diff --git a/drivers/fpga/intel-m10-bmc-sec-update.c b/drivers/fpga/intel-m10-bmc-sec-update.c
index 3bd22d03616a..fa5141f3504b 100644
--- a/drivers/fpga/intel-m10-bmc-sec-update.c
+++ b/drivers/fpga/intel-m10-bmc-sec-update.c
@@ -590,6 +590,9 @@ static const struct platform_device_id intel_m10bmc_sec_ids[] = {
 	{
 		.name = "d5005bmc-sec-update",
 	},
+	{
+		.name = "n6000bmc-sec-update",
+	},
 	{ }
 };
 MODULE_DEVICE_TABLE(platform, intel_m10bmc_sec_ids);
diff --git a/drivers/mfd/intel-m10-bmc-pmci.c b/drivers/mfd/intel-m10-bmc-pmci.c
index 918378a78bdb..84e100283767 100644
--- a/drivers/mfd/intel-m10-bmc-pmci.c
+++ b/drivers/mfd/intel-m10-bmc-pmci.c
@@ -6,9 +6,11 @@
  *
  */
 
+#include <linux/bitfield.h>
 #include <linux/dfl.h>
 #include <linux/mfd/core.h>
 #include <linux/mfd/intel-m10-bmc.h>
+#include <linux/minmax.h>
 #include <linux/module.h>
 #include <linux/regmap.h>
 
@@ -44,10 +46,180 @@
 
 #define PMCI_STAGING_FLASH_COUNT	0x7ff5000
 
+#define PMCI_FLASH_CTRL			0x40
+#define PMCI_FLASH_WR_MODE		BIT(0)
+#define PMCI_FLASH_RD_MODE		BIT(1)
+#define PMCI_FLASH_BUSY			BIT(2)
+#define PMCI_FLASH_FIFO_SPACE		GENMASK(13, 4)
+#define PMCI_FLASH_READ_COUNT		GENMASK(25, 16)
+
+#define PMCI_FLASH_INT_US		1
+#define PMCI_FLASH_TIMEOUT_US		10000
+
+#define PMCI_FLASH_ADDR			0x44
+#define PMCI_FLASH_FIFO			0x800
+#define PMCI_READ_BLOCK_SIZE		0x800
+#define PMCI_FIFO_MAX_BYTES		0x800
+#define PMCI_FIFO_WORD_SIZE		4
+#define PMCI_FIFO_MAX_WORDS		(PMCI_FIFO_MAX_BYTES / PMCI_FIFO_WORD_SIZE)
+
+#define M10BMC_PMCI_FLASH_CTRL	0x1d0
+#define FLASH_MUX_SELECTION	GENMASK(2, 0)
+#define FLASH_MUX_IDLE		0
+#define FLASH_MUX_NIOS		1
+#define FLASH_MUX_HOST		2
+#define FLASH_MUX_PFL		4
+#define get_flash_mux(mux)	FIELD_GET(FLASH_MUX_SELECTION, mux)
+
+#define FLASH_NIOS_REQUEST	BIT(4)
+#define FLASH_HOST_REQUEST	BIT(5)
+
+#define M10_FLASH_INT_US	1
+#define M10_FLASH_TIMEOUT_US	10000
+
 struct pmci_device {
 	void __iomem *base;
 	struct device *dev;
 	struct intel_m10bmc m10bmc;
+	struct mutex flash_mutex;	/* Prevent concurrent flash burst reads */
+};
+
+static void pmci_write_fifo(void __iomem *base, const u32 *buf, size_t count)
+{
+	while (count--)
+		writel(*buf++, base);
+}
+
+static void pmci_read_fifo(void __iomem *base, u32 *buf, size_t count)
+{
+	while (count--)
+		*buf++ = readl(base);
+}
+
+static u32 pmci_get_write_space(struct pmci_device *pmci)
+{
+	u32 val;
+	int ret;
+
+	ret = read_poll_timeout(readl, val,
+				FIELD_GET(PMCI_FLASH_FIFO_SPACE, val) == PMCI_FIFO_MAX_WORDS,
+				PMCI_FLASH_INT_US, PMCI_FLASH_TIMEOUT_US,
+				false, pmci->base + PMCI_FLASH_CTRL);
+	if (ret == -ETIMEDOUT)
+		return 0;
+
+	return FIELD_GET(PMCI_FLASH_FIFO_SPACE, val) * PMCI_FIFO_WORD_SIZE;
+}
+
+static int pmci_flash_bulk_write(struct intel_m10bmc *m10bmc, const u8 *buf, u32 size)
+{
+	struct pmci_device *pmci = container_of(m10bmc, struct pmci_device, m10bmc);
+	u32 blk_size, n_offset = 0, write_count;
+
+	if (!IS_ALIGNED((unsigned long)buf, PMCI_FIFO_WORD_SIZE) ||
+	    !IS_ALIGNED(size, PMCI_FIFO_WORD_SIZE))
+		return -EINVAL;
+
+	while (size) {
+		blk_size = min(pmci_get_write_space(pmci), size);
+		if (blk_size == 0) {
+			dev_err(pmci->dev, "get FIFO available size fail\n");
+			return -EIO;
+		}
+
+		write_count = blk_size / PMCI_FIFO_WORD_SIZE;
+		pmci_write_fifo(pmci->base + PMCI_FLASH_FIFO, (u32 *)(buf + n_offset), write_count);
+
+		size -= blk_size;
+		n_offset += blk_size;
+	}
+
+	return 0;
+}
+
+static int pmci_flash_bulk_read(struct intel_m10bmc *m10bmc, u8 *buf, u32 addr, u32 size)
+{
+	struct pmci_device *pmci = container_of(m10bmc, struct pmci_device, m10bmc);
+	u32 blk_size, offset = 0, val, read_count;
+	int ret;
+
+	if (!IS_ALIGNED(addr, PMCI_FIFO_WORD_SIZE) || !IS_ALIGNED(size, PMCI_FIFO_WORD_SIZE))
+		return -EINVAL;
+
+	while (size) {
+		blk_size = min_t(u32, size, PMCI_READ_BLOCK_SIZE);
+		read_count = blk_size / PMCI_FIFO_WORD_SIZE;
+
+		writel(addr + offset, pmci->base + PMCI_FLASH_ADDR);
+		writel(FIELD_PREP(PMCI_FLASH_READ_COUNT, read_count) | PMCI_FLASH_RD_MODE,
+		       pmci->base + PMCI_FLASH_CTRL);
+
+		ret = readl_poll_timeout((pmci->base + PMCI_FLASH_CTRL), val,
+					 !(val & PMCI_FLASH_BUSY),
+					 PMCI_FLASH_INT_US, PMCI_FLASH_TIMEOUT_US);
+		if (ret) {
+			dev_err(pmci->dev, "read timed out on reading flash 0x%xn", val);
+			return ret;
+		}
+
+		pmci_read_fifo(pmci->base + PMCI_FLASH_FIFO, (u32 *)(buf + offset), read_count);
+
+		size -= blk_size;
+		offset += blk_size;
+
+		writel(0, pmci->base + PMCI_FLASH_CTRL);
+	}
+
+	return 0;
+}
+
+static int m10bmc_pmci_set_flash_host_mux(struct intel_m10bmc *m10bmc, bool request)
+{
+	u32 ctrl;
+	int ret;
+
+	ret = regmap_update_bits(m10bmc->regmap, M10BMC_PMCI_FLASH_CTRL,
+				 FLASH_HOST_REQUEST,
+				 FIELD_PREP(FLASH_HOST_REQUEST, request));
+	if (ret)
+		return ret;
+
+	return regmap_read_poll_timeout(m10bmc->regmap,
+					M10BMC_PMCI_FLASH_CTRL, ctrl,
+					request ? (get_flash_mux(ctrl) == FLASH_MUX_HOST) :
+						  (get_flash_mux(ctrl) != FLASH_MUX_HOST),
+					M10_FLASH_INT_US, M10_FLASH_TIMEOUT_US);
+}
+
+static int m10bmc_pmci_flash_write(struct intel_m10bmc *m10bmc, const u8 *buf, u32 offset, u32 size)
+{
+	return pmci_flash_bulk_write(m10bmc, buf + offset, size);
+}
+
+static int m10bmc_pmci_flash_read(struct intel_m10bmc *m10bmc, u8 *buf, u32 addr, u32 size)
+{
+	struct pmci_device *pmci = container_of(m10bmc, struct pmci_device, m10bmc);
+	int ret, ret2;
+
+	mutex_lock(&pmci->flash_mutex);
+	ret = m10bmc_pmci_set_flash_host_mux(m10bmc, true);
+	if (ret)
+		goto read_fail;
+
+	ret = pmci_flash_bulk_read(m10bmc, buf, addr, size);
+
+read_fail:
+	ret2 = m10bmc_pmci_set_flash_host_mux(m10bmc, false);
+	mutex_unlock(&pmci->flash_mutex);
+
+	if (ret)
+		return ret;
+	return ret2;
+}
+
+static const struct intel_m10bmc_flash_ops m10bmc_pmci_flash_ops = {
+	.read = m10bmc_pmci_flash_read,
+	.write = m10bmc_pmci_flash_write,
 };
 
 static const struct regmap_range m10bmc_pmci_regmap_range[] = {
@@ -75,6 +247,7 @@ static struct regmap_config m10bmc_pmci_regmap_config = {
 
 static struct mfd_cell m10bmc_n6000_bmc_subdevs[] = {
 	{ .name = "n6000bmc-hwmon" },
+	{ .name = "n6000bmc-sec-update" },
 };
 
 static const struct m10bmc_csr_map m10bmc_pmci_csr_map = {
@@ -113,6 +286,9 @@ static int pmci_probe(struct dfl_device *ddev)
 	if (!pmci)
 		return -ENOMEM;
 
+	mutex_init(&pmci->flash_mutex);
+	pmci->m10bmc.flash_ops = &m10bmc_pmci_flash_ops;
+
 	pmci->m10bmc.dev = dev;
 	pmci->dev = dev;
 
@@ -130,6 +306,14 @@ static int pmci_probe(struct dfl_device *ddev)
 	return m10bmc_dev_init(&pmci->m10bmc, &m10bmc_m10_n6000);
 }
 
+static void pmci_remove(struct dfl_device *ddev)
+{
+	struct intel_m10bmc *m10bmc = dev_get_drvdata(&ddev->dev);
+	struct pmci_device *pmci = container_of(m10bmc, struct pmci_device, m10bmc);
+
+	mutex_destroy(&pmci->flash_mutex);
+}
+
 #define FME_FEATURE_ID_PMCI_BMC	0x12
 
 static const struct dfl_device_id pmci_ids[] = {
@@ -145,6 +329,7 @@ static struct dfl_driver pmci_driver = {
 	},
 	.id_table = pmci_ids,
 	.probe    = pmci_probe,
+	.remove   = pmci_remove,
 };
 
 module_dfl_driver(pmci_driver);
