Merge pull request #928 from davidcunado-arm/dc/update_userguide

Update AEM and Cortex Models versions
diff --git a/Makefile b/Makefile
index b59d785..b644b20 100644
--- a/Makefile
+++ b/Makefile
@@ -629,18 +629,18 @@
 ifneq (${GENERATE_COT},0)
 fwu_certificates: ${FWU_CRT_DEPS} ${CRTTOOL}
 	${Q}${CRTTOOL} ${FWU_CRT_ARGS}
-	@echo
+	@${ECHO_BLANK_LINE}
 	@echo "Built $@ successfully"
 	@echo "FWU certificates can be found in ${BUILD_PLAT}"
-	@echo
+	@${ECHO_BLANK_LINE}
 endif
 
 ${BUILD_PLAT}/${FWU_FIP_NAME}: ${FWU_FIP_DEPS} ${FIPTOOL}
 	${Q}${FIPTOOL} create ${FWU_FIP_ARGS} $@
 	${Q}${FIPTOOL} info $@
-	@echo
+	@${ECHO_BLANK_LINE}
 	@echo "Built $@ successfully"
-	@echo
+	@${ECHO_BLANK_LINE}
 
 fiptool: ${FIPTOOL}
 fip: ${BUILD_PLAT}/${FIP_NAME}
diff --git a/bl1/aarch64/bl1_context_mgmt.c b/bl1/aarch64/bl1_context_mgmt.c
index 7069ed6..2c7fe07 100644
--- a/bl1/aarch64/bl1_context_mgmt.c
+++ b/bl1/aarch64/bl1_context_mgmt.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2016, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2017, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -48,8 +48,7 @@
 	 * Ensure that the build flag to save AArch32 system registers in CPU
 	 * context is not set for AArch64-only platforms.
 	 */
-	if (((read_id_aa64pfr0_el1() >> ID_AA64PFR0_EL1_SHIFT)
-			& ID_AA64PFR0_ELX_MASK) == 0x1) {
+	if (EL_IMPLEMENTED(1) == EL_IMPL_A64ONLY) {
 		ERROR("EL1 supports AArch64-only. Please set build flag "
 				"CTX_INCLUDE_AARCH32_REGS = 0");
 		panic();
@@ -75,9 +74,8 @@
 		next_bl_ep->spsr = SPSR_64(MODE_EL1, MODE_SP_ELX,
 				   DISABLE_ALL_EXCEPTIONS);
 	} else {
-		/* Use EL2 if supported else use EL1. */
-		if (read_id_aa64pfr0_el1() &
-			(ID_AA64PFR0_ELX_MASK << ID_AA64PFR0_EL2_SHIFT)) {
+		/* Use EL2 if supported; else use EL1. */
+		if (EL_IMPLEMENTED(2)) {
 			next_bl_ep->spsr = SPSR_64(MODE_EL2, MODE_SP_ELX,
 				DISABLE_ALL_EXCEPTIONS);
 		} else {
diff --git a/bl31/bl31_main.c b/bl31/bl31_main.c
index ca18a80..c53f8a2 100644
--- a/bl31/bl31_main.c
+++ b/bl31/bl31_main.c
@@ -148,8 +148,7 @@
 	 * Ensure that the build flag to save AArch32 system registers in CPU
 	 * context is not set for AArch64-only platforms.
 	 */
-	if (((read_id_aa64pfr0_el1() >> ID_AA64PFR0_EL1_SHIFT)
-			& ID_AA64PFR0_ELX_MASK) == 0x1) {
+	if (EL_IMPLEMENTED(1) == EL_IMPL_A64ONLY) {
 		ERROR("EL1 supports AArch64-only. Please set build flag "
 				"CTX_INCLUDE_AARCH32_REGS = 0");
 		panic();
diff --git a/docs/arm-sip-service.md b/docs/arm-sip-service.md
new file mode 100644
index 0000000..7ebb724
--- /dev/null
+++ b/docs/arm-sip-service.md
@@ -0,0 +1,91 @@
+
+ARM SiP Service
+===============
+
+This document enumerates and describes the ARM SiP (Silicon Provider) services.
+
+SiP services are non-standard, platform-specific services offered by the silicon
+implementer or platform provider. They are accessed via. `SMC` ("SMC calls")
+instruction executed from Exception Levels below EL3. SMC calls for SiP
+services:
+
+* Follow [SMC Calling Convention][SMCCC];
+* Use SMC function IDs that fall in the SiP range, which are `0xc2000000` -
+  `0xc200ffff` for 64-bit calls, and `0x82000000` - `0x8200ffff` for 32-bit
+  calls.
+
+The ARM SiP implementation offers the following services:
+
+* Performance Measurement Framework (PMF)
+* Execution State Switching service
+
+Source definitions for ARM SiP service are located in the `arm_sip_svc.h` header
+file.
+
+Performance Measurement Framework (PMF)
+---------------------------------------
+
+The [Performance Measurement Framework](./firmware-design.md#13--performance-measurement-framework)
+allows callers to retrieve timestamps captured at various paths in ARM Trusted
+Firmware execution. It's described in detail in [Firmware Design document][Firmware Design].
+
+Execution State Switching service
+---------------------------------
+
+Execution State Switching service provides a mechanism for a non-secure lower
+Exception Level (either EL2, or NS EL1 if EL2 isn't implemented) to request to
+switch its execution state (a.k.a. Register Width), either from AArch64 to
+AArch32, or from AArch32 to AArch64, for the calling CPU. This service is only
+available when ARM Trusted Firmware is built for AArch64 (i.e. when build option
+`ARCH` is set to `aarch64`).
+
+### `ARM_SIP_SVC_EXE_STATE_SWITCH`
+
+    Arguments:
+        uint32_t Function ID
+        uint32_t PC hi
+        uint32_t PC lo
+        uint32_t Cookie hi
+        uint32_t Cookie lo
+
+    Return:
+        uint32_t
+
+The function ID parameter must be `0x82000020`. It uniquely identifies the
+Execution State Switching service being requested.
+
+The parameters _PC hi_ and _PC lo_ defines upper and lower words, respectively,
+of the entry point (physical address) at which execution should start, after
+Execution State has been switched. When calling from AArch64, _PC hi_ must be 0.
+
+When execution starts at the supplied entry point after Execution State has been
+switched, the parameters _Cookie hi_ and _Cookie lo_ are passed in CPU registers
+0 and 1, respectively. When calling from AArch64, _Cookie hi_ must be 0.
+
+This call can only be made on the primary CPU, before any secondaries were
+brought up with `CPU_ON` PSCI call. Otherwise, the call will always fail.
+
+The effect of switching execution state is as if the Exception Level were
+entered for the first time, following power on. This means CPU registers that
+have a defined reset value by the Architecture will assume that value. Other
+registers should not be expected to hold their values before the call was made.
+CPU endianness, however, is preserved from the previous execution state. Note
+that this switches the execution state of the calling CPU only. This is not a
+substitute for PSCI `SYSTEM_RESET`.
+
+The service may return the following error codes:
+
+  - `STATE_SW_E_PARAM`: If any of the parameters were deemed invalid for
+    a specific request.
+  - `STATE_SW_E_DENIED`: If the call is not successful, or when ARM Trusted
+    Firmware is built for AArch32.
+
+If the call is successful, the caller wouldn't observe the SMC returning.
+Instead, execution starts at the supplied entry point, with the CPU registers 0
+and 1 populated with the supplied _Cookie hi_ and _Cookie lo_ values,
+respectively.
+
+- - - - - - - - - - - - - - - - - - - - - - - - - -
+
+[Firmware Design]: ./firmware-design.md
+[SMCCC]: http://infocenter.arm.com/help/topic/com.arm.doc.den0028a/index.html "SMC Calling Convention PDD (ARM DEN 0028A)"
diff --git a/include/bl32/payloads/tlk.h b/include/bl32/payloads/tlk.h
index db9815f..4e06bcd 100644
--- a/include/bl32/payloads/tlk.h
+++ b/include/bl32/payloads/tlk.h
@@ -12,18 +12,18 @@
 /*
  * Generate function IDs for the Trusted OS/Apps
  */
-#define TLK_TOS_STD_FID(fid)	((fid) | 0x72000000 | (0 << 31))
-#define TLK_TA_STD_FID(fid)	((fid) | 0x70000000 | (0 << 31))
+#define TLK_TOS_YIELD_FID(fid)	((fid) | 0x72000000 | (0 << 31))
+#define TLK_TA_YIELD_FID(fid)	((fid) | 0x70000000 | (0 << 31))
 
 /*
  * Trusted OS specific function IDs
  */
-#define TLK_REGISTER_LOGBUF	TLK_TOS_STD_FID(0x1)
-#define TLK_REGISTER_REQBUF	TLK_TOS_STD_FID(0x2)
-#define TLK_RESUME_FID		TLK_TOS_STD_FID(0x100)
-#define TLK_SYSTEM_SUSPEND	TLK_TOS_STD_FID(0xE001)
-#define TLK_SYSTEM_RESUME	TLK_TOS_STD_FID(0xE002)
-#define TLK_SYSTEM_OFF		TLK_TOS_STD_FID(0xE003)
+#define TLK_REGISTER_LOGBUF	TLK_TOS_YIELD_FID(0x1)
+#define TLK_REGISTER_REQBUF	TLK_TOS_YIELD_FID(0x2)
+#define TLK_RESUME_FID		TLK_TOS_YIELD_FID(0x100)
+#define TLK_SYSTEM_SUSPEND	TLK_TOS_YIELD_FID(0xE001)
+#define TLK_SYSTEM_RESUME	TLK_TOS_YIELD_FID(0xE002)
+#define TLK_SYSTEM_OFF		TLK_TOS_YIELD_FID(0xE003)
 
 /*
  * SMC function IDs that TLK uses to signal various forms of completions
@@ -40,10 +40,10 @@
 /*
  * Trusted Application specific function IDs
  */
-#define TLK_OPEN_TA_SESSION	TLK_TA_STD_FID(0x1)
-#define TLK_CLOSE_TA_SESSION	TLK_TA_STD_FID(0x2)
-#define TLK_TA_LAUNCH_OP	TLK_TA_STD_FID(0x3)
-#define TLK_TA_SEND_EVENT	TLK_TA_STD_FID(0x4)
+#define TLK_OPEN_TA_SESSION	TLK_TA_YIELD_FID(0x1)
+#define TLK_CLOSE_TA_SESSION	TLK_TA_YIELD_FID(0x2)
+#define TLK_TA_LAUNCH_OP	TLK_TA_YIELD_FID(0x3)
+#define TLK_TA_SEND_EVENT	TLK_TA_YIELD_FID(0x4)
 
 /*
  * Total number of function IDs implemented for services offered to NS clients.
diff --git a/include/lib/aarch64/arch.h b/include/lib/aarch64/arch.h
index c627263..16adcf7 100644
--- a/include/lib/aarch64/arch.h
+++ b/include/lib/aarch64/arch.h
@@ -110,6 +110,10 @@
 #define ID_AA64PFR0_EL3_SHIFT	12
 #define ID_AA64PFR0_ELX_MASK	0xf
 
+#define EL_IMPL_NONE		0
+#define EL_IMPL_A64ONLY		1
+#define EL_IMPL_A64_A32		2
+
 #define ID_AA64PFR0_GIC_SHIFT	24
 #define ID_AA64PFR0_GIC_WIDTH	4
 #define ID_AA64PFR0_GIC_MASK	((1 << ID_AA64PFR0_GIC_WIDTH) - 1)
@@ -183,7 +187,8 @@
 #define MDCR_DEF_VAL		(MDCR_SDD_BIT | MDCR_SPD32(MDCR_SPD32_DISABLE))
 
 /* HCR definitions */
-#define HCR_RW_BIT		(1ull << 31)
+#define HCR_RW_SHIFT		31
+#define HCR_RW_BIT		(1ull << HCR_RW_SHIFT)
 #define HCR_AMO_BIT		(1 << 5)
 #define HCR_IMO_BIT		(1 << 4)
 #define HCR_FMO_BIT		(1 << 3)
diff --git a/include/lib/aarch64/arch_helpers.h b/include/lib/aarch64/arch_helpers.h
index 56d248c2..32290e2 100644
--- a/include/lib/aarch64/arch_helpers.h
+++ b/include/lib/aarch64/arch_helpers.h
@@ -328,6 +328,14 @@
 #define IS_IN_EL1() IS_IN_EL(1)
 #define IS_IN_EL3() IS_IN_EL(3)
 
+/*
+ * Check if an EL is implemented from AA64PFR0 register fields. 'el' argument
+ * must be one of 1, 2 or 3.
+ */
+#define EL_IMPLEMENTED(el) \
+	((read_id_aa64pfr0_el1() >> ID_AA64PFR0_EL##el##_SHIFT) \
+		& ID_AA64PFR0_ELX_MASK)
+
 /* Previously defined accesor functions with incomplete register names  */
 
 #define read_current_el()	read_CurrentEl()
diff --git a/include/lib/el3_runtime/context_mgmt.h b/include/lib/el3_runtime/context_mgmt.h
index c1f04b9..9479869 100644
--- a/include/lib/el3_runtime/context_mgmt.h
+++ b/include/lib/el3_runtime/context_mgmt.h
@@ -9,6 +9,8 @@
 
 #ifndef AARCH32
 #include <arch.h>
+#include <assert.h>
+#include <stdint.h>
 #endif
 
 /*******************************************************************************
diff --git a/include/lib/psci/psci_lib.h b/include/lib/psci/psci_lib.h
index 1e25f2e..4697f17 100644
--- a/include/lib/psci/psci_lib.h
+++ b/include/lib/psci/psci_lib.h
@@ -82,6 +82,7 @@
 			  void *handle,
 			  u_register_t flags);
 int psci_setup(const psci_lib_args_t *lib_args);
+int psci_secondaries_brought_up(void);
 void psci_warmboot_entrypoint(void);
 void psci_register_spd_pm_hook(const spd_pm_ops_t *pm);
 void psci_prepare_next_non_secure_ctx(
diff --git a/include/lib/xlat_tables/xlat_tables_defs.h b/include/lib/xlat_tables/xlat_tables_defs.h
index 3097d9a..c54b729 100644
--- a/include/lib/xlat_tables/xlat_tables_defs.h
+++ b/include/lib/xlat_tables/xlat_tables_defs.h
@@ -32,7 +32,10 @@
 #define SECOND_LEVEL_DESC_N	TWO_MB_SHIFT
 #define THIRD_LEVEL_DESC_N	FOUR_KB_SHIFT
 
+/* XN: Translation regimes that support one VA range (EL2 and EL3). */
 #define XN			(ULL(1) << 2)
+/* UXN, PXN: Translation regimes that support two VA ranges (EL1&0). */
+#define UXN			(ULL(1) << 2)
 #define PXN			(ULL(1) << 1)
 #define CONT_HINT		(ULL(1) << 0)
 #define UPPER_ATTRS(x)		(((x) & ULL(0x7)) << 52)
diff --git a/include/plat/arm/common/arm_sip_svc.h b/include/plat/arm/common/arm_sip_svc.h
index bbfd4da..68375af 100644
--- a/include/plat/arm/common/arm_sip_svc.h
+++ b/include/plat/arm/common/arm_sip_svc.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2016-2017, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -14,8 +14,11 @@
 /*					0x8200ff02 is reserved */
 #define ARM_SIP_SVC_VERSION		0x8200ff03
 
+/* Function ID for requesting state switch of lower EL */
+#define ARM_SIP_SVC_EXE_STATE_SWITCH	0x82000020
+
 /* ARM SiP Service Calls version numbers */
 #define ARM_SIP_SVC_VERSION_MAJOR		0x0
-#define ARM_SIP_SVC_VERSION_MINOR		0x1
+#define ARM_SIP_SVC_VERSION_MINOR		0x2
 
 #endif /* __ARM_SIP_SVC_H__ */
diff --git a/include/plat/arm/common/plat_arm.h b/include/plat/arm/common/plat_arm.h
index 9aa7a30..7967173 100644
--- a/include/plat/arm/common/plat_arm.h
+++ b/include/plat/arm/common/plat_arm.h
@@ -100,6 +100,9 @@
 
 #endif /* __ARM_RECOM_STATE_ID_ENC__ */
 
+/* ARM State switch error codes */
+#define STATE_SW_E_PARAM		(-2)
+#define STATE_SW_E_DENIED		(-3)
 
 /* IO storage utility functions */
 void arm_io_setup(void);
@@ -206,4 +209,12 @@
 /* Allow platform to override psci_pm_ops during runtime */
 const plat_psci_ops_t *plat_arm_psci_override_pm_ops(plat_psci_ops_t *ops);
 
+/* Execution state switch in ARM platforms */
+int arm_execution_state_switch(unsigned int smc_fid,
+		uint32_t pc_hi,
+		uint32_t pc_lo,
+		uint32_t cookie_hi,
+		uint32_t cookie_lo,
+		void *handle);
+
 #endif /* __PLAT_ARM_H__ */
diff --git a/lib/el3_runtime/aarch64/context_mgmt.c b/lib/el3_runtime/aarch64/context_mgmt.c
index d376fda..0104c4e 100644
--- a/lib/el3_runtime/aarch64/context_mgmt.c
+++ b/lib/el3_runtime/aarch64/context_mgmt.c
@@ -205,8 +205,7 @@
 			sctlr_elx &= ~SCTLR_EE_BIT;
 			sctlr_elx |= SCTLR_EL2_RES1;
 			write_sctlr_el2(sctlr_elx);
-		} else if (read_id_aa64pfr0_el1() &
-			   (ID_AA64PFR0_ELX_MASK << ID_AA64PFR0_EL2_SHIFT)) {
+		} else if (EL_IMPLEMENTED(2)) {
 			/* EL2 present but unused, need to disable safely */
 
 			/* HCR_EL2 = 0, except RW bit set to match SCR_EL3 */
diff --git a/lib/psci/psci_common.c b/lib/psci/psci_common.c
index 5b0e314..763de04 100644
--- a/lib/psci/psci_common.c
+++ b/lib/psci/psci_common.c
@@ -892,6 +892,27 @@
 #endif
 }
 
+/******************************************************************************
+ * Return whether any secondaries were powered up with CPU_ON call. A CPU that
+ * have ever been powered up would have set its MPDIR value to something other
+ * than PSCI_INVALID_MPIDR. Note that MPDIR isn't reset back to
+ * PSCI_INVALID_MPIDR when a CPU is powered down later, so the return value is
+ * meaningful only when called on the primary CPU during early boot.
+ *****************************************************************************/
+int psci_secondaries_brought_up(void)
+{
+	int idx, n_valid = 0;
+
+	for (idx = 0; idx < ARRAY_SIZE(psci_cpu_pd_nodes); idx++) {
+		if (psci_cpu_pd_nodes[idx].mpidr != PSCI_INVALID_MPIDR)
+			n_valid++;
+	}
+
+	assert(n_valid);
+
+	return (n_valid > 1);
+}
+
 #if ENABLE_PLAT_COMPAT
 /*******************************************************************************
  * PSCI Compatibility helper function to return the 'power_state' parameter of
diff --git a/lib/xlat_tables/aarch32/xlat_tables.c b/lib/xlat_tables/aarch32/xlat_tables.c
index 03caf36..3c9051c 100644
--- a/lib/xlat_tables/aarch32/xlat_tables.c
+++ b/lib/xlat_tables/aarch32/xlat_tables.c
@@ -69,6 +69,20 @@
 }
 #endif /* ENABLE_ASSERTIONS */
 
+int xlat_arch_current_el(void)
+{
+	/*
+	 * If EL3 is in AArch32 mode, all secure PL1 modes (Monitor, System,
+	 * SVC, Abort, UND, IRQ and FIQ modes) execute at EL3.
+	 */
+	return 3;
+}
+
+uint64_t xlat_arch_get_xn_desc(int el __unused)
+{
+	return UPPER_ATTRS(XN);
+}
+
 void init_xlat_tables(void)
 {
 	unsigned long long max_pa;
diff --git a/lib/xlat_tables/aarch64/xlat_tables.c b/lib/xlat_tables/aarch64/xlat_tables.c
index 2126180..309cb9b 100644
--- a/lib/xlat_tables/aarch64/xlat_tables.c
+++ b/lib/xlat_tables/aarch64/xlat_tables.c
@@ -122,6 +122,25 @@
 }
 #endif /* ENABLE_ASSERTIONS */
 
+int xlat_arch_current_el(void)
+{
+	int el = GET_EL(read_CurrentEl());
+
+	assert(el > 0);
+
+	return el;
+}
+
+uint64_t xlat_arch_get_xn_desc(int el)
+{
+	if (el == 3) {
+		return UPPER_ATTRS(XN);
+	} else {
+		assert(el == 1);
+		return UPPER_ATTRS(PXN);
+	}
+}
+
 void init_xlat_tables(void)
 {
 	unsigned long long max_pa;
diff --git a/lib/xlat_tables/xlat_tables_common.c b/lib/xlat_tables/xlat_tables_common.c
index f322a9a..17e7e6e 100644
--- a/lib/xlat_tables/xlat_tables_common.c
+++ b/lib/xlat_tables/xlat_tables_common.c
@@ -40,6 +40,8 @@
 static unsigned long long xlat_max_pa;
 static uintptr_t xlat_max_va;
 
+static uint64_t execute_never_mask;
+
 /*
  * Array of all memory regions stored in order of ascending base address.
  * The list is terminated by the first entry with size == 0.
@@ -213,7 +215,8 @@
 		 * fetch, which could be an issue if this memory region
 		 * corresponds to a read-sensitive peripheral.
 		 */
-		desc |= UPPER_ATTRS(XN);
+		desc |= execute_never_mask;
+
 	} else { /* Normal memory */
 		/*
 		 * Always map read-write normal memory as execute-never.
@@ -221,7 +224,7 @@
 		 * R/W memory is reserved for data storage, which must not be
 		 * executable.)
 		 * Note that setting the XN bit here is for consistency only.
-		 * The enable_mmu_elx() function sets the SCTLR_EL3.WXN bit,
+		 * The function that enables the MMU sets the SCTLR_ELx.WXN bit,
 		 * which makes any writable memory region to be treated as
 		 * execute-never, regardless of the value of the XN bit in the
 		 * translation table.
@@ -229,8 +232,9 @@
 		 * For read-only memory, rely on the MT_EXECUTE/MT_EXECUTE_NEVER
 		 * attribute to figure out the value of the XN bit.
 		 */
-		if ((attr & MT_RW) || (attr & MT_EXECUTE_NEVER))
-			desc |= UPPER_ATTRS(XN);
+		if ((attr & MT_RW) || (attr & MT_EXECUTE_NEVER)) {
+			desc |= execute_never_mask;
+		}
 
 		if (mem_type == MT_MEMORY) {
 			desc |= LOWER_ATTRS(ATTR_IWBWA_OWBWA_NTR_INDEX | ISH);
@@ -377,7 +381,7 @@
 			int level, uintptr_t *max_va,
 			unsigned long long *max_pa)
 {
-
+	execute_never_mask = xlat_arch_get_xn_desc(xlat_arch_current_el());
 	init_xlation_table_inner(mmap, base_va, table, level);
 	*max_va = xlat_max_va;
 	*max_pa = xlat_max_pa;
diff --git a/lib/xlat_tables/xlat_tables_private.h b/lib/xlat_tables/xlat_tables_private.h
index d568dc0..9207852 100644
--- a/lib/xlat_tables/xlat_tables_private.h
+++ b/lib/xlat_tables/xlat_tables_private.h
@@ -65,6 +65,17 @@
 #endif /* AARCH32 */
 
 void print_mmap(void);
+
+/* Returns the current Exception Level. The returned EL must be 1 or higher. */
+int xlat_arch_current_el(void);
+
+/*
+ * Returns the bit mask that has to be ORed to the rest of a translation table
+ * descriptor so that execution of code is prohibited at the given Exception
+ * Level.
+ */
+uint64_t xlat_arch_get_xn_desc(int el);
+
 void init_xlation_table(uintptr_t base_va, uint64_t *table,
 			int level, uintptr_t *max_va,
 			unsigned long long *max_pa);
diff --git a/lib/xlat_tables_v2/aarch32/xlat_tables_arch.c b/lib/xlat_tables_v2/aarch32/xlat_tables_arch.c
index 968a69a..afc65e7 100644
--- a/lib/xlat_tables_v2/aarch32/xlat_tables_arch.c
+++ b/lib/xlat_tables_v2/aarch32/xlat_tables_arch.c
@@ -67,6 +67,20 @@
 
 #endif /* PLAT_XLAT_TABLES_DYNAMIC */
 
+int xlat_arch_current_el(void)
+{
+	/*
+	 * If EL3 is in AArch32 mode, all secure PL1 modes (Monitor, System,
+	 * SVC, Abort, UND, IRQ and FIQ modes) execute at EL3.
+	 */
+	return 3;
+}
+
+uint64_t xlat_arch_get_xn_desc(int el __unused)
+{
+	return UPPER_ATTRS(XN);
+}
+
 void init_xlat_tables_arch(unsigned long long max_pa)
 {
 	assert((PLAT_PHY_ADDR_SPACE_SIZE - 1) <=
diff --git a/lib/xlat_tables_v2/aarch64/xlat_tables_arch.c b/lib/xlat_tables_v2/aarch64/xlat_tables_arch.c
index 9ce7840..cc41fc3 100644
--- a/lib/xlat_tables_v2/aarch64/xlat_tables_arch.c
+++ b/lib/xlat_tables_v2/aarch64/xlat_tables_arch.c
@@ -127,6 +127,25 @@
 
 #endif /* PLAT_XLAT_TABLES_DYNAMIC */
 
+int xlat_arch_current_el(void)
+{
+	int el = GET_EL(read_CurrentEl());
+
+	assert(el > 0);
+
+	return el;
+}
+
+uint64_t xlat_arch_get_xn_desc(int el)
+{
+	if (el == 3) {
+		return UPPER_ATTRS(XN);
+	} else {
+		assert(el == 1);
+		return UPPER_ATTRS(PXN);
+	}
+}
+
 void init_xlat_tables_arch(unsigned long long max_pa)
 {
 	assert((PLAT_PHY_ADDR_SPACE_SIZE - 1) <=
diff --git a/lib/xlat_tables_v2/xlat_tables_common.c b/lib/xlat_tables_v2/xlat_tables_common.c
index a8d021c..a6f3b7c 100644
--- a/lib/xlat_tables_v2/xlat_tables_common.c
+++ b/lib/xlat_tables_v2/xlat_tables_common.c
@@ -113,6 +113,8 @@
 	assert(!is_mmu_enabled());
 	assert(!tf_xlat_ctx.initialized);
 	print_mmap(tf_xlat_ctx.mmap);
+	tf_xlat_ctx.execute_never_mask =
+			xlat_arch_get_xn_desc(xlat_arch_current_el());
 	init_xlation_table(&tf_xlat_ctx);
 	xlat_tables_print(&tf_xlat_ctx);
 
diff --git a/lib/xlat_tables_v2/xlat_tables_internal.c b/lib/xlat_tables_v2/xlat_tables_internal.c
index fd64813..2d556e6 100644
--- a/lib/xlat_tables_v2/xlat_tables_internal.c
+++ b/lib/xlat_tables_v2/xlat_tables_internal.c
@@ -92,7 +92,7 @@
 
 /* Returns a block/page table descriptor for the given level and attributes. */
 static uint64_t xlat_desc(mmap_attr_t attr, unsigned long long addr_pa,
-			  int level)
+			  int level, uint64_t execute_never_mask)
 {
 	uint64_t desc;
 	int mem_type;
@@ -134,7 +134,8 @@
 		 * fetch, which could be an issue if this memory region
 		 * corresponds to a read-sensitive peripheral.
 		 */
-		desc |= UPPER_ATTRS(XN);
+		desc |= execute_never_mask;
+
 	} else { /* Normal memory */
 		/*
 		 * Always map read-write normal memory as execute-never.
@@ -142,7 +143,7 @@
 		 * R/W memory is reserved for data storage, which must not be
 		 * executable.)
 		 * Note that setting the XN bit here is for consistency only.
-		 * The enable_mmu_elx() function sets the SCTLR_EL3.WXN bit,
+		 * The function that enables the MMU sets the SCTLR_ELx.WXN bit,
 		 * which makes any writable memory region to be treated as
 		 * execute-never, regardless of the value of the XN bit in the
 		 * translation table.
@@ -150,8 +151,9 @@
 		 * For read-only memory, rely on the MT_EXECUTE/MT_EXECUTE_NEVER
 		 * attribute to figure out the value of the XN bit.
 		 */
-		if ((attr & MT_RW) || (attr & MT_EXECUTE_NEVER))
-			desc |= UPPER_ATTRS(XN);
+		if ((attr & MT_RW) || (attr & MT_EXECUTE_NEVER)) {
+			desc |= execute_never_mask;
+		}
 
 		if (mem_type == MT_MEMORY) {
 			desc |= LOWER_ATTRS(ATTR_IWBWA_OWBWA_NTR_INDEX | ISH);
@@ -511,7 +513,8 @@
 		if (action == ACTION_WRITE_BLOCK_ENTRY) {
 
 			table_base[table_idx] =
-				xlat_desc(mm->attr, table_idx_pa, level);
+				xlat_desc(mm->attr, table_idx_pa, level,
+					  ctx->execute_never_mask);
 
 		} else if (action == ACTION_CREATE_NEW_TABLE) {
 
@@ -916,7 +919,7 @@
 #if LOG_LEVEL >= LOG_LEVEL_VERBOSE
 
 /* Print the attributes of the specified block descriptor. */
-static void xlat_desc_print(uint64_t desc)
+static void xlat_desc_print(uint64_t desc, uint64_t execute_never_mask)
 {
 	int mem_type_index = ATTR_INDEX_GET(desc);
 
@@ -931,7 +934,7 @@
 
 	tf_printf(LOWER_ATTRS(AP_RO) & desc ? "-RO" : "-RW");
 	tf_printf(LOWER_ATTRS(NS) & desc ? "-NS" : "-S");
-	tf_printf(UPPER_ATTRS(XN) & desc ? "-XN" : "-EXEC");
+	tf_printf(execute_never_mask & desc ? "-XN" : "-EXEC");
 }
 
 static const char * const level_spacers[] = {
@@ -950,7 +953,7 @@
  */
 static void xlat_tables_print_internal(const uintptr_t table_base_va,
 		uint64_t *const table_base, const int table_entries,
-		const int level)
+		const int level, const uint64_t execute_never_mask)
 {
 	assert(level <= XLAT_TABLE_LEVEL_MAX);
 
@@ -1011,14 +1014,15 @@
 
 				xlat_tables_print_internal(table_idx_va,
 					(uint64_t *)addr_inner,
-					XLAT_TABLE_ENTRIES, level+1);
+					XLAT_TABLE_ENTRIES, level+1,
+					execute_never_mask);
 			} else {
 				tf_printf("%sVA:%p PA:0x%llx size:0x%zx ",
 					  level_spacers[level],
 					  (void *)table_idx_va,
 					  (unsigned long long)(desc & TABLE_ADDR_MASK),
 					  level_size);
-				xlat_desc_print(desc);
+				xlat_desc_print(desc, execute_never_mask);
 				tf_printf("\n");
 			}
 		}
@@ -1039,7 +1043,7 @@
 {
 #if LOG_LEVEL >= LOG_LEVEL_VERBOSE
 	xlat_tables_print_internal(0, ctx->base_table, ctx->base_table_entries,
-				   ctx->base_level);
+				   ctx->base_level, ctx->execute_never_mask);
 #endif /* LOG_LEVEL >= LOG_LEVEL_VERBOSE */
 }
 
diff --git a/lib/xlat_tables_v2/xlat_tables_private.h b/lib/xlat_tables_v2/xlat_tables_private.h
index 1cfbce0..07bf39f 100644
--- a/lib/xlat_tables_v2/xlat_tables_private.h
+++ b/lib/xlat_tables_v2/xlat_tables_private.h
@@ -84,6 +84,13 @@
 	/* Set to 1 when the translation tables are initialized. */
 	int initialized;
 
+	/*
+	 * Bit mask that has to be ORed to the rest of a translation table
+	 * descriptor in order to prohibit execution of code at the exception
+	 * level of this translation context.
+	 */
+	uint64_t execute_never_mask;
+
 } xlat_ctx_t;
 
 #if PLAT_XLAT_TABLES_DYNAMIC
@@ -153,6 +160,16 @@
 /*
  * Architecture-specific initialization code.
  */
+
+/* Returns the current Exception Level. The returned EL must be 1 or higher. */
+int xlat_arch_current_el(void);
+
+/*
+ * Returns the bit mask that has to be ORed to the rest of a translation table
+ * descriptor so that execution of code is prohibited at the given Exception
+ * Level.
+ */
+uint64_t xlat_arch_get_xn_desc(int el);
 
 /* Execute architecture-specific translation table initialization code. */
 void init_xlat_tables_arch(unsigned long long max_pa);
diff --git a/make_helpers/build_macros.mk b/make_helpers/build_macros.mk
index 2d23ef8..36f220e 100644
--- a/make_helpers/build_macros.mk
+++ b/make_helpers/build_macros.mk
@@ -284,14 +284,16 @@
         $(eval BL_LINKERFILE := $(BL$(call uppercase,$(1))_LINKERFILE))
         # We use sort only to get a list of unique object directory names.
         # ordering is not relevant but sort removes duplicates.
-        $(eval TEMP_OBJ_DIRS := $(sort $(BUILD_DIR)/ $(dir ${OBJS} ${LINKERFILE})))
+        $(eval TEMP_OBJ_DIRS := $(sort $(dir ${OBJS} ${LINKERFILE})))
         # The $(dir ) function leaves a trailing / on the directory names
         # Rip off the / to match directory names with make rule targets.
         $(eval OBJ_DIRS   := $(patsubst %/,%,$(TEMP_OBJ_DIRS)))
 
 # Create generators for object directory structure
 
-$(eval $(foreach objd,${OBJ_DIRS},$(call MAKE_PREREQ_DIR,${objd},)))
+$(eval $(call MAKE_PREREQ_DIR,${BUILD_DIR},))
+
+$(eval $(foreach objd,${OBJ_DIRS},$(call MAKE_PREREQ_DIR,${objd},${BUILD_DIR})))
 
 .PHONY : bl${1}_dirs
 
@@ -321,9 +323,9 @@
 $(BIN): $(ELF)
 	@echo "  BIN     $$@"
 	$$(Q)$$(OC) -O binary $$< $$@
-	@echo
+	@${ECHO_BLANK_LINE}
 	@echo "Built $$@ successfully"
-	@echo
+	@${ECHO_BLANK_LINE}
 
 .PHONY: bl$(1)
 bl$(1): $(BIN) $(DUMP)
diff --git a/make_helpers/unix.mk b/make_helpers/unix.mk
index 61b1368..17f8a7c 100644
--- a/make_helpers/unix.mk
+++ b/make_helpers/unix.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2016, ARM Limited and Contributors. All rights reserved.
+# Copyright (c) 2016-2017, ARM Limited and Contributors. All rights reserved.
 #
 # SPDX-License-Identifier: BSD-3-Clause
 #
@@ -43,11 +43,14 @@
 
     # ${1} is the directory to be generated.
     # ${2} is optional, and allows a prerequisite to be specified.
+    # Do nothing if $1 == $2, to ignore self dependencies.
     define MAKE_PREREQ_DIR
+        ifneq (${1},${2})
 
 ${1} : ${2}
 	${Q}mkdir -p  "${1}"
 
+        endif
     endef
 
     define SHELL_REMOVE_DIR
diff --git a/make_helpers/windows.mk b/make_helpers/windows.mk
index f6e8d55..69f6a01 100644
--- a/make_helpers/windows.mk
+++ b/make_helpers/windows.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2016, ARM Limited and Contributors. All rights reserved.
+# Copyright (c) 2016-2017, ARM Limited and Contributors. All rights reserved.
 #
 # SPDX-License-Identifier: BSD-3-Clause
 #
@@ -51,12 +51,15 @@
 
     # ${1} is the directory to be generated.
     # ${2} is optional, and allows prerequisites to be specified.
+    # Do nothing if $1 == $2, to ignore self dependencies.
     define MAKE_PREREQ_DIR
+        ifneq (${1},${2})
 
 ${1} : ${2}
 	$(eval tmp_dir:=$(subst /,\,${1}))
 	-@if not exist "$(tmp_dir)"  mkdir "${tmp_dir}"
 
+        endif
     endef
 
     # ${1} is the directory to be removed.
diff --git a/plat/arm/common/arm_common.c b/plat/arm/common/arm_common.c
index 5b78bb8..420a386 100644
--- a/plat/arm/common/arm_common.c
+++ b/plat/arm/common/arm_common.c
@@ -113,15 +113,11 @@
 #ifndef AARCH32
 uint32_t arm_get_spsr_for_bl33_entry(void)
 {
-	unsigned long el_status;
 	unsigned int mode;
 	uint32_t spsr;
 
 	/* Figure out what mode we enter the non-secure world in */
-	el_status = read_id_aa64pfr0_el1() >> ID_AA64PFR0_EL2_SHIFT;
-	el_status &= ID_AA64PFR0_ELX_MASK;
-
-	mode = (el_status) ? MODE_EL2 : MODE_EL1;
+	mode = EL_IMPLEMENTED(2) ? MODE_EL2 : MODE_EL1;
 
 	/*
 	 * TODO: Consider the possibility of specifying the SPSR in
diff --git a/plat/arm/common/arm_common.mk b/plat/arm/common/arm_common.mk
index 814d0fc..d51c123 100644
--- a/plat/arm/common/arm_common.mk
+++ b/plat/arm/common/arm_common.mk
@@ -140,6 +140,7 @@
 BL31_SOURCES		+=	plat/arm/common/arm_bl31_setup.c		\
 				plat/arm/common/arm_pm.c			\
 				plat/arm/common/arm_topology.c			\
+				plat/arm/common/execution_state_switch.c	\
 				plat/common/plat_psci_common.c
 
 ifeq (${ENABLE_PMF}, 1)
diff --git a/plat/arm/common/arm_sip_svc.c b/plat/arm/common/arm_sip_svc.c
index 90997e3..7fe6101 100644
--- a/plat/arm/common/arm_sip_svc.c
+++ b/plat/arm/common/arm_sip_svc.c
@@ -1,11 +1,12 @@
 /*
- * Copyright (c) 2016, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2016-2017, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
 
 #include <arm_sip_svc.h>
 #include <debug.h>
+#include <plat_arm.h>
 #include <pmf.h>
 #include <runtime_svc.h>
 #include <stdint.h>
@@ -36,6 +37,8 @@
 			void *handle,
 			u_register_t flags)
 {
+	int call_count = 0;
+
 	/*
 	 * Dispatch PMF calls to PMF SMC handler and return its return
 	 * value
@@ -46,12 +49,34 @@
 	}
 
 	switch (smc_fid) {
-	case ARM_SIP_SVC_CALL_COUNT:
+	case ARM_SIP_SVC_EXE_STATE_SWITCH: {
+		u_register_t pc;
+
+		/* Allow calls from non-secure only */
+		if (!is_caller_non_secure(flags))
+			SMC_RET1(handle, STATE_SW_E_DENIED);
+
+		/* Validate supplied entry point */
+		pc = (u_register_t) ((x1 << 32) | (uint32_t) x2);
+		if (arm_validate_ns_entrypoint(pc))
+			SMC_RET1(handle, STATE_SW_E_PARAM);
+
 		/*
-		 * Return the number of SiP Service Calls. PMF is the only
-		 * SiP service implemented; so return number of PMF calls
+		 * Pointers used in execution state switch are all 32 bits wide
 		 */
-		SMC_RET1(handle, PMF_NUM_SMC_CALLS);
+		return arm_execution_state_switch(smc_fid, (uint32_t) x1,
+				(uint32_t) x2, (uint32_t) x3, (uint32_t) x4,
+				handle);
+		}
+
+	case ARM_SIP_SVC_CALL_COUNT:
+		/* PMF calls */
+		call_count += PMF_NUM_SMC_CALLS;
+
+		/* State switch call */
+		call_count += 1;
+
+		SMC_RET1(handle, call_count);
 
 	case ARM_SIP_SVC_UID:
 		/* Return UID to the caller */
diff --git a/plat/arm/common/execution_state_switch.c b/plat/arm/common/execution_state_switch.c
new file mode 100644
index 0000000..5068cdf
--- /dev/null
+++ b/plat/arm/common/execution_state_switch.c
@@ -0,0 +1,197 @@
+/*
+ * Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of ARM nor the names of its contributors may be used
+ * to endorse or promote products derived from this software without specific
+ * prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <arch_helpers.h>
+#include <arm_sip_svc.h>
+#include <context.h>
+#include <context_mgmt.h>
+#include <plat_arm.h>
+#include <psci.h>
+#include <smcc_helpers.h>
+#include <string.h>
+#include <utils.h>
+
+/*
+ * Handle SMC from a lower exception level to switch its execution state
+ * (either from AArch64 to AArch32, or vice versa).
+ *
+ * smc_fid:
+ *	SMC function ID - either ARM_SIP_SVC_STATE_SWITCH_64 or
+ *	ARM_SIP_SVC_STATE_SWITCH_32.
+ * pc_hi, pc_lo:
+ *	PC upon re-entry to the calling exception level; width dependent on the
+ *	calling exception level.
+ * cookie_hi, cookie_lo:
+ *	Opaque pointer pairs received from the caller to pass it back, upon
+ *	re-entry.
+ * handle:
+ *	Handle to saved context.
+ */
+int arm_execution_state_switch(unsigned int smc_fid,
+		uint32_t pc_hi,
+		uint32_t pc_lo,
+		uint32_t cookie_hi,
+		uint32_t cookie_lo,
+		void *handle)
+{
+	/* Execution state can be switched only if EL3 is AArch64 */
+#ifdef AARCH64
+	int caller_64, from_el2, el, endianness, thumb = 0;
+	u_register_t spsr, pc, scr, sctlr;
+	entry_point_info_t ep;
+	cpu_context_t *ctx = (cpu_context_t *) handle;
+	el3_state_t *el3_ctx = get_el3state_ctx(ctx);
+
+	/* That the SMC originated from NS is already validated by the caller */
+
+	/*
+	 * Disallow state switch if any of the secondaries have been brought up.
+	 */
+	if (psci_secondaries_brought_up())
+		goto exec_denied;
+
+	spsr = read_ctx_reg(el3_ctx, CTX_SPSR_EL3);
+	caller_64 = (GET_RW(spsr) == MODE_RW_64);
+
+	if (caller_64) {
+		/*
+		 * If the call originated from AArch64, expect 32-bit pointers when
+		 * switching to AArch32.
+		 */
+		if ((pc_hi != 0) || (cookie_hi != 0))
+			goto invalid_param;
+
+		pc = pc_lo;
+
+		/* Instruction state when entering AArch32 */
+		thumb = pc & 1;
+	} else {
+		/* Construct AArch64 PC */
+		pc = (((u_register_t) pc_hi) << 32) | pc_lo;
+	}
+
+	/* Make sure PC is 4-byte aligned, except for Thumb */
+	if ((pc & 0x3) && !thumb)
+		goto invalid_param;
+
+	/*
+	 * EL3 controls register width of the immediate lower EL only. Expect
+	 * this request from EL2/Hyp unless:
+	 *
+	 * - EL2 is not implemented;
+	 * - EL2 is implemented, but was disabled. This can be inferred from
+	 *   SCR_EL3.HCE.
+	 */
+	from_el2 = caller_64 ? (GET_EL(spsr) == MODE_EL2) :
+		(GET_M32(spsr) == MODE32_hyp);
+	scr = read_ctx_reg(el3_ctx, CTX_SCR_EL3);
+	if (!from_el2) {
+		/* The call is from NS privilege level other than HYP */
+
+		/*
+		 * Disallow switching state if there's a Hypervisor in place;
+		 * this request must be taken up with the Hypervisor instead.
+		 */
+		if (scr & SCR_HCE_BIT)
+			goto exec_denied;
+	}
+
+	/*
+	 * Return to the caller using the same endianness. Extract
+	 * endianness bit from the respective system control register
+	 * directly.
+	 */
+	sctlr = from_el2 ? read_sctlr_el2() : read_sctlr_el1();
+	endianness = !!(sctlr & SCTLR_EE_BIT);
+
+	/* Construct SPSR for the exception state we're about to switch to */
+	if (caller_64) {
+		int impl;
+
+		/*
+		 * Switching from AArch64 to AArch32. Ensure this CPU implements
+		 * the target EL in AArch32.
+		 */
+		impl = from_el2 ? EL_IMPLEMENTED(2) : EL_IMPLEMENTED(1);
+		if (impl != EL_IMPL_A64_A32)
+			goto exec_denied;
+
+		/* Return to the equivalent AArch32 privilege level */
+		el = from_el2 ? MODE32_hyp : MODE32_svc;
+		spsr = SPSR_MODE32(el, thumb ? SPSR_T_THUMB : SPSR_T_ARM,
+				endianness, DISABLE_ALL_EXCEPTIONS);
+	} else {
+		/*
+		 * Switching from AArch32 to AArch64. Since it's not possible to
+		 * implement an EL as AArch32-only (from which this call was
+		 * raised), it's safe to assume AArch64 is also implemented.
+		 */
+		el = from_el2 ? MODE_EL2 : MODE_EL1;
+		spsr = SPSR_64(el, MODE_SP_ELX, DISABLE_ALL_EXCEPTIONS);
+	}
+
+	/*
+	 * Use the context management library to re-initialize the existing
+	 * context with the execution state flipped. Since the library takes
+	 * entry_point_info_t pointer as the argument, construct a dummy one
+	 * with PC, state width, endianness, security etc. appropriately set.
+	 * Other entries in the entry point structure are irrelevant for
+	 * purpose.
+	 */
+	zeromem(&ep, sizeof(ep));
+	ep.pc = pc;
+	ep.spsr = spsr;
+	SET_PARAM_HEAD(&ep, PARAM_EP, VERSION_1,
+			((endianness ? EP_EE_BIG : EP_EE_LITTLE) | NON_SECURE |
+			 EP_ST_DISABLE));
+
+	/*
+	 * Re-initialize the system register context, and exit EL3 as if for the
+	 * first time. State switch is effectively a soft reset of the
+	 * calling EL.
+	 */
+	cm_init_my_context(&ep);
+	cm_prepare_el3_exit(NON_SECURE);
+
+	/*
+	 * State switch success. The caller of SMC wouldn't see the SMC
+	 * returning. Instead, execution starts at the supplied entry point,
+	 * with context pointers populated in registers 0 and 1.
+	 */
+	SMC_RET2(handle, cookie_hi, cookie_lo);
+
+invalid_param:
+	SMC_RET1(handle, STATE_SW_E_PARAM);
+
+exec_denied:
+#endif
+	/* State switch denied */
+	SMC_RET1(handle, STATE_SW_E_DENIED);
+}
diff --git a/plat/mediatek/mt6795/bl31_plat_setup.c b/plat/mediatek/mt6795/bl31_plat_setup.c
index 2a4a7ed..a70d103 100644
--- a/plat/mediatek/mt6795/bl31_plat_setup.c
+++ b/plat/mediatek/mt6795/bl31_plat_setup.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2016-2017, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -336,20 +336,15 @@
 static entry_point_info_t *bl31_plat_get_next_kernel64_ep_info(void)
 {
 	entry_point_info_t *next_image_info;
-	unsigned long el_status;
 	unsigned int mode;
 
-	el_status = 0;
 	mode = 0;
 
 	/* Kernel image is always non-secured */
 	next_image_info = &bl33_image_ep_info;
 
 	/* Figure out what mode we enter the non-secure world in */
-	el_status = read_id_aa64pfr0_el1() >> ID_AA64PFR0_EL2_SHIFT;
-	el_status &= ID_AA64PFR0_ELX_MASK;
-
-	if (el_status) {
+	if (EL_IMPLEMENTED(2)) {
 		INFO("Kernel_EL2\n");
 		mode = MODE_EL2;
 	} else{
diff --git a/plat/qemu/qemu_bl2_setup.c b/plat/qemu/qemu_bl2_setup.c
index db3f731..2557a71 100644
--- a/plat/qemu/qemu_bl2_setup.c
+++ b/plat/qemu/qemu_bl2_setup.c
@@ -202,15 +202,11 @@
  ******************************************************************************/
 static uint32_t qemu_get_spsr_for_bl33_entry(void)
 {
-	unsigned long el_status;
 	unsigned int mode;
 	uint32_t spsr;
 
 	/* Figure out what mode we enter the non-secure world in */
-	el_status = read_id_aa64pfr0_el1() >> ID_AA64PFR0_EL2_SHIFT;
-	el_status &= ID_AA64PFR0_ELX_MASK;
-
-	mode = (el_status) ? MODE_EL2 : MODE_EL1;
+	mode = EL_IMPLEMENTED(2) ? MODE_EL2 : MODE_EL1;
 
 	/*
 	 * TODO: Consider the possibility of specifying the SPSR in
diff --git a/plat/rockchip/common/bl31_plat_setup.c b/plat/rockchip/common/bl31_plat_setup.c
index 9626a73..71d66c9 100644
--- a/plat/rockchip/common/bl31_plat_setup.c
+++ b/plat/rockchip/common/bl31_plat_setup.c
@@ -53,6 +53,11 @@
 		return NULL;
 }
 
+#pragma weak params_early_setup
+void params_early_setup(void *plat_param_from_bl2)
+{
+}
+
 /*******************************************************************************
  * Perform any BL3-1 early platform setup. Here is an opportunity to copy
  * parameters passed by the calling EL (S-EL1 in BL2 & S-EL3 in BL1) before they
diff --git a/plat/rockchip/common/drivers/parameter/ddr_parameter.c b/plat/rockchip/common/drivers/parameter/ddr_parameter.c
new file mode 100644
index 0000000..5069a92
--- /dev/null
+++ b/plat/rockchip/common/drivers/parameter/ddr_parameter.c
@@ -0,0 +1,131 @@
+/*
+ * Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <arch_helpers.h>
+#include <console.h>
+#include <debug.h>
+#include <delay_timer.h>
+#include <mmio.h>
+#include <platform_def.h>
+#include <plat_private.h>
+#include <soc.h>
+#include <string.h>
+#include "ddr_parameter.h"
+
+/*
+ *  The miniloader delivers the parameters about ddr usage info from address
+ * 0x02000000 and the data format is defined as below figure. It tells ATF the
+ * areas of ddr that are used by platform, we treat them as non-secure regions
+ * by default. Then we should parse the other part regions and configurate them
+ * as secure regions to avoid illegal access.
+ *
+ *			[ddr usage info data format]
+ * 0x02000000
+ * -----------------------------------------------------------------------------
+ * |       <name>        |  <size>   |      <description>                      |
+ * -----------------------------------------------------------------------------
+ * | count               |  4byte    | the array numbers of the                |
+ * |                     |           | 'addr_array' and 'size_array'           |
+ * -----------------------------------------------------------------------------
+ * | reserved            |  4byte    | just for 'addr_array' 8byte aligned     |
+ * -----------------------------------------------------------------------------
+ * | addr_array[count]   | per 8byte | memory region base address              |
+ * -----------------------------------------------------------------------------
+ * | size_array[count]   | per 8byte | memory region size (byte)               |
+ * -----------------------------------------------------------------------------
+ */
+
+/*
+ * function: read parameters info(ns-regions) and try to parse s-regions info
+ *
+ * @addr: head address to the ddr usage struct from miniloader
+ * @max_mb: the max ddr capacity(MB) that the platform support
+ */
+struct param_ddr_usage ddr_region_usage_parse(uint64_t addr, uint64_t max_mb)
+{
+	uint64_t base, top;
+	uint32_t i, addr_offset, size_offset;
+	struct param_ddr_usage p;
+
+	memset(&p, 0, sizeof(p));
+
+	/* read how many blocks of ns-regions, read from offset: 0x0 */
+	p.ns_nr = mmio_read_32(addr + REGION_NR_OFFSET);
+	if ((p.ns_nr > DDR_REGION_NR_MAX) || (p.ns_nr == 0)) {
+		ERROR("over or zero region, nr=%d, max=%d\n",
+		      p.ns_nr, DDR_REGION_NR_MAX);
+		return p;
+	}
+
+	/* whole ddr regions boundary, it will be used when parse s-regions */
+	p.boundary = max_mb;
+
+	/* calculate ns-region base addr and size offset */
+	addr_offset = REGION_ADDR_OFFSET;
+	size_offset = REGION_ADDR_OFFSET + p.ns_nr * REGION_DATA_PER_BYTES;
+
+	/* read all ns-regions base and top address */
+	for (i = 0; i < p.ns_nr; i++) {
+		base = mmio_read_64(addr + addr_offset);
+		top = base + mmio_read_64(addr + size_offset);
+		/*
+		 * translate byte to MB and store info,
+		 * Miniloader will promise every ns-region is MB aligned.
+		 */
+		p.ns_base[i] = RG_SIZE_MB(base);
+		p.ns_top[i] = RG_SIZE_MB(top);
+
+		addr_offset += REGION_DATA_PER_BYTES;
+		size_offset += REGION_DATA_PER_BYTES;
+	}
+
+	/*
+	 * a s-region's base starts from previous ns-region's top, and a
+	 * s-region's top ends with next ns-region's base. maybe like this:
+	 *
+	 *	   case1: ns-regison start from 0MB
+	 *	 -----------------------------------------------
+	 *	 |    ns0   |  S0  |  ns1  |   S1  |    ns2    |
+	 *	0----------------------------------------------- max_mb
+	 *
+	 *
+	 *	   case2: ns-regison not start from 0MB
+	 *	 -----------------------------------------------
+	 *	 |    S0   |  ns0  |  ns1  |   ns2  |    S1    |
+	 *	0----------------------------------------------- max_mb
+	 */
+
+	/* like above case2 figure, ns-region is not start from 0MB */
+	if (p.ns_base[0] != 0) {
+		p.s_base[p.s_nr] = 0;
+		p.s_top[p.s_nr] = p.ns_base[0];
+		p.s_nr++;
+	}
+
+	/*
+	 * notice: if ns-regions not start from 0MB, p.s_nr = 1 now, otherwise 0
+	 */
+	for (i = 0; i < p.ns_nr; i++) {
+		/*
+		 * if current ns-regions top covers boundary,
+		 * that means s-regions are all parsed yet, so finsh.
+		 */
+		if (p.ns_top[i] == p.boundary)
+			goto out;
+
+		/* s-region's base starts from previous ns-region's top */
+		p.s_base[p.s_nr] = p.ns_top[i];
+
+		/* s-region's top ends with next ns-region's base */
+		if (i + 1 < p.ns_nr)
+			p.s_top[p.s_nr] = p.ns_base[i + 1];
+		else
+			p.s_top[p.s_nr] = p.boundary;
+		p.s_nr++;
+	}
+out:
+	return p;
+}
diff --git a/plat/rockchip/common/drivers/parameter/ddr_parameter.h b/plat/rockchip/common/drivers/parameter/ddr_parameter.h
new file mode 100644
index 0000000..f8eacd4
--- /dev/null
+++ b/plat/rockchip/common/drivers/parameter/ddr_parameter.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#ifndef __PARAMETER_H__
+#define __PARAMETER_H__
+
+#include <arch_helpers.h>
+#include <console.h>
+#include <debug.h>
+#include <delay_timer.h>
+#include <mmio.h>
+#include <platform_def.h>
+#include <plat_private.h>
+#include <soc.h>
+#include <string.h>
+
+#define DDR_REGION_NR_MAX		10
+#define REGION_NR_OFFSET		0
+#define REGION_ADDR_OFFSET		8
+#define REGION_DATA_PER_BYTES		8
+#define RG_SIZE_MB(byte)		((byte) >> 20)
+
+/* unit: MB */
+struct param_ddr_usage {
+	uint64_t boundary;
+
+	uint32_t ns_nr;
+	uint64_t ns_base[DDR_REGION_NR_MAX];
+	uint64_t ns_top[DDR_REGION_NR_MAX];
+
+	uint32_t s_nr;
+	uint64_t s_base[DDR_REGION_NR_MAX];
+	uint64_t s_top[DDR_REGION_NR_MAX];
+};
+
+struct param_ddr_usage ddr_region_usage_parse(uint64_t addr, uint64_t max_mb);
+
+#endif /* __PARAMETER_H__ */
diff --git a/plat/rockchip/common/drivers/pmu/pmu_com.h b/plat/rockchip/common/drivers/pmu/pmu_com.h
index b426472..75e924d 100644
--- a/plat/rockchip/common/drivers/pmu/pmu_com.h
+++ b/plat/rockchip/common/drivers/pmu/pmu_com.h
@@ -7,6 +7,9 @@
 #ifndef __PMU_COM_H__
 #define __PMU_COM_H__
 
+#ifndef CHECK_CPU_WFIE_BASE
+#define CHECK_CPU_WFIE_BASE (PMU_BASE + PMU_CORE_PWR_ST)
+#endif
 /*
  * Use this macro to instantiate lock before it is used in below
  * rockchip_pd_lock_xxx() macros
@@ -90,13 +93,13 @@
 	else
 		wfie_msk <<= (clstl_cpu_wfe + cpu_id);
 
-	while (!(mmio_read_32(PMU_BASE + PMU_CORE_PWR_ST) & wfie_msk) &&
+	while (!(mmio_read_32(CHECK_CPU_WFIE_BASE) & wfie_msk) &&
 	       (loop < CHK_CPU_LOOP)) {
 		udelay(1);
 		loop++;
 	}
 
-	if ((mmio_read_32(PMU_BASE + PMU_CORE_PWR_ST) & wfie_msk) == 0) {
+	if ((mmio_read_32(CHECK_CPU_WFIE_BASE) & wfie_msk) == 0) {
 		WARN("%s: %d, %d, %d, error!\n", __func__,
 		     cluster_id, cpu_id, wfie_msk);
 		return -EINVAL;
diff --git a/plat/rockchip/common/plat_pm.c b/plat/rockchip/common/plat_pm.c
index 4625af8..4133fd0 100644
--- a/plat/rockchip/common/plat_pm.c
+++ b/plat/rockchip/common/plat_pm.c
@@ -367,6 +367,15 @@
 	rockchip_soc_system_off();
 }
 
+static void __dead2 rockchip_pd_pwr_down_wfi(
+		const psci_power_state_t *target_state)
+{
+	if (RK_SYSTEM_PWR_STATE(target_state) == PLAT_MAX_OFF_STATE)
+		rockchip_soc_sys_pd_pwr_dn_wfi();
+	else
+		rockchip_soc_cores_pd_pwr_dn_wfi(target_state);
+}
+
 /*******************************************************************************
  * Export the platform handlers via plat_rockchip_psci_pm_ops. The rockchip
  * standard
@@ -379,6 +388,7 @@
 	.pwr_domain_suspend = rockchip_pwr_domain_suspend,
 	.pwr_domain_on_finish = rockchip_pwr_domain_on_finish,
 	.pwr_domain_suspend_finish = rockchip_pwr_domain_suspend_finish,
+	.pwr_domain_pwr_down_wfi = rockchip_pd_pwr_down_wfi,
 	.system_reset = rockchip_system_reset,
 	.system_off = rockchip_system_poweroff,
 	.validate_power_state = rockchip_validate_power_state,
diff --git a/plat/rockchip/rk3328/drivers/pmu/plat_pmu_macros.S b/plat/rockchip/rk3328/drivers/pmu/plat_pmu_macros.S
new file mode 100644
index 0000000..cd604d2
--- /dev/null
+++ b/plat/rockchip/rk3328/drivers/pmu/plat_pmu_macros.S
@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <arch.h>
+#include <asm_macros.S>
+#include <platform_def.h>
+
+.globl	clst_warmboot_data
+
+.macro	func_rockchip_clst_warmboot
+.endm
+
+.macro rockchip_clst_warmboot_data
+clst_warmboot_data:
+	.rept	PLATFORM_CLUSTER_COUNT
+	.word	0
+	.endr
+.endm
diff --git a/plat/rockchip/rk3328/drivers/pmu/pmu.c b/plat/rockchip/rk3328/drivers/pmu/pmu.c
new file mode 100644
index 0000000..da013dd
--- /dev/null
+++ b/plat/rockchip/rk3328/drivers/pmu/pmu.c
@@ -0,0 +1,694 @@
+/*
+ * Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <arch_helpers.h>
+#include <debug.h>
+#include <assert.h>
+#include <bakery_lock.h>
+#include <bl31.h>
+#include <console.h>
+#include <delay_timer.h>
+#include <errno.h>
+#include <mmio.h>
+#include <platform.h>
+#include <platform_def.h>
+#include <plat_private.h>
+#include <pmu_sram.h>
+#include <pmu.h>
+#include <rk3328_def.h>
+#include <pmu_com.h>
+
+DEFINE_BAKERY_LOCK(rockchip_pd_lock);
+
+static struct psram_data_t *psram_sleep_cfg =
+		(struct psram_data_t *)PSRAM_DT_BASE;
+
+static struct rk3328_sleep_ddr_data ddr_data;
+static __sramdata struct rk3328_sleep_sram_data sram_data;
+
+static uint32_t cpu_warm_boot_addr;
+
+#pragma weak rk3328_pmic_suspend
+#pragma weak rk3328_pmic_resume
+
+void plat_rockchip_pmusram_prepare(void)
+{
+	uint32_t *sram_dst, *sram_src;
+	size_t sram_size = 2;
+	/*
+	 * pmu sram code and data prepare
+	 */
+	sram_dst = (uint32_t *)PMUSRAM_BASE;
+	sram_src = (uint32_t *)&pmu_cpuson_entrypoint_start;
+	sram_size = (uint32_t *)&pmu_cpuson_entrypoint_end -
+		    (uint32_t *)sram_src;
+	u32_align_cpy(sram_dst, sram_src, sram_size);
+
+	psram_sleep_cfg->sp = PSRAM_DT_BASE;
+}
+
+static inline uint32_t get_cpus_pwr_domain_cfg_info(uint32_t cpu_id)
+{
+	uint32_t pd_reg, apm_reg;
+
+	pd_reg = mmio_read_32(PMU_BASE + PMU_PWRDN_CON) & BIT(cpu_id);
+	apm_reg = mmio_read_32(PMU_BASE + PMU_CPUAPM_CON(cpu_id)) &
+			       BIT(core_pm_en);
+
+	if (pd_reg && !apm_reg)
+		return core_pwr_pd;
+	else if (!pd_reg && apm_reg)
+		return core_pwr_wfi;
+
+	ERROR("%s: 0x%x, 0x%x\n", __func__, pd_reg, apm_reg);
+	while (1)
+	;
+}
+
+static int cpus_power_domain_on(uint32_t cpu_id)
+{
+	uint32_t cpu_pd, cfg_info;
+
+	cpu_pd = PD_CPU0 + cpu_id;
+	cfg_info = get_cpus_pwr_domain_cfg_info(cpu_id);
+
+	if (cfg_info == core_pwr_pd) {
+		/* disable apm cfg */
+		mmio_write_32(PMU_BASE + PMU_CPUAPM_CON(cpu_id),
+			      CORES_PM_DISABLE);
+
+		/* if the cores have be on, power off it firstly */
+		if (pmu_power_domain_st(cpu_pd) == pmu_pd_on) {
+			mmio_write_32(PMU_BASE + PMU_CPUAPM_CON(cpu_id),
+				      CORES_PM_DISABLE);
+			pmu_power_domain_ctr(cpu_pd, pmu_pd_off);
+		}
+		pmu_power_domain_ctr(cpu_pd, pmu_pd_on);
+	} else {
+		if (pmu_power_domain_st(cpu_pd) == pmu_pd_on) {
+			WARN("%s: cpu%d is not in off,!\n", __func__, cpu_id);
+			return -EINVAL;
+		}
+
+		mmio_write_32(PMU_BASE + PMU_CPUAPM_CON(cpu_id),
+			      BIT(core_pm_sft_wakeup_en));
+	}
+
+	return 0;
+}
+
+static int cpus_power_domain_off(uint32_t cpu_id, uint32_t pd_cfg)
+{
+	uint32_t cpu_pd, core_pm_value;
+
+	cpu_pd = PD_CPU0 + cpu_id;
+	if (pmu_power_domain_st(cpu_pd) == pmu_pd_off)
+		return 0;
+
+	if (pd_cfg == core_pwr_pd) {
+		if (check_cpu_wfie(cpu_id, CKECK_WFEI_MSK))
+			return -EINVAL;
+		/* disable apm cfg */
+		mmio_write_32(PMU_BASE + PMU_CPUAPM_CON(cpu_id),
+			      CORES_PM_DISABLE);
+		pmu_power_domain_ctr(cpu_pd, pmu_pd_off);
+	} else {
+		core_pm_value = BIT(core_pm_en) | BIT(core_pm_dis_int);
+		if (pd_cfg == core_pwr_wfi_int)
+			core_pm_value |= BIT(core_pm_int_wakeup_en);
+
+		mmio_write_32(PMU_BASE + PMU_CPUAPM_CON(cpu_id),
+			      core_pm_value);
+	}
+
+	return 0;
+}
+
+static void nonboot_cpus_off(void)
+{
+	uint32_t boot_cpu, cpu;
+
+	/* turn off noboot cpus */
+	boot_cpu = plat_my_core_pos();
+	for (cpu = 0; cpu < PLATFORM_CORE_COUNT; cpu++) {
+		if (cpu == boot_cpu)
+			continue;
+		cpus_power_domain_off(cpu, core_pwr_pd);
+	}
+}
+
+int rockchip_soc_cores_pwr_dm_on(unsigned long mpidr, uint64_t entrypoint)
+{
+	uint32_t cpu_id = plat_core_pos_by_mpidr(mpidr);
+
+	assert(cpuson_flags[cpu_id] == 0);
+	cpuson_flags[cpu_id] = PMU_CPU_HOTPLUG;
+	cpuson_entry_point[cpu_id] = entrypoint;
+	dsb();
+
+	cpus_power_domain_on(cpu_id);
+
+	return 0;
+}
+
+int rockchip_soc_cores_pwr_dm_off(void)
+{
+	uint32_t cpu_id = plat_my_core_pos();
+
+	cpus_power_domain_off(cpu_id, core_pwr_wfi);
+
+	return 0;
+}
+
+int rockchip_soc_cores_pwr_dm_suspend(void)
+{
+	uint32_t cpu_id = plat_my_core_pos();
+
+	assert(cpuson_flags[cpu_id] == 0);
+	cpuson_flags[cpu_id] = PMU_CPU_AUTO_PWRDN;
+	cpuson_entry_point[cpu_id] = (uintptr_t)plat_get_sec_entrypoint();
+	dsb();
+
+	cpus_power_domain_off(cpu_id, core_pwr_wfi_int);
+
+	return 0;
+}
+
+int rockchip_soc_cores_pwr_dm_on_finish(void)
+{
+	uint32_t cpu_id = plat_my_core_pos();
+
+	mmio_write_32(PMU_BASE + PMU_CPUAPM_CON(cpu_id), CORES_PM_DISABLE);
+
+	return 0;
+}
+
+int rockchip_soc_cores_pwr_dm_resume(void)
+{
+	uint32_t cpu_id = plat_my_core_pos();
+
+	mmio_write_32(PMU_BASE + PMU_CPUAPM_CON(cpu_id), CORES_PM_DISABLE);
+
+	return 0;
+}
+
+void __dead2 rockchip_soc_soft_reset(void)
+{
+	mmio_write_32(CRU_BASE + CRU_CRU_MODE, PLL_SLOW_MODE(CPLL_ID));
+	mmio_write_32(CRU_BASE + CRU_CRU_MODE, PLL_SLOW_MODE(GPLL_ID));
+	mmio_write_32(CRU_BASE + CRU_CRU_MODE, PLL_SLOW_MODE(NPLL_ID));
+	mmio_write_32(CRU_BASE + CRU_CRU_MODE, PLL_SLOW_MODE(APLL_ID));
+	dsb();
+
+	mmio_write_32(CRU_BASE + CRU_GLB_SRST_FST, CRU_GLB_SRST_FST_VALUE);
+	dsb();
+	/*
+	 * Maybe the HW needs some times to reset the system,
+	 * so we do not hope the core to excute valid codes.
+	 */
+	while (1)
+		;
+}
+
+/*
+ * For PMIC RK805, its sleep pin is connect with gpio2_d2 from rk3328.
+ * If the PMIC is configed for responding the sleep pin to power off it,
+ * once the pin is output high,  it will get the pmic power off.
+ */
+void __dead2 rockchip_soc_system_off(void)
+{
+	uint32_t val;
+
+	/* gpio config */
+	val = mmio_read_32(GRF_BASE + GRF_GPIO2D_IOMUX);
+	val &= ~GPIO2_D2_GPIO_MODE;
+	mmio_write_32(GRF_BASE + GRF_GPIO2D_IOMUX, val);
+
+	/* config output */
+	val = mmio_read_32(GPIO2_BASE + SWPORTA_DDR);
+	val |= GPIO2_D2;
+	mmio_write_32(GPIO2_BASE + SWPORTA_DDR, val);
+
+	/* config output high level */
+	val = mmio_read_32(GPIO2_BASE);
+	val |= GPIO2_D2;
+	mmio_write_32(GPIO2_BASE, val);
+	dsb();
+
+	while (1)
+		;
+}
+
+static uint32_t clk_ungt_msk[CRU_CLKGATE_NUMS] = {
+	0x187f, 0x0000, 0x010c, 0x0000, 0x0200,
+	0x0010, 0x0000, 0x0017, 0x001f, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0003, 0x0000,
+	0xf001, 0x27c0, 0x04D9, 0x03ff, 0x0000,
+	0x0000, 0x0000, 0x0010, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0003, 0x0008
+};
+
+static void clks_gating_suspend(uint32_t *ungt_msk)
+{
+	int i;
+
+	for (i = 0; i < CRU_CLKGATE_NUMS; i++) {
+		ddr_data.clk_ungt_save[i] =
+			mmio_read_32(CRU_BASE + CRU_CLKGATE_CON(i));
+		mmio_write_32(CRU_BASE + CRU_CLKGATE_CON(i),
+			      ((~ungt_msk[i]) << 16) | 0xffff);
+	}
+}
+
+static void clks_gating_resume(void)
+{
+	int i;
+
+	for (i = 0; i < CRU_CLKGATE_NUMS; i++)
+		mmio_write_32(CRU_BASE + CRU_CLKGATE_CON(i),
+			      ddr_data.clk_ungt_save[i] | 0xffff0000);
+}
+
+static inline void pm_pll_wait_lock(uint32_t pll_id)
+{
+	uint32_t delay = PLL_LOCKED_TIMEOUT;
+
+	while (delay > 0) {
+		if (mmio_read_32(CRU_BASE + PLL_CONS(pll_id, 1)) &
+		    PLL_IS_LOCKED)
+			break;
+		delay--;
+	}
+	if (delay == 0)
+		ERROR("lock-pll: %d\n", pll_id);
+}
+
+static inline void pll_pwr_dwn(uint32_t pll_id, uint32_t pd)
+{
+	mmio_write_32(CRU_BASE + PLL_CONS(pll_id, 1),
+		      BITS_WITH_WMASK(1, 1, 15));
+	if (pd)
+		mmio_write_32(CRU_BASE + PLL_CONS(pll_id, 1),
+			      BITS_WITH_WMASK(1, 1, 14));
+	else
+		mmio_write_32(CRU_BASE + PLL_CONS(pll_id, 1),
+			      BITS_WITH_WMASK(0, 1, 14));
+}
+
+static __sramfunc void dpll_suspend(void)
+{
+	int i;
+
+	/* slow mode */
+	mmio_write_32(CRU_BASE + CRU_CRU_MODE, PLL_SLOW_MODE(DPLL_ID));
+
+	/* save pll con */
+	for (i = 0; i < CRU_PLL_CON_NUMS; i++)
+		sram_data.dpll_con_save[i] =
+				mmio_read_32(CRU_BASE + PLL_CONS(DPLL_ID, i));
+	mmio_write_32(CRU_BASE + PLL_CONS(DPLL_ID, 1),
+		      BITS_WITH_WMASK(1, 1, 15));
+	mmio_write_32(CRU_BASE + PLL_CONS(DPLL_ID, 1),
+		      BITS_WITH_WMASK(1, 1, 14));
+}
+
+static __sramfunc void dpll_resume(void)
+{
+	uint32_t delay = PLL_LOCKED_TIMEOUT;
+
+	mmio_write_32(CRU_BASE + PLL_CONS(DPLL_ID, 1),
+		      BITS_WITH_WMASK(1, 1, 15));
+	mmio_write_32(CRU_BASE + PLL_CONS(DPLL_ID, 1),
+		      BITS_WITH_WMASK(0, 1, 14));
+	mmio_write_32(CRU_BASE + PLL_CONS(DPLL_ID, 1),
+		      sram_data.dpll_con_save[1] | 0xc0000000);
+
+	dsb();
+
+	while (delay > 0) {
+		if (mmio_read_32(CRU_BASE + PLL_CONS(DPLL_ID, 1)) &
+				 PLL_IS_LOCKED)
+			break;
+		delay--;
+	}
+	if (delay == 0)
+		while (1)
+			;
+
+	mmio_write_32(CRU_BASE + CRU_CRU_MODE,
+		      PLL_NORM_MODE(DPLL_ID));
+}
+
+static inline void pll_suspend(uint32_t pll_id)
+{
+	int i;
+
+	/* slow mode */
+	mmio_write_32(CRU_BASE + CRU_CRU_MODE, PLL_SLOW_MODE(pll_id));
+
+	/* save pll con */
+	for (i = 0; i < CRU_PLL_CON_NUMS; i++)
+		ddr_data.cru_plls_con_save[pll_id][i] =
+				mmio_read_32(CRU_BASE + PLL_CONS(pll_id, i));
+
+	/* powerdown pll */
+	pll_pwr_dwn(pll_id, pmu_pd_off);
+}
+
+static inline void pll_resume(uint32_t pll_id)
+{
+	mmio_write_32(CRU_BASE + PLL_CONS(pll_id, 1),
+		      ddr_data.cru_plls_con_save[pll_id][1] | 0xc0000000);
+
+	pm_pll_wait_lock(pll_id);
+
+	if (PLL_IS_NORM_MODE(ddr_data.cru_mode_save, pll_id))
+		mmio_write_32(CRU_BASE + CRU_CRU_MODE,
+			      PLL_NORM_MODE(pll_id));
+}
+
+static void pm_plls_suspend(void)
+{
+	ddr_data.cru_mode_save = mmio_read_32(CRU_BASE + CRU_CRU_MODE);
+	ddr_data.clk_sel0 = mmio_read_32(CRU_BASE + CRU_CLKSEL_CON(0));
+	ddr_data.clk_sel1 = mmio_read_32(CRU_BASE + CRU_CLKSEL_CON(1));
+	ddr_data.clk_sel18 = mmio_read_32(CRU_BASE + CRU_CLKSEL_CON(18));
+	ddr_data.clk_sel20 = mmio_read_32(CRU_BASE + CRU_CLKSEL_CON(20));
+	ddr_data.clk_sel24 = mmio_read_32(CRU_BASE + CRU_CLKSEL_CON(24));
+	ddr_data.clk_sel38 = mmio_read_32(CRU_BASE + CRU_CLKSEL_CON(38));
+	pll_suspend(NPLL_ID);
+	pll_suspend(CPLL_ID);
+	pll_suspend(GPLL_ID);
+	pll_suspend(APLL_ID);
+
+	/* core */
+	mmio_write_32(CRU_BASE + CRU_CLKSEL_CON(0),
+		      BITS_WITH_WMASK(0, 0x1f, 0));
+
+	/* pclk_dbg */
+	mmio_write_32(CRU_BASE + CRU_CLKSEL_CON(1),
+		      BITS_WITH_WMASK(0, 0xf, 0));
+
+	/* crypto */
+	mmio_write_32(CRU_BASE + CRU_CLKSEL_CON(20),
+		      BITS_WITH_WMASK(0, 0x1f, 0));
+
+	/* pwm0 */
+	mmio_write_32(CRU_BASE + CRU_CLKSEL_CON(24),
+		      BITS_WITH_WMASK(0, 0x7f, 8));
+
+	/* uart2 from 24M */
+	mmio_write_32(CRU_BASE + CRU_CLKSEL_CON(18),
+		      BITS_WITH_WMASK(2, 0x3, 8));
+
+	/* clk_rtc32k */
+	mmio_write_32(CRU_BASE + CRU_CLKSEL_CON(38),
+		      BITS_WITH_WMASK(767, 0x3fff, 0) |
+		      BITS_WITH_WMASK(2, 0x3, 14));
+}
+
+static void pm_plls_resume(void)
+{
+	/* clk_rtc32k */
+	mmio_write_32(CRU_BASE + CRU_CLKSEL_CON(38),
+		      ddr_data.clk_sel38 |
+		      BITS_WMSK(0x3fff, 0) |
+		      BITS_WMSK(0x3, 14));
+
+	/* uart2 */
+	mmio_write_32(CRU_BASE + CRU_CLKSEL_CON(18),
+		      ddr_data.clk_sel18 | BITS_WMSK(0x3, 8));
+
+	/* pwm0 */
+	mmio_write_32(CRU_BASE + CRU_CLKSEL_CON(24),
+		      ddr_data.clk_sel24 | BITS_WMSK(0x7f, 8));
+
+	/* crypto */
+	mmio_write_32(CRU_BASE + CRU_CLKSEL_CON(20),
+		      ddr_data.clk_sel20 | BITS_WMSK(0x1f, 0));
+
+	/* pclk_dbg */
+	mmio_write_32(CRU_BASE + CRU_CLKSEL_CON(1),
+		      ddr_data.clk_sel1 | BITS_WMSK(0xf, 0));
+
+	/* core */
+	mmio_write_32(CRU_BASE + CRU_CLKSEL_CON(0),
+		      ddr_data.clk_sel0 | BITS_WMSK(0x1f, 0));
+
+	pll_pwr_dwn(APLL_ID, pmu_pd_on);
+	pll_pwr_dwn(GPLL_ID, pmu_pd_on);
+	pll_pwr_dwn(CPLL_ID, pmu_pd_on);
+	pll_pwr_dwn(NPLL_ID, pmu_pd_on);
+
+	pll_resume(APLL_ID);
+	pll_resume(GPLL_ID);
+	pll_resume(CPLL_ID);
+	pll_resume(NPLL_ID);
+}
+
+#define ARCH_TIMER_TICKS_PER_US (SYS_COUNTER_FREQ_IN_TICKS / 1000000)
+
+static __sramfunc void sram_udelay(uint32_t us)
+{
+	uint64_t pct_orig, pct_now;
+	uint64_t to_wait = ARCH_TIMER_TICKS_PER_US * us;
+
+	isb();
+	pct_orig = read_cntpct_el0();
+
+	do {
+		isb();
+		pct_now = read_cntpct_el0();
+	} while ((pct_now - pct_orig) <= to_wait);
+}
+
+/*
+ * For PMIC RK805, its sleep pin is connect with gpio2_d2 from rk3328.
+ * If the PMIC is configed for responding the sleep pin
+ * to get it into sleep mode,
+ * once the pin is output high,  it will get the pmic into sleep mode.
+ */
+__sramfunc void rk3328_pmic_suspend(void)
+{
+	sram_data.pmic_sleep_save = mmio_read_32(GRF_BASE + PMIC_SLEEP_REG);
+	sram_data.pmic_sleep_gpio_save[1] = mmio_read_32(GPIO2_BASE + 4);
+	sram_data.pmic_sleep_gpio_save[0] = mmio_read_32(GPIO2_BASE);
+	mmio_write_32(GRF_BASE + PMIC_SLEEP_REG, BITS_WITH_WMASK(0, 0x3, 4));
+	mmio_write_32(GPIO2_BASE + 4,
+		      sram_data.pmic_sleep_gpio_save[1] | BIT(26));
+	mmio_write_32(GPIO2_BASE,
+		      sram_data.pmic_sleep_gpio_save[0] | BIT(26));
+}
+
+__sramfunc void  rk3328_pmic_resume(void)
+{
+	mmio_write_32(GPIO2_BASE, sram_data.pmic_sleep_gpio_save[0]);
+	mmio_write_32(GPIO2_BASE + 4, sram_data.pmic_sleep_gpio_save[1]);
+	mmio_write_32(GRF_BASE + PMIC_SLEEP_REG,
+		      sram_data.pmic_sleep_save | BITS_WMSK(0xffff, 0));
+	/* Resuming volt need a lot of time */
+	sram_udelay(100);
+}
+
+static inline void rockchip_set_sram_sp(uint64_t set_sp)
+{
+	__asm volatile("mov sp, %0\n"::"r" (set_sp) : "sp");
+}
+
+static __sramfunc void ddr_suspend(void)
+{
+	sram_data.pd_sr_idle_save = mmio_read_32(DDR_UPCTL_BASE +
+						 DDR_PCTL2_PWRCTL);
+	sram_data.pd_sr_idle_save &= SELFREF_EN;
+
+	mmio_clrbits_32(DDR_UPCTL_BASE + DDR_PCTL2_PWRCTL, SELFREF_EN);
+	sram_data.ddr_grf_con0 = mmio_read_32(DDR_GRF_BASE +
+					      DDRGRF_SOC_CON(0));
+	mmio_write_32(DDR_GRF_BASE, BIT_WITH_WMSK(14) | WMSK_BIT(15));
+
+	/*
+	 * Override csysreq from ddrc and
+	 * send valid csysreq signal to PMU,
+	 * csysreq is controlled by ddrc only
+	 */
+
+	/* in self-refresh */
+	mmio_setbits_32(PMU_BASE + PMU_SFT_CON, BIT(0));
+	while ((mmio_read_32(DDR_GRF_BASE + DDRGRF_SOC_STATUS(1)) &
+	       (0x03 << 12)) !=  (0x02 << 12))
+		;
+	/* ddr retention */
+	mmio_setbits_32(PMU_BASE + PMU_SFT_CON, BIT(2));
+
+	/* ddr gating */
+	mmio_write_32(CRU_BASE + CRU_CLKGATE_CON(0),
+		      BITS_WITH_WMASK(0x7, 0x7, 4));
+	mmio_write_32(CRU_BASE + CRU_CLKGATE_CON(7),
+		      BITS_WITH_WMASK(1, 1, 4));
+	mmio_write_32(CRU_BASE + CRU_CLKGATE_CON(18),
+		      BITS_WITH_WMASK(0x1ff, 0x1ff, 1));
+	mmio_write_32(CRU_BASE + CRU_CLKGATE_CON(27),
+		      BITS_WITH_WMASK(0x3, 0x3, 0));
+
+	dpll_suspend();
+}
+
+static __sramfunc  void ddr_resume(void)
+{
+	dpll_resume();
+
+	/* ddr gating */
+	mmio_write_32(CRU_BASE + CRU_CLKGATE_CON(0),
+		      BITS_WITH_WMASK(0, 0x7, 4));
+	mmio_write_32(CRU_BASE + CRU_CLKGATE_CON(7),
+		      BITS_WITH_WMASK(0, 1, 4));
+	mmio_write_32(CRU_BASE + CRU_CLKGATE_CON(18),
+		      BITS_WITH_WMASK(0, 0x1ff, 1));
+	mmio_write_32(CRU_BASE + CRU_CLKGATE_CON(27),
+		      BITS_WITH_WMASK(0, 0x3, 0));
+
+	/* ddr de_retention */
+	mmio_clrbits_32(PMU_BASE + PMU_SFT_CON, BIT(2));
+	/* exit self-refresh */
+	mmio_clrbits_32(PMU_BASE + PMU_SFT_CON, BIT(0));
+	while ((mmio_read_32(DDR_GRF_BASE + DDRGRF_SOC_STATUS(1)) &
+		(0x03 << 12)) !=  (0x00 << 12))
+		;
+
+	mmio_write_32(DDR_GRF_BASE, sram_data.ddr_grf_con0 | 0xc0000000);
+	if (sram_data.pd_sr_idle_save)
+		mmio_setbits_32(DDR_UPCTL_BASE + DDR_PCTL2_PWRCTL,
+				SELFREF_EN);
+}
+
+static __sramfunc void sram_dbg_uart_suspend(void)
+{
+	sram_data.uart2_ier = mmio_read_32(UART2_BASE + UART_IER);
+	mmio_write_32(UART2_BASE + UART_IER, UART_INT_DISABLE);
+	mmio_write_32(CRU_BASE + CRU_CLKGATE_CON(16), 0x20002000);
+	mmio_write_32(CRU_BASE + CRU_CLKGATE_CON(2), 0x00040004);
+}
+
+static __sramfunc void sram_dbg_uart_resume(void)
+{
+	/* restore uart clk and reset fifo */
+	mmio_write_32(CRU_BASE + CRU_CLKGATE_CON(16), 0x20000000);
+	mmio_write_32(CRU_BASE + CRU_CLKGATE_CON(2), 0x00040000);
+	mmio_write_32(UART2_BASE + UART_FCR, UART_FIFO_RESET);
+	mmio_write_32(UART2_BASE + UART_IER, sram_data.uart2_ier);
+}
+
+static __sramfunc void sram_soc_enter_lp(void)
+{
+	uint32_t apm_value;
+
+	apm_value = BIT(core_pm_en) |
+		    BIT(core_pm_dis_int) |
+		    BIT(core_pm_int_wakeup_en);
+	mmio_write_32(PMU_BASE + PMU_CPUAPM_CON(PD_CPU0), apm_value);
+
+	dsb();
+	isb();
+err_loop:
+	wfi();
+	/*
+	 *Soc will enter low power mode and
+	 *do not return to here.
+	 */
+	goto err_loop;
+}
+
+__sramfunc void sram_suspend(void)
+{
+	/* disable mmu and icache */
+	tlbialle3();
+	disable_mmu_icache_el3();
+
+	mmio_write_32(SGRF_BASE + SGRF_SOC_CON(1),
+		      (PMUSRAM_BASE >> CPU_BOOT_ADDR_ALIGN) |
+		      CPU_BOOT_ADDR_WMASK);
+
+	/* ddr self-refresh and gating phy */
+	ddr_suspend();
+
+	rk3328_pmic_suspend();
+
+	sram_dbg_uart_suspend();
+
+	sram_soc_enter_lp();
+}
+
+static __sramfunc void sys_resume_first(void)
+{
+	sram_dbg_uart_resume();
+
+	rk3328_pmic_resume();
+
+	/* ddr self-refresh exit */
+	ddr_resume();
+
+	/* disable apm cfg */
+	mmio_write_32(PMU_BASE + PMU_CPUAPM_CON(0), CORES_PM_DISABLE);
+
+	/* the warm booting address of cpus */
+	mmio_write_32(SGRF_BASE + SGRF_SOC_CON(1),
+		      (cpu_warm_boot_addr >> CPU_BOOT_ADDR_ALIGN) |
+		      CPU_BOOT_ADDR_WMASK);
+}
+
+void __dead2 rockchip_soc_sys_pd_pwr_dn_wfi(void)
+{
+	rockchip_set_sram_sp(PSRAM_DT_BASE);
+
+	sram_suspend();
+
+	/* should never reach here */
+	psci_power_down_wfi();
+}
+
+int rockchip_soc_sys_pwr_dm_suspend(void)
+{
+	clks_gating_suspend(clk_ungt_msk);
+
+	pm_plls_suspend();
+
+	return 0;
+}
+
+int rockchip_soc_sys_pwr_dm_resume(void)
+{
+	pm_plls_resume();
+
+	clks_gating_resume();
+
+	plat_rockchip_gic_cpuif_enable();
+
+	return 0;
+}
+
+void plat_rockchip_pmu_init(void)
+{
+	uint32_t cpu;
+
+	for (cpu = 0; cpu < PLATFORM_CORE_COUNT; cpu++)
+		cpuson_flags[cpu] = 0;
+
+	cpu_warm_boot_addr = (uint64_t)platform_cpu_warmboot;
+	psram_sleep_cfg->ddr_func = (uint64_t)sys_resume_first;
+	psram_sleep_cfg->ddr_data = 0x00;
+	psram_sleep_cfg->ddr_flag = 0x01;
+	psram_sleep_cfg->boot_mpidr = read_mpidr_el1() & 0xffff;
+
+	/* the warm booting address of cpus */
+	mmio_write_32(SGRF_BASE + SGRF_SOC_CON(1),
+		      (cpu_warm_boot_addr >> CPU_BOOT_ADDR_ALIGN) |
+		      CPU_BOOT_ADDR_WMASK);
+
+	nonboot_cpus_off();
+
+	INFO("%s: pd status 0x%x\n",
+	     __func__, mmio_read_32(PMU_BASE + PMU_PWRDN_ST));
+}
diff --git a/plat/rockchip/rk3328/drivers/pmu/pmu.h b/plat/rockchip/rk3328/drivers/pmu/pmu.h
new file mode 100644
index 0000000..9d2819a
--- /dev/null
+++ b/plat/rockchip/rk3328/drivers/pmu/pmu.h
@@ -0,0 +1,131 @@
+/*
+ * Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#ifndef __PMU_H__
+#define __PMU_H__
+
+#include <soc.h>
+
+struct rk3328_sleep_ddr_data {
+	uint32_t pmu_debug_enable;
+	uint32_t debug_iomux_save;
+	uint32_t pmic_sleep_save;
+	uint32_t pmu_wakeup_conf0;
+	uint32_t pmu_pwrmd_com;
+	uint32_t cru_mode_save;
+	uint32_t clk_sel0, clk_sel1, clk_sel18,
+		 clk_sel20, clk_sel24, clk_sel38;
+	uint32_t clk_ungt_save[CRU_CLKGATE_NUMS];
+	uint32_t cru_plls_con_save[MAX_PLL][CRU_PLL_CON_NUMS];
+};
+
+struct rk3328_sleep_sram_data {
+	uint32_t pmic_sleep_save;
+	uint32_t pmic_sleep_gpio_save[2];
+	uint32_t ddr_grf_con0;
+	uint32_t dpll_con_save[CRU_PLL_CON_NUMS];
+	uint32_t pd_sr_idle_save;
+	uint32_t uart2_ier;
+};
+
+/*****************************************************************************
+ * The ways of cores power domain contorlling
+ *****************************************************************************/
+enum cores_pm_ctr_mode {
+	core_pwr_pd = 0,
+	core_pwr_wfi = 1,
+	core_pwr_wfi_int = 2
+};
+
+enum pmu_cores_pm_by_wfi {
+	core_pm_en = 0,
+	core_pm_int_wakeup_en,
+	core_pm_dis_int,
+	core_pm_sft_wakeup_en
+};
+
+extern void *pmu_cpuson_entrypoint_start;
+extern void *pmu_cpuson_entrypoint_end;
+extern uint64_t cpuson_entry_point[PLATFORM_CORE_COUNT];
+extern uint32_t cpuson_flags[PLATFORM_CORE_COUNT];
+
+#define CORES_PM_DISABLE	0x0
+
+/*****************************************************************************
+ * pmu con,reg
+ *****************************************************************************/
+#define PMU_WAKEUP_CFG0		0x00
+#define PMU_PWRDN_CON		0x0c
+#define PMU_PWRDN_ST		0x10
+#define PMU_PWRMD_COM		0x18
+#define PMU_SFT_CON		0x1c
+#define PMU_INT_CON		0x20
+#define PMU_INT_ST		0x24
+#define PMU_POWER_ST		0x44
+#define PMU_CPUAPM_CON(n)	(0x80 + (n) * 4)
+#define PMU_SYS_REG(n)		(0xa0 + (n) * 4)
+
+#define CHECK_CPU_WFIE_BASE		(GRF_BASE + GRF_CPU_STATUS(1))
+
+enum pmu_core_pwrst_shift {
+	clst_cpu_wfe = 0,
+	clst_cpu_wfi = 4,
+};
+
+#define clstl_cpu_wfe (clst_cpu_wfe)
+#define clstb_cpu_wfe (clst_cpu_wfe)
+
+enum pmu_pd_id {
+	PD_CPU0 = 0,
+	PD_CPU1,
+	PD_CPU2,
+	PD_CPU3,
+};
+
+enum pmu_power_mode_common {
+	pmu_mode_en = 0,
+	sref_enter_en,
+	global_int_disable_cfg,
+	cpu0_pd_en,
+	wait_wakeup_begin_cfg = 4,
+	l2_flush_en,
+	l2_idle_en,
+	ddrio_ret_de_req,
+	ddrio_ret_en = 8,
+};
+
+enum pmu_sft_con {
+	upctl_c_sysreq_cfg = 0,
+	l2flushreq_req,
+	ddr_io_ret_cfg,
+	pmu_sft_ret_cfg,
+};
+
+#define CKECK_WFE_MSK		0x1
+#define CKECK_WFI_MSK		0x10
+#define CKECK_WFEI_MSK		0x11
+
+#define PD_CTR_LOOP		500
+#define CHK_CPU_LOOP		500
+#define MAX_WAIT_CONUT		1000
+
+#define WAKEUP_INT_CLUSTER_EN	0x1
+#define PMIC_SLEEP_REG		0x34
+
+#define PLL_IS_NORM_MODE(mode, pll_id)	\
+		((mode & (PLL_NORM_MODE(pll_id)) & 0xffff) != 0)
+
+#define CTLR_ENABLE_G1_BIT	BIT(1)
+#define UART_FIFO_EMPTY		BIT(6)
+
+#define UART_IER		0x04
+#define UART_FCR		0x08
+#define UART_LSR		0x14
+
+#define UART_INT_DISABLE	0x00
+#define UART_FIFO_RESET		0x07
+
+#endif /* __PMU_H__ */
diff --git a/plat/rockchip/rk3328/drivers/soc/soc.c b/plat/rockchip/rk3328/drivers/soc/soc.c
new file mode 100644
index 0000000..d4cba99
--- /dev/null
+++ b/plat/rockchip/rk3328/drivers/soc/soc.c
@@ -0,0 +1,150 @@
+/*
+ * Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <arch_helpers.h>
+#include <console.h>
+#include <debug.h>
+#include <delay_timer.h>
+#include <mmio.h>
+#include <platform_def.h>
+#include <plat_private.h>
+#include <ddr_parameter.h>
+#include <rk3328_def.h>
+#include <soc.h>
+
+/* Table of regions to map using the MMU. */
+const mmap_region_t plat_rk_mmap[] = {
+	MAP_REGION_FLAT(UART2_BASE, UART2_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE),
+	MAP_REGION_FLAT(PMU_BASE, PMU_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE),
+	MAP_REGION_FLAT(SGRF_BASE, SGRF_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE),
+	MAP_REGION_FLAT(GPIO0_BASE, GPIO0_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE),
+	MAP_REGION_FLAT(GPIO1_BASE, GPIO1_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE),
+	MAP_REGION_FLAT(GPIO2_BASE, GPIO2_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE),
+	MAP_REGION_FLAT(GPIO3_BASE, GPIO3_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE),
+	MAP_REGION_FLAT(CRU_BASE, CRU_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE),
+	MAP_REGION_FLAT(GRF_BASE, GRF_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE),
+	MAP_REGION_FLAT(FIREWALL_DDR_BASE, FIREWALL_DDR_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE),
+	MAP_REGION_FLAT(FIREWALL_CFG_BASE, FIREWALL_CFG_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE),
+	MAP_REGION_FLAT(STIME_BASE, STIME_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE),
+	MAP_REGION_FLAT(GIC400_BASE, GIC400_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE),
+	MAP_REGION_FLAT(PMUSRAM_BASE, PMUSRAM_SIZE,
+			MT_MEMORY | MT_RW | MT_SECURE),
+	MAP_REGION_FLAT(SHARE_MEM_BASE, SHARE_MEM_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE),
+	MAP_REGION_FLAT(DDR_GRF_BASE, DDR_GRF_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE),
+	MAP_REGION_FLAT(DDR_UPCTL_BASE, DDR_UPCTL_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE),
+	MAP_REGION_FLAT(PWM_BASE, PWM_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE),
+	MAP_REGION_FLAT(DDR_PARAM_BASE, DDR_PARAM_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE),
+	MAP_REGION_FLAT(EFUSE8_BASE, EFUSE8_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE),
+	MAP_REGION_FLAT(EFUSE32_BASE, EFUSE32_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE),
+	MAP_REGION_FLAT(DDR_PHY_BASE, DDR_PHY_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE),
+	MAP_REGION_FLAT(SERVER_MSCH_BASE, SERVER_MSCH_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE),
+	MAP_REGION_FLAT(DDR_MONITOR_BASE, DDR_MONITOR_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE),
+	MAP_REGION_FLAT(VOP_BASE, VOP_SIZE,
+			MT_DEVICE | MT_RW | MT_SECURE),
+
+	{ 0 }
+};
+
+/* The RockChip power domain tree descriptor */
+const unsigned char rockchip_power_domain_tree_desc[] = {
+	/* No of root nodes */
+	PLATFORM_SYSTEM_COUNT,
+	/* No of children for the root node */
+	PLATFORM_CLUSTER_COUNT,
+	/* No of children for the first cluster node */
+	PLATFORM_CLUSTER0_CORE_COUNT,
+};
+
+void secure_timer_init(void)
+{
+	mmio_write_32(STIMER_CHN_BASE(1) + TIMER_LOADE_COUNT0, 0xffffffff);
+	mmio_write_32(STIMER_CHN_BASE(1) + TIMER_LOADE_COUNT1, 0xffffffff);
+	/* auto reload & enable the timer */
+	mmio_write_32(STIMER_CHN_BASE(1) + TIMER_CONTROL_REG, TIMER_EN);
+}
+
+void sgrf_init(void)
+{
+	uint32_t i, val;
+	struct param_ddr_usage usg;
+
+	/* general secure regions */
+	usg = ddr_region_usage_parse(DDR_PARAM_BASE,
+				     PLAT_MAX_DDR_CAPACITY_MB);
+	for (i = 0; i < usg.s_nr; i++) {
+		/* enable secure */
+		val = mmio_read_32(FIREWALL_DDR_BASE +
+			      FIREWALL_DDR_FW_DDR_CON_REG);
+		val |= BIT(7 - i);
+		mmio_write_32(FIREWALL_DDR_BASE +
+			      FIREWALL_DDR_FW_DDR_CON_REG, val);
+		/* map top and base */
+		mmio_write_32(FIREWALL_DDR_BASE +
+			      FIREWALL_DDR_FW_DDR_RGN(7 - i),
+			      RG_MAP_SECURE(usg.s_top[i], usg.s_base[i]));
+	}
+
+	/* set ddr rgn0_top and rga0_top as 0 */
+	mmio_write_32(FIREWALL_DDR_BASE + FIREWALL_DDR_FW_DDR_RGN(0), 0x0);
+
+	/* set all slave ip into no-secure, except stimer */
+	mmio_write_32(FIREWALL_CFG_BASE + FIREWALL_CFG_FW_SYS_CON(0),
+		      SGRF_SLV_S_ALL_NS);
+	mmio_write_32(FIREWALL_CFG_BASE + FIREWALL_CFG_FW_SYS_CON(1),
+		      SGRF_SLV_S_ALL_NS);
+	mmio_write_32(FIREWALL_CFG_BASE + FIREWALL_CFG_FW_SYS_CON(2),
+		      SGRF_SLV_S_ALL_NS | STIMER_S);
+	mmio_write_32(FIREWALL_CFG_BASE + FIREWALL_CFG_FW_SYS_CON(3),
+		      SGRF_SLV_S_ALL_NS);
+
+	/* set all master ip into no-secure */
+	mmio_write_32(SGRF_BASE + SGRF_SOC_CON(2), 0xf0000000);
+	mmio_write_32(SGRF_BASE + SGRF_SOC_CON(3), SGRF_MST_S_ALL_NS);
+	mmio_write_32(SGRF_BASE + SGRF_SOC_CON(4), SGRF_MST_S_ALL_NS);
+
+	/* set DMAC into no-secure */
+	mmio_write_32(SGRF_BASE + SGRF_DMAC_CON(3), DMA_IRQ_BOOT_NS);
+	mmio_write_32(SGRF_BASE + SGRF_DMAC_CON(4), DMA_PERI_CH_NS_15_0);
+	mmio_write_32(SGRF_BASE + SGRF_DMAC_CON(5), DMA_PERI_CH_NS_19_16);
+	mmio_write_32(SGRF_BASE + SGRF_DMAC_CON(5), DMA_MANAGER_BOOT_NS);
+
+	/* soft reset dma before use */
+	mmio_write_32(CRU_BASE + CRU_SOFTRSTS_CON(3), DMA_SOFTRST_REQ);
+	udelay(5);
+	mmio_write_32(CRU_BASE + CRU_SOFTRSTS_CON(3), DMA_SOFTRST_RLS);
+}
+
+void plat_rockchip_soc_init(void)
+{
+	secure_timer_init();
+	sgrf_init();
+
+	NOTICE("BL31:Rockchip release version: v%d.%d\n",
+	       MAJOR_VERSION, MINOR_VERSION);
+}
diff --git a/plat/rockchip/rk3328/drivers/soc/soc.h b/plat/rockchip/rk3328/drivers/soc/soc.h
new file mode 100644
index 0000000..2c04ae2
--- /dev/null
+++ b/plat/rockchip/rk3328/drivers/soc/soc.h
@@ -0,0 +1,113 @@
+/*
+ * Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#ifndef __SOC_H__
+#define __SOC_H__
+
+/******************************* stimer ***************************************/
+#define TIMER_LOADE_COUNT0	0x00
+#define TIMER_LOADE_COUNT1	0x04
+#define TIMER_CURRENT_VALUE0	0x08
+#define TIMER_CURRENT_VALUE1	0x0C
+#define TIMER_CONTROL_REG	0x10
+#define TIMER_INTSTATUS		0x18
+#define TIMER_EN		0x1
+
+extern const unsigned char rockchip_power_domain_tree_desc[];
+
+/**************************** read/write **************************************/
+#ifndef BITS_WMSK
+#define BITS_WMSK(msk, shift)	((msk) << (shift + REG_MSK_SHIFT))
+#endif
+
+/**************************** cru *********************************************/
+enum plls_id {
+	APLL_ID = 0,
+	DPLL_ID,
+	CPLL_ID,
+	GPLL_ID,
+	REVERVE,
+	NPLL_ID,
+	MAX_PLL,
+};
+
+#define CRU_CRU_MODE		0x0080
+#define CRU_CRU_MISC		0x0084
+#define CRU_GLB_SRST_FST	0x009c
+#define CRU_GLB_SRST_FST_VALUE	0xfdb9
+#define PLL_CONS(id, i)		(0x020 * (id) + ((i) * 4))
+#define CRU_CLKSEL_CON(i)	(0x100 + ((i) * 4))
+#define CRU_CLKSEL_NUMS		53
+#define CRU_CLKGATE_CON(i)	(0x200 + ((i) * 4))
+#define CRU_CLKGATE_NUMS	29
+#define CRU_SOFTRSTS_CON(n)	(0x300 + ((n) * 4))
+#define CRU_SOFTRSTS_NUMS	12
+#define CRU_PLL_CON_NUMS	5
+
+/* PLLn_CON1 */
+#define PLL_IS_LOCKED		BIT(10)
+/* PLLn_CON0 */
+#define PLL_BYPASS		BITS_WITH_WMASK(1, 0x1, 15)
+#define PLL_NO_BYPASS		BITS_WITH_WMASK(0, 0x1, 15)
+/* CRU_MODE */
+#define PLL_SLOW_MODE(id)	((id) == NPLL_ID) ?		\
+				BITS_WITH_WMASK(0, 0x1, 1) :	\
+				BITS_WITH_WMASK(0, 0x1, ((id) * 4))
+#define PLL_NORM_MODE(id)	((id) == NPLL_ID) ?		\
+				BITS_WITH_WMASK(1, 0x1, 1) :	\
+				BITS_WITH_WMASK(1, 0x1, ((id) * 4))
+
+#define CRU_GATEID_CONS(ID)	(0x200 + (ID / 16) * 4)
+#define CRU_CONS_GATEID(i)	(16 * (i))
+#define GATE_ID(reg, bit)	((reg * 16) + bit)
+
+#define PLL_LOCKED_TIMEOUT 600000U
+
+#define STIMER_CHN_BASE(n)	(STIME_BASE + 0x20 * (n))
+/************************** config regs ***************************************/
+#define FIREWALL_CFG_FW_SYS_CON(n)	(0x000 + (n) * 4)
+#define FIREWALL_DDR_FW_DDR_RGN(n)	(0x000 + (n) * 4)
+#define FIREWALL_DDR_FW_DDR_MST(n)	(0x020 + (n) * 4)
+#define FIREWALL_DDR_FW_DDR_CON_REG	(0x040)
+#define GRF_SOC_CON(n)			(0x400 + (n) * 4)
+#define GRF_SOC_STATUS(n)		(0x480 + (n) * 4)
+#define GRF_CPU_STATUS(n)		(0x520 + (n) * 4)
+#define GRF_OS_REG(n)			(0x5c8 + (n) * 4)
+#define DDRGRF_SOC_CON(n)		(0x000 + (n) * 4)
+#define DDRGRF_SOC_STATUS(n)		(0x100 + (n) * 4)
+#define SGRF_SOC_CON(n)			(0x000 + (n) * 4)
+#define SGRF_DMAC_CON(n)		(0x100 + (n) * 4)
+#define SGRF_HDCP_KEY_CON(n)		(0x280 + (n) * 4)
+
+#define DDR_PCTL2_PWRCTL		0x30
+/************************** regs func *****************************************/
+#define STIMER_S			BIT(23)
+#define SGRF_SLV_S_ALL_NS		0x0
+#define SGRF_MST_S_ALL_NS		0xffffffff
+#define DMA_IRQ_BOOT_NS			0xffffffff
+#define DMA_MANAGER_BOOT_NS		0x80008000
+#define DMA_PERI_CH_NS_15_0		0xffffffff
+#define DMA_PERI_CH_NS_19_16		0x000f000f
+#define DMA_SOFTRST_REQ			0x01000100
+#define DMA_SOFTRST_RLS			0x01000000
+
+#define SELFREF_EN			BIT(0)
+/************************** cpu ***********************************************/
+#define CPU_BOOT_ADDR_WMASK		0xffff0000
+#define CPU_BOOT_ADDR_ALIGN		16
+
+/************************** ddr secure region *********************************/
+#define PLAT_MAX_DDR_CAPACITY_MB	4096
+#define RG_MAP_SECURE(top, base)	((((top) - 1) << 16) | (base))
+
+/************************** gpio2_d2 ******************************************/
+#define SWPORTA_DR		0x00
+#define SWPORTA_DDR		0x04
+#define GPIO2_D2		BIT(26)
+#define GPIO2_D2_GPIO_MODE	0x30
+#define GRF_GPIO2D_IOMUX	0x34
+
+#endif /* __SOC_H__ */
diff --git a/plat/rockchip/rk3328/include/plat.ld.S b/plat/rockchip/rk3328/include/plat.ld.S
new file mode 100644
index 0000000..ff17572
--- /dev/null
+++ b/plat/rockchip/rk3328/include/plat.ld.S
@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+#ifndef __ROCKCHIP_PLAT_LD_S__
+#define __ROCKCHIP_PLAT_LD_S__
+
+MEMORY {
+    SRAM (rwx): ORIGIN = SRAM_LDS_BASE, LENGTH = SRAM_LDS_SIZE
+}
+
+SECTIONS
+{
+	. = SRAM_LDS_BASE;
+	ASSERT(. == ALIGN(4096),
+		"SRAM_BASE address is not aligned on a page boundary.")
+
+	/*
+	 * The SRAM space allocation for RK3328
+	 * ----------------
+	 * | sram text
+	 * ----------------
+	 * | sram data
+	 * ----------------
+	 */
+	.text_sram : ALIGN(4096) {
+		__bl31_sram_text_start = .;
+		*(.sram.text)
+		*(.sram.rodata)
+		. = ALIGN(4096);
+		__bl31_sram_text_end = .;
+	} >SRAM
+
+	.data_sram : ALIGN(4096) {
+		__bl31_sram_data_start = .;
+		*(.sram.data)
+		. = ALIGN(4096);
+		__bl31_sram_data_end = .;
+	} >SRAM
+	__sram_incbin_start = .;
+	__sram_incbin_end = .;
+}
+
+#endif /* __ROCKCHIP_PLAT_LD_S__ */
diff --git a/plat/rockchip/rk3328/include/platform_def.h b/plat/rockchip/rk3328/include/platform_def.h
new file mode 100644
index 0000000..1f49fcd
--- /dev/null
+++ b/plat/rockchip/rk3328/include/platform_def.h
@@ -0,0 +1,123 @@
+/*
+ * Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#ifndef __PLATFORM_DEF_H__
+#define __PLATFORM_DEF_H__
+
+#include <arch.h>
+#include <common_def.h>
+#include <rk3328_def.h>
+
+#define DEBUG_XLAT_TABLE 0
+
+/*******************************************************************************
+ * Platform binary types for linking
+ ******************************************************************************/
+#define PLATFORM_LINKER_FORMAT		"elf64-littleaarch64"
+#define PLATFORM_LINKER_ARCH		aarch64
+
+/*******************************************************************************
+ * Generic platform constants
+ ******************************************************************************/
+
+/* Size of cacheable stacks */
+#if DEBUG_XLAT_TABLE
+#define PLATFORM_STACK_SIZE 0x800
+#elif IMAGE_BL1
+#define PLATFORM_STACK_SIZE 0x440
+#elif IMAGE_BL2
+#define PLATFORM_STACK_SIZE 0x400
+#elif IMAGE_BL31
+#define PLATFORM_STACK_SIZE 0x800
+#elif IMAGE_BL32
+#define PLATFORM_STACK_SIZE 0x440
+#endif
+
+#define FIRMWARE_WELCOME_STR		"Booting Trusted Firmware\n"
+
+#define PLATFORM_MAX_AFFLVL		MPIDR_AFFLVL2
+#define PLATFORM_SYSTEM_COUNT		1
+#define PLATFORM_CLUSTER_COUNT		1
+#define PLATFORM_CLUSTER0_CORE_COUNT	4
+#define PLATFORM_CLUSTER1_CORE_COUNT	0
+#define PLATFORM_CORE_COUNT		(PLATFORM_CLUSTER1_CORE_COUNT +	\
+					 PLATFORM_CLUSTER0_CORE_COUNT)
+
+#define PLATFORM_NUM_AFFS		(PLATFORM_SYSTEM_COUNT +	\
+					 PLATFORM_CLUSTER_COUNT +	\
+					 PLATFORM_CORE_COUNT)
+
+#define PLAT_MAX_PWR_LVL		MPIDR_AFFLVL2
+
+#define PLAT_RK_CLST_TO_CPUID_SHIFT	6
+
+/*
+ * This macro defines the deepest retention state possible. A higher state
+ * id will represent an invalid or a power down state.
+ */
+#define PLAT_MAX_RET_STATE		1
+
+/*
+ * This macro defines the deepest power down states possible. Any state ID
+ * higher than this is invalid.
+ */
+#define PLAT_MAX_OFF_STATE		2
+
+/*******************************************************************************
+ * Platform memory map related constants
+ ******************************************************************************/
+/* TF txet, ro, rw, Size: 512KB */
+#define TZRAM_BASE		(0x0)
+#define TZRAM_SIZE		(0x80000)
+
+/*******************************************************************************
+ * BL31 specific defines.
+ ******************************************************************************/
+/*
+ * Put BL3-1 at the top of the Trusted RAM
+ */
+#define BL31_BASE		(TZRAM_BASE + 0x10000)
+#define BL31_LIMIT		(TZRAM_BASE + TZRAM_SIZE)
+
+/*******************************************************************************
+ * Platform specific page table and MMU setup constants
+ ******************************************************************************/
+#define ADDR_SPACE_SIZE		(1ull << 32)
+#define MAX_XLAT_TABLES		9
+#define MAX_MMAP_REGIONS	33
+
+/*******************************************************************************
+ * Declarations and constants to access the mailboxes safely. Each mailbox is
+ * aligned on the biggest cache line size in the platform. This is known only
+ * to the platform as it might have a combination of integrated and external
+ * caches. Such alignment ensures that two maiboxes do not sit on the same cache
+ * line at any cache level. They could belong to different cpus/clusters &
+ * get written while being protected by different locks causing corruption of
+ * a valid mailbox address.
+ ******************************************************************************/
+#define CACHE_WRITEBACK_SHIFT	6
+#define CACHE_WRITEBACK_GRANULE	(1 << CACHE_WRITEBACK_SHIFT)
+
+/*
+ * Define GICD and GICC and GICR base
+ */
+#define PLAT_RK_GICD_BASE	RK3328_GICD_BASE
+#define PLAT_RK_GICC_BASE	RK3328_GICC_BASE
+
+/*
+ * Define a list of Group 1 Secure and Group 0 interrupts as per GICv3
+ * terminology. On a GICv2 system or mode, the lists will be merged and treated
+ * as Group 0 interrupts.
+ */
+#define PLAT_RK_G1S_IRQS	RK_G1S_IRQS
+
+#define PLAT_RK_UART_BASE	RK3328_UART2_BASE
+#define PLAT_RK_UART_CLOCK	RK3328_UART_CLOCK
+#define PLAT_RK_UART_BAUDRATE	RK3328_BAUDRATE
+
+#define PLAT_RK_PRIMARY_CPU	0x0
+
+#endif /* __PLATFORM_DEF_H__ */
diff --git a/plat/rockchip/rk3328/platform.mk b/plat/rockchip/rk3328/platform.mk
new file mode 100644
index 0000000..b81d746
--- /dev/null
+++ b/plat/rockchip/rk3328/platform.mk
@@ -0,0 +1,55 @@
+#
+# Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
+#
+# SPDX-License-Identifier: BSD-3-Clause
+#
+
+RK_PLAT			:=	plat/rockchip
+RK_PLAT_SOC		:=	${RK_PLAT}/${PLAT}
+RK_PLAT_COMMON		:=	${RK_PLAT}/common
+
+PLAT_INCLUDES		:=	-Idrivers/arm/gic/common/			\
+				-Idrivers/arm/gic/v2/			\
+				-Iinclude/plat/common/				\
+				-I${RK_PLAT_COMMON}/                            \
+				-I${RK_PLAT_COMMON}/include/                    \
+				-I${RK_PLAT_COMMON}/pmusram                     \
+				-I${RK_PLAT_COMMON}/drivers/pmu/                \
+				-I${RK_PLAT_COMMON}/drivers/parameter/		\
+				-I${RK_PLAT_SOC}/				\
+				-I${RK_PLAT_SOC}/drivers/pmu/			\
+				-I${RK_PLAT_SOC}/drivers/soc/			\
+				-I${RK_PLAT_SOC}/include/
+
+RK_GIC_SOURCES		:=	drivers/arm/gic/common/gic_common.c		\
+				drivers/arm/gic/v2/gicv2_main.c			\
+				drivers/arm/gic/v2/gicv2_helpers.c		\
+				plat/common/plat_gicv2.c			\
+				${RK_PLAT}/common/rockchip_gicv2.c
+
+PLAT_BL_COMMON_SOURCES	:=	lib/aarch64/xlat_tables.c			\
+				plat/common/aarch64/plat_psci_common.c
+
+BL31_SOURCES		+=	${RK_GIC_SOURCES}				\
+				drivers/arm/cci/cci.c				\
+				drivers/console/console.S			\
+				drivers/ti/uart/16550_console.S			\
+				drivers/delay_timer/delay_timer.c		\
+				drivers/delay_timer/generic_delay_timer.c	\
+				lib/cpus/aarch64/aem_generic.S			\
+				lib/cpus/aarch64/cortex_a53.S			\
+				${RK_PLAT_COMMON}/drivers/parameter/ddr_parameter.c	\
+				${RK_PLAT_COMMON}/aarch64/plat_helpers.S	\
+				${RK_PLAT_COMMON}/bl31_plat_setup.c		\
+				${RK_PLAT_COMMON}/pmusram/pmu_sram.c            \
+				${RK_PLAT_COMMON}/pmusram/pmu_sram_cpus_on.S	\
+				${RK_PLAT_COMMON}/plat_pm.c			\
+				${RK_PLAT_COMMON}/plat_topology.c		\
+				${RK_PLAT_COMMON}/aarch64/platform_common.c	\
+				${RK_PLAT_SOC}/drivers/pmu/pmu.c		\
+				${RK_PLAT_SOC}/drivers/soc/soc.c
+
+ENABLE_PLAT_COMPAT 	:=      0
+
+$(eval $(call add_define,PLAT_EXTRA_LD_SCRIPT))
+$(eval $(call add_define,PLAT_SKIP_OPTEE_S_EL1_INT_REGISTER))
diff --git a/plat/rockchip/rk3328/rk3328_def.h b/plat/rockchip/rk3328/rk3328_def.h
new file mode 100644
index 0000000..062c9cc
--- /dev/null
+++ b/plat/rockchip/rk3328/rk3328_def.h
@@ -0,0 +1,144 @@
+/*
+ * Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#ifndef __PLAT_DEF_H__
+#define __PLAT_DEF_H__
+
+#define MAJOR_VERSION		(1)
+#define MINOR_VERSION		(2)
+
+#define SIZE_K(n)		((n) * 1024)
+
+/* Special value used to verify platform parameters from BL2 to BL3-1 */
+#define RK_BL31_PLAT_PARAM_VAL	0x0f1e2d3c4b5a6978ULL
+
+#define UART2_BASE		0xff130000
+#define UART2_SIZE		SIZE_K(64)
+
+#define PMU_BASE		0xff140000
+#define PMU_SIZE		SIZE_K(64)
+
+#define SGRF_BASE		0xff0d0000
+#define SGRF_SIZE		SIZE_K(64)
+
+#define CRU_BASE		0xff440000
+#define CRU_SIZE		SIZE_K(64)
+
+#define GRF_BASE		0xff100000
+#define GRF_SIZE		SIZE_K(64)
+
+#define GPIO0_BASE		0xff210000
+#define GPIO0_SIZE		SIZE_K(32)
+
+#define GPIO1_BASE		0xff220000
+#define GPIO1_SIZE		SIZE_K(32)
+
+#define GPIO2_BASE		0xff230000
+#define GPIO2_SIZE		SIZE_K(64)
+
+#define GPIO3_BASE		0xff240000
+#define GPIO3_SIZE		SIZE_K(64)
+
+#define STIME_BASE		0xff1d0000
+#define STIME_SIZE		SIZE_K(64)
+
+#define INTMEM_BASE		0xff090000
+#define INTMEM_SIZE		SIZE_K(32)
+
+#define SRAM_LDS_BASE		(INTMEM_BASE + SIZE_K(4))
+#define SRAM_LDS_SIZE		(INTMEM_SIZE - SIZE_K(4))
+
+#define PMUSRAM_BASE		INTMEM_BASE
+#define PMUSRAM_SIZE		SIZE_K(4)
+#define PMUSRAM_RSIZE		SIZE_K(4)
+
+#define VOP_BASE		0xff370000
+#define VOP_SIZE		SIZE_K(16)
+
+#define DDR_PHY_BASE		0xff400000
+#define DDR_PHY_SIZE		SIZE_K(4)
+
+#define SERVER_MSCH_BASE	0xff720000
+#define SERVER_MSCH_SIZE	SIZE_K(4)
+
+#define DDR_UPCTL_BASE		0xff780000
+#define DDR_UPCTL_SIZE		SIZE_K(12)
+
+#define DDR_MONITOR_BASE	0xff790000
+#define DDR_MONITOR_SIZE	SIZE_K(4)
+
+#define FIREWALL_DDR_BASE	0xff7c0000
+#define FIREWALL_DDR_SIZE	SIZE_K(64)
+
+#define FIREWALL_CFG_BASE	0xff7d0000
+#define FIREWALL_CFG_SIZE	SIZE_K(64)
+
+#define GIC400_BASE		0xff810000
+#define GIC400_SIZE		SIZE_K(64)
+
+#define DDR_GRF_BASE		0xff798000
+#define DDR_GRF_SIZE		SIZE_K(16)
+
+#define PWM_BASE		0xff1b0000
+#define PWM_SIZE		SIZE_K(64)
+
+#define DDR_PARAM_BASE		0x02000000
+#define DDR_PARAM_SIZE		SIZE_K(4)
+
+#define EFUSE8_BASE		0xff260000
+#define EFUSE8_SIZE		SIZE_K(4)
+
+#define EFUSE32_BASE		0xff0b0000
+#define EFUSE32_SIZE		SIZE_K(4)
+
+/**************************************************************************
+ * UART related constants
+ **************************************************************************/
+#define RK3328_UART2_BASE	UART2_BASE
+#define RK3328_BAUDRATE	1500000
+#define RK3328_UART_CLOCK	24000000
+
+/******************************************************************************
+ * System counter frequency related constants
+ ******************************************************************************/
+#define SYS_COUNTER_FREQ_IN_TICKS	24000000U
+#define SYS_COUNTER_FREQ_IN_MHZ		24
+
+/******************************************************************************
+ * GIC-400 & interrupt handling related constants
+ ******************************************************************************/
+
+/* Base rk_platform compatible GIC memory map */
+#define RK3328_GICD_BASE		(GIC400_BASE + 0x1000)
+#define RK3328_GICC_BASE		(GIC400_BASE + 0x2000)
+#define RK3328_GICR_BASE		0	/* no GICR in GIC-400 */
+
+/******************************************************************************
+ * sgi, ppi
+ ******************************************************************************/
+#define RK_IRQ_SEC_PHY_TIMER	29
+
+#define RK_IRQ_SEC_SGI_0	8
+#define RK_IRQ_SEC_SGI_1	9
+#define RK_IRQ_SEC_SGI_2	10
+#define RK_IRQ_SEC_SGI_3	11
+#define RK_IRQ_SEC_SGI_4	12
+#define RK_IRQ_SEC_SGI_5	13
+#define RK_IRQ_SEC_SGI_6	14
+#define RK_IRQ_SEC_SGI_7	15
+
+/*
+ * Define a list of Group 1 Secure and Group 0 interrupts as per GICv3
+ * terminology. On a GICv2 system or mode, the lists will be merged and treated
+ * as Group 0 interrupts.
+ */
+#define RK_G1S_IRQS		RK_IRQ_SEC_PHY_TIMER, RK_IRQ_SEC_SGI_6
+
+#define SHARE_MEM_BASE          0x100000/* [1MB, 1MB+60K]*/
+#define SHARE_MEM_PAGE_NUM      15
+#define SHARE_MEM_SIZE          SIZE_K(SHARE_MEM_PAGE_NUM * 4)
+
+#endif /* __PLAT_DEF_H__ */
diff --git a/services/spd/opteed/opteed_main.c b/services/spd/opteed/opteed_main.c
index 20a4866..418e482 100644
--- a/services/spd/opteed/opteed_main.c
+++ b/services/spd/opteed/opteed_main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2013-2017, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -235,7 +235,7 @@
 					&optee_vectors->fast_smc_entry);
 		} else {
 			cm_set_elr_el3(SECURE, (uint64_t)
-					&optee_vectors->std_smc_entry);
+					&optee_vectors->yield_smc_entry);
 		}
 
 		cm_el1_sysregs_context_restore(SECURE);
@@ -401,13 +401,13 @@
 	opteed_smc_handler
 );
 
-/* Define an OPTEED runtime service descriptor for standard SMC calls */
+/* Define an OPTEED runtime service descriptor for yielding SMC calls */
 DECLARE_RT_SVC(
 	opteed_std,
 
 	OEN_TOS_START,
 	OEN_TOS_END,
-	SMC_TYPE_STD,
+	SMC_TYPE_YIELD,
 	NULL,
 	opteed_smc_handler
 );
diff --git a/services/spd/opteed/opteed_private.h b/services/spd/opteed/opteed_private.h
index 49ea499..70cc925 100644
--- a/services/spd/opteed/opteed_private.h
+++ b/services/spd/opteed/opteed_private.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2013-2017, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -86,7 +86,7 @@
 typedef uint32_t optee_vector_isn_t;
 
 typedef struct optee_vectors {
-	optee_vector_isn_t std_smc_entry;
+	optee_vector_isn_t yield_smc_entry;
 	optee_vector_isn_t fast_smc_entry;
 	optee_vector_isn_t cpu_on_entry;
 	optee_vector_isn_t cpu_off_entry;
diff --git a/services/spd/tlkd/tlkd_common.c b/services/spd/tlkd/tlkd_common.c
index a36a908..599d7a3 100644
--- a/services/spd/tlkd/tlkd_common.c
+++ b/services/spd/tlkd/tlkd_common.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2017, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -88,7 +88,7 @@
 
 	/* Associate this context with the cpu specified */
 	tlk_ctx->mpidr = read_mpidr_el1();
-	clr_std_smc_active_flag(tlk_ctx->state);
+	clr_yield_smc_active_flag(tlk_ctx->state);
 	cm_set_context(&tlk_ctx->cpu_ctx, SECURE);
 
 	if (rw == SP_AARCH64)
diff --git a/services/spd/tlkd/tlkd_main.c b/services/spd/tlkd/tlkd_main.c
index 572e022..2748868 100644
--- a/services/spd/tlkd/tlkd_main.c
+++ b/services/spd/tlkd/tlkd_main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2016, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2017, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -195,7 +195,7 @@
 	 *    Applications.
 	 * c. open/close sessions
 	 * d. issue commands to the Trusted Apps
-	 * e. resume the preempted standard SMC call.
+	 * e. resume the preempted yielding SMC call.
 	 */
 	case TLK_REGISTER_LOGBUF:
 	case TLK_REGISTER_REQBUF:
@@ -217,15 +217,15 @@
 		assert(handle == cm_get_context(NON_SECURE));
 
 		/*
-		 * Check if we are already processing a standard SMC
+		 * Check if we are already processing a yielding SMC
 		 * call. Of all the supported fids, only the "resume"
 		 * fid expects the flag to be set.
 		 */
 		if (smc_fid == TLK_RESUME_FID) {
-			if (!get_std_smc_active_flag(tlk_ctx.state))
+			if (!get_yield_smc_active_flag(tlk_ctx.state))
 				SMC_RET1(handle, SMC_UNK);
 		} else {
-			if (get_std_smc_active_flag(tlk_ctx.state))
+			if (get_yield_smc_active_flag(tlk_ctx.state))
 				SMC_RET1(handle, SMC_UNK);
 		}
 
@@ -239,7 +239,7 @@
 		/*
 		 * Mark the SP state as active.
 		 */
-		set_std_smc_active_flag(tlk_ctx.state);
+		set_yield_smc_active_flag(tlk_ctx.state);
 
 		/*
 		 * We are done stashing the non-secure context. Ask the
@@ -298,7 +298,7 @@
 
 	/*
 	 * This is a request from the SP to mark completion of
-	 * a standard function ID.
+	 * a yielding function ID.
 	 */
 	case TLK_REQUEST_DONE:
 		if (ns)
@@ -307,7 +307,7 @@
 		/*
 		 * Mark the SP state as inactive.
 		 */
-		clr_std_smc_active_flag(tlk_ctx.state);
+		clr_yield_smc_active_flag(tlk_ctx.state);
 
 		/* Get a reference to the non-secure context */
 		ns_cpu_context = cm_get_context(NON_SECURE);
@@ -411,13 +411,13 @@
 	tlkd_smc_handler
 );
 
-/* Define a SPD runtime service descriptor for standard SMC calls */
+/* Define a SPD runtime service descriptor for yielding SMC calls */
 DECLARE_RT_SVC(
 	tlkd_tos_std,
 
 	OEN_TOS_START,
 	OEN_TOS_END,
-	SMC_TYPE_STD,
+	SMC_TYPE_YIELD,
 	NULL,
 	tlkd_smc_handler
 );
@@ -433,13 +433,13 @@
 	tlkd_smc_handler
 );
 
-/* Define a SPD runtime service descriptor for standard SMC calls */
+/* Define a SPD runtime service descriptor for yielding SMC calls */
 DECLARE_RT_SVC(
 	tlkd_tap_std,
 
 	OEN_TAP_START,
 	OEN_TAP_END,
-	SMC_TYPE_STD,
+	SMC_TYPE_YIELD,
 	NULL,
 	tlkd_smc_handler
 );
diff --git a/services/spd/tlkd/tlkd_private.h b/services/spd/tlkd/tlkd_private.h
index 130544f..ba66098 100644
--- a/services/spd/tlkd/tlkd_private.h
+++ b/services/spd/tlkd/tlkd_private.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2015-2017, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -14,7 +14,7 @@
 #include <psci.h>
 
 /*
- * This flag is used by the TLKD to determine if the SP is servicing a standard
+ * This flag is used by the TLKD to determine if the SP is servicing a yielding
  * SMC request prior to programming the next entry into the SP e.g. if SP
  * execution is preempted by a non-secure interrupt and handed control to the
  * normal world. If another request which is distinct from what the SP was
@@ -22,15 +22,16 @@
  * reject the new request or service it while ensuring that the previous context
  * is not corrupted.
  */
-#define STD_SMC_ACTIVE_FLAG_SHIFT	2
-#define STD_SMC_ACTIVE_FLAG_MASK	1
-#define get_std_smc_active_flag(state)	(((state) >> STD_SMC_ACTIVE_FLAG_SHIFT) \
-					 & STD_SMC_ACTIVE_FLAG_MASK)
-#define set_std_smc_active_flag(state)	((state) |=                           \
-					 (1 << STD_SMC_ACTIVE_FLAG_SHIFT))
-#define clr_std_smc_active_flag(state)	((state) &=                           \
-					 ~(STD_SMC_ACTIVE_FLAG_MASK           \
-					   << STD_SMC_ACTIVE_FLAG_SHIFT))
+#define YIELD_SMC_ACTIVE_FLAG_SHIFT	2
+#define YIELD_SMC_ACTIVE_FLAG_MASK	1
+#define get_yield_smc_active_flag(state)				\
+			(((state) >> YIELD_SMC_ACTIVE_FLAG_SHIFT)	\
+			& YIELD_SMC_ACTIVE_FLAG_MASK)
+#define set_yield_smc_active_flag(state)	((state) |=		\
+					 (1 << YIELD_SMC_ACTIVE_FLAG_SHIFT))
+#define clr_yield_smc_active_flag(state)	((state) &=		\
+					 ~(YIELD_SMC_ACTIVE_FLAG_MASK	\
+					 << YIELD_SMC_ACTIVE_FLAG_SHIFT))
 
 /*******************************************************************************
  * Translate virtual address received from the NS world
diff --git a/services/spd/trusty/smcall.h b/services/spd/trusty/smcall.h
index d0299c7..99f1608 100644
--- a/services/spd/trusty/smcall.h
+++ b/services/spd/trusty/smcall.h
@@ -24,9 +24,9 @@
 		)
 
 #define SMC_FASTCALL_NR(entity, fn)	SMC_NR((entity), (fn), 1, 0)
-#define SMC_STDCALL_NR(entity, fn)	SMC_NR((entity), (fn), 0, 0)
 #define SMC_FASTCALL64_NR(entity, fn)	SMC_NR((entity), (fn), 1, 1)
-#define SMC_STDCALL64_NR(entity, fn)	SMC_NR((entity), (fn), 0, 1)
+#define SMC_YIELDCALL_NR(entity, fn)	SMC_NR((entity), (fn), 0, 0)
+#define SMC_YIELDCALL64_NR(entity, fn)	SMC_NR((entity), (fn), 0, 1)
 
 #define	SMC_ENTITY_ARCH			0	/* ARM Architecture calls */
 #define	SMC_ENTITY_CPU			1	/* CPU Service calls */
@@ -39,14 +39,14 @@
 #define SMC_ENTITY_LOGGING              51	/* Used for secure -> nonsecure logging */
 #define	SMC_ENTITY_SECURE_MONITOR	60	/* Trusted OS calls internal to secure monitor */
 
-/* FC = Fast call, SC = Standard call */
-#define SMC_SC_RESTART_LAST	SMC_STDCALL_NR  (SMC_ENTITY_SECURE_MONITOR, 0)
-#define SMC_SC_NOP		SMC_STDCALL_NR  (SMC_ENTITY_SECURE_MONITOR, 1)
+/* FC = Fast call, YC = Yielding call */
+#define SMC_YC_RESTART_LAST	SMC_YIELDCALL_NR  (SMC_ENTITY_SECURE_MONITOR, 0)
+#define SMC_YC_NOP		SMC_YIELDCALL_NR  (SMC_ENTITY_SECURE_MONITOR, 1)
 
 /*
  * Return from secure os to non-secure os with return value in r1
  */
-#define SMC_SC_NS_RETURN	SMC_STDCALL_NR  (SMC_ENTITY_SECURE_MONITOR, 0)
+#define SMC_YC_NS_RETURN	SMC_YIELDCALL_NR  (SMC_ENTITY_SECURE_MONITOR, 0)
 
 #define SMC_FC_RESERVED		SMC_FASTCALL_NR (SMC_ENTITY_SECURE_MONITOR, 0)
 #define SMC_FC_FIQ_EXIT		SMC_FASTCALL_NR (SMC_ENTITY_SECURE_MONITOR, 1)
@@ -64,12 +64,12 @@
 #define SMC_FC_GET_VERSION_STR	SMC_FASTCALL_NR (SMC_ENTITY_SECURE_MONITOR, 10)
 
 /* Trusted OS entity calls */
-#define SMC_SC_VIRTIO_GET_DESCR	  SMC_STDCALL_NR(SMC_ENTITY_TRUSTED_OS, 20)
-#define SMC_SC_VIRTIO_START	  SMC_STDCALL_NR(SMC_ENTITY_TRUSTED_OS, 21)
-#define SMC_SC_VIRTIO_STOP	  SMC_STDCALL_NR(SMC_ENTITY_TRUSTED_OS, 22)
+#define SMC_YC_VIRTIO_GET_DESCR	  SMC_YIELDCALL_NR(SMC_ENTITY_TRUSTED_OS, 20)
+#define SMC_YC_VIRTIO_START	  SMC_YIELDCALL_NR(SMC_ENTITY_TRUSTED_OS, 21)
+#define SMC_YC_VIRTIO_STOP	  SMC_YIELDCALL_NR(SMC_ENTITY_TRUSTED_OS, 22)
 
-#define SMC_SC_VDEV_RESET	  SMC_STDCALL_NR(SMC_ENTITY_TRUSTED_OS, 23)
-#define SMC_SC_VDEV_KICK_VQ	  SMC_STDCALL_NR(SMC_ENTITY_TRUSTED_OS, 24)
-#define SMC_SC_SET_ROT_PARAMS	  SMC_STDCALL_NR(SMC_ENTITY_TRUSTED_OS, 65535)
+#define SMC_YC_VDEV_RESET	  SMC_YIELDCALL_NR(SMC_ENTITY_TRUSTED_OS, 23)
+#define SMC_YC_VDEV_KICK_VQ	  SMC_YIELDCALL_NR(SMC_ENTITY_TRUSTED_OS, 24)
+#define SMC_YC_SET_ROT_PARAMS	  SMC_YIELDCALL_NR(SMC_ENTITY_TRUSTED_OS, 65535)
 
 #endif /* __LIB_SM_SMCALL_H */
diff --git a/services/spd/trusty/trusty.c b/services/spd/trusty/trusty.c
index 1968ac4..a95141b 100644
--- a/services/spd/trusty/trusty.c
+++ b/services/spd/trusty/trusty.c
@@ -221,14 +221,14 @@
 	 * Verified Boot is not even supported and returning success here
 	 * would not compromise the boot process.
 	 */
-	if (!ep_info && (smc_fid == SMC_SC_SET_ROT_PARAMS)) {
+	if (!ep_info && (smc_fid == SMC_YC_SET_ROT_PARAMS)) {
 		SMC_RET1(handle, 0);
 	} else if (!ep_info) {
 		SMC_RET1(handle, SMC_UNK);
 	}
 
 	if (is_caller_secure(flags)) {
-		if (smc_fid == SMC_SC_NS_RETURN) {
+		if (smc_fid == SMC_YC_NS_RETURN) {
 			ret = trusty_context_switch(SECURE, x1, 0, 0, 0);
 			SMC_RET8(handle, ret.r0, ret.r1, ret.r2, ret.r3,
 				 ret.r4, ret.r5, ret.r6, ret.r7);
@@ -424,13 +424,13 @@
 	trusty_smc_handler
 );
 
-/* Define a SPD runtime service descriptor for standard SMC calls */
+/* Define a SPD runtime service descriptor for yielding SMC calls */
 DECLARE_RT_SVC(
 	trusty_std,
 
 	OEN_TAP_START,
 	SMC_ENTITY_SECURE_MONITOR,
-	SMC_TYPE_STD,
+	SMC_TYPE_YIELD,
 	NULL,
 	trusty_smc_handler
 );