diff --git a/patch/fault_inject/ras_ffh_nested.patch b/patch/fault_inject/ras_ffh_nested.patch
new file mode 100644
index 0000000..a7352fd
--- /dev/null
+++ b/patch/fault_inject/ras_ffh_nested.patch
@@ -0,0 +1,56 @@
+diff --git a/bl31/aarch64/runtime_exceptions.S b/bl31/aarch64/runtime_exceptions.S
+index 165058da9..cce9a9029 100644
+--- a/bl31/aarch64/runtime_exceptions.S
++++ b/bl31/aarch64/runtime_exceptions.S
+@@ -228,6 +228,9 @@ vector_entry sync_exception_aarch64
+ 	 */
+ 	save_x30
+ 	apply_at_speculative_wa
++	mrs	x30, scr_el3
++	orr	x30, x30, SCR_EA_BIT
++	msr	scr_el3, x30
+ 	sync_and_handle_pending_serror
+ 	unmask_async_ea
+ 	handle_sync_exception
+diff --git a/services/arm_arch_svc/arm_arch_svc_setup.c b/services/arm_arch_svc/arm_arch_svc_setup.c
+index 57d211ed7..36da3cc1e 100644
+--- a/services/arm_arch_svc/arm_arch_svc_setup.c
++++ b/services/arm_arch_svc/arm_arch_svc_setup.c
+@@ -14,9 +14,37 @@
+ #include <services/arm_arch_svc.h>
+ #include <smccc_helpers.h>
+ #include <plat/common/platform.h>
++#include <context.h>
++#include <lib/el3_runtime/context_mgmt.h>
++
++static void target_ea_to_lower_el(void)
++{
++	u_register_t scr_el3;
++	cpu_context_t *ctx = cm_get_context(NON_SECURE);
++	el3_state_t *el3_ctx = get_el3state_ctx(ctx);
++	scr_el3 = read_ctx_reg(el3_ctx, CTX_SCR_EL3);
++	scr_el3 &= ~SCR_EA_BIT;
++	write_ctx_reg(el3_ctx, CTX_SCR_EL3, scr_el3);
++}
+ 
+ static int32_t smccc_version(void)
+ {
++	/*
++	 * This patch is used in RAS FFH case.
++	 * In RAS FFH case lower EL EAs are routed to EL3 but to do reflection
++	 * of SError tests we need SError to be pended in tftf when SMC call is
++	 * made. Taking an SError depends on PSTATE.A bit of EL but if SCR_EL3.EA
++	 * is set, the SError is immediately taken. So to allow SError to be
++	 * pended in tftf we need to clear SCR_EL3.EA along with PSTATE.A masked
++	 * (which is done in tftf as part of test).
++	 * Since tftf cannot modify SCR_EL3 register, this hack is used in
++	 * SMCCC_VERSION path which tftf calls before running actual test.
++	 *
++	 * We can't directly modify SCR_EL3 and preserve it in context switch that
++	 * is why the context value is modified. The value of SCR_EL3 is modified
++	 * again while exiting EL3 in reflection path.
++	 */
++	target_ea_to_lower_el();
+ 	return MAKE_SMCCC_VERSION(SMCCC_MAJOR_VERSION, SMCCC_MINOR_VERSION);
+ }
+ 
diff --git a/patch/fault_inject/ras_kfh_reflection.patch b/patch/fault_inject/ras_kfh_reflection.patch
new file mode 100644
index 0000000..cf3afea
--- /dev/null
+++ b/patch/fault_inject/ras_kfh_reflection.patch
@@ -0,0 +1,54 @@
+diff --git a/bl31/aarch64/ea_delegate.S b/bl31/aarch64/ea_delegate.S
+index c6790a2f9..c67fa30ee 100644
+--- a/bl31/aarch64/ea_delegate.S
++++ b/bl31/aarch64/ea_delegate.S
+@@ -256,6 +256,14 @@ skip_loop_ctr:
+ 	sub	x28, x28, #4
+ skip_smc_check:
+ 	msr	elr_el3, x28
++	mrs	x30, spsr_el3
++	/* Clear PSTATE.A bit so that tftf can take SError */
++	bic	x30, x30, # (1 << 8)
++	msr	spsr_el3, x30
++	/* Route IRQ to be routed to tftf again */
++	mrs	x30, scr_el3
++	bic	x30, x30, SCR_IRQ_BIT
++	msr	scr_el3, x30
+ 	ldp	x28, x29, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X28]
+ 	ldr	x30, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_LR]
+ 	exception_return
+diff --git a/services/arm_arch_svc/arm_arch_svc_setup.c b/services/arm_arch_svc/arm_arch_svc_setup.c
+index bb042c70e..a4b488005 100644
+--- a/services/arm_arch_svc/arm_arch_svc_setup.c
++++ b/services/arm_arch_svc/arm_arch_svc_setup.c
+@@ -14,9 +14,30 @@
+ #include <services/arm_arch_svc.h>
+ #include <smccc_helpers.h>
+ #include <plat/common/platform.h>
++#include <context.h>
++#include <lib/el3_runtime/context_mgmt.h>
++
++static void modify_scr_el3_irq(void)
++{
++	u_register_t scr_el3;
++	cpu_context_t *ctx = cm_get_context(NON_SECURE);
++	el3_state_t *el3_ctx = get_el3state_ctx(ctx);
++	scr_el3 = read_ctx_reg(el3_ctx, CTX_SCR_EL3);
++	scr_el3 |= SCR_IRQ_BIT;
++	write_ctx_reg(el3_ctx, CTX_SCR_EL3, scr_el3);
++}
+ 
+ static int32_t smccc_version(void)
+ {
++	/*
++	 * This function is called tftf as part of testing SError reflection
++	 * from EL3 to lower EL.
++	 * Temporarily target tftf IRQ to EL3, trigger IRQ in tftf while SError
++	 * is pending which will cause lower EL IRQ handler in EL3, on finding
++	 * a pending SError EL3 will reflect back to tftf also in ret path make
++	 * sure SCR_EL3.IRQ is cleared so that IRQ is now handled in lower EL
++	 */
++	modify_scr_el3_irq();
+ 	return MAKE_SMCCC_VERSION(SMCCC_MAJOR_VERSION, SMCCC_MINOR_VERSION);
+ }
+