9 files changed, 96 insertions, 25 deletions
diff --git a/src/include/ipxe/efi/Pi/PiBootMode.h b/src/include/ipxe/efi/Pi/PiBootMode.h
index 1d8a8a9af..9451c8cbe 100644
--- a/src/include/ipxe/efi/Pi/PiBootMode.h
+++ b/src/include/ipxe/efi/Pi/PiBootMode.h
@@ -13,6 +13,7 @@
 #define __PI_BOOT_MODE_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 ///
 /// EFI boot mode
diff --git a/src/include/ipxe/efi/Pi/PiDependency.h b/src/include/ipxe/efi/Pi/PiDependency.h
index bfe30c430..8c9ffc40b 100644
--- a/src/include/ipxe/efi/Pi/PiDependency.h
+++ b/src/include/ipxe/efi/Pi/PiDependency.h
@@ -13,6 +13,7 @@
 #define __PI_DEPENDENCY_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 ///
 /// If present, this must be the first and only opcode,
diff --git a/src/include/ipxe/efi/Pi/PiDxeCis.h b/src/include/ipxe/efi/Pi/PiDxeCis.h
index 9b9254936..b501b053f 100644
--- a/src/include/ipxe/efi/Pi/PiDxeCis.h
+++ b/src/include/ipxe/efi/Pi/PiDxeCis.h
@@ -5,7 +5,7 @@ Copyright (c) 2006 - 2018, Intel Corporation. All rights reserved.<BR>
 SPDX-License-Identifier: BSD-2-Clause-Patent
 
   @par Revision Reference:
-  PI Version 1.7
+  PI Version 1.8.A
 
 **/
 
@@ -13,6 +13,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __PI_DXECIS_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Uefi/UefiMultiPhase.h>
 #include <ipxe/efi/Pi/PiMultiPhase.h>
@@ -58,14 +59,11 @@ typedef enum {
   /// system. If all memory has the same reliability, then this bit is not used.
   ///
   EfiGcdMemoryTypeMoreReliable,
-  // ///
-  // /// A memory region that describes system memory that has not been accepted
-  // /// by a corresponding call to the underlying isolation architecture.
-  // ///
-  // /// Please be noted:
-  // /// EfiGcdMemoryTypeUnaccepted is defined in PrePiDxeCis.h because it has not been
-  // /// defined in PI spec.
-  // EfiGcdMemoryTypeUnaccepted,
+  ///
+  /// A memory region that describes system memory that has not been accepted
+  /// by a corresponding call to the underlying isolation architecture.
+  ///
+  EfiGcdMemoryTypeUnaccepted,
   EfiGcdMemoryTypeMaximum = 7
 } EFI_GCD_MEMORY_TYPE;
 
@@ -696,8 +694,8 @@ EFI_STATUS
 // DXE Services Table
 //
 #define DXE_SERVICES_SIGNATURE            0x565245535f455844ULL
-#define DXE_SPECIFICATION_MAJOR_REVISION  1
-#define DXE_SPECIFICATION_MINOR_REVISION  70
+#define DXE_SPECIFICATION_MAJOR_REVISION  PI_SPECIFICATION_MAJOR_REVISION
+#define DXE_SPECIFICATION_MINOR_REVISION  PI_SPECIFICATION_MINOR_REVISION
 #define DXE_SERVICES_REVISION             ((DXE_SPECIFICATION_MAJOR_REVISION<<16) | (DXE_SPECIFICATION_MINOR_REVISION))
 
 typedef struct {
diff --git a/src/include/ipxe/efi/Pi/PiFirmwareFile.h b/src/include/ipxe/efi/Pi/PiFirmwareFile.h
index daf66f8a2..f81070bb0 100644
--- a/src/include/ipxe/efi/Pi/PiFirmwareFile.h
+++ b/src/include/ipxe/efi/Pi/PiFirmwareFile.h
@@ -13,6 +13,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __PI_FIRMWARE_FILE_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #pragma pack(1)
 ///
diff --git a/src/include/ipxe/efi/Pi/PiFirmwareVolume.h b/src/include/ipxe/efi/Pi/PiFirmwareVolume.h
index f46134fee..c67f70dcb 100644
--- a/src/include/ipxe/efi/Pi/PiFirmwareVolume.h
+++ b/src/include/ipxe/efi/Pi/PiFirmwareVolume.h
@@ -13,6 +13,7 @@
 #define __PI_FIRMWAREVOLUME_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 ///
 /// EFI_FV_FILE_ATTRIBUTES
diff --git a/src/include/ipxe/efi/Pi/PiHob.h b/src/include/ipxe/efi/Pi/PiHob.h
index 5ecdf321f..4a98e2645 100644
--- a/src/include/ipxe/efi/Pi/PiHob.h
+++ b/src/include/ipxe/efi/Pi/PiHob.h
@@ -5,7 +5,7 @@ Copyright (c) 2006 - 2017, Intel Corporation. All rights reserved.<BR>
 SPDX-License-Identifier: BSD-2-Clause-Patent
 
   @par Revision Reference:
-  PI Version 1.6
+  PI Version 1.9
 
 **/
 
@@ -13,6 +13,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __PI_HOB_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 //
 // HobType of EFI_HOB_GENERIC_HEADER.
@@ -234,16 +235,8 @@ typedef UINT32 EFI_RESOURCE_TYPE;
 #define EFI_RESOURCE_MEMORY_MAPPED_IO_PORT  0x00000004
 #define EFI_RESOURCE_MEMORY_RESERVED        0x00000005
 #define EFI_RESOURCE_IO_RESERVED            0x00000006
-//
-// BZ3937_EFI_RESOURCE_MEMORY_UNACCEPTED is defined for unaccepted memory.
-// But this defitinion has not been officially in the PI spec. Base
-// on the code-first we define BZ3937_EFI_RESOURCE_MEMORY_UNACCEPTED at
-// MdeModulePkg/Include/Pi/PrePiHob.h and update EFI_RESOURCE_MAX_MEMORY_TYPE
-// to 8. After BZ3937_EFI_RESOURCE_MEMORY_UNACCEPTED is officially published
-// in PI spec, we will re-visit here.
-//
-// #define BZ3937_EFI_RESOURCE_MEMORY_UNACCEPTED      0x00000007
-#define EFI_RESOURCE_MAX_MEMORY_TYPE  0x00000008
+#define EFI_RESOURCE_MEMORY_UNACCEPTED      0x00000007
+#define EFI_RESOURCE_MAX_MEMORY_TYPE        0x00000008
 
 ///
 /// A type of recount attribute type.
@@ -299,6 +292,9 @@ typedef UINT32 EFI_RESOURCE_ATTRIBUTE_TYPE;
 #define EFI_RESOURCE_ATTRIBUTE_READ_ONLY_PROTECTED    0x00040000
 #define EFI_RESOURCE_ATTRIBUTE_READ_ONLY_PROTECTABLE  0x00080000
 
+#define EFI_RESOURCE_ATTRIBUTE_ENCRYPTED        0x04000000
+#define EFI_RESOURCE_ATTRIBUTE_SPECIAL_PURPOSE  0x08000000
+#define EFI_RESOURCE_ATTRIBUTE_HOT_PLUGGABLE    0x10000000
 //
 // Physical memory relative reliability attribute. This
 // memory provides higher reliability relative to other
diff --git a/src/include/ipxe/efi/Pi/PiMultiPhase.h b/src/include/ipxe/efi/Pi/PiMultiPhase.h
index e631821ca..f5ee07068 100644
--- a/src/include/ipxe/efi/Pi/PiMultiPhase.h
+++ b/src/include/ipxe/efi/Pi/PiMultiPhase.h
@@ -5,7 +5,7 @@ Copyright (c) 2006 - 2018, Intel Corporation. All rights reserved.<BR>
 SPDX-License-Identifier: BSD-2-Clause-Patent
 
   @par Revision Reference:
-  These elements are defined in UEFI Platform Initialization Specification 1.2.
+  These elements are defined in UEFI Platform Initialization Specification 1.8.A
 
 **/
 
@@ -13,6 +13,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __PI_MULTIPHASE_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Pi/PiFirmwareVolume.h>
 #include <ipxe/efi/Pi/PiFirmwareFile.h>
@@ -22,6 +23,13 @@ FILE_LICENCE ( BSD2_PATENT );
 #include <ipxe/efi/Pi/PiStatusCode.h>
 #include <ipxe/efi/Pi/PiS3BootScript.h>
 
+//
+// PI Specification Version Information
+//
+#define PI_SPECIFICATION_MAJOR_REVISION  1
+#define PI_SPECIFICATION_MINOR_REVISION  80
+#define PI_SPECIFICATION_VERSION         ((PI_SPECIFICATION_MAJOR_REVISION << 16) | (PI_SPECIFICATION_MINOR_REVISION))
+
 /**
   Produces an error code in the range reserved for use by the Platform Initialization
   Architecture Specification.
@@ -106,6 +114,14 @@ FILE_LICENCE ( BSD2_PATENT );
 #define EFI_SMRAM_LOCKED  EFI_MMRAM_LOCKED
 
 ///
+/// MM Communicate header constants
+///
+#define COMMUNICATE_HEADER_V3_GUID \
+  { \
+    0x68e8c853, 0x2ba9, 0x4dd7, { 0x9a, 0xc0, 0x91, 0xe1, 0x61, 0x55, 0xc9, 0x35 } \
+  }
+
+///
 /// Structure describing a MMRAM region and its accessibility attributes.
 ///
 typedef struct {
@@ -151,6 +167,47 @@ typedef struct _EFI_MM_RESERVED_MMRAM_REGION {
   UINT64                  MmramReservedSize;
 } EFI_MM_RESERVED_MMRAM_REGION;
 
+#pragma pack(1)
+
+///
+/// To avoid confusion in interpreting frames, the buffer communicating to MM core through
+/// EFI_MM_COMMUNICATE3 or later should always start with EFI_MM_COMMUNICATE_HEADER_V3.
+///
+typedef struct {
+  ///
+  /// Indicator GUID for MM core that the communication buffer is compliant with this v3 header.
+  /// Must be gEfiMmCommunicateHeaderV3Guid.
+  ///
+  EFI_GUID    HeaderGuid;
+  ///
+  /// Describes the size of the entire buffer (in bytes) available for communication, including this communication header.
+  ///
+  UINT64      BufferSize;
+  ///
+  /// Reserved for future use.
+  ///
+  UINT64      Reserved;
+  ///
+  /// Allows for disambiguation of the message format.
+  ///
+  EFI_GUID    MessageGuid;
+  ///
+  /// Describes the size of MessageData (in bytes) and does not include the size of the header.
+  ///
+  UINT64      MessageSize;
+  ///
+  /// Designates an array of bytes that is MessageSize in size.
+  ///
+  UINT8       MessageData[];
+} EFI_MM_COMMUNICATE_HEADER_V3;
+
+#pragma pack()
+
+STATIC_ASSERT (
+  (sizeof (EFI_MM_COMMUNICATE_HEADER_V3) == OFFSET_OF (EFI_MM_COMMUNICATE_HEADER_V3, MessageData)), \
+  "sizeof (EFI_MM_COMMUNICATE_HEADER_V3) does not align with the beginning of flexible array MessageData"
+  );
+
 typedef enum {
   EFI_PCD_TYPE_8,
   EFI_PCD_TYPE_16,
@@ -210,4 +267,6 @@ EFI_STATUS
   IN VOID  *ProcedureArgument
   );
 
+extern EFI_GUID  gEfiMmCommunicateHeaderV3Guid;
+
 #endif
diff --git a/src/include/ipxe/efi/Pi/PiS3BootScript.h b/src/include/ipxe/efi/Pi/PiS3BootScript.h
index f016e1245..e7086a565 100644
--- a/src/include/ipxe/efi/Pi/PiS3BootScript.h
+++ b/src/include/ipxe/efi/Pi/PiS3BootScript.h
@@ -1,5 +1,5 @@
 /** @file
-  This file contains the boot script defintions that are shared between the
+  This file contains the boot script definitions that are shared between the
   Boot Script Executor PPI and the Boot Script Save Protocol.
 
   Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
@@ -11,6 +11,7 @@
 #define _PI_S3_BOOT_SCRIPT_H_
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 // *******************************************
 // EFI Boot Script Opcode definitions
diff --git a/src/include/ipxe/efi/Pi/PiStatusCode.h b/src/include/ipxe/efi/Pi/PiStatusCode.h
index 427e5061d..6015cabb2 100644
--- a/src/include/ipxe/efi/Pi/PiStatusCode.h
+++ b/src/include/ipxe/efi/Pi/PiStatusCode.h
@@ -2,6 +2,7 @@
   StatusCode related definitions in PI.
 
 Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2024, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 SPDX-License-Identifier: BSD-2-Clause-Patent
 
   @par Revision Reference:
@@ -14,9 +15,10 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __PI_STATUS_CODE_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 //
-// Required for IA32, X64, IPF, ARM and EBC defines for CPU exception types
+// Required for IA32, X64, IPF, and EBC defines for CPU exception types
 //
 #include <ipxe/efi/Protocol/DebugSupport.h>
 
@@ -142,6 +144,7 @@ typedef struct {
 #define EFI_COMPUTING_UNIT_CACHE               (EFI_COMPUTING_UNIT | 0x00040000)
 #define EFI_COMPUTING_UNIT_MEMORY              (EFI_COMPUTING_UNIT | 0x00050000)
 #define EFI_COMPUTING_UNIT_CHIPSET             (EFI_COMPUTING_UNIT | 0x00060000)
+#define EFI_COMPUTING_UNIT_MANAGEABILITY       (EFI_COMPUTING_UNIT | 0x00070000)
 ///@}
 
 ///
@@ -346,6 +349,16 @@ typedef struct {
 ///@}
 
 ///
+/// Computing Unit Manageability Subclass Error Code definitions.
+/// The detail information is reported by REPORT_STATUS_CODE_WITH_EXTENDED_DATA
+//  with ASCII string in EFI_STATUS_CODE_STRING_DATA.
+///@{
+#define EFI_MANAGEABILITY_EC_REDFISH_COMMUNICATION_ERROR         (EFI_SUBCLASS_SPECIFIC | 0x00000000)
+#define EFI_MANAGEABILITY_EC_REDFISH_HOST_INTERFACE_ERROR        (EFI_SUBCLASS_SPECIFIC | 0x00000001)
+#define EFI_MANAGEABILITY_EC_REDFISH_BOOTSTRAP_CREDENTIAL_ERROR  (EFI_SUBCLASS_SPECIFIC | 0x00000002)
+///@}
+
+///
 /// Peripheral Subclass definitions.
 /// Values of 12-127 are reserved for future use by this specification.
 /// Values of 128-255 are reserved for OEM use.