diff --git a/Makefile b/Makefile
index 01627c5..ecaa9c8 100644
--- a/Makefile
+++ b/Makefile
@@ -43,7 +43,7 @@
 
 
 CHECKPATCH := $(CURDIR)/third_party/linux/scripts/checkpatch.pl \
-	--ignore BRACES,SPDX_LICENSE_TAG,VOLATILE,SPLIT_STRING,AVOID_EXTERNS,USE_SPINLOCK_T,NEW_TYPEDEFS,INITIALISED_STATIC,FILE_PATH_CHANGES,EMBEDDED_FUNCTION_NAME,SINGLE_STATEMENT_DO_WHILE_MACRO,MACRO_WITH_FLOW_CONTROL,PREFER_PACKED,PREFER_ALIGNED --quiet
+	--ignore BRACES,SPDX_LICENSE_TAG,VOLATILE,SPLIT_STRING,AVOID_EXTERNS,USE_SPINLOCK_T,NEW_TYPEDEFS,INITIALISED_STATIC,FILE_PATH_CHANGES,EMBEDDED_FUNCTION_NAME,SINGLE_STATEMENT_DO_WHILE_MACRO,MACRO_WITH_FLOW_CONTROL,PREFER_PACKED,PREFER_ALIGNED,INDENTED_LABEL --quiet
 
 # Specifies the grep pattern for ignoring specific files in checkpatch.
 # C++ headers, *.hh, are automatically excluded.
diff --git a/inc/hf/api.h b/inc/hf/api.h
index c5ebe2a..d6de2cb 100644
--- a/inc/hf/api.h
+++ b/inc/hf/api.h
@@ -65,3 +65,11 @@
 				    uint32_t fragment_length, uint32_t length,
 				    uint32_t cookie, struct vcpu *current,
 				    struct vcpu **next);
+struct spci_value api_spci_mem_retrieve_req(ipaddr_t address,
+					    uint32_t page_count,
+					    uint32_t fragment_length,
+					    uint32_t length, uint32_t cookie,
+					    struct vcpu *current);
+struct spci_value api_spci_mem_relinquish(struct vcpu *current);
+struct spci_value api_spci_mem_reclaim(uint32_t handle, uint32_t flags,
+				       struct vcpu *current);
diff --git a/inc/hf/mm.h b/inc/hf/mm.h
index 43d4c79..6fb9296 100644
--- a/inc/hf/mm.h
+++ b/inc/hf/mm.h
@@ -79,6 +79,8 @@
 
 /* clang-format on */
 
+#define MM_PPOOL_ENTRY_SIZE sizeof(struct mm_page_table)
+
 struct mm_page_table {
 	alignas(PAGE_SIZE) pte_t entries[MM_PTE_PER_PAGE];
 };
diff --git a/inc/hf/spci_memory.h b/inc/hf/spci_memory.h
index fc21e09..023a8ce 100644
--- a/inc/hf/spci_memory.h
+++ b/inc/hf/spci_memory.h
@@ -21,9 +21,19 @@
 
 #include "vmapi/hf/spci.h"
 
-struct spci_value spci_memory_send(struct vm_locked to_locked,
-				   struct vm_locked from_locked,
+struct spci_value spci_memory_send(struct vm *to, struct vm_locked from_locked,
 				   struct spci_memory_region *memory_region,
 				   uint32_t memory_share_size,
 				   uint32_t share_func,
 				   struct mpool *page_pool);
+struct spci_value spci_memory_retrieve(
+	struct vm_locked to_locked,
+	struct spci_memory_retrieve_request *retrieve_request,
+	uint32_t retrieve_request_size, struct mpool *page_pool);
+struct spci_value spci_memory_relinquish(
+	struct vm_locked from_locked,
+	struct spci_mem_relinquish *relinquish_request,
+	struct mpool *page_pool);
+struct spci_value spci_memory_reclaim(struct vm_locked to_locked,
+				      spci_memory_handle_t handle, bool clear,
+				      struct mpool *page_pool);
diff --git a/inc/vmapi/hf/abi.h b/inc/vmapi/hf/abi.h
index 2802479..ed004b7 100644
--- a/inc/vmapi/hf/abi.h
+++ b/inc/vmapi/hf/abi.h
@@ -35,9 +35,6 @@
 #define HF_SPCI_RUN_WAIT_FOR_INTERRUPT 0xff09
 #define HF_SPCI_RUN_WAKE_UP            0xff0a
 
-/* Custom SPCI-like call for relinquishing memory in the push model. */
-#define HF_SPCI_MEM_RELINQUISH         0xffab
-
 /* This matches what Trusty and its ATF module currently use. */
 #define HF_DEBUG_LOG            0xbd000000
 
diff --git a/inc/vmapi/hf/call.h b/inc/vmapi/hf/call.h
index 5a1e097..f3557b6 100644
--- a/inc/vmapi/hf/call.h
+++ b/inc/vmapi/hf/call.h
@@ -159,16 +159,28 @@
 					     .arg5 = cookie});
 }
 
-static inline struct spci_value hf_spci_mem_relinquish(uint32_t fragment_length,
-						       uint32_t length,
-						       uint32_t cookie)
+static inline struct spci_value spci_mem_retrieve_req(uint32_t fragment_length,
+						      uint32_t length,
+						      uint32_t cookie)
 {
-	return spci_call((struct spci_value){.func = HF_SPCI_MEM_RELINQUISH,
+	return spci_call((struct spci_value){.func = SPCI_MEM_RETRIEVE_REQ_32,
 					     .arg3 = fragment_length,
 					     .arg4 = length,
 					     .arg5 = cookie});
 }
 
+static inline struct spci_value spci_mem_relinquish(void)
+{
+	return spci_call((struct spci_value){.func = SPCI_MEM_RELINQUISH_32});
+}
+
+static inline struct spci_value spci_mem_reclaim(uint32_t handle,
+						 uint32_t flags)
+{
+	return spci_call((struct spci_value){
+		.func = SPCI_MEM_RECLAIM_32, .arg1 = handle, .arg2 = flags});
+}
+
 /**
  * Called by secondary VMs to receive a message. This will block until a message
  * is received.
diff --git a/inc/vmapi/hf/spci.h b/inc/vmapi/hf/spci.h
index 98fad84..0422415 100644
--- a/inc/vmapi/hf/spci.h
+++ b/inc/vmapi/hf/spci.h
@@ -47,6 +47,10 @@
 #define SPCI_MEM_DONATE_32            0x84000071
 #define SPCI_MEM_LEND_32              0x84000072
 #define SPCI_MEM_SHARE_32             0x84000073
+#define SPCI_MEM_RETRIEVE_REQ_32      0x84000074
+#define SPCI_MEM_RETRIEVE_RESP_32     0x84000075
+#define SPCI_MEM_RELINQUISH_32        0x84000076
+#define SPCI_MEM_RECLAIM_32           0x84000077
 
 /* SPCI error codes. */
 #define SPCI_NOT_SUPPORTED      INT32_C(-1)
@@ -65,6 +69,8 @@
 #define SPCI_MSG_SEND_NOTIFY 0x1
 #define SPCI_MSG_SEND_NOTIFY_MASK 0x1
 
+#define SPCI_MEM_RECLAIM_CLEAR 0x1
+
 #define SPCI_SLEEP_INDEFINITE 0
 
 /**
@@ -157,6 +163,10 @@
 
 /* clang-format on */
 
+#define SPCI_MEMORY_HANDLE_ALLOCATOR_MASK ((spci_memory_handle_t)(1U << 31))
+#define SPCI_MEMORY_HANDLE_ALLOCATOR_HYPERVISOR \
+	((spci_memory_handle_t)(1U << 31))
+
 /** The ID of a VM. These are assigned sequentially starting with an offset. */
 typedef uint16_t spci_vm_id_t;
 typedef uint32_t spci_memory_handle_t;
@@ -208,6 +218,12 @@
 	return args.arg4;
 }
 
+static inline spci_memory_handle_t spci_mem_success_handle(
+	struct spci_value args)
+{
+	return args.arg2;
+}
+
 static inline spci_vm_id_t spci_vm_id(struct spci_value args)
 {
 	return (args.arg1 >> 16) & 0xffff;
@@ -304,6 +320,132 @@
 	struct spci_memory_region_attributes attributes[];
 };
 
+/**
+ * Retrieval attributes for a single receiver. This corresponds to table 138 of
+ * the SPCI beta specification, "Descriptor with properties to retrieve a memory
+ * region".
+ */
+struct spci_memory_retrieve_properties {
+	struct spci_memory_region_attributes attributes;
+	uint32_t page_count;
+	uint32_t constituent_count;
+	/** Reserved field, must be 0. */
+	uint32_t reserved;
+	struct spci_memory_region_constituent constituents[];
+};
+
+/**
+ * Descriptor used for SPCI_MEM_RETRIEVE_REQ. This corresponds to table 137 of
+ * the SPCI beta specification, "Descriptor to retrieve a donated, lent or
+ * shared memory region".
+ */
+struct spci_memory_retrieve_request {
+	/** Globally unique handle to identify the memory transaction. */
+	spci_memory_handle_t handle;
+	/** ID of the VM which sent the memory. */
+	spci_vm_id_t sender;
+	/** Reserved field, must be 0. */
+	uint16_t reserved_0;
+	/** Function ID of the memory sharing operation. */
+	uint32_t share_func;
+	/**
+	 * An implementation defined value associated with the receiver and the
+	 * memory region.
+	 */
+	uint32_t tag;
+	/**
+	 * The number of descriptors to specify the attributes with which the
+	 * memory region will be mapped in the other recipients. Hafnium doesn't
+	 * support multi-way memory sharing so this should always be 0.
+	 */
+	uint32_t attribute_count;
+	/**
+	 * The offset in bytes from the base address of this
+	 * `spci_memory_retrieve_request` to the start of the first attribute
+	 * descriptor.
+	 */
+	uint32_t attribute_offset;
+	/**
+	 * The number of `spci_memory_retrieve_properties` entries included
+	 * in this retrieve request, i.e. the number of receivers including the
+	 * caller and any stream endpoints for which the caller is a proxy.
+	 * Hafnium doesn't support stream endpoints, so this should always be 1.
+	 */
+	uint32_t retrieve_properties_count;
+	/** Reserved field, must be 0. */
+	uint32_t reserved_1;
+	/*
+	 * 'Array' of `struct spci_memory_retrieve_properties` goes here, but it
+	 * is not included in the struct as the entries are variable length. Use
+	 * `spci_memory_retrieve_request_first_retrieve_properties` to get the
+	 * first one.
+	 */
+};
+
+/**
+ * Receiver address range descriptor. This corresponds to table 144 of the SPCI
+ * beta specification, "Descriptor with address ranges of retrieved memory
+ * region", and is included as part of the `spci_retrieved_memory_region`.
+ */
+struct spci_receiver_address_range {
+	/** Receiver VM ID. */
+	spci_vm_id_t receiver;
+	/** Reserved field, must be 0. */
+	uint16_t reserved_0;
+	/**
+	 * The total number of 4 kiB pages included in this memory region. This
+	 * must be equal to the sum of page counts specified in each
+	 * `spci_memory_region_constituent`.
+	 */
+	uint32_t page_count;
+	/**
+	 * The number of constituents (`spci_memory_region_constituent`)
+	 * included in this memory region range.
+	 */
+	uint32_t constituent_count;
+	/** Reserved field, must be 0. */
+	uint32_t reserved_1;
+	/** An array of `constituent_count` memory region constituents. */
+	struct spci_memory_region_constituent constituents[];
+};
+
+/**
+ * Descriptor used for SPCI_MEM_RETRIEVE_RESP. This corresponds to table 143 of
+ * the SPCI beta specification, "Encoding of mapped address ranges of retrieved
+ * memory region".
+ */
+struct spci_retrieved_memory_region {
+	/**
+	 * The number of `spci_receiver_address_range` entries included
+	 * in this memory region.
+	 */
+	uint32_t receiver_count;
+	/** Reserved field, must be 0. */
+	uint32_t reserved_0;
+	/** Reserved field, must be 0. */
+	uint64_t reserved_1;
+	/*
+	 * 'Array' of `struct spci_receiver_address_range` goes here, but it is
+	 * not included in the struct as the entries are variable length. Use
+	 * `spci_retrieved_memory_region_first_receiver_range` to get the first
+	 * one.
+	 */
+};
+
+/**
+ * Descriptor used for SPCI_MEM_RELINQUISH requests. This corresponds to table
+ * 146 of the SPCI beta specification, "Descriptor to relinquish a memory
+ * region".
+ */
+struct spci_mem_relinquish {
+	spci_memory_handle_t handle;
+	uint32_t flags;
+	spci_vm_id_t sender;
+	uint16_t reserved;
+	uint32_t endpoint_count;
+	spci_vm_id_t endpoints[];
+};
+
 static inline struct spci_memory_region_constituent
 spci_memory_region_constituent_init(uint64_t address, uint32_t page_count)
 {
@@ -332,6 +474,33 @@
 			   memory_region->constituent_offset);
 }
 
+/**
+ * Gets the first descriptor with address ranges of a retrieved memory region.
+ *
+ * Note that getting the second requires parsing the first, as they are variable
+ * length due to the variable number of constituents.
+ */
+static inline struct spci_receiver_address_range *
+spci_retrieved_memory_region_first_receiver_range(
+	struct spci_retrieved_memory_region *memory_region)
+{
+	return (struct spci_receiver_address_range *)(memory_region + 1);
+}
+
+/**
+ * Gets the first retrieval attributes descriptor of a memory region retrieval
+ * request.
+ *
+ * Note that getting the second requires parsing the first, as they are variable
+ * length due to the variable number of constituents.
+ */
+static inline struct spci_memory_retrieve_properties *
+spci_memory_retrieve_request_first_retrieve_properties(
+	struct spci_memory_retrieve_request *retrieve_request)
+{
+	return (struct spci_memory_retrieve_properties *)(retrieve_request + 1);
+}
+
 uint32_t spci_memory_region_init(
 	struct spci_memory_region *memory_region, spci_vm_id_t sender,
 	spci_vm_id_t receiver,
@@ -340,3 +509,15 @@
 	spci_memory_region_flags_t flags, enum spci_memory_access access,
 	enum spci_memory_type type, enum spci_memory_cacheability cacheability,
 	enum spci_memory_shareability shareability);
+uint32_t spci_memory_retrieve_request_init(
+	struct spci_memory_retrieve_request *request,
+	spci_memory_handle_t handle, spci_vm_id_t sender, spci_vm_id_t receiver,
+	uint32_t share_func, uint32_t tag, uint32_t page_count,
+	enum spci_memory_access access, enum spci_memory_type type,
+	enum spci_memory_cacheability cacheability,
+	enum spci_memory_shareability shareability);
+uint32_t spci_retrieved_memory_region_init(
+	struct spci_retrieved_memory_region *response, size_t response_max_size,
+	spci_vm_id_t receiver,
+	const struct spci_memory_region_constituent constituents[],
+	uint32_t constituent_count, uint32_t page_count);
diff --git a/inc/vmapi/hf/types.h b/inc/vmapi/hf/types.h
index dc9f7a1..d0989c7 100644
--- a/inc/vmapi/hf/types.h
+++ b/inc/vmapi/hf/types.h
@@ -35,6 +35,8 @@
 
 #endif
 
+#define HF_HYPERVISOR_VM_ID 0
+
 /**
  * An offset to use when assigning VM IDs.
  * The offset is needed because VM ID 0 is reserved.
diff --git a/src/BUILD.gn b/src/BUILD.gn
index 04e0923..3220b4e 100644
--- a/src/BUILD.gn
+++ b/src/BUILD.gn
@@ -71,6 +71,7 @@
     ":std",
     ":string",
     "//src/arch/${plat_arch}/hypervisor",
+    "//vmlib",
     plat_boot_flow,
     plat_console,
     plat_iommu,
diff --git a/src/api.c b/src/api.c
index 39da4d8..981fd5d 100644
--- a/src/api.c
+++ b/src/api.c
@@ -49,6 +49,11 @@
 	      "Currently, a page is mapped for the send and receive buffers so "
 	      "the maximum request is the size of a page.");
 
+static_assert(MM_PPOOL_ENTRY_SIZE >= HF_MAILBOX_SIZE,
+	      "The page pool entry size must be at least as big as the mailbox "
+	      "size, so that memory region descriptors can be copied from the "
+	      "mailbox for memory sharing.");
+
 static struct mpool api_page_pool;
 
 /**
@@ -380,7 +385,6 @@
 	case SPCI_MEM_DONATE_32:
 	case SPCI_MEM_LEND_32:
 	case SPCI_MEM_SHARE_32:
-	case HF_SPCI_MEM_RELINQUISH:
 		return (struct spci_value){.func = receiver->mailbox.recv_func,
 					   .arg3 = receiver->mailbox.recv_size,
 					   .arg4 = receiver->mailbox.recv_size};
@@ -1453,9 +1457,7 @@
 	struct vm *from = current->vm;
 	struct vm *to;
 	const void *from_msg;
-	uint32_t message_buffer_size;
 	struct spci_memory_region *memory_region;
-	struct two_vm_locked vm_to_from_lock;
 	struct spci_value ret;
 
 	if (ipa_addr(address) != 0 || page_count != 0) {
@@ -1486,25 +1488,36 @@
 	}
 
 	/*
-	 * Copy the memory region descriptor to an internal buffer, so that the
-	 * sender can't change it underneath us.
+	 * Copy the memory region descriptor to a fresh page from the memory
+	 * pool. This prevents the sender from changing it underneath us, and
+	 * also lets us keep it around in the share state table if needed.
 	 */
-	memory_region =
-		(struct spci_memory_region *)cpu_get_buffer(current->cpu);
-	message_buffer_size = cpu_get_buffer_size(current->cpu);
-	if (length > HF_MAILBOX_SIZE || length > message_buffer_size) {
+	if (length > HF_MAILBOX_SIZE || length > MM_PPOOL_ENTRY_SIZE) {
 		return spci_error(SPCI_INVALID_PARAMETERS);
 	}
-	memcpy_s(memory_region, message_buffer_size, from_msg, length);
+	memory_region =
+		(struct spci_memory_region *)mpool_alloc(&api_page_pool);
+	if (memory_region == NULL) {
+		dlog_verbose("Failed to allocate memory region copy.\n");
+		return spci_error(SPCI_NO_MEMORY);
+	}
+	memcpy_s(memory_region, MM_PPOOL_ENTRY_SIZE, from_msg, length);
 
 	/* The sender must match the caller. */
 	if (memory_region->sender != from->id) {
-		return spci_error(SPCI_INVALID_PARAMETERS);
+		dlog_verbose("Memory region sender doesn't match caller.\n");
+		ret = spci_error(SPCI_INVALID_PARAMETERS);
+		goto out;
 	}
 
 	if (memory_region->attribute_count != 1) {
 		/* Hafnium doesn't support multi-way memory sharing for now. */
-		return spci_error(SPCI_NOT_SUPPORTED);
+		dlog_verbose(
+			"Multi-way memory sharing not supported (got %d "
+			"attribute descriptors, expected 0).\n",
+			memory_region->attribute_count);
+		ret = spci_error(SPCI_INVALID_PARAMETERS);
+		goto out;
 	}
 
 	/*
@@ -1512,41 +1525,219 @@
 	 */
 	to = vm_find(memory_region->attributes[0].receiver);
 	if (to == NULL || to == from) {
+		dlog_verbose("Invalid receiver.\n");
+		ret = spci_error(SPCI_INVALID_PARAMETERS);
+		goto out;
+	}
+
+	if (to->id == HF_TEE_VM_ID) {
+		/*
+		 * The 'to' VM lock is only needed in the case that it is the
+		 * TEE VM.
+		 */
+		struct two_vm_locked vm_to_from_lock = vm_lock_both(to, from);
+
+		if (msg_receiver_busy(vm_to_from_lock.vm1, from, false)) {
+			ret = spci_error(SPCI_BUSY);
+			goto out_unlock;
+		}
+
+		ret = spci_memory_send(to, vm_to_from_lock.vm2, memory_region,
+				       length, share_func, &api_page_pool);
+		/*
+		 * spci_memory_send takes ownership of the memory_region, so
+		 * make sure we don't free it.
+		 */
+		memory_region = NULL;
+
+		if (ret.func == SPCI_SUCCESS_32 && to->id == HF_TEE_VM_ID) {
+			/* Forward memory send message on to TEE. */
+			memcpy_s(to->mailbox.recv, SPCI_MSG_PAYLOAD_MAX,
+				 memory_region, length);
+			mpool_free(&api_page_pool, memory_region);
+			memory_region = NULL;
+			to->mailbox.recv_size = length;
+			to->mailbox.recv_sender = from->id;
+			to->mailbox.recv_func = share_func;
+			ret = deliver_msg(vm_to_from_lock.vm1, from->id,
+					  current, next);
+		}
+
+	out_unlock:
+		vm_unlock(&vm_to_from_lock.vm1);
+		vm_unlock(&vm_to_from_lock.vm2);
+	} else {
+		struct vm_locked from_locked = vm_lock(from);
+
+		ret = spci_memory_send(to, from_locked, memory_region, length,
+				       share_func, &api_page_pool);
+		/*
+		 * spci_memory_send takes ownership of the memory_region, so
+		 * make sure we don't free it.
+		 */
+		memory_region = NULL;
+
+		vm_unlock(&from_locked);
+	}
+
+out:
+	if (memory_region != NULL) {
+		mpool_free(&api_page_pool, memory_region);
+	}
+
+	return ret;
+}
+
+struct spci_value api_spci_mem_retrieve_req(ipaddr_t address,
+					    uint32_t page_count,
+					    uint32_t fragment_length,
+					    uint32_t length, uint32_t cookie,
+					    struct vcpu *current)
+{
+	struct vm *to = current->vm;
+	struct vm_locked to_locked;
+	const void *to_msg;
+	struct spci_memory_retrieve_request *retrieve_request;
+	uint32_t message_buffer_size;
+	struct spci_value ret;
+
+	if (ipa_addr(address) != 0 || page_count != 0) {
+		/*
+		 * Hafnium only supports passing the descriptor in the TX
+		 * mailbox.
+		 */
 		return spci_error(SPCI_INVALID_PARAMETERS);
 	}
 
-	vm_to_from_lock = vm_lock_both(to, from);
+	if (fragment_length == length && cookie != 0) {
+		/* Cookie is only allowed if there are multiple fragments. */
+		dlog_verbose("Unexpected cookie %d.\n", cookie);
+		return spci_error(SPCI_INVALID_PARAMETERS);
+	}
 
-	if (msg_receiver_busy(vm_to_from_lock.vm1, from, false)) {
+	retrieve_request =
+		(struct spci_memory_retrieve_request *)cpu_get_buffer(
+			current->cpu);
+	message_buffer_size = cpu_get_buffer_size(current->cpu);
+	if (length > HF_MAILBOX_SIZE || length > message_buffer_size) {
+		dlog_verbose("Retrieve request too long.\n");
+		return spci_error(SPCI_INVALID_PARAMETERS);
+	}
+
+	to_locked = vm_lock(to);
+	to_msg = to->mailbox.send;
+
+	if (to_msg == NULL) {
+		dlog_verbose("TX buffer not setup.\n");
+		ret = spci_error(SPCI_INVALID_PARAMETERS);
+		goto out;
+	}
+
+	/*
+	 * Copy the retrieve request descriptor to an internal buffer, so that
+	 * the caller can't change it underneath us.
+	 */
+	memcpy_s(retrieve_request, message_buffer_size, to_msg, length);
+
+	if (msg_receiver_busy(to_locked, NULL, false)) {
+		/*
+		 * Can't retrieve memory information if the mailbox is not
+		 * available.
+		 */
+		dlog_verbose("RX buffer not ready.\n");
 		ret = spci_error(SPCI_BUSY);
 		goto out;
 	}
 
-	ret = spci_memory_send(vm_to_from_lock.vm1, vm_to_from_lock.vm2,
-			       memory_region, length, share_func,
-			       &api_page_pool);
-
-	if (ret.func == SPCI_SUCCESS_32) {
-		/* Copy data to the destination Rx. */
-		/*
-		 * TODO: Translate the <from> IPA addresses to <to> IPA
-		 * addresses. Currently we assume identity mapping of the stage
-		 * 2 translation. Removing this assumption relies on a mechanism
-		 * to handle scenarios where the memory region fits in the
-		 * source Tx buffer but cannot fit in the destination Rx buffer.
-		 * This mechanism will be defined at the spec level.
-		 */
-		memcpy_s(to->mailbox.recv, SPCI_MSG_PAYLOAD_MAX, memory_region,
-			 length);
-		to->mailbox.recv_size = length;
-		to->mailbox.recv_sender = from->id;
-		to->mailbox.recv_func = share_func;
-		ret = deliver_msg(vm_to_from_lock.vm1, from->id, current, next);
-	}
+	ret = spci_memory_retrieve(to_locked, retrieve_request, length,
+				   &api_page_pool);
 
 out:
-	vm_unlock(&vm_to_from_lock.vm1);
-	vm_unlock(&vm_to_from_lock.vm2);
+	vm_unlock(&to_locked);
+	return ret;
+}
+
+struct spci_value api_spci_mem_relinquish(struct vcpu *current)
+{
+	struct vm *from = current->vm;
+	struct vm_locked from_locked;
+	const void *from_msg;
+	struct spci_mem_relinquish *relinquish_request;
+	uint32_t message_buffer_size;
+	struct spci_value ret;
+	uint32_t length;
+
+	from_locked = vm_lock(from);
+	from_msg = from->mailbox.send;
+
+	if (from_msg == NULL) {
+		dlog_verbose("TX buffer not setup.\n");
+		ret = spci_error(SPCI_INVALID_PARAMETERS);
+		goto out;
+	}
+
+	/*
+	 * Calculate length from relinquish descriptor before copying. We will
+	 * check again later to make sure it hasn't changed.
+	 */
+	length = sizeof(struct spci_mem_relinquish) +
+		 ((struct spci_mem_relinquish *)from_msg)->endpoint_count *
+			 sizeof(spci_vm_id_t);
+	/*
+	 * Copy the relinquish descriptor to an internal buffer, so that the
+	 * caller can't change it underneath us.
+	 */
+	relinquish_request =
+		(struct spci_mem_relinquish *)cpu_get_buffer(current->cpu);
+	message_buffer_size = cpu_get_buffer_size(current->cpu);
+	if (length > HF_MAILBOX_SIZE || length > message_buffer_size) {
+		dlog_verbose("Relinquish message too long.\n");
+		ret = spci_error(SPCI_INVALID_PARAMETERS);
+		goto out;
+	}
+	memcpy_s(relinquish_request, message_buffer_size, from_msg, length);
+
+	if (sizeof(struct spci_mem_relinquish) +
+		    relinquish_request->endpoint_count * sizeof(spci_vm_id_t) !=
+	    length) {
+		dlog_verbose(
+			"Endpoint count changed while copying to internal "
+			"buffer.\n");
+		ret = spci_error(SPCI_INVALID_PARAMETERS);
+		goto out;
+	}
+
+	ret = spci_memory_relinquish(from_locked, relinquish_request,
+				     &api_page_pool);
+
+out:
+	vm_unlock(&from_locked);
+	return ret;
+}
+
+struct spci_value api_spci_mem_reclaim(uint32_t handle, uint32_t flags,
+				       struct vcpu *current)
+{
+	struct vm *to = current->vm;
+	struct vm_locked to_locked;
+	struct spci_value ret;
+
+	to_locked = vm_lock(to);
+
+	if ((handle & SPCI_MEMORY_HANDLE_ALLOCATOR_MASK) ==
+	    SPCI_MEMORY_HANDLE_ALLOCATOR_HYPERVISOR) {
+		ret = spci_memory_reclaim(to_locked, handle,
+					  flags & SPCI_MEM_RECLAIM_CLEAR,
+					  &api_page_pool);
+	} else {
+		dlog_verbose(
+			"Tried to reclaim handle %#x not allocated by "
+			"hypervisor.\n",
+			handle);
+		ret = spci_error(SPCI_INVALID_PARAMETERS);
+	}
+
+	vm_unlock(&to_locked);
 
 	return ret;
 }
diff --git a/src/arch/aarch64/hypervisor/handler.c b/src/arch/aarch64/hypervisor/handler.c
index b4646d3..4a4f035 100644
--- a/src/arch/aarch64/hypervisor/handler.c
+++ b/src/arch/aarch64/hypervisor/handler.c
@@ -366,11 +366,21 @@
 	case SPCI_MEM_DONATE_32:
 	case SPCI_MEM_LEND_32:
 	case SPCI_MEM_SHARE_32:
-	case HF_SPCI_MEM_RELINQUISH:
 		*args = api_spci_mem_send(func, ipa_init(args->arg1),
 					  args->arg2, args->arg3, args->arg4,
 					  args->arg5, current(), next);
 		return true;
+	case SPCI_MEM_RETRIEVE_REQ_32:
+		*args = api_spci_mem_retrieve_req(
+			ipa_init(args->arg1), args->arg2, args->arg3,
+			args->arg4, args->arg5, current());
+		return true;
+	case SPCI_MEM_RELINQUISH_32:
+		*args = api_spci_mem_relinquish(current());
+		return true;
+	case SPCI_MEM_RECLAIM_32:
+		*args = api_spci_mem_reclaim(args->arg1, args->arg2, current());
+		return true;
 	}
 
 	return false;
diff --git a/src/init.c b/src/init.c
index f944461..2f241b8 100644
--- a/src/init.c
+++ b/src/init.c
@@ -38,9 +38,7 @@
 
 #include "vmapi/hf/call.h"
 
-alignas(alignof(
-	struct mm_page_table)) char ptable_buf[sizeof(struct mm_page_table) *
-					       HEAP_PAGES];
+alignas(MM_PPOOL_ENTRY_SIZE) char ptable_buf[MM_PPOOL_ENTRY_SIZE * HEAP_PAGES];
 
 static struct mpool ppool;
 
@@ -58,7 +56,7 @@
 
 	dlog_notice("Initialising hafnium\n");
 
-	mpool_init(&ppool, sizeof(struct mm_page_table));
+	mpool_init(&ppool, MM_PPOOL_ENTRY_SIZE);
 	mpool_add_chunk(&ppool, ptable_buf, sizeof(ptable_buf));
 
 	if (!mm_init(&ppool)) {
diff --git a/src/spci_memory.c b/src/spci_memory.c
index afd6315..eeafc05 100644
--- a/src/spci_memory.c
+++ b/src/spci_memory.c
@@ -24,6 +24,16 @@
 #include "hf/std.h"
 #include "hf/vm.h"
 
+/** The maximum number of recipients a memory region may be sent to. */
+#define MAX_MEM_SHARE_RECIPIENTS 1
+
+/**
+ * The maximum number of memory sharing handles which may be active at once. A
+ * DONATE handle is active from when it is sent to when it is retrieved; a SHARE
+ * or LEND handle is active from when it is sent to when it is reclaimed.
+ */
+#define MAX_MEM_SHARES 100
+
 static_assert(sizeof(struct spci_memory_region_constituent) % 16 == 0,
 	      "struct spci_memory_region_constituent must be a multiple of 16 "
 	      "bytes long.");
@@ -32,14 +42,227 @@
 	      "bytes long.");
 static_assert(sizeof(struct spci_memory_region) % 16 == 0,
 	      "struct spci_memory_region must be a multiple of 16 bytes long.");
+static_assert(sizeof(struct spci_receiver_address_range) % 16 == 0,
+	      "struct spci_receiver_address_range must be a multiple of 16 "
+	      "bytes long.");
+static_assert(sizeof(struct spci_retrieved_memory_region) % 16 == 0,
+	      "struct spci_retrieved_memory_region must be a multiple of 16 "
+	      "bytes long.");
+static_assert(sizeof(struct spci_memory_retrieve_properties) % 16 == 0,
+	      "struct spci_memory_retrieve_properties must be a multiple of 16 "
+	      "bytes long.");
+static_assert(sizeof(struct spci_memory_retrieve_request) % 16 == 0,
+	      "struct spci_memory_retrieve_request must be a multiple of 16 "
+	      "bytes long.");
 
-struct spci_mem_transitions {
-	uint32_t orig_from_mode;
-	uint32_t orig_to_mode;
-	uint32_t from_mode;
-	uint32_t to_mode;
+struct spci_memory_share_state {
+	/**
+	 * The memory region being shared, or NULL if this share state is
+	 * unallocated.
+	 */
+	struct spci_memory_region *memory_region;
+
+	/**
+	 * The SPCI function used for sharing the memory. Must be one of
+	 * SPCI_MEM_DONATE_32, SPCI_MEM_LEND_32 or SPCI_MEM_SHARE_32 if the
+	 * share state is allocated, or 0.
+	 */
+	uint32_t share_func;
+
+	/**
+	 * Whether each recipient has retrieved the memory region yet. The order
+	 * of this array matches the order of the attribute descriptors in the
+	 * memory region descriptor. Any entries beyond the attribute_count will
+	 * always be false.
+	 */
+	bool retrieved[MAX_MEM_SHARE_RECIPIENTS];
 };
 
+/**
+ * Encapsulates the set of share states while the `share_states_lock` is held.
+ */
+struct share_states_locked {
+	struct spci_memory_share_state *share_states;
+};
+
+/**
+ * All access to members of a `struct spci_memory_share_state` must be guarded
+ * by this lock.
+ */
+static struct spinlock share_states_lock_instance = SPINLOCK_INIT;
+static struct spci_memory_share_state share_states[MAX_MEM_SHARES];
+
+/**
+ * Initialises the next available `struct spci_memory_share_state` and sets
+ * `handle` to its handle. Returns true on succes or false if none are
+ * available.
+ */
+static bool allocate_share_state(uint32_t share_func,
+				 struct spci_memory_region *memory_region,
+				 spci_memory_handle_t *handle)
+{
+	uint32_t i;
+
+	CHECK(memory_region != NULL);
+
+	sl_lock(&share_states_lock_instance);
+	for (i = 0; i < MAX_MEM_SHARES; ++i) {
+		if (share_states[i].share_func == 0) {
+			uint32_t j;
+			struct spci_memory_share_state *allocated_state =
+				&share_states[i];
+			allocated_state->share_func = share_func;
+			allocated_state->memory_region = memory_region;
+			for (j = 0; j < MAX_MEM_SHARE_RECIPIENTS; ++j) {
+				allocated_state->retrieved[j] = false;
+			}
+			*handle = i | SPCI_MEMORY_HANDLE_ALLOCATOR_HYPERVISOR;
+			sl_unlock(&share_states_lock_instance);
+			return true;
+		}
+	}
+
+	sl_unlock(&share_states_lock_instance);
+	return false;
+}
+
+/** Locks the share states lock. */
+struct share_states_locked share_states_lock(void)
+{
+	sl_lock(&share_states_lock_instance);
+
+	return (struct share_states_locked){.share_states = share_states};
+}
+
+/** Unlocks the share states lock. */
+static void share_states_unlock(struct share_states_locked *share_states)
+{
+	CHECK(share_states->share_states != NULL);
+	share_states->share_states = NULL;
+	sl_unlock(&share_states_lock_instance);
+}
+
+/**
+ * If the given handle is a valid handle for an allocated share state then takes
+ * the lock, initialises `share_state_locked` to point to the share state and
+ * returns true. Otherwise returns false and doesn't take the lock.
+ */
+static bool get_share_state(struct share_states_locked share_states,
+			    spci_memory_handle_t handle,
+			    struct spci_memory_share_state **share_state_ret)
+{
+	struct spci_memory_share_state *share_state;
+	uint32_t index = handle & ~SPCI_MEMORY_HANDLE_ALLOCATOR_MASK;
+
+	if (index >= MAX_MEM_SHARES) {
+		return false;
+	}
+
+	share_state = &share_states.share_states[index];
+
+	if (share_state->share_func == 0) {
+		return false;
+	}
+
+	*share_state_ret = share_state;
+	return true;
+}
+
+/** Marks a share state as unallocated. */
+static void share_state_free(struct share_states_locked share_states,
+			     struct spci_memory_share_state *share_state,
+			     struct mpool *page_pool)
+{
+	CHECK(share_states.share_states != NULL);
+	share_state->share_func = 0;
+	mpool_free(page_pool, share_state->memory_region);
+	share_state->memory_region = NULL;
+}
+
+/**
+ * Marks the share state with the given handle as unallocated, or returns false
+ * if the handle was invalid.
+ */
+static bool share_state_free_handle(spci_memory_handle_t handle,
+				    struct mpool *page_pool)
+{
+	struct share_states_locked share_states = share_states_lock();
+	struct spci_memory_share_state *share_state;
+
+	if (!get_share_state(share_states, handle, &share_state)) {
+		share_states_unlock(&share_states);
+		return false;
+	}
+
+	share_state_free(share_states, share_state, page_pool);
+	share_states_unlock(&share_states);
+
+	return true;
+}
+
+static void dump_memory_region(struct spci_memory_region *memory_region)
+{
+	uint32_t i;
+
+	if (LOG_LEVEL < LOG_LEVEL_VERBOSE) {
+		return;
+	}
+
+	dlog("from VM %d, tag %d, flags %#x, %d total pages in %d constituents "
+	     "to %d recipients [",
+	     memory_region->sender, memory_region->tag, memory_region->flags,
+	     memory_region->page_count, memory_region->constituent_count,
+	     memory_region->attribute_count);
+	for (i = 0; i < memory_region->attribute_count; ++i) {
+		if (i != 0) {
+			dlog(", ");
+		}
+		dlog("VM %d: %#x", memory_region->attributes[i].receiver,
+		     memory_region->attributes[i].memory_attributes);
+	}
+	dlog("]");
+}
+
+static void dump_share_states(void)
+{
+	uint32_t i;
+
+	if (LOG_LEVEL < LOG_LEVEL_VERBOSE) {
+		return;
+	}
+
+	dlog("Current share states:\n");
+	sl_lock(&share_states_lock_instance);
+	for (i = 0; i < MAX_MEM_SHARES; ++i) {
+		if (share_states[i].share_func != 0) {
+			dlog("%d: ", i);
+			switch (share_states[i].share_func) {
+			case SPCI_MEM_SHARE_32:
+				dlog("SHARE");
+				break;
+			case SPCI_MEM_LEND_32:
+				dlog("LEND");
+				break;
+			case SPCI_MEM_DONATE_32:
+				dlog("DONATE");
+				break;
+			default:
+				dlog("invalid share_func %#x",
+				     share_states[i].share_func);
+			}
+			dlog(" (");
+			dump_memory_region(share_states[i].memory_region);
+			if (share_states[i].retrieved[0]) {
+				dlog("): retrieved\n");
+			} else {
+				dlog("): not retrieved\n");
+			}
+			break;
+		}
+	}
+	sl_unlock(&share_states_lock_instance);
+}
+
 /* TODO: Add device attributes: GRE, cacheability, shareability. */
 static inline uint32_t spci_memory_attrs_to_mode(uint16_t memory_attributes)
 {
@@ -64,188 +287,21 @@
 }
 
 /**
- * Obtain the next mode to apply to the two VMs.
- *
- * Returns true iff a state transition was found.
+ * Get the current mode in the stage-2 page table of the given vm of all the
+ * pages in the given constituents, if they all have the same mode, or return
+ * false if not.
  */
-static bool spci_msg_get_next_state(
-	const struct spci_mem_transitions *transitions,
-	uint32_t transition_count, uint32_t memory_to_attributes,
-	uint32_t orig_from_mode, uint32_t orig_to_mode, uint32_t *from_mode,
-	uint32_t *to_mode)
-{
-	const uint32_t state_mask =
-		MM_MODE_INVALID | MM_MODE_UNOWNED | MM_MODE_SHARED;
-	const uint32_t orig_from_state = orig_from_mode & state_mask;
-
-	for (uint32_t index = 0; index < transition_count; index++) {
-		uint32_t table_orig_from_mode =
-			transitions[index].orig_from_mode;
-		uint32_t table_orig_to_mode = transitions[index].orig_to_mode;
-
-		if (((orig_from_state) == table_orig_from_mode) &&
-		    ((orig_to_mode & state_mask) == table_orig_to_mode)) {
-			*to_mode = transitions[index].to_mode |
-				   memory_to_attributes;
-
-			*from_mode = transitions[index].from_mode |
-				     (~state_mask & orig_from_mode);
-
-			return true;
-		}
-	}
-	return false;
-}
-
-/**
- * Verify that all pages have the same mode, that the starting mode
- * constitutes a valid state and obtain the next mode to apply
- * to the two VMs.
- *
- * Returns:
- *  The error code false indicates that:
- *   1) a state transition was not found;
- *   2) the pages being shared do not have the same mode within the <to>
- *     or <from> VMs;
- *   3) The beginning and end IPAs are not page aligned;
- *   4) The requested share type was not handled.
- *  Success is indicated by true.
- */
-static bool spci_msg_check_transition(
-	struct vm *to, struct vm *from, uint32_t share_func,
-	uint32_t *orig_from_mode,
+static bool constituents_get_mode(
+	struct vm_locked vm, uint32_t *orig_mode,
 	struct spci_memory_region_constituent *constituents,
-	uint32_t constituent_count, uint32_t memory_to_attributes,
-	uint32_t *from_mode, uint32_t *to_mode)
+	uint32_t constituent_count)
 {
-	uint32_t orig_to_mode;
-	const struct spci_mem_transitions *mem_transition_table;
-	uint32_t transition_table_size;
 	uint32_t i;
 
-	/*
-	 * TODO: Transition table does not currently consider the multiple
-	 * shared case.
-	 */
-	static const struct spci_mem_transitions donate_transitions[] = {
-		{
-			/* 1) {O-EA, !O-NA} -> {!O-NA, O-EA} */
-			.orig_from_mode = 0,
-			.orig_to_mode = MM_MODE_INVALID | MM_MODE_UNOWNED,
-			.from_mode = MM_MODE_INVALID | MM_MODE_UNOWNED,
-			.to_mode = 0,
-		},
-		{
-			/*
-			 * Duplicate of 1) in order to cater for an alternative
-			 * representation of !O-NA:
-			 * (INVALID | UNOWNED | SHARED) and (INVALID | UNOWNED)
-			 * are both alternate representations of !O-NA.
-			 */
-			/* 4) {O-EA, !O-NA} -> {!O-NA, O-EA} */
-			.orig_from_mode = 0,
-			.orig_to_mode = MM_MODE_INVALID | MM_MODE_UNOWNED |
-					MM_MODE_SHARED,
-			.from_mode = MM_MODE_INVALID | MM_MODE_UNOWNED |
-				     MM_MODE_SHARED,
-			.to_mode = 0,
-		},
-	};
-
-	static const uint32_t size_donate_transitions =
-		ARRAY_SIZE(donate_transitions);
-
-	/*
-	 * This data structure holds the allowed state transitions for the
-	 * "lend" state machine. In this state machine the owner keeps ownership
-	 * but loses access to the lent pages.
-	 */
-	static const struct spci_mem_transitions lend_transitions[] = {
-		{
-			/* 1) {O-EA, !O-NA} -> {O-NA, !O-EA} */
-			.orig_from_mode = 0,
-			.orig_to_mode = MM_MODE_INVALID | MM_MODE_UNOWNED |
-					MM_MODE_SHARED,
-			.from_mode = MM_MODE_INVALID,
-			.to_mode = MM_MODE_UNOWNED,
-		},
-		{
-			/*
-			 * Duplicate of 1) in order to cater for an alternative
-			 * representation of !O-NA:
-			 * (INVALID | UNOWNED | SHARED) and (INVALID | UNOWNED)
-			 * are both alternate representations of !O-NA.
-			 */
-			/* 2) {O-EA, !O-NA} -> {O-NA, !O-EA} */
-			.orig_from_mode = 0,
-			.orig_to_mode = MM_MODE_INVALID | MM_MODE_UNOWNED,
-			.from_mode = MM_MODE_INVALID,
-			.to_mode = MM_MODE_UNOWNED,
-		},
-	};
-
-	static const uint32_t size_lend_transitions =
-		ARRAY_SIZE(lend_transitions);
-
-	/*
-	 * This data structure holds the allowed state transitions for the
-	 * "share" state machine. In this state machine the owner keeps the
-	 * shared pages mapped on its stage2 table and keeps access as well.
-	 */
-	static const struct spci_mem_transitions share_transitions[] = {
-		{
-			/* 1) {O-EA, !O-NA} -> {O-SA, !O-SA} */
-			.orig_from_mode = 0,
-			.orig_to_mode = MM_MODE_INVALID | MM_MODE_UNOWNED |
-					MM_MODE_SHARED,
-			.from_mode = MM_MODE_SHARED,
-			.to_mode = MM_MODE_UNOWNED | MM_MODE_SHARED,
-		},
-		{
-			/*
-			 * Duplicate of 1) in order to cater for an alternative
-			 * representation of !O-NA:
-			 * (INVALID | UNOWNED | SHARED) and (INVALID | UNOWNED)
-			 * are both alternate representations of !O-NA.
-			 */
-			/* 2) {O-EA, !O-NA} -> {O-SA, !O-SA} */
-			.orig_from_mode = 0,
-			.orig_to_mode = MM_MODE_INVALID | MM_MODE_UNOWNED,
-			.from_mode = MM_MODE_SHARED,
-			.to_mode = MM_MODE_UNOWNED | MM_MODE_SHARED,
-		},
-	};
-
-	static const uint32_t size_share_transitions =
-		ARRAY_SIZE(share_transitions);
-
-	static const struct spci_mem_transitions relinquish_transitions[] = {
-		{
-			/* 1) {!O-EA, O-NA} -> {!O-NA, O-EA} */
-			.orig_from_mode = MM_MODE_UNOWNED,
-			.orig_to_mode = MM_MODE_INVALID,
-			.from_mode = MM_MODE_INVALID | MM_MODE_UNOWNED |
-				     MM_MODE_SHARED,
-			.to_mode = 0,
-		},
-		{
-			/* 2) {!O-SA, O-SA} -> {!O-NA, O-EA} */
-			.orig_from_mode = MM_MODE_UNOWNED | MM_MODE_SHARED,
-			.orig_to_mode = MM_MODE_SHARED,
-			.from_mode = MM_MODE_INVALID | MM_MODE_UNOWNED |
-				     MM_MODE_SHARED,
-			.to_mode = 0,
-		},
-	};
-
-	static const uint32_t size_relinquish_transitions =
-		ARRAY_SIZE(relinquish_transitions);
-
 	if (constituent_count == 0) {
 		/*
-		 * Fail if there are no constituents. Otherwise
-		 * spci_msg_get_next_state would get an unitialised
-		 * *orig_from_mode and orig_to_mode.
+		 * Fail if there are no constituents. Otherwise we would get an
+		 * uninitialised *orig_mode.
 		 */
 		return false;
 	}
@@ -256,8 +312,7 @@
 				&constituents[i]));
 		size_t size = constituents[i].page_count * PAGE_SIZE;
 		ipaddr_t end = ipa_add(begin, size);
-		uint32_t current_from_mode;
-		uint32_t current_to_mode;
+		uint32_t current_mode;
 
 		/* Fail if addresses are not page-aligned. */
 		if (!is_aligned(ipa_addr(begin), PAGE_SIZE) ||
@@ -269,10 +324,8 @@
 		 * Ensure that this constituent memory range is all mapped with
 		 * the same mode.
 		 */
-		if (!mm_vm_get_mode(&from->ptable, begin, end,
-				    &current_from_mode) ||
-		    !mm_vm_get_mode(&to->ptable, begin, end,
-				    &current_to_mode)) {
+		if (!mm_vm_get_mode(&vm.vm->ptable, begin, end,
+				    &current_mode)) {
 			return false;
 		}
 
@@ -280,48 +333,191 @@
 		 * Ensure that all constituents are mapped with the same mode.
 		 */
 		if (i == 0) {
-			*orig_from_mode = current_from_mode;
-			orig_to_mode = current_to_mode;
-		} else if (current_from_mode != *orig_from_mode ||
-			   current_to_mode != orig_to_mode) {
+			*orig_mode = current_mode;
+		} else if (current_mode != *orig_mode) {
 			return false;
 		}
 	}
 
-	/* Ensure the address range is normal memory and not a device. */
-	if (*orig_from_mode & MM_MODE_D) {
+	return true;
+}
+
+/**
+ * Verify that all pages have the same mode, that the starting mode
+ * constitutes a valid state and obtain the next mode to apply
+ * to the sending VM.
+ *
+ * Returns:
+ *  The error code false indicates that:
+ *   1) a state transition was not found;
+ *   2) the pages being shared do not have the same mode within the <from> VM;
+ *   3) The beginning and end IPAs are not page aligned;
+ *   4) The requested share type was not handled.
+ *  Success is indicated by true.
+ *
+ */
+static bool spci_send_check_transition(
+	struct vm_locked from, uint32_t share_func, uint32_t *orig_from_mode,
+	struct spci_memory_region_constituent *constituents,
+	uint32_t constituent_count, uint32_t *from_mode)
+{
+	const uint32_t state_mask =
+		MM_MODE_INVALID | MM_MODE_UNOWNED | MM_MODE_SHARED;
+
+	if (!constituents_get_mode(from, orig_from_mode, constituents,
+				   constituent_count)) {
 		return false;
 	}
 
+	/* Ensure the address range is normal memory and not a device. */
+	if (*orig_from_mode & MM_MODE_D) {
+		dlog_verbose("Can't share device memory (mode is %#x).\n",
+			     *orig_from_mode);
+		return false;
+	}
+
+	/*
+	 * Ensure the sender is the owner and has exclusive access to the
+	 * memory.
+	 */
+	if ((*orig_from_mode & state_mask) != 0) {
+		return false;
+	}
+
+	/* Find the appropriate new mode. */
+	*from_mode = ~state_mask & *orig_from_mode;
 	switch (share_func) {
 	case SPCI_MEM_DONATE_32:
-		mem_transition_table = donate_transitions;
-		transition_table_size = size_donate_transitions;
+		*from_mode |= MM_MODE_INVALID | MM_MODE_UNOWNED;
 		break;
 
 	case SPCI_MEM_LEND_32:
-		mem_transition_table = lend_transitions;
-		transition_table_size = size_lend_transitions;
+		*from_mode |= MM_MODE_INVALID;
 		break;
 
 	case SPCI_MEM_SHARE_32:
-		mem_transition_table = share_transitions;
-		transition_table_size = size_share_transitions;
-		break;
-
-	case HF_SPCI_MEM_RELINQUISH:
-		mem_transition_table = relinquish_transitions;
-		transition_table_size = size_relinquish_transitions;
+		*from_mode |= MM_MODE_SHARED;
 		break;
 
 	default:
 		return false;
 	}
 
-	return spci_msg_get_next_state(mem_transition_table,
-				       transition_table_size,
-				       memory_to_attributes, *orig_from_mode,
-				       orig_to_mode, from_mode, to_mode);
+	return true;
+}
+
+static bool spci_relinquish_check_transition(
+	struct vm_locked from, uint32_t *orig_from_mode,
+	struct spci_memory_region_constituent *constituents,
+	uint32_t constituent_count, uint32_t *from_mode)
+{
+	const uint32_t state_mask =
+		MM_MODE_INVALID | MM_MODE_UNOWNED | MM_MODE_SHARED;
+	uint32_t orig_from_state;
+
+	if (!constituents_get_mode(from, orig_from_mode, constituents,
+				   constituent_count)) {
+		return false;
+	}
+
+	/* Ensure the address range is normal memory and not a device. */
+	if (*orig_from_mode & MM_MODE_D) {
+		dlog_verbose("Can't relinquish device memory (mode is %#x).\n",
+			     *orig_from_mode);
+		return false;
+	}
+
+	/*
+	 * Ensure the relinquishing VM is not the owner but has access to the
+	 * memory.
+	 */
+	orig_from_state = *orig_from_mode & state_mask;
+	if ((orig_from_state & ~MM_MODE_SHARED) != MM_MODE_UNOWNED) {
+		dlog_verbose(
+			"Tried to relinquish memory in state %#x (masked %#x "
+			"but "
+			"should be %#x).\n",
+			*orig_from_mode, orig_from_state, MM_MODE_UNOWNED);
+		return false;
+	}
+
+	/* Find the appropriate new mode. */
+	*from_mode = (~state_mask & *orig_from_mode) | MM_MODE_UNMAPPED_MASK;
+
+	return true;
+}
+
+/**
+ * Verify that all pages have the same mode, that the starting mode
+ * constitutes a valid state and obtain the next mode to apply
+ * to the retrieving VM.
+ *
+ * Returns:
+ *  The error code false indicates that:
+ *   1) a state transition was not found;
+ *   2) the pages being shared do not have the same mode within the <to> VM;
+ *   3) The beginning and end IPAs are not page aligned;
+ *   4) The requested share type was not handled.
+ *  Success is indicated by true.
+ */
+static bool spci_retrieve_check_transition(
+	struct vm_locked to, uint32_t share_func,
+	struct spci_memory_region_constituent *constituents,
+	uint32_t constituent_count, uint32_t memory_to_attributes,
+	uint32_t *to_mode)
+{
+	uint32_t orig_to_mode;
+
+	if (!constituents_get_mode(to, &orig_to_mode, constituents,
+				   constituent_count)) {
+		return false;
+	}
+
+	if (share_func == SPCI_MEM_RECLAIM_32) {
+		const uint32_t state_mask =
+			MM_MODE_INVALID | MM_MODE_UNOWNED | MM_MODE_SHARED;
+		uint32_t orig_to_state = orig_to_mode & state_mask;
+
+		if (orig_to_state != MM_MODE_INVALID &&
+		    orig_to_state != MM_MODE_SHARED) {
+			return false;
+		}
+	} else {
+		/*
+		 * Ensure the retriever has the expected state. We don't care
+		 * about the MM_MODE_SHARED bit; either with or without it set
+		 * are both valid representations of the !O-NA state.
+		 */
+		if ((orig_to_mode & MM_MODE_UNMAPPED_MASK) !=
+		    MM_MODE_UNMAPPED_MASK) {
+			return false;
+		}
+	}
+
+	/* Find the appropriate new mode. */
+	*to_mode = memory_to_attributes;
+	switch (share_func) {
+	case SPCI_MEM_DONATE_32:
+		*to_mode |= 0;
+		break;
+
+	case SPCI_MEM_LEND_32:
+		*to_mode |= MM_MODE_UNOWNED;
+		break;
+
+	case SPCI_MEM_SHARE_32:
+		*to_mode |= MM_MODE_UNOWNED | MM_MODE_SHARED;
+		break;
+
+	case SPCI_MEM_RECLAIM_32:
+		*to_mode |= 0;
+		break;
+
+	default:
+		return false;
+	}
+
+	return true;
 }
 
 /**
@@ -460,30 +656,27 @@
 }
 
 /**
- * Shares memory from the calling VM with another. The memory can be shared in
- * different modes.
+ * Validates and prepares memory to be sent from the calling VM to another.
  *
- * This function requires the calling context to hold the <to> and <from> locks.
+ * This function requires the calling context to hold the <from> VM lock.
  *
  * Returns:
- *  In case of error one of the following values is returned:
+ *  In case of error, one of the following values is returned:
  *   1) SPCI_INVALID_PARAMETERS - The endpoint provided parameters were
  *     erroneous;
  *   2) SPCI_NO_MEMORY - Hafnium did not have sufficient memory to complete
  *     the request.
  *  Success is indicated by SPCI_SUCCESS.
  */
-static struct spci_value spci_share_memory(
-	struct vm_locked to_locked, struct vm_locked from_locked,
+static struct spci_value spci_send_memory(
+	struct vm_locked from_locked,
 	struct spci_memory_region_constituent *constituents,
-	uint32_t constituent_count, uint32_t memory_to_attributes,
-	uint32_t share_func, struct mpool *page_pool, bool clear)
+	uint32_t constituent_count, uint32_t share_func,
+	struct mpool *page_pool, bool clear)
 {
-	struct vm *to = to_locked.vm;
 	struct vm *from = from_locked.vm;
 	uint32_t orig_from_mode;
 	uint32_t from_mode;
-	uint32_t to_mode;
 	struct mpool local_page_pool;
 	struct spci_value ret;
 
@@ -492,26 +685,17 @@
 	 * not we would get alignment faults trying to read (32-bit) values.
 	 */
 	if (!is_aligned(constituents, 4)) {
-		dlog_verbose("Constituents not aligned.\n");
-		return spci_error(SPCI_INVALID_PARAMETERS);
-	}
-
-	/* Disallow reflexive shares as this suggests an error in the VM. */
-	if (to == from) {
-		dlog_verbose("Reflexive share.\n");
 		return spci_error(SPCI_INVALID_PARAMETERS);
 	}
 
 	/*
-	 * Check if the state transition is lawful for both VMs involved
-	 * in the memory exchange, ensure that all constituents of a memory
-	 * region being shared are at the same state.
+	 * Check if the state transition is lawful for the sender, ensure that
+	 * all constituents of a memory region being shared are at the same
+	 * state.
 	 */
-	if (!spci_msg_check_transition(to, from, share_func, &orig_from_mode,
-				       constituents, constituent_count,
-				       memory_to_attributes, &from_mode,
-				       &to_mode)) {
-		dlog_verbose("Invalid transition.\n");
+	if (!spci_send_check_transition(from_locked, share_func,
+					&orig_from_mode, constituents,
+					constituent_count, &from_mode)) {
 		return spci_error(SPCI_INVALID_PARAMETERS);
 	}
 
@@ -523,16 +707,12 @@
 	mpool_init_with_fallback(&local_page_pool, page_pool);
 
 	/*
-	 * First reserve all required memory for the new page table entries in
-	 * both sender and recipient page tables without committing, to make
-	 * sure the entire operation will succeed without exhausting the page
-	 * pool.
+	 * First reserve all required memory for the new page table entries
+	 * without committing, to make sure the entire operation will succeed
+	 * without exhausting the page pool.
 	 */
 	if (!spci_region_group_identity_map(from_locked, constituents,
 					    constituent_count, from_mode,
-					    page_pool, false) ||
-	    !spci_region_group_identity_map(to_locked, constituents,
-					    constituent_count, to_mode,
 					    page_pool, false)) {
 		/* TODO: partial defrag of failed range. */
 		ret = spci_error(SPCI_NO_MEMORY);
@@ -540,10 +720,10 @@
 	}
 
 	/*
-	 * First update the mapping for the sender so there is no overlap with
-	 * the recipient. This won't allocate because the transaction was
-	 * already prepared above, but may free pages in the case that a whole
-	 * block is being unmapped that was previously partially mapped.
+	 * Update the mapping for the sender. This won't allocate because the
+	 * transaction was already prepared above, but may free pages in the
+	 * case that a whole block is being unmapped that was previously
+	 * partially mapped.
 	 */
 	CHECK(spci_region_group_identity_map(from_locked, constituents,
 					     constituent_count, from_mode,
@@ -566,6 +746,95 @@
 		goto out;
 	}
 
+	ret = (struct spci_value){.func = SPCI_SUCCESS_32};
+
+out:
+	mpool_fini(&local_page_pool);
+
+	/*
+	 * Tidy up the page table by reclaiming failed mappings (if there was an
+	 * error) or merging entries into blocks where possible (on success).
+	 */
+	mm_vm_defrag(&from->ptable, page_pool);
+
+	return ret;
+}
+
+/**
+ * Validates and maps memory shared from one VM to another.
+ *
+ * This function requires the calling context to hold the <to> lock.
+ *
+ * Returns:
+ *  In case of error, one of the following values is returned:
+ *   1) SPCI_INVALID_PARAMETERS - The endpoint provided parameters were
+ *     erroneous;
+ *   2) SPCI_NO_MEMORY - Hafnium did not have sufficient memory to complete
+ *     the request.
+ *  Success is indicated by SPCI_SUCCESS.
+ */
+static struct spci_value spci_retrieve_memory(
+	struct vm_locked to_locked,
+	struct spci_memory_region_constituent *constituents,
+	uint32_t constituent_count, uint32_t memory_to_attributes,
+	uint32_t share_func, bool clear, struct mpool *page_pool)
+{
+	struct vm *to = to_locked.vm;
+	uint32_t to_mode;
+	struct mpool local_page_pool;
+	struct spci_value ret;
+
+	/*
+	 * Make sure constituents are properly aligned to a 32-bit boundary. If
+	 * not we would get alignment faults trying to read (32-bit) values.
+	 */
+	if (!is_aligned(constituents, 4)) {
+		dlog_verbose("Constituents not aligned.\n");
+		return spci_error(SPCI_INVALID_PARAMETERS);
+	}
+
+	/*
+	 * Check if the state transition is lawful for the recipient, and ensure
+	 * that all constituents of the memory region being retrieved are at the
+	 * same state.
+	 */
+	if (!spci_retrieve_check_transition(to_locked, share_func, constituents,
+					    constituent_count,
+					    memory_to_attributes, &to_mode)) {
+		dlog_verbose("Invalid transition.\n");
+		return spci_error(SPCI_INVALID_PARAMETERS);
+	}
+
+	/*
+	 * Create a local pool so any freed memory can't be used by another
+	 * thread. This is to ensure the original mapping can be restored if the
+	 * clear fails.
+	 */
+	mpool_init_with_fallback(&local_page_pool, page_pool);
+
+	/*
+	 * First reserve all required memory for the new page table entries in
+	 * the recipient page tables without committing, to make sure the entire
+	 * operation will succeed without exhausting the page pool.
+	 */
+	if (!spci_region_group_identity_map(to_locked, constituents,
+					    constituent_count, to_mode,
+					    page_pool, false)) {
+		/* TODO: partial defrag of failed range. */
+		dlog_verbose(
+			"Insufficient memory to update recipient page "
+			"table.\n");
+		ret = spci_error(SPCI_NO_MEMORY);
+		goto out;
+	}
+
+	/* Clear the memory so no VM or device can see the previous contents. */
+	if (clear && !spci_clear_memory_constituents(
+			     constituents, constituent_count, page_pool)) {
+		ret = spci_error(SPCI_NO_MEMORY);
+		goto out;
+	}
+
 	/*
 	 * Complete the transfer by mapping the memory into the recipient. This
 	 * won't allocate because the transaction was already prepared above, so
@@ -581,11 +850,88 @@
 	mpool_fini(&local_page_pool);
 
 	/*
-	 * Tidy up the page tables by reclaiming failed mappings (if there was
+	 * Tidy up the page table by reclaiming failed mappings (if there was
 	 * an error) or merging entries into blocks where possible (on success).
 	 */
 	mm_vm_defrag(&to->ptable, page_pool);
-	mm_vm_defrag(&from->ptable, page_pool);
+
+	return ret;
+}
+
+static struct spci_value spci_relinquish_memory(
+	struct vm_locked from_locked,
+	struct spci_memory_region_constituent *constituents,
+	uint32_t constituent_count, struct mpool *page_pool, bool clear)
+{
+	uint32_t orig_from_mode;
+	uint32_t from_mode;
+	struct mpool local_page_pool;
+	struct spci_value ret;
+
+	if (!spci_relinquish_check_transition(from_locked, &orig_from_mode,
+					      constituents, constituent_count,
+					      &from_mode)) {
+		dlog_verbose("Invalid transition.\n");
+		return spci_error(SPCI_INVALID_PARAMETERS);
+	}
+
+	/*
+	 * Create a local pool so any freed memory can't be used by another
+	 * thread. This is to ensure the original mapping can be restored if the
+	 * clear fails.
+	 */
+	mpool_init_with_fallback(&local_page_pool, page_pool);
+
+	/*
+	 * First reserve all required memory for the new page table entries
+	 * without committing, to make sure the entire operation will succeed
+	 * without exhausting the page pool.
+	 */
+	if (!spci_region_group_identity_map(from_locked, constituents,
+					    constituent_count, from_mode,
+					    page_pool, false)) {
+		/* TODO: partial defrag of failed range. */
+		ret = spci_error(SPCI_NO_MEMORY);
+		goto out;
+	}
+
+	/*
+	 * Update the mapping for the sender. This won't allocate because the
+	 * transaction was already prepared above, but may free pages in the
+	 * case that a whole block is being unmapped that was previously
+	 * partially mapped.
+	 */
+	CHECK(spci_region_group_identity_map(from_locked, constituents,
+					     constituent_count, from_mode,
+					     &local_page_pool, true));
+
+	/* Clear the memory so no VM or device can see the previous contents. */
+	if (clear && !spci_clear_memory_constituents(
+			     constituents, constituent_count, page_pool)) {
+		/*
+		 * On failure, roll back by returning memory to the sender. This
+		 * may allocate pages which were previously freed into
+		 * `local_page_pool` by the call above, but will never allocate
+		 * more pages than that so can never fail.
+		 */
+		CHECK(spci_region_group_identity_map(
+			from_locked, constituents, constituent_count,
+			orig_from_mode, &local_page_pool, true));
+
+		ret = spci_error(SPCI_NO_MEMORY);
+		goto out;
+	}
+
+	ret = (struct spci_value){.func = SPCI_SUCCESS_32};
+
+out:
+	mpool_fini(&local_page_pool);
+
+	/*
+	 * Tidy up the page table by reclaiming failed mappings (if there was an
+	 * error) or merging entries into blocks where possible (on success).
+	 */
+	mm_vm_defrag(&from_locked.vm->ptable, page_pool);
 
 	return ret;
 }
@@ -598,19 +944,25 @@
  *
  * Assumes that the caller has already found and locked both VMs and ensured
  * that the destination RX buffer is available, and copied the memory region
- * descriptor from the sender's TX buffer to a trusted internal buffer.
+ * descriptor from the sender's TX buffer to a freshly allocated page from
+ * Hafnium's internal pool.
+ *
+ * This function takes ownership of the `memory_region` passed in; it must not
+ * be freed by the caller.
  */
-struct spci_value spci_memory_send(struct vm_locked to_locked,
-				   struct vm_locked from_locked,
+struct spci_value spci_memory_send(struct vm *to, struct vm_locked from_locked,
 				   struct spci_memory_region *memory_region,
 				   uint32_t memory_share_size,
 				   uint32_t share_func, struct mpool *page_pool)
 {
-	uint32_t memory_to_attributes;
+	struct spci_memory_region_constituent *constituents =
+		spci_memory_region_get_constituents(memory_region);
+	uint32_t constituent_count = memory_region->constituent_count;
 	uint32_t attributes_size;
 	uint32_t constituents_size;
-	struct spci_memory_region_constituent *constituents;
-	uint32_t constituent_count = memory_region->constituent_count;
+	bool clear;
+	struct spci_value ret;
+	spci_memory_handle_t handle;
 
 	/*
 	 * Ensure the number of constituents are within the memory
@@ -624,42 +976,416 @@
 		    sizeof(struct spci_memory_region) + attributes_size ||
 	    memory_share_size !=
 		    memory_region->constituent_offset + constituents_size) {
+		dlog_verbose("Invalid size %d or constituent offset %d.\n",
+			     memory_share_size,
+			     memory_region->constituent_offset);
+		mpool_free(page_pool, memory_region);
 		return spci_error(SPCI_INVALID_PARAMETERS);
 	}
 
 	/* The sender must match the message sender. */
 	if (memory_region->sender != from_locked.vm->id) {
+		dlog_verbose("Invalid sender %d.\n", memory_region->sender);
+		mpool_free(page_pool, memory_region);
 		return spci_error(SPCI_INVALID_PARAMETERS);
 	}
 
 	/* We only support a single recipient. */
 	if (memory_region->attribute_count != 1) {
+		dlog_verbose("Multiple recipients not supported.\n");
+		mpool_free(page_pool, memory_region);
 		return spci_error(SPCI_NOT_SUPPORTED);
 	}
 
 	/* The recipient must match the message recipient. */
-	if (memory_region->attributes[0].receiver != to_locked.vm->id) {
+	if (memory_region->attributes[0].receiver != to->id) {
+		mpool_free(page_pool, memory_region);
 		return spci_error(SPCI_INVALID_PARAMETERS);
 	}
 
-	switch (share_func) {
-	case SPCI_MEM_DONATE_32:
-	case SPCI_MEM_LEND_32:
-	case SPCI_MEM_SHARE_32:
-		memory_to_attributes = spci_memory_attrs_to_mode(
-			memory_region->attributes[0].memory_attributes);
-		break;
-	case HF_SPCI_MEM_RELINQUISH:
-		memory_to_attributes = MM_MODE_R | MM_MODE_W | MM_MODE_X;
-		break;
-	default:
-		dlog_error("Invalid memory sharing message.\n");
+	clear = memory_region->flags & SPCI_MEMORY_REGION_FLAG_CLEAR;
+	/*
+	 * Clear is not allowed for memory sharing, as the sender still has
+	 * access to the memory.
+	 */
+	if (clear && share_func == SPCI_MEM_SHARE_32) {
+		dlog_verbose("Memory can't be cleared while being shared.\n");
 		return spci_error(SPCI_INVALID_PARAMETERS);
 	}
 
+	/*
+	 * Allocate a share state before updating the page table. Otherwise if
+	 * updating the page table succeeded but allocating the share state
+	 * failed then it would leave the memory in a state where nobody could
+	 * get it back.
+	 */
+	if (to->id != HF_TEE_VM_ID &&
+	    !allocate_share_state(share_func, memory_region, &handle)) {
+		dlog_verbose("Failed to allocate share state.\n");
+		mpool_free(page_pool, memory_region);
+		return spci_error(SPCI_NO_MEMORY);
+	}
+
+	dump_share_states();
+
+	/* Check that state is valid in sender page table and update. */
+	ret = spci_send_memory(from_locked, constituents, constituent_count,
+			       share_func, page_pool, clear);
+	if (ret.func != SPCI_SUCCESS_32) {
+		if (to->id != HF_TEE_VM_ID) {
+			/* Free share state. */
+			bool freed = share_state_free_handle(handle, page_pool);
+
+			CHECK(freed);
+		}
+
+		return ret;
+	}
+
+	if (to->id == HF_TEE_VM_ID) {
+		/* Return directly, no need to allocate share state. */
+		return (struct spci_value){.func = SPCI_SUCCESS_32};
+	}
+
+	return (struct spci_value){.func = SPCI_SUCCESS_32, .arg2 = handle};
+}
+
+struct spci_value spci_memory_retrieve(
+	struct vm_locked to_locked,
+	struct spci_memory_retrieve_request *retrieve_request,
+	uint32_t retrieve_request_size, struct mpool *page_pool)
+{
+	uint32_t expected_retrieve_request_size =
+		sizeof(struct spci_memory_retrieve_request) +
+		retrieve_request->retrieve_properties_count *
+			sizeof(struct spci_memory_retrieve_properties);
+	spci_memory_handle_t handle = retrieve_request->handle;
+	struct spci_memory_region *memory_region;
+	struct spci_memory_retrieve_properties *retrieve_properties;
+	uint32_t memory_to_attributes;
+	struct spci_memory_region_constituent *constituents;
+	uint32_t constituent_count;
+	struct share_states_locked share_states;
+	struct spci_memory_share_state *share_state;
+	struct spci_value ret;
+	uint32_t response_size;
+
+	dump_share_states();
+
+	if (retrieve_request_size != expected_retrieve_request_size) {
+		dlog_verbose(
+			"Invalid length for SPCI_MEM_RETRIEVE_REQ, expected %d "
+			"but was %d.\n",
+			expected_retrieve_request_size, retrieve_request_size);
+		return spci_error(SPCI_INVALID_PARAMETERS);
+	}
+
+	share_states = share_states_lock();
+	if (!get_share_state(share_states, handle, &share_state)) {
+		dlog_verbose("Invalid handle %#x for SPCI_MEM_RETRIEVE_REQ.\n",
+			     handle);
+		ret = spci_error(SPCI_INVALID_PARAMETERS);
+		goto out;
+	}
+
+	if (retrieve_request->share_func != share_state->share_func) {
+		dlog_verbose(
+			"Incorrect transaction type %#x for "
+			"SPCI_MEM_RETRIEVE_REQ, expected %#x for handle %#x.\n",
+			retrieve_request->share_func, share_state->share_func,
+			handle);
+		ret = spci_error(SPCI_INVALID_PARAMETERS);
+		goto out;
+	}
+
+	memory_region = share_state->memory_region;
+	CHECK(memory_region != NULL);
+
+	if (retrieve_request->sender != memory_region->sender) {
+		dlog_verbose(
+			"Incorrect sender ID %d for SPCI_MEM_RETRIEVE_REQ, "
+			"expected %d for handle %#x.\n",
+			retrieve_request->sender, memory_region->sender,
+			handle);
+		ret = spci_error(SPCI_INVALID_PARAMETERS);
+		goto out;
+	}
+
+	if (retrieve_request->tag != memory_region->tag) {
+		dlog_verbose(
+			"Incorrect tag %d for SPCI_MEM_RETRIEVE_REQ, expected "
+			"%d for handle %#x.\n",
+			retrieve_request->tag, memory_region->tag, handle);
+		ret = spci_error(SPCI_INVALID_PARAMETERS);
+		goto out;
+	}
+
+	if (memory_region->attributes[0].receiver != to_locked.vm->id) {
+		dlog_verbose(
+			"Incorrect receiver VM ID %d for "
+			"SPCI_MEM_RETRIEVE_REQ, expected %d for handle %#x.\n",
+			to_locked.vm->id, memory_region->attributes[0].receiver,
+			handle);
+		ret = spci_error(SPCI_INVALID_PARAMETERS);
+		goto out;
+	}
+
+	if (share_state->retrieved[0]) {
+		dlog_verbose("Memory with handle %#x already retrieved.\n",
+			     handle);
+		ret = spci_error(SPCI_DENIED);
+		goto out;
+	}
+
+	if (retrieve_request->attribute_count != 0) {
+		dlog_verbose(
+			"Multi-way memory sharing not supported (got %d "
+			"attribute descriptors on SPCI_MEM_RETRIEVE_REQ, "
+			"expected 0).\n",
+			retrieve_request->attribute_count);
+		ret = spci_error(SPCI_NOT_SUPPORTED);
+		goto out;
+	}
+
+	if (retrieve_request->retrieve_properties_count != 1) {
+		dlog_verbose(
+			"Stream endpoints not supported (got %d retrieve "
+			"properties descriptors on SPCI_MEM_RETRIEVE_REQ, "
+			"expected 1).\n",
+			retrieve_request->retrieve_properties_count);
+		ret = spci_error(SPCI_INVALID_PARAMETERS);
+		goto out;
+	}
+
+	retrieve_properties =
+		spci_memory_retrieve_request_first_retrieve_properties(
+			retrieve_request);
+
+	if (retrieve_properties->attributes.receiver != to_locked.vm->id) {
+		dlog_verbose(
+			"Retrieve properties receiver VM ID %d didn't match "
+			"caller of SPCI_MEM_RETRIEVE_REQ.\n",
+			retrieve_properties->attributes.receiver);
+		ret = spci_error(SPCI_INVALID_PARAMETERS);
+		goto out;
+	}
+
+	if (retrieve_properties->page_count != memory_region->page_count) {
+		dlog_verbose(
+			"Incorrect page count %d for "
+			"SPCI_MEM_RETRIEVE_REQ, expected %d for handle %#x.\n",
+			retrieve_properties->page_count,
+			memory_region->page_count, handle);
+		ret = spci_error(SPCI_INVALID_PARAMETERS);
+		goto out;
+	}
+
+	if (retrieve_properties->constituent_count != 0) {
+		dlog_verbose(
+			"Retriever specified address ranges not supported (got "
+			"%d).\n",
+			retrieve_properties->constituent_count);
+		ret = spci_error(SPCI_INVALID_PARAMETERS);
+		goto out;
+	}
+
+	memory_to_attributes = spci_memory_attrs_to_mode(
+		memory_region->attributes[0].memory_attributes);
+
+	constituents = spci_memory_region_get_constituents(memory_region);
+	constituent_count = memory_region->constituent_count;
+	ret = spci_retrieve_memory(to_locked, constituents, constituent_count,
+				   memory_to_attributes,
+				   share_state->share_func, false, page_pool);
+	if (ret.func != SPCI_SUCCESS_32) {
+		goto out;
+	}
+
+	/*
+	 * Copy response to RX buffer of caller and deliver the message. This
+	 * must be done before the share_state is (possibly) freed.
+	 */
+	response_size = spci_retrieved_memory_region_init(
+		to_locked.vm->mailbox.recv, HF_MAILBOX_SIZE, to_locked.vm->id,
+		constituents, constituent_count, memory_region->page_count);
+	to_locked.vm->mailbox.recv_size = response_size;
+	to_locked.vm->mailbox.recv_sender = HF_HYPERVISOR_VM_ID;
+	to_locked.vm->mailbox.recv_func = SPCI_MEM_RETRIEVE_RESP_32;
+	to_locked.vm->mailbox.state = MAILBOX_STATE_READ;
+
+	if (share_state->share_func == SPCI_MEM_DONATE_32) {
+		/*
+		 * Memory that has been donated can't be relinquished, so no
+		 * need to keep the share state around.
+		 */
+		share_state_free(share_states, share_state, page_pool);
+		dlog_verbose("Freed share state for donate.\n");
+	} else {
+		share_state->retrieved[0] = true;
+	}
+
+	ret = (struct spci_value){.func = SPCI_MEM_RETRIEVE_RESP_32,
+				  .arg3 = response_size,
+				  .arg4 = response_size};
+
+out:
+	share_states_unlock(&share_states);
+	dump_share_states();
+	return ret;
+}
+
+struct spci_value spci_memory_relinquish(
+	struct vm_locked from_locked,
+	struct spci_mem_relinquish *relinquish_request, struct mpool *page_pool)
+{
+	spci_memory_handle_t handle = relinquish_request->handle;
+	struct share_states_locked share_states;
+	struct spci_memory_share_state *share_state;
+	struct spci_memory_region *memory_region;
+	bool clear;
+	struct spci_memory_region_constituent *constituents;
+	uint32_t constituent_count;
+	struct spci_value ret;
+
+	if (relinquish_request->endpoint_count != 0) {
+		dlog_verbose(
+			"Stream endpoints not supported (got %d extra "
+			"endpoints on SPCI_MEM_RELINQUISH, expected 0).\n",
+			relinquish_request->endpoint_count);
+		return spci_error(SPCI_INVALID_PARAMETERS);
+	}
+
+	if (relinquish_request->sender != from_locked.vm->id) {
+		dlog_verbose(
+			"VM ID %d in relinquish message doesn't match calling "
+			"VM ID %d.\n",
+			relinquish_request->sender, from_locked.vm->id);
+		return spci_error(SPCI_INVALID_PARAMETERS);
+	}
+
+	dump_share_states();
+
+	share_states = share_states_lock();
+	if (!get_share_state(share_states, handle, &share_state)) {
+		dlog_verbose("Invalid handle %#x for SPCI_MEM_RELINQUISH.\n",
+			     handle);
+		ret = spci_error(SPCI_INVALID_PARAMETERS);
+		goto out;
+	}
+
+	memory_region = share_state->memory_region;
+	CHECK(memory_region != NULL);
+
+	if (memory_region->attributes[0].receiver != from_locked.vm->id) {
+		dlog_verbose(
+			"VM ID %d tried to relinquish memory region with "
+			"handle %#x but receiver was %d.\n",
+			from_locked.vm->id, handle,
+			memory_region->attributes[0].receiver);
+		ret = spci_error(SPCI_INVALID_PARAMETERS);
+		goto out;
+	}
+
+	if (!share_state->retrieved[0]) {
+		dlog_verbose(
+			"Memory with handle %#x not yet retrieved, can't "
+			"relinquish.\n",
+			handle);
+		ret = spci_error(SPCI_INVALID_PARAMETERS);
+		goto out;
+	}
+
+	clear = relinquish_request->flags & SPCI_MEMORY_REGION_FLAG_CLEAR;
+
+	/*
+	 * Clear is not allowed for memory that was shared, as the original
+	 * sender still has access to the memory.
+	 */
+	if (clear && share_state->share_func == SPCI_MEM_SHARE_32) {
+		dlog_verbose("Memory which was shared can't be cleared.\n");
+		ret = spci_error(SPCI_INVALID_PARAMETERS);
+		goto out;
+	}
+
 	constituents = spci_memory_region_get_constituents(memory_region);
-	return spci_share_memory(
-		to_locked, from_locked, constituents, constituent_count,
-		memory_to_attributes, share_func, page_pool,
-		memory_region->flags & SPCI_MEMORY_REGION_FLAG_CLEAR);
+	constituent_count = memory_region->constituent_count;
+	ret = spci_relinquish_memory(from_locked, constituents,
+				     constituent_count, page_pool, clear);
+
+	if (ret.func == SPCI_SUCCESS_32) {
+		/*
+		 * Mark memory handle as not retrieved, so it can be reclaimed
+		 * (or retrieved again).
+		 */
+		share_state->retrieved[0] = false;
+	}
+
+out:
+	share_states_unlock(&share_states);
+	dump_share_states();
+	return ret;
+}
+
+/**
+ * Validates that the reclaim transition is allowed for the given handle,
+ * updates the page table of the reclaiming VM, and frees the internal state
+ * associated with the handle.
+ */
+struct spci_value spci_memory_reclaim(struct vm_locked to_locked,
+				      spci_memory_handle_t handle, bool clear,
+				      struct mpool *page_pool)
+{
+	struct share_states_locked share_states;
+	struct spci_memory_share_state *share_state;
+	struct spci_memory_region *memory_region;
+	struct spci_memory_region_constituent *constituents;
+	uint32_t constituent_count;
+	uint32_t memory_to_attributes = MM_MODE_R | MM_MODE_W | MM_MODE_X;
+	struct spci_value ret;
+
+	dump_share_states();
+
+	share_states = share_states_lock();
+	if (!get_share_state(share_states, handle, &share_state)) {
+		dlog_verbose("Invalid handle %#x for SPCI_MEM_RECLAIM.\n",
+			     handle);
+		ret = spci_error(SPCI_INVALID_PARAMETERS);
+		goto out;
+	}
+
+	memory_region = share_state->memory_region;
+	CHECK(memory_region != NULL);
+
+	if (to_locked.vm->id != memory_region->sender) {
+		dlog_verbose(
+			"VM %d attempted to reclaim memory handle %#x "
+			"originally sent by VM %d.\n",
+			to_locked.vm->id, handle, memory_region->sender);
+		ret = spci_error(SPCI_INVALID_PARAMETERS);
+		goto out;
+	}
+
+	if (share_state->retrieved[0]) {
+		dlog_verbose(
+			"Tried to reclaim memory handle %#x that has not been "
+			"relinquished.\n",
+			handle);
+		ret = spci_error(SPCI_DENIED);
+		goto out;
+	}
+
+	constituents = spci_memory_region_get_constituents(memory_region);
+	constituent_count = memory_region->constituent_count;
+	ret = spci_retrieve_memory(to_locked, constituents, constituent_count,
+				   memory_to_attributes, SPCI_MEM_RECLAIM_32,
+				   clear, page_pool);
+
+	if (ret.func == SPCI_SUCCESS_32) {
+		share_state_free(share_states, share_state, page_pool);
+		dlog_verbose("Freed share state after successful reclaim.\n");
+	}
+
+out:
+	share_states_unlock(&share_states);
+	return ret;
 }
diff --git a/test/inc/test/vmapi/spci.h b/test/inc/test/vmapi/spci.h
index ae6df07..24e9fc5 100644
--- a/test/inc/test/vmapi/spci.h
+++ b/test/inc/test/vmapi/spci.h
@@ -31,3 +31,12 @@
 };
 
 struct mailbox_buffers set_up_mailbox(void);
+spci_memory_handle_t send_memory_and_retrieve_request(
+	uint32_t share_func, void *tx_buffer, spci_vm_id_t sender,
+	spci_vm_id_t recipient,
+	struct spci_memory_region_constituent constituents[],
+	uint32_t constituent_count, spci_memory_region_flags_t flags,
+	enum spci_memory_access access);
+spci_vm_id_t retrieve_memory_from_message(void *recv_buf, void *send_buf,
+					  struct spci_value msg_ret,
+					  spci_memory_handle_t *handle);
diff --git a/test/vmapi/common/spci.c b/test/vmapi/common/spci.c
index a175cea..c3176b3 100644
--- a/test/vmapi/common/spci.c
+++ b/test/vmapi/common/spci.c
@@ -41,3 +41,95 @@
 		.recv = recv_page,
 	};
 }
+
+/*
+ * Helper function to send memory to a VM then send a message with the retrieve
+ * request it needs to retrieve it.
+ */
+spci_memory_handle_t send_memory_and_retrieve_request(
+	uint32_t share_func, void *tx_buffer, spci_vm_id_t sender,
+	spci_vm_id_t recipient,
+	struct spci_memory_region_constituent constituents[],
+	uint32_t constituent_count, spci_memory_region_flags_t flags,
+	enum spci_memory_access access)
+{
+	uint32_t msg_size;
+	struct spci_value ret;
+	uint32_t page_count = 0;
+	uint32_t handle;
+	uint32_t i;
+
+	/* Send the memory. */
+	msg_size = spci_memory_region_init(
+		tx_buffer, sender, recipient, constituents, constituent_count,
+		0, flags, access, SPCI_MEMORY_NORMAL_MEM,
+		SPCI_MEMORY_CACHE_WRITE_BACK, SPCI_MEMORY_OUTER_SHAREABLE);
+	switch (share_func) {
+	case SPCI_MEM_DONATE_32:
+		ret = spci_mem_donate(msg_size, msg_size, 0);
+		break;
+	case SPCI_MEM_LEND_32:
+		ret = spci_mem_lend(msg_size, msg_size, 0);
+		break;
+	case SPCI_MEM_SHARE_32:
+		ret = spci_mem_share(msg_size, msg_size, 0);
+		break;
+	default:
+		FAIL("Invalid share_func %#x.\n", share_func);
+		/* Never reached, but needed to keep clang-analyser happy. */
+		return 0;
+	}
+	EXPECT_EQ(ret.func, SPCI_SUCCESS_32);
+	handle = spci_mem_success_handle(ret);
+
+	/* Count pages. */
+	for (i = 0; i < constituent_count; ++i) {
+		page_count += constituents[i].page_count;
+	}
+
+	/*
+	 * Send the appropriate retrieve request to the VM so that it can use it
+	 * to retrieve the memory.
+	 */
+	msg_size = spci_memory_retrieve_request_init(
+		tx_buffer, handle, sender, recipient, share_func, 0, page_count,
+		access, SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
+		SPCI_MEMORY_OUTER_SHAREABLE);
+	EXPECT_EQ(spci_msg_send(sender, recipient, msg_size, 0).func,
+		  SPCI_SUCCESS_32);
+
+	return handle;
+}
+
+/*
+ * Use the retrieve request from the recieve buffer to retrieve a memory region
+ * which has been sent to us. Returns the sender, and the handle via a return
+ * parameter.
+ */
+spci_vm_id_t retrieve_memory_from_message(void *recv_buf, void *send_buf,
+					  struct spci_value msg_ret,
+					  spci_memory_handle_t *handle)
+{
+	uint32_t msg_size;
+	struct spci_value ret;
+	struct spci_retrieved_memory_region *memory_region;
+	spci_vm_id_t sender;
+
+	EXPECT_EQ(msg_ret.func, SPCI_MSG_SEND_32);
+	msg_size = spci_msg_send_size(msg_ret);
+	sender = spci_msg_send_sender(msg_ret);
+
+	if (handle != NULL) {
+		struct spci_memory_retrieve_request *retrieve_request =
+			(struct spci_memory_retrieve_request *)recv_buf;
+		*handle = retrieve_request->handle;
+	}
+	memcpy_s(send_buf, HF_MAILBOX_SIZE, recv_buf, msg_size);
+	spci_rx_release();
+	ret = spci_mem_retrieve_req(msg_size, msg_size, 0);
+	EXPECT_EQ(ret.func, SPCI_MEM_RETRIEVE_RESP_32);
+	memory_region = (struct spci_retrieved_memory_region *)recv_buf;
+	EXPECT_EQ(memory_region->receiver_count, 1);
+
+	return sender;
+}
diff --git a/test/vmapi/primary_with_secondaries/memory_sharing.c b/test/vmapi/primary_with_secondaries/memory_sharing.c
index 17f8bc1..5050f11 100644
--- a/test/vmapi/primary_with_secondaries/memory_sharing.c
+++ b/test/vmapi/primary_with_secondaries/memory_sharing.c
@@ -160,27 +160,18 @@
  * Tries relinquishing memory with different VMs and asserts that
  * it will fail.
  */
-static void check_cannot_relinquish_memory(
-	struct mailbox_buffers mb,
-	struct spci_memory_region_constituent constituents[],
-	int constituent_count)
+static void check_cannot_relinquish_memory(struct mailbox_buffers mb,
+					   spci_memory_handle_t handle)
 {
 	uint32_t vms[] = {HF_PRIMARY_VM_ID, SERVICE_VM1, SERVICE_VM2};
 
 	size_t i;
-	size_t j;
 	for (i = 0; i < ARRAY_SIZE(vms); ++i) {
-		for (j = 0; j < ARRAY_SIZE(vms); ++j) {
-			uint32_t msg_size = spci_memory_region_init(
-				mb.send, vms[j], vms[i], constituents,
-				constituent_count, 0, 0, SPCI_MEMORY_RW_X,
-				SPCI_MEMORY_NORMAL_MEM,
-				SPCI_MEMORY_CACHE_WRITE_BACK,
-				SPCI_MEMORY_OUTER_SHAREABLE);
-			EXPECT_SPCI_ERROR(
-				hf_spci_mem_relinquish(msg_size, msg_size, 0),
-				SPCI_INVALID_PARAMETERS);
-		}
+		*(struct spci_mem_relinquish *)mb.send =
+			(struct spci_mem_relinquish){.handle = handle,
+						     .sender = vms[i]};
+		EXPECT_SPCI_ERROR(spci_mem_relinquish(),
+				  SPCI_INVALID_PARAMETERS);
 	}
 }
 
@@ -198,7 +189,6 @@
 	struct spci_value run_res;
 	struct mailbox_buffers mb = set_up_mailbox();
 	uint8_t *ptr = pages;
-	uint32_t msg_size;
 	struct spci_memory_region_constituent constituents[] = {
 		spci_memory_region_constituent_init((uint64_t)pages, 1),
 	};
@@ -207,13 +197,9 @@
 
 	memset_s(ptr, sizeof(pages), 'a', PAGE_SIZE);
 
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, SPCI_MEMORY_REGION_FLAG_CLEAR,
-		SPCI_MEMORY_RW_X, SPCI_MEMORY_NORMAL_MEM,
-		SPCI_MEMORY_CACHE_WRITE_BACK, SPCI_MEMORY_OUTER_SHAREABLE);
-
-	EXPECT_EQ(spci_mem_share(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	send_memory_and_retrieve_request(
+		SPCI_MEM_SHARE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	run_res = spci_run(SERVICE_VM1, 0);
 	EXPECT_EQ(run_res.func, SPCI_YIELD_32);
@@ -238,10 +224,10 @@
  */
 TEST(memory_sharing, share_concurrently_and_get_back)
 {
+	spci_memory_handle_t handle;
 	struct spci_value run_res;
 	struct mailbox_buffers mb = set_up_mailbox();
 	uint8_t *ptr = pages;
-	uint32_t msg_size;
 	struct spci_memory_region_constituent constituents[] = {
 		spci_memory_region_constituent_init((uint64_t)pages, 1),
 	};
@@ -251,20 +237,18 @@
 	/* Dirty the memory before sharing it. */
 	memset_s(ptr, sizeof(pages), 'b', PAGE_SIZE);
 
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_share(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	handle = send_memory_and_retrieve_request(
+		SPCI_MEM_SHARE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	/* Let the memory be returned. */
 	run_res = spci_run(SERVICE_VM1, 0);
-	EXPECT_EQ(run_res.func, HF_SPCI_MEM_RELINQUISH);
+	EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
+	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+	EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
 	for (int i = 0; i < PAGE_SIZE; ++i) {
 		ASSERT_EQ(ptr[i], 'c');
 	}
-	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
 
 	run_res = spci_run(SERVICE_VM1, 0);
 	EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -300,7 +284,7 @@
 	struct spci_value run_res;
 	struct mailbox_buffers mb = set_up_mailbox();
 	uint8_t *ptr = pages;
-	uint32_t msg_size;
+	spci_memory_handle_t handle;
 
 	SERVICE_SELECT(SERVICE_VM1, "spci_memory_lend_relinquish", mb.send);
 
@@ -313,18 +297,16 @@
 						    2),
 	};
 
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
+	handle = send_memory_and_retrieve_request(
+		SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
-	EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
 	run_res = spci_run(SERVICE_VM1, 0);
 
 	/* Let the memory be returned. */
-	EXPECT_EQ(run_res.func, HF_SPCI_MEM_RELINQUISH);
+	EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
 	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+	EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
 
 	/* Ensure that the secondary VM accessed the region. */
 	for (int i = 0; i < PAGE_SIZE; ++i) {
@@ -344,7 +326,6 @@
 	struct spci_value run_res;
 	struct mailbox_buffers mb = set_up_mailbox();
 	uint8_t *ptr = pages;
-	uint32_t msg_size;
 
 	SERVICE_SELECT(SERVICE_VM1, "spci_memory_donate_relinquish", mb.send);
 
@@ -357,13 +338,9 @@
 						    2),
 	};
 
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-
-	EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	send_memory_and_retrieve_request(
+		SPCI_MEM_DONATE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	/*
 	 * Let the service access the memory, and try and fail to relinquish it.
@@ -380,7 +357,6 @@
 	struct spci_value run_res;
 	struct mailbox_buffers mb = set_up_mailbox();
 	uint8_t *ptr = pages;
-	uint32_t msg_size;
 	struct spci_memory_region_constituent constituents[] = {
 		spci_memory_region_constituent_init((uint64_t)pages, 1),
 	};
@@ -390,16 +366,15 @@
 	/* Dirty the memory before giving it. */
 	memset_s(ptr, sizeof(pages), 'b', PAGE_SIZE);
 
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	send_memory_and_retrieve_request(
+		SPCI_MEM_DONATE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
-	/* Let the memory be returned. */
+	/* Let the memory be returned, and retrieve it. */
 	run_res = spci_run(SERVICE_VM1, 0);
-	EXPECT_EQ(run_res.func, SPCI_MEM_DONATE_32);
+	EXPECT_EQ(retrieve_memory_from_message(mb.recv, mb.send, run_res, NULL),
+		  SERVICE_VM1);
+
 	for (int i = 0; i < PAGE_SIZE; ++i) {
 		ASSERT_EQ(ptr[i], 'c');
 	}
@@ -415,10 +390,10 @@
  */
 TEST(memory_sharing, lend_and_get_back)
 {
+	spci_memory_handle_t handle;
 	struct spci_value run_res;
 	struct mailbox_buffers mb = set_up_mailbox();
 	uint8_t *ptr = pages;
-	uint32_t msg_size;
 	struct spci_memory_region_constituent constituents[] = {
 		spci_memory_region_constituent_init((uint64_t)pages, 1),
 	};
@@ -428,20 +403,18 @@
 	/* Dirty the memory before lending it. */
 	memset_s(ptr, sizeof(pages), 'c', PAGE_SIZE);
 
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	handle = send_memory_and_retrieve_request(
+		SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	/* Let the memory be returned. */
 	run_res = spci_run(SERVICE_VM1, 0);
-	EXPECT_EQ(run_res.func, HF_SPCI_MEM_RELINQUISH);
+	EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
+	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+	EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
 	for (int i = 0; i < PAGE_SIZE; ++i) {
 		ASSERT_EQ(ptr[i], 'd');
 	}
-	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
 
 	run_res = spci_run(SERVICE_VM1, 0);
 	EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -449,54 +422,50 @@
 }
 
 /**
- * After memory has been returned, it is free to be shared again.
+ * After memory has been returned, it is free to be lent again.
  */
-TEST(memory_sharing, reshare_after_return)
+TEST(memory_sharing, relend_after_return)
 {
+	spci_memory_handle_t handle;
 	struct spci_value run_res;
 	struct mailbox_buffers mb = set_up_mailbox();
-	uint32_t msg_size;
 	struct spci_memory_region_constituent constituents[] = {
 		spci_memory_region_constituent_init((uint64_t)pages, 1),
 	};
 
 	SERVICE_SELECT(SERVICE_VM1, "spci_memory_lend_relinquish", mb.send);
 
-	/* Share the memory initially. */
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	/* Lend the memory initially. */
+	handle = send_memory_and_retrieve_request(
+		SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	/* Let the memory be returned. */
 	run_res = spci_run(SERVICE_VM1, 0);
-	EXPECT_EQ(run_res.func, HF_SPCI_MEM_RELINQUISH);
+	EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
 	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+	EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
 
-	/* Share the memory again after it has been returned. */
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	/* Lend the memory again after it has been returned. */
+	handle = send_memory_and_retrieve_request(
+		SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	/* Observe the service doesn't fault when accessing the memory. */
 	run_res = spci_run(SERVICE_VM1, 0);
-	EXPECT_EQ(run_res.func, HF_SPCI_MEM_RELINQUISH);
+	EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
 	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+	EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
 }
 
 /**
- * After memory has been returned, it is free to be shared with another VM.
+ * After memory has been returned, it is free to be lent to another VM.
  */
-TEST(memory_sharing, share_elsewhere_after_return)
+TEST(memory_sharing, lend_elsewhere_after_return)
 {
+	spci_memory_handle_t handle;
 	struct spci_value run_res;
 	struct mailbox_buffers mb = set_up_mailbox();
-	uint32_t msg_size;
 	struct spci_memory_region_constituent constituents[] = {
 		spci_memory_region_constituent_init((uint64_t)pages, 1),
 	};
@@ -504,26 +473,21 @@
 	SERVICE_SELECT(SERVICE_VM1, "spci_memory_lend_relinquish", mb.send);
 	SERVICE_SELECT(SERVICE_VM2, "spci_memory_lend_relinquish", mb.send);
 
-	/* Share the memory initially. */
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	/* Lend the memory initially. */
+	handle = send_memory_and_retrieve_request(
+		SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	/* Let the memory be returned. */
 	run_res = spci_run(SERVICE_VM1, 0);
-	EXPECT_EQ(run_res.func, HF_SPCI_MEM_RELINQUISH);
+	EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
 	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+	EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
 
 	/* Share the memory with a different VM after it has been returned. */
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	send_memory_and_retrieve_request(
+		SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	run_res = spci_run(SERVICE_VM1, 0);
 	EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -537,21 +501,23 @@
 {
 	struct spci_value run_res;
 	struct mailbox_buffers mb = set_up_mailbox();
-	struct spci_memory_region *memory_region;
-	struct spci_memory_region_constituent *constituents;
+	struct spci_retrieved_memory_region *memory_region;
+	struct spci_receiver_address_range *range;
 	uint8_t *ptr;
 
 	SERVICE_SELECT(SERVICE_VM1, "give_memory_and_fault", mb.send);
 
 	/* Have the memory be given. */
 	run_res = spci_run(SERVICE_VM1, 0);
-	EXPECT_EQ(run_res.func, SPCI_MEM_DONATE_32);
+	EXPECT_EQ(retrieve_memory_from_message(mb.recv, mb.send, run_res, NULL),
+		  SERVICE_VM1);
 
 	/* Check the memory was cleared. */
-	memory_region = (struct spci_memory_region *)mb.recv;
-	constituents = spci_memory_region_get_constituents(memory_region);
+	memory_region = (struct spci_retrieved_memory_region *)mb.recv;
+	range = spci_retrieved_memory_region_first_receiver_range(
+		memory_region);
 	ptr = (uint8_t *)spci_memory_region_constituent_get_address(
-		&constituents[0]);
+		&range->constituents[0]);
 	for (int i = 0; i < PAGE_SIZE; ++i) {
 		ASSERT_EQ(ptr[i], 0);
 	}
@@ -569,21 +535,23 @@
 {
 	struct spci_value run_res;
 	struct mailbox_buffers mb = set_up_mailbox();
-	struct spci_memory_region *memory_region;
-	struct spci_memory_region_constituent *constituents;
+	struct spci_retrieved_memory_region *memory_region;
+	struct spci_receiver_address_range *range;
 	uint8_t *ptr;
 
 	SERVICE_SELECT(SERVICE_VM1, "lend_memory_and_fault", mb.send);
 
 	/* Have the memory be lent. */
 	run_res = spci_run(SERVICE_VM1, 0);
-	EXPECT_EQ(run_res.func, SPCI_MEM_LEND_32);
+	EXPECT_EQ(retrieve_memory_from_message(mb.recv, mb.send, run_res, NULL),
+		  SERVICE_VM1);
 
 	/* Check the memory was cleared. */
-	memory_region = (struct spci_memory_region *)mb.recv;
-	constituents = spci_memory_region_get_constituents(memory_region);
+	memory_region = (struct spci_retrieved_memory_region *)mb.recv;
+	range = spci_retrieved_memory_region_first_receiver_range(
+		memory_region);
 	ptr = (uint8_t *)spci_memory_region_constituent_get_address(
-		&constituents[0]);
+		&range->constituents[0]);
 	for (int i = 0; i < PAGE_SIZE; ++i) {
 		ASSERT_EQ(ptr[i], 0);
 	}
@@ -602,11 +570,10 @@
 	struct spci_value run_res;
 	struct mailbox_buffers mb = set_up_mailbox();
 	uint8_t *ptr = pages;
-	uint32_t msg_size;
 	uint64_t address;
 
-	SERVICE_SELECT(SERVICE_VM1, "spci_donate_check_upper_bound", mb.send);
-	SERVICE_SELECT(SERVICE_VM2, "spci_donate_check_upper_bound", mb.send);
+	SERVICE_SELECT(SERVICE_VM1, "spci_check_upper_bound", mb.send);
+	SERVICE_SELECT(SERVICE_VM2, "spci_check_upper_bound", mb.send);
 
 	/* Initialise the memory before giving it. */
 	memset_s(ptr, sizeof(pages), 'b', 4 * PAGE_SIZE);
@@ -624,12 +591,9 @@
 	 */
 	pages[0] = 0;
 
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	send_memory_and_retrieve_request(
+		SPCI_MEM_DONATE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	run_res = spci_run(SERVICE_VM1, 0);
 	EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -653,12 +617,9 @@
 	 * Use the second secondary VM for this test as the first is now in an
 	 * exception loop.
 	 */
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	send_memory_and_retrieve_request(
+		SPCI_MEM_DONATE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	run_res = spci_run(SERVICE_VM2, 0);
 	EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -673,11 +634,10 @@
 	struct spci_value run_res;
 	struct mailbox_buffers mb = set_up_mailbox();
 	uint8_t *ptr = pages;
-	uint32_t msg_size;
 	uint64_t address;
 
-	SERVICE_SELECT(SERVICE_VM1, "spci_donate_check_lower_bound", mb.send);
-	SERVICE_SELECT(SERVICE_VM2, "spci_donate_check_lower_bound", mb.send);
+	SERVICE_SELECT(SERVICE_VM1, "spci_check_lower_bound", mb.send);
+	SERVICE_SELECT(SERVICE_VM2, "spci_check_lower_bound", mb.send);
 
 	/* Initialise the memory before donating it. */
 	memset_s(ptr, sizeof(pages), 'b', 4 * PAGE_SIZE);
@@ -695,12 +655,9 @@
 	 */
 	pages[0] = 0;
 
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	send_memory_and_retrieve_request(
+		SPCI_MEM_DONATE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	run_res = spci_run(SERVICE_VM1, 0);
 	EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -724,12 +681,9 @@
 	 * Use the second secondary VM for this test as the first is now in an
 	 * exception loop.
 	 */
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	send_memory_and_retrieve_request(
+		SPCI_MEM_DONATE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	run_res = spci_run(SERVICE_VM2, 0);
 	EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -745,7 +699,6 @@
 	struct spci_value run_res;
 	struct mailbox_buffers mb = set_up_mailbox();
 	uint8_t *ptr = pages;
-	uint32_t msg_size;
 
 	SERVICE_SELECT(SERVICE_VM1, "spci_memory_return", mb.send);
 	SERVICE_SELECT(SERVICE_VM2, "spci_memory_return", mb.send);
@@ -757,26 +710,21 @@
 		spci_memory_region_constituent_init((uint64_t)pages, 1),
 	};
 
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
+	send_memory_and_retrieve_request(
+		SPCI_MEM_DONATE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
-	EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
 	run_res = spci_run(SERVICE_VM1, 0);
 
 	/* Let the memory be returned. */
-	EXPECT_EQ(run_res.func, SPCI_MEM_DONATE_32);
+	EXPECT_EQ(retrieve_memory_from_message(mb.recv, mb.send, run_res, NULL),
+		  SERVICE_VM1);
 	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
 
 	/* Share the memory with another VM. */
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	send_memory_and_retrieve_request(
+		SPCI_MEM_DONATE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	run_res = spci_run(SERVICE_VM1, 0);
 	EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -792,7 +740,6 @@
 	struct spci_value run_res;
 	struct mailbox_buffers mb = set_up_mailbox();
 	uint8_t *ptr = pages;
-	uint32_t msg_size;
 
 	SERVICE_SELECT(SERVICE_VM1, "spci_donate_secondary_and_fault", mb.send);
 	SERVICE_SELECT(SERVICE_VM2, "spci_memory_receive", mb.send);
@@ -809,12 +756,9 @@
 	EXPECT_EQ(run_res.func, SPCI_MSG_WAIT_32);
 
 	/* Donate memory. */
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	send_memory_and_retrieve_request(
+		SPCI_MEM_DONATE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	/* Let the memory be sent from VM1 to VM2. */
 	run_res = spci_run(SERVICE_VM1, 0);
@@ -840,10 +784,10 @@
  */
 TEST(memory_sharing, donate_twice)
 {
+	spci_memory_handle_t handle;
 	struct spci_value run_res;
 	struct mailbox_buffers mb = set_up_mailbox();
 	uint8_t *ptr = pages;
-	uint32_t msg_size;
 
 	SERVICE_SELECT(SERVICE_VM1, "spci_donate_twice", mb.send);
 	SERVICE_SELECT(SERVICE_VM2, "spci_memory_receive", mb.send);
@@ -856,12 +800,9 @@
 	};
 
 	/* Donate memory to VM1. */
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	handle = send_memory_and_retrieve_request(
+		SPCI_MEM_DONATE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	/* Let the memory be received. */
 	run_res = spci_run(SERVICE_VM1, 0);
@@ -875,12 +816,12 @@
 	check_cannot_donate_memory(mb, constituents, ARRAY_SIZE(constituents),
 				   -1);
 	/* Fail to relinquish memory from any VM. */
-	check_cannot_relinquish_memory(mb, constituents,
-				       ARRAY_SIZE(constituents));
+	check_cannot_relinquish_memory(mb, handle);
 
 	/* Let the memory be sent from VM1 to PRIMARY (returned). */
 	run_res = spci_run(SERVICE_VM1, 0);
-	EXPECT_EQ(run_res.func, SPCI_MEM_DONATE_32);
+	EXPECT_EQ(retrieve_memory_from_message(mb.recv, mb.send, run_res, NULL),
+		  SERVICE_VM1);
 	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
 
 	/* Check we have access again. */
@@ -1009,16 +950,14 @@
 			  SPCI_INVALID_PARAMETERS);
 
 	/* Successfully donate to VM1. */
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	send_memory_and_retrieve_request(
+		SPCI_MEM_DONATE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	/* Receive and return memory from VM1. */
 	run_res = spci_run(SERVICE_VM1, 0);
-	EXPECT_EQ(run_res.func, SPCI_MEM_DONATE_32);
+	EXPECT_EQ(retrieve_memory_from_message(mb.recv, mb.send, run_res, NULL),
+		  SERVICE_VM1);
 	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
 
 	/* Use VM1 to fail to donate memory from the primary to VM2. */
@@ -1075,6 +1014,7 @@
 TEST(memory_sharing, lend_invalid_source)
 {
 	struct spci_value run_res;
+	spci_memory_handle_t handle;
 	struct mailbox_buffers mb = set_up_mailbox();
 	uint8_t *ptr = pages;
 	uint32_t msg_size;
@@ -1097,17 +1037,15 @@
 			  SPCI_INVALID_PARAMETERS);
 
 	/* Lend memory to VM1. */
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	handle = send_memory_and_retrieve_request(
+		SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	/* Receive and return memory from VM1. */
 	run_res = spci_run(SERVICE_VM1, 0);
-	EXPECT_EQ(run_res.func, HF_SPCI_MEM_RELINQUISH);
+	EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
 	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+	EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
 
 	/* Try to lend memory from primary in VM1. */
 	run_res = spci_run(SERVICE_VM1, 0);
@@ -1121,9 +1059,9 @@
 TEST(memory_sharing, lend_relinquish_X_RW)
 {
 	struct spci_value run_res;
+	spci_memory_handle_t handle;
 	struct mailbox_buffers mb = set_up_mailbox();
 	uint8_t *ptr = pages;
-	uint32_t msg_size;
 
 	SERVICE_SELECT(SERVICE_VM1, "spci_memory_lend_relinquish_RW", mb.send);
 
@@ -1134,13 +1072,9 @@
 		spci_memory_region_constituent_init((uint64_t)pages, 1),
 	};
 
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-
-	EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	handle = send_memory_and_retrieve_request(
+		SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	/* Let the memory be accessed. */
 	run_res = spci_run(SERVICE_VM1, 0);
@@ -1148,19 +1082,16 @@
 
 	/* Let service write to and return memory. */
 	run_res = spci_run(SERVICE_VM1, 0);
-	EXPECT_EQ(run_res.func, HF_SPCI_MEM_RELINQUISH);
+	EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
 	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+	EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
 
 	/* Re-initialise the memory before giving it. */
 	memset_s(ptr, sizeof(pages), 'b', PAGE_SIZE);
 
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RO_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-
-	EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	send_memory_and_retrieve_request(
+		SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RO_X);
 
 	/* Let the memory be accessed. */
 	run_res = spci_run(SERVICE_VM1, 0);
@@ -1177,10 +1108,10 @@
  */
 TEST(memory_sharing, share_relinquish_X_RW)
 {
+	spci_memory_handle_t handle;
 	struct spci_value run_res;
 	struct mailbox_buffers mb = set_up_mailbox();
 	uint8_t *ptr = pages;
-	uint32_t msg_size;
 
 	SERVICE_SELECT(SERVICE_VM1, "spci_memory_lend_relinquish_RW", mb.send);
 
@@ -1191,13 +1122,9 @@
 		spci_memory_region_constituent_init((uint64_t)pages, 1),
 	};
 
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-
-	EXPECT_EQ(spci_mem_share(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	handle = send_memory_and_retrieve_request(
+		SPCI_MEM_SHARE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	/* Let the memory be accessed. */
 	run_res = spci_run(SERVICE_VM1, 0);
@@ -1211,19 +1138,16 @@
 
 	/* Let service write to and return memory. */
 	run_res = spci_run(SERVICE_VM1, 0);
-	EXPECT_EQ(run_res.func, HF_SPCI_MEM_RELINQUISH);
+	EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
 	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+	EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
 
 	/* Re-initialise the memory before giving it. */
 	memset_s(ptr, sizeof(pages), 'b', PAGE_SIZE);
 
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RO_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-
-	EXPECT_EQ(spci_mem_share(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	send_memory_and_retrieve_request(
+		SPCI_MEM_SHARE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RO_X);
 
 	/* Let the memory be accessed. */
 	run_res = spci_run(SERVICE_VM1, 0);
@@ -1247,9 +1171,9 @@
 TEST(memory_sharing, share_relinquish_NX_RW)
 {
 	struct spci_value run_res;
+	spci_memory_handle_t handle;
 	struct mailbox_buffers mb = set_up_mailbox();
 	uint8_t *ptr = pages;
-	uint32_t msg_size;
 
 	SERVICE_SELECT(SERVICE_VM1, "spci_memory_lend_relinquish_RW", mb.send);
 
@@ -1260,13 +1184,9 @@
 		spci_memory_region_constituent_init((uint64_t)pages, 1),
 	};
 
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_NX,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-
-	EXPECT_EQ(spci_mem_share(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	handle = send_memory_and_retrieve_request(
+		SPCI_MEM_SHARE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_NX);
 
 	/* Let the memory be accessed. */
 	run_res = spci_run(SERVICE_VM1, 0);
@@ -1279,19 +1199,16 @@
 
 	/* Let service write to and return memory. */
 	run_res = spci_run(SERVICE_VM1, 0);
-	EXPECT_EQ(run_res.func, HF_SPCI_MEM_RELINQUISH);
+	EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
 	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+	EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
 
 	/* Re-initialise the memory before giving it. */
 	memset_s(ptr, sizeof(pages), 'b', PAGE_SIZE);
 
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RO_NX,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-
-	EXPECT_EQ(spci_mem_share(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	send_memory_and_retrieve_request(
+		SPCI_MEM_SHARE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RO_NX);
 
 	/* Let the memory be accessed. */
 	run_res = spci_run(SERVICE_VM1, 0);
@@ -1309,14 +1226,51 @@
 }
 
 /**
+ * Test that memory which is shared cannot be cleared when it is relinquished.
+ */
+TEST(memory_sharing, share_relinquish_clear)
+{
+	struct mailbox_buffers mb = set_up_mailbox();
+	uint8_t *ptr = pages;
+	spci_memory_handle_t handle;
+	struct spci_value run_res;
+	size_t i;
+
+	SERVICE_SELECT(SERVICE_VM1, "spci_memory_share_relinquish_clear",
+		       mb.send);
+
+	/* Initialise the memory before giving it. */
+	memset_s(ptr, sizeof(pages) * 2, 'b', PAGE_SIZE * 2);
+
+	struct spci_memory_region_constituent constituents[] = {
+		spci_memory_region_constituent_init((uint64_t)pages, 2),
+	};
+
+	handle = send_memory_and_retrieve_request(
+		SPCI_MEM_SHARE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_NX);
+
+	/* Let the memory be received, fail to be cleared, and then returned. */
+	run_res = spci_run(SERVICE_VM1, 0);
+	EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
+	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+	EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
+
+	/* Check that it has not been cleared. */
+	for (i = 0; i < PAGE_SIZE * 2; ++i) {
+		ASSERT_EQ(ptr[i], 'b');
+	};
+}
+
+/**
  * Exercise execution permissions for lending memory.
  */
 TEST(memory_sharing, lend_relinquish_RW_X)
 {
+	spci_memory_handle_t handle;
 	struct spci_value run_res;
 	struct mailbox_buffers mb = set_up_mailbox();
 	uint8_t *ptr = pages;
-	uint32_t msg_size;
 
 	SERVICE_SELECT(SERVICE_VM1, "spci_memory_lend_relinquish_X", mb.send);
 
@@ -1331,24 +1285,19 @@
 		spci_memory_region_constituent_init((uint64_t)pages, 1),
 	};
 
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	handle = send_memory_and_retrieve_request(
+		SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	/* Attempt to execute from memory. */
 	run_res = spci_run(SERVICE_VM1, 0);
-	EXPECT_EQ(run_res.func, HF_SPCI_MEM_RELINQUISH);
+	EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
 	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+	EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
 
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_NX,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	send_memory_and_retrieve_request(
+		SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_NX);
 
 	run_res = spci_run(SERVICE_VM1, 0);
 	EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -1360,10 +1309,10 @@
  */
 TEST(memory_sharing, lend_relinquish_RO_X)
 {
+	spci_memory_handle_t handle;
 	struct spci_value run_res;
 	struct mailbox_buffers mb = set_up_mailbox();
 	uint8_t *ptr = pages;
-	uint32_t msg_size;
 
 	SERVICE_SELECT(SERVICE_VM1, "spci_memory_lend_relinquish_X", mb.send);
 
@@ -1378,24 +1327,19 @@
 		spci_memory_region_constituent_init((uint64_t)pages, 1),
 	};
 
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RO_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	handle = send_memory_and_retrieve_request(
+		SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RO_X);
 
 	/* Attempt to execute from memory. */
 	run_res = spci_run(SERVICE_VM1, 0);
-	EXPECT_EQ(run_res.func, HF_SPCI_MEM_RELINQUISH);
+	EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
 	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+	EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
 
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RO_NX,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	send_memory_and_retrieve_request(
+		SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RO_NX);
 
 	run_res = spci_run(SERVICE_VM1, 0);
 	EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -1422,13 +1366,10 @@
 		spci_memory_region_constituent_init((uint64_t)pages, 2),
 	};
 
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RO_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-
-	EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	/* Lend memory to VM1. */
+	send_memory_and_retrieve_request(
+		SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RO_X);
 
 	/* Let the memory be accessed. */
 	run_res = spci_run(SERVICE_VM1, 0);
@@ -1481,13 +1422,9 @@
 			(uint64_t)pages + PAGE_SIZE * 2, 2),
 	};
 
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RO_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-
-	EXPECT_EQ(spci_mem_share(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	send_memory_and_retrieve_request(
+		SPCI_MEM_SHARE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RO_X);
 
 	/* Let the memory be accessed. */
 	run_res = spci_run(SERVICE_VM1, 0);
@@ -1527,6 +1464,7 @@
  */
 TEST(memory_sharing, lend_twice)
 {
+	spci_memory_handle_t handle;
 	struct spci_value run_res;
 	struct mailbox_buffers mb = set_up_mailbox();
 	uint8_t *ptr = pages;
@@ -1544,13 +1482,10 @@
 			(uint64_t)pages + PAGE_SIZE * 3, 1),
 	};
 
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-
-	EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	/* Lend memory to VM1. */
+	handle = send_memory_and_retrieve_request(
+		SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	/* Let the memory be accessed. */
 	run_res = spci_run(SERVICE_VM1, 0);
@@ -1566,8 +1501,7 @@
 	check_cannot_donate_memory(mb, constituents, ARRAY_SIZE(constituents),
 				   SERVICE_VM1);
 	/* Fail to relinquish from any VM. */
-	check_cannot_relinquish_memory(mb, constituents,
-				       ARRAY_SIZE(constituents));
+	check_cannot_relinquish_memory(mb, handle);
 
 	/* Now attempt to share only a portion of the same area of memory. */
 	struct spci_memory_region_constituent constituents_subsection[] = {
@@ -1579,8 +1513,6 @@
 	check_cannot_donate_memory(mb, constituents_subsection,
 				   ARRAY_SIZE(constituents_subsection),
 				   SERVICE_VM1);
-	check_cannot_relinquish_memory(mb, constituents_subsection,
-				       ARRAY_SIZE(constituents_subsection));
 
 	/* Attempt to lend again with different permissions. */
 	constituents[0].page_count = 1;
@@ -1603,6 +1535,7 @@
  */
 TEST(memory_sharing, share_twice)
 {
+	spci_memory_handle_t handle;
 	struct spci_value run_res;
 	struct mailbox_buffers mb = set_up_mailbox();
 	uint8_t *ptr = pages;
@@ -1618,13 +1551,9 @@
 		spci_memory_region_constituent_init((uint64_t)pages, 2),
 	};
 
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-
-	EXPECT_EQ(spci_mem_share(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	handle = send_memory_and_retrieve_request(
+		SPCI_MEM_SHARE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	/* Let the memory be accessed. */
 	run_res = spci_run(SERVICE_VM1, 0);
@@ -1642,8 +1571,7 @@
 	check_cannot_donate_memory(mb, constituents, ARRAY_SIZE(constituents),
 				   SERVICE_VM1);
 	/* Fail to relinquish from any VM. */
-	check_cannot_relinquish_memory(mb, constituents,
-				       ARRAY_SIZE(constituents));
+	check_cannot_relinquish_memory(mb, handle);
 
 	/* Attempt to share again with different permissions. */
 	constituents[0].page_count = 1;
@@ -1662,7 +1590,40 @@
 }
 
 /**
- * Memory can be cleared while being shared.
+ * Memory can be cleared while being lent.
+ */
+TEST(memory_sharing, lend_clear)
+{
+	struct mailbox_buffers mb = set_up_mailbox();
+	uint8_t *ptr = pages;
+	spci_memory_handle_t handle;
+	size_t i;
+
+	SERVICE_SELECT(SERVICE_VM1, "spci_memory_return", mb.send);
+
+	/* Initialise the memory before giving it. */
+	memset_s(ptr, sizeof(pages) * 2, 'b', PAGE_SIZE * 2);
+
+	struct spci_memory_region_constituent constituents[] = {
+		spci_memory_region_constituent_init((uint64_t)pages, 2),
+	};
+
+	/* Lend memory with clear flag. */
+	handle = send_memory_and_retrieve_request(
+		SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents),
+		SPCI_MEMORY_REGION_FLAG_CLEAR, SPCI_MEMORY_RO_X);
+	/* Take it back again. */
+	spci_mem_reclaim(handle, 0);
+
+	/* Check that it has not been cleared. */
+	for (i = 0; i < PAGE_SIZE * 2; ++i) {
+		ASSERT_EQ(ptr[i], 0);
+	};
+}
+
+/**
+ * Memory cannot be cleared while being shared.
  */
 TEST(memory_sharing, share_clear)
 {
@@ -1685,11 +1646,12 @@
 		ARRAY_SIZE(constituents), 0, SPCI_MEMORY_REGION_FLAG_CLEAR,
 		SPCI_MEMORY_RO_X, SPCI_MEMORY_NORMAL_MEM,
 		SPCI_MEMORY_CACHE_WRITE_BACK, SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_share(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	EXPECT_SPCI_ERROR(spci_mem_share(msg_size, msg_size, 0),
+			  SPCI_INVALID_PARAMETERS);
 
-	/* Check that it has been cleared. */
+	/* Check that it has not been cleared. */
 	for (i = 0; i < PAGE_SIZE * 2; ++i) {
-		ASSERT_EQ(ptr[i], 0);
+		ASSERT_EQ(ptr[i], 'b');
 	};
 }
 
@@ -1701,11 +1663,10 @@
 	struct spci_value run_res;
 	struct mailbox_buffers mb = set_up_mailbox();
 	uint8_t *ptr = pages;
-	uint32_t msg_size;
 	uint64_t address;
 
-	SERVICE_SELECT(SERVICE_VM1, "spci_lend_check_upper_bound", mb.send);
-	SERVICE_SELECT(SERVICE_VM2, "spci_lend_check_upper_bound", mb.send);
+	SERVICE_SELECT(SERVICE_VM1, "spci_check_upper_bound", mb.send);
+	SERVICE_SELECT(SERVICE_VM2, "spci_check_upper_bound", mb.send);
 
 	/* Initialise the memory before lending it. */
 	memset_s(ptr, sizeof(pages), 'b', 4 * PAGE_SIZE);
@@ -1723,12 +1684,9 @@
 	 */
 	pages[0] = 0;
 
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	send_memory_and_retrieve_request(
+		SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	run_res = spci_run(SERVICE_VM1, 0);
 	EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -1752,12 +1710,9 @@
 	 * Use the second secondary VM for this test as the first is now in an
 	 * exception loop.
 	 */
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	send_memory_and_retrieve_request(
+		SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	run_res = spci_run(SERVICE_VM2, 0);
 	EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -1772,11 +1727,10 @@
 	struct spci_value run_res;
 	struct mailbox_buffers mb = set_up_mailbox();
 	uint8_t *ptr = pages;
-	uint32_t msg_size;
 	uint64_t address;
 
-	SERVICE_SELECT(SERVICE_VM1, "spci_lend_check_lower_bound", mb.send);
-	SERVICE_SELECT(SERVICE_VM2, "spci_lend_check_lower_bound", mb.send);
+	SERVICE_SELECT(SERVICE_VM1, "spci_check_lower_bound", mb.send);
+	SERVICE_SELECT(SERVICE_VM2, "spci_check_lower_bound", mb.send);
 
 	/* Initialise the memory before lending it. */
 	memset_s(ptr, sizeof(pages), 'b', 4 * PAGE_SIZE);
@@ -1794,12 +1748,9 @@
 	 */
 	pages[0] = 0;
 
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	send_memory_and_retrieve_request(
+		SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	run_res = spci_run(SERVICE_VM1, 0);
 	EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -1823,12 +1774,9 @@
 	 * Use the second secondary VM for this test as the first is now in an
 	 * exception loop.
 	 */
-	msg_size = spci_memory_region_init(
-		mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2, constituents,
-		ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	send_memory_and_retrieve_request(
+		SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2,
+		constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
 
 	run_res = spci_run(SERVICE_VM2, 0);
 	EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
diff --git a/test/vmapi/primary_with_secondaries/services/memory.c b/test/vmapi/primary_with_secondaries/services/memory.c
index 1ffabc4..0a1c561 100644
--- a/test/vmapi/primary_with_secondaries/services/memory.c
+++ b/test/vmapi/primary_with_secondaries/services/memory.c
@@ -32,25 +32,21 @@
 {
 	/* Loop, writing message to the shared memory. */
 	for (;;) {
-		struct spci_value ret = spci_msg_wait();
-		uint8_t *ptr;
 		size_t i;
 		void *recv_buf = SERVICE_RECV_BUFFER();
-		struct spci_memory_region *memory_region =
-			(struct spci_memory_region *)recv_buf;
-		struct spci_memory_region_constituent *constituents =
-			spci_memory_region_get_constituents(memory_region);
-		spci_vm_id_t sender = memory_region->sender;
+		void *send_buf = SERVICE_SEND_BUFFER();
 
-		EXPECT_EQ(ret.func, SPCI_MEM_SHARE_32);
-
-		ptr = (uint8_t *)spci_memory_region_constituent_get_address(
-			&constituents[0]);
-
-		/* Check the memory was cleared. */
-		for (i = 0; i < PAGE_SIZE; ++i) {
-			ASSERT_EQ(ptr[i], 0);
-		}
+		struct spci_value ret = spci_msg_wait();
+		spci_vm_id_t sender = retrieve_memory_from_message(
+			recv_buf, send_buf, ret, NULL);
+		struct spci_retrieved_memory_region *memory_region =
+			(struct spci_retrieved_memory_region *)recv_buf;
+		struct spci_receiver_address_range *range =
+			spci_retrieved_memory_region_first_receiver_range(
+				memory_region);
+		uint8_t *ptr =
+			(uint8_t *)spci_memory_region_constituent_get_address(
+				&range->constituents[0]);
 
 		/* Allow the memory to be populated. */
 		EXPECT_EQ(spci_yield().func, SPCI_SUCCESS_32);
@@ -69,17 +65,15 @@
 TEST_SERVICE(give_memory_and_fault)
 {
 	void *send_buf = SERVICE_SEND_BUFFER();
-
-	/* Give memory to the primary. */
 	struct spci_memory_region_constituent constituents[] = {
 		spci_memory_region_constituent_init((uint64_t)&page, 1),
 	};
-	uint32_t msg_size = spci_memory_region_init(
-		send_buf, hf_vm_get_id(), HF_PRIMARY_VM_ID, constituents,
-		ARRAY_SIZE(constituents), 0, SPCI_MEMORY_REGION_FLAG_CLEAR,
-		SPCI_MEMORY_RW_X, SPCI_MEMORY_NORMAL_MEM,
-		SPCI_MEMORY_CACHE_WRITE_BACK, SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+
+	/* Give memory to the primary. */
+	send_memory_and_retrieve_request(
+		SPCI_MEM_DONATE_32, send_buf, hf_vm_get_id(), HF_PRIMARY_VM_ID,
+		constituents, ARRAY_SIZE(constituents),
+		SPCI_MEMORY_REGION_FLAG_CLEAR, SPCI_MEMORY_RW_X);
 
 	exception_setup(NULL, exception_handler_yield_data_abort);
 
@@ -92,17 +86,15 @@
 TEST_SERVICE(lend_memory_and_fault)
 {
 	void *send_buf = SERVICE_SEND_BUFFER();
-
-	/* Lend memory to the primary. */
 	struct spci_memory_region_constituent constituents[] = {
 		spci_memory_region_constituent_init((uint64_t)&page, 1),
 	};
-	uint32_t msg_size = spci_memory_region_init(
-		send_buf, hf_vm_get_id(), HF_PRIMARY_VM_ID, constituents,
-		ARRAY_SIZE(constituents), 0, SPCI_MEMORY_REGION_FLAG_CLEAR,
-		SPCI_MEMORY_RW_X, SPCI_MEMORY_NORMAL_MEM,
-		SPCI_MEMORY_CACHE_WRITE_BACK, SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+
+	/* Lend memory to the primary. */
+	send_memory_and_retrieve_request(
+		SPCI_MEM_LEND_32, send_buf, hf_vm_get_id(), HF_PRIMARY_VM_ID,
+		constituents, ARRAY_SIZE(constituents),
+		SPCI_MEMORY_REGION_FLAG_CLEAR, SPCI_MEMORY_RW_X);
 
 	exception_setup(NULL, exception_handler_yield_data_abort);
 
@@ -116,24 +108,21 @@
 {
 	struct spci_value ret = spci_msg_wait();
 	uint8_t *ptr;
-	uint32_t msg_size;
 	size_t i;
 	void *recv_buf = SERVICE_RECV_BUFFER();
 	void *send_buf = SERVICE_SEND_BUFFER();
-	struct spci_memory_region *memory_region;
-	struct spci_memory_region_constituent *constituents;
 
 	exception_setup(NULL, exception_handler_yield_data_abort);
 
-	/* The memory may have been sent in one of several different ways. */
-	EXPECT_TRUE(ret.func == SPCI_MEM_DONATE_32 ||
-		    ret.func == SPCI_MEM_LEND_32 ||
-		    ret.func == SPCI_MEM_SHARE_32);
-
-	memory_region = (struct spci_memory_region *)recv_buf;
-	constituents = spci_memory_region_get_constituents(memory_region);
+	spci_vm_id_t sender =
+		retrieve_memory_from_message(recv_buf, send_buf, ret, NULL);
+	struct spci_retrieved_memory_region *memory_region =
+		(struct spci_retrieved_memory_region *)recv_buf;
+	struct spci_receiver_address_range *range =
+		spci_retrieved_memory_region_first_receiver_range(
+			memory_region);
 	ptr = (uint8_t *)spci_memory_region_constituent_get_address(
-		&constituents[0]);
+		&range->constituents[0]);
 
 	/* Check that one has access to the shared region. */
 	for (i = 0; i < PAGE_SIZE; ++i) {
@@ -141,13 +130,11 @@
 	}
 
 	/* Give the memory back and notify the sender. */
-	msg_size = spci_memory_region_init(
-		send_buf, hf_vm_get_id(), memory_region->sender, constituents,
-		memory_region->constituent_count, 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
+	send_memory_and_retrieve_request(
+		SPCI_MEM_DONATE_32, send_buf, hf_vm_get_id(), sender,
+		range->constituents, range->constituent_count, 0,
+		SPCI_MEMORY_RW_X);
 	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
-	EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
 
 	/*
 	 * Try and access the memory which will cause a fault unless the memory
@@ -158,66 +145,77 @@
 	FAIL("Exception not generated by invalid access.");
 }
 
-TEST_SERVICE(spci_donate_check_upper_bound)
+/**
+ * Attempt to modify above the upper bound of a memory region sent to us.
+ */
+TEST_SERVICE(spci_check_upper_bound)
 {
-	struct spci_value ret = spci_msg_wait();
+	struct spci_retrieved_memory_region *memory_region;
+	struct spci_receiver_address_range *range;
 	uint8_t *ptr;
 	uint8_t index;
+
 	void *recv_buf = SERVICE_RECV_BUFFER();
-	struct spci_memory_region *memory_region;
-	struct spci_memory_region_constituent *constituents;
+	void *send_buf = SERVICE_SEND_BUFFER();
+	struct spci_value ret = spci_msg_wait();
 
 	exception_setup(NULL, exception_handler_yield_data_abort);
 
-	EXPECT_EQ(ret.func, SPCI_MEM_DONATE_32);
-
-	memory_region = (struct spci_memory_region *)recv_buf;
-	constituents = spci_memory_region_get_constituents(memory_region);
+	retrieve_memory_from_message(recv_buf, send_buf, ret, NULL);
+	memory_region = (struct spci_retrieved_memory_region *)recv_buf;
+	range = spci_retrieved_memory_region_first_receiver_range(
+		memory_region);
 
 	/* Choose which constituent we want to test. */
 	index = *(uint8_t *)spci_memory_region_constituent_get_address(
-		&constituents[0]);
+		&range->constituents[0]);
 	ptr = (uint8_t *)spci_memory_region_constituent_get_address(
-		&constituents[index]);
+		&range->constituents[index]);
 	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
 
 	/*
-	 * Check that one cannot access out of bounds after donated
-	 * region. This should trigger the exception handler.
+	 * Check that we can't access out of bounds after the region sent to us.
+	 * This should trigger the exception handler.
 	 */
 	ptr[PAGE_SIZE]++;
 
 	FAIL("Exception not generated by access out of bounds.");
 }
 
-TEST_SERVICE(spci_donate_check_lower_bound)
+/**
+ * Attempt to modify below the lower bound of a memory region sent to us.
+ */
+TEST_SERVICE(spci_check_lower_bound)
 {
-	struct spci_value ret = spci_msg_wait();
+	struct spci_retrieved_memory_region *memory_region;
+	struct spci_receiver_address_range *range;
 	uint8_t *ptr;
 	uint8_t index;
+
 	void *recv_buf = SERVICE_RECV_BUFFER();
-	struct spci_memory_region *memory_region;
-	struct spci_memory_region_constituent *constituents;
+	void *send_buf = SERVICE_SEND_BUFFER();
+	struct spci_value ret = spci_msg_wait();
 
 	exception_setup(NULL, exception_handler_yield_data_abort);
 
-	EXPECT_EQ(ret.func, SPCI_MEM_DONATE_32);
-
-	memory_region = (struct spci_memory_region *)recv_buf;
-	constituents = spci_memory_region_get_constituents(memory_region);
+	retrieve_memory_from_message(recv_buf, send_buf, ret, NULL);
+	memory_region = (struct spci_retrieved_memory_region *)recv_buf;
+	range = spci_retrieved_memory_region_first_receiver_range(
+		memory_region);
 
 	/* Choose which constituent we want to test. */
 	index = *(uint8_t *)spci_memory_region_constituent_get_address(
-		&constituents[0]);
+		&range->constituents[0]);
 	ptr = (uint8_t *)spci_memory_region_constituent_get_address(
-		&constituents[index]);
+		&range->constituents[index]);
 	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
 
 	/*
-	 * Check that one cannot access out of bounds after donated
-	 * region. This should trigger the exception handler.
+	 * Check that we can't access out of bounds before the region sent to
+	 * us. This should trigger the exception handler.
 	 */
 	ptr[-1]++;
+
 	FAIL("Exception not generated by access out of bounds.");
 }
 
@@ -226,31 +224,31 @@
  */
 TEST_SERVICE(spci_donate_secondary_and_fault)
 {
-	struct spci_value ret = spci_msg_wait();
 	uint8_t *ptr;
-	uint32_t msg_size;
 	void *recv_buf = SERVICE_RECV_BUFFER();
 	void *send_buf = SERVICE_SEND_BUFFER();
-	struct spci_memory_region *memory_region =
-		(struct spci_memory_region *)recv_buf;
-	struct spci_memory_region_constituent *constituents =
-		spci_memory_region_get_constituents(memory_region);
 
-	EXPECT_EQ(ret.func, SPCI_MEM_DONATE_32);
+	struct spci_value ret = spci_msg_wait();
+	spci_vm_id_t sender =
+		retrieve_memory_from_message(recv_buf, send_buf, ret, NULL);
+	struct spci_retrieved_memory_region *memory_region =
+		(struct spci_retrieved_memory_region *)recv_buf;
+	struct spci_receiver_address_range *range =
+		spci_retrieved_memory_region_first_receiver_range(
+			memory_region);
 
+	ASSERT_EQ(sender, HF_PRIMARY_VM_ID);
 	exception_setup(NULL, exception_handler_yield_data_abort);
 
 	ptr = (uint8_t *)spci_memory_region_constituent_get_address(
-		&constituents[0]);
+		&range->constituents[0]);
 
 	/* Donate memory to next VM. */
-	msg_size = spci_memory_region_init(
-		send_buf, hf_vm_get_id(), SERVICE_VM2, constituents,
-		memory_region->constituent_count, 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
+	send_memory_and_retrieve_request(
+		SPCI_MEM_DONATE_32, send_buf, hf_vm_get_id(), SERVICE_VM2,
+		range->constituents, range->constituent_count, 0,
+		SPCI_MEMORY_RW_X);
 	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
-	EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
 
 	/* Ensure that we are unable to modify memory any more. */
 	ptr[0] = 'c';
@@ -264,26 +262,29 @@
 TEST_SERVICE(spci_donate_twice)
 {
 	uint32_t msg_size;
-	struct spci_value ret = spci_msg_wait();
 	void *recv_buf = SERVICE_RECV_BUFFER();
 	void *send_buf = SERVICE_SEND_BUFFER();
-	struct spci_memory_region *memory_region =
-		(struct spci_memory_region *)recv_buf;
-	struct spci_memory_region_constituent constituent =
-		spci_memory_region_get_constituents(memory_region)[0];
 
-	EXPECT_EQ(ret.func, SPCI_MEM_DONATE_32);
+	struct spci_value ret = spci_msg_wait();
+	spci_vm_id_t sender =
+		retrieve_memory_from_message(recv_buf, send_buf, ret, NULL);
+	struct spci_retrieved_memory_region *memory_region =
+		(struct spci_retrieved_memory_region *)recv_buf;
+	struct spci_receiver_address_range *range =
+		spci_retrieved_memory_region_first_receiver_range(
+			memory_region);
+	struct spci_memory_region_constituent constituent =
+		range->constituents[0];
+
 	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
 
 	/* Yield to allow attempt to re donate from primary. */
 	spci_yield();
 
 	/* Give the memory back and notify the sender. */
-	msg_size = spci_memory_region_init(
-		send_buf, SERVICE_VM1, HF_PRIMARY_VM_ID, &constituent, 1, 0, 0,
-		SPCI_MEMORY_RW_X, SPCI_MEMORY_NORMAL_MEM,
-		SPCI_MEMORY_CACHE_WRITE_BACK, SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	send_memory_and_retrieve_request(SPCI_MEM_DONATE_32, send_buf,
+					 hf_vm_get_id(), sender, &constituent,
+					 1, 0, SPCI_MEMORY_RW_X);
 
 	/* Attempt to donate the memory to another VM. */
 	msg_size = spci_memory_region_init(
@@ -302,19 +303,22 @@
  */
 TEST_SERVICE(spci_memory_receive)
 {
+	void *recv_buf = SERVICE_RECV_BUFFER();
+	void *send_buf = SERVICE_SEND_BUFFER();
+
 	for (;;) {
 		struct spci_value ret = spci_msg_wait();
+		struct spci_retrieved_memory_region *memory_region;
+		struct spci_receiver_address_range *range;
 		uint8_t *ptr;
-		void *recv_buf = SERVICE_RECV_BUFFER();
-		struct spci_memory_region *memory_region =
-			(struct spci_memory_region *)recv_buf;
-		struct spci_memory_region_constituent *constituents =
-			spci_memory_region_get_constituents(memory_region);
 
-		EXPECT_EQ(ret.func, SPCI_MEM_DONATE_32);
-
+		retrieve_memory_from_message(recv_buf, send_buf, ret, NULL);
+		memory_region = (struct spci_retrieved_memory_region *)recv_buf;
+		range = spci_retrieved_memory_region_first_receiver_range(
+			memory_region);
 		ptr = (uint8_t *)spci_memory_region_constituent_get_address(
-			&constituents[0]);
+			&range->constituents[0]);
+
 		EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
 		ptr[0] = 'd';
 		spci_yield();
@@ -331,28 +335,28 @@
 TEST_SERVICE(spci_donate_invalid_source)
 {
 	uint32_t msg_size;
-	struct spci_value ret = spci_msg_wait();
 	void *recv_buf = SERVICE_RECV_BUFFER();
 	void *send_buf = SERVICE_SEND_BUFFER();
-	struct spci_memory_region *memory_region =
-		(struct spci_memory_region *)recv_buf;
-	struct spci_memory_region_constituent *constituents =
-		spci_memory_region_get_constituents(memory_region);
 
-	EXPECT_EQ(ret.func, SPCI_MEM_DONATE_32);
+	struct spci_value ret = spci_msg_wait();
+	spci_vm_id_t sender =
+		retrieve_memory_from_message(recv_buf, send_buf, ret, NULL);
+	struct spci_retrieved_memory_region *memory_region =
+		(struct spci_retrieved_memory_region *)recv_buf;
+	struct spci_receiver_address_range *range =
+		spci_retrieved_memory_region_first_receiver_range(
+			memory_region);
 
 	/* Give the memory back and notify the sender. */
-	msg_size = spci_memory_region_init(
-		send_buf, hf_vm_get_id(), HF_PRIMARY_VM_ID, constituents,
-		memory_region->constituent_count, 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+	send_memory_and_retrieve_request(
+		SPCI_MEM_DONATE_32, send_buf, hf_vm_get_id(), sender,
+		range->constituents, range->constituent_count, 0,
+		SPCI_MEMORY_RW_X);
 
 	/* Fail to donate the memory from the primary to VM2. */
 	msg_size = spci_memory_region_init(
-		send_buf, HF_PRIMARY_VM_ID, SERVICE_VM2, constituents,
-		memory_region->constituent_count, 0, 0, SPCI_MEMORY_RW_X,
+		send_buf, HF_PRIMARY_VM_ID, SERVICE_VM2, range->constituents,
+		range->constituent_count, 0, 0, SPCI_MEMORY_RW_X,
 		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
 		SPCI_MEMORY_OUTER_SHAREABLE);
 	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
@@ -367,28 +371,26 @@
 
 	/* Loop, giving memory back to the sender. */
 	for (;;) {
-		struct spci_value ret = spci_msg_wait();
 		uint8_t *ptr;
 		uint8_t *ptr2;
 		uint32_t count;
 		uint32_t count2;
-		uint32_t msg_size;
 		size_t i;
+		spci_memory_handle_t handle;
 
 		void *recv_buf = SERVICE_RECV_BUFFER();
 		void *send_buf = SERVICE_SEND_BUFFER();
-		struct spci_memory_region *memory_region =
-			(struct spci_memory_region *)recv_buf;
-		struct spci_memory_region_constituent *constituents =
-			spci_memory_region_get_constituents(memory_region);
 
-		/*
-		 * The memory may have been sent in one of several different
-		 * ways.
-		 */
-		EXPECT_TRUE(ret.func == SPCI_MEM_DONATE_32 ||
-			    ret.func == SPCI_MEM_LEND_32 ||
-			    ret.func == SPCI_MEM_SHARE_32);
+		struct spci_value ret = spci_msg_wait();
+		spci_vm_id_t sender = retrieve_memory_from_message(
+			recv_buf, send_buf, ret, &handle);
+		struct spci_retrieved_memory_region *memory_region =
+			(struct spci_retrieved_memory_region *)recv_buf;
+		struct spci_receiver_address_range *range =
+			spci_retrieved_memory_region_first_receiver_range(
+				memory_region);
+		struct spci_memory_region_constituent *constituents =
+			range->constituents;
 
 		ptr = (uint8_t *)spci_memory_region_constituent_get_address(
 			&constituents[0]);
@@ -396,6 +398,8 @@
 		ptr2 = (uint8_t *)spci_memory_region_constituent_get_address(
 			&constituents[1]);
 		count2 = constituents[1].page_count;
+		/* Relevant information read, mailbox can be cleared. */
+		EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
 
 		/* Check that one has access to the shared region. */
 		for (i = 0; i < PAGE_SIZE * count; ++i) {
@@ -406,15 +410,11 @@
 		}
 
 		/* Give the memory back and notify the sender. */
-		msg_size = spci_memory_region_init(
-			send_buf, hf_vm_get_id(), memory_region->sender,
-			constituents, memory_region->constituent_count, 0, 0,
-			SPCI_MEMORY_RW_X, SPCI_MEMORY_NORMAL_MEM,
-			SPCI_MEMORY_CACHE_WRITE_BACK,
-			SPCI_MEMORY_OUTER_SHAREABLE);
-		/* Relevant information read, mailbox can be cleared. */
-		EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
-		EXPECT_EQ(hf_spci_mem_relinquish(msg_size, msg_size, 0).func,
+		*(struct spci_mem_relinquish *)send_buf =
+			(struct spci_mem_relinquish){.handle = handle,
+						     .sender = hf_vm_get_id()};
+		EXPECT_EQ(spci_mem_relinquish().func, SPCI_SUCCESS_32);
+		EXPECT_EQ(spci_msg_send(hf_vm_get_id(), sender, 0, 0).func,
 			  SPCI_SUCCESS_32);
 
 		/*
@@ -431,39 +431,38 @@
 TEST_SERVICE(spci_memory_donate_relinquish)
 {
 	for (;;) {
-		struct spci_value ret = spci_msg_wait();
-		uint8_t *ptr;
-		uint32_t msg_size;
 		size_t i;
+		spci_memory_handle_t handle;
+		struct spci_retrieved_memory_region *memory_region;
+		struct spci_receiver_address_range *range;
+		uint8_t *ptr;
 
 		void *recv_buf = SERVICE_RECV_BUFFER();
 		void *send_buf = SERVICE_SEND_BUFFER();
-		struct spci_memory_region *memory_region =
-			(struct spci_memory_region *)recv_buf;
-		struct spci_memory_region_constituent *constituents =
-			spci_memory_region_get_constituents(memory_region);
+		struct spci_value ret = spci_msg_wait();
 
-		EXPECT_EQ(ret.func, SPCI_MEM_DONATE_32);
+		retrieve_memory_from_message(recv_buf, send_buf, ret, &handle);
+		memory_region = (struct spci_retrieved_memory_region *)recv_buf;
+		range = spci_retrieved_memory_region_first_receiver_range(
+			memory_region);
 
 		ptr = (uint8_t *)spci_memory_region_constituent_get_address(
-			&constituents[0]);
+			&range->constituents[0]);
 
 		/* Check that we have access to the shared region. */
 		for (i = 0; i < PAGE_SIZE; ++i) {
 			ptr[i]++;
 		}
+
 		/*
 		 * Attempt to relinquish the memory, which should fail because
 		 * it was donated not lent.
 		 */
-		msg_size = spci_memory_region_init(
-			send_buf, hf_vm_get_id(), HF_PRIMARY_VM_ID,
-			constituents, memory_region->constituent_count, 0, 0,
-			SPCI_MEMORY_RW_X, SPCI_MEMORY_NORMAL_MEM,
-			SPCI_MEMORY_CACHE_WRITE_BACK,
-			SPCI_MEMORY_OUTER_SHAREABLE);
+		*(struct spci_mem_relinquish *)send_buf =
+			(struct spci_mem_relinquish){.handle = handle,
+						     .sender = hf_vm_get_id()};
 		EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
-		EXPECT_SPCI_ERROR(hf_spci_mem_relinquish(msg_size, msg_size, 0),
+		EXPECT_SPCI_ERROR(spci_mem_relinquish(),
 				  SPCI_INVALID_PARAMETERS);
 
 		/* Ensure we still have access to the memory. */
@@ -474,44 +473,79 @@
 }
 
 /**
+ * Receive memory that has been shared, try to relinquish it with the clear flag
+ * set (and expect to fail), and then relinquish without any flags.
+ */
+TEST_SERVICE(spci_memory_share_relinquish_clear)
+{
+	exception_setup(NULL, exception_handler_yield_data_abort);
+
+	/* Loop, receiving memory and relinquishing it. */
+	for (;;) {
+		spci_memory_handle_t handle;
+
+		void *recv_buf = SERVICE_RECV_BUFFER();
+		void *send_buf = SERVICE_SEND_BUFFER();
+
+		struct spci_value ret = spci_msg_wait();
+		spci_vm_id_t sender = retrieve_memory_from_message(
+			recv_buf, send_buf, ret, &handle);
+
+		/*
+		 * Mailbox can be cleared, we don't actually care what the
+		 * memory region is.
+		 */
+		EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+
+		/* Trying to relinquish the memory and clear it should fail. */
+		*(struct spci_mem_relinquish *)send_buf =
+			(struct spci_mem_relinquish){
+				.handle = handle,
+				.sender = hf_vm_get_id(),
+				.flags = SPCI_MEMORY_REGION_FLAG_CLEAR};
+		EXPECT_SPCI_ERROR(spci_mem_relinquish(),
+				  SPCI_INVALID_PARAMETERS);
+
+		/* Give the memory back and notify the sender. */
+		*(struct spci_mem_relinquish *)send_buf =
+			(struct spci_mem_relinquish){.handle = handle,
+						     .sender = hf_vm_get_id()};
+		EXPECT_EQ(spci_mem_relinquish().func, SPCI_SUCCESS_32);
+		EXPECT_EQ(spci_msg_send(hf_vm_get_id(), sender, 0, 0).func,
+			  SPCI_SUCCESS_32);
+	}
+}
+
+/**
  * Receive memory and attempt to donate from primary VM.
  */
 TEST_SERVICE(spci_lend_invalid_source)
 {
+	spci_memory_handle_t handle;
 	uint32_t msg_size;
-	struct spci_value ret = spci_msg_wait();
 
 	void *recv_buf = SERVICE_RECV_BUFFER();
 	void *send_buf = SERVICE_SEND_BUFFER();
-	struct spci_memory_region *memory_region =
-		(struct spci_memory_region *)recv_buf;
-	struct spci_memory_region_constituent *constituents =
-		spci_memory_region_get_constituents(memory_region);
-
-	EXPECT_EQ(ret.func, SPCI_MEM_LEND_32);
-
-	/* Attempt to relinquish to this same VM. */
-	msg_size = spci_memory_region_init(
-		send_buf, HF_PRIMARY_VM_ID, hf_vm_get_id(), constituents,
-		memory_region->constituent_count, 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_SPCI_ERROR(hf_spci_mem_relinquish(msg_size, msg_size, 0),
-			  SPCI_INVALID_PARAMETERS);
+	struct spci_value ret = spci_msg_wait();
+	spci_vm_id_t sender =
+		retrieve_memory_from_message(recv_buf, send_buf, ret, &handle);
+	struct spci_retrieved_memory_region *memory_region =
+		(struct spci_retrieved_memory_region *)recv_buf;
+	struct spci_receiver_address_range *range =
+		spci_retrieved_memory_region_first_receiver_range(
+			memory_region);
 
 	/* Give the memory back and notify the sender. */
-	msg_size = spci_memory_region_init(
-		send_buf, hf_vm_get_id(), HF_PRIMARY_VM_ID, constituents,
-		memory_region->constituent_count, 0, 0, SPCI_MEMORY_RW_X,
-		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-		SPCI_MEMORY_OUTER_SHAREABLE);
-	EXPECT_EQ(hf_spci_mem_relinquish(msg_size, msg_size, 0).func,
+	*(struct spci_mem_relinquish *)send_buf = (struct spci_mem_relinquish){
+		.handle = handle, .sender = hf_vm_get_id()};
+	EXPECT_EQ(spci_mem_relinquish().func, SPCI_SUCCESS_32);
+	EXPECT_EQ(spci_msg_send(hf_vm_get_id(), sender, 0, 0).func,
 		  SPCI_SUCCESS_32);
 
 	/* Ensure we cannot lend from the primary to another secondary. */
 	msg_size = spci_memory_region_init(
-		send_buf, HF_PRIMARY_VM_ID, SERVICE_VM2, constituents,
-		memory_region->constituent_count, 0, 0, SPCI_MEMORY_RW_X,
+		send_buf, HF_PRIMARY_VM_ID, SERVICE_VM2, range->constituents,
+		range->constituent_count, 0, 0, SPCI_MEMORY_RW_X,
 		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
 		SPCI_MEMORY_OUTER_SHAREABLE);
 	EXPECT_SPCI_ERROR(spci_mem_lend(msg_size, msg_size, 0),
@@ -519,8 +553,8 @@
 
 	/* Ensure we cannot share from the primary to another secondary. */
 	msg_size = spci_memory_region_init(
-		send_buf, HF_PRIMARY_VM_ID, SERVICE_VM2, constituents,
-		memory_region->constituent_count, 0, 0, SPCI_MEMORY_RW_X,
+		send_buf, HF_PRIMARY_VM_ID, SERVICE_VM2, range->constituents,
+		range->constituent_count, 0, 0, SPCI_MEMORY_RW_X,
 		SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
 		SPCI_MEMORY_OUTER_SHAREABLE);
 	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
@@ -538,21 +572,25 @@
 	exception_setup(NULL, exception_handler_yield_instruction_abort);
 
 	for (;;) {
-		struct spci_value ret = spci_msg_wait();
-		uint64_t *ptr;
-		uint32_t msg_size;
-
+		spci_memory_handle_t handle;
 		void *recv_buf = SERVICE_RECV_BUFFER();
 		void *send_buf = SERVICE_SEND_BUFFER();
-		struct spci_memory_region *memory_region =
-			(struct spci_memory_region *)recv_buf;
+		struct spci_value ret = spci_msg_wait();
+		spci_vm_id_t sender = retrieve_memory_from_message(
+			recv_buf, send_buf, ret, &handle);
+		struct spci_retrieved_memory_region *memory_region =
+			(struct spci_retrieved_memory_region *)recv_buf;
+		struct spci_receiver_address_range *range =
+			spci_retrieved_memory_region_first_receiver_range(
+				memory_region);
 		struct spci_memory_region_constituent *constituents =
-			spci_memory_region_get_constituents(memory_region);
+			range->constituents;
+		uint64_t *ptr =
+			(uint64_t *)spci_memory_region_constituent_get_address(
+				&constituents[0]);
 
-		EXPECT_EQ(ret.func, SPCI_MEM_LEND_32);
+		EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
 
-		ptr = (uint64_t *)spci_memory_region_constituent_get_address(
-			&constituents[0]);
 		/*
 		 * Verify that the instruction in memory is the encoded RET
 		 * instruction.
@@ -562,14 +600,11 @@
 		__asm__ volatile("blr %0" ::"r"(ptr));
 
 		/* Release the memory again. */
-		msg_size = spci_memory_region_init(
-			send_buf, hf_vm_get_id(), HF_PRIMARY_VM_ID,
-			constituents, memory_region->constituent_count, 0, 0,
-			SPCI_MEMORY_RW_X, SPCI_MEMORY_NORMAL_MEM,
-			SPCI_MEMORY_CACHE_WRITE_BACK,
-			SPCI_MEMORY_OUTER_SHAREABLE);
-		EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
-		EXPECT_EQ(hf_spci_mem_relinquish(msg_size, msg_size, 0).func,
+		*(struct spci_mem_relinquish *)send_buf =
+			(struct spci_mem_relinquish){.handle = handle,
+						     .sender = hf_vm_get_id()};
+		EXPECT_EQ(spci_mem_relinquish().func, SPCI_SUCCESS_32);
+		EXPECT_EQ(spci_msg_send(hf_vm_get_id(), sender, 0, 0).func,
 			  SPCI_SUCCESS_32);
 	}
 }
@@ -582,27 +617,22 @@
 	exception_setup(NULL, exception_handler_yield_data_abort);
 
 	for (;;) {
-		struct spci_value ret = spci_msg_wait();
+		spci_memory_handle_t handle;
 		uint8_t *ptr;
-		uint32_t msg_size;
 		size_t i;
 
 		void *recv_buf = SERVICE_RECV_BUFFER();
 		void *send_buf = SERVICE_SEND_BUFFER();
-		struct spci_memory_region *memory_region =
-			(struct spci_memory_region *)recv_buf;
-		struct spci_memory_region_constituent *constituents =
-			spci_memory_region_get_constituents(memory_region);
+		struct spci_value ret = spci_msg_wait();
+		spci_vm_id_t sender = retrieve_memory_from_message(
+			recv_buf, send_buf, ret, &handle);
+		struct spci_retrieved_memory_region *memory_region =
+			(struct spci_retrieved_memory_region *)recv_buf;
+		struct spci_receiver_address_range *range =
+			spci_retrieved_memory_region_first_receiver_range(
+				memory_region);
 		struct spci_memory_region_constituent constituent_copy =
-			constituents[0];
-
-		/*
-		 * The memory may have been sent in one of several different
-		 * ways.
-		 */
-		EXPECT_TRUE(ret.func == SPCI_MEM_DONATE_32 ||
-			    ret.func == SPCI_MEM_LEND_32 ||
-			    ret.func == SPCI_MEM_SHARE_32);
+			range->constituents[0];
 
 		EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
 
@@ -622,80 +652,16 @@
 			ptr[i]++;
 		}
 
-		msg_size = spci_memory_region_init(
-			send_buf, hf_vm_get_id(), HF_PRIMARY_VM_ID,
-			&constituent_copy, 1, 0, 0, SPCI_MEMORY_RW_X,
-			SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
-			SPCI_MEMORY_OUTER_SHAREABLE);
-		EXPECT_EQ(hf_spci_mem_relinquish(msg_size, msg_size, 0).func,
+		/* Give the memory back and notify the sender. */
+		*(struct spci_mem_relinquish *)send_buf =
+			(struct spci_mem_relinquish){.handle = handle,
+						     .sender = hf_vm_get_id()};
+		EXPECT_EQ(spci_mem_relinquish().func, SPCI_SUCCESS_32);
+		EXPECT_EQ(spci_msg_send(hf_vm_get_id(), sender, 0, 0).func,
 			  SPCI_SUCCESS_32);
 	}
 }
 
-/**
- * Attempt to modify above the upper bound for the lent memory.
- */
-TEST_SERVICE(spci_lend_check_upper_bound)
-{
-	struct spci_value ret = spci_msg_wait();
-	uint8_t *ptr;
-	uint8_t index;
-
-	void *recv_buf = SERVICE_RECV_BUFFER();
-	struct spci_memory_region *memory_region =
-		(struct spci_memory_region *)recv_buf;
-	struct spci_memory_region_constituent *constituents =
-		spci_memory_region_get_constituents(memory_region);
-
-	EXPECT_EQ(ret.func, SPCI_MEM_LEND_32);
-
-	exception_setup(NULL, exception_handler_yield_data_abort);
-
-	/* Choose which constituent we want to test. */
-	index = *(uint8_t *)spci_memory_region_constituent_get_address(
-		&constituents[0]);
-	ptr = (uint8_t *)spci_memory_region_constituent_get_address(
-		&constituents[index]);
-	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
-
-	/* Check that one cannot access after lent region. */
-	ASSERT_EQ(ptr[PAGE_SIZE], 0);
-
-	FAIL("Exception not generated by invalid access.");
-}
-
-/**
- * Attempt to modify below the lower bound for the lent memory.
- */
-TEST_SERVICE(spci_lend_check_lower_bound)
-{
-	struct spci_value ret = spci_msg_wait();
-	uint8_t *ptr;
-	uint8_t index;
-
-	void *recv_buf = SERVICE_RECV_BUFFER();
-	struct spci_memory_region *memory_region =
-		(struct spci_memory_region *)recv_buf;
-	struct spci_memory_region_constituent *constituents =
-		spci_memory_region_get_constituents(memory_region);
-
-	exception_setup(NULL, exception_handler_yield_data_abort);
-
-	EXPECT_EQ(ret.func, SPCI_MEM_LEND_32);
-
-	/* Choose which constituent we want to test. */
-	index = *(uint8_t *)spci_memory_region_constituent_get_address(
-		&constituents[0]);
-	ptr = (uint8_t *)spci_memory_region_constituent_get_address(
-		&constituents[index]);
-	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
-
-	/* Check that one cannot access after lent region. */
-	ptr[-1]++;
-
-	FAIL("Exception not generated by invalid access.");
-}
-
 TEST_SERVICE(spci_memory_lend_twice)
 {
 	struct spci_value ret = spci_msg_wait();
@@ -705,17 +671,15 @@
 
 	void *recv_buf = SERVICE_RECV_BUFFER();
 	void *send_buf = SERVICE_SEND_BUFFER();
-	struct spci_memory_region *memory_region =
-		(struct spci_memory_region *)recv_buf;
-	struct spci_memory_region_constituent *constituents =
-		spci_memory_region_get_constituents(memory_region);
-	struct spci_memory_region_constituent constituent_copy =
-		constituents[0];
+	struct spci_retrieved_memory_region *memory_region;
+	struct spci_receiver_address_range *range;
+	struct spci_memory_region_constituent constituent_copy;
 
-	/* The memory may have been sent in one of several different ways. */
-	EXPECT_TRUE(ret.func == SPCI_MEM_DONATE_32 ||
-		    ret.func == SPCI_MEM_LEND_32 ||
-		    ret.func == SPCI_MEM_SHARE_32);
+	retrieve_memory_from_message(recv_buf, send_buf, ret, NULL);
+	memory_region = (struct spci_retrieved_memory_region *)recv_buf;
+	range = spci_retrieved_memory_region_first_receiver_range(
+		memory_region);
+	constituent_copy = range->constituents[0];
 
 	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
 
diff --git a/test/vmapi/primary_with_secondaries/unmapped.c b/test/vmapi/primary_with_secondaries/unmapped.c
index 43619f5..64fa9a0 100644
--- a/test/vmapi/primary_with_secondaries/unmapped.c
+++ b/test/vmapi/primary_with_secondaries/unmapped.c
@@ -46,14 +46,6 @@
 
 	SERVICE_SELECT(SERVICE_VM1, "straddling_data_unmapped", mb.send);
 
-	/*
-	 * First we get a message about the memory being donated to us, then we
-	 * get the trap.
-	 */
-	run_res = spci_run(SERVICE_VM1, 0);
-	EXPECT_EQ(run_res.func, SPCI_MEM_DONATE_32);
-	EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
-
 	run_res = spci_run(SERVICE_VM1, 0);
 	EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
 		  1);
diff --git a/vmlib/spci.c b/vmlib/spci.c
index e5fccba..55347cf 100644
--- a/vmlib/spci.c
+++ b/vmlib/spci.c
@@ -16,14 +16,29 @@
 
 #include "hf/spci.h"
 
+#include <stddef.h>
+
 #include "hf/types.h"
 
+#if defined(__linux__) && defined(__KERNEL__)
+#include <linux/kernel.h>
+#include <linux/string.h>
+
+/* Linux doesn't have a checked memcpy, so just use the unchecked version. */
+void memcpy_s(void *dest, size_t destsz, const void *src, size_t count)
+{
+	memcpy(dest, src, count);
+}
+
 /*
- * Copied from hf/arch/std.h because we can't include Hafnium internal headers
- * here.
+ * Use macro from Linux because we can't include Hafnium internal headers here.
  */
 #ifndef align_up
-#define align_up(v, a) (((uintptr_t)(v) + ((a)-1)) & ~((a)-1))
+#define align_up(v, a) ALIGN((v), (a))
+#endif
+
+#else
+#include "hf/std.h"
 #endif
 
 /**
@@ -90,3 +105,68 @@
 
 	return memory_region->constituent_offset + constituents_length;
 }
+
+uint32_t spci_memory_retrieve_request_init(
+	struct spci_memory_retrieve_request *request,
+	spci_memory_handle_t handle, spci_vm_id_t sender, spci_vm_id_t receiver,
+	uint32_t share_func, uint32_t tag, uint32_t page_count,
+	enum spci_memory_access access, enum spci_memory_type type,
+	enum spci_memory_cacheability cacheability,
+	enum spci_memory_shareability shareability)
+{
+	struct spci_memory_retrieve_properties *retrieve_properties =
+		spci_memory_retrieve_request_first_retrieve_properties(request);
+	uint16_t attributes = 0;
+
+	/* Set memory region's page attributes. */
+	spci_set_memory_access_attr(&attributes, access);
+	spci_set_memory_type_attr(&attributes, type);
+	spci_set_memory_cacheability_attr(&attributes, cacheability);
+	spci_set_memory_shareability_attr(&attributes, shareability);
+
+	request->reserved_0 = 0;
+	request->reserved_1 = 0;
+	request->handle = handle;
+	request->sender = sender;
+	request->share_func = share_func;
+	request->tag = tag;
+	request->attribute_count = 0;
+	request->attribute_offset = 0;
+	request->retrieve_properties_count = 1;
+
+	retrieve_properties->attributes.receiver = receiver;
+	retrieve_properties->attributes.memory_attributes = attributes;
+	retrieve_properties->page_count = page_count;
+	retrieve_properties->constituent_count = 0;
+	retrieve_properties->reserved = 0;
+
+	return sizeof(struct spci_memory_retrieve_request) +
+	       sizeof(struct spci_memory_retrieve_properties);
+}
+
+uint32_t spci_retrieved_memory_region_init(
+	struct spci_retrieved_memory_region *response, size_t response_max_size,
+	spci_vm_id_t receiver,
+	const struct spci_memory_region_constituent constituents[],
+	uint32_t constituent_count, uint32_t page_count)
+{
+	struct spci_receiver_address_range *response_range =
+		spci_retrieved_memory_region_first_receiver_range(response);
+
+	response->receiver_count = 1;
+	response_range->receiver = receiver;
+	response_range->page_count = page_count;
+	response_range->constituent_count = constituent_count;
+	memcpy_s(response_range->constituents,
+		 response_max_size -
+			 sizeof(struct spci_retrieved_memory_region) -
+			 sizeof(struct spci_receiver_address_range),
+		 constituents,
+		 constituent_count *
+			 sizeof(struct spci_memory_region_constituent));
+
+	return sizeof(struct spci_retrieved_memory_region) +
+	       sizeof(struct spci_receiver_address_range) +
+	       constituent_count *
+		       sizeof(struct spci_memory_region_constituent);
+}