Adding upstream version 7.0.14-dfsg.upstream/7.0.14-dfsg

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

8 files changed, 1329 insertions, 0 deletions

diff --git a/src/VBox/Devices/EFI/Firmware/UefiCpuPkg/SecCore/FindPeiCore.c b/src/VBox/Devices/EFI/Firmware/UefiCpuPkg/SecCore/FindPeiCore.c
new file mode 100644
index 00000000..ef9420bf
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/UefiCpuPkg/SecCore/FindPeiCore.c
@@ -0,0 +1,190 @@
+/** @file
+  Locate the entry point for the PEI Core
+
+  Copyright (c) 2008 - 2019, Intel Corporation. All rights reserved.<BR>
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include <PiPei.h>
+
+#include "SecMain.h"
+
+/**
+  Find core image base.
+
+  @param   FirmwareVolumePtr        Point to the firmware volume for finding core image.
+  @param   FileType                 The FileType for searching, either SecCore or PeiCore.
+  @param   CoreImageBase            The base address of the core image.
+
+**/
+EFI_STATUS
+EFIAPI
+FindImageBase (
+  IN  EFI_FIRMWARE_VOLUME_HEADER       *FirmwareVolumePtr,
+  IN  EFI_FV_FILETYPE                  FileType,
+  OUT EFI_PHYSICAL_ADDRESS             *CoreImageBase
+  )
+{
+  EFI_PHYSICAL_ADDRESS        CurrentAddress;
+  EFI_PHYSICAL_ADDRESS        EndOfFirmwareVolume;
+  EFI_FFS_FILE_HEADER         *File;
+  UINT32                      Size;
+  EFI_PHYSICAL_ADDRESS        EndOfFile;
+  EFI_COMMON_SECTION_HEADER   *Section;
+  EFI_PHYSICAL_ADDRESS        EndOfSection;
+
+  *CoreImageBase = 0;
+
+  CurrentAddress = (EFI_PHYSICAL_ADDRESS)(UINTN) FirmwareVolumePtr;
+  EndOfFirmwareVolume = CurrentAddress + FirmwareVolumePtr->FvLength;
+
+  //
+  // Loop through the FFS files in the Boot Firmware Volume
+  //
+  for (EndOfFile = CurrentAddress + FirmwareVolumePtr->HeaderLength; ; ) {
+
+    CurrentAddress = (EndOfFile + 7) & 0xfffffffffffffff8ULL;
+    if (CurrentAddress > EndOfFirmwareVolume) {
+      return EFI_NOT_FOUND;
+    }
+
+    File = (EFI_FFS_FILE_HEADER*)(UINTN) CurrentAddress;
+    if (IS_FFS_FILE2 (File)) {
+      Size = FFS_FILE2_SIZE (File);
+      if (Size <= 0x00FFFFFF) {
+        return EFI_NOT_FOUND;
+      }
+    } else {
+      Size = FFS_FILE_SIZE (File);
+      if (Size < sizeof (EFI_FFS_FILE_HEADER)) {
+        return EFI_NOT_FOUND;
+      }
+    }
+
+    EndOfFile = CurrentAddress + Size;
+    if (EndOfFile > EndOfFirmwareVolume) {
+      return EFI_NOT_FOUND;
+    }
+
+    //
+    // Look for particular Core file (either SEC Core or PEI Core)
+    //
+    if (File->Type != FileType) {
+      continue;
+    }
+
+    //
+    // Loop through the FFS file sections within the FFS file
+    //
+    if (IS_FFS_FILE2 (File)) {
+      EndOfSection = (EFI_PHYSICAL_ADDRESS) (UINTN) ((UINT8 *) File + sizeof (EFI_FFS_FILE_HEADER2));
+    } else {
+      EndOfSection = (EFI_PHYSICAL_ADDRESS) (UINTN) ((UINT8 *) File + sizeof (EFI_FFS_FILE_HEADER));
+    }
+    for (;;) {
+      CurrentAddress = (EndOfSection + 3) & 0xfffffffffffffffcULL;
+      Section = (EFI_COMMON_SECTION_HEADER*)(UINTN) CurrentAddress;
+
+      if (IS_SECTION2 (Section)) {
+        Size = SECTION2_SIZE (Section);
+        if (Size <= 0x00FFFFFF) {
+          return EFI_NOT_FOUND;
+        }
+      } else {
+        Size = SECTION_SIZE (Section);
+        if (Size < sizeof (EFI_COMMON_SECTION_HEADER)) {
+          return EFI_NOT_FOUND;
+        }
+      }
+
+      EndOfSection = CurrentAddress + Size;
+      if (EndOfSection > EndOfFile) {
+        return EFI_NOT_FOUND;
+      }
+
+      //
+      // Look for executable sections
+      //
+      if (Section->Type == EFI_SECTION_PE32 || Section->Type == EFI_SECTION_TE) {
+        if (File->Type == FileType) {
+          if (IS_SECTION2 (Section)) {
+            *CoreImageBase = (PHYSICAL_ADDRESS) (UINTN) ((UINT8 *) Section + sizeof (EFI_COMMON_SECTION_HEADER2));
+          } else {
+            *CoreImageBase = (PHYSICAL_ADDRESS) (UINTN) ((UINT8 *) Section + sizeof (EFI_COMMON_SECTION_HEADER));
+          }
+        }
+        break;
+      }
+    }
+
+    //
+    // Either SEC Core or PEI Core images found
+    //
+    if (*CoreImageBase != 0) {
+      return EFI_SUCCESS;
+    }
+  }
+}
+
+/**
+  Find and return Pei Core entry point.
+
+  It also find SEC and PEI Core file debug information. It will report them if
+  remote debug is enabled.
+
+  @param   SecCoreFirmwareVolumePtr Point to the firmware volume for finding SecCore.
+  @param   PeiCoreFirmwareVolumePtr Point to the firmware volume for finding PeiCore.
+  @param   PeiCoreEntryPoint        The entry point of the PEI core.
+
+**/
+VOID
+EFIAPI
+FindAndReportEntryPoints (
+  IN  EFI_FIRMWARE_VOLUME_HEADER       *SecCoreFirmwareVolumePtr,
+  IN  EFI_FIRMWARE_VOLUME_HEADER       *PeiCoreFirmwareVolumePtr,
+  OUT EFI_PEI_CORE_ENTRY_POINT         *PeiCoreEntryPoint
+  )
+{
+  EFI_STATUS                       Status;
+  EFI_PHYSICAL_ADDRESS             SecCoreImageBase;
+  EFI_PHYSICAL_ADDRESS             PeiCoreImageBase;
+  PE_COFF_LOADER_IMAGE_CONTEXT     ImageContext;
+
+  //
+  // Find SEC Core image base
+  //
+  Status = FindImageBase (SecCoreFirmwareVolumePtr, EFI_FV_FILETYPE_SECURITY_CORE, &SecCoreImageBase);
+  ASSERT_EFI_ERROR (Status);
+
+  ZeroMem ((VOID *) &ImageContext, sizeof (PE_COFF_LOADER_IMAGE_CONTEXT));
+  //
+  // Report SEC Core debug information when remote debug is enabled
+  //
+  ImageContext.ImageAddress = SecCoreImageBase;
+  ImageContext.PdbPointer = PeCoffLoaderGetPdbPointer ((VOID*) (UINTN) ImageContext.ImageAddress);
+  PeCoffLoaderRelocateImageExtraAction (&ImageContext);
+
+  //
+  // Find PEI Core image base
+  //
+  Status = FindImageBase (PeiCoreFirmwareVolumePtr, EFI_FV_FILETYPE_PEI_CORE, &PeiCoreImageBase);
+  ASSERT_EFI_ERROR (Status);
+
+  //
+  // Report PEI Core debug information when remote debug is enabled
+  //
+  ImageContext.ImageAddress = PeiCoreImageBase;
+  ImageContext.PdbPointer = PeCoffLoaderGetPdbPointer ((VOID*) (UINTN) ImageContext.ImageAddress);
+  PeCoffLoaderRelocateImageExtraAction (&ImageContext);
+
+  //
+  // Find PEI Core entry point
+  //
+  Status = PeCoffLoaderGetEntryPoint ((VOID *) (UINTN) PeiCoreImageBase, (VOID**) PeiCoreEntryPoint);
+  if (EFI_ERROR (Status)) {
+    *PeiCoreEntryPoint = 0;
+  }
+
+  return;
+}
diff --git a/src/VBox/Devices/EFI/Firmware/UefiCpuPkg/SecCore/Ia32/ResetVec.nasmb b/src/VBox/Devices/EFI/Firmware/UefiCpuPkg/SecCore/Ia32/ResetVec.nasmb
new file mode 100644
index 00000000..1d2203de
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/UefiCpuPkg/SecCore/Ia32/ResetVec.nasmb
@@ -0,0 +1,114 @@
+;------------------------------------------------------------------------------
+;
+; Copyright (c) 2014, Intel Corporation. All rights reserved.<BR>
+; SPDX-License-Identifier: BSD-2-Clause-Patent
+;
+; Module Name:
+;
+;  ResetVec.nasmb
+;
+; Abstract:
+;
+;  Reset Vector Data structure
+;  This structure is located at 0xFFFFF000
+;
+;------------------------------------------------------------------------------
+
+;    .stack  0x0
+;    SECTION .text
+USE16
+
+;
+; The layout of this file is fixed. The build tool makes assumption of the layout.
+;
+
+    ORG     0h
+
+;
+; 0xFFFFF000
+;
+; We enter here with CS:IP = 0xFF00:0x0000. Do a far-jump to change CS to 0xF000
+; and IP to ApStartup.
+;
+ApVector:
+    mov     di, "AP"
+    jmp     0xF000:0xF000+ApStartup
+
+    TIMES 0xFC0-($-$$) nop
+
+;
+; This should be at 0xFFFFFFC0
+;
+
+;
+; Reserved
+;
+ReservedData:            DD 0eeeeeeeeh, 0eeeeeeeeh
+
+    TIMES 0xFD0-($-$$) nop
+;
+; This is located at 0xFFFFFFD0
+;
+    mov     di, "PA"
+    jmp     ApStartup
+
+    TIMES 0xFE0-($-$$) nop
+;
+; Pointer to the entry point of the PEI core
+; It is located at 0xFFFFFFE0, and is fixed up by some build tool
+; So if the value 8..1 appears in the final FD image, tool failure occurs.
+;
+PeiCoreEntryPoint:       DD      87654321h
+
+;
+; This is the handler for all kinds of exceptions. Since it's for debugging
+; purpose only, nothing except a dead loop would be done here. Developers could
+; analyze the cause of the exception if a debugger had been attached.
+;
+global ASM_PFX(InterruptHandler)
+ASM_PFX(InterruptHandler):
+    jmp     $
+    iret
+
+    TIMES 0xFF0-($-$$) nop
+;
+; For IA32, the reset vector must be at 0xFFFFFFF0, i.e., 4G-16 byte
+; Execution starts here upon power-on/platform-reset.
+;
+ResetHandler:
+    nop
+    nop
+ApStartup:
+    ;
+    ; Jmp Rel16 instruction
+    ; Use machine code directly in case of the assembler optimization
+    ; SEC entry point relative address will be fixed up by some build tool.
+    ;
+    ; Typically, SEC entry point is the function _ModuleEntryPoint() defined in
+    ; SecEntry.asm
+    ;
+    DB      0e9h
+    DW      -3
+
+
+    TIMES 0xFF8-($-$$) nop
+;
+; Ap reset vector segment address is at 0xFFFFFFF8
+; This will be fixed up by some build tool,
+; so if the value 1..8 appears in the final FD image,
+; tool failure occurs
+;
+ApSegAddress:    dd      12345678h
+
+    TIMES 0xFFC-($-$$) nop
+;
+; BFV Base is at 0xFFFFFFFC
+; This will be fixed up by some build tool,
+; so if the value 1..8 appears in the final FD image,
+; tool failure occurs.
+;
+BfvBase:     DD      12345678h
+
+;
+; Nothing can go here, otherwise the layout of this file would change.
+;
diff --git a/src/VBox/Devices/EFI/Firmware/UefiCpuPkg/SecCore/SecBist.c b/src/VBox/Devices/EFI/Firmware/UefiCpuPkg/SecCore/SecBist.c
new file mode 100644
index 00000000..ce85b565
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/UefiCpuPkg/SecCore/SecBist.c
@@ -0,0 +1,264 @@
+/** @file
+  Get SEC platform information(2) PPI and reinstall it.
+
+  Copyright (c) 2006 - 2016, Intel Corporation. All rights reserved.<BR>
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "SecMain.h"
+
+EFI_SEC_PLATFORM_INFORMATION_PPI mSecPlatformInformation = {
+  SecPlatformInformationBist
+};
+
+EFI_PEI_PPI_DESCRIPTOR mPeiSecPlatformInformation = {
+  (EFI_PEI_PPI_DESCRIPTOR_PPI | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST),
+  &gEfiSecPlatformInformationPpiGuid,
+  &mSecPlatformInformation
+};
+
+EFI_SEC_PLATFORM_INFORMATION2_PPI mSecPlatformInformation2 = {
+  SecPlatformInformation2Bist
+};
+
+EFI_PEI_PPI_DESCRIPTOR mPeiSecPlatformInformation2 = {
+  (EFI_PEI_PPI_DESCRIPTOR_PPI | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST),
+  &gEfiSecPlatformInformation2PpiGuid,
+  &mSecPlatformInformation2
+};
+
+/**
+  Worker function to parse CPU BIST information from Guided HOB.
+
+  @param[in, out] StructureSize     Pointer to the variable describing size of the input buffer.
+  @param[in, out] StructureBuffer   Pointer to the buffer save CPU BIST information.
+
+  @retval EFI_SUCCESS           The data was successfully returned.
+  @retval EFI_BUFFER_TOO_SMALL  The buffer was too small.
+
+**/
+EFI_STATUS
+GetBistFromHob (
+  IN OUT UINT64           *StructureSize,
+  IN OUT VOID             *StructureBuffer
+  )
+{
+  EFI_HOB_GUID_TYPE       *GuidHob;
+  VOID                    *DataInHob;
+  UINTN                   DataSize;
+
+  GuidHob = GetFirstGuidHob (&gEfiCallerIdGuid);
+  if (GuidHob == NULL) {
+    *StructureSize = 0;
+    return EFI_SUCCESS;
+  }
+
+  DataInHob = GET_GUID_HOB_DATA (GuidHob);
+  DataSize  = GET_GUID_HOB_DATA_SIZE (GuidHob);
+
+  //
+  // return the information from BistHob
+  //
+  if ((*StructureSize) < (UINT64) DataSize) {
+    *StructureSize = (UINT64) DataSize;
+    return EFI_BUFFER_TOO_SMALL;
+  }
+
+  *StructureSize = (UINT64) DataSize;
+  CopyMem (StructureBuffer, DataInHob, DataSize);
+  return EFI_SUCCESS;
+}
+
+/**
+  Implementation of the PlatformInformation service in EFI_SEC_PLATFORM_INFORMATION_PPI.
+
+  @param[in]      PeiServices                Pointer to the PEI Services Table.
+  @param[in, out] StructureSize              Pointer to the variable describing size of the input buffer.
+  @param[out]     PlatformInformationRecord  Pointer to the EFI_SEC_PLATFORM_INFORMATION_RECORD.
+
+  @retval EFI_SUCCESS                    The data was successfully returned.
+  @retval EFI_BUFFER_TOO_SMALL           The buffer was too small.
+
+**/
+EFI_STATUS
+EFIAPI
+SecPlatformInformationBist (
+  IN CONST EFI_PEI_SERVICES                  **PeiServices,
+  IN OUT UINT64                              *StructureSize,
+     OUT EFI_SEC_PLATFORM_INFORMATION_RECORD *PlatformInformationRecord
+  )
+{
+  return GetBistFromHob (StructureSize, PlatformInformationRecord);
+}
+
+/**
+  Implementation of the PlatformInformation2 service in EFI_SEC_PLATFORM_INFORMATION2_PPI.
+
+  @param[in]      PeiServices                The pointer to the PEI Services Table.
+  @param[in, out] StructureSize              The pointer to the variable describing size of the input buffer.
+  @param[out]     PlatformInformationRecord2 The pointer to the EFI_SEC_PLATFORM_INFORMATION_RECORD2.
+
+  @retval EFI_SUCCESS                    The data was successfully returned.
+  @retval EFI_BUFFER_TOO_SMALL           The buffer was too small. The current buffer size needed to
+                                         hold the record is returned in StructureSize.
+
+**/
+EFI_STATUS
+EFIAPI
+SecPlatformInformation2Bist (
+  IN CONST EFI_PEI_SERVICES                   **PeiServices,
+  IN OUT UINT64                               *StructureSize,
+     OUT EFI_SEC_PLATFORM_INFORMATION_RECORD2 *PlatformInformationRecord2
+  )
+{
+  return GetBistFromHob (StructureSize, PlatformInformationRecord2);
+}
+
+/**
+  Worker function to get CPUs' BIST by calling SecPlatformInformationPpi
+  or SecPlatformInformation2Ppi.
+
+  @param[in]  PeiServices         Pointer to PEI Services Table
+  @param[in]  Guid                PPI Guid
+  @param[out] PpiDescriptor       Return a pointer to instance of the
+                                  EFI_PEI_PPI_DESCRIPTOR
+  @param[out] BistInformationData Pointer to BIST information data
+  @param[out] BistInformationSize Return the size in bytes of BIST information
+
+  @retval EFI_SUCCESS         Retrieve of the BIST data successfully
+  @retval EFI_NOT_FOUND       No sec platform information(2) ppi export
+  @retval EFI_DEVICE_ERROR    Failed to get CPU Information
+
+**/
+EFI_STATUS
+GetBistInfoFromPpi (
+  IN CONST EFI_PEI_SERVICES     **PeiServices,
+  IN CONST EFI_GUID             *Guid,
+     OUT EFI_PEI_PPI_DESCRIPTOR **PpiDescriptor,
+     OUT VOID                   **BistInformationData,
+     OUT UINT64                 *BistInformationSize OPTIONAL
+  )
+{
+  EFI_STATUS                            Status;
+  EFI_SEC_PLATFORM_INFORMATION2_PPI     *SecPlatformInformation2Ppi;
+  EFI_SEC_PLATFORM_INFORMATION_RECORD2  *SecPlatformInformation2;
+  UINT64                                InformationSize;
+
+  Status = PeiServicesLocatePpi (
+             Guid,                                // GUID
+             0,                                   // INSTANCE
+             PpiDescriptor,                       // EFI_PEI_PPI_DESCRIPTOR
+             (VOID **)&SecPlatformInformation2Ppi // PPI
+             );
+  if (Status == EFI_NOT_FOUND) {
+    return EFI_NOT_FOUND;
+  }
+
+  if (Status == EFI_SUCCESS) {
+    //
+    // Get the size of the sec platform information2(BSP/APs' BIST data)
+    //
+    InformationSize         = 0;
+    SecPlatformInformation2 = NULL;
+    Status = SecPlatformInformation2Ppi->PlatformInformation2 (
+                                           PeiServices,
+                                           &InformationSize,
+                                           SecPlatformInformation2
+                                           );
+    if (Status == EFI_BUFFER_TOO_SMALL) {
+      Status = PeiServicesAllocatePool (
+                 (UINTN) InformationSize,
+                 (VOID **) &SecPlatformInformation2
+                 );
+      if (Status == EFI_SUCCESS) {
+        //
+        // Retrieve BIST data
+        //
+        Status = SecPlatformInformation2Ppi->PlatformInformation2 (
+                                               PeiServices,
+                                               &InformationSize,
+                                               SecPlatformInformation2
+                                               );
+        if (Status == EFI_SUCCESS) {
+          *BistInformationData = SecPlatformInformation2;
+          if (BistInformationSize != NULL) {
+            *BistInformationSize = InformationSize;
+          }
+          return EFI_SUCCESS;
+        }
+      }
+    }
+  }
+
+  return EFI_DEVICE_ERROR;
+}
+
+/**
+  Get CPUs' BIST by calling SecPlatformInformationPpi/SecPlatformInformation2Ppi.
+
+**/
+VOID
+RepublishSecPlatformInformationPpi (
+  VOID
+  )
+{
+  EFI_STATUS                            Status;
+  CONST EFI_PEI_SERVICES                **PeiServices;
+  UINT64                                BistInformationSize;
+  VOID                                  *BistInformationData;
+  EFI_PEI_PPI_DESCRIPTOR                *SecInformationDescriptor;
+
+  PeiServices = GetPeiServicesTablePointer ();
+  Status = GetBistInfoFromPpi (
+             PeiServices,
+             &gEfiSecPlatformInformation2PpiGuid,
+             &SecInformationDescriptor,
+             &BistInformationData,
+             &BistInformationSize
+             );
+  if (Status == EFI_SUCCESS) {
+    BuildGuidDataHob (
+      &gEfiCallerIdGuid,
+      BistInformationData,
+      (UINTN) BistInformationSize
+      );
+    //
+    // The old SecPlatformInformation2 data is on temporary memory.
+    // After memory discovered, we should never get it from temporary memory,
+    // or the data will be crashed. So, we reinstall SecPlatformInformation2 PPI here.
+    //
+    Status = PeiServicesReInstallPpi (
+               SecInformationDescriptor,
+               &mPeiSecPlatformInformation2
+               );
+  } if (Status == EFI_NOT_FOUND) {
+    Status = GetBistInfoFromPpi (
+               PeiServices,
+               &gEfiSecPlatformInformationPpiGuid,
+               &SecInformationDescriptor,
+               &BistInformationData,
+               &BistInformationSize
+               );
+    if (Status == EFI_SUCCESS) {
+      BuildGuidDataHob (
+        &gEfiCallerIdGuid,
+        BistInformationData,
+        (UINTN) BistInformationSize
+        );
+      //
+      // The old SecPlatformInformation data is on temporary memory.
+      // After memory discovered, we should never get it from temporary memory,
+      // or the data will be crashed. So, we reinstall SecPlatformInformation PPI here.
+      //
+      Status = PeiServicesReInstallPpi (
+                 SecInformationDescriptor,
+                 &mPeiSecPlatformInformation
+                 );
+    } else if (Status == EFI_NOT_FOUND) {
+      return;
+    }
+  }
+
+  ASSERT_EFI_ERROR(Status);
+}
diff --git a/src/VBox/Devices/EFI/Firmware/UefiCpuPkg/SecCore/SecCore.inf b/src/VBox/Devices/EFI/Firmware/UefiCpuPkg/SecCore/SecCore.inf
new file mode 100644
index 00000000..29322ae7
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/UefiCpuPkg/SecCore/SecCore.inf
@@ -0,0 +1,83 @@
+## @file
+#  SecCore module that implements the SEC phase.
+#
+#  This is the first module taking control of the platform upon power-on/reset.
+#  It implements the first phase of the security phase. The entry point function is
+#  _ModuleEntryPoint in PlatformSecLib. The entry point function will switch to
+#  protected mode, setup flat memory model, enable temporary memory and
+#  call into SecStartup().
+#
+#  Copyright (c) 2006 - 2019, Intel Corporation. All rights reserved.<BR>
+#  SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+##
+
+[Defines]
+  INF_VERSION                    = 0x00010005
+  BASE_NAME                      = SecCore
+  MODULE_UNI_FILE                = SecCore.uni
+  FILE_GUID                      = 1BA0062E-C779-4582-8566-336AE8F78F09
+  MODULE_TYPE                    = SEC
+  VERSION_STRING                 = 1.0
+
+
+#
+# The following information is for reference only and not required by the build tools.
+#
+#  VALID_ARCHITECTURES           = IA32 X64 EBC
+#
+
+[Sources]
+  SecMain.c
+  SecMain.h
+  FindPeiCore.c
+  SecBist.c
+
+[Sources.IA32]
+  Ia32/ResetVec.nasmb
+
+[Packages]
+  MdePkg/MdePkg.dec
+  MdeModulePkg/MdeModulePkg.dec
+  UefiCpuPkg/UefiCpuPkg.dec
+
+[LibraryClasses]
+  BaseMemoryLib
+  DebugLib
+  PlatformSecLib
+  PcdLib
+  DebugAgentLib
+  UefiCpuLib
+  PeCoffGetEntryPointLib
+  PeCoffExtraActionLib
+  CpuExceptionHandlerLib
+  ReportStatusCodeLib
+  PeiServicesLib
+  PeiServicesTablePointerLib
+  HobLib
+
+[Ppis]
+  ## SOMETIMES_CONSUMES
+  ## PRODUCES
+  gEfiSecPlatformInformationPpiGuid
+  ## SOMETIMES_CONSUMES
+  ## SOMETIMES_PRODUCES
+  gEfiSecPlatformInformation2PpiGuid
+  gEfiTemporaryRamDonePpiGuid                          ## PRODUCES
+  ## NOTIFY
+  ## SOMETIMES_CONSUMES
+  gPeiSecPerformancePpiGuid
+  gEfiPeiCoreFvLocationPpiGuid
+  ## CONSUMES
+  gRepublishSecPpiPpiGuid
+
+[Guids]
+  ## SOMETIMES_PRODUCES   ## HOB
+  gEfiFirmwarePerformanceGuid
+
+[Pcd]
+  gUefiCpuPkgTokenSpaceGuid.PcdPeiTemporaryRamStackSize  ## CONSUMES
+  gEfiMdeModulePkgTokenSpaceGuid.PcdMigrateTemporaryRamFirmwareVolumes  ## CONSUMES
+
+[UserExtensions.TianoCore."ExtraFiles"]
+  SecCoreExtra.uni
diff --git a/src/VBox/Devices/EFI/Firmware/UefiCpuPkg/SecCore/SecCore.uni b/src/VBox/Devices/EFI/Firmware/UefiCpuPkg/SecCore/SecCore.uni
new file mode 100644
index 00000000..1ecf928b
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/UefiCpuPkg/SecCore/SecCore.uni
@@ -0,0 +1,18 @@
+// /** @file

+// SecCore module that implements the SEC phase.

+//

+// This is the first module taking control of the platform upon power-on/reset.

+// It implements the first phase of the security phase. The entry point function is

+// _ModuleEntryPoint in PlatformSecLib. The entry point function will switch to

+// protected mode, setup flat memory model, enable temporary memory and

+// call into SecStartup().

+//

+// Copyright (c) 2006 - 2014, Intel Corporation. All rights reserved.<BR>

+//

+// SPDX-License-Identifier: BSD-2-Clause-Patent

+//

+// **/

+

+#string STR_MODULE_ABSTRACT             #language en-US "SecCore module that implements the SEC phase"

+

+#string STR_MODULE_DESCRIPTION          #language en-US "This is the first module taking control of the platform upon power-on/reset. It implements the first phase of the security phase. The entry point function is _ModuleEntryPoint in PlatformSecLib. The entry point function will switch to protected mode, will setup flat memory model, will enable temporary memory and will call into SecStartup()."

diff --git a/src/VBox/Devices/EFI/Firmware/UefiCpuPkg/SecCore/SecCoreExtra.uni b/src/VBox/Devices/EFI/Firmware/UefiCpuPkg/SecCore/SecCoreExtra.uni
new file mode 100644
index 00000000..4b582f1d
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/UefiCpuPkg/SecCore/SecCoreExtra.uni
@@ -0,0 +1,12 @@
+// /** @file

+// SecCore Localized Strings and Content

+//

+// Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.<BR>

+//

+// SPDX-License-Identifier: BSD-2-Clause-Patent

+//

+// **/

+

+#string STR_PROPERTIES_MODULE_NAME

+#language en-US

+"SEC Core Module"

diff --git a/src/VBox/Devices/EFI/Firmware/UefiCpuPkg/SecCore/SecMain.c b/src/VBox/Devices/EFI/Firmware/UefiCpuPkg/SecCore/SecMain.c
new file mode 100644
index 00000000..f8038a9f
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/UefiCpuPkg/SecCore/SecMain.c
@@ -0,0 +1,468 @@
+/** @file
+  C functions in SEC
+
+  Copyright (c) 2008 - 2019, Intel Corporation. All rights reserved.<BR>
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "SecMain.h"
+
+EFI_PEI_TEMPORARY_RAM_DONE_PPI gSecTemporaryRamDonePpi = {
+  SecTemporaryRamDone
+};
+
+EFI_SEC_PLATFORM_INFORMATION_PPI  mSecPlatformInformationPpi = { SecPlatformInformation };
+
+EFI_PEI_PPI_DESCRIPTOR            mPeiSecPlatformInformationPpi[] = {
+  {
+    //
+    // SecPerformance PPI notify descriptor.
+    //
+    EFI_PEI_PPI_DESCRIPTOR_NOTIFY_CALLBACK,
+    &gPeiSecPerformancePpiGuid,
+    (VOID *) (UINTN) SecPerformancePpiCallBack
+  },
+  {
+    EFI_PEI_PPI_DESCRIPTOR_PPI,
+    &gEfiTemporaryRamDonePpiGuid,
+    &gSecTemporaryRamDonePpi
+  },
+  {
+    (EFI_PEI_PPI_DESCRIPTOR_PPI | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST),
+    &gEfiSecPlatformInformationPpiGuid,
+    &mSecPlatformInformationPpi
+  }
+};
+
+/**
+  Migrates the Global Descriptor Table (GDT) to permanent memory.
+
+  @retval   EFI_SUCCESS           The GDT was migrated successfully.
+  @retval   EFI_OUT_OF_RESOURCES  The GDT could not be migrated due to lack of available memory.
+
+**/
+EFI_STATUS
+MigrateGdt (
+  VOID
+  )
+{
+  EFI_STATUS          Status;
+  UINTN               GdtBufferSize;
+  IA32_DESCRIPTOR     Gdtr;
+  VOID                *GdtBuffer;
+
+  AsmReadGdtr ((IA32_DESCRIPTOR *) &Gdtr);
+  GdtBufferSize = sizeof (IA32_SEGMENT_DESCRIPTOR) -1 + Gdtr.Limit + 1;
+
+  Status =  PeiServicesAllocatePool (
+              GdtBufferSize,
+              &GdtBuffer
+              );
+  ASSERT (GdtBuffer != NULL);
+  if (EFI_ERROR (Status)) {
+    return EFI_OUT_OF_RESOURCES;
+  }
+
+  GdtBuffer = ALIGN_POINTER (GdtBuffer, sizeof (IA32_SEGMENT_DESCRIPTOR));
+  CopyMem (GdtBuffer, (VOID *) Gdtr.Base, Gdtr.Limit + 1);
+  Gdtr.Base = (UINTN) GdtBuffer;
+  AsmWriteGdtr (&Gdtr);
+
+  return EFI_SUCCESS;
+}
+
+//
+// These are IDT entries pointing to 10:FFFFFFE4h.
+//
+UINT64  mIdtEntryTemplate = 0xffff8e000010ffe4ULL;
+
+/**
+  Caller provided function to be invoked at the end of InitializeDebugAgent().
+
+  Entry point to the C language phase of SEC. After the SEC assembly
+  code has initialized some temporary memory and set up the stack,
+  the control is transferred to this function.
+
+  @param[in] Context    The first input parameter of InitializeDebugAgent().
+
+**/
+VOID
+NORETURN
+EFIAPI
+SecStartupPhase2(
+  IN VOID                     *Context
+  );
+
+/**
+  Entry point of the notification callback function itself within the PEIM.
+  It is to get SEC performance data and build HOB to convey the SEC performance
+  data to DXE phase.
+
+  @param  PeiServices      Indirect reference to the PEI Services Table.
+  @param  NotifyDescriptor Address of the notification descriptor data structure.
+  @param  Ppi              Address of the PPI that was installed.
+
+  @return Status of the notification.
+          The status code returned from this function is ignored.
+**/
+EFI_STATUS
+EFIAPI
+SecPerformancePpiCallBack (
+  IN EFI_PEI_SERVICES           **PeiServices,
+  IN EFI_PEI_NOTIFY_DESCRIPTOR  *NotifyDescriptor,
+  IN VOID                       *Ppi
+  )
+{
+  EFI_STATUS                    Status;
+  PEI_SEC_PERFORMANCE_PPI       *SecPerf;
+  FIRMWARE_SEC_PERFORMANCE      Performance;
+
+  SecPerf = (PEI_SEC_PERFORMANCE_PPI *) Ppi;
+  Status = SecPerf->GetPerformance ((CONST EFI_PEI_SERVICES **) PeiServices, SecPerf, &Performance);
+  if (!EFI_ERROR (Status)) {
+    BuildGuidDataHob (
+      &gEfiFirmwarePerformanceGuid,
+      &Performance,
+      sizeof (FIRMWARE_SEC_PERFORMANCE)
+    );
+    DEBUG ((DEBUG_INFO, "FPDT: SEC Performance Hob ResetEnd = %ld\n", Performance.ResetEnd));
+  }
+
+  return Status;
+}
+
+/**
+
+  Entry point to the C language phase of SEC. After the SEC assembly
+  code has initialized some temporary memory and set up the stack,
+  the control is transferred to this function.
+
+
+  @param SizeOfRam           Size of the temporary memory available for use.
+  @param TempRamBase         Base address of temporary ram
+  @param BootFirmwareVolume  Base address of the Boot Firmware Volume.
+**/
+VOID
+NORETURN
+EFIAPI
+SecStartup (
+  IN UINT32                   SizeOfRam,
+  IN UINT32                   TempRamBase,
+  IN VOID                     *BootFirmwareVolume
+  )
+{
+  EFI_SEC_PEI_HAND_OFF        SecCoreData;
+  IA32_DESCRIPTOR             IdtDescriptor;
+  SEC_IDT_TABLE               IdtTableInStack;
+  UINT32                      Index;
+  UINT32                      PeiStackSize;
+  EFI_STATUS                  Status;
+
+  //
+  // Report Status Code to indicate entering SEC core
+  //
+  REPORT_STATUS_CODE (
+    EFI_PROGRESS_CODE,
+    EFI_SOFTWARE_SEC | EFI_SW_SEC_PC_ENTRY_POINT
+    );
+
+  PeiStackSize = PcdGet32 (PcdPeiTemporaryRamStackSize);
+  if (PeiStackSize == 0) {
+    PeiStackSize = (SizeOfRam >> 1);
+  }
+
+  ASSERT (PeiStackSize < SizeOfRam);
+
+  //
+  // Process all libraries constructor function linked to SecCore.
+  //
+  ProcessLibraryConstructorList ();
+
+  //
+  // Initialize floating point operating environment
+  // to be compliant with UEFI spec.
+  //
+  InitializeFloatingPointUnits ();
+
+  // |-------------------|---->
+  // |IDT Table          |
+  // |-------------------|
+  // |PeiService Pointer |    PeiStackSize
+  // |-------------------|
+  // |                   |
+  // |      Stack        |
+  // |-------------------|---->
+  // |                   |
+  // |                   |
+  // |      Heap         |    PeiTemporayRamSize
+  // |                   |
+  // |                   |
+  // |-------------------|---->  TempRamBase
+
+  IdtTableInStack.PeiService = 0;
+  for (Index = 0; Index < SEC_IDT_ENTRY_COUNT; Index ++) {
+    CopyMem ((VOID*)&IdtTableInStack.IdtTable[Index], (VOID*)&mIdtEntryTemplate, sizeof (UINT64));
+  }
+
+  IdtDescriptor.Base  = (UINTN) &IdtTableInStack.IdtTable;
+  IdtDescriptor.Limit = (UINT16)(sizeof (IdtTableInStack.IdtTable) - 1);
+
+  AsmWriteIdtr (&IdtDescriptor);
+
+  //
+  // Setup the default exception handlers
+  //
+  Status = InitializeCpuExceptionHandlers (NULL);
+  ASSERT_EFI_ERROR (Status);
+
+  //
+  // Update the base address and length of Pei temporary memory
+  //
+  SecCoreData.DataSize               = (UINT16) sizeof (EFI_SEC_PEI_HAND_OFF);
+  SecCoreData.BootFirmwareVolumeBase = BootFirmwareVolume;
+  SecCoreData.BootFirmwareVolumeSize = (UINTN)((EFI_FIRMWARE_VOLUME_HEADER *) BootFirmwareVolume)->FvLength;
+  SecCoreData.TemporaryRamBase       = (VOID*)(UINTN) TempRamBase;
+  SecCoreData.TemporaryRamSize       = SizeOfRam;
+  SecCoreData.PeiTemporaryRamBase    = SecCoreData.TemporaryRamBase;
+  SecCoreData.PeiTemporaryRamSize    = SizeOfRam - PeiStackSize;
+  SecCoreData.StackBase              = (VOID*)(UINTN)(TempRamBase + SecCoreData.PeiTemporaryRamSize);
+  SecCoreData.StackSize              = PeiStackSize;
+
+  //
+  // Initialize Debug Agent to support source level debug in SEC/PEI phases before memory ready.
+  //
+  InitializeDebugAgent (DEBUG_AGENT_INIT_PREMEM_SEC, &SecCoreData, SecStartupPhase2);
+
+  //
+  // Should not come here.
+  //
+  UNREACHABLE ();
+}
+
+/**
+  Caller provided function to be invoked at the end of InitializeDebugAgent().
+
+  Entry point to the C language phase of SEC. After the SEC assembly
+  code has initialized some temporary memory and set up the stack,
+  the control is transferred to this function.
+
+  @param[in] Context    The first input parameter of InitializeDebugAgent().
+
+**/
+VOID
+NORETURN
+EFIAPI
+SecStartupPhase2(
+  IN VOID                     *Context
+  )
+{
+  EFI_SEC_PEI_HAND_OFF        *SecCoreData;
+  EFI_PEI_PPI_DESCRIPTOR      *PpiList;
+  UINT32                      Index;
+  EFI_PEI_PPI_DESCRIPTOR      *AllSecPpiList;
+  EFI_PEI_CORE_ENTRY_POINT    PeiCoreEntryPoint;
+
+  PeiCoreEntryPoint = NULL;
+  SecCoreData   = (EFI_SEC_PEI_HAND_OFF *) Context;
+
+  //
+  // Perform platform specific initialization before entering PeiCore.
+  //
+  PpiList = SecPlatformMain (SecCoreData);
+  //
+  // Find Pei Core entry point. It will report SEC and Pei Core debug information if remote debug
+  // is enabled.
+  //
+  if (PpiList != NULL) {
+    Index = 0;
+    do {
+      if (CompareGuid (PpiList[Index].Guid, &gEfiPeiCoreFvLocationPpiGuid) &&
+          (((EFI_PEI_CORE_FV_LOCATION_PPI *) PpiList[Index].Ppi)->PeiCoreFvLocation != 0)
+         ) {
+        //
+        // In this case, SecCore is in BFV but PeiCore is in another FV reported by PPI.
+        //
+        FindAndReportEntryPoints (
+          (EFI_FIRMWARE_VOLUME_HEADER *) SecCoreData->BootFirmwareVolumeBase,
+          (EFI_FIRMWARE_VOLUME_HEADER *) ((EFI_PEI_CORE_FV_LOCATION_PPI *) PpiList[Index].Ppi)->PeiCoreFvLocation,
+          &PeiCoreEntryPoint
+          );
+        if (PeiCoreEntryPoint != NULL) {
+          break;
+        } else {
+          //
+          // Invalid PeiCore FV provided by platform
+          //
+          CpuDeadLoop ();
+        }
+      }
+    } while ((PpiList[Index++].Flags & EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST) != EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST);
+  }
+  //
+  // If EFI_PEI_CORE_FV_LOCATION_PPI not found, try to locate PeiCore from BFV.
+  //
+  if (PeiCoreEntryPoint == NULL) {
+    //
+    // Both SecCore and PeiCore are in BFV.
+    //
+    FindAndReportEntryPoints (
+      (EFI_FIRMWARE_VOLUME_HEADER *) SecCoreData->BootFirmwareVolumeBase,
+      (EFI_FIRMWARE_VOLUME_HEADER *) SecCoreData->BootFirmwareVolumeBase,
+      &PeiCoreEntryPoint
+      );
+    if (PeiCoreEntryPoint == NULL) {
+      CpuDeadLoop ();
+    }
+  }
+
+  if (PpiList != NULL) {
+    AllSecPpiList = (EFI_PEI_PPI_DESCRIPTOR *) SecCoreData->PeiTemporaryRamBase;
+
+    //
+    // Remove the terminal flag from the terminal PPI
+    //
+    CopyMem (AllSecPpiList, mPeiSecPlatformInformationPpi, sizeof (mPeiSecPlatformInformationPpi));
+    Index = sizeof (mPeiSecPlatformInformationPpi) / sizeof (EFI_PEI_PPI_DESCRIPTOR) - 1;
+    AllSecPpiList[Index].Flags = AllSecPpiList[Index].Flags & (~EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST);
+
+    //
+    // Append the platform additional PPI list
+    //
+    Index += 1;
+    while (((PpiList->Flags & EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST) != EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST)) {
+      CopyMem (&AllSecPpiList[Index], PpiList, sizeof (EFI_PEI_PPI_DESCRIPTOR));
+      Index++;
+      PpiList++;
+    }
+
+    //
+    // Add the terminal PPI
+    //
+    CopyMem (&AllSecPpiList[Index ++], PpiList, sizeof (EFI_PEI_PPI_DESCRIPTOR));
+
+    //
+    // Set PpiList to the total PPI
+    //
+    PpiList = AllSecPpiList;
+
+    //
+    // Adjust PEI TEMP RAM Range.
+    //
+    ASSERT (SecCoreData->PeiTemporaryRamSize > Index * sizeof (EFI_PEI_PPI_DESCRIPTOR));
+    SecCoreData->PeiTemporaryRamBase = (VOID *)((UINTN) SecCoreData->PeiTemporaryRamBase + Index * sizeof (EFI_PEI_PPI_DESCRIPTOR));
+    SecCoreData->PeiTemporaryRamSize = SecCoreData->PeiTemporaryRamSize - Index * sizeof (EFI_PEI_PPI_DESCRIPTOR);
+    //
+    // Adjust the Base and Size to be 8-byte aligned as HOB which has 8byte aligned requirement
+    // will be built based on them in PEI phase.
+    //
+    SecCoreData->PeiTemporaryRamBase = (VOID *)(((UINTN)SecCoreData->PeiTemporaryRamBase + 7) & ~0x07);
+    SecCoreData->PeiTemporaryRamSize &= ~(UINTN)0x07;
+  } else {
+    //
+    // No addition PPI, PpiList directly point to the common PPI list.
+    //
+    PpiList = &mPeiSecPlatformInformationPpi[0];
+  }
+
+  DEBUG ((
+    DEBUG_INFO,
+    "%a() Stack Base: 0x%p, Stack Size: 0x%x\n",
+    __FUNCTION__,
+    SecCoreData->StackBase,
+    (UINT32) SecCoreData->StackSize
+    ));
+
+  //
+  // Report Status Code to indicate transferring to PEI core
+  //
+  REPORT_STATUS_CODE (
+    EFI_PROGRESS_CODE,
+    EFI_SOFTWARE_SEC | EFI_SW_SEC_PC_HANDOFF_TO_NEXT
+    );
+
+  //
+  // Transfer the control to the PEI core
+  //
+  ASSERT (PeiCoreEntryPoint != NULL);
+  (*PeiCoreEntryPoint) (SecCoreData, PpiList);
+
+  //
+  // Should not come here.
+  //
+  UNREACHABLE ();
+}
+
+/**
+  TemporaryRamDone() disables the use of Temporary RAM. If present, this service is invoked
+  by the PEI Foundation after the EFI_PEI_PERMANANT_MEMORY_INSTALLED_PPI is installed.
+
+  @retval EFI_SUCCESS           Use of Temporary RAM was disabled.
+  @retval EFI_INVALID_PARAMETER Temporary RAM could not be disabled.
+
+**/
+EFI_STATUS
+EFIAPI
+SecTemporaryRamDone (
+  VOID
+  )
+{
+  EFI_STATUS                    Status;
+  EFI_STATUS                    Status2;
+  UINTN                         Index;
+  BOOLEAN                       State;
+  EFI_PEI_PPI_DESCRIPTOR        *PeiPpiDescriptor;
+  REPUBLISH_SEC_PPI_PPI         *RepublishSecPpiPpi;
+
+  //
+  // Republish Sec Platform Information(2) PPI
+  //
+  RepublishSecPlatformInformationPpi ();
+
+  //
+  // Re-install SEC PPIs using a PEIM produced service if published
+  //
+  for (Index = 0, Status = EFI_SUCCESS; Status == EFI_SUCCESS; Index++) {
+    Status = PeiServicesLocatePpi (
+               &gRepublishSecPpiPpiGuid,
+               Index,
+               &PeiPpiDescriptor,
+               (VOID **) &RepublishSecPpiPpi
+               );
+    if (!EFI_ERROR (Status)) {
+      DEBUG ((DEBUG_INFO, "Calling RepublishSecPpi instance %d.\n", Index));
+      Status2 = RepublishSecPpiPpi->RepublishSecPpis ();
+      ASSERT_EFI_ERROR (Status2);
+    }
+  }
+
+  //
+  // Migrate DebugAgentContext.
+  //
+  InitializeDebugAgent (DEBUG_AGENT_INIT_POSTMEM_SEC, NULL, NULL);
+
+  //
+  // Disable interrupts and save current interrupt state
+  //
+  State = SaveAndDisableInterrupts ();
+
+  //
+  // Migrate GDT before NEM near down
+  //
+  if (PcdGetBool (PcdMigrateTemporaryRamFirmwareVolumes)) {
+    Status = MigrateGdt ();
+    ASSERT_EFI_ERROR (Status);
+  }
+
+  //
+  // Disable Temporary RAM after Stack and Heap have been migrated at this point.
+  //
+  SecPlatformDisableTemporaryMemory ();
+
+  //
+  // Restore original interrupt state
+  //
+  SetInterruptState (State);
+
+  return EFI_SUCCESS;
+}
diff --git a/src/VBox/Devices/EFI/Firmware/UefiCpuPkg/SecCore/SecMain.h b/src/VBox/Devices/EFI/Firmware/UefiCpuPkg/SecCore/SecMain.h
new file mode 100644
index 00000000..9b474dee
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/UefiCpuPkg/SecCore/SecMain.h
@@ -0,0 +1,180 @@
+/** @file
+  Master header file for SecCore.
+
+  Copyright (c) 2008 - 2019, Intel Corporation. All rights reserved.<BR>
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef _SEC_CORE_H_
+#define _SEC_CORE_H_
+
+#include <PiPei.h>
+
+#include <Ppi/SecPlatformInformation2.h>
+#include <Ppi/TemporaryRamDone.h>
+#include <Ppi/SecPerformance.h>
+#include <Ppi/PeiCoreFvLocation.h>
+#include <Ppi/RepublishSecPpi.h>
+
+#include <Guid/FirmwarePerformance.h>
+
+#include <Library/DebugLib.h>
+#include <Library/PcdLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/PlatformSecLib.h>
+#include <Library/UefiCpuLib.h>
+#include <Library/PeCoffGetEntryPointLib.h>
+#include <Library/PeCoffExtraActionLib.h>
+#include <Library/DebugAgentLib.h>
+#include <Library/CpuExceptionHandlerLib.h>
+#include <Library/ReportStatusCodeLib.h>
+#include <Library/PeiServicesTablePointerLib.h>
+#include <Library/HobLib.h>
+#include <Library/PeiServicesLib.h>
+
+#define SEC_IDT_ENTRY_COUNT  34
+
+typedef struct _SEC_IDT_TABLE {
+  //
+  // Reserved 8 bytes preceding IDT to store EFI_PEI_SERVICES**, since IDT base
+  // address should be 8-byte alignment.
+  // Note: For IA32, only the 4 bytes immediately preceding IDT is used to store
+  // EFI_PEI_SERVICES**
+  //
+  UINT64            PeiService;
+  UINT64            IdtTable[SEC_IDT_ENTRY_COUNT];
+} SEC_IDT_TABLE;
+
+/**
+  TemporaryRamDone() disables the use of Temporary RAM. If present, this service is invoked
+  by the PEI Foundation after the EFI_PEI_PERMANANT_MEMORY_INSTALLED_PPI is installed.
+
+  @retval EFI_SUCCESS           Use of Temporary RAM was disabled.
+  @retval EFI_INVALID_PARAMETER Temporary RAM could not be disabled.
+
+**/
+EFI_STATUS
+EFIAPI
+SecTemporaryRamDone (
+  VOID
+  );
+
+/**
+  Entry point to the C language phase of SEC. After the SEC assembly
+  code has initialized some temporary memory and set up the stack,
+  the control is transferred to this function.
+
+  @param SizeOfRam           Size of the temporary memory available for use.
+  @param TempRamBase         Base address of temporary ram
+  @param BootFirmwareVolume  Base address of the Boot Firmware Volume.
+**/
+VOID
+NORETURN
+EFIAPI
+SecStartup (
+  IN UINT32                   SizeOfRam,
+  IN UINT32                   TempRamBase,
+  IN VOID                     *BootFirmwareVolume
+  );
+
+/**
+  Find and return Pei Core entry point.
+
+  It also find SEC and PEI Core file debug information. It will report them if
+  remote debug is enabled.
+
+  @param   SecCoreFirmwareVolumePtr Point to the firmware volume for finding SecCore.
+  @param   PeiCoreFirmwareVolumePtr Point to the firmware volume for finding PeiCore.
+  @param   PeiCoreEntryPoint        The entry point of the PEI core.
+
+**/
+VOID
+EFIAPI
+FindAndReportEntryPoints (
+  IN  EFI_FIRMWARE_VOLUME_HEADER       *SecCoreFirmwareVolumePtr,
+  IN  EFI_FIRMWARE_VOLUME_HEADER       *PeiCoreFirmwareVolumePtr,
+  OUT EFI_PEI_CORE_ENTRY_POINT         *PeiCoreEntryPoint
+  );
+
+/**
+  Auto-generated function that calls the library constructors for all of the module's
+  dependent libraries.  This function must be called by the SEC Core once a stack has
+  been established.
+
+**/
+VOID
+EFIAPI
+ProcessLibraryConstructorList (
+  VOID
+  );
+
+/**
+  Implementation of the PlatformInformation service in EFI_SEC_PLATFORM_INFORMATION_PPI.
+
+  @param  PeiServices                Pointer to the PEI Services Table.
+  @param  StructureSize              Pointer to the variable describing size of the input buffer.
+  @param  PlatformInformationRecord  Pointer to the EFI_SEC_PLATFORM_INFORMATION_RECORD.
+
+  @retval EFI_SUCCESS                The data was successfully returned.
+  @retval EFI_BUFFER_TOO_SMALL       The buffer was too small.
+
+**/
+EFI_STATUS
+EFIAPI
+SecPlatformInformationBist (
+  IN CONST EFI_PEI_SERVICES                  **PeiServices,
+  IN OUT UINT64                              *StructureSize,
+     OUT EFI_SEC_PLATFORM_INFORMATION_RECORD *PlatformInformationRecord
+  );
+
+/**
+  Implementation of the PlatformInformation2 service in EFI_SEC_PLATFORM_INFORMATION2_PPI.
+
+  @param  PeiServices                The pointer to the PEI Services Table.
+  @param  StructureSize              The pointer to the variable describing size of the input buffer.
+  @param  PlatformInformationRecord2 The pointer to the EFI_SEC_PLATFORM_INFORMATION_RECORD2.
+
+  @retval EFI_SUCCESS                The data was successfully returned.
+  @retval EFI_BUFFER_TOO_SMALL       The buffer was too small. The current buffer size needed to
+                                     hold the record is returned in StructureSize.
+
+**/
+EFI_STATUS
+EFIAPI
+SecPlatformInformation2Bist (
+  IN CONST EFI_PEI_SERVICES                   **PeiServices,
+  IN OUT UINT64                               *StructureSize,
+     OUT EFI_SEC_PLATFORM_INFORMATION_RECORD2 *PlatformInformationRecord2
+  );
+
+/**
+  Republish SecPlatformInformationPpi/SecPlatformInformation2Ppi.
+
+**/
+VOID
+RepublishSecPlatformInformationPpi (
+  VOID
+  );
+
+/**
+  Entry point of the notification callback function itself within the PEIM.
+  It is to get SEC performance data and build HOB to convey the SEC performance
+  data to DXE phase.
+
+  @param  PeiServices      Indirect reference to the PEI Services Table.
+  @param  NotifyDescriptor Address of the notification descriptor data structure.
+  @param  Ppi              Address of the PPI that was installed.
+
+  @return Status of the notification.
+          The status code returned from this function is ignored.
+**/
+EFI_STATUS
+EFIAPI
+SecPerformancePpiCallBack (
+  IN EFI_PEI_SERVICES           **PeiServices,
+  IN EFI_PEI_NOTIFY_DESCRIPTOR  *NotifyDescriptor,
+  IN VOID                       *Ppi
+  );
+
+#endif