diff --git a/MdeModulePkg/Core/Dxe/DxeMain.h b/MdeModulePkg/Core/Dxe/DxeMain.h
index 76ca0513cd..94af660bca 100644
--- a/MdeModulePkg/Core/Dxe/DxeMain.h
+++ b/MdeModulePkg/Core/Dxe/DxeMain.h
@@ -2737,6 +2737,7 @@ EFI_STATUS
 EFIAPI
 CallBootService (
   IN UINT8  Type,
+  IN UINT8  NumberOfArguments,
   IN UINTN  *UserArguments,
   IN UINTN  ReturnSP
   );
diff --git a/MdeModulePkg/Core/Dxe/DxeRing3/AARCH64/SysCall.S b/MdeModulePkg/Core/Dxe/DxeRing3/AARCH64/SysCall.S
index 7ed039d821..4a63ec87e1 100644
--- a/MdeModulePkg/Core/Dxe/DxeRing3/AARCH64/SysCall.S
+++ b/MdeModulePkg/Core/Dxe/DxeRing3/AARCH64/SysCall.S
@@ -11,7 +11,8 @@
 // EFI_STATUS
 // EFIAPI
 // SysCall (
-//   IN  UINT8  Type,
+//   IN UINT8  Type,
+//   IN UINT8  NumberOfArguments,
 //   ...
 //   );
 //------------------------------------------------------------------------------
diff --git a/MdeModulePkg/Core/Dxe/DxeRing3/ARM/SysCall.S b/MdeModulePkg/Core/Dxe/DxeRing3/ARM/SysCall.S
index 2f0495f31f..2a0a28e32f 100644
--- a/MdeModulePkg/Core/Dxe/DxeRing3/ARM/SysCall.S
+++ b/MdeModulePkg/Core/Dxe/DxeRing3/ARM/SysCall.S
@@ -11,7 +11,8 @@
 // EFI_STATUS
 // EFIAPI
 // SysCall (
-//   IN  UINT8  Type,
+//   IN UINT8  Type,
+//   IN UINT8  NumberOfArguments,
 //   ...
 //   );
 //------------------------------------------------------------------------------
diff --git a/MdeModulePkg/Core/Dxe/DxeRing3/DxeRing3.c b/MdeModulePkg/Core/Dxe/DxeRing3/DxeRing3.c
index 3afb8f37e4..b024fb5aac 100644
--- a/MdeModulePkg/Core/Dxe/DxeRing3/DxeRing3.c
+++ b/MdeModulePkg/Core/Dxe/DxeRing3/DxeRing3.c
@@ -238,7 +238,7 @@ Ring3Call (
       break;
   }
 
-  SysCall (SysCallReturnToCore, Status);
+  SysCall (SysCallReturnToCore, 1, Status);
 }
 
 EFI_STATUS
diff --git a/MdeModulePkg/Core/Dxe/DxeRing3/IA32/SysCall.nasm b/MdeModulePkg/Core/Dxe/DxeRing3/IA32/SysCall.nasm
index 40e22ef83e..7b6ff6d1c4 100644
--- a/MdeModulePkg/Core/Dxe/DxeRing3/IA32/SysCall.nasm
+++ b/MdeModulePkg/Core/Dxe/DxeRing3/IA32/SysCall.nasm
@@ -3,6 +3,8 @@
 ; SPDX-License-Identifier: BSD-3-Clause
 ;------------------------------------------------------------------------------
 
+#include <Uefi/UefiSpec.h>
+
 extern ASM_PFX(Ring3Call)
 
 DEFAULT REL
@@ -12,18 +14,36 @@ SECTION .text
 ; EFI_STATUS
 ; EFIAPI
 ; SysCall (
-;   IN  UINT8  Type,
+;   IN UINT8  Type,
+;   IN UINT8  NumberOfArguments,
 ;   ...
 ;   );
 ;------------------------------------------------------------------------------
 global ASM_PFX(SysCall)
 ASM_PFX(SysCall):
+  push    ebx
   mov     edx, esp
-  mov     ecx, [esp + 4] ; Type
+  mov     ecx, [esp + 4*2] ; Type
+  mov     ebx, [esp + 4*3] ; NumberOfArguments
   lea     eax, [userReturnAddress]
-
+  ; Fixup NumberOfArguments.
+  cmp     ecx, SC_FREE_PAGES
+  je      fixup
+  cmp     ecx, SC_BLOCK_IO_READ
+  je      fixup
+  cmp     ecx, SC_BLOCK_IO_WRITE
+  je      fixup
+  cmp     ecx, SC_DISK_IO_READ
+  je      fixup
+  cmp     ecx, SC_DISK_IO_WRITE
+  je      fixup
+  jmp     makecall
+fixup:
+  add     ebx, 1
+makecall:
   sysenter
 userReturnAddress:
+  pop     ebx
   ret
 
 ;------------------------------------------------------------------------------
diff --git a/MdeModulePkg/Core/Dxe/DxeRing3/Ring3.h b/MdeModulePkg/Core/Dxe/DxeRing3/Ring3.h
index a2d5e6416d..44c1938344 100644
--- a/MdeModulePkg/Core/Dxe/DxeRing3/Ring3.h
+++ b/MdeModulePkg/Core/Dxe/DxeRing3/Ring3.h
@@ -14,7 +14,8 @@
 EFI_STATUS
 EFIAPI
 SysCall (
-  IN  UINT8  Type,
+  IN UINT8  Type,
+  IN UINT8  NumberOfArguments,
   ...
   );
 
diff --git a/MdeModulePkg/Core/Dxe/DxeRing3/Ring3Protocols.c b/MdeModulePkg/Core/Dxe/DxeRing3/Ring3Protocols.c
index 7c01109a3e..7b7efeb12f 100644
--- a/MdeModulePkg/Core/Dxe/DxeRing3/Ring3Protocols.c
+++ b/MdeModulePkg/Core/Dxe/DxeRing3/Ring3Protocols.c
@@ -16,6 +16,7 @@ Ring3BlockIoReset (
 {
   return SysCall (
            SysCallBlockIoReset,
+           2,
            This,
            ExtendedVerification
            );
@@ -33,6 +34,7 @@ Ring3BlockIoRead (
 {
   return SysCall (
            SysCallBlockIoRead,
+           5,
            This,
            MediaId,
            BufferSize,
@@ -53,6 +55,7 @@ Ring3BlockIoWrite (
 {
   return SysCall (
            SysCallBlockIoWrite,
+           5,
            This,
            MediaId,
            BufferSize,
@@ -69,6 +72,7 @@ Ring3BlockIoFlush (
 {
   return SysCall (
            SysCallBlockIoFlush,
+           1,
            This
            );
 }
@@ -85,6 +89,7 @@ Ring3DiskIoRead (
 {
   return SysCall (
            SysCallDiskIoRead,
+           5,
            This,
            MediaId,
            BufferSize,
@@ -105,6 +110,7 @@ Ring3DiskIoWrite (
 {
   return SysCall (
            SysCallDiskIoWrite,
+           5,
            This,
            MediaId,
            BufferSize,
@@ -123,6 +129,7 @@ Ring3UnicodeStriColl (
 {
   return (INTN)SysCall (
                  SysCallUnicodeStriColl,
+                 3,
                  This,
                  Str1,
                  Str2
@@ -139,6 +146,7 @@ Ring3UnicodeMetaiMatch (
 {
   return (BOOLEAN)SysCall (
                     SysCallUnicodeMetaiMatch,
+                    3,
                     This,
                     String,
                     Pattern
@@ -154,6 +162,7 @@ Ring3UnicodeStrLwr (
 {
   SysCall (
     SysCallUnicodeStrLwr,
+    2,
     This,
     Str
     );
@@ -168,6 +177,7 @@ Ring3UnicodeStrUpr (
 {
   SysCall (
     SysCallUnicodeStrUpr,
+    2,
     This,
     Str
     );
@@ -184,6 +194,7 @@ Ring3UnicodeFatToStr (
 {
   SysCall (
     SysCallUnicodeFatToStr,
+    4,
     This,
     FatSize,
     Fat,
@@ -202,6 +213,7 @@ Ring3UnicodeStrToFat (
 {
   return (BOOLEAN)SysCall (
                     SysCallUnicodeStrToFat,
+                    4,
                     This,
                     String,
                     FatSize,
diff --git a/MdeModulePkg/Core/Dxe/DxeRing3/Ring3UefiBootServices.c b/MdeModulePkg/Core/Dxe/DxeRing3/Ring3UefiBootServices.c
index cc62ba4f61..04ccc7b669 100644
--- a/MdeModulePkg/Core/Dxe/DxeRing3/Ring3UefiBootServices.c
+++ b/MdeModulePkg/Core/Dxe/DxeRing3/Ring3UefiBootServices.c
@@ -98,6 +98,7 @@ Ring3RaiseTpl (
 {
   return (EFI_TPL)SysCall (
                     SysCallRaiseTpl,
+                    1,
                     NewTpl
                     );
 }
@@ -110,6 +111,7 @@ Ring3RestoreTpl (
 {
   SysCall (
     SysCallRestoreTpl,
+    1,
     NewTpl
     );
 }
@@ -127,6 +129,7 @@ Ring3AllocatePages (
 
   Status = SysCall (
              SysCallAllocatePages,
+             4,
              Type,
              EfiRing3MemoryType,
              NumberOfPages,
@@ -150,6 +153,7 @@ Ring3FreePages (
 
   Status = SysCall (
              SysCallFreePages,
+             2,
              NumberOfPages,
              Memory
              );
@@ -302,6 +306,7 @@ Ring3HandleProtocol (
 
   Status = SysCall (
              SysCallHandleProtocol,
+             3,
              CoreUserHandle,
              Protocol,
              Interface
@@ -511,6 +516,7 @@ Ring3OpenProtocol (
 
   Status = SysCall (
              SysCallOpenProtocol,
+             6,
              CoreUserHandle,
              Protocol,
              Interface,
@@ -536,6 +542,7 @@ Ring3CloseProtocol (
 {
   return SysCall (
            SysCallCloseProtocol,
+           4,
            UserHandle,
            Protocol,
            AgentHandle,
@@ -587,6 +594,7 @@ Ring3LocateHandleBuffer (
 
   StatusBS = SysCall (
                SysCallLocateHandleBuffer,
+               5,
                SearchType,
                Protocol,
                SearchKey,
@@ -631,6 +639,7 @@ Ring3LocateProtocol (
 
   Status = SysCall (
              SysCallLocateProtocol,
+             3,
              Protocol,
              CoreRegistration,
              Interface
@@ -673,6 +682,7 @@ Ring3InstallMultipleProtocolInterfaces (
 
   return SysCall (
            SysCallInstallMultipleProtocolInterfaces,
+           2,
            Handle,
            ArgList
            );
@@ -700,6 +710,7 @@ Ring3CalculateCrc32 (
 {
   return SysCall (
            SysCallCalculateCrc32,
+           3,
            Data,
            DataSize,
            Crc32
diff --git a/MdeModulePkg/Core/Dxe/DxeRing3/Ring3UefiRuntimeServices.c b/MdeModulePkg/Core/Dxe/DxeRing3/Ring3UefiRuntimeServices.c
index e4e9af3299..ed888b9b37 100644
--- a/MdeModulePkg/Core/Dxe/DxeRing3/Ring3UefiRuntimeServices.c
+++ b/MdeModulePkg/Core/Dxe/DxeRing3/Ring3UefiRuntimeServices.c
@@ -91,6 +91,7 @@ Ring3GetVariable (
 {
   return SysCall (
            SysCallGetVariable,
+           5,
            VariableName,
            VendorGuid,
            Attributes,
diff --git a/MdeModulePkg/Core/Dxe/DxeRing3/X64/SysCall.nasm b/MdeModulePkg/Core/Dxe/DxeRing3/X64/SysCall.nasm
index d9c3d1162d..6d82942e48 100644
--- a/MdeModulePkg/Core/Dxe/DxeRing3/X64/SysCall.nasm
+++ b/MdeModulePkg/Core/Dxe/DxeRing3/X64/SysCall.nasm
@@ -12,7 +12,8 @@ SECTION .text
 ; EFI_STATUS
 ; EFIAPI
 ; SysCall (
-;   IN  UINT8  Type,
+;   IN UINT8  Type,
+;   IN UINT8  NumberOfArguments,
 ;   ...
 ;   );
 ;------------------------------------------------------------------------------
@@ -20,7 +21,21 @@ global ASM_PFX(SysCall)
 ASM_PFX(SysCall):
   ; Save Type for CoreBootServices().
   mov     r10, rcx
-
+  ; Construct User Arguments[].
+  cmp     rdx, 2
+  jg      continue
+  push    r9
+  push    r8
+  mov     r8, rsp
+  sub     r8, 8
+  add     rsp, 8*2
+  jmp     makecall
+continue:
+  mov     [rsp + 8*4], r9
+  mov     [rsp + 8*3], r8
+  mov     r8, rsp
+  add     r8, 8*2
+makecall:
   ; SYSCALL saves RFLAGS into R11 and the RIP of the next instruction into RCX.
   syscall
   ; SYSRET copies the value in RCX into RIP and loads RFLAGS from R11.
diff --git a/MdeModulePkg/Core/Dxe/SysCall/AARCH64/InitializeAARCH64.c b/MdeModulePkg/Core/Dxe/SysCall/AARCH64/InitializeAARCH64.c
index fbc5581d81..eef01bd07d 100644
--- a/MdeModulePkg/Core/Dxe/SysCall/AARCH64/InitializeAARCH64.c
+++ b/MdeModulePkg/Core/Dxe/SysCall/AARCH64/InitializeAARCH64.c
@@ -39,7 +39,7 @@ SysCallBootService (
   Status = CoreAllocatePages (
              AllocateAnyPages,
              EfiRing3MemoryType,
-             EFI_SIZE_TO_PAGES (8 * sizeof (UINTN)),
+             EFI_SIZE_TO_PAGES (7 * sizeof (UINTN)),
              &Physical
              );
   if (EFI_ERROR (Status)) {
@@ -47,16 +47,17 @@ SysCallBootService (
   }
 
   AllowSupervisorAccessToUserMemory ();
-  CopyMem ((VOID *)Physical, (VOID *)&(Context.SystemContextAArch64->X0), 8 * sizeof (UINTN));
+  CopyMem ((VOID *)Physical, (VOID *)&(Context.SystemContextAArch64->X1), 7 * sizeof (UINTN));
   ForbidSupervisorAccessToUserMemory ();
 
   Status = CallBootService (
              Context.SystemContextAArch64->X0,
+             Context.SystemContextAArch64->X1,
              (UINTN *)Physical,
              *(UINTN *)Context.SystemContextAArch64->SP
              );
 
-  CoreFreePages (Physical, EFI_SIZE_TO_PAGES (9 * sizeof (UINTN)));
+  CoreFreePages (Physical, EFI_SIZE_TO_PAGES (7 * sizeof (UINTN)));
 
   ArmDisableInterrupts ();
 
diff --git a/MdeModulePkg/Core/Dxe/SysCall/ARM/InitializeARM.c b/MdeModulePkg/Core/Dxe/SysCall/ARM/InitializeARM.c
index 498037385b..2ede13fe8c 100644
--- a/MdeModulePkg/Core/Dxe/SysCall/ARM/InitializeARM.c
+++ b/MdeModulePkg/Core/Dxe/SysCall/ARM/InitializeARM.c
@@ -32,13 +32,26 @@ SysCallBootService (
 {
   EFI_STATUS              Status;
   EFI_PHYSICAL_ADDRESS    Physical;
+  UINT8                   Type;
+  UINT8                   NumberOfArguments;
 
   ArmEnableInterrupts ();
 
+  Type              = Context.SystemContextArm->R0;
+  NumberOfArguments = Context.SystemContextArm->R1;
+
+  if ((Type == SysCallFreePages)
+    || (Type == SysCallBlockIoRead)
+    || (Type == SysCallBlockIoWrite)
+    || (Type == SysCallDiskIoRead)
+    || (Type == SysCallDiskIoWrite)) {
+    ++NumberOfArguments;
+  }
+
   Status = CoreAllocatePages (
              AllocateAnyPages,
              EfiRing3MemoryType,
-             EFI_SIZE_TO_PAGES (8 * sizeof (UINTN)),
+             EFI_SIZE_TO_PAGES ((NumberOfArguments + 1) * sizeof (UINTN)),
              &Physical
              );
   if (EFI_ERROR (Status)) {
@@ -46,25 +59,47 @@ SysCallBootService (
   }
 
   AllowSupervisorAccessToUserMemory ();
-  //
-  // First 3 arguments are passed through R1-R3 and copied to SysCall Stack.
-  //
-  CopyMem ((VOID *)(UINTN)Physical, (VOID *)&(Context.SystemContextArm->R0), 4 * sizeof (UINTN));
-  //
-  // All remaining arguments are on User Stack.
-  //
-  CopyMem ((VOID *)((UINTN)Physical + 4 * sizeof (UINTN)), (VOID *)Context.SystemContextArm->SP, 4 * sizeof (UINTN));
+  if (Type == SysCallFreePages) {
+    //
+    // R0 == Type, R1 == NumberOfArguments, R2 == NumberOfPages, R3 == NULL
+    // [SP] == Memory
+    // Memory is passed as 2 words on stack and aligned on 8 bytes.
+    //
+    CopyMem ((VOID *)(UINTN)Physical, (VOID *)&(Context.SystemContextArm->R1), 2 * sizeof (UINTN));
+    CopyMem (
+      (VOID *)((UINTN)Physical + 2 * sizeof (UINTN)),
+      (VOID *)Context.SystemContextArm->SP,
+      2 * sizeof (UINTN)
+      );
+  } else {
+    //
+    // First 2 arguments are passed through R2-R3 and copied to SysCall Stack.
+    //
+    CopyMem ((VOID *)(UINTN)Physical, (VOID *)&(Context.SystemContextArm->R1), 3 * sizeof (UINTN));
+
+    if (NumberOfArguments > 2) {
+      //
+      // All remaining arguments are on User Stack.
+      //
+      CopyMem (
+        (VOID *)((UINTN)Physical + 3 * sizeof (UINTN)),
+        (VOID *)Context.SystemContextArm->SP,
+        (NumberOfArguments - 2) * sizeof (UINTN)
+        );      
+    }
+  }
   ForbidSupervisorAccessToUserMemory ();
 
   Status = CallBootService (
-             Context.SystemContextArm->R0,
+             Type,
+             NumberOfArguments,
              (UINTN *)(UINTN)Physical,
              *(UINTN *)Context.SystemContextArm->SP_EL1
              );
   //
   // TODO: Fix memory leak for ReturnToCore().
   //
-  CoreFreePages (Physical, EFI_SIZE_TO_PAGES (9 * sizeof (UINTN)));
+  CoreFreePages (Physical, EFI_SIZE_TO_PAGES ((NumberOfArguments + 1) * sizeof (UINTN)));
 
   ArmDisableInterrupts ();
 
diff --git a/MdeModulePkg/Core/Dxe/SysCall/BootServices.c b/MdeModulePkg/Core/Dxe/SysCall/BootServices.c
index 184c3a7b62..640143ca27 100644
--- a/MdeModulePkg/Core/Dxe/SysCall/BootServices.c
+++ b/MdeModulePkg/Core/Dxe/SysCall/BootServices.c
@@ -279,7 +279,7 @@ STATIC
 UINTN *
 EFIAPI
 CopyUserArguments (
-  IN UINTN  NumberOfArguments,
+  IN UINT8  NumberOfArguments,
   IN UINTN  *UserArguments
   )
 {
@@ -330,6 +330,7 @@ EFI_STATUS
 EFIAPI
 CallBootService (
   IN UINT8  Type,
+  IN UINT8  NumberOfArguments,
   IN UINTN  *UserArguments,
   IN UINTN  ReturnSP
   )
@@ -367,13 +368,12 @@ CallBootService (
   Argument5    = 0;
   Argument6    = 0;
   Interface    = NULL;
+  Arguments    = CopyUserArguments (NumberOfArguments, UserArguments);
 
   DEBUG ((DEBUG_VERBOSE, "Type: %a\n", SysCallNames[Type]));
 
   switch (Type) {
     case SysCallReturnToCore:
-      Arguments  = CopyUserArguments (1, UserArguments);
-
       ReturnToCore (Arguments[1], ReturnSP);
       break;
     case SysCallLocateProtocol:
@@ -382,8 +382,6 @@ CallBootService (
       // Argument 2: VOID      *CoreRegistration
       // Argument 3: VOID      **Interface
       //
-      Arguments = CopyUserArguments (3, UserArguments);
-
       gCpu->GetMemoryAttributes (gCpu, (EFI_PHYSICAL_ADDRESS)Arguments[1], &Attributes);
       ASSERT ((Attributes & EFI_MEMORY_USER) != 0);
       gCpu->GetMemoryAttributes (gCpu, (EFI_PHYSICAL_ADDRESS)(Arguments[1] + sizeof (EFI_GUID) - 1), &Attributes);
@@ -428,8 +426,6 @@ CallBootService (
       // Argument 5: EFI_HANDLE  CoreControllerHandle
       // Argument 6: UINT32      Attributes
       //
-      Arguments = CopyUserArguments (6, UserArguments);
-
       gCpu->GetMemoryAttributes (gCpu, (EFI_PHYSICAL_ADDRESS)Arguments[2], &Attributes);
       ASSERT ((Attributes & EFI_MEMORY_USER) != 0);
       gCpu->GetMemoryAttributes (gCpu, (EFI_PHYSICAL_ADDRESS)(Arguments[2] + sizeof (EFI_GUID) - 1), &Attributes);
@@ -476,8 +472,6 @@ CallBootService (
       // Argument 1: EFI_HANDLE  *Handle
       // ...
       //
-      Arguments = CopyUserArguments (2, UserArguments);
-
       gCpu->GetMemoryAttributes (gCpu, (EFI_PHYSICAL_ADDRESS)Arguments[1], &Attributes);
       ASSERT ((Attributes & EFI_MEMORY_USER) != 0);
       gCpu->GetMemoryAttributes (gCpu, (EFI_PHYSICAL_ADDRESS)(Arguments[1] + sizeof (EFI_HANDLE *) - 1), &Attributes);
@@ -588,8 +582,6 @@ CallBootService (
       // Argument 3: EFI_HANDLE  CoreAgentHandle
       // Argument 4: EFI_HANDLE  CoreControllerHandle
       //
-      Arguments = CopyUserArguments (4, UserArguments);
-
       gCpu->GetMemoryAttributes (gCpu, (EFI_PHYSICAL_ADDRESS)Arguments[2], &Attributes);
       ASSERT ((Attributes & EFI_MEMORY_USER) != 0);
       gCpu->GetMemoryAttributes (gCpu, (EFI_PHYSICAL_ADDRESS)(Arguments[2] + sizeof (EFI_GUID) - 1), &Attributes);
@@ -619,8 +611,6 @@ CallBootService (
       // Argument 2: EFI_GUID    *Protocol
       // Argument 3: VOID        **Interface
       //
-      Arguments = CopyUserArguments (3, UserArguments);
-
       gCpu->GetMemoryAttributes (gCpu, (EFI_PHYSICAL_ADDRESS)Arguments[2], &Attributes);
       ASSERT ((Attributes & EFI_MEMORY_USER) != 0);
       gCpu->GetMemoryAttributes (gCpu, (EFI_PHYSICAL_ADDRESS)(Arguments[2] + sizeof (EFI_GUID) - 1), &Attributes);
@@ -663,8 +653,6 @@ CallBootService (
       // Argument 3: UINTN                 NumberOfPages
       // Argument 4: EFI_PHYSICAL_ADDRESS  *Memory
       //
-      Arguments = CopyUserArguments (4, UserArguments);
-
       Status = gBS->AllocatePages (
                       (EFI_ALLOCATE_TYPE)Arguments[1],
                       (EFI_MEMORY_TYPE)Arguments[2],
@@ -689,8 +677,7 @@ CallBootService (
       // Argument 1: UINTN                 NumberOfPages
       // Argument 2: EFI_PHYSICAL_ADDRESS  Memory
       //
-      Arguments = CopyUserArguments (3, UserArguments);
-      PhysAddr  = *(EFI_PHYSICAL_ADDRESS *)&Arguments[2];
+      PhysAddr = *(EFI_PHYSICAL_ADDRESS *)&Arguments[2];
 
       gCpu->GetMemoryAttributes (gCpu, PhysAddr, &Attributes);
       ASSERT ((Attributes & EFI_MEMORY_USER) != 0);
@@ -706,8 +693,6 @@ CallBootService (
       //
       // Argument 1: EFI_TPL  NewTpl
       //
-      Arguments = CopyUserArguments (1, UserArguments);
-
       Status = (EFI_STATUS)gBS->RaiseTPL ((EFI_TPL)Arguments[1]);
 
       FreePool (Arguments);
@@ -717,8 +702,6 @@ CallBootService (
       //
       // Argument 1: EFI_TPL  NewTpl
       //
-      Arguments = CopyUserArguments (1, UserArguments);
-
       gBS->RestoreTPL ((EFI_TPL)Arguments[1]);
 
       FreePool (Arguments);
@@ -732,8 +715,6 @@ CallBootService (
       // Argument 4: UINTN                   *NumberHandles
       // Argument 5: EFI_HANDLE              **Buffer
       //
-      Arguments = CopyUserArguments (5, UserArguments);
-
       if ((EFI_GUID *)Arguments[2] != NULL) {
         gCpu->GetMemoryAttributes (gCpu, (EFI_PHYSICAL_ADDRESS)Arguments[2], &Attributes);
         ASSERT ((Attributes & EFI_MEMORY_USER) != 0);
@@ -805,8 +786,6 @@ CallBootService (
       // Argument 2: UINTN   DataSize
       // Argument 3: UINT32  *Crc32
       //
-      Arguments = CopyUserArguments (3, UserArguments);
-
       gCpu->GetMemoryAttributes (gCpu, (EFI_PHYSICAL_ADDRESS)Arguments[1], &Attributes);
       ASSERT ((Attributes & EFI_MEMORY_USER) != 0);
       gCpu->GetMemoryAttributes (gCpu, (EFI_PHYSICAL_ADDRESS)(Arguments[1] + Arguments[2] - 1), &Attributes);
@@ -847,8 +826,6 @@ CallBootService (
       // Argument 4: UINTN     *DataSize
       // Argument 5: VOID      *Data           OPTIONAL
       //
-      Arguments = CopyUserArguments (5, UserArguments);
-
       gCpu->GetMemoryAttributes (gCpu, (EFI_PHYSICAL_ADDRESS)Arguments[1], &Attributes);
       ASSERT ((Attributes & EFI_MEMORY_USER) != 0);
       gCpu->GetMemoryAttributes (gCpu, (EFI_PHYSICAL_ADDRESS)Arguments[2], &Attributes);
@@ -938,8 +915,6 @@ CallBootService (
       // Argument 1: EFI_BLOCK_IO_PROTOCOL  *This
       // Argument 2: BOOLEAN                ExtendedVerification
       //
-      Arguments = CopyUserArguments (2, UserArguments);
-
       BlockIo = FindInterface (FALSE, (VOID *)Arguments[1]);
 
       if (BlockIo == NULL) {
@@ -963,16 +938,7 @@ CallBootService (
       // Argument 4: VOID                  *Buffer
       // Argument 5: EFI_LBA               Lba
       //
-#if defined (MDE_CPU_ARM)
-      //
-      // EFI_LBA Lba is aligned on 8 bytes.
-      //
-      Arguments = CopyUserArguments (7, UserArguments);
-      PhysAddr  = *(EFI_PHYSICAL_ADDRESS *)&Arguments[6];
-#else
-      Arguments = CopyUserArguments (6, UserArguments);
-      PhysAddr  = *(EFI_PHYSICAL_ADDRESS *)&Arguments[5];
-#endif
+      PhysAddr = *(EFI_PHYSICAL_ADDRESS *)&Arguments[5];
 
       BlockIo = FindInterface (FALSE, (VOID *)Arguments[1]);
 
@@ -1017,16 +983,7 @@ CallBootService (
       // Argument 4: VOID                  *Buffer
       // Argument 5: EFI_LBA               Lba
       //
-#if defined (MDE_CPU_ARM)
-      //
-      // EFI_LBA Lba is aligned on 8 bytes.
-      //
-      Arguments = CopyUserArguments (7, UserArguments);
-      PhysAddr  = *(EFI_PHYSICAL_ADDRESS *)&Arguments[6];
-#else
-      Arguments = CopyUserArguments (6, UserArguments);
-      PhysAddr  = *(EFI_PHYSICAL_ADDRESS *)&Arguments[5];
-#endif
+      PhysAddr = *(EFI_PHYSICAL_ADDRESS *)&Arguments[5];
 
       BlockIo = FindInterface (FALSE, (VOID *)Arguments[1]);
 
@@ -1067,8 +1024,6 @@ CallBootService (
       //
       // Argument 1: EFI_BLOCK_IO_PROTOCOL  *This
       //
-      Arguments = CopyUserArguments (1, UserArguments);
-
       BlockIo = FindInterface (FALSE, (VOID *)Arguments[1]);
 
       if (BlockIo == NULL) {
@@ -1089,16 +1044,7 @@ CallBootService (
       // Argument 4: VOID                  *Buffer
       // Argument 5: UINT64                Offset
       //
-#if defined (MDE_CPU_ARM)
-      //
-      // UINT64 Offset is aligned on 8 bytes.
-      //
-      Arguments = CopyUserArguments (7, UserArguments);
-      PhysAddr  = *(EFI_PHYSICAL_ADDRESS *)&Arguments[6];
-#else
-      Arguments = CopyUserArguments (6, UserArguments);
-      PhysAddr  = *(EFI_PHYSICAL_ADDRESS *)&Arguments[5];
-#endif
+      PhysAddr = *(EFI_PHYSICAL_ADDRESS *)&Arguments[5];
 
       DiskIo = FindInterface (FALSE, (VOID *)Arguments[1]);
 
@@ -1143,16 +1089,7 @@ CallBootService (
       // Argument 4: VOID                  *Buffer
       // Argument 5: UINT64                Offset
       //
-#if defined (MDE_CPU_ARM)
-      //
-      // UINT64 Offset is aligned on 8 bytes.
-      //
-      Arguments = CopyUserArguments (7, UserArguments);
-      PhysAddr  = *(EFI_PHYSICAL_ADDRESS *)&Arguments[6];
-#else
-      Arguments = CopyUserArguments (6, UserArguments);
-      PhysAddr  = *(EFI_PHYSICAL_ADDRESS *)&Arguments[5];
-#endif
+      PhysAddr = *(EFI_PHYSICAL_ADDRESS *)&Arguments[5];
 
       DiskIo = FindInterface (FALSE, (VOID *)Arguments[1]);
 
@@ -1195,8 +1132,6 @@ CallBootService (
       // Argument 2: CHAR16                          *Str1
       // Argument 3: CHAR16                          *Str2
       //
-      Arguments = CopyUserArguments (3, UserArguments);
-
       Unicode = FindInterface (FALSE, (VOID *)Arguments[1]);
 
       if (Unicode == NULL) {
@@ -1263,8 +1198,6 @@ CallBootService (
       // Argument 2: CHAR16                          *String
       // Argument 3: CHAR16                          *Pattern
       //
-      Arguments = CopyUserArguments (3, UserArguments);
-
       Unicode = FindInterface (FALSE, (VOID *)Arguments[1]);
 
       if (Unicode == NULL) {
@@ -1330,8 +1263,6 @@ CallBootService (
       // Argument 1: EFI_UNICODE_COLLATION_PROTOCOL  *This
       // Argument 2: CHAR16                          *Str
       //
-      Arguments = CopyUserArguments (2, UserArguments);
-
       Unicode = FindInterface (FALSE, (VOID *)Arguments[1]);
 
       if (Unicode == NULL) {
@@ -1376,8 +1307,6 @@ CallBootService (
       // Argument 1: EFI_UNICODE_COLLATION_PROTOCOL  *This
       // Argument 2: CHAR16                          *Str
       //
-      Arguments = CopyUserArguments (2, UserArguments);
-
       Unicode = FindInterface (FALSE, (VOID *)Arguments[1]);
 
       if (Unicode == NULL) {
@@ -1424,8 +1353,6 @@ CallBootService (
       // Argument 3: CHAR8                           *Fat
       // Argument 4: CHAR16                          *String
       //
-      Arguments = CopyUserArguments (4, UserArguments);
-
       Unicode = FindInterface (FALSE, (VOID *)Arguments[1]);
 
       if (Unicode == NULL) {
@@ -1494,8 +1421,6 @@ CallBootService (
       // Argument 3: UINTN                           FatSize
       // Argument 4: CHAR8                           *Fat
       //
-      Arguments = CopyUserArguments (4, UserArguments);
-
       Unicode = FindInterface (FALSE, (VOID *)Arguments[1]);
 
       if (Unicode == NULL) {
diff --git a/MdeModulePkg/Core/Dxe/SysCall/IA32/CoreBootServices.nasm b/MdeModulePkg/Core/Dxe/SysCall/IA32/CoreBootServices.nasm
index 9478b93345..8662e53ae0 100644
--- a/MdeModulePkg/Core/Dxe/SysCall/IA32/CoreBootServices.nasm
+++ b/MdeModulePkg/Core/Dxe/SysCall/IA32/CoreBootServices.nasm
@@ -109,6 +109,7 @@ ASM_PFX(SysCallBase):
 ;   );
 ;
 ;   (eax) User return address.
+;   (ebx) Number of User Arguments.
 ;   (ecx) Type.
 ;   (edx) User Stack Pointer.
 ;
@@ -135,8 +136,9 @@ ASM_PFX(CoreBootServices):
     mov     ebp, esp
     mov     eax, [esp + 4*3]
     push    eax      ; ReturnSP
-    add     edx, 4   ; User Arguments[]
-    push    edx
+    add     edx, 4*3
+    push    edx      ; User Arguments[]
+    push    ebx      ; NumberOfArguments
     push    ecx      ; Type
 
     sti
diff --git a/MdeModulePkg/Core/Dxe/SysCall/X64/CoreBootServices.nasm b/MdeModulePkg/Core/Dxe/SysCall/X64/CoreBootServices.nasm
index 2b48d77740..b9d3004163 100644
--- a/MdeModulePkg/Core/Dxe/SysCall/X64/CoreBootServices.nasm
+++ b/MdeModulePkg/Core/Dxe/SysCall/X64/CoreBootServices.nasm
@@ -117,13 +117,10 @@ ASM_PFX(SysCallBase):
 ;   );
 ;
 ;   (rcx) RIP of the next instruction saved by SYSCALL in SysCall().
-;   (rdx) Argument 1 of the called function.
-;   (r8)  Argument 2 of the called function.
-;   (r9)  Argument 3 of the called function.
+;   (rdx) Number of User Arguments.
+;   (r8)  User Arguments[].
 ;   (r10) Type.
 ;   (r11) RFLAGS saved by SYSCALL in SysCall().
-;
-;   (On User Stack) Argument 4, 5, ...
 ;------------------------------------------------------------------------------
 global ASM_PFX(CoreBootServices)
 ASM_PFX(CoreBootServices):
@@ -147,23 +144,14 @@ ASM_PFX(CoreBootServices):
     push    rcx
     ; Save User RFLAGS for SYSRET.
     push    r11
-    ; Save User Arguments [1..3] on User stack.
-    call ASM_PFX(AllowSupervisorAccessToUserMemory)
-    mov     rax, [rsp + 8*3]
-    mov     [rax + 8*2], rdx
-    mov     [rax + 8*3], r8
-    mov     [rax + 8*4], r9
-    call ASM_PFX(ForbidSupervisorAccessToUserMemory)
     mov     rbp, rsp
     ; Reserve space on stack for 4 CallBootService arguments (NOOPT prerequisite).
     sub     rsp, 8*4
 
     ; Prepare CallBootService arguments.
     mov     rcx, r10   ; Type
-    mov     rdx, [rbp + 8*3]
-    add     rdx, 8     ; User Arguments[]
     mov     rax, [ASM_PFX(SysCallStackTop)]
-    mov     r8, [rax]  ; ReturnSP
+    mov     r9, [rax]  ; ReturnSP
 
     sti
     call ASM_PFX(CallBootService)
diff --git a/MdePkg/Include/Uefi/UefiSpec.h b/MdePkg/Include/Uefi/UefiSpec.h
index 3a6e68ab5a..557a0a801b 100644
--- a/MdePkg/Include/Uefi/UefiSpec.h
+++ b/MdePkg/Include/Uefi/UefiSpec.h
@@ -2024,7 +2024,7 @@ typedef enum {
   SysCallCloseProtocol,
   SysCallHandleProtocol,
   SysCallAllocatePages,
-  SysCallFreePages,
+  SysCallFreePages = 7,
   SysCallRaiseTpl,
   SysCallRestoreTpl,
   SysCallLocateHandleBuffer,
@@ -2037,11 +2037,11 @@ typedef enum {
   // Protocols
   //
   SysCallBlockIoReset,
-  SysCallBlockIoRead,
-  SysCallBlockIoWrite,
+  SysCallBlockIoRead = 14,
+  SysCallBlockIoWrite = 15,
   SysCallBlockIoFlush,
-  SysCallDiskIoRead,
-  SysCallDiskIoWrite,
+  SysCallDiskIoRead = 17,
+  SysCallDiskIoWrite = 18,
   SysCallUnicodeStriColl,
   SysCallUnicodeMetaiMatch,
   SysCallUnicodeStrLwr,
@@ -2052,6 +2052,11 @@ typedef enum {
 } SYS_CALL_TYPE;
 
 #define MAX_LIST 32
+#define SC_FREE_PAGES     7
+#define SC_BLOCK_IO_READ  14
+#define SC_BLOCK_IO_WRITE 15
+#define SC_DISK_IO_READ   17
+#define SC_DISK_IO_WRITE  18
 
 ///
 /// Contains a set of GUID/pointer pairs comprised of the ConfigurationTable field in the