Add support for BL3-2 in BL2

This patch adds support for loading a BL3-2 image in BL2. In case a
BL3-2 image is found, it also passes information to BL3-1 about where it
is located and the extents of memory available to it. Information about
memory extents is populated by platform specific code.

The documentation has also been updated to reflect the above changes.

Change-Id: I526b2efb80babebab1318f2b02e319a86d6758b0
Co-authored-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
diff --git a/docs/porting-guide.md b/docs/porting-guide.md
index 91b2a20..720c877 100644
--- a/docs/porting-guide.md
+++ b/docs/porting-guide.md
@@ -536,6 +536,34 @@
     if the platform wants to restrict the amount of memory visible to BL3-1.
     Details of this function are given below.
 
+4.  Loading the BL3-2 binary image (if present) in platform provided memory
+    using semi-hosting. To load the BL3-2 image, BL2 makes use of the
+    `bl32_meminfo` field in the `bl31_args` structure to which a pointer is
+    returned by the `bl2_get_bl31_args_ptr()` function. The platform also
+    defines the address in memory where BL3-2 is loaded through the constant
+    `BL32_BASE`. BL2 uses this information to determine if there is enough
+    memory to load the BL3-2 image.
+
+5.  Arranging to pass control to the BL3-2 image (if present) that has been
+    pre-loaded at `BL32_BASE`. BL2 populates an `el_change_info` structure
+    in memory provided by the platform with information about how BL3-1 should
+    pass control to the BL3-2 image. This structure follows the
+    `el_change_info` structure populated for the normal world BL image in 2.
+    above.
+
+6.  Populating a `meminfo` structure with the following information in
+    memory that is accessible by BL3-1 immediately upon entry.
+
+        meminfo.total_base = Base address of memory visible to BL3-2
+        meminfo.total_size = Size of memory visible to BL3-2
+        meminfo.free_base  = Base address of memory available for allocation
+                             to BL3-2
+        meminfo.free_size  = Size of memory available for allocation to
+                             BL3-2
+
+    BL2 populates this information in the `bl32_meminfo` field of the pointer
+    returned by the `bl2_get_bl31_args_ptr() function.
+
 The following functions must be implemented by the platform port to enable BL2
 to perform the above tasks.
 
@@ -585,6 +613,11 @@
 BL2 to pass information to BL3_1. The pointer is initialized to the base
 address of Secure DRAM (`0x06000000`).
 
+The ARM FVP port also populates the `bl32_meminfo` field in the `bl31_args`
+structure pointed to by `bl2_to_bl31_args` with the extents of memory available
+for use by the BL3-2 image. The memory is allocated in the Secure DRAM from the
+address defined by the constant `BL32_BASE`.
+
 The non-secure memory extents used for loading BL3-3 are also initialized in
 this function. This information is accessible in the `bl33_meminfo` field in
 the `bl31_args` structure pointed to by `bl2_to_bl31_args`.
diff --git a/docs/user-guide.md b/docs/user-guide.md
index 011f233..589d0b1 100644
--- a/docs/user-guide.md
+++ b/docs/user-guide.md
@@ -799,7 +799,8 @@
 platform-specific mechanism. It calculates the limits of DRAM (main memory)
 to determine whether there is enough space to load the normal world software
 images. A platform defined base address is used to specify the load address for
-the BL3-1 image.
+the BL3-1 image. It also defines the extents of memory available for use by the
+BL3-2 image.
 
 #### Normal world image load
 
@@ -811,6 +812,16 @@
 specified in Section 5.13 of the [PSCI PDD] [PSCI]. This information is passed
 to BL3-1.
 
+#### BL3-2 (Secure Payload) image load
+
+BL2 loads the optional BL3-2 image. The image executes in the secure world. BL2
+relies on BL3-1 to pass control to the BL3-2 image, if present. Hence, BL2
+populates a platform- specific area of memory with the entrypoint and Current
+Program Status Register (`CPSR`) of the BL3-2 image. The entrypoint is the load
+address of the BL3-2 image. The `CPSR` is initialized with Secure EL1 and Stack
+pointer set to SP_EL1 (EL1h) as the mode, exception bits disabled (DAIF bits)
+and AArch64 execution state. This information is passed to BL3-1.
+
 ##### UEFI firmware load
 
 BL2 loads the BL3-3 (UEFI) image into non-secure memory as defined by the