_EL1		S3_0_C5_C5_0
+#define ERXMISC1_EL1		S3_0_C5_C5_1
 
 #endif /* ARCH_H */
diff --git a/include/lib/cpus/aarch64/denver.h b/include/lib/cpus/aarch64/denver.h
index d8c4d2e..712a4a4 100644
--- a/include/lib/cpus/aarch64/denver.h
+++ b/include/lib/cpus/aarch64/denver.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2017, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2018, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -20,6 +20,20 @@
 /* CPU state ids - implementation defined */
 #define DENVER_CPU_STATE_POWER_DOWN	U(0x3)
 
+/* Speculative store buffering */
+#define DENVER_CPU_DIS_SSB_EL3		(U(1) << 11)
+#define DENVER_PN4_CPU_DIS_SSB_EL3	(U(1) << 18)
+
+/* Speculative memory disambiguation */
+#define DENVER_CPU_DIS_MD_EL3		(U(1) << 9)
+#define DENVER_PN4_CPU_DIS_MD_EL3	(U(1) << 17)
+
+/* Core power management states */
+#define DENVER_CPU_PMSTATE_C1		U(0x1)
+#define DENVER_CPU_PMSTATE_C6		U(0x6)
+#define DENVER_CPU_PMSTATE_C7		U(0x7)
+#define DENVER_CPU_PMSTATE_MASK		U(0xF)
+
 #ifndef __ASSEMBLY__
 
 /* Disable Dynamic Code Optimisation */
diff --git a/include/plat/arm/board/common/board_arm_def.h b/include/plat/arm/board/common/board_arm_def.h
index a388ed9..86c8512 100644
--- a/include/plat/arm/board/common/board_arm_def.h
+++ b/include/plat/arm/board/common/board_arm_def.h
@@ -102,7 +102,7 @@
  * little space for growth.
  */
 #if TRUSTED_BOARD_BOOT
-# define PLAT_ARM_MAX_BL2_SIZE		0x1F000
+# define PLAT_ARM_MAX_BL2_SIZE		0x1C000
 #else
 # define PLAT_ARM_MAX_BL2_SIZE		0x11000
 #endif
diff --git a/include/plat/arm/common/arm_def.h b/include/plat/arm/common/arm_def.h
index ea9d811..c499417 100644
--- a/include/plat/arm/common/arm_def.h
+++ b/include/plat/arm/common/arm_def.h
@@ -242,6 +242,17 @@
 						MT_MEMORY | MT_RW | MT_SECURE)
 
 /*
+ * Mapping for the BL1 RW region. This mapping is needed by BL2 in order to
+ * share the Mbed TLS heap. Since the heap is allocated inside BL1, it resides
+ * in the BL1 RW region. Hence, BL2 needs access to the BL1 RW region in order
+ * to be able to access the heap.
+ */
+#define ARM_MAP_BL1_RW		MAP_REGION_FLAT(	\
+					BL1_RW_BASE,	\
+					BL1_RW_LIMIT - BL1_RW_BASE, \
+					MT_MEMORY | MT_RW | MT_SECURE)
+
+/*
  * If SEPARATE_CODE_AND_RODATA=1 we define a region for each section
  * otherwise one region is defined containing both.
  */
diff --git a/include/plat/arm/common/arm_dyn_cfg_helpers.h b/include/plat/arm/common/arm_dyn_cfg_helpers.h
index 382ec60..cb17c95 100644
--- a/include/plat/arm/common/arm_dyn_cfg_helpers.h
+++ b/include/plat/arm/common/arm_dyn_cfg_helpers.h
@@ -6,12 +6,17 @@
 #ifndef __ARM_DYN_CFG_HELPERS_H__
 #define __ARM_DYN_CFG_HELPERS_H__
 
+#include <stddef.h>
 #include <stdint.h>
 
-/* Function declaration */
+/* Function declarations */
 int arm_dyn_get_config_load_info(void *dtb, int node, unsigned int config_id,
 		uint64_t *config_addr, uint32_t *config_size);
 int arm_dyn_tb_fw_cfg_init(void *dtb, int *node);
 int arm_dyn_get_disable_auth(void *dtb, int node, uint32_t *disable_auth);
+int arm_get_dtb_mbedtls_heap_info(void *dtb, void **heap_addr,
+	size_t *heap_size);
+int arm_set_dtb_mbedtls_heap_info(void *dtb, void *heap_addr,
+	size_t heap_size);
 
 #endif /* __ARM_DYN_CFG_HELPERS_H__ */
diff --git a/include/plat/arm/common/plat_arm.h b/include/plat/arm/common/plat_arm.h
index 1af4dd1..0770c0e 100644
--- a/include/plat/arm/common/plat_arm.h
+++ b/include/plat/arm/common/plat_arm.h
@@ -223,6 +223,8 @@
 void arm_load_tb_fw_config(void);
 void arm_bl2_set_tb_cfg_addr(void *dtb);
 void arm_bl2_dyn_cfg_init(void);
+void arm_bl1_set_mbedtls_heap(void);
+int arm_get_mbedtls_heap(void **heap_addr, size_t *heap_size);
 
 /*
  * Mandatory functions required in ARM standard platforms
diff --git a/include/plat/common/platform.h b/include/plat/common/platform.h
index dae9589..e0297ae 100644
--- a/include/plat/common/platform.h
+++ b/include/plat/common/platform.h
@@ -103,6 +103,7 @@
 const char *plat_log_get_prefix(unsigned int log_level);
 void bl2_plat_preload_setup(void);
 int plat_try_next_boot_source(void);
+int plat_get_mbedtls_heap(void **heap_addr, size_t *heap_size);
 
 /*******************************************************************************
  * Mandatory BL1 functions
diff --git a/include/plat/marvell/a8k/common/a8k_common.h b/include/plat/marvell/a8k/common/armada_common.h
similarity index 100%
rename from include/plat/marvell/a8k/common/a8k_common.h
rename to include/plat/marvell/a8k/common/armada_common.h
diff --git a/include/plat/marvell/a8k/common/marvell_def.h b/include/plat/marvell/a8k/common/marvell_def.h
index 7dacf82..9429753 100644
--- a/include/plat/marvell/a8k/common/marvell_def.h
+++ b/include/plat/marvell/a8k/common/marvell_def.h
@@ -63,6 +63,7 @@
 #define MARVELL_DRAM_END		(MARVELL_DRAM_BASE + \
 					 MARVELL_DRAM_SIZE - 1)
 
+#define MARVELL_IRQ_PIC0		28
 #define MARVELL_IRQ_SEC_PHY_TIMER	29
 
 #define MARVELL_IRQ_SEC_SGI_0		8
diff --git a/include/plat/marvell/a8k/common/plat_marvell.h b/include/plat/marvell/a8k/common/plat_marvell.h
index 81cbf38..9ca68d3 100644
--- a/include/plat/marvell/a8k/common/plat_marvell.h
+++ b/include/plat/marvell/a8k/common/plat_marvell.h
@@ -94,6 +94,14 @@
 void plat_marvell_system_reset(void);
 
 /*
+ * Miscellaneous platform SMC routines
+ */
+#ifdef MVEBU_PMU_IRQ_WA
+void mvebu_pmu_interrupt_enable(void);
+void mvebu_pmu_interrupt_disable(void);
+#endif
+
+/*
  * Optional functions required in Marvell standard platforms
  */
 void plat_marvell_io_setup(void);
diff --git a/lib/cpus/aarch64/denver.S b/lib/cpus/aarch64/denver.S
index a981d02..c377b28 100644
--- a/lib/cpus/aarch64/denver.S
+++ b/lib/cpus/aarch64/denver.S
@@ -156,11 +156,12 @@
 	 * ----------------------------------------------------
 	 */
 func denver_enable_dco
-	mrs	x0, mpidr_el1
-	and	x0, x0, #0xF
+	mov	x3, x30
+	bl	plat_my_core_pos
 	mov	x1, #1
 	lsl	x1, x1, x0
 	msr	s3_0_c15_c0_2, x1
+	mov	x30, x3
 	ret
 endfunc denver_enable_dco
 
@@ -170,9 +171,10 @@
 	 */
 func denver_disable_dco
 
+	mov	x3, x30
+
 	/* turn off background work */
-	mrs	x0, mpidr_el1
-	and	x0, x0, #0xF
+	bl	plat_my_core_pos
 	mov	x1, #1
 	lsl	x1, x1, x0
 	lsl	x2, x1, #16
@@ -186,6 +188,7 @@
 	and	x2, x2, x1
 	cbnz	x2, 1b
 
+	mov	x30, x3
 	ret
 endfunc denver_disable_dco
 
@@ -208,6 +211,15 @@
 	ret
 endfunc check_errata_cve_2017_5715
 
+func check_errata_cve_2018_3639
+#if WORKAROUND_CVE_2018_3639
+	mov	x0, #ERRATA_APPLIES
+#else
+	mov	x0, #ERRATA_MISSING
+#endif
+	ret
+endfunc check_errata_cve_2018_3639
+
 	/* -------------------------------------------------
 	 * The CPU Ops reset function for Denver.
 	 * -------------------------------------------------
@@ -233,6 +245,34 @@
 	msr	vbar_el3, x0
 #endif
 
+#if WORKAROUND_CVE_2018_3639
+	/*
+	 * Denver CPUs with DENVER_MIDR_PN3 or earlier, use different
+	 * bits in the ACTLR_EL3 register to disable speculative
+	 * store buffer and memory disambiguation.
+	 */
+	mrs	x0, midr_el1
+	mov_imm	x1, DENVER_MIDR_PN4
+	cmp	x0, x1
+	mrs	x0, actlr_el3
+	mov	x1, #(DENVER_CPU_DIS_MD_EL3 | DENVER_CPU_DIS_SSB_EL3)
+	mov	x2, #(DENVER_PN4_CPU_DIS_MD_EL3 | DENVER_PN4_CPU_DIS_SSB_EL3)
+	csel	x3, x1, x2, ne
+	orr	x0, x0, x3
+	msr	actlr_el3, x0
+	isb
+	dsb	sy
+#endif
+
+	/* ----------------------------------------------------
+	 * Reset ACTLR.PMSTATE to C1 state
+	 * ----------------------------------------------------
+	 */
+	mrs	x0, actlr_el1
+	bic	x0, x0, #DENVER_CPU_PMSTATE_MASK
+	orr	x0, x0, #DENVER_CPU_PMSTATE_C1
+	msr	actlr_el1, x0
+
 	/* ----------------------------------------------------
 	 * Enable dynamic code optimizer (DCO)
 	 * ----------------------------------------------------
@@ -282,6 +322,7 @@
 	 * checking functions of each errata.
 	 */
 	report_errata WORKAROUND_CVE_2017_5715, denver, cve_2017_5715
+	report_errata WORKAROUND_CVE_2018_3639, denver, cve_2018_3639
 
 	ldp	x8, x30, [sp], #16
 	ret
diff --git a/lib/optee/optee_utils.c b/lib/optee/optee_utils.c
index ecf7cc0..34d095b 100644
--- a/lib/optee/optee_utils.c
+++ b/lib/optee/optee_utils.c
@@ -25,14 +25,15 @@
 
 #define OPTEE_PAGER_IMAGE_ID		0
 #define OPTEE_PAGED_IMAGE_ID		1
-#define OPTEE_MAX_IMAGE_NUM		2
+
+#define OPTEE_MAX_NUM_IMAGES		2u
 
 #define TEE_MAGIC_NUM_OPTEE		0x4554504f
 /*
  * magic: header magic number.
  * version: OPTEE header version:
- * 	1 - not supported
- * 	2 - supported
+ *		1 - not supported
+ *		2 - supported
  * arch: OPTEE os architecture type: 0 - AARCH32, 1 - AARCH64.
  * flags: unused currently.
  * nb_images: number of images.
@@ -53,14 +54,20 @@
  ******************************************************************************/
 static inline int tee_validate_header(optee_header_t *header)
 {
+	int valid = 0;
+
 	if ((header->magic == TEE_MAGIC_NUM_OPTEE) &&
-		(header->version == 2) &&
-		(header->nb_images <= OPTEE_MAX_IMAGE_NUM)) {
-		return 1;
+		(header->version == 2u) &&
+		(header->nb_images > 0u) &&
+		(header->nb_images <= OPTEE_MAX_NUM_IMAGES)) {
+		valid = 1;
 	}
 
-	WARN("Not a known TEE, use default loading options.\n");
-	return 0;
+	else {
+		WARN("Not a known TEE, use default loading options.\n");
+	}
+
+	return valid;
 }
 
 /*******************************************************************************
diff --git a/plat/arm/board/fvp/fdts/fvp_tb_fw_config.dts b/plat/arm/board/fvp/fdts/fvp_tb_fw_config.dts
index 28299f6..ce58938 100644
--- a/plat/arm/board/fvp/fdts/fvp_tb_fw_config.dts
+++ b/plat/arm/board/fvp/fdts/fvp_tb_fw_config.dts
@@ -26,5 +26,16 @@
 		tos_fw_config_max_size = <0x200>;
 		nt_fw_config_addr = <0x0 0x80000000>;
 		nt_fw_config_max_size = <0x200>;
+		/*
+		 * The following two entries are placeholders for Mbed TLS
+		 * heap information. The default values don't matter since
+		 * they will be overwritten by BL1.
+		 * In case of having shared Mbed TLS heap between BL1 and BL2,
+		 * BL1 will populate these two properties with the respective
+		 * info about the shared heap. This info will be available for
+		 * BL2 in order to locate and re-use the heap.
+		 */
+		mbedtls_heap_addr = <0x0 0x0>;
+		mbedtls_heap_size = <0x0>;
 	};
 };
diff --git a/plat/arm/board/fvp/fvp_common.c b/plat/arm/board/fvp/fvp_common.c
index af258b0..1b0c764 100644
--- a/plat/arm/board/fvp/fvp_common.c
+++ b/plat/arm/board/fvp/fvp_common.c
@@ -15,6 +15,7 @@
 #include <gicv2.h>
 #include <mmio.h>
 #include <plat_arm.h>
+#include <platform.h>
 #include <secure_partition.h>
 #include <v2m_def.h>
 #include "../fvp_def.h"
@@ -50,7 +51,6 @@
 					DEVICE2_SIZE,			\
 					MT_DEVICE | MT_RW | MT_SECURE)
 
-
 /*
  * Table of memory regions for various BL stages to map using the MMU.
  * This doesn't include Trusted SRAM as arm_setup_page_tables() already
@@ -92,7 +92,10 @@
 #if TRUSTED_BOARD_BOOT
 	/* To access the Root of Trust Public Key registers. */
 	MAP_DEVICE2,
-#endif
+#if LOAD_IMAGE_V2 && !BL2_AT_EL3
+	ARM_MAP_BL1_RW,
+#endif /* LOAD_IMAGE_V2 && !BL2_AT_EL3 */
+#endif /* TRUSTED_BOARD_BOOT */
 #if ENABLE_SPM
 	ARM_SP_IMAGE_MMAP,
 #endif
@@ -395,3 +398,13 @@
 	}
 #endif
 }
+
+#if TRUSTED_BOARD_BOOT && LOAD_IMAGE_V2
+int plat_get_mbedtls_heap(void **heap_addr, size_t *heap_size)
+{
+	assert(heap_addr != NULL);
+	assert(heap_size != NULL);
+
+	return arm_get_mbedtls_heap(heap_addr, heap_size);
+}
+#endif
diff --git a/plat/arm/board/juno/juno_bl2_setup.c b/plat/arm/board/juno/juno_bl2_setup.c
index cedef66..1f483d6 100644
--- a/plat/arm/board/juno/juno_bl2_setup.c
+++ b/plat/arm/board/juno/juno_bl2_setup.c
@@ -16,7 +16,7 @@
  * boot flow as the core comes up in aarch64 and to enter the BL32 image a warm
  * reset in aarch32 state is required.
  ******************************************************************************/
-int bl2_plat_handle_post_image_load(unsigned int image_id)
+int arm_bl2_plat_handle_post_image_load(unsigned int image_id)
 {
 	int err = arm_bl2_handle_post_image_load(image_id);
 
diff --git a/plat/arm/common/arm_bl1_setup.c b/plat/arm/common/arm_bl1_setup.c
index d435553..a4d2b44 100644
--- a/plat/arm/common/arm_bl1_setup.c
+++ b/plat/arm/common/arm_bl1_setup.c
@@ -149,7 +149,11 @@
 	plat_arm_io_setup();
 #if LOAD_IMAGE_V2
 	arm_load_tb_fw_config();
-#endif
+#if TRUSTED_BOARD_BOOT
+	/* Share the Mbed TLS heap info with other images */
+	arm_bl1_set_mbedtls_heap();
+#endif /* TRUSTED_BOARD_BOOT */
+#endif /* LOAD_IMAGE_V2 */
 	/*
 	 * Allow access to the System counter timer module and program
 	 * counter frequency for non secure images during FWU
diff --git a/plat/arm/common/arm_bl2_setup.c b/plat/arm/common/arm_bl2_setup.c
index 01ae8f3..a8ea075 100644
--- a/plat/arm/common/arm_bl2_setup.c
+++ b/plat/arm/common/arm_bl2_setup.c
@@ -42,7 +42,7 @@
 
 #if LOAD_IMAGE_V2
 
-#pragma weak bl2_plat_handle_post_image_load
+#pragma weak arm_bl2_plat_handle_post_image_load
 
 #else /* LOAD_IMAGE_V2 */
 
@@ -328,11 +328,16 @@
  * This function can be used by the platforms to update/use image
  * information for given `image_id`.
  ******************************************************************************/
-int bl2_plat_handle_post_image_load(unsigned int image_id)
+int arm_bl2_plat_handle_post_image_load(unsigned int image_id)
 {
 	return arm_bl2_handle_post_image_load(image_id);
 }
 
+int bl2_plat_handle_post_image_load(unsigned int image_id)
+{
+	return arm_bl2_plat_handle_post_image_load(image_id);
+}
+
 #else /* LOAD_IMAGE_V2 */
 
 /*******************************************************************************
diff --git a/plat/arm/common/arm_dyn_cfg.c b/plat/arm/common/arm_dyn_cfg.c
index b9c73f0..f2570a8 100644
--- a/plat/arm/common/arm_dyn_cfg.c
+++ b/plat/arm/common/arm_dyn_cfg.c
@@ -8,6 +8,9 @@
 #include <assert.h>
 #include <debug.h>
 #include <desc_image_load.h>
+#if TRUSTED_BOARD_BOOT
+#include <mbedtls_config.h>
+#endif
 #include <plat_arm.h>
 #include <platform.h>
 #include <platform_def.h>
@@ -16,9 +19,94 @@
 
 #if LOAD_IMAGE_V2
 
-/* Variable to store the address to TB_FW_CONFIG passed from BL1 */
+/* Variable to store the address of TB_FW_CONFIG file */
 static void *tb_fw_cfg_dtb;
 
+
+#if TRUSTED_BOARD_BOOT
+
+static void *mbedtls_heap_addr;
+static size_t mbedtls_heap_size;
+
+/*
+ * This function is the implementation of the shared Mbed TLS heap between
+ * BL1 and BL2 for Arm platforms. The shared heap address is passed from BL1
+ * to BL2 with a pointer. This pointer resides inside the TB_FW_CONFIG file
+ * which is a DTB.
+ *
+ * This function is placed inside an #if directive for the below reasons:
+ *   - To allocate space for the Mbed TLS heap --only if-- Trusted Board Boot
+ *     is enabled.
+ *   - This implementation requires the DTB to be present so that BL1 has a
+ *     mechanism to pass the pointer to BL2. If LOAD_IMAGE_V2=0 then
+ *     TB_FW_CONFIG is not present, which means that this implementation
+ *     cannot be applied.
+ */
+int arm_get_mbedtls_heap(void **heap_addr, size_t *heap_size)
+{
+	assert(heap_addr != NULL);
+	assert(heap_size != NULL);
+
+#if defined(IMAGE_BL1) || BL2_AT_EL3
+
+	/* If in BL1 or BL2_AT_EL3 define a heap */
+	static unsigned char heap[TF_MBEDTLS_HEAP_SIZE];
+
+	*heap_addr = heap;
+	*heap_size = sizeof(heap);
+	mbedtls_heap_addr = heap;
+	mbedtls_heap_size = sizeof(heap);
+
+#elif defined(IMAGE_BL2)
+
+	int err;
+
+	/* If in BL2, retrieve the already allocated heap's info from DTB */
+	err = arm_get_dtb_mbedtls_heap_info(tb_fw_cfg_dtb, heap_addr,
+		heap_size);
+	if (err < 0) {
+		ERROR("BL2: unable to retrieve shared Mbed TLS heap "
+			"information from DTB\n");
+		panic();
+	}
+#endif
+
+	return 0;
+}
+
+/*
+ * Puts the shared Mbed TLS heap information to the DTB.
+ * Executed only from BL1.
+ */
+void arm_bl1_set_mbedtls_heap(void)
+{
+	int err;
+
+	/*
+	 * If tb_fw_cfg_dtb==NULL then DTB is not present for the current
+	 * platform. As such, we don't attempt to write to the DTB at all.
+	 *
+	 * If mbedtls_heap_addr==NULL, then it means we are using the default
+	 * heap implementation. As such, BL2 will have its own heap for sure
+	 * and hence there is no need to pass any information to the DTB.
+	 *
+	 * In the latter case, if we still wanted to write in the DTB the heap
+	 * information, we would need to call plat_get_mbedtls_heap to retrieve
+	 * the default heap's address and size.
+	 */
+	if ((tb_fw_cfg_dtb != NULL) && (mbedtls_heap_addr != NULL)) {
+		err = arm_set_dtb_mbedtls_heap_info(tb_fw_cfg_dtb,
+			mbedtls_heap_addr, mbedtls_heap_size);
+		if (err < 0) {
+			ERROR("BL1: unable to write shared Mbed TLS heap "
+				"information to DTB\n");
+			panic();
+		}
+	}
+}
+
+#endif /* TRUSTED_BOARD_BOOT */
+
 /*
  * Helper function to load TB_FW_CONFIG and populate the load information to
  * arg0 of BL2 entrypoint info.
@@ -45,7 +133,9 @@
 		return;
 	}
 
+	/* At this point we know that a DTB is indeed available */
 	config_base = arm_tb_fw_info.image_info.image_base;
+	tb_fw_cfg_dtb = (void *)config_base;
 
 	/* The BL2 ep_info arg0 is modified to point to TB_FW_CONFIG */
 	image_desc = bl1_plat_get_image_desc(BL2_IMAGE_ID);
diff --git a/plat/arm/common/arm_dyn_cfg_helpers.c b/plat/arm/common/arm_dyn_cfg_helpers.c
index 5a7e20a..e610903 100644
--- a/plat/arm/common/arm_dyn_cfg_helpers.c
+++ b/plat/arm/common/arm_dyn_cfg_helpers.c
@@ -11,6 +11,8 @@
 #include <libfdt.h>
 #include <plat_arm.h>
 
+#define DTB_PROP_MBEDTLS_HEAP_ADDR "mbedtls_heap_addr"
+#define DTB_PROP_MBEDTLS_HEAP_SIZE "mbedtls_heap_size"
 
 typedef struct config_load_info_prop {
 	unsigned int config_id;
@@ -164,3 +166,102 @@
 	VERBOSE("Dyn cfg: Found \"arm,tb_fw\" in the config\n");
 	return 0;
 }
+
+
+#if TRUSTED_BOARD_BOOT && LOAD_IMAGE_V2
+/*
+ * Reads and returns the Mbed TLS shared heap information from the DTB.
+ * This function is supposed to be called *only* when a DTB is present.
+ * This function is supposed to be called only by BL2.
+ *
+ * Returns:
+ *	0 = success
+ *	-1 = error. In this case the values of heap_addr, heap_size should be
+ *	    considered as garbage by the caller.
+ */
+int arm_get_dtb_mbedtls_heap_info(void *dtb, void **heap_addr,
+	size_t *heap_size)
+{
+	int err, dtb_root;
+
+	/* Verify the DTB is valid and get the root node */
+	err = arm_dyn_tb_fw_cfg_init(dtb, &dtb_root);
+	if (err < 0) {
+		ERROR("%s: Invalid TB_FW_CONFIG. Cannot retrieve Mbed TLS "
+			"heap information from DTB\n", __func__);
+		return -1;
+	}
+
+	/* Retrieve the Mbed TLS heap details from the DTB */
+	err = fdtw_read_cells(dtb, dtb_root,
+		DTB_PROP_MBEDTLS_HEAP_ADDR, 2, heap_addr);
+	if (err < 0) {
+		ERROR("%s: error while reading %s from DTB\n", __func__,
+			DTB_PROP_MBEDTLS_HEAP_ADDR);
+		return -1;
+	}
+	err = fdtw_read_cells(dtb, dtb_root,
+		DTB_PROP_MBEDTLS_HEAP_SIZE, 1, heap_size);
+	if (err < 0) {
+		ERROR("%s: error while reading %s from DTB\n", __func__,
+			DTB_PROP_MBEDTLS_HEAP_SIZE);
+		return -1;
+	}
+	return 0;
+}
+
+
+/*
+ * This function writes the Mbed TLS heap address and size in the DTB. When it
+ * is called, it is guaranteed that a DTB is available. However it is not
+ * guaranteed that the shared Mbed TLS heap implementation is used. Thus we
+ * return error code from here and it's the responsibility of the caller to
+ * determine the action upon error.
+ *
+ * This function is supposed to be called only by BL1.
+ *
+ * Returns:
+ *	0 = success
+ *	1 = error
+ */
+int arm_set_dtb_mbedtls_heap_info(void *dtb, void *heap_addr, size_t heap_size)
+{
+	int err, dtb_root;
+
+	/*
+	 * Verify that the DTB is valid, before attempting to write to it,
+	 * and get the DTB root node.
+	 */
+	err = arm_dyn_tb_fw_cfg_init(dtb, &dtb_root);
+	if (err < 0) {
+		ERROR("%s: Invalid TB_FW_CONFIG loaded. Unable to get "
+			"root node\n", __func__);
+		return -1;
+	}
+
+	/*
+	 * Write the heap address and size in the DTB.
+	 *
+	 * NOTE: The variables heap_addr and heap_size are corrupted
+	 * by the "fdtw_write_inplace_cells" function. After the
+	 * function calls they must NOT be reused.
+	 */
+	err = fdtw_write_inplace_cells(dtb, dtb_root,
+		DTB_PROP_MBEDTLS_HEAP_ADDR, 2, &heap_addr);
+	if (err < 0) {
+		ERROR("%s: unable to write DTB property %s\n",
+			__func__, DTB_PROP_MBEDTLS_HEAP_ADDR);
+		return -1;
+	}
+
+	err = fdtw_write_inplace_cells(dtb, dtb_root,
+		DTB_PROP_MBEDTLS_HEAP_SIZE, 1, &heap_size);
+	if (err < 0) {
+		ERROR("%s: unable to write DTB property %s\n",
+			__func__, DTB_PROP_MBEDTLS_HEAP_SIZE);
+		return -1;
+	}
+
+	return 0;
+}
+#endif /* TRUSTED_BOARD_BOOT && LOAD_IMAGE_V2 */
diff --git a/plat/arm/css/sgi/fdts/sgi575_tb_fw_config.dts b/plat/arm/css/sgi/fdts/sgi575_tb_fw_config.dts
index 0bb0a94..315fa69 100644
--- a/plat/arm/css/sgi/fdts/sgi575_tb_fw_config.dts
+++ b/plat/arm/css/sgi/fdts/sgi575_tb_fw_config.dts
@@ -11,4 +11,15 @@
 	compatible = "arm,tb_fw";
 	hw_config_addr = <0x0 0xFEF00000>;
 	hw_config_max_size = <0x0100000>;
+	/*
+	 * The following two entries are placeholders for Mbed TLS
+	 * heap information. The default values don't matter since
+	 * they will be overwritten by BL1.
+	 * In case of having shared Mbed TLS heap between BL1 and BL2,
+	 * BL1 will populate these two properties with the respective
+	 * info about the shared heap. This info will be available for
+	 * BL2 in order to locate and re-use the heap.
+	 */
+	mbedtls_heap_addr = <0x0 0x0>;
+	mbedtls_heap_size = <0x0>;
 };
diff --git a/plat/arm/css/sgi/sgi_plat.c b/plat/arm/css/sgi/sgi_plat.c
index 6aa76ef..0a7e319 100644
--- a/plat/arm/css/sgi/sgi_plat.c
+++ b/plat/arm/css/sgi/sgi_plat.c
@@ -6,6 +6,7 @@
 
 #include <arm_def.h>
 #include <arm_spm_def.h>
+#include <assert.h>
 #include <bl_common.h>
 #include <ccn.h>
 #include <debug.h>
@@ -64,6 +65,9 @@
 #if ENABLE_SPM
 	ARM_SP_IMAGE_MMAP,
 #endif
+#if TRUSTED_BOARD_BOOT && LOAD_IMAGE_V2 && !BL2_AT_EL3
+	ARM_MAP_BL1_RW,
+#endif
 	{0}
 };
 #endif
@@ -143,3 +147,13 @@
 	return &plat_arm_secure_partition_boot_info;
 }
 #endif /* ENABLE_SPM && defined(IMAGE_BL31) */
+
+#if TRUSTED_BOARD_BOOT && LOAD_IMAGE_V2
+int plat_get_mbedtls_heap(void **heap_addr, size_t *heap_size)
+{
+	assert(heap_addr != NULL);
+	assert(heap_size != NULL);
+
+	return arm_get_mbedtls_heap(heap_addr, heap_size);
+}
+#endif
diff --git a/plat/arm/css/sgm/fdts/sgm_tb_fw_config.dts b/plat/arm/css/sgm/fdts/sgm_tb_fw_config.dts
index 9502549..d481018 100644
--- a/plat/arm/css/sgm/fdts/sgm_tb_fw_config.dts
+++ b/plat/arm/css/sgm/fdts/sgm_tb_fw_config.dts
@@ -12,5 +12,16 @@
 		compatible = "arm,tb_fw";
 		hw_config_addr = <0x0 0x83000000>;
 		hw_config_max_size = <0x01000000>;
+		/*
+		 * The following two entries are placeholders for Mbed TLS
+		 * heap information. The default values don't matter since
+		 * they will be overwritten by BL1.
+		 * In case of having shared Mbed TLS heap between BL1 and BL2,
+		 * BL1 will populate these two properties with the respective
+		 * info about the shared heap. This info will be available for
+		 * BL2 in order to locate and re-use the heap.
+		 */
+		mbedtls_heap_addr = <0x0 0x0>;
+		mbedtls_heap_size = <0x0>;
 	};
 };
diff --git a/plat/arm/css/sgm/sgm_mmap_config.c b/plat/arm/css/sgm/sgm_mmap_config.c
index 009ee64..8a4a8ab 100644
--- a/plat/arm/css/sgm/sgm_mmap_config.c
+++ b/plat/arm/css/sgm/sgm_mmap_config.c
@@ -43,6 +43,9 @@
 #ifdef SPD_opteed
 	ARM_OPTEE_PAGEABLE_LOAD_MEM,
 #endif
+#if TRUSTED_BOARD_BOOT && LOAD_IMAGE_V2 && !BL2_AT_EL3
+	ARM_MAP_BL1_RW,
+#endif
 	{0}
 };
 #endif
diff --git a/plat/arm/css/sgm/sgm_plat_config.c b/plat/arm/css/sgm/sgm_plat_config.c
index 809edf6..97b16a8 100644
--- a/plat/arm/css/sgm/sgm_plat_config.c
+++ b/plat/arm/css/sgm/sgm_plat_config.c
@@ -67,3 +67,13 @@
 	assert(css_plat_info != NULL);
 	return css_plat_info;
 }
+
+#if TRUSTED_BOARD_BOOT && LOAD_IMAGE_V2
+int plat_get_mbedtls_heap(void **heap_addr, size_t *heap_size)
+{
+	assert(heap_addr != NULL);
+	assert(heap_size != NULL);
+
+	return arm_get_mbedtls_heap(heap_addr, heap_size);
+}
+#endif
diff --git a/plat/common/plat_bl_common.c b/plat/common/plat_bl_common.c
index b471a7e..95d73e3 100644
--- a/plat/common/plat_bl_common.c
+++ b/plat/common/plat_bl_common.c
@@ -9,6 +9,9 @@
 #include <bl_common.h>
 #include <debug.h>
 #include <errno.h>
+#if TRUSTED_BOARD_BOOT
+#include <mbedtls_config.h>
+#endif
 #include <platform.h>
 
 /*
@@ -21,6 +24,7 @@
 #pragma weak bl2_plat_handle_pre_image_load
 #pragma weak bl2_plat_handle_post_image_load
 #pragma weak plat_try_next_boot_source
+#pragma weak plat_get_mbedtls_heap
 
 void bl2_el3_plat_prepare_exit(void)
 {
@@ -66,3 +70,22 @@
 	bl2_early_platform_setup((void *)arg1);
 }
 #endif
+
+
+#if TRUSTED_BOARD_BOOT
+/*
+ * The following default implementation of the function simply returns the
+ * by-default allocated heap.
+ */
+int plat_get_mbedtls_heap(void **heap_addr, size_t *heap_size)
+{
+	static unsigned char heap[TF_MBEDTLS_HEAP_SIZE];
+
+	assert(heap_addr != NULL);
+	assert(heap_size != NULL);
+
+	*heap_addr = heap;
+	*heap_size = sizeof(heap);
+	return 0;
+}
+#endif /* TRUSTED_BOARD_BOOT */
diff --git a/plat/marvell/a8k/a70x0/board/marvell_plat_config.c b/plat/marvell/a8k/a70x0/board/marvell_plat_config.c
index 9171986..d126f55 100644
--- a/plat/marvell/a8k/a70x0/board/marvell_plat_config.c
+++ b/plat/marvell/a8k/a70x0/board/marvell_plat_config.c
@@ -5,7 +5,7 @@
  * https://spdx.org/licenses
  */
 
-#include <a8k_common.h>
+#include <armada_common.h>
 
 /*
  * If bootrom is currently at BLE there's no need to include the memory
@@ -76,6 +76,8 @@
 	{0x00000000f7000000,	0x1000000,	PEX1_TID},
 	/* PEX2_X1 window */
 	{0x00000000f8000000,	0x1000000,	PEX2_TID},
+	{0x00000000c0000000,	0x30000000,	PEX2_TID},
+	{0x0000000800000000,	0x100000000,	PEX2_TID},
 	/* PEX0_X4 window */
 	{0x00000000f6000000,	0x1000000,	PEX0_TID},
 	/* SPI1_CS0 (RUNIT) window */
@@ -101,6 +103,8 @@
 	{0x00000000f2000000,	0x4000000,	IO_0_TID}, /* IO window */
 #else
 	{0x00000000f2000000,	0xe000000,	IO_0_TID},
+	{0x00000000c0000000,	0x30000000,	IO_0_TID}, /* IO window */
+	{0x0000000800000000,	0x100000000,	IO_0_TID}, /* IO window */
 #endif
 };
 
diff --git a/plat/marvell/a8k/a70x0_amc/board/marvell_plat_config.c b/plat/marvell/a8k/a70x0_amc/board/marvell_plat_config.c
index ec4124c..f8a1c40 100644
--- a/plat/marvell/a8k/a70x0_amc/board/marvell_plat_config.c
+++ b/plat/marvell/a8k/a70x0_amc/board/marvell_plat_config.c
@@ -5,7 +5,7 @@
  * https://spdx.org/licenses
  */
 
-#include <a8k_common.h>
+#include <armada_common.h>
 
 /*
  * If bootrom is currently at BLE there's no need to include the memory
diff --git a/plat/marvell/a8k/a80x0/board/marvell_plat_config.c b/plat/marvell/a8k/a80x0/board/marvell_plat_config.c
index 43beffa..7901dd2 100644
--- a/plat/marvell/a8k/a80x0/board/marvell_plat_config.c
+++ b/plat/marvell/a8k/a80x0/board/marvell_plat_config.c
@@ -5,7 +5,8 @@
  * https://spdx.org/licenses
  */
 
-#include <a8k_common.h>
+#include <armada_common.h>
+
 /*
  * If bootrom is currently at BLE there's no need to include the memory
  * maps structure at this point
@@ -85,7 +86,9 @@
 	/* PEX2_X1 window */
 	{0x00000000f8000000,	0x1000000,	PEX2_TID},
 	/* PEX0_X4 window */
-	{0x00000000f6000000,	0x1000000,	PEX0_TID}
+	{0x00000000f6000000,	0x1000000,	PEX0_TID},
+	{0x00000000c0000000,	0x30000000,	PEX0_TID},
+	{0x0000000800000000,	0x100000000,	PEX0_TID},
 };
 
 struct addr_map_win iob_memory_map_cp1[] = {
@@ -129,6 +132,8 @@
 	{0x00000000f2000000,	0x4000000,  IO_0_TID}, /* IO window */
 #else
 	{0x00000000f2000000,	0xe000000,  IO_0_TID}, /* IO window */
+	{0x00000000c0000000,	0x30000000,  IO_0_TID}, /* IO window */
+	{0x0000000800000000,	0x100000000,  IO_0_TID}, /* IO window */
 #endif
 };
 
diff --git a/plat/marvell/a8k/a80x0_mcbin/board/marvell_plat_config.c b/plat/marvell/a8k/a80x0_mcbin/board/marvell_plat_config.c
index 079bd8f..384d0f5 100644
--- a/plat/marvell/a8k/a80x0_mcbin/board/marvell_plat_config.c
+++ b/plat/marvell/a8k/a80x0_mcbin/board/marvell_plat_config.c
@@ -5,9 +5,10 @@
  * https://spdx.org/licenses
  */
 
-#include <a8k_common.h>
+#include <armada_common.h>
 #include <delay_timer.h>
 #include <mmio.h>
+
 /*
  * If bootrom is currently at BLE there's no need to include the memory
  * maps structure at this point
diff --git a/plat/marvell/a8k/common/a8k_common.mk b/plat/marvell/a8k/common/a8k_common.mk
index 3bcce96..5956737 100644
--- a/plat/marvell/a8k/common/a8k_common.mk
+++ b/plat/marvell/a8k/common/a8k_common.mk
@@ -76,7 +76,8 @@
 				$(MARVELL_DRV_BASE)/amb_adec.c	\
 				$(MARVELL_DRV_BASE)/ccu.c	\
 				$(MARVELL_DRV_BASE)/cache_llc.c	\
-				$(MARVELL_DRV_BASE)/comphy/phy-comphy-cp110.c
+				$(MARVELL_DRV_BASE)/comphy/phy-comphy-cp110.c \
+				$(MARVELL_DRV_BASE)/mc_trustzone/mc_trustzone.c
 
 BL31_PORTING_SOURCES	:=	$(PLAT_FAMILY_BASE)/$(PLAT)/board/marvell_plat_config.c
 
diff --git a/plat/marvell/a8k/common/include/platform_def.h b/plat/marvell/a8k/common/include/platform_def.h
index f7bd23f..06d4fa9 100644
--- a/plat/marvell/a8k/common/include/platform_def.h
+++ b/plat/marvell/a8k/common/include/platform_def.h
@@ -134,6 +134,8 @@
 	INTR_PROP_DESC(MARVELL_IRQ_SEC_SGI_0, GIC_HIGHEST_SEC_PRIORITY, grp, \
 			GIC_INTR_CFG_LEVEL), \
 	INTR_PROP_DESC(MARVELL_IRQ_SEC_SGI_6, GIC_HIGHEST_SEC_PRIORITY, grp, \
+			GIC_INTR_CFG_LEVEL), \
+	INTR_PROP_DESC(MARVELL_IRQ_PIC0, GIC_HIGHEST_SEC_PRIORITY, grp, \
 			GIC_INTR_CFG_LEVEL)
 
 #define PLAT_MARVELL_G1S_IRQ_PROPS(grp) \
@@ -199,4 +201,6 @@
 
 #define BL32_BASE				TRUSTED_DRAM_BASE
 
+#define MVEBU_PMU_IRQ_WA
+
 #endif /* __PLATFORM_DEF_H__ */
diff --git a/plat/marvell/a8k/common/mss/mss_bl2_setup.c b/plat/marvell/a8k/common/mss/mss_bl2_setup.c
index 2154185..973c56d 100644
--- a/plat/marvell/a8k/common/mss/mss_bl2_setup.c
+++ b/plat/marvell/a8k/common/mss/mss_bl2_setup.c
@@ -5,7 +5,7 @@
  * https://spdx.org/licenses
  */
 
-#include <a8k_common.h>
+#include <armada_common.h>
 #include <bl_common.h>
 #include <ccu.h>
 #include <cp110_setup.h>
diff --git a/plat/marvell/a8k/common/plat_bl31_setup.c b/plat/marvell/a8k/common/plat_bl31_setup.c
index 6c85fcc..6dfbcbb 100644
--- a/plat/marvell/a8k/common/plat_bl31_setup.c
+++ b/plat/marvell/a8k/common/plat_bl31_setup.c
@@ -5,12 +5,13 @@
  * https://spdx.org/licenses
  */
 
-#include <a8k_common.h>
+#include <armada_common.h>
 #include <ap_setup.h>
 #include <cp110_setup.h>
 #include <debug.h>
 #include <marvell_plat_priv.h>
 #include <marvell_pm.h>
+#include <mc_trustzone/mc_trustzone.h>
 #include <mmio.h>
 #include <mci.h>
 #include <plat_marvell.h>
@@ -75,6 +76,24 @@
 	return pm_fw_running;
 }
 
+/* For TrusTzone we treat the "target" field of addr_map_win
+ * struct as attribute
+ */
+static const struct addr_map_win tz_map[] = {
+	{PLAT_MARVELL_ATF_BASE, 0x200000, TZ_PERM_ABORT}
+};
+
+/* Configure MC TrustZone regions */
+static void marvell_bl31_security_setup(void)
+{
+	int tz_nr, win_id;
+
+	tz_nr = ARRAY_SIZE(tz_map);
+
+	for (win_id = 0; win_id < tz_nr; win_id++)
+		tz_enable_win(MVEBU_AP0, tz_map, win_id);
+}
+
 /* This function overruns the same function in marvell_bl31_setup.c */
 void bl31_plat_arch_setup(void)
 {
@@ -116,4 +135,6 @@
 
 	/* Configure GPIO */
 	marvell_gpio_config();
+
+	marvell_bl31_security_setup();
 }
diff --git a/plat/marvell/a8k/common/plat_ble_setup.c b/plat/marvell/a8k/common/plat_ble_setup.c
index 0cd62cb..7438f69 100644
--- a/plat/marvell/a8k/common/plat_ble_setup.c
+++ b/plat/marvell/a8k/common/plat_ble_setup.c
@@ -5,8 +5,8 @@
  * https://spdx.org/licenses
  */
 
-#include <a8k_common.h>
 #include <ap_setup.h>
+#include <armada_common.h>
 #include <aro.h>
 #include <ccu.h>
 #include <cp110_setup.h>
@@ -43,11 +43,22 @@
 #define AVS_EN_CTRL_REG			(MVEBU_AP_GEN_MGMT_BASE + 0x130)
 #define AVS_ENABLE_OFFSET		(0)
 #define AVS_SOFT_RESET_OFFSET		(2)
-#define AVS_LOW_VDD_LIMIT_OFFSET	(4)
-#define AVS_HIGH_VDD_LIMIT_OFFSET	(12)
 #define AVS_TARGET_DELTA_OFFSET		(21)
-#define AVS_VDD_LOW_LIMIT_MASK	        (0xFF << AVS_LOW_VDD_LIMIT_OFFSET)
-#define AVS_VDD_HIGH_LIMIT_MASK	        (0xFF << AVS_HIGH_VDD_LIMIT_OFFSET)
+
+#ifndef MVEBU_SOC_AP807
+	/* AP806 SVC bits */
+	#define AVS_LOW_VDD_LIMIT_OFFSET	(4)
+	#define AVS_HIGH_VDD_LIMIT_OFFSET	(12)
+	#define AVS_VDD_LOW_LIMIT_MASK	(0xFF << AVS_LOW_VDD_LIMIT_OFFSET)
+	#define AVS_VDD_HIGH_LIMIT_MASK	(0xFF << AVS_HIGH_VDD_LIMIT_OFFSET)
+#else
+	/* AP807 SVC bits */
+	#define AVS_LOW_VDD_LIMIT_OFFSET	(3)
+	#define AVS_HIGH_VDD_LIMIT_OFFSET	(13)
+	#define AVS_VDD_LOW_LIMIT_MASK	(0x3FF << AVS_LOW_VDD_LIMIT_OFFSET)
+	#define AVS_VDD_HIGH_LIMIT_MASK	(0x3FF << AVS_HIGH_VDD_LIMIT_OFFSET)
+#endif
+
 /* VDD limit is 0.9V for A70x0 @ CPU frequency < 1600MHz */
 #define AVS_A7K_LOW_CLK_VALUE		((0x80 << AVS_TARGET_DELTA_OFFSET) | \
 					 (0x1A << AVS_HIGH_VDD_LIMIT_OFFSET) | \
@@ -84,11 +95,6 @@
 #define AP807_CPU_ARO_SEL_PLL_MASK	(0x1 << AP807_CPU_ARO_SEL_PLL_OFFSET)
 
 /*
- * - AVS work points in the LD0 eFuse:
- *	SVC1 work point:     LD0[88:81]
- *	SVC2 work point:     LD0[96:89]
- *	SVC3 work point:     LD0[104:97]
- *	SVC4 work point:     LD0[112:105]
  * - Identification information in the LD-0 eFuse:
  *	DRO:           LD0[74:65] - Not used by the SW
  *	Revision:      LD0[78:75] - Not used by the SW
@@ -114,11 +120,30 @@
 #define EFUSE_AP_LD0_SWREV_OFFS		50		/* LD0[115:113] */
 #define EFUSE_AP_LD0_SWREV_MASK		0x7
 
-#define EFUSE_AP_LD0_SVC1_OFFS		18		/* LD0[88:81] */
-#define EFUSE_AP_LD0_SVC2_OFFS		26		/* LD0[96:89] */
-#define EFUSE_AP_LD0_SVC3_OFFS		34		/* LD0[104:97] */
+#ifndef MVEBU_SOC_AP807
+	/* AP806 AVS work points in the LD0 eFuse
+	 * SVC1 work point:     LD0[88:81]
+	 * SVC2 work point:     LD0[96:89]
+	 * SVC3 work point:     LD0[104:97]
+	 * SVC4 work point:     LD0[112:105]
+	 */
+	#define EFUSE_AP_LD0_SVC1_OFFS		18	/* LD0[88:81] */
+	#define EFUSE_AP_LD0_SVC2_OFFS		26	/* LD0[96:89] */
+	#define EFUSE_AP_LD0_SVC3_OFFS		34	/* LD0[104:97] */
+	#define EFUSE_AP_LD0_WP_MASK		0xFF
+#else
+	/* AP807 AVS work points in the LD0 eFuse
+	 * SVC1 work point:     LD0[91:81]
+	 * SVC2 work point:     LD0[102:92]
+	 * SVC3 work point:     LD0[113:103]
+	 */
+	#define EFUSE_AP_LD0_SVC1_OFFS		17	/* LD0[91:81] */
+	#define EFUSE_AP_LD0_SVC2_OFFS		28	/* LD0[102:92] */
+	#define EFUSE_AP_LD0_SVC3_OFFS		39	/* LD0[113:103] */
+	#define EFUSE_AP_LD0_WP_MASK		0x3FF
+#endif
+
 #define EFUSE_AP_LD0_SVC4_OFFS		42		/* LD0[112:105] */
-#define EFUSE_AP_LD0_WP_MASK		0xFF
 
 #define EFUSE_AP_LD0_CLUSTER_DOWN_OFFS	4
 
@@ -233,16 +258,8 @@
 	uint32_t reg_val, avs_workpoint, freq_pidi_mode;
 	uint64_t efuse;
 	uint32_t device_id, single_cluster;
-	uint8_t  svc[4], perr[4], i, sw_ver;
-
-	/* Due to a bug in A3900 device_id skip SVC config
-	 * TODO: add SVC config once it is decided for a3900
-	 */
-	if (ble_get_ap_type() == CHIP_ID_AP807) {
-		NOTICE("SVC: SVC is not supported on AP807\n");
-		ble_plat_avs_config();
-		return;
-	}
+	uint16_t  svc[4], perr[4], i, sw_ver;
+	unsigned int ap_type;
 
 	/* Set access to LD0 */
 	reg_val = mmio_read_32(MVEBU_AP_EFUSE_SRV_CTRL_REG);
@@ -276,9 +293,19 @@
 	svc[0] = (efuse >> EFUSE_AP_LD0_SVC1_OFFS) & EFUSE_AP_LD0_WP_MASK;
 	svc[1] = (efuse >> EFUSE_AP_LD0_SVC2_OFFS) & EFUSE_AP_LD0_WP_MASK;
 	svc[2] = (efuse >> EFUSE_AP_LD0_SVC3_OFFS) & EFUSE_AP_LD0_WP_MASK;
-	svc[3] = (efuse >> EFUSE_AP_LD0_SVC4_OFFS) & EFUSE_AP_LD0_WP_MASK;
-	INFO("SVC: Efuse WP: [0]=0x%x, [1]=0x%x, [2]=0x%x, [3]=0x%x\n",
-		svc[0], svc[1], svc[2], svc[3]);
+
+	/* Fetch AP type to distinguish between AP806 and AP807 */
+	ap_type = ble_get_ap_type();
+
+	if (ap_type != CHIP_ID_AP807) {
+		svc[3] = (efuse >> EFUSE_AP_LD0_SVC4_OFFS)
+			 & EFUSE_AP_LD0_WP_MASK;
+		INFO("SVC: Efuse WP: [0]=0x%x, [1]=0x%x, [2]=0x%x, [3]=0x%x\n",
+		     svc[0], svc[1], svc[2], svc[3]);
+	} else {
+		INFO("SVC: Efuse WP: [0]=0x%x, [1]=0x%x, [2]=0x%x\n",
+		     svc[0], svc[1], svc[2]);
+	}
 
 	/* Validate parity of SVC workpoint values */
 	for (i = 0; i < 4; i++) {
@@ -385,6 +412,26 @@
 				avs_workpoint = 0;
 			break;
 		}
+	} else if (device_id == MVEBU_3900_DEV_ID) {
+		NOTICE("SVC: DEV ID: %s, FREQ Mode: 0x%x\n",
+		       "3900", freq_pidi_mode);
+		switch (freq_pidi_mode) {
+		case CPU_1600_DDR_1200_RCLK_1200:
+			if (perr[0])
+				goto perror;
+			avs_workpoint = svc[0];
+			break;
+		case CPU_1300_DDR_800_RCLK_800:
+			if (perr[1])
+				goto perror;
+			avs_workpoint = svc[1];
+			break;
+		default:
+			if (perr[0])
+				goto perror;
+			avs_workpoint = svc[0];
+			break;
+		}
 	} else {
 		ERROR("SVC: Unsupported Device ID 0x%x\n", device_id);
 		return;
@@ -397,7 +444,8 @@
 	}
 
 	/* Remove parity bit */
-	avs_workpoint &= 0x7F;
+	if (ap_type != CHIP_ID_AP807)
+		avs_workpoint &= 0x7F;
 
 	reg_val  = mmio_read_32(AVS_EN_CTRL_REG);
 	NOTICE("SVC: AVS work point changed from 0x%x to 0x%x\n",
diff --git a/plat/marvell/a8k/common/plat_pm.c b/plat/marvell/a8k/common/plat_pm.c
index c716ee0..0c74b2f 100644
--- a/plat/marvell/a8k/common/plat_pm.c
+++ b/plat/marvell/a8k/common/plat_pm.c
@@ -5,7 +5,7 @@
  * https://spdx.org/licenses
  */
 
-#include <a8k_common.h>
+#include <armada_common.h>
 #include <assert.h>
 #include <bakery_lock.h>
 #include <debug.h>
@@ -379,8 +379,10 @@
  */
 static void a8k_cpu_standby(plat_local_state_t cpu_state)
 {
-	ERROR("%s: needs to be implemented\n", __func__);
-	panic();
+	if (!is_pm_fw_running()) {
+		ERROR("%s: needs to be implemented\n", __func__);
+		panic();
+	}
 }
 
 /*****************************************************************************
diff --git a/plat/marvell/common/marvell_gicv2.c b/plat/marvell/common/marvell_gicv2.c
index ba8e409..19e1ec0 100644
--- a/plat/marvell/common/marvell_gicv2.c
+++ b/plat/marvell/common/marvell_gicv2.c
@@ -5,7 +5,11 @@
  * https://spdx.org/licenses
  */
 
+#include <bakery_lock.h>
+#include <debug.h>
 #include <gicv2.h>
+#include <interrupt_mgmt.h>
+#include <mmio.h>
 #include <plat_marvell.h>
 #include <platform.h>
 #include <platform_def.h>
@@ -17,6 +21,21 @@
 #pragma weak plat_marvell_gic_driver_init
 #pragma weak plat_marvell_gic_init
 
+#define A7K8K_PIC_CAUSE_REG		0xf03f0100
+#define A7K8K_PIC0_MASK_REG		0xf03f0108
+
+#define A7K8K_PIC_PMUOF_IRQ_MASK	(1 << 17)
+
+#define A7K8K_PIC_MAX_IRQS		32
+#define A7K8K_PIC_MAX_IRQ_MASK		((1UL << A7K8K_PIC_MAX_IRQS) - 1)
+
+#define A7K8K_ODMIN_SET_REG		0xf0300040
+#define A7K8K_ODMI_PMU_IRQ(idx)		((2 + idx) << 12)
+
+#define A7K8K_ODMI_PMU_GIC_IRQ(idx)	(130 + idx)
+
+static DEFINE_BAKERY_LOCK(a7k8k_irq_lock);
+
 /*
  * On a GICv2 system, the Group 1 secure interrupts are treated as Group 0
  * interrupts.
@@ -50,6 +69,74 @@
 	gicv2_driver_init(&marvell_gic_data);
 }
 
+static uint64_t a7k8k_pmu_interrupt_handler(uint32_t id,
+					  uint32_t flags,
+					  void *handle,
+					  void *cookie)
+{
+	unsigned int idx = plat_my_core_pos();
+	uint32_t irq;
+
+	bakery_lock_get(&a7k8k_irq_lock);
+
+	/* Acknowledge IRQ */
+	irq = plat_ic_acknowledge_interrupt();
+
+	plat_ic_end_of_interrupt(irq);
+
+	if (irq != MARVELL_IRQ_PIC0) {
+		bakery_lock_release(&a7k8k_irq_lock);
+		return 0;
+	}
+
+	/* Acknowledge PMU overflow IRQ in PIC0 */
+	mmio_setbits_32(A7K8K_PIC_CAUSE_REG, A7K8K_PIC_PMUOF_IRQ_MASK);
+
+	/* Trigger ODMI Frame IRQ */
+	mmio_write_32(A7K8K_ODMIN_SET_REG, A7K8K_ODMI_PMU_IRQ(idx));
+
+	bakery_lock_release(&a7k8k_irq_lock);
+
+	return 0;
+}
+
+void mvebu_pmu_interrupt_enable(void)
+{
+	unsigned int idx;
+	uint32_t flags;
+	int32_t rc;
+
+	/* Reset PIC */
+	mmio_write_32(A7K8K_PIC_CAUSE_REG, A7K8K_PIC_MAX_IRQ_MASK);
+	/* Unmask PMU overflow IRQ in PIC0 */
+	mmio_clrbits_32(A7K8K_PIC0_MASK_REG, A7K8K_PIC_PMUOF_IRQ_MASK);
+
+	/* Configure ODMI Frame IRQs as edge triggered */
+	for (idx = 0; idx < PLATFORM_CORE_COUNT; idx++)
+		gicv2_interrupt_set_cfg(A7K8K_ODMI_PMU_GIC_IRQ(idx),
+					GIC_INTR_CFG_EDGE);
+
+	/*
+	 * Register IRQ handler as INTR_TYPE_S_EL1 as its the only valid type
+	 * for GICv2 in ARM-TF.
+	 */
+	flags = 0U;
+	set_interrupt_rm_flag((flags), (NON_SECURE));
+	rc = register_interrupt_type_handler(INTR_TYPE_S_EL1,
+					     a7k8k_pmu_interrupt_handler,
+					     flags);
+	if (rc != 0)
+		panic();
+}
+
+void mvebu_pmu_interrupt_disable(void)
+{
+	/* Reset PIC */
+	mmio_write_32(A7K8K_PIC_CAUSE_REG, A7K8K_PIC_MAX_IRQ_MASK);
+	/* Mask PMU overflow IRQ in PIC0 */
+	mmio_setbits_32(A7K8K_PIC0_MASK_REG, A7K8K_PIC_PMUOF_IRQ_MASK);
+}
+
 void plat_marvell_gic_init(void)
 {
 	gicv2_distif_init();
diff --git a/plat/marvell/common/mrvl_sip_svc.c b/plat/marvell/common/mrvl_sip_svc.c
index ec293af..a0ca50d 100644
--- a/plat/marvell/common/mrvl_sip_svc.c
+++ b/plat/marvell/common/mrvl_sip_svc.c
@@ -9,6 +9,7 @@
 #include <cache_llc.h>
 #include <debug.h>
 #include <marvell_plat_priv.h>
+#include <plat_marvell.h>
 #include <runtime_svc.h>
 #include <smcc.h>
 #include "comphy/phy-comphy-cp110.h"
@@ -30,6 +31,8 @@
 /* Miscellaneous FID's' */
 #define MV_SIP_DRAM_SIZE	0x82000010
 #define MV_SIP_LLC_ENABLE	0x82000011
+#define MV_SIP_PMU_IRQ_ENABLE	0x82000012
+#define MV_SIP_PMU_IRQ_DISABLE	0x82000013
 
 #define MAX_LANE_NR		6
 #define MVEBU_COMPHY_OFFSET	0x441000
@@ -109,6 +112,14 @@
 			llc_runtime_enable(i);
 
 		SMC_RET1(handle, 0);
+#ifdef MVEBU_PMU_IRQ_WA
+	case MV_SIP_PMU_IRQ_ENABLE:
+		mvebu_pmu_interrupt_enable();
+		SMC_RET1(handle, 0);
+	case MV_SIP_PMU_IRQ_DISABLE:
+		mvebu_pmu_interrupt_disable();
+		SMC_RET1(handle, 0);
+#endif
 
 	default:
 		ERROR("%s: unhandled SMC (0x%x)\n", __func__, smc_fid);
diff --git a/plat/marvell/marvell.mk b/plat/marvell/marvell.mk
index 217ad46..2a2da3b 100644
--- a/plat/marvell/marvell.mk
+++ b/plat/marvell/marvell.mk
@@ -48,6 +48,7 @@
 	${Q}${MAKE} PLAT=${PLAT} --no-print-directory -C ${DOIMAGEPATH} clean
 
 ${DOIMAGETOOL}: mrvl_clean
+	@$(DOIMAGE_LIBS_CHECK)
 	${Q}${MAKE} --no-print-directory -C ${DOIMAGEPATH} WTMI_IMG=$(WTMI_IMG)
 
 
diff --git a/plat/marvell/version.mk b/plat/marvell/version.mk
index 017e119..16b0a16 100644
--- a/plat/marvell/version.mk
+++ b/plat/marvell/version.mk
@@ -1 +1 @@
-SUBVERSION = devel-18.08.0
+SUBVERSION = devel-18.09.1
diff --git a/plat/ti/k3/common/k3_psci.c b/plat/ti/k3/common/k3_psci.c
index 4c501f5..e75ebac 100644
--- a/plat/ti/k3/common/k3_psci.c
+++ b/plat/ti/k3/common/k3_psci.c
@@ -76,10 +76,19 @@
 
 void k3_pwr_domain_off(const psci_power_state_t *target_state)
 {
+	int core_id, device, ret;
+
 	/* Prevent interrupts from spuriously waking up this cpu */
 	k3_gic_cpuif_disable();
 
-	/* TODO: Indicate to System firmware about powering down */
+	core_id = plat_my_core_pos();
+	device = PLAT_PROC_DEVICE_START_ID + core_id;
+
+	ret = ti_sci_device_put(device);
+	if (ret) {
+		ERROR("Request to stop core failed: %d\n", ret);
+		return;
+	}
 }
 
 void k3_pwr_domain_on_finish(const psci_power_state_t *target_state)
diff --git a/plat/xilinx/zynqmp/aarch64/zynqmp_common.c b/plat/xilinx/zynqmp/aarch64/zynqmp_common.c
index c361270..2f4228f 100644
--- a/plat/xilinx/zynqmp/aarch64/zynqmp_common.c
+++ b/plat/xilinx/zynqmp/aarch64/zynqmp_common.c
@@ -44,19 +44,10 @@
 {
 	unsigned int ver = zynqmp_get_silicon_ver();
 
-	switch (ver) {
-	case ZYNQMP_CSU_VERSION_VELOCE:
-		return 48000;
-	case ZYNQMP_CSU_VERSION_EP108:
-		return 25000000;
-	case ZYNQMP_CSU_VERSION_QEMU:
+	if (ver == ZYNQMP_CSU_VERSION_QEMU)
 		return 133000000;
-	default:
-		/* Do nothing in default case */
-		break;
-	}
-
-	return 100000000;
+	else
+		return 100000000;
 }
 
 #if LOG_LEVEL >= LOG_LEVEL_NOTICE
@@ -298,12 +289,6 @@
 	char *label = "Unknown";
 
 	switch (ver) {
-	case ZYNQMP_CSU_VERSION_VELOCE:
-		label = "VELOCE";
-		break;
-	case ZYNQMP_CSU_VERSION_EP108:
-		label = "EP108";
-		break;
 	case ZYNQMP_CSU_VERSION_QEMU:
 		label = "QEMU";
 		break;
@@ -346,17 +331,8 @@
 {
 	unsigned int ver = zynqmp_get_silicon_ver();
 
-	switch (ver) {
-	case ZYNQMP_CSU_VERSION_VELOCE:
-		return 10000;
-	case ZYNQMP_CSU_VERSION_EP108:
-		return 4000000;
-	case ZYNQMP_CSU_VERSION_QEMU:
+	if (ver == ZYNQMP_CSU_VERSION_QEMU)
 		return 50000000;
-	default:
-		/* Do nothing in default case */
-		break;
-	}
-
-	return mmio_read_32(IOU_SCNTRS_BASEFREQ);
+	else
+		return mmio_read_32(IOU_SCNTRS_BASEFREQ);
 }
diff --git a/plat/xilinx/zynqmp/platform.mk b/plat/xilinx/zynqmp/platform.mk
index 3ac9db9..f806d46 100644
--- a/plat/xilinx/zynqmp/platform.mk
+++ b/plat/xilinx/zynqmp/platform.mk
@@ -17,6 +17,10 @@
 
 WORKAROUND_CVE_2017_5715	:=	0
 
+ARM_XLAT_TABLES_LIB_V1		:=	1
+$(eval $(call assert_boolean,ARM_XLAT_TABLES_LIB_V1))
+$(eval $(call add_define,ARM_XLAT_TABLES_LIB_V1))
+
 ifdef ZYNQMP_ATF_MEM_BASE
     $(eval $(call add_define,ZYNQMP_ATF_MEM_BASE))
 
diff --git a/plat/xilinx/zynqmp/pm_service/pm_api_clock.c b/plat/xilinx/zynqmp/pm_service/pm_api_clock.c
index a41eebb..b175b78 100644
--- a/plat/xilinx/zynqmp/pm_service/pm_api_clock.c
+++ b/plat/xilinx/zynqmp/pm_service/pm_api_clock.c
@@ -25,7 +25,6 @@
 #define CLK_TOPOLOGY_NODE_OFFSET	U(16)
 #define CLK_TOPOLOGY_PAYLOAD_LEN	U(12)
 #define CLK_PARENTS_PAYLOAD_LEN		U(12)
-#define CLK_INIT_ENABLE_SHIFT		U(1)
 #define CLK_TYPE_SHIFT			U(2)
 #define CLK_CLKFLAGS_SHIFT		U(8)
 #define CLK_TYPEFLAGS_SHIFT		U(24)
@@ -337,7 +336,8 @@
 		.width = PERIPH_GATE_WIDTH,
 		.clkflags = CLK_SET_RATE_PARENT |
 			    CLK_IGNORE_UNUSED |
-			    CLK_IS_BASIC,
+			    CLK_IS_BASIC |
+			    CLK_IS_CRITICAL,
 		.typeflags = NA_TYPE_FLAGS,
 		.mult = NA_MULT,
 		.div = NA_DIV,
@@ -496,7 +496,7 @@
 		.type = TYPE_DIV1,
 		.offset = 8,
 		.width = 6,
-		.clkflags = CLK_IS_BASIC,
+		.clkflags = CLK_IS_BASIC | CLK_IS_CRITICAL,
 		.typeflags = CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO,
 		.mult = NA_MULT,
 		.div = NA_DIV,
@@ -2022,12 +2022,11 @@
 	},
 	[CLK_WDT] = {
 		.name = "wdt",
-		.control_reg = IOU_SLCR_WDT_CLK_SEL,
+		.control_reg = FPD_SLCR_WDT_CLK_SEL,
 		.status_reg = 0,
 		.parents = &((int32_t []) {
 			CLK_TOPSW_LSBUS,
 			EXT_CLK_SWDT0 | CLK_EXTERNAL_PARENT,
-			EXT_CLK_SWDT1 | CLK_EXTERNAL_PARENT,
 			CLK_NA_PARENT
 		}),
 		.nodes = &wdt_nodes,
@@ -2243,12 +2242,6 @@
 /* Array of clock which are invalid for this variant */
 static uint32_t pm_clk_invalid_list[] = {CLK_USB0, CLK_USB1, CLK_CSU_SPB};
 
-/* Array of clocks which needs to be enabled at init */
-static uint32_t pm_clk_init_enable_list[] = {
-	CLK_ACPU,
-	CLK_DDR_REF,
-};
-
 /**
  * pm_clock_valid - Check if clock is valid or not
  * @clock_id	Id of the clock to be queried
@@ -2273,26 +2266,6 @@
 }
 
 /**
- * pm_clock_init_enable - Check if clock needs to be enabled at init
- * @clock_id	Id of the clock to be queried
- *
- * This function is used to check if given clock needs to be enabled
- * at boot up or not. Some clocks needs to be enabled at init.
- *
- * Return: Returns 1 if clock needs to be enabled at boot up else 0.
- */
-static unsigned int pm_clock_init_enable(unsigned int clock_id)
-{
-	unsigned int i;
-
-	for (i = 0; i < ARRAY_SIZE(pm_clk_init_enable_list); i++)
-		if (pm_clk_init_enable_list[i] == clock_id)
-			return 1;
-
-	return 0;
-}
-
-/**
  * pm_clock_type - Get clock's type
  * @clock_id	Id of the clock to be queried
  *
@@ -2307,6 +2280,21 @@
 }
 
 /**
+ * pm_api_clock_get_num_clocks() - PM call to request number of clocks
+ * @nclocks	Number of clocks
+ *
+ * This function is used by master to get number of clocks.
+ *
+ * @return	Returns success.
+ */
+enum pm_ret_status pm_api_clock_get_num_clocks(unsigned int *nclocks)
+{
+	*nclocks = CLK_MAX;
+
+	return PM_RET_SUCCESS;
+}
+
+/**
  * pm_api_clock_get_name() - PM call to request a clock's name
  * @clock_id	Clock ID
  * @name	Name of clock (max 16 bytes)
@@ -2494,9 +2482,6 @@
 	/* Clock valid bit */
 	*attr = pm_clock_valid(clock_id);
 
-	/* If clock needs to be enabled during init */
-	*attr |= (pm_clock_init_enable(clock_id) << CLK_INIT_ENABLE_SHIFT);
-
 	/* Clock type (Output/External) */
 	*attr |= (pm_clock_type(clock_id) << CLK_TYPE_SHIFT);
 
@@ -2642,10 +2627,11 @@
 	if (pm_clock_type(clock_id) != CLK_TYPE_OUTPUT)
 		return PM_RET_ERROR_NOTSUPPORTED;
 
-	if (ISPLL(clock_id))
-		ret = pm_api_pll_bypass_and_reset(clock_id,
-						  CLK_PLL_RESET_PULSE);
-	else
+	/*
+	 * PLL type clock should not enable explicitly.
+	 * It is done by FSBL on boot-up and by PMUFW whenever required.
+	 */
+	if (!ISPLL(clock_id))
 		ret = pm_api_clk_enable_disable(clock_id, 1);
 
 	return ret;
@@ -2671,10 +2657,11 @@
 	if (pm_clock_type(clock_id) != CLK_TYPE_OUTPUT)
 		return PM_RET_ERROR_NOTSUPPORTED;
 
-	if (ISPLL(clock_id))
-		ret = pm_api_pll_bypass_and_reset(clock_id,
-						  CLK_PLL_RESET_ASSERT);
-	else
+	/*
+	 * PLL type clock should not be disabled explicitly.
+	 * It is done by PMUFW if required.
+	 */
+	if (!ISPLL(clock_id))
 		ret = pm_api_clk_enable_disable(clock_id, 0);
 
 	return ret;
@@ -2822,8 +2809,13 @@
 					  unsigned int divider)
 {
 	unsigned int reg = clocks[clock_id].control_reg;
+	enum pm_ret_status ret;
 
-	return pm_mmio_write(reg, PLL_FBDIV_MASK, divider << PLL_FBDIV_SHIFT);
+	pm_api_pll_bypass_and_reset(clock_id, CLK_PLL_RESET_ASSERT);
+	ret = pm_mmio_write(reg, PLL_FBDIV_MASK, divider << PLL_FBDIV_SHIFT);
+	pm_api_pll_bypass_and_reset(clock_id, CLK_PLL_RESET_RELEASE);
+
+	return ret;
 }
 
 /**
@@ -2973,7 +2965,7 @@
 /**
  * pm_api_clock_setparent - Set the clock parent for given id
  * @clock_id	Id of the clock
- * @parent_id	parent id
+ * @parent_idx	parent index
  *
  * This function is used by master to set parent for any clock.
  *
@@ -3024,7 +3016,7 @@
 /**
  * pm_api_clock_getparent - Get the clock parent for given id
  * @clock_id	Id of the clock
- * @parent_id	parent id
+ * @parent_idx	parent index
  *
  * This function is used by master to get parent index
  * for any clock.
diff --git a/plat/xilinx/zynqmp/pm_service/pm_api_clock.h b/plat/xilinx/zynqmp/pm_service/pm_api_clock.h
index 56f850a..386f275 100644
--- a/plat/xilinx/zynqmp/pm_service/pm_api_clock.h
+++ b/plat/xilinx/zynqmp/pm_service/pm_api_clock.h
@@ -276,6 +276,7 @@
 
 
 enum pm_ret_status pm_api_clock_get_name(unsigned int clock_id, char *name);
+enum pm_ret_status pm_api_clock_get_num_clocks(unsigned int *nclocks);
 enum pm_ret_status pm_api_clock_get_topology(unsigned int clock_id,
 					     unsigned int index,
 					     uint32_t *topology);
diff --git a/plat/xilinx/zynqmp/pm_service/pm_api_ioctl.c b/plat/xilinx/zynqmp/pm_service/pm_api_ioctl.c
index cdbb515..32c7357 100644
--- a/plat/xilinx/zynqmp/pm_service/pm_api_ioctl.c
+++ b/plat/xilinx/zynqmp/pm_service/pm_api_ioctl.c
@@ -453,6 +453,48 @@
 }
 
 /**
+ * pm_ioctl_afi() - Ioctl function for writing afi values
+ *
+ * @index 	AFI register index
+ * @value	Register value to be written
+ *
+ *
+ * @return      Returns status, either success or error+reason
+ */
+static enum pm_ret_status pm_ioctl_afi(unsigned int index,
+					      unsigned int value)
+{
+	unsigned int mask;
+	unsigned int regarr[] = {0xFD360000,
+				0xFD360014,
+				0xFD370000,
+				0xFD370014,
+				0xFD380000,
+				0xFD380014,
+				0xFD390000,
+				0xFD390014,
+				0xFD3a0000,
+				0xFD3a0014,
+				0xFD3b0000,
+				0xFD3b0014,
+				0xFF9b0000,
+				0xFF9b0014,
+				0xFD615000,
+				0xFF419000,
+				};
+
+	if (index >= ARRAY_SIZE(regarr))
+		return PM_RET_ERROR_ARGS;
+
+	if (index < AFIFM6_WRCTRL)
+		mask = FABRIC_WIDTH;
+	else
+		mask = 0xf00;
+
+	return pm_mmio_write(regarr[index], mask, value);
+}
+
+/**
  * pm_ioctl_read_pggs() - Ioctl function for reading persistent
  *			  global general storage (pggs)
  * @index	PGGS register index
@@ -472,6 +514,54 @@
 }
 
 /**
+ * pm_ioctl_ulpi_reset() - Ioctl function for performing ULPI reset
+ *
+ * This function peerforms the ULPI reset sequence for resetting
+ * the ULPI transceiver.
+ *
+ * @return      Returns status, either success or error+reason
+ */
+static enum pm_ret_status pm_ioctl_ulpi_reset(void)
+{
+	enum pm_ret_status ret;
+
+	ret = pm_mmio_write(CRL_APB_BOOT_PIN_CTRL, CRL_APB_BOOT_PIN_MASK,
+			    ZYNQMP_ULPI_RESET_VAL_HIGH);
+	if (ret != PM_RET_SUCCESS)
+		return ret;
+
+	/* Drive ULPI assert for atleast 1ms */
+	mdelay(1);
+
+	ret = pm_mmio_write(CRL_APB_BOOT_PIN_CTRL, CRL_APB_BOOT_PIN_MASK,
+			    ZYNQMP_ULPI_RESET_VAL_LOW);
+	if (ret != PM_RET_SUCCESS)
+		return ret;
+
+	/* Drive ULPI de-assert for atleast 1ms */
+	mdelay(1);
+
+	ret = pm_mmio_write(CRL_APB_BOOT_PIN_CTRL, CRL_APB_BOOT_PIN_MASK,
+			    ZYNQMP_ULPI_RESET_VAL_HIGH);
+
+	return ret;
+}
+
+/**
+ * pm_ioctl_set_boot_health_status() - Ioctl for setting healthy boot status
+ *
+ * This function sets healthy bit value to indicate boot health status
+ * to firmware.
+ *
+ * @return      Returns status, either success or error+reason
+ */
+static enum pm_ret_status pm_ioctl_set_boot_health_status(unsigned int value)
+{
+	return pm_mmio_write(PM_BOOT_HEALTH_STATUS_REG,
+			     PM_BOOT_HEALTH_STATUS_MASK, value);
+}
+
+/**
  * pm_api_ioctl() -  PM IOCTL API for device control and configs
  * @node_id	Node ID of the device
  * @ioctl_id	ID of the requested IOCTL
@@ -540,6 +630,15 @@
 	case IOCTL_READ_PGGS:
 		ret = pm_ioctl_read_pggs(arg1, value);
 		break;
+	case IOCTL_ULPI_RESET:
+		ret = pm_ioctl_ulpi_reset();
+		break;
+	case IOCTL_SET_BOOT_HEALTH_STATUS:
+		ret = pm_ioctl_set_boot_health_status(arg1);
+		break;
+	case IOCTL_AFI:
+		ret = pm_ioctl_afi(arg1, arg2);
+		break;
 	default:
 		ret = PM_RET_ERROR_NOTSUPPORTED;
 		break;
diff --git a/plat/xilinx/zynqmp/pm_service/pm_api_ioctl.h b/plat/xilinx/zynqmp/pm_service/pm_api_ioctl.h
index 081259f..d68c5e3 100644
--- a/plat/xilinx/zynqmp/pm_service/pm_api_ioctl.h
+++ b/plat/xilinx/zynqmp/pm_service/pm_api_ioctl.h
@@ -32,6 +32,11 @@
 	IOCTL_READ_GGS,
 	IOCTL_WRITE_PGGS,
 	IOCTL_READ_PGGS,
+	/* IOCTL for ULPI reset */
+	IOCTL_ULPI_RESET,
+	/* Set healthy bit value */
+	IOCTL_SET_BOOT_HEALTH_STATUS,
+	IOCTL_AFI,
 };
 
 //RPU operation mode
diff --git a/plat/xilinx/zynqmp/pm_service/pm_api_sys.c b/plat/xilinx/zynqmp/pm_service/pm_api_sys.c
index 133043d..e85b2ce 100644
--- a/plat/xilinx/zynqmp/pm_service/pm_api_sys.c
+++ b/plat/xilinx/zynqmp/pm_service/pm_api_sys.c
@@ -602,6 +602,30 @@
 }
 
 /**
+ * pm_aes_engine() - Aes data blob encryption/decryption
+ * This function provides access to the xilsecure library to
+ * encrypt/decrypt data blobs.
+ *
+ * address_low: lower 32-bit address of the AesParams structure
+ *
+ * address_high: higher 32-bit address of the AesParams structure
+ *
+ * value:        Returned output value
+ *
+ * @return       Returns status, either success or error+reason
+ */
+enum pm_ret_status pm_aes_engine(uint32_t address_high,
+				 uint32_t address_low,
+				 uint32_t *value)
+{
+	uint32_t payload[PAYLOAD_ARG_CNT];
+
+	/* Send request to the PMU */
+	PM_PACK_PAYLOAD3(payload, PM_SECURE_AES, address_high, address_low);
+	return pm_ipi_send_sync(primary_proc, payload, value, 1);
+}
+
+/**
  * pm_pinctrl_request() - Request Pin from firmware
  * @pin		Pin number to request
  *
@@ -713,6 +737,19 @@
 }
 
 /**
+ * pm_clock_get_num_clocks - PM call to request number of clocks
+ * @nclockss: Number of clocks
+ *
+ * This function is used by master to get number of clocks.
+ *
+ * Return: Returns status, either success or error+reason.
+ */
+static enum pm_ret_status pm_clock_get_num_clocks(uint32_t *nclocks)
+{
+	return pm_api_clock_get_num_clocks(nclocks);
+}
+
+/**
  * pm_clock_get_name() - PM call to request a clock's name
  * @clock_id	Clock ID
  * @name	Name of clock (max 16 bytes)
@@ -1118,6 +1155,10 @@
 						(uint16_t *)&data[1]);
 		data[0] = (unsigned int)ret;
 		break;
+	case PM_QID_CLOCK_GET_NUM_CLOCKS:
+		ret = pm_clock_get_num_clocks(&data[1]);
+		data[0] = (unsigned int)ret;
+		break;
 	default:
 		ret = PM_RET_ERROR_ARGS;
 		WARN("Unimplemented query service call: 0x%x\n", qid);
@@ -1166,3 +1207,33 @@
 			 key_hi, key_lo);
 	return pm_ipi_send_sync(primary_proc, payload, value, 2);
 }
+
+/**
+ * pm_fpga_read - Perform the fpga configuration readback
+ *
+ * @reg_numframes: Configuration register offset (or) Number of frames to read
+ * @address_low: lower 32-bit Linear memory space address
+ * @address_high: higher 32-bit Linear memory space address
+ * @readback_type: Type of fpga readback operation
+ *		   0 -- Configuration Register readback
+ *		   1 -- Configuration Data readback
+ * @value:	Value to read
+ *
+ * This function provides access to the xilfpga library to read
+ * the PL configuration.
+ *
+ * Return: Returns status, either success or error+reason.
+ */
+enum pm_ret_status pm_fpga_read(uint32_t reg_numframes,
+				uint32_t address_low,
+				uint32_t address_high,
+				uint32_t readback_type,
+				uint32_t *value)
+{
+	uint32_t payload[PAYLOAD_ARG_CNT];
+
+	/* Send request to the PMU */
+	PM_PACK_PAYLOAD5(payload, PM_FPGA_READ, reg_numframes, address_low,
+			 address_high, readback_type);
+	return pm_ipi_send_sync(primary_proc, payload, value, 1);
+}
diff --git a/plat/xilinx/zynqmp/pm_service/pm_api_sys.h b/plat/xilinx/zynqmp/pm_service/pm_api_sys.h
index 55a8a6e..1c9255e 100644
--- a/plat/xilinx/zynqmp/pm_service/pm_api_sys.h
+++ b/plat/xilinx/zynqmp/pm_service/pm_api_sys.h
@@ -23,6 +23,7 @@
 	PM_QID_PINCTRL_GET_FUNCTION_NAME,
 	PM_QID_PINCTRL_GET_FUNCTION_GROUPS,
 	PM_QID_PINCTRL_GET_PIN_GROUPS,
+	PM_QID_CLOCK_GET_NUM_CLOCKS,
 };
 
 /**********************************************************
@@ -165,4 +166,14 @@
 				   uint32_t key_lo,
 				   uint32_t key_hi,
 				   uint32_t *value);
+
+enum pm_ret_status pm_fpga_read(uint32_t reg_numframes,
+				uint32_t address_low,
+				uint32_t address_high,
+				uint32_t readback_type,
+				uint32_t *value);
+enum pm_ret_status pm_aes_engine(uint32_t address_high,
+				 uint32_t address_low,
+				 uint32_t  *value);
+
 #endif /* _PM_API_SYS_H_ */
diff --git a/plat/xilinx/zynqmp/pm_service/pm_defs.h b/plat/xilinx/zynqmp/pm_service/pm_defs.h
index 9a8026f..1fbf6ee 100644
--- a/plat/xilinx/zynqmp/pm_service/pm_defs.h
+++ b/plat/xilinx/zynqmp/pm_service/pm_defs.h
@@ -89,6 +89,9 @@
 	PM_CLOCK_SETPARENT,
 	PM_CLOCK_GETPARENT,
 	PM_SECURE_IMAGE,
+	/* FPGA PL Readback */
+	PM_FPGA_READ,
+	PM_SECURE_AES,
 	PM_API_MAX
 };
 
diff --git a/plat/xilinx/zynqmp/pm_service/pm_svc_main.c b/plat/xilinx/zynqmp/pm_service/pm_svc_main.c
index dd9bbc8..7790c97 100644
--- a/plat/xilinx/zynqmp/pm_service/pm_svc_main.c
+++ b/plat/xilinx/zynqmp/pm_service/pm_svc_main.c
@@ -546,6 +546,23 @@
 			 result[1]);
 	}
 
+	case PM_FPGA_READ:
+	{
+		uint32_t value;
+
+		ret = pm_fpga_read(pm_arg[0], pm_arg[1], pm_arg[2], pm_arg[3],
+				   &value);
+		SMC_RET1(handle, (uint64_t)ret | ((uint64_t)value) << 32);
+	}
+
+	case PM_SECURE_AES:
+	{
+		uint32_t value;
+
+		ret = pm_aes_engine(pm_arg[0], pm_arg[1], &value);
+		SMC_RET1(handle, (uint64_t)ret | ((uint64_t)value) << 32);
+	}
+
 	default:
 		WARN("Unimplemented PM Service Call: 0x%x\n", smc_fid);
 		SMC_RET1(handle, SMC_UNK);
diff --git a/plat/xilinx/zynqmp/zynqmp_def.h b/plat/xilinx/zynqmp/zynqmp_def.h
index 22256eb..50a7331 100644
--- a/plat/xilinx/zynqmp/zynqmp_def.h
+++ b/plat/xilinx/zynqmp/zynqmp_def.h
@@ -48,6 +48,7 @@
 #define CRL_APB_BOOT_MODE_USER		(CRL_APB_BASE + 0x200)
 #define CRL_APB_RESET_CTRL		(CRL_APB_BASE + 0x218)
 #define CRL_APB_RST_LPD_TOP		(CRL_APB_BASE + 0x23C)
+#define CRL_APB_BOOT_PIN_CTRL		(CRL_APB_BASE + U(0x250))
 #define CRL_APB_CLK_BASE		U(0xFF5E0020)
 
 #define CRL_APB_RPU_AMBA_RESET		(U(1) << 2)
@@ -56,7 +57,15 @@
 #define CRL_APB_RESET_CTRL_SOFT_RESET	(U(1) << 4)
 
 #define CRL_APB_BOOT_MODE_MASK		(U(0xf) << 0)
+#define CRL_APB_BOOT_PIN_MASK		(U(0xf0f) << 0)
+#define CRL_APB_BOOT_DRIVE_PIN_1_SHIFT	U(9)
+#define CRL_APB_BOOT_ENABLE_PIN_1_SHIFT	U(1)
+#define CRL_APB_BOOT_ENABLE_PIN_1	(U(0x1) << CRL_APB_BOOT_ENABLE_PIN_1_SHIFT)
+#define CRL_APB_BOOT_DRIVE_PIN_1	(U(0x1) << CRL_APB_BOOT_DRIVE_PIN_1_SHIFT)
 #define ZYNQMP_BOOTMODE_JTAG		U(0)
+#define ZYNQMP_ULPI_RESET_VAL_HIGH	(CRL_APB_BOOT_ENABLE_PIN_1 | \
+					 CRL_APB_BOOT_DRIVE_PIN_1)
+#define ZYNQMP_ULPI_RESET_VAL_LOW	CRL_APB_BOOT_ENABLE_PIN_1
 
 /* system counter registers and bitfields */
 #define IOU_SCNTRS_BASE			0xFF260000
@@ -148,8 +157,6 @@
 #define ZYNQMP_SILICON_VER_MASK		0xF000
 #define ZYNQMP_SILICON_VER_SHIFT	12
 #define ZYNQMP_CSU_VERSION_SILICON	0
-#define ZYNQMP_CSU_VERSION_EP108	1
-#define ZYNQMP_CSU_VERSION_VELOCE	2
 #define ZYNQMP_CSU_VERSION_QEMU		3
 
 #define ZYNQMP_RTL_VER_MASK		0xFF0
@@ -192,6 +199,7 @@
 #define ACTLR_EL3_L2ACTLR_BIT	(1 << 6)
 #define ACTLR_EL3_CPUACTLR_BIT	(1 << 0)
 
+#define FPD_SLCR_BASEADDR		U(0xFD610000)
 #define IOU_SLCR_BASEADDR		U(0xFF180000)
 
 #define ZYNQMP_RPU_GLBL_CNTL			U(0xFF9A0000)
@@ -316,7 +324,7 @@
 #define CRL_APB_TIMESTAMP_REF_CTRL	(CRL_APB_CLK_BASE + 0x108)
 #define IOU_SLCR_GEM_CLK_CTRL		(IOU_SLCR_BASEADDR + 0x308)
 #define IOU_SLCR_CAN_MIO_CTRL		(IOU_SLCR_BASEADDR + 0x304)
-#define IOU_SLCR_WDT_CLK_SEL		(IOU_SLCR_BASEADDR + 0x300)
+#define FPD_SLCR_WDT_CLK_SEL		(FPD_SLCR_BASEADDR + 0x100)
 
 /* Global general storage register base address */
 #define GGS_BASEADDR		(0xFFD80030U)
@@ -326,4 +334,12 @@
 #define PGGS_BASEADDR		(0xFFD80050U)
 #define PGGS_NUM_REGS		U(4)
 
+/* Warm restart boot health status register and mask */
+#define PM_BOOT_HEALTH_STATUS_REG		(GGS_BASEADDR + U(0x10))
+#define PM_BOOT_HEALTH_STATUS_MASK		U(0x01)
+
+/*AFI registers */
+#define  AFIFM6_WRCTRL		U(13)
+#define  FABRIC_WIDTH		U(3)
+
 #endif /* __ZYNQMP_DEF_H__ */
diff --git a/services/spd/opteed/opteed_pm.c b/services/spd/opteed/opteed_pm.c
index bdacf98..b133651 100644
--- a/services/spd/opteed/opteed_pm.c
+++ b/services/spd/opteed/opteed_pm.c
@@ -66,6 +66,9 @@
 	assert(optee_vector_table);
 	assert(get_optee_pstate(optee_ctx->state) == OPTEE_PSTATE_ON);
 
+	write_ctx_reg(get_gpregs_ctx(&optee_ctx->cpu_ctx), CTX_GPREG_X0,
+		      max_off_pwrlvl);
+
 	/* Program the entry point and enter OPTEE */
 	cm_set_elr_el3(SECURE, (uint64_t) &optee_vector_table->cpu_suspend_entry);
 	rc = opteed_synchronous_sp_entry(optee_ctx);
diff --git a/tools/doimage/doimage.c b/tools/doimage/doimage.c
index 56dabba..6fc23d5 100644
--- a/tools/doimage/doimage.c
+++ b/tools/doimage/doimage.c
@@ -768,7 +768,7 @@
 	/* CSK index option */
 	if (config_lookup_int(&sec_cfg, "csk_key_index",
 			      &cfg_int32) != CONFIG_TRUE) {
-		fprintf(stderr, "Error obtaining \"flash_id\" element. "
+		fprintf(stderr, "Error obtaining \"flash_id\" element. ");
 		fprintf(stderr, "Using default - 0x0\n");
 		cfg_int32 = 0;
 	}
diff --git a/tools/doimage/secure/aes_key.txt b/tools/doimage/secure/aes_key.txt
new file mode 100644
index 0000000..3e8a888
--- /dev/null
+++ b/tools/doimage/secure/aes_key.txt
@@ -0,0 +1 @@
+ABCDEF1234567890ABCDEF1234567890ABCDEF1234567890ABCDEF1234567890
diff --git a/tools/doimage/secure/csk_priv_pem0.key b/tools/doimage/secure/csk_priv_pem0.key
new file mode 100644
index 0000000..0840c2a
--- /dev/null
+++ b/tools/doimage/secure/csk_priv_pem0.key
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEAm6jN6o2zQmtyUlvfkfDbSjPJ7Vlpp/KgK/eznoVBBsDIZakX
+cIgf8TSLpNVkc+ZE0f/n8X7mEZIyjuSBObLOm9vbkoZcR7DlKUL7RNNOUCv55Ozl
+hQwrzpH/uIyIJTvmek29G5wroi0wGbPoxzhelIRTjVCibleBWhYCmZQ6SIRmTY8L
+JT8VkX8I/Mhu62DjvxF3BnV6pXuh/FdgDN7MbldzM8Y+GOxVGi5Kcm5WHY7eyMxl
+4Y0Yko31Xv7T1PcXahVBIciT+11w+fLc4wQuCJ6GUf9JbzQ0ZllY/FdRG0AhuRMH
+zN0jAc/sKrIFoAErED6qlcoQg0vl7gmWN5x+2wIDAQABAoIBACtnPFOkw1FH6I6y
+c3qcMGlWW33FKsLb0nGwFfOjsGgTpU1Dgver3UxCnJWPsvzmPlZYBvK9saVAoLxb
+VvUhuJ6ZBXar5FtRJfUFak7cpL+SI5IDxFP++tAUwbtR5DyNoUyFFK/4Mep8sybX
+lZbHTwgWhb2nuEMQP09BR+RPAplpcitkIoPkhmbGfbt9Hsd25I3bb5Z9R4S/2Rcf
+7tmaxndQamij7/pUI7xtd8L6cMESJGIWrgEt/MaT2z8nNPE3EDctDSlH9yKqA2O7
+/LTfrxNDnw5gGRtOgahloThKljVM6pQa4mi91FufD67pHwnKn8urNbt8/3AWg6uU
+x4FzZdECgYEA0k2UYzBM+dU6T1bZZ176YI0cZrP1tbf/JwnZGHicQYS7lPLAqgfO
+u5oRQzuDimOXaV4xCPBO2nadd6aBxbZTXaglR7GG2uCHX6w2DnOr8/d66YTErTVV
+u7/Bf8gMKT9mM4rWPrOEXfXfF0fvcpkBQ+QDynIB37tx/mj2lXRkLx0CgYEAvXuX
+Dbe2QgSK0ajrcH7YJyx3RVx9RonOqL4yjCVCELmaDQd307Ef3j+gkd59XIewm+HA
+mPyeWEUd8EzH+UvjckfKFuF2I4lEUUWtVZTa7me7mvsFqeEOu5KusD4+Hs+B9Kqd
+3Evqcpj2lcMBI519Hvr9BTKfDBcH1EUos6A9rFcCgYAxsyPeTQvj/wBIv72hMFD7
+gF2159GpoFIsZ6dmoRpMYZHzIWtmw3GX5FEwEmCD1AV0YU41TpVUC7QrEq6Yiv4o
+pBQrXUkBcQ6NDaW4xJ1eip4Bkd7pEDGyrR6NlDlLhjAg/i6joskla3XNirKL4pzp
+7nj23vqSZToLZcLgjyEeAQKBgD5EvDo80j9VwMzvpxecB6qv+S4pG94vcWOQxYm6
+wMBATjjT6HP/9EoUPM9S/32F9er0QFfGRL8bT6Blix4I62Dl6KqmQy2gcXwH2tOS
+DHRmUIe40H6oQDAyHwg6HC4B4WInI6N+qzgnvnku0VQD8FdbAgVQQmY1t1PxulN1
+aG8XAoGAPWAr4i8KkVAx4wLlMF8E/ecKcsX1J0+UuKket7Dvk7xJfwtkSLPeV8Bp
+HuoHXMM3KYoZ93Hlto5rAT1VQhYuj7heU10v+9UtYTFHgaitptYmxovoCKKiZICl
+48aPUI377e5jQ6RhhGYy8ltKsJ80K1T9DIkThJPSS+9NAI+jrmg=
+-----END RSA PRIVATE KEY-----
diff --git a/tools/doimage/secure/csk_priv_pem1.key b/tools/doimage/secure/csk_priv_pem1.key
new file mode 100644
index 0000000..91d1aeb
--- /dev/null
+++ b/tools/doimage/secure/csk_priv_pem1.key
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEAgwHXB0AaIhT15Z9lHpQ2YT1W8i4oMvvRiLGQCrba5l7BJ03E
+ct0x3zagNKZEnpNndT4EAy98ihkhwVlUhxZCparJ2L3JsTs5RgV0wyQkQzwMLM8g
+QI5EMmJCgFAVRHmVICOsisGGfNVUHjGdGwPOipyQCsX2MAm3E139VpB7NYj+Q4IR
+4kvcb+59LZxKuRJTFKRDIqMGJu98P/ga70+YLXPCBPKSfnZnUppuaI86jF1E6xt8
+o7YtfEPCHDd2LXxKPZ670OapVqwo0t7ZSzEG63NkLp56FXc1OpfC69C8VPiZ8JqW
+wxvS/vL8MMCxsBnjSuqnmOAbcNR2GFtUwJOGwwIDAQABAoIBAFcfoiDwQHDp/531
+ownzBzcj0+67Q4Ckd3SwoVp+wJTz7wB0d3DsKX6IlYJuELRk0yjlVUXJDsnIbOpo
+vg4Yf7otGo9JqBh1imFGv6AHKRaNmIs0M/66nh/juNYcbAhd0w7MqrKcgRQDyy1J
+UXHl1jXYaPLBNDg+PcJjf1dSPp4axzmW2Pk2rXnJCsPcZXL/0YmEvqhfOze0GdjR
+hOkbbr6MPPVM66tA00xSwg9XEYJvHtwH6oB0rnANM8ieNK1mtcWkTU5di17CCrjS
+ohIhXQrdVpxt549EJoUqEFSgo8OOMm2npDbFrjlukb5euakvMacwoT1te79blSKf
+hrTvjgECgYEA0VqoFL0Vqe1qleikYDJ7S5xcv1oruEV31TeuBhDuf0c4PADCnBrV
+/RnCEYuXs6wCk60chHg5s0jxg+nGbiY6jRTHkJLRU3ZhDtrtfidEZ78GRzFF3shl
+Uzt7dHkKK1ZdiMH4sWzyRLom91TKWMrNKC1AD7v4/zjEXy6phall3ZcCgYEAoDJa
+0dIKvVCS6dM2E2kMqi/45mJqsJzFvYL1s4mbma/BAC47bBju/YEse90x+iIi3Gg/
+NoXmNfGPrtgdl+/J/Y6Pohxf/e7gGN71tYVETzgc2Jv09wqmzmTjCmo3wyepyWf+
+pIAE39kdhwnqXVw5xwOG1N3xrQ9TomOO+1QiXbUCgYAF84TJqiJehUA9aLKbhXPZ
+z2UXj3GkuFzSs9V/mKWe+qBPnFnr5BtnKX9JzmUOl3ovRoGEBoLlZNJwxIl+ghmx
+/wA5TOMkcz4JFRIhPu6D4HtGNNFepuWyewNkaThvyPG5vIHcUVOFvqDy8PcblRBF
+7xteFyLZ5nw2lHX/NbSOmwKBgFxLZqPIPcPArkPlGhyow1Ex/lbNkOZcDFkZIHHl
+8C3lYm62NCodW2PWjkh2shqInEkcDn9dObsOh1eWz8X/swJQplQhwPROMfJiUnHY
+a/iwPX5WrBXAn0X+Pgh8FdBsA5g0QDOKRkSplCd/APX08pzEXWQ60siAMhE3BuOq
+H3qZAoGAVnzFidlXuyn+fbNaNVepK9hbuoxHHbzYYWSkpi+73EchN8kXktC+AdEf
+owr9TPILbwWWJyisa3wW4xdbMifCgVLTedWZpZ09BENVqC+7g7ksX0pNMGYuFLOh
+Td7mFAgmclxG5UiKexajOLjjdnAsJyrDaNKhHn8NQNN6L93N0sE=
+-----END RSA PRIVATE KEY-----
diff --git a/tools/doimage/secure/csk_priv_pem2.key b/tools/doimage/secure/csk_priv_pem2.key
new file mode 100644
index 0000000..ea47ac5
--- /dev/null
+++ b/tools/doimage/secure/csk_priv_pem2.key
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEAjxTSTh57/5njUpE200+Qb3ySAn8lKeufgaa0K2Xc6Ri7lDZR
+ZJ2BPuQZV4lYGqgWUf0IOzNf2WnE2lPfVnLMx08h7NhBqJ83yJVajpr+itnOmW+r
+M7h76TFyuna1xz2kw1uhgI5Y4FRnJ4Cg4AexCSyViXSzEN/7LQwxa5z5WGDiNX5N
+3/tgjGu+dzSMOiIQhXwIcK/XaiQNm3WHqqnAhPb5Q9IBuuqBfpZoFfH4XmbFWrC8
+neSMMMxX5Ti9pKhLd1EsiaP0aUNQlF8gNWuC/tNaf+OCtwVelVa3sGSRjRFe06VQ
+sAE9oyXKri11yD5Dwp1xXivbpOrf7xjUe5gILwIDAQABAoIBABTr94CCxqDucKYP
+I9QsSzNyJKuGyfliQdWkea3q3C2ddzhJ5QbwXQjEM8xwAdkMAQ+GD2EQtxBEfgtq
+vjqW2MjAEnbefGNavL5w0GgP0+6bwLEA+ii67iuAFoWbfCMhKWmDiY8RwX8z+E13
+ao63sTRlN4x86v4pskG5CbTxpCg+8m7KklLns4SwRGf5gGQcgKRtNSR5nE4g2UNl
+dghbDdNlvUncm4zxUcTh0kquhF5Tef5w+6L7W8Hv9Pky3b1c2OK1BMhJlxYrtt69
+/zhIJs89CLx5ACfam+DT/xs0uUiuRQq/e1CCQLCnUO02JqpeN/schtDCd0ZWhbtB
+nT7fwTECgYEAx+COhys+7AZI0U+PeuTkI86GUsWHoBislXThxbxyGvMFjgyADZD+
+q/XEGAcxd4eTA1fr0Q9cLuuHZubjGQ7+OIXMZ6arXUsrmMrjRu3kHO+y6K6r4s8j
+5bxN/iQ0bymUtJRfJSLI172plszusiPWhCL5+yhYlNoh4mNZJuJnzXkCgYEAt0Gz
+07P19YPsxk5ow7ZnSNOMOkkEPP0SuHHWekMIK9KMjiRUSygOAk07zTL7MUoFn9Gy
+Prfi0ybFArNhIa4Xio3Fbjfig7rGgaApK4Y3d9A/CGPv/Nj7C2OTepqlEzRLmU9e
+Xw5yhbccCydXLyAYFAET2XHsmbewpvHyeYUSoOcCgYBRMJEUrOdhPmhDxZqVo/Zb
+6R887gnaaUtpZlHzXUnIUqEWA1PcruIT/b/KttlMIWEBQayDfkbGtFuK3AyxeBqh
+4Q+XpucC/W7XIMrTW/yGGIPG6nTdq6B8SFIyAojeArjp5T8Eua11nRAPNm1bJR2V
+DRQYBlp9FGIhMJPdLKhXmQKBgGeywSyR0COfBHPu2K+u3uFB/D7bJI/ScS54FHLY
+zZ3mpeylOCHTR6IbzDRAng31Ihue0KtW6P6tGJx/nv4tAltAADFvZDlAjqW5WLKt
+X2PoLlL0IlBFBEIclc6yBalJVWIqnG9TwJBT3oWdPGOJWLaxKWdJZSZS4J6HmLsV
+B0aPAoGAduLsOt8C5z48jPqmJxyPwsmT0Q424FccPMcvGOJ13yxq3xNsfAsbmg9l
+L2i/ktE0wCMA+Pm7cuFgxwD7xTr67POZgt9022KsOSonjPsIn24UQeP46vAX/Qtx
+Qf3sfvzf57vNy2Hybe38T8RsVOZla+v/QctfSfmb8Y95XL/SZzA=
+-----END RSA PRIVATE KEY-----
diff --git a/tools/doimage/secure/csk_priv_pem3.key b/tools/doimage/secure/csk_priv_pem3.key
new file mode 100644
index 0000000..e40a864
--- /dev/null
+++ b/tools/doimage/secure/csk_priv_pem3.key
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAlA/T/5IMTPTu+k5PeesB2oeP80Y6nq0ls8vXLul0TVEJoJ+O
+InbPYNqYPu4dbQQg/u8qp8BeXm2ujtJbBTcdn0jKIiDTKYEnlsGfUt9GHnuuzvFh
+rORSKuAolUqvo/zcSCo1uykaFvSuyTovSPlwllzSixD9XBbHfn3kXneiIUa45vsJ
+AyjTn2qCJt0WgvX42NTxH6Q/OWLeOuKTyRHf25eabucIv77KYy0mlEPq5jjiV5AJ
+gl5F1h5G8n07JCIWjkZ2QV4wr+Hv9uGNaSb0WGppBp4CbdQa0eUI75cKzz4WXqds
+HZaYiX/a8YC+EUfvqDD02vKREIKFL/1zL53P/wIDAQABAoIBAGzBj5w7oBNrGpr7
+qL9KEyt8xg0Q+gAR+Q6vXRlVXBtquiKk8Jd6I+vlxUz8RNsN3FrGPNPJpse/0yeP
+dlJHYNfedLNK3zCucPD4uln6LRw5B3d0sKV5dK2Px9+ZY5iWJQxRDPS0RTi1dCnV
+NmRo7P1Vo0WJLkFVbiYIvRVy1MGRfF9ejN41G6U4MoBAQ9WqLp+JasUMTspZI49a
+z8tOiJPT94MHBwbKnz8Mcq8sy02LR7U5h82+0T7JoRVix/OXiOoiQExNjZ9yGar0
+wBnl0SL1UW5UUaYzbyNH0mlMXLD+qowbDZM2pBWPfqXK+CMOsL6STIwnns7lY+ZJ
+ILbaVmECgYEA2kQXE1PZ25A87a81wCEld402WJ2KegrZC719EWv+xeoS72Ji8uv7
+V0PxVGJQOcG1N+dzJ5tN59SQ/NvVTrjwqNUxQqsygmWq/TcfGb9ONZRmyzcehYLb
+m4xTjqJKQ6Kwm5SoaCYmzEb/xaeLwLS9HmR9MdB1dxtDOLpjaK/8qPECgYEArait
+QhgaknlxG8pcAimPsEUrLHYWSFRE/MUk4+YvZg/5+YJ8csvY0SO2h0tF/ARwUrdI
+DaLEifHm4vqgN03K/0gqj7TKxcNlV16PvVx7Vz97xejdqdHZLDfAo4lcotsgvFQW
+zIqoQGGPLf6WhFixZ8mEYj8xnmzLGPvHQmf1h+8CgYEA0LDl917nIN4qw4ARPqDy
+t/pXCienrcUNfgIxwSSnNwj2DdjejzI+4VNfPbW6y16BLPCp1CbUOGOwNXTj4R9H
+S8Z8ESirZK5c7Tt1CyM1XlmEZ61OC43w+CsWAXz+0OiPQFLFKr+/vPXtvEjUgO7P
+HG4sniKZDccNYQIl5oTOaaECgYAPU4u3AZmWw9EPutRT/IcJ75DX47Qjvgw4os2W
+r4IPZ+mP88w39XW1P4mkdyg+DcY8BqD9Uxg1dHwEHEp3lw4LabsX48Thn1UaWOYm
+uDrKgHfUB7FIg5S/Kkx+ImliliRVerZoZvRiejnAvW9bTtiZaFeetCUU7lUeZ1o2
+qiYpUQKBgHQDfdDhguBGPKpkJ7pVwHkJA/lyRWaN1hwplw4TvX2oH14NsHg5Q5Fd
+lHqHFs2Ry/6X3bKgF0E6q4cx0V1Xnnj9sGsemlrHdiSxplDYRQql7X5OeYPGF/Bg
+ZTTG8rDwy+ey6EP9BZUb03hISx/LyMynOzjGl6uOcdAcy2d9Vno0
+-----END RSA PRIVATE KEY-----
diff --git a/tools/doimage/secure/kak_priv_pem.key b/tools/doimage/secure/kak_priv_pem.key
new file mode 100644
index 0000000..dfceaba
--- /dev/null
+++ b/tools/doimage/secure/kak_priv_pem.key
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAsj2cHcrE2pdyCqNr+oVcQULiRx6RivkrhLl2DTqWXpP33BPm
+MP0W0X0z98X7E3kZO+JIGRZ8q+6AWmUpL+53aOGItNeUgT7jQKViPJIo9ZcEnv/n
+PJqdgDd4xFhnwYMgq8uVYN9IPfaKDwB3EoOqjNox2JholUVxvLw6W8DAC8La3zwb
+0hiqtIlirQOQ/KaTHxC6dPYkrai+jSK5uAX7Vt8RKYg5qfDxSdZckmC2xVKYURhV
+bZAlyKki4h6f8CwYCJMQDpHL6mVYCuJ1Ju/OJEXvthDKD0CD2hwILhksdey3qMOC
+I5lHSO1b+sTvnVHGs65wI7A+ZYwnadMNvS9e2QIDAQABAoIBAH2uu9q2FEEe8SdX
+PNiWGQtbojsL7wzTzj/0lq2VVlqyc+AXmAWLMP/fDTn1vKlqhsSXNseZ96c0sgUL
+uBM4T7MA9WivauQH+C6pb6/OUFt8daG4SNGPJOg4NUweGmt1jyAUmeyJBWPL6GXT
+qiK//Q78/JECRxyaryyqfWwdak3flzfwONBJ03tQ9EO+L7hf9gAP7OYnAsuNp+Bz
+tj1xzNMumYYYiHvsEXx8UTe8HGrmYuO53ZY5fBLGB6Jj7hRlAHNfcdVDvvoBU5cI
+Zwi+5YsBuSP2Hr9Gt2Odu+KitH3gFdS0HIiDh44AT+Trj29NMANFDfkDbVHUmE0q
+YBL75NECgYEA2E+fJzdaYyyPIcvQgVM8g52hltR5IRgJICND3NOdB/Zb2teBGZh+
+1XJ6ZqQMDcOQZo0CMbX9UNRnf3NU55k48/EEITxCgUJTx/WdfJeTVlWGspt5+U/r
+hDnQmkePdU1en63+u9eqsla9+VhLwU3fl/pIOpsBAnoEzs3hMQZ1G0cCgYEA0vHH
+ilm3AztIoZlH3wgDAl2Gu5/YopqEofKA8G4Jp89rlkk919P/GNjEc6575wjgztDB
+0Xab+H7Nqxjs3HqQX/DTTuAxzAggBg3j/ijpHnmjrCHLeMT5ciyH+EH5Bg///cLq
++Cwn7aOWuSK1hGdDYxUycHylAYZXXFJzmEIEhN8CgYEA1qTrwPZkctTckyS0GiCG
+g/P/TLQ6HmTDaWiVBqPVxvjn3RjLuqJf+V5Hp2JRs7bDq39xFfMJExQyP34qWkbp
+BOe8uV4agDlY+ar4Q5IFWj40EzfEqWhsxCC6pt0rtbK4mqsFg1BWyfDZQnwjcAXe
+QejRk5YMQnDiJHSXaRaHTjECgYAv6ecvD624ODEJM63VhRZZ5TCDUY19caeKuXB8
+LCJZUY3Ydw5rBaY92I7Wz90o3yVhFJ3RnCVVTkgdAu5aLiS5BhSZJ+dntri/Z0xQ
+IK7C01JP+OUkq2kVe/Pued28eMnms+13LWBsY+oKZ03foyz1Ro1Ma6N3MzKIr9m9
+zdEE9QKBgECfoh0xE2T/cbJrtH0mwMCUM6eMVGq+yQBKNvuuPg6kaQUsah1n1rp6
+OyvjwRAXdhshszEzNTX1WTT6/i+vZX277Ax50pPo9UhQ9kVteVt1frN6+u5sy07V
+fg1f2+m0iFx4BD/irU0fzSyfGE+QkBnmXFBUNSYjp2PSqYIdufmW
+-----END RSA PRIVATE KEY-----
diff --git a/tools/doimage/secure/sec_img_7K.cfg b/tools/doimage/secure/sec_img_7K.cfg
new file mode 100644
index 0000000..459f731
--- /dev/null
+++ b/tools/doimage/secure/sec_img_7K.cfg
@@ -0,0 +1,29 @@
+# Trusted boot image extension definitions
+
+kak_key_file = "tools/doimage/secure/kak_priv_pem.key";
+
+# CSK keys array - 16 entries total.
+# Only a key with csk_key_index will be used for signing the image
+# use "*" string instead of file name for specifying an empty key
+csk_key_file = ["tools/doimage/secure/csk_priv_pem0.key",
+                "tools/doimage/secure/csk_priv_pem1.key",
+                "tools/doimage/secure/csk_priv_pem2.key",
+                "tools/doimage/secure/csk_priv_pem3.key",
+                "*", "*", "*", "*", "*", "*", "*", "*", "*", "*", "*", "*"];
+
+# index of CSK key in the array. Valid range is 0 to 15
+csk_key_index = 3;
+
+# AES-256 symmetric key for image encryption
+aes_key_file = "tools/doimage/secure/aes_key.txt";
+
+efuse_disable = false;
+jtag = { enable = true; delay = 20; };
+
+box_id = 0xdeadbeef;
+flash_id = 0xbaddf00d;
+
+# SecureBootControl and EfuseBurnControl registers array
+# Two register addresses for each connected CP
+# A7K - one CP, two register values
+control = [0xF2441920, 0xF2441940];
diff --git a/tools/doimage/secure/sec_img_8K.cfg b/tools/doimage/secure/sec_img_8K.cfg
new file mode 100644
index 0000000..a849dff
--- /dev/null
+++ b/tools/doimage/secure/sec_img_8K.cfg
@@ -0,0 +1,29 @@
+# Trusted boot image extension definitions
+
+kak_key_file = "tools/doimage/secure/kak_priv_pem.key";
+
+# CSK keys array - 16 entries total.
+# Only a key with csk_key_index will be used for signing the image
+# use "*" string instead of file name for specifying an empty key
+csk_key_file = ["tools/doimage/secure/csk_priv_pem0.key",
+                "tools/doimage/secure/csk_priv_pem1.key",
+                "tools/doimage/secure/csk_priv_pem2.key",
+                "tools/doimage/secure/csk_priv_pem3.key",
+                "*", "*", "*", "*", "*", "*", "*", "*", "*", "*", "*", "*"];
+
+# index of CSK key in the array. Valid range is 0 to 15
+csk_key_index = 3;
+
+# AES-256 symmetric key for image encryption
+aes_key_file = "tools/doimage/secure/aes_key.txt";
+
+efuse_disable = false;
+jtag = { enable = true; delay = 20; };
+
+box_id = 0xdeadbeef;
+flash_id = 0xbaddf00d;
+
+# SecureBootControl and EfuseBurnControl registers array
+# Two register addresses for each connected CP
+# A8K - two CP, four register values
+control = [0xF2441920, 0xF2441940, 0xF4441920, 0xF4441940];