Where is the legacy BIOS (the 16 bit reset code that jumps to the POST entry point at F000:E05B and indeed POST itself and all the BIOS routines) originally stored on a UEFI system before it's shadowed to 0xF0000? And the embedded option ROMs before they're shadowed to 0xC0000? And what shadows the legacy BIOS to 0xF000: ME, the Startup ACM, SEC or the legacy BIOS itself?
It doesn't appear to be in the SPI flash BIOS region (I've searched byte sequences in the dump on IDA). I thought it might be on the LPC or EC flash but my laptop doesn't appear to have one (and neither does my flash descriptor show an EC region so don't ask me where the EC ROM is stored either, but it's supposed to be on the SPI flash, and the schematic doesn't appear to show it having a private SPI flash, but it must do; maybe that's where the legacy BIOS is?); plus it looks like you can only configure the PCH to send all BIOS ranges to either LPC/eSPI or SPI and not 0xF0000 to one and 0xFFFF0000 to another. My laptop is booted into legacy BIOS and has EA at 0xFFFF0 (so obviously a legacy BIOS shadow) and 90 90 E9 at 0xFFFFFFF0. I can't find anything on this and I've been searching all sorts of combinations on verbatim search for hours, hundreds of manuals, UEFI papers, specifications, and not one mentions it.