diff --git a/common/fdt_wrappers.c b/common/fdt_wrappers.c
index e67fdb0..ca5b455 100644
--- a/common/fdt_wrappers.c
+++ b/common/fdt_wrappers.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2018-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -103,6 +103,41 @@
 }
 
 /*
+ * Read bytes from a given property of the given node. Any number of
+ * bytes of the property can be read. The fdt pointer is updated.
+ * Returns 0 on success, and -1 on error.
+ */
+int fdtw_read_bytes(const void *dtb, int node, const char *prop,
+		    unsigned int length, void *value)
+{
+	const void *ptr;
+	int value_len;
+
+	assert(dtb != NULL);
+	assert(prop != NULL);
+	assert(value != NULL);
+	assert(node >= 0);
+
+	/* Access property and obtain its length (in bytes) */
+	ptr = fdt_getprop_namelen(dtb, node, prop, (int)strlen(prop),
+					&value_len);
+	if (ptr == NULL) {
+		WARN("Couldn't find property %s in dtb\n", prop);
+		return -1;
+	}
+
+	/* Verify that property length is not less than number of bytes */
+	if ((unsigned int)value_len < length) {
+		WARN("Property length mismatch\n");
+		return -1;
+	}
+
+	(void)memcpy(value, ptr, length);
+
+	return 0;
+}
+
+/*
  * Read string from a given property of the given node. Up to 'size - 1'
  * characters are read, and a NUL terminator is added. Returns 0 on success,
  * and -1 upon error.
@@ -167,3 +202,45 @@
 
 	return 0;
 }
+
+/*
+ * Write bytes in place to a given property of the given node.
+ * Any number of bytes of the property can be written.
+ * Returns 0 on success, and < 0 on error.
+ */
+int fdtw_write_inplace_bytes(void *dtb, int node, const char *prop,
+			     unsigned int length, const void *data)
+{
+	const void *ptr;
+	int namelen, value_len, err;
+
+	assert(dtb != NULL);
+	assert(prop != NULL);
+	assert(data != NULL);
+	assert(node >= 0);
+
+	namelen = (int)strlen(prop);
+
+	/* Access property and obtain its length in bytes */
+	ptr = fdt_getprop_namelen(dtb, node, prop, namelen, &value_len);
+	if (ptr == NULL) {
+		WARN("Couldn't find property %s in dtb\n", prop);
+		return -1;
+	}
+
+	/* Verify that property length is not less than number of bytes */
+	if ((unsigned int)value_len < length) {
+		WARN("Property length mismatch\n");
+		return -1;
+	}
+
+	/* Set property value in place */
+	err = fdt_setprop_inplace_namelen_partial(dtb, node, prop,
+						  namelen, 0,
+						  data, (int)length);
+	if (err != 0) {
+		WARN("Set property %s failed with error %d\n", prop, err);
+	}
+
+	return err;
+}
diff --git a/docs/plat/qemu.rst b/docs/plat/qemu.rst
index a4c5bec..88196bc 100644
--- a/docs/plat/qemu.rst
+++ b/docs/plat/qemu.rst
@@ -14,7 +14,7 @@
 via register x0, as expected by a Linux kernel. This allows a Linux kernel image
 to be booted directly as BL33 rather than using a bootloader.
 
-An ARM64 defconfig v4.5 Linux kernel is known to boot, FDT doesn't need to be
+An ARM64 defconfig v5.5 Linux kernel is known to boot, FDT doesn't need to be
 provided as it's generated by QEMU.
 
 Current limitations:
@@ -24,7 +24,7 @@
 -  No instructions for how to load a BL32 (Secure Payload)
 
 ``QEMU_EFI.fd`` can be dowloaded from
-http://snapshots.linaro.org/components/kernel/leg-virt-tianocore-edk2-upstream/latest/QEMU-KERNEL-AARCH64/RELEASE_GCC49/QEMU_EFI.fd
+http://snapshots.linaro.org/components/kernel/leg-virt-tianocore-edk2-upstream/latest/QEMU-KERNEL-AARCH64/RELEASE_GCC5/QEMU_EFI.fd
 
 Boot binaries, except BL1, are primarily loaded via semi-hosting so all
 binaries has to reside in the same directory as QEMU is started from. This
@@ -33,7 +33,7 @@
 -  ``bl2.bin`` -> BL2
 -  ``bl31.bin`` -> BL31
 -  ``bl33.bin`` -> BL33 (``QEMU_EFI.fd``)
--  ``Image`` -> linux/Image
+-  ``Image`` -> linux/arch/arm64/boot/Image
 
 To build:
 
@@ -41,12 +41,12 @@
 
     make CROSS_COMPILE=aarch64-none-elf- PLAT=qemu
 
-To start (QEMU v2.6.0):
+To start (QEMU v4.1.0):
 
 .. code:: shell
 
     qemu-system-aarch64 -nographic -machine virt,secure=on -cpu cortex-a57  \
         -kernel Image                           \
-        -append console=ttyAMA0,38400 keep_bootcon root=/dev/vda2   \
+        -append "console=ttyAMA0,38400 keep_bootcon root=/dev/vda2"   \
         -initrd rootfs-arm64.cpio.gz -smp 2 -m 1024 -bios bl1.bin   \
         -d unimp -semihosting-config enable,target=native
diff --git a/include/common/fdt_wrappers.h b/include/common/fdt_wrappers.h
index 79d001d..f467958 100644
--- a/include/common/fdt_wrappers.h
+++ b/include/common/fdt_wrappers.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2018-2020, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -20,5 +20,9 @@
 		char *str, size_t size);
 int fdtw_write_inplace_cells(void *dtb, int node, const char *prop,
 		unsigned int cells, void *value);
+int fdtw_read_bytes(const void *dtb, int node, const char *prop,
+		unsigned int length, void *value);
+int fdtw_write_inplace_bytes(void *dtb, int node, const char *prop,
+		unsigned int length, const void *data);
 
 #endif /* FDT_WRAPPERS_H */
diff --git a/lib/romlib/jmptbl.i b/lib/romlib/jmptbl.i
index a7280d0..33710f5 100644
--- a/lib/romlib/jmptbl.i
+++ b/lib/romlib/jmptbl.i
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2018, ARM Limited and Contributors. All rights reserved.
+# Copyright (c) 2018-2020, ARM Limited and Contributors. All rights reserved.
 #
 # SPDX-License-Identifier: BSD-3-Clause
 #
@@ -17,6 +17,7 @@
 fdt	fdt_setprop_inplace
 fdt	fdt_check_header
 fdt	fdt_node_offset_by_compatible
+fdt     fdt_setprop_inplace_namelen_partial
 mbedtls	mbedtls_asn1_get_alg
 mbedtls	mbedtls_asn1_get_alg_null
 mbedtls	mbedtls_asn1_get_bitstring_null
diff --git a/plat/arm/board/fvp/jmptbl.i b/plat/arm/board/fvp/jmptbl.i
index bfa9b56..6ccdd28 100644
--- a/plat/arm/board/fvp/jmptbl.i
+++ b/plat/arm/board/fvp/jmptbl.i
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2018-2019, ARM Limited and Contributors. All rights reserved.
+# Copyright (c) 2018-2020, ARM Limited and Contributors. All rights reserved.
 #
 # SPDX-License-Identifier: BSD-3-Clause
 #
@@ -19,6 +19,7 @@
 fdt     fdt_setprop_inplace
 fdt     fdt_check_header
 fdt     fdt_node_offset_by_compatible
+fdt     fdt_setprop_inplace_namelen_partial
 mbedtls mbedtls_asn1_get_alg
 mbedtls mbedtls_asn1_get_alg_null
 mbedtls mbedtls_asn1_get_bitstring_null
diff --git a/plat/arm/board/juno/jmptbl.i b/plat/arm/board/juno/jmptbl.i
index bfa9b56..6ccdd28 100644
--- a/plat/arm/board/juno/jmptbl.i
+++ b/plat/arm/board/juno/jmptbl.i
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2018-2019, ARM Limited and Contributors. All rights reserved.
+# Copyright (c) 2018-2020, ARM Limited and Contributors. All rights reserved.
 #
 # SPDX-License-Identifier: BSD-3-Clause
 #
@@ -19,6 +19,7 @@
 fdt     fdt_setprop_inplace
 fdt     fdt_check_header
 fdt     fdt_node_offset_by_compatible
+fdt     fdt_setprop_inplace_namelen_partial
 mbedtls mbedtls_asn1_get_alg
 mbedtls mbedtls_asn1_get_alg_null
 mbedtls mbedtls_asn1_get_bitstring_null