Merge pull request #735 from soby-mathew/sm/aarch32_sctlr

Unify SCTLR initialization for AArch32 normal world
diff --git a/Makefile b/Makefile
index 2b630b3..b73a4dd 100644
--- a/Makefile
+++ b/Makefile
@@ -32,7 +32,7 @@
 # Trusted Firmware Version
 #
 VERSION_MAJOR			:= 1
-VERSION_MINOR			:= 2
+VERSION_MINOR			:= 3
 
 # Default goal is build all images
 .DEFAULT_GOAL			:= all
@@ -117,6 +117,12 @@
 SEPARATE_CODE_AND_RODATA	:= 0
 # Flag to enable new version of image loading
 LOAD_IMAGE_V2		:= 0
+# Flag to enable runtime instrumentation using PMF
+ENABLE_RUNTIME_INSTRUMENTATION	:= 0
+
+ifeq (${ENABLE_RUNTIME_INSTRUMENTATION}, 1)
+ENABLE_PMF			:= 1
+endif
 
 ################################################################################
 # Checkpatch script options
@@ -466,6 +472,7 @@
 $(eval $(call assert_boolean,ENABLE_PSCI_STAT))
 $(eval $(call assert_boolean,SEPARATE_CODE_AND_RODATA))
 $(eval $(call assert_boolean,LOAD_IMAGE_V2))
+$(eval $(call assert_boolean,ENABLE_RUNTIME_INSTRUMENTATION))
 
 
 ################################################################################
@@ -497,6 +504,7 @@
 $(eval $(call add_define,ENABLE_PSCI_STAT))
 $(eval $(call add_define,SEPARATE_CODE_AND_RODATA))
 $(eval $(call add_define,LOAD_IMAGE_V2))
+$(eval $(call add_define,ENABLE_RUNTIME_INSTRUMENTATION))
 # Define the EL3_PAYLOAD_BASE flag only if it is provided.
 ifdef EL3_PAYLOAD_BASE
         $(eval $(call add_define,EL3_PAYLOAD_BASE))
@@ -743,7 +751,7 @@
 	@echo "  cscope         Generate cscope index"
 	@echo "  distclean      Remove all build artifacts for all platforms"
 	@echo "  certtool       Build the Certificate generation tool"
-	@echo "  fiptool        Build the Firmware Image Package(FIP) creation tool"
+	@echo "  fiptool        Build the Firmware Image Package (FIP) creation tool"
 	@echo ""
 	@echo "Note: most build targets require PLAT to be set to a specific platform."
 	@echo ""
diff --git a/bl31/aarch64/bl31_entrypoint.S b/bl31/aarch64/bl31_entrypoint.S
index 4c3a515..d14a68d 100644
--- a/bl31/aarch64/bl31_entrypoint.S
+++ b/bl31/aarch64/bl31_entrypoint.S
@@ -31,6 +31,8 @@
 #include <arch.h>
 #include <bl_common.h>
 #include <el3_common_macros.S>
+#include <pmf_asm_macros.S>
+#include <runtime_instr.h>
 #include <xlat_tables.h>
 
 	.globl	bl31_entrypoint
@@ -141,6 +143,18 @@
 	 * --------------------------------------------------------------------
 	 */
 func bl31_warm_entrypoint
+#if ENABLE_RUNTIME_INSTRUMENTATION
+
+	/*
+	 * This timestamp update happens with cache off.  The next
+	 * timestamp collection will need to do cache maintenance prior
+	 * to timestamp update.
+	 */
+	pmf_calc_timestamp_addr rt_instr_svc RT_INSTR_EXIT_HW_LOW_PWR
+	mrs	x1, cntpct_el0
+	str	x1, [x0]
+#endif
+
 	/*
 	 * On the warm boot path, most of the EL3 initialisations performed by
 	 * 'el3_entrypoint_common' must be skipped:
@@ -188,5 +202,23 @@
 
 	bl	psci_warmboot_entrypoint
 
+#if ENABLE_RUNTIME_INSTRUMENTATION
+	pmf_calc_timestamp_addr rt_instr_svc RT_INSTR_EXIT_PSCI
+	mov	x19, x0
+
+	/*
+	 * Invalidate before updating timestamp to ensure previous timestamp
+	 * updates on the same cache line with caches disabled are properly
+	 * seen by the same core. Without the cache invalidate, the core might
+	 * write into a stale cache line.
+	 */
+	mov	x1, #PMF_TS_SIZE
+	mov	x20, x30
+	bl	inv_dcache_range
+	mov	x30, x20
+
+	mrs	x0, cntpct_el0
+	str	x0, [x19]
+#endif
 	b	el3_exit
 endfunc bl31_warm_entrypoint
diff --git a/bl31/aarch64/runtime_exceptions.S b/bl31/aarch64/runtime_exceptions.S
index 799062e..f333bf1 100644
--- a/bl31/aarch64/runtime_exceptions.S
+++ b/bl31/aarch64/runtime_exceptions.S
@@ -31,6 +31,7 @@
 #include <arch.h>
 #include <asm_macros.S>
 #include <context.h>
+#include <cpu_data.h>
 #include <interrupt_mgmt.h>
 #include <platform_def.h>
 #include <runtime_svc.h>
@@ -47,6 +48,21 @@
 	msr	daifclr, #DAIF_ABT_BIT
 
 	str	x30, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_LR]
+
+#if ENABLE_RUNTIME_INSTRUMENTATION
+
+	/*
+	 * Read the timestamp value and store it in per-cpu data.
+	 * The value will be extracted from per-cpu data by the
+	 * C level SMC handler and saved to the PMF timestamp region.
+	 */
+	mrs	x30, cntpct_el0
+	str	x29, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X29]
+	mrs	x29, tpidr_el3
+	str	x30, [x29, #CPU_DATA_PMF_TS0_OFFSET]
+	ldr	x29, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X29]
+#endif
+
 	mrs	x30, esr_el3
 	ubfx	x30, x30, #ESR_EC_SHIFT, #ESR_EC_LENGTH
 
diff --git a/bl31/bl31_main.c b/bl31/bl31_main.c
index fae5ee4..85b3ea1 100644
--- a/bl31/bl31_main.c
+++ b/bl31/bl31_main.c
@@ -36,9 +36,16 @@
 #include <context_mgmt.h>
 #include <debug.h>
 #include <platform.h>
+#include <pmf.h>
+#include <runtime_instr.h>
 #include <runtime_svc.h>
 #include <string.h>
 
+#if ENABLE_RUNTIME_INSTRUMENTATION
+PMF_REGISTER_SERVICE_SMC(rt_instr_svc, PMF_RT_INSTR_SVC_ID,
+	RT_INSTR_TOTAL_IDS, PMF_STORE_ENABLE)
+#endif
+
 /*******************************************************************************
  * This function pointer is used to initialise the BL32 image. It's initialized
  * by SPD calling bl31_register_bl32_init after setting up all things necessary
diff --git a/docs/change-log.md b/docs/change-log.md
index 627b1c2..74edf98 100644
--- a/docs/change-log.md
+++ b/docs/change-log.md
@@ -1,3 +1,229 @@
+
+ARM Trusted Firmware - version 1.3
+==================================
+
+New features
+------------
+
+*   Added support for running Trusted Firmware in AArch32 execution state.
+
+    The PSCI library has been refactored to allow integration with **EL3 Runtime
+    Software**. This is software that is executing at the highest secure
+    privilege which is EL3 in AArch64 or Secure SVC/Monitor mode in AArch32. See
+    [PSCI Integration Guide].
+
+    Included is a minimal AArch32 Secure Payload, **SP-MIN**, that illustrates
+    the usage and integration of the PSCI library with EL3 Runtime Software
+    running in AArch32 state.
+
+    Booting to the BL1/BL2 images as well as booting straight to the Secure
+    Payload is supported.
+
+*   Improvements to the initialization framework for the PSCI service and ARM
+    Standard Services in general.
+
+    The PSCI service is now initialized as part of ARM Standard Service
+    initialization. This consolidates the initializations of any ARM Standard
+    Service that may be added in the future.
+
+    A new function `get_arm_std_svc_args()` is introduced to get arguments
+    corresponding to each standard service and must be implemented by the EL3
+    Runtime Software.
+
+    For PSCI, a new versioned structure `psci_lib_args_t` is introduced to
+    initialize the PSCI Library. **Note** this is a compatibility break due to
+    the change in the prototype of `psci_setup()`.
+
+*   To support AArch32 builds of BL1 and BL2, implemented a new, alternative
+    firmware image loading mechanism that adds flexibility.
+
+    The current mechanism has a hard-coded set of images and execution order
+    (BL31, BL32, etc). The new mechanism is data-driven by a list of image
+    descriptors provided by the platform code.
+
+    ARM platforms have been updated to support the new loading mechanism.
+
+    The new mechanism is enabled by a build flag (`LOAD_IMAGE_V2`) which is
+    currently off by default for the AArch64 build.
+
+    **Note** `TRUSTED_BOARD_BOOT` is currently not supported when
+    `LOAD_IMAGE_V2` is enabled.
+
+*   Updated requirements for making contributions to ARM TF.
+
+    Commits now must have a 'Signed-off-by:' field to certify that the
+    contribution has been made under the terms of the
+    [Developer Certificate of Origin].
+
+    A signed CLA is no longer required.
+
+    The [Contribution Guide] has been updated to reflect this change.
+
+*   Introduced Performance Measurement Framework (PMF) which provides support
+    for capturing, storing, dumping and retrieving time-stamps to measure the
+    execution time of critical paths in the firmware. This relies on defining
+    fixed sample points at key places in the code.
+
+*   To support the QEMU platform port, imported libfdt v1.4.1 from
+    https://git.kernel.org/cgit/utils/dtc/dtc.git
+
+*   Updated PSCI support:
+
+    *   Added support for PSCI NODE_HW_STATE API for ARM platforms.
+
+    *   New optional platform hook, `pwr_domain_pwr_down_wfi()`, in
+        `plat_psci_ops` to enable platforms to perform platform-specific actions
+        needed to enter powerdown, including the 'wfi' invocation.
+
+    *   PSCI STAT residency and count functions have been added on ARM platforms
+        by using PMF.
+
+*   Enhancements to the translation table library:
+
+    *   Limited memory mapping support for region overlaps to only allow regions
+        to overlap that are identity mapped or have the same virtual to physical
+        address offset, and overlap completely but must not cover the same area.
+
+        This limitation will enable future enhancements without having to
+        support complex edge cases that may not be necessary.
+
+    *   The initial translation lookup level is now inferred from the virtual
+        address space size. Previously, it was hard-coded.
+
+    *   Added support for mapping Normal, Inner Non-cacheable, Outer
+        Non-cacheable memory in the translation table library.
+
+        This can be useful to map a non-cacheable memory region, such as a DMA
+        buffer.
+
+    *   Introduced the MT_EXECUTE/MT_EXECUTE_NEVER memory mapping attributes to
+        specify the access permissions for instruction execution of a memory
+        region.
+
+*   Enabled support to isolate code and read-only data on separate memory pages,
+    allowing independent access control to be applied to each.
+
+*   Enabled SCR_EL3.SIF (Secure Instruction Fetch) bit in BL1 and BL31 common
+    architectural setup code, preventing fetching instructions from non-secure
+    memory when in secure state.
+
+*   Enhancements to FIP support:
+
+    *   Replaced `fip_create` with `fiptool` which provides a more consistent
+        and intuitive interface as well as additional support to remove an image
+        from a FIP file.
+
+    *   Enabled printing the SHA256 digest with info command, allowing quick
+        verification of an image within a FIP without having to extract the
+        image and running sha256sum on it.
+
+    *   Added support for unpacking the contents of an existing FIP file into
+        the working directory.
+
+    *   Aligned command line options for specifying images to use same naming
+        convention as specified by TBBR and already used in cert_create tool.
+
+*   Refactored the TZC-400 driver to also support memory controllers that
+    integrate TZC functionality, for example ARM CoreLink DMC-500. Also added
+    DMC-500 specific support.
+
+*   Implemented generic delay timer based on the system generic counter and
+    migrated all platforms to use it.
+
+*   Enhanced support for ARM platforms:
+
+    *   Updated image loading support to make SCP images (SCP_BL2 and SCP_BL2U)
+        optional.
+
+    *   Enhanced topology description support to allow multi-cluster topology
+        definitions.
+
+    *   Added interconnect abstraction layer to help platform ports select the
+        right interconnect driver, CCI or CCN, for the platform.
+
+    *   Added support to allow loading BL31 in the TZC-secured DRAM instead of
+        the default secure SRAM.
+
+    *   Added support to use a System Security Control (SSC) Registers Unit
+        enabling ARM TF to be compiled to support multiple ARM platforms and
+        then select one at runtime.
+
+    *   Restricted mapping of Trusted ROM in BL1 to what is actually needed by
+        BL1 rather than entire Trusted ROM region.
+
+    *   Flash is now mapped as execute-never by default. This increases security
+        by restricting the executable region to what is strictly needed.
+
+*   Applied following erratum workarounds for Cortex-A57: 833471, 826977,
+    829520, 828024 and 826974.
+
+*   Added support for Mediatek MT6795 platform.
+
+*   Added support for QEMU virtualization ARMv8-A target.
+
+*   Added support for Rockchip RK3368 and RK3399 platforms.
+
+*   Added support for Xilinx Zynq UltraScale+ MPSoC platform.
+
+*   Added support for ARM Cortex-A73 MPCore Processor.
+
+*   Added support for ARM Cortex-A72 processor.
+
+*   Added support for ARM Cortex-A35 processor.
+
+*   Added support for ARM Cortex-A32 MPCore Processor.
+
+*   Enabled preloaded BL33 alternative boot flow, in which BL2 does not load
+    BL33 from non-volatile storage and BL31 hands execution over to a preloaded
+    BL33. The User Guide has been updated with an example of how to use this
+    option with a bootwrapped kernel.
+
+*   Added support to build ARM TF on a Windows-based host machine.
+
+*   Updated Trusted Board Boot prototype implementation:
+
+    *   Enabled the ability for a production ROM with TBBR enabled to boot test
+        software before a real ROTPK is deployed (e.g. manufacturing mode).
+        Added support to use ROTPK in certificate without verifying against the
+        platform value when `ROTPK_NOT_DEPLOYED` bit is set.
+
+    *   Added support for non-volatile counter authentication to the
+        Authentication Module to protect against roll-back.
+
+*   Updated GICv3 support:
+
+    *   Enabled processor power-down and automatic power-on using GICv3.
+
+    *   Enabled G1S or G0 interrupts to be configured independently.
+
+    *   Changed FVP default interrupt driver to be the GICv3-only driver.
+        **Note** the default build of Trusted Firmware will not be able to boot
+        Linux kernel with GICv2 FDT blob.
+
+    *   Enabled wake-up from CPU_SUSPEND to stand-by by temporarily re-routing
+        interrupts and then restoring after resume.
+
+Issues resolved since last release
+----------------------------------
+
+Known issues
+------------
+
+*   The version of the AEMv8 Base FVP used in this release resets the model
+    instead of terminating its execution in response to a shutdown request using
+    the PSCI `SYSTEM_OFF` API. This issue will be fixed in a future version of
+    the model.
+
+*   Building TF with compiler optimisations disabled (`-O0`) fails.
+
+
+*   ARM TF cannot be built with mbed TLS version v2.3.0 due to build warnings
+    that the ARM TF build system interprets as errors.
+
+*   TBBR is not currently supported when running Trusted Firmware in AArch32
+    state.
+
+
 ARM Trusted Firmware - version 1.2
 ==================================
 
@@ -860,7 +1086,7 @@
 
 - - - - - - - - - - - - - - - - - - - - - - - - - -
 
-_Copyright (c) 2013-2015, ARM Limited and Contributors. All rights reserved._
+_Copyright (c) 2013-2016, ARM Limited and Contributors. All rights reserved._
 
 [OP-TEE Dispatcher]:                  optee-dispatcher.md
 [Power Domain Topology Design]:       psci-pd-tree.md
@@ -868,3 +1094,10 @@
 [Authentication Framework]:           auth-framework.md
 [Firmware Update]:                    firmware-update.md
 [TF Reset Design]:                    reset-design.md
+[PSCI Integration Guide]:             psci-lib-integration-guide.md
+[Firmware Design]:                    firmware-design.md
+[CPU Specific Build Macros]:          cpu-specific-build-macros.md
+[User Guide]:                         user-guide.md
+[Porting Guide]:                      porting-guide.md
+[Developer Certificate of Origin]:    ../dco.txt
+[Contribution Guide]:                 ../contributing.md
diff --git a/docs/user-guide.md b/docs/user-guide.md
index 55571b4..5b73b66 100644
--- a/docs/user-guide.md
+++ b/docs/user-guide.md
@@ -116,11 +116,7 @@
         "Summary of build options" for more information on available build
         options.
 
-    *   (AArch32 only) Currently only `PLAT=fvp` is supported. Please note that
-        AArch32 support for Normal world boot loader (BL33), like U-boot or
-        UEFI, on FVP is not available upstream. Hence custom solutions are
-        required to allow Linux boot on FVP. The build instructions below
-        assume such a custom boot loader (BL33) is available.
+    *   (AArch32 only) Currently only `PLAT=fvp` is supported.
 
     *   (AArch32 only) `AARCH32_SP` is the AArch32 EL3 Runtime Software and it
         corresponds to the BL32 image. A minimal `AARCH32_SP`, sp_min, is
@@ -632,7 +628,7 @@
 
 An additional boot loader binary file is created in the `build` directory:
 
-    `build/<platform>/<build-type>/bl32.bin`
+    build/<platform>/<build-type>/bl32.bin
 
 ### Checking source code style
 
@@ -667,14 +663,26 @@
 (e.g. UEFI or U-Boot).
 
 The TF build system provides the make target `fip` to create a FIP file for the
-specified platform using the FIP creation tool included in the TF project. For
-example, to build a FIP file for FVP, packaging TF images and a BL33 image:
+specified platform using the FIP creation tool included in the TF project.
+Examples below show how to build a FIP file for FVP, packaging TF images and a
+BL33 image.
+
+For AArch64:
 
     make PLAT=fvp BL33=<path/to/bl33.bin> fip
 
+For AArch32:
+
+    make PLAT=fvp ARCH=aarch32 AARCH32_SP=sp_min BL33=<path/to/bl33.bin> fip
+
+Note that AArch32 support for Normal world boot loader (BL33), like U-boot or
+UEFI, on FVP is not available upstream. Hence custom solutions are required to
+allow Linux boot on FVP. These instructions assume such a custom boot loader
+(BL33) is available.
+
 The resulting FIP may be found in:
 
-    `build/fvp/<build-type>/fip.bin`
+    build/fvp/<build-type>/fip.bin
 
 For advanced operations on FIP files, it is also possible to independently build
 the tool and create or modify FIPs using this tool. To do this, follow these
@@ -863,6 +871,9 @@
 a single FIP binary. It assumes that a [Linaro Release][Linaro Release Notes]
 has been installed.
 
+Note currently [Linaro Release][Linaro Release Notes] only includes pre-built
+binaries for AArch64. For AArch32, pre-built binaries are not available.
+
 Note: follow the full instructions for one platform before switching to a
 different one. Mixing instructions for different platforms may result in
 corrupted binaries.
@@ -891,14 +902,20 @@
     exist in the current directory. If that is the case, either delete those
     files or use the `--force` option to overwrite.
 
+    Note for AArch32, the instructions below assume that nt-fw.bin is a custom
+    Normal world boot loader that supports AArch32.
+
 3.  Build TF images and create a new FIP
 
         # Juno
         make PLAT=juno SCP_BL2=scp-fw.bin BL33=nt-fw.bin all fip
 
-        # FVP
+        # FVP AArch64
         make PLAT=fvp BL33=nt-fw.bin all fip
 
+        # FVP AArch32
+        make PLAT=fvp ARCH=aarch32 AARCH32_SP=sp_min BL33=nt-fw.bin all fip
+
 The resulting BL1 and FIP images may be found in:
 
     # Juno
diff --git a/include/lib/el3_runtime/cpu_data.h b/include/lib/el3_runtime/cpu_data.h
index 910b153..3b00a5e 100644
--- a/include/lib/el3_runtime/cpu_data.h
+++ b/include/lib/el3_runtime/cpu_data.h
@@ -50,10 +50,20 @@
 
 #if CRASH_REPORTING
 #define CPU_DATA_LOG2SIZE		7
+#define CPU_DATA_CRASH_BUF_END		(CPU_DATA_CRASH_BUF_OFFSET + \
+						CPU_DATA_CRASH_BUF_SIZE)
 #else
 #define CPU_DATA_LOG2SIZE		6
+#define CPU_DATA_CRASH_BUF_END		CPU_DATA_CRASH_BUF_OFFSET
 #endif
 
+#if ENABLE_RUNTIME_INSTRUMENTATION
+/* Temporary space to store PMF timestamps from assembly code */
+#define CPU_DATA_PMF_TS_COUNT		1
+#define CPU_DATA_PMF_TS0_OFFSET		CPU_DATA_CRASH_BUF_END
+#define CPU_DATA_PMF_TS0_IDX		0
+#endif
+
 #ifndef __ASSEMBLY__
 
 #include <arch_helpers.h>
@@ -96,6 +106,9 @@
 #if CRASH_REPORTING
 	u_register_t crash_buf[CPU_DATA_CRASH_BUF_SIZE >> 3];
 #endif
+#if ENABLE_RUNTIME_INSTRUMENTATION
+	uint64_t cpu_data_pmf_ts[CPU_DATA_PMF_TS_COUNT];
+#endif
 	struct psci_cpu_data psci_svc_cpu_data;
 #if PLAT_PCPU_DATA_SIZE
 	uint8_t platform_cpu_data[PLAT_PCPU_DATA_SIZE];
@@ -116,6 +129,12 @@
 		(cpu_data_t, cpu_ops_ptr),
 		assert_cpu_data_cpu_ops_ptr_offset_mismatch);
 
+#if ENABLE_RUNTIME_INSTRUMENTATION
+CASSERT(CPU_DATA_PMF_TS0_OFFSET == __builtin_offsetof
+		(cpu_data_t, cpu_data_pmf_ts[0]),
+		assert_cpu_data_pmf_ts0_offset_mismatch);
+#endif
+
 struct cpu_data *_cpu_data_by_index(uint32_t cpu_index);
 
 #ifndef AARCH32
diff --git a/include/lib/pmf/pmf.h b/include/lib/pmf/pmf.h
index 5f953b5..7c33387 100644
--- a/include/lib/pmf/pmf.h
+++ b/include/lib/pmf/pmf.h
@@ -75,6 +75,7 @@
 
 /* Following are the supported PMF service IDs */
 #define PMF_PSCI_STAT_SVC_ID	0
+#define PMF_RT_INSTR_SVC_ID	1
 
 #if ENABLE_PMF
 /*
diff --git a/include/lib/pmf/pmf_helpers.h b/include/lib/pmf/pmf_helpers.h
index bb4242c..e7fd275 100644
--- a/include/lib/pmf/pmf_helpers.h
+++ b/include/lib/pmf/pmf_helpers.h
@@ -33,6 +33,7 @@
 
 #include <arch_helpers.h>
 #include <assert.h>
+#include <bl_common.h>
 #include <platform.h>
 #include <pmf.h>
 #include <stdint.h>
diff --git a/include/lib/runtime_instr.h b/include/lib/runtime_instr.h
new file mode 100644
index 0000000..d409002
--- /dev/null
+++ b/include/lib/runtime_instr.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2016, ARM Limited and Contributors. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of ARM nor the names of its contributors may be used
+ * to endorse or promote products derived from this software without specific
+ * prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __RUNTIME_INSTR_H__
+#define __RUNTIME_INSTR_H__
+
+#define RT_INSTR_TOTAL_IDS		4
+#define RT_INSTR_ENTER_PSCI		0
+#define RT_INSTR_EXIT_PSCI		1
+#define RT_INSTR_ENTER_HW_LOW_PWR	2
+#define RT_INSTR_EXIT_HW_LOW_PWR	3
+
+#ifndef __ASSEMBLY__
+PMF_DECLARE_CAPTURE_TIMESTAMP(rt_instr_svc)
+PMF_DECLARE_GET_TIMESTAMP(rt_instr_svc)
+#endif /* __ASSEMBLY__ */
+
+#endif /* __RUNTIME_INSTR_H__ */
diff --git a/include/lib/stdlib/sys/uuid.h b/include/lib/stdlib/sys/uuid.h
index 5c4767b..d43b641 100644
--- a/include/lib/stdlib/sys/uuid.h
+++ b/include/lib/stdlib/sys/uuid.h
@@ -34,8 +34,6 @@
 #ifndef _SYS_UUID_H_
 #define _SYS_UUID_H_
 
-#include <sys/cdefs.h>
-
 /* Length of a node address (an IEEE 802 address). */
 #define	_UUID_NODE_LEN		6
 
diff --git a/include/plat/arm/common/arm_sip_svc.h b/include/plat/arm/common/arm_sip_svc.h
new file mode 100644
index 0000000..640bbaf
--- /dev/null
+++ b/include/plat/arm/common/arm_sip_svc.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2016, ARM Limited and Contributors. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of ARM nor the names of its contributors may be used
+ * to endorse or promote products derived from this software without specific
+ * prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __ARM_SIP_SVC_H__
+#define __ARM_SIP_SVC_H__
+
+/* SMC function IDs for SiP Service queries */
+
+#define ARM_SIP_SVC_CALL_COUNT		0x8200ff00
+#define ARM_SIP_SVC_UID			0x8200ff01
+/*					0x8200ff02 is reserved */
+#define ARM_SIP_SVC_VERSION		0x8200ff03
+
+/* ARM SiP Service Calls version numbers */
+#define ARM_SIP_SVC_VERSION_MAJOR		0x0
+#define ARM_SIP_SVC_VERSION_MINOR		0x1
+
+#endif /* __ARM_SIP_SVC_H__ */
diff --git a/lib/psci/psci_main.c b/lib/psci/psci_main.c
index 23bd106..0a3a60a 100644
--- a/lib/psci/psci_main.c
+++ b/lib/psci/psci_main.c
@@ -33,6 +33,8 @@
 #include <assert.h>
 #include <debug.h>
 #include <platform.h>
+#include <pmf.h>
+#include <runtime_instr.h>
 #include <smcc.h>
 #include <string.h>
 #include "psci_private.h"
@@ -124,11 +126,23 @@
 			PMF_NO_CACHE_MAINT);
 #endif
 
+#if ENABLE_RUNTIME_INSTRUMENTATION
+		PMF_CAPTURE_TIMESTAMP(rt_instr_svc,
+		    RT_INSTR_ENTER_HW_LOW_PWR,
+		    PMF_NO_CACHE_MAINT);
+#endif
+
 		psci_plat_pm_ops->cpu_standby(cpu_pd_state);
 
 		/* Upon exit from standby, set the state back to RUN. */
 		psci_set_cpu_local_state(PSCI_LOCAL_STATE_RUN);
 
+#if ENABLE_RUNTIME_INSTRUMENTATION
+		PMF_CAPTURE_TIMESTAMP(rt_instr_svc,
+		    RT_INSTR_EXIT_HW_LOW_PWR,
+		    PMF_NO_CACHE_MAINT);
+#endif
+
 #if ENABLE_PSCI_STAT
 		/* Capture time-stamp after CPU standby */
 		PMF_CAPTURE_TIMESTAMP(psci_svc, PSCI_STAT_ID_EXIT_LOW_PWR,
diff --git a/lib/psci/psci_off.c b/lib/psci/psci_off.c
index 471141d..1cc6ede 100644
--- a/lib/psci/psci_off.c
+++ b/lib/psci/psci_off.c
@@ -33,6 +33,8 @@
 #include <assert.h>
 #include <debug.h>
 #include <platform.h>
+#include <pmf.h>
+#include <runtime_instr.h>
 #include <string.h>
 #include "psci_private.h"
 
@@ -153,6 +155,19 @@
 		dsbish();
 		inv_cpu_data(psci_svc_cpu_data.aff_info_state);
 
+#if ENABLE_RUNTIME_INSTRUMENTATION
+
+		/*
+		 * Update the timestamp with cache off.  We assume this
+		 * timestamp can only be read from the current CPU and the
+		 * timestamp cache line will be flushed before return to
+		 * normal world on wakeup.
+		 */
+		PMF_CAPTURE_TIMESTAMP(rt_instr_svc,
+		    RT_INSTR_ENTER_HW_LOW_PWR,
+		    PMF_NO_CACHE_MAINT);
+#endif
+
 		if (psci_plat_pm_ops->pwr_domain_pwr_down_wfi) {
 			/* This function must not return */
 			psci_plat_pm_ops->pwr_domain_pwr_down_wfi(&state_info);
diff --git a/lib/psci/psci_suspend.c b/lib/psci/psci_suspend.c
index 0887e3b..10d2481 100644
--- a/lib/psci/psci_suspend.c
+++ b/lib/psci/psci_suspend.c
@@ -37,6 +37,8 @@
 #include <cpu_data.h>
 #include <debug.h>
 #include <platform.h>
+#include <pmf.h>
+#include <runtime_instr.h>
 #include <stddef.h>
 #include "psci_private.h"
 
@@ -212,6 +214,19 @@
 		return;
 
 	if (is_power_down_state) {
+#if ENABLE_RUNTIME_INSTRUMENTATION
+
+		/*
+		 * Update the timestamp with cache off.  We assume this
+		 * timestamp can only be read from the current CPU and the
+		 * timestamp cache line will be flushed before return to
+		 * normal world on wakeup.
+		 */
+		PMF_CAPTURE_TIMESTAMP(rt_instr_svc,
+		    RT_INSTR_ENTER_HW_LOW_PWR,
+		    PMF_NO_CACHE_MAINT);
+#endif
+
 		/* The function calls below must not return */
 		if (psci_plat_pm_ops->pwr_domain_pwr_down_wfi)
 			psci_plat_pm_ops->pwr_domain_pwr_down_wfi(state_info);
@@ -219,6 +234,12 @@
 			psci_power_down_wfi();
 	}
 
+#if ENABLE_RUNTIME_INSTRUMENTATION
+	PMF_CAPTURE_TIMESTAMP(rt_instr_svc,
+	    RT_INSTR_ENTER_HW_LOW_PWR,
+	    PMF_NO_CACHE_MAINT);
+#endif
+
 	/*
 	 * We will reach here if only retention/standby states have been
 	 * requested at multiple power levels. This means that the cpu
@@ -226,6 +247,12 @@
 	 */
 	wfi();
 
+#if ENABLE_RUNTIME_INSTRUMENTATION
+	PMF_CAPTURE_TIMESTAMP(rt_instr_svc,
+	    RT_INSTR_EXIT_HW_LOW_PWR,
+	    PMF_NO_CACHE_MAINT);
+#endif
+
 	/*
 	 * After we wake up from context retaining suspend, call the
 	 * context retaining suspend finisher.
diff --git a/plat/arm/common/arm_common.mk b/plat/arm/common/arm_common.mk
index 98d7219..8f8d3fd 100644
--- a/plat/arm/common/arm_common.mk
+++ b/plat/arm/common/arm_common.mk
@@ -144,6 +144,11 @@
 				plat/common/aarch64/platform_mp_stack.S		\
 				plat/common/plat_psci_common.c
 
+ifeq (${ENABLE_PMF}, 1)
+BL31_SOURCES		+=	plat/arm/common/arm_sip_svc.c			\
+				lib/pmf/pmf_smc.c
+endif
+
 ifneq (${TRUSTED_BOARD_BOOT},0)
 
     # By default, ARM platforms use RSA keys
diff --git a/plat/arm/common/arm_sip_svc.c b/plat/arm/common/arm_sip_svc.c
new file mode 100644
index 0000000..eb8ec9e
--- /dev/null
+++ b/plat/arm/common/arm_sip_svc.c
@@ -0,0 +1,104 @@
+/*
+ * Copyright (c) 2016, ARM Limited and Contributors. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of ARM nor the names of its contributors may be used
+ * to endorse or promote products derived from this software without specific
+ * prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <arm_sip_svc.h>
+#include <debug.h>
+#include <pmf.h>
+#include <runtime_svc.h>
+#include <stdint.h>
+#include <uuid.h>
+
+
+/* ARM SiP Service UUID */
+DEFINE_SVC_UUID(arm_sip_svc_uid,
+		0xe2756d55, 0x3360, 0x4bb5, 0xbf, 0xf3,
+		0x62, 0x79, 0xfd, 0x11, 0x37, 0xff);
+
+static int arm_sip_setup(void)
+{
+	if (pmf_setup() != 0)
+		return 1;
+	return 0;
+}
+
+/*
+ * This function handles ARM defined SiP Calls
+ */
+static uintptr_t arm_sip_handler(unsigned int smc_fid,
+			u_register_t x1,
+			u_register_t x2,
+			u_register_t x3,
+			u_register_t x4,
+			void *cookie,
+			void *handle,
+			u_register_t flags)
+{
+	/*
+	 * Dispatch PMF calls to PMF SMC handler and return its return
+	 * value
+	 */
+	if (is_pmf_fid(smc_fid)) {
+		return pmf_smc_handler(smc_fid, x1, x2, x3, x4, cookie,
+				handle, flags);
+	}
+
+	switch (smc_fid) {
+	case ARM_SIP_SVC_CALL_COUNT:
+		/*
+		 * Return the number of SiP Service Calls. PMF is the only
+		 * SiP service implemented; so return number of PMF calls
+		 */
+		SMC_RET1(handle, PMF_NUM_SMC_CALLS);
+
+	case ARM_SIP_SVC_UID:
+		/* Return UID to the caller */
+		SMC_UUID_RET(handle, arm_sip_svc_uid);
+
+	case ARM_SIP_SVC_VERSION:
+		/* Return the version of current implementation */
+		SMC_RET2(handle, ARM_SIP_SVC_VERSION_MAJOR, ARM_SIP_SVC_VERSION_MINOR);
+
+	default:
+		WARN("Unimplemented ARM SiP Service Call: 0x%x \n", smc_fid);
+		SMC_RET1(handle, SMC_UNK);
+	}
+
+}
+
+
+/* Define a runtime service descriptor for fast SMC calls */
+DECLARE_RT_SVC(
+	arm_sip_svc,
+	OEN_SIP_START,
+	OEN_SIP_END,
+	SMC_TYPE_FAST,
+	arm_sip_setup,
+	arm_sip_handler
+);
diff --git a/plat/rockchip/rk3399/drivers/soc/soc.c b/plat/rockchip/rk3399/drivers/soc/soc.c
index 29bf6dd..6af7a2e 100644
--- a/plat/rockchip/rk3399/drivers/soc/soc.c
+++ b/plat/rockchip/rk3399/drivers/soc/soc.c
@@ -325,9 +325,16 @@
 {
 	int i;
 
-	for (i = 0; i < CRU_CLKSEL_COUNT; i++)
-		mmio_write_32((CRU_BASE + CRU_CLKSEL_CON(i)),
-			      REG_SOC_WMSK | slp_data.cru_clksel_con[i]);
+	for (i = 0; i < CRU_CLKSEL_COUNT; i++) {
+		/* CRU_CLKSEL_CON96~107 the high 16-bit isb't write_mask */
+		if (i > 95)
+			mmio_write_32((CRU_BASE + CRU_CLKSEL_CON(i)),
+				      slp_data.cru_clksel_con[i]);
+		else
+			mmio_write_32((CRU_BASE + CRU_CLKSEL_CON(i)),
+				      REG_SOC_WMSK |
+				      slp_data.cru_clksel_con[i]);
+	}
 	for (i = 0; i < PMUCRU_CLKSEL_CONUT; i++)
 		mmio_write_32((PMUCRU_BASE +
 			      PMUCRU_CLKSEL_OFFSET + i * REG_SIZE),
diff --git a/plat/rockchip/rk3399/drivers/soc/soc.h b/plat/rockchip/rk3399/drivers/soc/soc.h
index 906452a..d99b380 100644
--- a/plat/rockchip/rk3399/drivers/soc/soc.h
+++ b/plat/rockchip/rk3399/drivers/soc/soc.h
@@ -65,7 +65,7 @@
 
 #define PLL_CON_COUNT			0x06
 #define CRU_CLKSEL_COUNT		0x108
-#define CRU_CLKSEL_CON(n)		(0x80 + (n) * 4)
+#define CRU_CLKSEL_CON(n)		(0x100 + (n) * 4)
 
 #define PMUCRU_CLKSEL_CONUT		0x06
 #define PMUCRU_CLKSEL_OFFSET		0x080
diff --git a/readme.md b/readme.md
index cc2294b..d9a1714 100644
--- a/readme.md
+++ b/readme.md
@@ -1,4 +1,4 @@
-ARM Trusted Firmware - version 1.2
+ARM Trusted Firmware - version 1.3
 ==================================
 
 ARM Trusted Firmware provides a reference implementation of secure world
@@ -17,17 +17,25 @@
 License
 -------
 
-The software is provided under a BSD 3-Clause [license]. Certain source files
-are derived from FreeBSD code: the original license is included in these
-source files.
+The software is provided under a BSD-3-Clause [license]. Contributions to this
+project are accepted under the same license with developer sign-off as
+described in the [Contributing Guidelines].
 
+This project contains code from other projects as listed below. The original
+license text is included in those source files.
+
+*   The stdlib source code is derived from FreeBSD code.
+
+*   The libfdt source code is dual licensed. It is used by this project under
+    the terms of the BSD-2-Clause license.
+
 
 This Release
 ------------
 
 This release provides a suitable starting point for productization of secure
-world boot and runtime firmware. Future versions will contain new features,
-optimizations and quality improvements.
+world boot and runtime firmware, executing in either the AArch32 or AArch64
+execution state.
 
 Users are encouraged to do their own security validation, including penetration
 testing, on any secure world code derived from ARM Trusted Firmware.
@@ -42,7 +50,7 @@
 *   Library support for CPU specific reset and power down sequences. This
     includes support for errata workarounds.
 
-*   Drivers for both the version 2.0 and version 3.0 ARM Generic Interrupt
+*   Drivers for both versions 2.0 and 3.0 of the ARM Generic Interrupt
     Controller specifications (GICv2 and GICv3). The latter also enables GICv3
     hardware systems that do not contain legacy GICv2 support.
 
@@ -53,18 +61,26 @@
 *   SMC (Secure Monitor Call) handling, conforming to the [SMC Calling
     Convention][SMCCC] using an EL3 runtime services framework.
 
-*   SMC handling relating to [PSCI] for the Secondary CPU Boot, CPU Hotplug,
-    CPU Idle and System Shutdown/Reset/Suspend use-cases.
+*   [PSCI] library support for the Secondary CPU Boot, CPU Hotplug, CPU Idle
+    and System Shutdown/Reset/Suspend use-cases.
+    This library is pre-integrated with the provided AArch64 EL3 Runtime
+    Software, and is also suitable for integration into other EL3 Runtime
+    Software.
+
+*   A minimal AArch32 Secure Payload to demonstrate [PSCI] library integration
+    on platforms with AArch32 EL3 Runtime Software.
 
 *   Secure Monitor library code such as world switching, EL1 context management
-    and interrupt routing. This must be integrated with a Secure-EL1 Payload
-    Dispatcher (SPD) component to customize the interaction with a Secure-EL1
-    Payload (SP), for example a Secure OS.
+    and interrupt routing.
+    When using the provided AArch64 EL3 Runtime Software, this must be
+    integrated with a Secure-EL1 Payload Dispatcher (SPD) component to
+    customize the interaction with a Secure-EL1 Payload (SP), for example a
+    Secure OS.
 
-*   A Test Secure-EL1 Payload and Dispatcher to demonstrate Secure Monitor
-    functionality and Secure-EL1 interaction with PSCI.
+*   A Test Secure-EL1 Payload and Dispatcher to demonstrate AArch64 Secure
+    Monitor functionality and Secure-EL1 interaction with PSCI.
 
-*   SPDs for the [OP-TEE Secure OS] and [NVidia Trusted Little Kernel]
+*   AArch64 SPDs for the [OP-TEE Secure OS] and [NVidia Trusted Little Kernel]
     [NVidia TLK].
 
 *   A Trusted Board Boot implementation, conforming to all mandatory TBBR
@@ -72,11 +88,12 @@
     Firmware Update (or recovery mode) boot flow, and packaging of the various
     firmware images into a Firmware Image Package (FIP) to be loaded from
     non-volatile storage.
+    The TBBR implementation is currently only supported in the AArch64 build.
 
 *   Support for alternative boot flows. Some platforms have their own boot
-    firmware and only require the ARM Trusted Firmware Secure Monitor
-    functionality. Other platforms require minimal initialization before
-    booting into an arbitrary EL3 payload.
+    firmware and only require the AArch64 EL3 Runtime Software provided by this
+    project. Other platforms require minimal initialization before booting
+    into an arbitrary EL3 payload.
 
 For a full description of functionality and implementation details, please
 see the [Firmware Design] and supporting documentation. The [Change Log]
@@ -84,36 +101,46 @@
 
 ### Platforms
 
-This release of the Trusted Firmware has been tested on variants r0 and r1 of
-the [Juno ARM Development Platform] [Juno] with [Linaro Release 15.10]
-[Linaro Release Notes].
+The AArch64 build of this release has been tested on variants r0, r1 and r2
+of the [Juno ARM Development Platform] [Juno] with [Linaro Release 16.06].
 
-The Trusted Firmware has also been tested on the 64-bit Linux versions of the
-following ARM [FVP]s:
+The AArch64 build of this release has been tested on the following ARM
+[FVP]s (64-bit host machine only):
 
-*   `Foundation_Platform` (Version 9.4, Build 9.4.59)
-*   `FVP_Base_AEMv8A-AEMv8A` (Version 7.0, Build 0.8.7004)
-*   `FVP_Base_Cortex-A57x4-A53x4` (Version 7.0, Build 0.8.7004)
-*   `FVP_Base_Cortex-A57x1-A53x1` (Version 7.0, Build 0.8.7004)
-*   `FVP_Base_Cortex-A57x2-A53x4` (Version 7.0, Build 0.8.7004)
+*   `Foundation_Platform` (Version 10.1, Build 10.1.32)
+*   `FVP_Base_AEMv8A-AEMv8A` (Version 7.7, Build 0.8.7701)
+*   `FVP_Base_Cortex-A57x4-A53x4` (Version 7.7, Build 0.8.7701)
+*   `FVP_Base_Cortex-A57x1-A53x1` (Version 7.7, Build 0.8.7701)
+*   `FVP_Base_Cortex-A57x2-A53x4` (Version 7.7, Build 0.8.7701)
+
+The AArch32 build of this release has been tested on the following ARM
+[FVP]s (64-bit host machine only):
+
+*   `FVP_Base_AEMv8A-AEMv8A` (Version 7.7, Build 0.8.7701)
+*   `FVP_Base_Cortex-A32x4` (Version 10.1, Build 10.1.32)
 
 The Foundation FVP can be downloaded free of charge. The Base FVPs can be
 licensed from ARM: see [www.arm.com/fvp] [FVP].
 
 This release also contains the following platform support:
 
+*   MediaTek MT6795 and MT8173 SoCs
 *   NVidia T210 and T132 SoCs
-*   MediaTek MT8173 SoC
+*   QEMU emulator
+*   RockChip RK3368 and RK3399 SoCs
+*   Xilinx Zynq UltraScale + MPSoC
 
 ### Still to Come
 
-*   Complete implementation of the [PSCI] v1.0 specification.
-
-*   Support for new CPUs and System IP.
+*   AArch32 TBBR support and ongoing TBBR alignment.
 
 *   More platform support.
 
-*   Optimization and quality improvements.
+*   Ongoing support for new architectural features, CPUs and System IP.
+
+*   Ongoing [PSCI] alignment and feature support.
+
+*   Ongoing security hardening, optimization and quality improvements.
 
 For a full list of detailed issues in the current code, please see the [Change
 Log] and the [GitHub issue tracker].
@@ -147,7 +174,7 @@
 
 - - - - - - - - - - - - - - - - - - - - - - - - - -
 
-_Copyright (c) 2013-2015, ARM Limited and Contributors. All rights reserved._
+_Copyright (c) 2013-2016, ARM Limited and Contributors. All rights reserved._
 
 
 [License]:                  ./license.md "BSD license for ARM Trusted Firmware"
@@ -167,4 +194,4 @@
 [GitHub issue tracker]:  https://github.com/ARM-software/tf-issues/issues
 [OP-TEE Secure OS]:      https://github.com/OP-TEE/optee_os
 [NVidia TLK]:            http://nv-tegra.nvidia.com/gitweb/?p=3rdparty/ote_partner/tlk.git;a=summary
-[Linaro Release Notes]:  https://community.arm.com/docs/DOC-10952#jive_content_id_Linaro_Release_1510
+[Linaro Release 16.06]:  https://community.arm.com/docs/DOC-10952#jive_content_id_Linaro_Release_1606
diff --git a/services/std_svc/std_svc_setup.c b/services/std_svc/std_svc_setup.c
index e096601..97a9fbd 100644
--- a/services/std_svc/std_svc_setup.c
+++ b/services/std_svc/std_svc_setup.c
@@ -29,8 +29,11 @@
  */
 
 #include <assert.h>
+#include <cpu_data.h>
 #include <debug.h>
+#include <pmf.h>
 #include <psci.h>
+#include <runtime_instr.h>
 #include <runtime_svc.h>
 #include <smcc_helpers.h>
 #include <std_svc.h>
@@ -75,9 +78,25 @@
 	 * value
 	 */
 	if (is_psci_fid(smc_fid)) {
-		SMC_RET1(handle,
-			psci_smc_handler(smc_fid, x1, x2, x3, x4,
-					cookie, handle, flags));
+		uint64_t ret;
+
+#if ENABLE_RUNTIME_INSTRUMENTATION
+		PMF_WRITE_TIMESTAMP(rt_instr_svc,
+		    RT_INSTR_ENTER_PSCI,
+		    PMF_NO_CACHE_MAINT,
+		    get_cpu_data(cpu_data_pmf_ts[CPU_DATA_PMF_TS0_IDX]));
+#endif
+
+		ret = psci_smc_handler(smc_fid, x1, x2, x3, x4,
+		    cookie, handle, flags);
+
+#if ENABLE_RUNTIME_INSTRUMENTATION
+		PMF_CAPTURE_TIMESTAMP(rt_instr_svc,
+		    RT_INSTR_EXIT_PSCI,
+		    PMF_NO_CACHE_MAINT);
+#endif
+
+		SMC_RET1(handle, ret);
 	}
 
 	switch (smc_fid) {