Secure Monitor Call Calling Convention

This Secure Monitor Call Calling Convention (SMCCC) and HyperVisor Call (HVC) convention describes the standard mechanism that is to be used with the SMCCC and HVC instructions. The SMCCC instruction is used to generate a synchronous exception that is handled by Secure Monitor code, running in EL3. Arguments and return values are passed in registers. After being handled by the Secure Monitor, calls that result from the instructions can be passed on to a Trusted OS or some other entity in the secure software stack.

The HVC instruction is used to generate a synchronous exception that is handled by a hypervisor, running in EL2. Arguments and return values are passed in registers. Hypervisors can also trap SMCCC calls that are made by Guest Operating Systems (at EL1), which allows the calls to be emulated, passed through, or denied as appropriate.

This specification aims to ease integration and reduce fragmentation between software layers, for example Operating Systems, hypervisors, Trusted OSs, Secure Monitors, and System Firmware.

Discover SMCCC

Secure Monitor Call interfaces

The Secure Monitor Call Calling Convention (SMCCC) defines ranges for the SMC/HVC function IDs. These function ranges have an associated entity that can issue new function IDs. The following lists the standard FID ranges of where functions are defined by Arm specifications. Please see the SMCCC specification for more information.

Arm Architecture Service

The standard range of SMC/HVC function IDs taking values in [0x8000_0000, 0x8000_FFFF]. The functions in this range are defined in the SMCCC specification.

The following table details the currently occupied subranges:


Interface

ID Ranges                                                                                      


Specification link

Range Description
Arm Architecture range

0x8000 0000 – 0x8000 8000

SMCCC
SMC Calls defined in the Arm Architecture range – Section 7 in the SMCCC.
SMCCC (General Service Queries) 0x8000 FF00 – 0x8000 FF03 SMCCC
Standard query functions present in all ranges.

Standard Secure Services

The standard range of SMC/HVC function IDs taking values in [0x8400_0000, 0x8400_FFFF].

The table below lists the different specification documents where the functions are defined, and the function ID sub-ranges allocated to each specification.

Interface

ID Ranges                                                                              

Specification link
Range Description
PSCI 0x8400 0000 – 0x8400 001F PSCI
Interface for Normal World OS directed System Power State control.
SDEI 0x8400 0020 – 0x8400 003F SDEI
Interface for registering and servicing system events from system firmware.
Management Mode 0x8400 0040 – 0x8400 004F Management Mode
Interface to enable the implementation of OS agnostic services (MM services).
TRNG ABI 0x8400 0050 – 0x8400 005F TRNG FW Interface
Interface for an OS or Hypervisor to obtain entropy from.
FF-A 0x8400 0060 – 0x8400 00FF FF-A
Interface for the OS and Hypervisor to communicate with entities in TrustZone.
PCI Configuration Space 0x8400 0130 – 0x8400 014F PCI Configuration Space Interface
Interface for an OS or hypervisor to access the PCI Configuration Space.
SMCCC (General Service Queries) 0x8400 FF00 – 0x8400 FF03 SMCCC
Standard query functions present in all ranges.

Standard HV services

The standard SMC/HVC function IDs taking values in [0x8500_0000, 0x8500_FFFF].

These functions are meant to be implemented by system FW running at the EL2 exception level.

The table below lists the different specification documents where the functions are defined, and the function ID sub-ranges allocated to each specification.

Interface
ID Ranges
Specification link
Range Description
SMCCC (General Service Queries) 0x8500 FF00 – 0x8500 FF03 SMCCC
Standard query functions present in all ranges.
PV Timer 0x8500 0020 – 0x8500 0040 PV Timer
Interface for measuring stolen time on virtualized systems..