diff --git a/drivers/auth/cca/cot.c b/drivers/auth/cca/cot.c
index d3f3087..e8f4d9c 100644
--- a/drivers/auth/cca/cot.c
+++ b/drivers/auth/cca/cot.c
@@ -1,13 +1,15 @@
 /*
- * Copyright (c) 2022, Arm Limited. All rights reserved.
+ * Copyright (c) 2022-2023, Arm Limited. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
 
 #include <stddef.h>
 
+#include <mbedtls/version.h>
+
+#include <common/tbbr/cot_def.h>
 #include <drivers/auth/auth_mod.h>
-#include MBEDTLS_CONFIG_FILE
 #include <tools_share/cca_oid.h>
 
 #include <platform_def.h>
diff --git a/drivers/auth/cryptocell/712/cryptocell_crypto.c b/drivers/auth/cryptocell/712/cryptocell_crypto.c
index c7ee36f..e2b189b 100644
--- a/drivers/auth/cryptocell/712/cryptocell_crypto.c
+++ b/drivers/auth/cryptocell/712/cryptocell_crypto.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017-2020, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2017-2023, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -7,7 +7,8 @@
 #include <stddef.h>
 #include <string.h>
 
-#include <platform_def.h>
+#include <mbedtls/oid.h>
+#include <mbedtls/x509.h>
 
 #include <arch_helpers.h>
 #include <common/debug.h>
@@ -21,8 +22,7 @@
 #include <drivers/auth/mbedtls/mbedtls_common.h>
 #include <lib/utils.h>
 
-#include <mbedtls/oid.h>
-#include <mbedtls/x509.h>
+#include <platform_def.h>
 
 #define LIB_NAME		"CryptoCell 712 SBROM"
 #define RSA_SALT_LEN		32
@@ -95,11 +95,10 @@
 	CCError_t error;
 	CCSbNParams_t pk;
 	CCSbSignature_t signature;
-	int rc, exp;
+	int rc, exp, expected_salt_len;
 	mbedtls_asn1_buf sig_oid, alg_oid, params;
-	mbedtls_md_type_t md_alg;
+	mbedtls_md_type_t md_alg, mgf1_hash_id;
 	mbedtls_pk_type_t pk_alg;
-	mbedtls_pk_rsassa_pss_options pss_opts;
 	size_t len;
 	uint8_t *p, *end;
 	/* Temp buf to store the public key modulo (N) in LE format */
@@ -110,70 +109,85 @@
 	p = sig_alg;
 	end = p + sig_alg_len;
 	rc = mbedtls_asn1_get_alg(&p, end, &sig_oid, &params);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	/* Get the actual signature algorithm (MD + PK) */
 	rc = mbedtls_oid_get_sig_alg(&sig_oid, &md_alg, &pk_alg);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	/* The CryptoCell only supports RSASSA-PSS signature */
-	if (pk_alg != MBEDTLS_PK_RSASSA_PSS || md_alg != MBEDTLS_MD_NONE)
+	if ((pk_alg != MBEDTLS_PK_RSASSA_PSS) || (md_alg != MBEDTLS_MD_NONE)) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	/* Verify the RSASSA-PSS params */
 	/* The trailer field is verified to be 0xBC internally by this API */
 	rc = mbedtls_x509_get_rsassa_pss_params(&params, &md_alg,
-			&pss_opts.mgf1_hash_id,
-			&pss_opts.expected_salt_len);
-	if (rc != 0)
+			&mgf1_hash_id,
+			&expected_salt_len);
+	if (rc != 0) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	/* The CryptoCell only supports SHA256 as hash algorithm */
-	if (md_alg != MBEDTLS_MD_SHA256 || pss_opts.mgf1_hash_id != MBEDTLS_MD_SHA256)
+	if ((md_alg != MBEDTLS_MD_SHA256) || (mgf1_hash_id != MBEDTLS_MD_SHA256)) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
-	if (pss_opts.expected_salt_len != RSA_SALT_LEN)
+	if (expected_salt_len != RSA_SALT_LEN) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	/* Parse the public key */
 	p = pk_ptr;
 	end = p + pk_len;
 	rc = mbedtls_asn1_get_tag(&p, end, &len,
 			MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	end = p + len;
 	rc = mbedtls_asn1_get_alg_null(&p, end, &alg_oid);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
-	if (mbedtls_oid_get_pk_alg(&alg_oid, &pk_alg) != 0)
+	if (mbedtls_oid_get_pk_alg(&alg_oid, &pk_alg) != 0) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
-	if (pk_alg != MBEDTLS_PK_RSA)
+	if (pk_alg != MBEDTLS_PK_RSA) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	rc = mbedtls_asn1_get_bitstring_null(&p, end, &len);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	rc = mbedtls_asn1_get_tag(&p, end, &len,
 				MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	rc = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_INTEGER);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	if (*p == 0) {
 		p++; len--;
 	}
-	if (len != RSA_MOD_SIZE_IN_BYTES || ((p + len) > end))
+
+	if (len != RSA_MOD_SIZE_IN_BYTES || ((p + len) > end)) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	/*
 	 * The CCSbVerifySignature() API expects N and Np in BE format and
@@ -184,11 +198,13 @@
 	/* Verify the RSA exponent */
 	p += len;
 	rc = mbedtls_asn1_get_int(&p, end, &exp);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
-	if (exp != RSA_EXPONENT)
+	if (exp != RSA_EXPONENT) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	/*
 	 * Calculate the Np (Barrett n' value). The RSA_CalcNp() API expects
@@ -205,11 +221,13 @@
 	p = sig_ptr;
 	end = p + sig_len;
 	rc = mbedtls_asn1_get_bitstring_null(&p, end, &len);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
-	if (len != RSA_MOD_SIZE_IN_BYTES || ((p + len) > end))
+	if (len != RSA_MOD_SIZE_IN_BYTES || ((p + len) > end)) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	/*
 	 *  The signature is BE format. Convert it to LE before calling
@@ -227,8 +245,9 @@
 	error = CCSbVerifySignature((uintptr_t)PLAT_CRYPTOCELL_BASE,
 			(uint32_t *)data_ptr, &pk, &signature,
 			data_len, RSA_PSS);
-	if (error != CC_OK)
+	if (error != CC_OK) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	/* Signature verification success */
 	return CRYPTO_SUCCESS;
@@ -256,29 +275,36 @@
 	end = p + digest_info_len;
 	rc = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED |
 				  MBEDTLS_ASN1_SEQUENCE);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_HASH;
+	}
 
 	/* Get the hash algorithm */
 	rc = mbedtls_asn1_get_alg(&p, end, &hash_oid, &params);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_HASH;
+	}
 
 	rc = mbedtls_oid_get_md_alg(&hash_oid, &md_alg);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_HASH;
+	}
+
 	/* Verify that hash algorithm is SHA256 */
-	if (md_alg != MBEDTLS_MD_SHA256)
+	if (md_alg != MBEDTLS_MD_SHA256) {
 		return CRYPTO_ERR_HASH;
+	}
 
 	/* Hash should be octet string type */
 	rc = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OCTET_STRING);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_HASH;
+	}
 
 	/* Length of hash must match the algorithm's size */
-	if (len != HASH_RESULT_SIZE_IN_BYTES)
+	if (len != HASH_RESULT_SIZE_IN_BYTES) {
 		return CRYPTO_ERR_HASH;
+	}
 
 	/*
 	 * CryptoCell utilises DMA internally to transfer data. Flush the data
@@ -289,12 +315,14 @@
 	hash = p;
 	error = SBROM_CryptoHash((uintptr_t)PLAT_CRYPTOCELL_BASE,
 			(uintptr_t)data_ptr, data_len, pubKeyHash);
-	if (error != CC_OK)
+	if (error != CC_OK) {
 		return CRYPTO_ERR_HASH;
+	}
 
 	rc = memcmp(pubKeyHash, hash, HASH_RESULT_SIZE_IN_BYTES);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_HASH;
+	}
 
 	return CRYPTO_SUCCESS;
 }
diff --git a/drivers/auth/cryptocell/713/cryptocell_crypto.c b/drivers/auth/cryptocell/713/cryptocell_crypto.c
index 3ac16af..388264e 100644
--- a/drivers/auth/cryptocell/713/cryptocell_crypto.c
+++ b/drivers/auth/cryptocell/713/cryptocell_crypto.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017-2020 ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2017-2023 ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -8,14 +8,14 @@
 #include <stddef.h>
 #include <string.h>
 
-#include <platform_def.h>
+#include <mbedtls/oid.h>
+#include <mbedtls/x509.h>
 
 #include <drivers/arm/cryptocell/713/bsv_api.h>
 #include <drivers/arm/cryptocell/713/bsv_crypto_asym_api.h>
 #include <drivers/auth/crypto_mod.h>
 
-#include <mbedtls/oid.h>
-#include <mbedtls/x509.h>
+#include <platform_def.h>
 
 #define LIB_NAME		"CryptoCell 713 SBROM"
 #define RSA_SALT_LEN		32
@@ -82,11 +82,11 @@
 	CCError_t error;
 	CCBsvNBuff_t NBuff;
 	CCBsvSignature_t signature;
-	int rc, exp;
+	int rc, exp, expected_salt_len;
 	mbedtls_asn1_buf sig_oid, alg_oid, params;
-	mbedtls_md_type_t md_alg;
+	mbedtls_md_type_t md_alg, mgf1_hash_id;
 	mbedtls_pk_type_t pk_alg;
-	mbedtls_pk_rsassa_pss_options pss_opts;
+
 	size_t len;
 	uint8_t *p, *end;
 	CCHashResult_t digest;
@@ -99,72 +99,86 @@
 	p = sig_alg;
 	end = p + sig_alg_len;
 	rc = mbedtls_asn1_get_alg(&p, end, &sig_oid, &params);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	/* Get the actual signature algorithm (MD + PK) */
 	rc = mbedtls_oid_get_sig_alg(&sig_oid, &md_alg, &pk_alg);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	/* The CryptoCell only supports RSASSA-PSS signature */
-	if (pk_alg != MBEDTLS_PK_RSASSA_PSS || md_alg != MBEDTLS_MD_NONE)
+	if (pk_alg != MBEDTLS_PK_RSASSA_PSS || md_alg != MBEDTLS_MD_NONE) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	/* Verify the RSASSA-PSS params */
 	/* The trailer field is verified to be 0xBC internally by this API */
 	rc = mbedtls_x509_get_rsassa_pss_params(&params, &md_alg,
-			&pss_opts.mgf1_hash_id,
-			&pss_opts.expected_salt_len);
-	if (rc != 0)
+			&mgf1_hash_id,
+			&expected_salt_len);
+	if (rc != 0) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	/* The CryptoCell only supports SHA256 as hash algorithm */
 	if (md_alg != MBEDTLS_MD_SHA256 ||
-	    pss_opts.mgf1_hash_id != MBEDTLS_MD_SHA256)
+	    mgf1_hash_id != MBEDTLS_MD_SHA256) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
-	if (pss_opts.expected_salt_len != RSA_SALT_LEN)
+	if (expected_salt_len != RSA_SALT_LEN) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	/* Parse the public key */
 	p = pk_ptr;
 	end = p + pk_len;
 	rc = mbedtls_asn1_get_tag(&p, end, &len,
 			MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	end = p + len;
 	rc = mbedtls_asn1_get_alg_null(&p, end, &alg_oid);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
-	if (mbedtls_oid_get_pk_alg(&alg_oid, &pk_alg) != 0)
+	if (mbedtls_oid_get_pk_alg(&alg_oid, &pk_alg) != 0) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
-	if (pk_alg != MBEDTLS_PK_RSA)
+	if (pk_alg != MBEDTLS_PK_RSA) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	rc = mbedtls_asn1_get_bitstring_null(&p, end, &len);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	rc = mbedtls_asn1_get_tag(&p, end, &len,
 				MBEDTLS_ASN1_CONSTRUCTED |
 				MBEDTLS_ASN1_SEQUENCE);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	rc = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_INTEGER);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	if (*p == 0) {
 		p++; len--;
 	}
-	if (len != BSV_CERT_RSA_KEY_SIZE_IN_BYTES || ((p + len) > end))
+	if (len != BSV_CERT_RSA_KEY_SIZE_IN_BYTES || ((p + len) > end)) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	/*
 	 * Copy N from certificate.
@@ -174,21 +188,25 @@
 	/* Verify the RSA exponent */
 	p += len;
 	rc = mbedtls_asn1_get_int(&p, end, &exp);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
-	if (exp != RSA_EXPONENT)
+	if (exp != RSA_EXPONENT) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	/* Get the signature (bitstring) */
 	p = sig_ptr;
 	end = p + sig_len;
 	rc = mbedtls_asn1_get_bitstring_null(&p, end, &len);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
-	if (len != BSV_CERT_RSA_KEY_SIZE_IN_BYTES || ((p + len) > end))
+	if (len != BSV_CERT_RSA_KEY_SIZE_IN_BYTES || ((p + len) > end)) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	/*
 	 * Copy the signature (in BE format)
@@ -197,15 +215,17 @@
 
 	error = CC_BsvSha256((uintptr_t)PLAT_CRYPTOCELL_BASE,
 			     data_ptr, data_len, digest);
-	if (error != CC_OK)
+	if (error != CC_OK) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	/* Verify the signature */
 	error = CC_BsvRsaPssVerify((uintptr_t)PLAT_CRYPTOCELL_BASE, NBuff,
 				    NULL, signature, digest, workspace,
 				    BSV_RSA_WORKSPACE_MIN_SIZE, &is_verified);
-	if ((error != CC_OK) || (is_verified != CC_TRUE))
+	if ((error != CC_OK) || (is_verified != CC_TRUE)) {
 		return CRYPTO_ERR_SIGNATURE;
+	}
 
 	/* Signature verification success */
 	return CRYPTO_SUCCESS;
@@ -233,39 +253,48 @@
 	end = p + digest_info_len;
 	rc = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED |
 				  MBEDTLS_ASN1_SEQUENCE);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_HASH;
+	}
 
 	/* Get the hash algorithm */
 	rc = mbedtls_asn1_get_alg(&p, end, &hash_oid, &params);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_HASH;
+	}
 
 	rc = mbedtls_oid_get_md_alg(&hash_oid, &md_alg);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_HASH;
+	}
+
 	/* Verify that hash algorithm is SHA256 */
-	if (md_alg != MBEDTLS_MD_SHA256)
+	if (md_alg != MBEDTLS_MD_SHA256) {
 		return CRYPTO_ERR_HASH;
+	}
 
 	/* Hash should be octet string type */
 	rc = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OCTET_STRING);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_HASH;
+	}
 
 	/* Length of hash must match the algorithm's size */
-	if (len != HASH_RESULT_SIZE_IN_BYTES)
+	if (len != HASH_RESULT_SIZE_IN_BYTES) {
 		return CRYPTO_ERR_HASH;
+	}
 
 	hash = p;
 	error = CC_BsvSha256((uintptr_t)PLAT_CRYPTOCELL_BASE, data_ptr,
 			     data_len, pubKeyHash);
-	if (error != CC_OK)
+	if (error != CC_OK) {
 		return CRYPTO_ERR_HASH;
+	}
 
 	rc = memcmp(pubKeyHash, hash, HASH_RESULT_SIZE_IN_BYTES);
-	if (rc != 0)
+	if (rc != 0) {
 		return CRYPTO_ERR_HASH;
+	}
 
 	return CRYPTO_SUCCESS;
 }
diff --git a/drivers/auth/dualroot/cot.c b/drivers/auth/dualroot/cot.c
index 8368503..c89930c 100644
--- a/drivers/auth/dualroot/cot.c
+++ b/drivers/auth/dualroot/cot.c
@@ -1,17 +1,20 @@
 /*
- * Copyright (c) 2020-2022, Arm Limited. All rights reserved.
+ * Copyright (c) 2020-2023, Arm Limited. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
 
 #include <stddef.h>
 
-#include <platform_def.h>
+#include <mbedtls/version.h>
 
-#include MBEDTLS_CONFIG_FILE
+#include <common/tbbr/cot_def.h>
 #include <drivers/auth/auth_mod.h>
+
 #include <tools_share/dualroot_oid.h>
 
+#include <platform_def.h>
+
 /*
  * Allocate static buffers to store the authentication parameters extracted from
  * the certificates.
diff --git a/drivers/auth/mbedtls/mbedtls_common.c b/drivers/auth/mbedtls/mbedtls_common.c
index a12e49c..4f30d82 100644
--- a/drivers/auth/mbedtls/mbedtls_common.c
+++ b/drivers/auth/mbedtls/mbedtls_common.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2022, Arm Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2023, Arm Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -10,10 +10,11 @@
 /* mbed TLS headers */
 #include <mbedtls/memory_buffer_alloc.h>
 #include <mbedtls/platform.h>
+#include <mbedtls/version.h>
 
 #include <common/debug.h>
 #include <drivers/auth/mbedtls/mbedtls_common.h>
-#include MBEDTLS_CONFIG_FILE
+
 #include <plat/common/platform.h>
 
 static void cleanup(void)
diff --git a/drivers/auth/mbedtls/mbedtls_common.mk b/drivers/auth/mbedtls/mbedtls_common.mk
index ae4b067..79c4512 100644
--- a/drivers/auth/mbedtls/mbedtls_common.mk
+++ b/drivers/auth/mbedtls/mbedtls_common.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2015-2022, Arm Limited. All rights reserved.
+# Copyright (c) 2015-2023, Arm Limited. All rights reserved.
 #
 # SPDX-License-Identifier: BSD-3-Clause
 #
@@ -15,42 +15,68 @@
 
 MBEDTLS_INC		=	-I${MBEDTLS_DIR}/include
 
+MBEDTLS_MAJOR=$(shell grep -hP "define MBEDTLS_VERSION_MAJOR" ${MBEDTLS_DIR}/include/mbedtls/*.h | grep -oe '\([0-9.]*\)')
+MBEDTLS_MINOR=$(shell grep -hP "define MBEDTLS_VERSION_MINOR" ${MBEDTLS_DIR}/include/mbedtls/*.h | grep -oe '\([0-9.]*\)')
+$(info MBEDTLS_VERSION_MAJOR is [${MBEDTLS_MAJOR}] MBEDTLS_VERSION_MINOR is [${MBEDTLS_MINOR}])
+
 # Specify mbed TLS configuration file
-MBEDTLS_CONFIG_FILE	?=	"<drivers/auth/mbedtls/mbedtls_config.h>"
+ifeq (${MBEDTLS_MAJOR}, 2)
+	MBEDTLS_CONFIG_FILE	?=	"<drivers/auth/mbedtls/mbedtls_config-2.h>"
+else ifeq (${MBEDTLS_MAJOR}, 3)
+	MBEDTLS_CONFIG_FILE	?=	"<drivers/auth/mbedtls/mbedtls_config-3.h>"
+endif
+
 $(eval $(call add_define,MBEDTLS_CONFIG_FILE))
 
 MBEDTLS_SOURCES	+=		drivers/auth/mbedtls/mbedtls_common.c
 
-
-LIBMBEDTLS_SRCS		+= $(addprefix ${MBEDTLS_DIR}/library/,	\
-					aes.c 					\
-					asn1parse.c 				\
-					asn1write.c 				\
-					cipher.c 				\
-					cipher_wrap.c 				\
-					memory_buffer_alloc.c			\
-					oid.c 					\
-					platform.c 				\
-					platform_util.c				\
-					bignum.c				\
-					gcm.c 					\
-					md.c					\
-					pk.c 					\
-					pk_wrap.c 				\
-					pkparse.c 				\
-					pkwrite.c 				\
-					sha256.c            			\
-					sha512.c            			\
-					ecdsa.c					\
-					ecp_curves.c				\
-					ecp.c					\
-					rsa.c					\
-					rsa_internal.c				\
-					x509.c 					\
-					x509_crt.c 				\
-					constant_time.c 			\
+LIBMBEDTLS_SRCS		+= $(addprefix ${MBEDTLS_DIR}/library/,		\
+					aes.c 				\
+					asn1parse.c 			\
+					asn1write.c 			\
+					cipher.c 			\
+					cipher_wrap.c 			\
+					constant_time.c			\
+					memory_buffer_alloc.c		\
+					oid.c 				\
+					platform.c 			\
+					platform_util.c			\
+					bignum.c			\
+					gcm.c 				\
+					md.c				\
+					pk.c 				\
+					pk_wrap.c 			\
+					pkparse.c 			\
+					pkwrite.c 			\
+					sha256.c            		\
+					sha512.c            		\
+					ecdsa.c				\
+					ecp_curves.c			\
+					ecp.c				\
+					rsa.c				\
+					x509.c 				\
+					x509_crt.c 			\
 					)
 
+ifeq (${MBEDTLS_MAJOR}, 2)
+	LIBMBEDTLS_SRCS +=  $(addprefix ${MBEDTLS_DIR}/library/,	\
+						rsa_internal.c		\
+						)
+else ifeq (${MBEDTLS_MAJOR}, 3)
+	LIBMBEDTLS_SRCS +=  $(addprefix ${MBEDTLS_DIR}/library/,	\
+						bignum_core.c		\
+						rsa_alt_helpers.c	\
+						hash_info.c		\
+						)
+
+	# Currently on Mbedtls-3 there is outstanding bug due to usage
+	# of redundant declaration[1], So disable redundant-decls
+	# compilation flag to avoid compilation error when compiling with
+	# Mbedtls-3.
+	# [1]: https://github.com/Mbed-TLS/mbedtls/issues/6910
+	LIBMBEDTLS_CFLAGS += -Wno-error=redundant-decls
+endif
+
 # The platform may define the variable 'TF_MBEDTLS_KEY_ALG' to select the key
 # algorithm to use. If the variable is not defined, select it based on
 # algorithm used for key generation `KEY_ALG`. If `KEY_ALG` is not defined,
diff --git a/drivers/auth/mbedtls/mbedtls_crypto.c b/drivers/auth/mbedtls/mbedtls_crypto.c
index 42a0925..4241d21 100644
--- a/drivers/auth/mbedtls/mbedtls_crypto.c
+++ b/drivers/auth/mbedtls/mbedtls_crypto.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2022, Arm Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2023, Arm Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -14,12 +14,13 @@
 #include <mbedtls/memory_buffer_alloc.h>
 #include <mbedtls/oid.h>
 #include <mbedtls/platform.h>
+#include <mbedtls/version.h>
 #include <mbedtls/x509.h>
 
 #include <common/debug.h>
 #include <drivers/auth/crypto_mod.h>
 #include <drivers/auth/mbedtls/mbedtls_common.h>
-#include <drivers/auth/mbedtls/mbedtls_config.h>
+
 #include <plat/common/platform.h>
 
 #define LIB_NAME		"mbed TLS"
@@ -294,6 +295,7 @@
 	unsigned char *pt = data_ptr;
 	size_t dec_len;
 	int diff, i, rc;
+	size_t output_length __unused;
 
 	mbedtls_gcm_init(&ctx);
 
@@ -303,7 +305,11 @@
 		goto exit_gcm;
 	}
 
+#if (MBEDTLS_VERSION_MAJOR < 3)
 	rc = mbedtls_gcm_starts(&ctx, MBEDTLS_GCM_DECRYPT, iv, iv_len, NULL, 0);
+#else
+	rc = mbedtls_gcm_starts(&ctx, MBEDTLS_GCM_DECRYPT, iv, iv_len);
+#endif
 	if (rc != 0) {
 		rc = CRYPTO_ERR_DECRYPTION;
 		goto exit_gcm;
@@ -312,7 +318,12 @@
 	while (len > 0) {
 		dec_len = MIN(sizeof(buf), len);
 
+#if (MBEDTLS_VERSION_MAJOR < 3)
 		rc = mbedtls_gcm_update(&ctx, dec_len, pt, buf);
+#else
+		rc = mbedtls_gcm_update(&ctx, pt, dec_len, buf, sizeof(buf), &output_length);
+#endif
+
 		if (rc != 0) {
 			rc = CRYPTO_ERR_DECRYPTION;
 			goto exit_gcm;
@@ -323,7 +334,12 @@
 		len -= dec_len;
 	}
 
+#if (MBEDTLS_VERSION_MAJOR < 3)
 	rc = mbedtls_gcm_finish(&ctx, tag_buf, sizeof(tag_buf));
+#else
+	rc = mbedtls_gcm_finish(&ctx, NULL, 0, &output_length, tag_buf, sizeof(tag_buf));
+#endif
+
 	if (rc != 0) {
 		rc = CRYPTO_ERR_DECRYPTION;
 		goto exit_gcm;
diff --git a/drivers/auth/mbedtls/mbedtls_x509_parser.c b/drivers/auth/mbedtls/mbedtls_x509_parser.c
index bbabd9b..b538c78 100644
--- a/drivers/auth/mbedtls/mbedtls_x509_parser.c
+++ b/drivers/auth/mbedtls/mbedtls_x509_parser.c
@@ -161,7 +161,8 @@
 
 	p = (unsigned char *)img;
 	len = img_len;
-	end = p + len;
+	crt_end = p + len;
+	end = crt_end;
 
 	/*
 	 * Certificate  ::=  SEQUENCE  {
@@ -171,15 +172,10 @@
 	 */
 	ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED |
 				   MBEDTLS_ASN1_SEQUENCE);
-	if (ret != 0) {
+	if ((ret != 0) || ((p + len) != end)) {
 		return IMG_PARSER_ERR_FORMAT;
 	}
 
-	if (len != (size_t)(end - p)) {
-		return IMG_PARSER_ERR_FORMAT;
-	}
-	crt_end = p + len;
-
 	/*
 	 * TBSCertificate  ::=  SEQUENCE  {
 	 */
@@ -220,9 +216,6 @@
 	if (ret != 0) {
 		return IMG_PARSER_ERR_FORMAT;
 	}
-	if ((end - p) < 1) {
-		return IMG_PARSER_ERR_FORMAT;
-	}
 	sig_alg1.len = (p + len) - sig_alg1.p;
 	p += len;
 
@@ -288,30 +281,24 @@
 
 	/*
 	 * issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,
-	 */
-	ret = mbedtls_asn1_get_tag(&p, end, &len,
-				   MBEDTLS_ASN1_CONTEXT_SPECIFIC |
-				   MBEDTLS_ASN1_CONSTRUCTED | 1);
-	if (ret != 0) {
-		if (ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) {
-			return IMG_PARSER_ERR_FORMAT;
-		}
-	} else {
-		p += len;
-	}
-
-	/*
 	 * subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL,
+	 * -- technically these contain BIT STRINGs but that is not worth
+	 * -- validating
 	 */
-	ret = mbedtls_asn1_get_tag(&p, end, &len,
-				   MBEDTLS_ASN1_CONTEXT_SPECIFIC |
-				   MBEDTLS_ASN1_CONSTRUCTED | 2);
-	if (ret != 0) {
+	for (int i = 1; i < 3; i++) {
+		ret = mbedtls_asn1_get_tag(&p, end, &len,
+					   MBEDTLS_ASN1_CONTEXT_SPECIFIC |
+					   MBEDTLS_ASN1_CONSTRUCTED | i);
+		/*
+		 * Unique IDs are obsolete, so MBEDTLS_ERR_ASN1_UNEXPECTED_TAG
+		 * is the common case.
+		 */
 		if (ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) {
-			return IMG_PARSER_ERR_FORMAT;
+			if (ret != 0) {
+				return IMG_PARSER_ERR_FORMAT;
+			}
+			p += len;
 		}
-	} else {
-		p += len;
 	}
 
 	/*
@@ -414,19 +401,14 @@
 
 	/*
 	 * signatureValue       BIT STRING
+	 * } -- must consume all bytes
 	 */
 	signature.p = p;
 	ret = mbedtls_asn1_get_bitstring_null(&p, end, &len);
-	if (ret != 0) {
+	if ((ret != 0) || ((p + len) != end)) {
 		return IMG_PARSER_ERR_FORMAT;
 	}
-	signature.len = (p + len) - signature.p;
-	p += len;
-
-	/* Check certificate length */
-	if (p != end) {
-		return IMG_PARSER_ERR_FORMAT;
-	}
+	signature.len = end - signature.p;
 
 	return IMG_PARSER_OK;
 }
diff --git a/drivers/auth/tbbr/tbbr_cot_bl1.c b/drivers/auth/tbbr/tbbr_cot_bl1.c
index 44f8638..21942b4 100644
--- a/drivers/auth/tbbr/tbbr_cot_bl1.c
+++ b/drivers/auth/tbbr/tbbr_cot_bl1.c
@@ -1,22 +1,24 @@
 /*
- * Copyright (c) 2015-2022, Arm Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2023, Arm Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
 
 #include <stddef.h>
 
-#include <platform_def.h>
-#include MBEDTLS_CONFIG_FILE
+#include <mbedtls/version.h>
 
 #include <drivers/auth/auth_mod.h>
 #include <drivers/auth/tbbr_cot_common.h>
+
 #if USE_TBBR_DEFS
 #include <tools_share/tbbr_oid.h>
 #else
 #include <platform_oid.h>
 #endif
 
+#include <platform_def.h>
+
 static auth_param_type_desc_t scp_bl2u_hash = AUTH_PARAM_TYPE_DESC(
 		AUTH_PARAM_HASH, SCP_FWU_CFG_HASH_OID);
 static auth_param_type_desc_t bl2u_hash = AUTH_PARAM_TYPE_DESC(
diff --git a/drivers/auth/tbbr/tbbr_cot_bl1_r64.c b/drivers/auth/tbbr/tbbr_cot_bl1_r64.c
index 78e38f6..236823a 100644
--- a/drivers/auth/tbbr/tbbr_cot_bl1_r64.c
+++ b/drivers/auth/tbbr/tbbr_cot_bl1_r64.c
@@ -1,13 +1,14 @@
 /*
- * Copyright (c) 2021-2022, Arm Limited and Contributors. All rights reserved.
+ * Copyright (c) 2021-2023, Arm Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
 
 #include <stddef.h>
 
+#include <mbedtls/version.h>
+
 #include <drivers/auth/auth_mod.h>
-#include MBEDTLS_CONFIG_FILE
 #include <drivers/auth/tbbr_cot_common.h>
 
 #if USE_TBBR_DEFS
@@ -15,8 +16,8 @@
 #else
 #include <platform_oid.h>
 #endif
-#include <platform_def.h>
 
+#include <platform_def.h>
 
 static unsigned char trusted_world_pk_buf[PK_DER_LEN];
 static unsigned char non_trusted_world_pk_buf[PK_DER_LEN];
diff --git a/drivers/auth/tbbr/tbbr_cot_bl2.c b/drivers/auth/tbbr/tbbr_cot_bl2.c
index 11e2f46..ce2aa7e 100644
--- a/drivers/auth/tbbr/tbbr_cot_bl2.c
+++ b/drivers/auth/tbbr/tbbr_cot_bl2.c
@@ -1,22 +1,24 @@
 /*
- * Copyright (c) 2015-2022, Arm Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2023, Arm Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
 
 #include <stddef.h>
 
-#include <platform_def.h>
-#include MBEDTLS_CONFIG_FILE
+#include <mbedtls/version.h>
 
 #include <drivers/auth/auth_mod.h>
 #include <drivers/auth/tbbr_cot_common.h>
+
 #if USE_TBBR_DEFS
 #include <tools_share/tbbr_oid.h>
 #else
 #include <platform_oid.h>
 #endif
 
+#include <platform_def.h>
+
 static unsigned char soc_fw_hash_buf[HASH_DER_LEN];
 static unsigned char tos_fw_hash_buf[HASH_DER_LEN];
 static unsigned char tos_fw_extra1_hash_buf[HASH_DER_LEN];
diff --git a/drivers/auth/tbbr/tbbr_cot_common.c b/drivers/auth/tbbr/tbbr_cot_common.c
index 0983d42..8c37248 100644
--- a/drivers/auth/tbbr/tbbr_cot_common.c
+++ b/drivers/auth/tbbr/tbbr_cot_common.c
@@ -1,22 +1,23 @@
 /*
- * Copyright (c) 2015-2022, Arm Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2023, Arm Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
 
 #include <stddef.h>
 
-#include <platform_def.h>
-#include MBEDTLS_CONFIG_FILE
+#include <mbedtls/version.h>
 
 #include <drivers/auth/auth_mod.h>
 #include <drivers/auth/tbbr_cot_common.h>
+
 #if USE_TBBR_DEFS
 #include <tools_share/tbbr_oid.h>
 #else
 #include <platform_oid.h>
 #endif
 
+#include <platform_def.h>
 /*
  * The platform must allocate buffers to store the authentication parameters
  * extracted from the certificates. In this case, because of the way the CoT is
diff --git a/drivers/ufs/ufs.c b/drivers/ufs/ufs.c
index cf3f0e6..6074374 100644
--- a/drivers/ufs/ufs.c
+++ b/drivers/ufs/ufs.c
@@ -234,42 +234,33 @@
 	return -EIO;
 }
 
-/* Check Door Bell register to get an empty slot */
-static int get_empty_slot(int *slot)
+/* Read Door Bell register to check if slot zero is available */
+static int is_slot_available(void)
 {
-	unsigned int data;
-	int i;
-
-	data = mmio_read_32(ufs_params.reg_base + UTRLDBR);
-	for (i = 0; i < nutrs; i++) {
-		if ((data & 1) == 0)
-			break;
-		data = data >> 1;
-	}
-	if (i >= nutrs)
+	if (mmio_read_32(ufs_params.reg_base + UTRLDBR) & 0x1) {
 		return -EBUSY;
-	*slot = i;
+	}
 	return 0;
 }
 
 static void get_utrd(utp_utrd_t *utrd)
 {
 	uintptr_t base;
-	int slot = 0, result;
+	int result;
 	utrd_header_t *hd;
 
 	assert(utrd != NULL);
-	result = get_empty_slot(&slot);
+	result = is_slot_available();
 	assert(result == 0);
 
 	/* clear utrd */
 	memset((void *)utrd, 0, sizeof(utp_utrd_t));
-	base = ufs_params.desc_base + (slot * sizeof(utrd_header_t));
+	base = ufs_params.desc_base;
 	/* clear the descriptor */
 	memset((void *)base, 0, UFS_DESC_SIZE);
 
 	utrd->header = base;
-	utrd->task_tag = slot + 1;
+	utrd->task_tag = 1; /* We always use the first slot */
 	/* CDB address should be aligned with 128 bytes */
 	utrd->upiu = ALIGN_CDB(utrd->header + sizeof(utrd_header_t));
 	utrd->resp_upiu = ALIGN_8(utrd->upiu + sizeof(cmd_upiu_t));
@@ -297,7 +288,8 @@
 	prdt_t *prdt;
 	unsigned int ulba;
 	unsigned int lba_cnt;
-	int prdt_size;
+	uintptr_t desc_limit;
+	uintptr_t prdt_end;
 
 	hd = (utrd_header_t *)utrd->header;
 	upiu = (cmd_upiu_t *)utrd->upiu;
@@ -351,17 +343,24 @@
 		assert(0);
 		break;
 	}
-	if (hd->dd == DD_IN)
+	if (hd->dd == DD_IN) {
 		flush_dcache_range(buf, length);
-	else if (hd->dd == DD_OUT)
+	} else if (hd->dd == DD_OUT) {
 		inv_dcache_range(buf, length);
+	}
+
+	utrd->prdt_length = 0;
 	if (length) {
 		upiu->exp_data_trans_len = htobe32(length);
 		assert(lba_cnt <= UINT16_MAX);
 		prdt = (prdt_t *)utrd->prdt;
 
-		prdt_size = 0;
+		desc_limit = ufs_params.desc_base + ufs_params.desc_size;
 		while (length > 0) {
+			if ((uintptr_t)prdt + sizeof(prdt_t) > desc_limit) {
+				ERROR("UFS: Exceeded descriptor limit. Image is too large\n");
+				panic();
+			}
 			prdt->dba = (unsigned int)(buf & UINT32_MAX);
 			prdt->dbau = (unsigned int)((buf >> 32) & UINT32_MAX);
 			/* prdt->dbc counts from 0 */
@@ -374,14 +373,14 @@
 			}
 			buf += MAX_PRDT_SIZE;
 			prdt++;
-			prdt_size += sizeof(prdt_t);
+			utrd->prdt_length++;
 		}
-		utrd->size_prdt = ALIGN_8(prdt_size);
-		hd->prdtl = utrd->size_prdt >> 2;
+		hd->prdtl = utrd->prdt_length;
 		hd->prdto = (utrd->size_upiu + utrd->size_resp_upiu) >> 2;
 	}
 
-	flush_dcache_range((uintptr_t)utrd->header, UFS_DESC_SIZE);
+	prdt_end = utrd->prdt + utrd->prdt_length * sizeof(prdt_t);
+	flush_dcache_range(utrd->header, prdt_end - utrd->header);
 	return 0;
 }
 
diff --git a/include/common/tbbr/cot_def.h b/include/common/tbbr/cot_def.h
index 60dfb8a..7823ff3 100644
--- a/include/common/tbbr/cot_def.h
+++ b/include/common/tbbr/cot_def.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2022, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2023, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -7,9 +7,7 @@
 #ifndef COT_DEF_H
 #define COT_DEF_H
 
-#ifdef MBEDTLS_CONFIG_FILE
-#include MBEDTLS_CONFIG_FILE
-#endif
+#include <mbedtls/version.h>
 
 /* TBBR CoT definitions */
 #if defined(SPD_spmd)
diff --git a/include/drivers/auth/auth_mod.h b/include/drivers/auth/auth_mod.h
index 94537f6..28aa407 100644
--- a/include/drivers/auth/auth_mod.h
+++ b/include/drivers/auth/auth_mod.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2022, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2023, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -7,7 +7,6 @@
 #ifndef AUTH_MOD_H
 #define AUTH_MOD_H
 
-#include <common/tbbr/cot_def.h>
 #include <common/tbbr/tbbr_img_def.h>
 #include <drivers/auth/auth_common.h>
 #include <drivers/auth/img_parser_mod.h>
diff --git a/include/drivers/auth/mbedtls/mbedtls_config.h b/include/drivers/auth/mbedtls/mbedtls_config-2.h
similarity index 100%
rename from include/drivers/auth/mbedtls/mbedtls_config.h
rename to include/drivers/auth/mbedtls/mbedtls_config-2.h
diff --git a/include/drivers/auth/mbedtls/mbedtls_config-3.h b/include/drivers/auth/mbedtls/mbedtls_config-3.h
new file mode 100644
index 0000000..ba936a3
--- /dev/null
+++ b/include/drivers/auth/mbedtls/mbedtls_config-3.h
@@ -0,0 +1,153 @@
+/*
+ * Copyright (c) 2023, Arm Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+/**
+ *  This set of compile-time options may be used to enable
+ *  or disable features selectively, and reduce the global
+ *  memory footprint.
+ */
+
+/*
+ * Key algorithms currently supported on mbed TLS libraries
+ */
+#define TF_MBEDTLS_RSA			1
+#define TF_MBEDTLS_ECDSA		2
+#define TF_MBEDTLS_RSA_AND_ECDSA	3
+
+#define TF_MBEDTLS_USE_RSA (TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_RSA \
+		|| TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_RSA_AND_ECDSA)
+#define TF_MBEDTLS_USE_ECDSA (TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_ECDSA \
+		|| TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_RSA_AND_ECDSA)
+
+/*
+ * Hash algorithms currently supported on mbed TLS libraries
+ */
+#define TF_MBEDTLS_SHA256		1
+#define TF_MBEDTLS_SHA384		2
+#define TF_MBEDTLS_SHA512		3
+
+/*
+ * Configuration file to build mbed TLS with the required features for
+ * Trusted Boot
+ */
+
+#define MBEDTLS_PLATFORM_MEMORY
+#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
+/* Prevent mbed TLS from using snprintf so that it can use tf_snprintf. */
+#define MBEDTLS_PLATFORM_SNPRINTF_ALT
+
+#define MBEDTLS_PKCS1_V21
+
+#define MBEDTLS_ASN1_PARSE_C
+#define MBEDTLS_ASN1_WRITE_C
+
+#define MBEDTLS_BASE64_C
+#define MBEDTLS_BIGNUM_C
+
+#define MBEDTLS_ERROR_C
+#define MBEDTLS_MD_C
+
+#define MBEDTLS_MEMORY_BUFFER_ALLOC_C
+#define MBEDTLS_OID_C
+
+#define MBEDTLS_PK_C
+#define MBEDTLS_PK_PARSE_C
+#define MBEDTLS_PK_WRITE_C
+
+#define MBEDTLS_PLATFORM_C
+
+#if TF_MBEDTLS_USE_ECDSA
+#define MBEDTLS_ECDSA_C
+#define MBEDTLS_ECP_C
+#define MBEDTLS_ECP_DP_SECP256R1_ENABLED
+#endif
+#if TF_MBEDTLS_USE_RSA
+#define MBEDTLS_RSA_C
+#define MBEDTLS_X509_RSASSA_PSS_SUPPORT
+#endif
+
+/* The library does not currently support enabling SHA-256 without SHA-224. */
+#define MBEDTLS_SHA224_C
+#define MBEDTLS_SHA256_C
+/*
+ * If either Trusted Boot or Measured Boot require a stronger algorithm than
+ * SHA-256, pull in SHA-512 support. Library currently needs to have SHA_384
+ * support when enabling SHA-512.
+ */
+#if (TF_MBEDTLS_HASH_ALG_ID != TF_MBEDTLS_SHA256) /* TBB hash algo */
+#define MBEDTLS_SHA384_C
+#define	MBEDTLS_SHA512_C
+#else
+   /* TBB uses SHA-256, what about measured boot? */
+#if defined(TF_MBEDTLS_MBOOT_USE_SHA512)
+#define MBEDTLS_SHA384_C
+#define MBEDTLS_SHA512_C
+#endif
+#endif
+
+#define MBEDTLS_VERSION_C
+
+#define MBEDTLS_X509_USE_C
+#define MBEDTLS_X509_CRT_PARSE_C
+
+#if TF_MBEDTLS_USE_AES_GCM
+#define MBEDTLS_AES_C
+#define MBEDTLS_CIPHER_C
+#define MBEDTLS_GCM_C
+#endif
+
+/* MPI / BIGNUM options */
+#define MBEDTLS_MPI_WINDOW_SIZE			2
+
+#if TF_MBEDTLS_USE_RSA
+#if TF_MBEDTLS_KEY_SIZE <= 2048
+#define MBEDTLS_MPI_MAX_SIZE			256
+#else
+#define MBEDTLS_MPI_MAX_SIZE			512
+#endif
+#else
+#define MBEDTLS_MPI_MAX_SIZE			256
+#endif
+
+/* Memory buffer allocator options */
+#define MBEDTLS_MEMORY_ALIGN_MULTIPLE		8
+
+/*
+ * Prevent the use of 128-bit division which
+ * creates dependency on external libraries.
+ */
+#define MBEDTLS_NO_UDBL_DIVISION
+
+#ifndef __ASSEMBLER__
+/* System headers required to build mbed TLS with the current configuration */
+#include <stdlib.h>
+#include <mbedtls/check_config.h>
+#endif
+
+/*
+ * Determine Mbed TLS heap size
+ * 13312 = 13*1024
+ * 11264 = 11*1024
+ * 7168  = 7*1024
+ */
+#if TF_MBEDTLS_USE_ECDSA
+#define TF_MBEDTLS_HEAP_SIZE		U(13312)
+#elif TF_MBEDTLS_USE_RSA
+#if TF_MBEDTLS_KEY_SIZE <= 2048
+#define TF_MBEDTLS_HEAP_SIZE		U(7168)
+#else
+#define TF_MBEDTLS_HEAP_SIZE		U(11264)
+#endif
+#endif
+
+/*
+ * Warn if errors from certain functions are ignored.
+ *
+ * The warnings are always enabled (where supported) for critical functions
+ * where ignoring the return value is almost always a bug. This macro extends
+ * the warnings to more functions.
+ */
+#define MBEDTLS_CHECK_RETURN_WARNING
diff --git a/include/drivers/auth/tbbr_cot_common.h b/include/drivers/auth/tbbr_cot_common.h
index a51faee..b4f2d22 100644
--- a/include/drivers/auth/tbbr_cot_common.h
+++ b/include/drivers/auth/tbbr_cot_common.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2020,2023, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -7,6 +7,7 @@
 #ifndef TBBR_COT_COMMON_H
 #define TBBR_COT_COMMON_H
 
+#include <common/tbbr/cot_def.h>
 #include <drivers/auth/auth_mod.h>
 
 extern unsigned char tb_fw_hash_buf[HASH_DER_LEN];
diff --git a/include/drivers/ufs.h b/include/drivers/ufs.h
index 1cd1bee..e4ec00d 100644
--- a/include/drivers/ufs.h
+++ b/include/drivers/ufs.h
@@ -519,7 +519,7 @@
 	uintptr_t	prdt;
 	size_t		size_upiu;
 	size_t		size_resp_upiu;
-	size_t		size_prdt;
+	size_t		prdt_length;
 	int		task_tag;
 } utp_utrd_t;
 
diff --git a/lib/fconf/fconf_cot_getter.c b/lib/fconf/fconf_cot_getter.c
index ae59d8c..1033018 100644
--- a/lib/fconf/fconf_cot_getter.c
+++ b/lib/fconf/fconf_cot_getter.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2022, Arm Limited. All rights reserved.
+ * Copyright (c) 2020-2023, Arm Limited. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -7,8 +7,10 @@
 #include <assert.h>
 #include <stddef.h>
 
+#include <mbedtls/version.h>
+
 #include <common/fdt_wrappers.h>
-#include MBEDTLS_CONFIG_FILE
+#include <common/tbbr/cot_def.h>
 #include <drivers/auth/auth_mod.h>
 #include <lib/fconf/fconf.h>
 #include <lib/object_pool.h>
diff --git a/plat/arm/board/fvp/include/platform_def.h b/plat/arm/board/fvp/include/platform_def.h
index 1ef6c87..52146a3 100644
--- a/plat/arm/board/fvp/include/platform_def.h
+++ b/plat/arm/board/fvp/include/platform_def.h
@@ -16,6 +16,10 @@
 
 #include "../fvp_def.h"
 
+#if TRUSTED_BOARD_BOOT
+#include MBEDTLS_CONFIG_FILE
+#endif
+
 /* Required platform porting definitions */
 #define PLATFORM_CORE_COUNT  (U(FVP_CLUSTER_COUNT) * \
 			      U(FVP_MAX_CPUS_PER_CLUSTER) * \
@@ -171,7 +175,11 @@
  * PLAT_ARM_MAX_BL1_RW_SIZE is calculated using the current BL1 RW debug size
  * plus a little space for growth.
  */
+#if TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_RSA_AND_ECDSA
+#define PLAT_ARM_MAX_BL1_RW_SIZE	UL(0xC000)
+#else
 #define PLAT_ARM_MAX_BL1_RW_SIZE	UL(0xB000)
+#endif
 
 /*
  * PLAT_ARM_MAX_ROMLIB_RW_SIZE is define to use a full page
@@ -191,10 +199,12 @@
  * PLAT_ARM_MAX_BL2_SIZE is calculated using the current BL2 debug size plus a
  * little space for growth.
  */
-#if TRUSTED_BOARD_BOOT && COT_DESC_IN_DTB
+#if CRYPTO_SUPPORT
+#if (TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_RSA_AND_ECDSA) || COT_DESC_IN_DTB
 # define PLAT_ARM_MAX_BL2_SIZE	(UL(0x1E000) - FVP_BL2_ROMLIB_OPTIMIZATION)
-#elif CRYPTO_SUPPORT
+#else
 # define PLAT_ARM_MAX_BL2_SIZE	(UL(0x1D000) - FVP_BL2_ROMLIB_OPTIMIZATION)
+#endif
 #elif ARM_BL31_IN_DRAM
 /* When ARM_BL31_IN_DRAM is set, BL2 can use almost all of Trusted SRAM. */
 # define PLAT_ARM_MAX_BL2_SIZE	(UL(0x1F000) - FVP_BL2_ROMLIB_OPTIMIZATION)
diff --git a/plat/arm/common/arm_dyn_cfg.c b/plat/arm/common/arm_dyn_cfg.c
index c88621e..067109b 100644
--- a/plat/arm/common/arm_dyn_cfg.c
+++ b/plat/arm/common/arm_dyn_cfg.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2022, Arm Limited and Contributors. All rights reserved.
+ * Copyright (c) 2018-2023, Arm Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -8,20 +8,20 @@
 #include <string.h>
 #include <libfdt.h>
 
-#include <platform_def.h>
+#if CRYPTO_SUPPORT
+#include <mbedtls/version.h>
+#endif /* CRYPTO_SUPPORT */
 
 #include <common/debug.h>
 #include <common/desc_image_load.h>
 #include <common/tbbr/tbbr_img_def.h>
-#if CRYPTO_SUPPORT
-#include MBEDTLS_CONFIG_FILE
-#endif /* CRYPTO_SUPPORT */
 #include <lib/fconf/fconf.h>
 #include <lib/fconf/fconf_dyn_cfg_getter.h>
 #include <lib/fconf/fconf_tbbr_getter.h>
 
 #include <plat/arm/common/arm_dyn_cfg_helpers.h>
 #include <plat/arm/common/plat_arm.h>
+#include <platform_def.h>
 
 #if CRYPTO_SUPPORT
 
diff --git a/plat/st/stm32mp1/include/stm32mp1_mbedtls_config.h b/plat/st/stm32mp1/include/stm32mp1_mbedtls_config-2.h
similarity index 100%
rename from plat/st/stm32mp1/include/stm32mp1_mbedtls_config.h
rename to plat/st/stm32mp1/include/stm32mp1_mbedtls_config-2.h
diff --git a/plat/st/stm32mp1/include/stm32mp1_mbedtls_config-3.h b/plat/st/stm32mp1/include/stm32mp1_mbedtls_config-3.h
new file mode 100644
index 0000000..d7dab1f
--- /dev/null
+++ b/plat/st/stm32mp1/include/stm32mp1_mbedtls_config-3.h
@@ -0,0 +1,115 @@
+/*
+ * Copyright (c) 2022, STMicroelectronics - All Rights Reserved
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+/*
+ * Key algorithms currently supported on mbed TLS libraries
+ */
+#define TF_MBEDTLS_USE_RSA	0
+#define TF_MBEDTLS_USE_ECDSA	1
+
+/*
+ * Hash algorithms currently supported on mbed TLS libraries
+ */
+#define TF_MBEDTLS_SHA256		1
+#define TF_MBEDTLS_SHA384		2
+#define TF_MBEDTLS_SHA512		3
+
+/*
+ * Configuration file to build mbed TLS with the required features for
+ * Trusted Boot
+ */
+
+#define MBEDTLS_PLATFORM_MEMORY
+#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
+/* Prevent mbed TLS from using snprintf so that it can use tf_snprintf. */
+#define MBEDTLS_PLATFORM_SNPRINTF_ALT
+
+#define MBEDTLS_PKCS1_V21
+
+#define MBEDTLS_ASN1_PARSE_C
+#define MBEDTLS_ASN1_WRITE_C
+
+#define MBEDTLS_BASE64_C
+#define MBEDTLS_BIGNUM_C
+
+#define MBEDTLS_ERROR_C
+#define MBEDTLS_MD_C
+
+#define MBEDTLS_MEMORY_BUFFER_ALLOC_C
+#define MBEDTLS_OID_C
+
+#define MBEDTLS_PK_C
+#define MBEDTLS_PK_PARSE_C
+#define MBEDTLS_PK_WRITE_C
+
+#define MBEDTLS_PLATFORM_C
+
+#if TF_MBEDTLS_USE_ECDSA
+#define MBEDTLS_ECDSA_C
+#define MBEDTLS_ECP_C
+#define MBEDTLS_ECP_DP_SECP256R1_ENABLED
+#endif
+#if TF_MBEDTLS_USE_RSA
+#define MBEDTLS_RSA_C
+#define MBEDTLS_X509_RSASSA_PSS_SUPPORT
+#endif
+
+/* The library does not currently support enabling SHA-256 without SHA-224. */
+#define MBEDTLS_SHA224_C
+#define MBEDTLS_SHA256_C
+
+#if (TF_MBEDTLS_HASH_ALG_ID != TF_MBEDTLS_SHA256)
+#define MBEDTLS_SHA384_C
+#define MBEDTLS_SHA512_C
+#endif
+
+#define MBEDTLS_VERSION_C
+
+#define MBEDTLS_X509_USE_C
+#define MBEDTLS_X509_CRT_PARSE_C
+
+#if TF_MBEDTLS_USE_AES_GCM
+#define MBEDTLS_AES_C
+#define MBEDTLS_CIPHER_C
+#define MBEDTLS_GCM_C
+#endif
+
+/* MPI / BIGNUM options */
+#define MBEDTLS_MPI_WINDOW_SIZE			2
+
+#if TF_MBEDTLS_USE_RSA
+#if TF_MBEDTLS_KEY_SIZE <= 2048
+#define MBEDTLS_MPI_MAX_SIZE			256
+#else
+#define MBEDTLS_MPI_MAX_SIZE			512
+#endif
+#else
+#define MBEDTLS_MPI_MAX_SIZE			256
+#endif
+
+/* Memory buffer allocator options */
+#define MBEDTLS_MEMORY_ALIGN_MULTIPLE		8
+
+/*
+ * Prevent the use of 128-bit division which
+ * creates dependency on external libraries.
+ */
+#define MBEDTLS_NO_UDBL_DIVISION
+
+#ifndef __ASSEMBLER__
+/* System headers required to build mbed TLS with the current configuration */
+#include <stdlib.h>
+#include <mbedtls/check_config.h>
+#endif
+
+/*
+ * Mbed TLS heap size is smal as we only use the asn1
+ * parsing functions
+ * digest, signature and crypto algorithm are done by
+ * other library.
+ */
+
+#define TF_MBEDTLS_HEAP_SIZE           U(5120)
diff --git a/plat/st/stm32mp1/platform.mk b/plat/st/stm32mp1/platform.mk
index 236296e..039ae63 100644
--- a/plat/st/stm32mp1/platform.mk
+++ b/plat/st/stm32mp1/platform.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2015-2022, ARM Limited and Contributors. All rights reserved.
+# Copyright (c) 2015-2023, ARM Limited and Contributors. All rights reserved.
 #
 # SPDX-License-Identifier: BSD-3-Clause
 #
@@ -381,7 +381,19 @@
 
 endif
 TF_MBEDTLS_KEY_ALG 	:=	ecdsa
-MBEDTLS_CONFIG_FILE	?=	"<stm32mp1_mbedtls_config.h>"
+
+ifneq (${MBEDTLS_DIR},)
+MBEDTLS_MAJOR=$(shell grep -hP "define MBEDTLS_VERSION_MAJOR" \
+${MBEDTLS_DIR}/include/mbedtls/*.h | grep -oe '\([0-9.]*\)')
+
+ifeq (${MBEDTLS_MAJOR}, 2)
+MBEDTLS_CONFIG_FILE	?=	"<stm32mp1_mbedtls_config-2.h>"
+endif
+
+ifeq (${MBEDTLS_MAJOR}, 3)
+MBEDTLS_CONFIG_FILE	?=	"<stm32mp1_mbedtls_config-3.h>"
+endif
+endif
 
 include drivers/auth/mbedtls/mbedtls_x509.mk
 
diff --git a/plat/xilinx/zynqmp/pm_service/pm_api_sys.c b/plat/xilinx/zynqmp/pm_service/pm_api_sys.c
index 6965f4b..99594f7 100644
--- a/plat/xilinx/zynqmp/pm_service/pm_api_sys.c
+++ b/plat/xilinx/zynqmp/pm_service/pm_api_sys.c
@@ -253,10 +253,6 @@
 	return pm_shutdown_scope;
 }
 
-#define EM_PACK_PAYLOAD1(pl, arg0) {	\
-	pl[0] = (uint16_t)(0xE) << 16 | (uint16_t)arg0;	\
-}
-
 /**
  * pm_self_suspend() - PM call for processor to suspend itself
  * @nid		Node id of the processor or subsystem
@@ -1810,30 +1806,3 @@
 
 	return pm_ipi_send_sync(primary_proc, payload, value, 1);
 }
-
-enum pm_ret_status em_set_action(uint32_t *value)
-{
-	uint32_t payload[PAYLOAD_ARG_CNT];
-
-	/* Send request to the PMU */
-	EM_PACK_PAYLOAD1(payload, EM_SET_ACTION);
-	return pm_ipi_send_sync(primary_proc, payload, value, 1);
-}
-
-enum pm_ret_status em_remove_action(uint32_t *value)
-{
-	uint32_t payload[PAYLOAD_ARG_CNT];
-
-	/* Send request to the PMU */
-	EM_PACK_PAYLOAD1(payload, EM_REMOVE_ACTION);
-	return pm_ipi_send_sync(primary_proc, payload, value, 1);
-}
-
-enum pm_ret_status em_send_errors(uint32_t *value)
-{
-	uint32_t payload[PAYLOAD_ARG_CNT];
-
-	/* Send request to the PMU */
-	EM_PACK_PAYLOAD1(payload, EM_SEND_ERRORS);
-	return pm_ipi_send_sync(primary_proc, payload, value, 1);
-}
diff --git a/plat/xilinx/zynqmp/pm_service/pm_api_sys.h b/plat/xilinx/zynqmp/pm_service/pm_api_sys.h
index 9ba9475..c4fe038 100644
--- a/plat/xilinx/zynqmp/pm_service/pm_api_sys.h
+++ b/plat/xilinx/zynqmp/pm_service/pm_api_sys.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2013-2022, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2023, Advanced Micro Devices Inc. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -187,9 +188,6 @@
 enum pm_ret_status pm_pll_get_mode(enum pm_node_id nid, enum pm_pll_mode *mode);
 enum pm_ret_status pm_efuse_access(uint32_t address_high,
 				   uint32_t address_low, uint32_t *value);
-enum pm_ret_status em_set_action(uint32_t *value);
-enum pm_ret_status em_remove_action(uint32_t *value);
-enum pm_ret_status em_send_errors(uint32_t *value);
 enum pm_ret_status pm_feature_check(uint32_t api_id, uint32_t *version,
 				    uint32_t *bit_mask, uint8_t len);
 enum pm_ret_status check_api_dependency(uint8_t id);
diff --git a/plat/xilinx/zynqmp/pm_service/pm_defs.h b/plat/xilinx/zynqmp/pm_service/pm_defs.h
index f0a8d03..008cfdc 100644
--- a/plat/xilinx/zynqmp/pm_service/pm_defs.h
+++ b/plat/xilinx/zynqmp/pm_service/pm_defs.h
@@ -53,8 +53,6 @@
 #define PM_PROC_STATE_SLEEP		2U
 #define PM_PROC_STATE_SUSPENDING	3U
 
-#define EM_FUNID_NUM_MASK    0xF0000U
-
 #define PM_GET_CALLBACK_DATA		0xa01
 #define PM_SET_SUSPEND_MODE		0xa02
 #define PM_GET_TRUSTZONE_VERSION	0xa03
@@ -355,13 +353,4 @@
 	PM_CLOCK_DIV1_ID,
 };
 
-/**
- * EM API IDs
- */
-enum em_api_id {
-	EM_SET_ACTION = 0x3001,
-	EM_REMOVE_ACTION,
-	EM_SEND_ERRORS,
-};
-
 #endif /* PM_DEFS_H */
diff --git a/plat/xilinx/zynqmp/pm_service/pm_svc_main.c b/plat/xilinx/zynqmp/pm_service/pm_svc_main.c
index a3f0278..c907773 100644
--- a/plat/xilinx/zynqmp/pm_service/pm_svc_main.c
+++ b/plat/xilinx/zynqmp/pm_service/pm_svc_main.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2013-2022, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2023, Advanced Micro Devices Inc. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -568,56 +569,3 @@
 			 (uint64_t)result[1] | ((uint64_t)result[2] << 32U));
 	}
 }
-
-/**
- * em_smc_handler() - SMC handler for EM-API calls coming from EL1/EL2.
- * @smc_fid - Function Identifier
- * @x1 - x4 - Arguments
- * @cookie  - Unused
- * @handler - Pointer to caller's context structure
- *
- * @return  - Unused
- *
- * Determines that smc_fid is valid and supported EM SMC Function ID from the
- * list of em_api_ids, otherwise completes the request with
- * the unknown SMC Function ID
- *
- * The SMC calls for EM service are forwarded from SIP Service SMC handler
- * function with rt_svc_handle signature
- */
-uint64_t em_smc_handler(uint32_t smc_fid, uint64_t x1, uint64_t x2, uint64_t x3,
-			uint64_t x4, const void *cookie, void *handle, uint64_t flags)
-{
-	enum pm_ret_status ret;
-
-	switch (smc_fid & FUNCID_NUM_MASK) {
-	/* EM API Functions */
-	case EM_SET_ACTION:
-	{
-		uint32_t value;
-
-		ret = em_set_action(&value);
-		SMC_RET1(handle, (uint64_t)ret | ((uint64_t)value) << 32U);
-	}
-
-	case EM_REMOVE_ACTION:
-	{
-		uint32_t value;
-
-		ret = em_remove_action(&value);
-		SMC_RET1(handle, (uint64_t)ret | ((uint64_t)value) << 32U);
-	}
-
-	case EM_SEND_ERRORS:
-	{
-		uint32_t value;
-
-		ret = em_send_errors(&value);
-		SMC_RET1(handle, (uint64_t)ret | ((uint64_t)value) << 32U);
-	}
-
-	default:
-		WARN("Unimplemented EM Service Call: 0x%x\n", smc_fid);
-		SMC_RET1(handle, SMC_UNK);
-	}
-}
diff --git a/plat/xilinx/zynqmp/pm_service/pm_svc_main.h b/plat/xilinx/zynqmp/pm_service/pm_svc_main.h
index c1781f3..3c3082f 100644
--- a/plat/xilinx/zynqmp/pm_service/pm_svc_main.h
+++ b/plat/xilinx/zynqmp/pm_service/pm_svc_main.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2013-2020, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2023, Advanced Micro Devices Inc. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -13,8 +14,4 @@
 uint64_t pm_smc_handler(uint32_t smc_fid, uint64_t x1, uint64_t x2, uint64_t x3,
 			uint64_t x4, const void *cookie, void *handle,
 			uint64_t flags);
-
-uint64_t em_smc_handler(uint32_t smc_fid, uint64_t x1, uint64_t x2, uint64_t x3,
-			uint64_t x4, const void *cookie, void *handle,
-			uint64_t flags);
 #endif /* PM_SVC_MAIN_H */
diff --git a/plat/xilinx/zynqmp/sip_svc_setup.c b/plat/xilinx/zynqmp/sip_svc_setup.c
index c928e43..c55784e 100644
--- a/plat/xilinx/zynqmp/sip_svc_setup.c
+++ b/plat/xilinx/zynqmp/sip_svc_setup.c
@@ -30,8 +30,6 @@
 #define XLNX_FID_MASK	GENMASK(23, 12)
 #define PM_FID_VALUE	0u
 #define IPI_FID_VALUE	0x1000u
-#define EM_FID_VALUE	0x3000u
-#define is_em_fid(_fid) (((_fid) & XLNX_FID_MASK) == EM_FID_VALUE)
 #define is_pm_fid(_fid) (((_fid) & XLNX_FID_MASK) == PM_FID_VALUE)
 #define is_ipi_fid(_fid) (((_fid) & XLNX_FID_MASK) == IPI_FID_VALUE)
 
@@ -74,12 +72,6 @@
 		SMC_RET1(handle, SMC_UNK);
 	}
 
-	/* Let EM SMC handler deal with EM-related requests */
-	if (is_em_fid(smc_fid)) {
-		return em_smc_handler(smc_fid, x1, x2, x3, x4, cookie, handle,
-				      flags);
-	}
-
 	/* Let PM SMC handler deal with PM-related requests */
 	if (is_pm_fid(smc_fid)) {
 		return pm_smc_handler(smc_fid, x1, x2, x3, x4, cookie, handle,
diff --git a/tools/marvell/doimage/doimage.c b/tools/marvell/doimage/doimage.c
index e08b820..513f33f 100644
--- a/tools/marvell/doimage/doimage.c
+++ b/tools/marvell/doimage/doimage.c
@@ -17,12 +17,6 @@
 #ifdef CONFIG_MVEBU_SECURE_BOOT
 #include <libconfig.h>	/* for parsing config file */
 
-#if !defined(MBEDTLS_CONFIG_FILE)
-#include "mbedtls/config.h"
-#else
-#include MBEDTLS_CONFIG_FILE
-#endif
-
 /* mbedTLS stuff */
 #if defined(MBEDTLS_BIGNUM_C) && defined(MBEDTLS_ENTROPY_C) && \
 	defined(MBEDTLS_SHA256_C) && \
@@ -34,6 +28,7 @@
 #include <mbedtls/md.h>
 #include <mbedtls/pk.h>
 #include <mbedtls/sha256.h>
+#include <mbedtls/version.h>
 #include <mbedtls/x509.h>
 #else
 #error "Bad mbedTLS configuration!"