From 61b412842dd26fc9a432f92eed11eece7a9d8b01 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20=C5=BBygowski?= <michal.zygowski@3mdeb.com>
Date: Wed, 1 Jul 2026 12:19:49 +0200
Subject: [PATCH 01/22] security/intel/stm/Makefile.mk: Enable STM compression
 in CBFS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Compress the STM binary in CBFS to save space.

Upstream-Status: Pending
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
---
 src/security/intel/stm/Makefile.mk | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/security/intel/stm/Makefile.mk b/src/security/intel/stm/Makefile.mk
index 90b7c188f7f..94e5ea8070b 100644
--- a/src/security/intel/stm/Makefile.mk
+++ b/src/security/intel/stm/Makefile.mk
@@ -5,6 +5,7 @@
 cbfs-files-$(CONFIG_STM) += stm.bin
 stm.bin-file := $(CONFIG_STM_BINARY_FILE)
 stm.bin-type := raw
+stm.bin-compression := LZMA
 
 ramstage-$(CONFIG_STM) += SmmStm.c
 ramstage-$(CONFIG_STM) += StmPlatformSmm.c

From e5addd4b72e9a54a308d3ef20731f9a634d7b6e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20=C5=BBygowski?= <michal.zygowski@3mdeb.com>
Date: Wed, 1 Jul 2026 12:21:57 +0200
Subject: [PATCH 02/22] mb/msi/{ms7d25,ms7e06}: Provide TSEG and MSEG overrides
 for STM
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Override the sizes of SMM regions when STM is enabled to provide
known working defaults.

Upstream-Status: Pending
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
---
 src/mainboard/msi/ms7d25/Kconfig | 16 ++++++++++++++++
 src/mainboard/msi/ms7e06/Kconfig | 15 +++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/src/mainboard/msi/ms7d25/Kconfig b/src/mainboard/msi/ms7d25/Kconfig
index 04052c947bf..05cb0e030c5 100644
--- a/src/mainboard/msi/ms7d25/Kconfig
+++ b/src/mainboard/msi/ms7d25/Kconfig
@@ -95,4 +95,20 @@ config INTEL_FIT_LOC
 
 endif
 
+if STM
+
+config IED_REGION_SIZE
+	default 0x0
+
+config SMM_TSEG_SIZE
+	default 0x1000000
+
+config MSEG_SIZE
+	default 0xCD0000
+
+config STM_HEAPSIZE
+	default 0xB47000
+
+endif
+
 endif
diff --git a/src/mainboard/msi/ms7e06/Kconfig b/src/mainboard/msi/ms7e06/Kconfig
index 30d29ded341..6fc99feec76 100644
--- a/src/mainboard/msi/ms7e06/Kconfig
+++ b/src/mainboard/msi/ms7e06/Kconfig
@@ -94,5 +94,20 @@ config INTEL_FIT_LOC
 
 endif
 
+if STM
+
+config IED_REGION_SIZE
+	default 0x0
+
+config SMM_TSEG_SIZE
+	default 0x1000000
+
+config MSEG_SIZE
+	default 0xCD0000
+
+config STM_HEAPSIZE
+	default 0xB47000
+
+endif
 
 endif

From 1517e38e3f92ceef11503ba49264933cbeb17f53 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20=C5=BBygowski?= <michal.zygowski@3mdeb.com>
Date: Wed, 1 Jul 2026 12:24:39 +0200
Subject: [PATCH 03/22] payloads/external/edk2: Pass STM to EDK2 build
 environment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pass STM Kconfig value to EDK2 to enable the STM option visibility
in the setup menu.

Upstream-Status: Inappropriate [Dasharo downstream]
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
---
 payloads/external/Makefile.mk   | 3 ++-
 payloads/external/edk2/Makefile | 4 ++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/payloads/external/Makefile.mk b/payloads/external/Makefile.mk
index 9347c1267b8..1fd46312b06 100644
--- a/payloads/external/Makefile.mk
+++ b/payloads/external/Makefile.mk
@@ -308,7 +308,8 @@ $(obj)/UEFIPAYLOAD.fd: $(DOTCONFIG) $(IPXE_EFI)
 		CONFIG_EDK2_VGA_BIOS_VENDOR_ID=0x$(word 1,$(subst $(comma),$(spc),$(call strip_quotes,$(CONFIG_VGA_BIOS_ID)))) \
 		CONFIG_EDK2_VGA_BIOS_DEVICE_ID=0x$(word 2,$(subst $(comma),$(spc),$(call strip_quotes,$(CONFIG_VGA_BIOS_ID)))) \
 		CONFIG_VGA_BIOS_FILE=$(CONFIG_VGA_BIOS_FILE) \
-		CONFIG_BOOTSPLASH_REGION_LOGO_FILE=$(CONFIG_BOOTSPLASH_REGION_LOGO_FILE)
+		CONFIG_BOOTSPLASH_REGION_LOGO_FILE=$(CONFIG_BOOTSPLASH_REGION_LOGO_FILE) \
+		CONFIG_STM=$(CONFIG_STM)
 
 $(obj)/ShimmedUniversalPayload.elf: $(DOTCONFIG)
 	$(MAKE) -C payloads/external/edk2 UniversalPayload \
diff --git a/payloads/external/edk2/Makefile b/payloads/external/edk2/Makefile
index dd33e8148dd..cb1718d14fa 100644
--- a/payloads/external/edk2/Makefile
+++ b/payloads/external/edk2/Makefile
@@ -460,6 +460,10 @@ BUILD_STR += -D USE_AMD_PLATFORM_GOP=TRUE
 BUILD_STR += --pcd gDasharoPayloadPkgTokenSpaceGuid.AmdVbiosOptionRomVendorId=$(CONFIG_EDK2_VGA_BIOS_VENDOR_ID)
 BUILD_STR += --pcd gDasharoPayloadPkgTokenSpaceGuid.AmdVbiosOptionRomDeviceId=$(CONFIG_EDK2_VGA_BIOS_DEVICE_ID)
 endif
+# PcdShowSecurityStmOption = FALSE
+ifeq ($(CONFIG_STM),y)
+BUILD_STR += --pcd gDasharoSystemFeaturesTokenSpaceGuid.PcdShowSecurityStmOption=TRUE
+endif
 
 BUILD_STR += --pcd gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareVersionString=$(CONFIG_EDK2_FW_VERSION)
 BUILD_STR += --pcd gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareVendor=$(CONFIG_EDK2_FW_VENDOR)

From 478e16ee37806de14a5c3d9b1608687216151a16 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20=C5=BBygowski?= <michal.zygowski@3mdeb.com>
Date: Wed, 1 Jul 2026 12:31:06 +0200
Subject: [PATCH 04/22] security/intel/stm/StmPlatformSmm.c: Control STM with
 variable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Load STM conditionally based on the variable state.

Upstream-Status: Inappropriate [Dasharo downstream]
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
---
 src/security/intel/stm/StmPlatformSmm.c          |  8 ++++++++
 src/vendorcode/dasharo/include/dasharo/options.h |  9 +++++++++
 src/vendorcode/dasharo/options.c                 | 10 ++++++++++
 3 files changed, 27 insertions(+)

diff --git a/src/security/intel/stm/StmPlatformSmm.c b/src/security/intel/stm/StmPlatformSmm.c
index 99e62c77c03..8e9da237738 100644
--- a/src/security/intel/stm/StmPlatformSmm.c
+++ b/src/security/intel/stm/StmPlatformSmm.c
@@ -7,6 +7,7 @@
 #include <cpu/x86/gdt.h>
 #include <cpu/x86/smm.h>
 #include <cpu/x86/msr.h>
+#include <dasharo/options.h>
 
 #include <cbfs.h>
 #include <console/console.h>
@@ -142,9 +143,16 @@ void stm_setup(uintptr_t mseg, int cpu, uintptr_t smbase,
 	msr_t InitMseg;
 	msr_t MsegChk;
 	msr_t vmx_basic;
+	static int stm_en = -1;
 
 	uintptr_t addr_calc;  // used to calculate the stm resource heap area
 
+	if (stm_en == -1)
+		stm_en = (int)get_stm_option();
+
+	if (stm_en == 0)
+		return;
+
 	printk(BIOS_DEBUG, "STM: set up for cpu %d\n", cpu);
 
 	vmx_basic = rdmsr(IA32_VMX_BASIC_MSR);
diff --git a/src/vendorcode/dasharo/include/dasharo/options.h b/src/vendorcode/dasharo/include/dasharo/options.h
index 39d2aeac5f7..22dcb14900c 100644
--- a/src/vendorcode/dasharo/include/dasharo/options.h
+++ b/src/vendorcode/dasharo/include/dasharo/options.h
@@ -336,4 +336,13 @@ bool get_ibecc_option(bool ibecc_default);
  */
 bool dasharo_is_disk_capsules_boot(void);
 
+/* Looks Dasharo/"STM" variable to check SMI Transfer Monitor (STM) should be
+ * enabled.
+ *
+ * Result:
+ *  - true  - STM enabled
+ *  - false - STM disabled
+ */
+bool get_stm_option(void);
+
 #endif /* DASHARO_OPTIONS_H */
diff --git a/src/vendorcode/dasharo/options.c b/src/vendorcode/dasharo/options.c
index 58370705160..77888edc837 100644
--- a/src/vendorcode/dasharo/options.c
+++ b/src/vendorcode/dasharo/options.c
@@ -559,6 +559,16 @@ bool get_ibecc_option(bool ibecc_default)
 	return ibecc_en;
 }
 
+bool get_stm_option(void)
+{
+	bool stm_enabled = false;
+
+	if (CONFIG(DRIVERS_EFI_VARIABLE_STORE) && CONFIG(STM))
+		read_bool_var("STM", &stm_enabled);
+
+	return stm_enabled;
+}
+
 bool dasharo_is_disk_capsules_boot(void)
 {
 	if (!CONFIG(EDK2_CAPSULES_V2))

From e69631bcfa30a6167e22caa4626d55ec9f1546d9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20=C5=BBygowski?= <michal.zygowski@3mdeb.com>
Date: Mon, 6 Jul 2026 09:37:53 +0200
Subject: [PATCH 05/22] drivers/intel/fsp2_0,soc/intel/alderlake: Add support
 for 64bit mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add support for 64bit mode coreboot launching 32bit FSP. Certain
definitions and types have to be overridden to make coreboot compile
in 64bit mode while FSP is purely 32bit mode.

Upstream-Status: Pending
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
---
 src/drivers/intel/fsp2_0/include/fsp/api.h    |  1 +
 .../include/fsp/fsp_status_x64_to_x86.h       | 53 +++++++++++++++++++
 src/soc/intel/alderlake/fsp_params.c          | 19 ++++---
 src/soc/intel/alderlake/romstage/fsp_params.c |  5 ++
 4 files changed, 72 insertions(+), 6 deletions(-)
 create mode 100644 src/drivers/intel/fsp2_0/include/fsp/fsp_status_x64_to_x86.h

diff --git a/src/drivers/intel/fsp2_0/include/fsp/api.h b/src/drivers/intel/fsp2_0/include/fsp/api.h
index fa3c42c94ef..c4840347623 100644
--- a/src/drivers/intel/fsp2_0/include/fsp/api.h
+++ b/src/drivers/intel/fsp2_0/include/fsp/api.h
@@ -6,6 +6,7 @@
 #include <stddef.h>
 #include <stdint.h>
 #include <fsp/soc_binding.h>
+#include <fsp/fsp_status_x64_to_x86.h>
 #include <soc/intel/common/mma.h>
 
 #define FSP_SUCCESS	EFI_SUCCESS
diff --git a/src/drivers/intel/fsp2_0/include/fsp/fsp_status_x64_to_x86.h b/src/drivers/intel/fsp2_0/include/fsp/fsp_status_x64_to_x86.h
new file mode 100644
index 00000000000..e713c8b9e39
--- /dev/null
+++ b/src/drivers/intel/fsp2_0/include/fsp/fsp_status_x64_to_x86.h
@@ -0,0 +1,53 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef _FSP2_0_STATUS_X64_TO_X86_H_
+#define _FSP2_0_STATUS_X64_TO_X86_H_
+
+/* Fixup definitions for x86_64 mode when FSP uses 32bit mode */
+#if CONFIG(PLATFORM_USES_FSP2_X86_32) && CONFIG(USE_X86_64_SUPPORT)
+
+#undef MAX_BIT
+#undef ENCODE_RESET_REQUEST
+#undef FSP_STATUS_RESET_REQUIRED_COLD
+#undef FSP_STATUS_RESET_REQUIRED_WARM
+#undef FSP_STATUS_RESET_REQUIRED_3
+#undef FSP_STATUS_RESET_REQUIRED_4
+#undef FSP_STATUS_RESET_REQUIRED_5
+#undef FSP_STATUS_RESET_REQUIRED_6
+#undef FSP_STATUS_RESET_REQUIRED_7
+#undef FSP_STATUS_RESET_REQUIRED_8
+#undef FSP_STATUS_VARIABLE_REQUEST
+
+#undef EFI_SUCCESS
+#undef EFI_INVALID_PARAMETER
+#undef EFI_UNSUPPORTED
+#undef EFI_DEVICE_ERROR
+#undef EFI_NOT_FOUND
+#undef EFI_NOT_STARTED
+
+#define MAX_BIT				0x80000000
+#define ENCODE_RESET_REQUEST(ResetType)	\
+		((UINT32)((MAX_BIT >> 1) | (ResetType)))
+#define FSP_STATUS_RESET_REQUIRED_COLD	ENCODE_RESET_REQUEST(1)
+#define FSP_STATUS_RESET_REQUIRED_WARM	ENCODE_RESET_REQUEST(2)
+#define FSP_STATUS_RESET_REQUIRED_3	ENCODE_RESET_REQUEST(3)
+#define FSP_STATUS_RESET_REQUIRED_4	ENCODE_RESET_REQUEST(4)
+#define FSP_STATUS_RESET_REQUIRED_5	ENCODE_RESET_REQUEST(5)
+#define FSP_STATUS_RESET_REQUIRED_6	ENCODE_RESET_REQUEST(6)
+#define FSP_STATUS_RESET_REQUIRED_7	ENCODE_RESET_REQUEST(7)
+#define FSP_STATUS_RESET_REQUIRED_8	ENCODE_RESET_REQUEST(8)
+#define FSP_STATUS_VARIABLE_REQUEST	ENCODE_RESET_REQUEST(10)
+
+#define ENCODE_EFI_STATUS(Status)	\
+		((UINT32)((MAX_BIT) | (Status)))
+
+#define EFI_SUCCESS			0
+#define EFI_INVALID_PARAMETER		ENCODE_EFI_STATUS(2)
+#define EFI_UNSUPPORTED			ENCODE_EFI_STATUS(3)
+#define EFI_DEVICE_ERROR		ENCODE_EFI_STATUS(7)
+#define EFI_NOT_FOUND			ENCODE_EFI_STATUS(14)
+#define EFI_NOT_STARTED			ENCODE_EFI_STATUS(19)
+
+#endif
+
+#endif  /* _FSP2_0_STATUS_X64_TO_X86_H_ */
\ No newline at end of file
diff --git a/src/soc/intel/alderlake/fsp_params.c b/src/soc/intel/alderlake/fsp_params.c
index 82246def092..5225c9f29a6 100644
--- a/src/soc/intel/alderlake/fsp_params.c
+++ b/src/soc/intel/alderlake/fsp_params.c
@@ -771,8 +771,14 @@ static void fill_fsps_uart_params(FSP_S_CONFIG *s_cfg,
 {
 	if (CONFIG(FSP_USES_CB_DEBUG_EVENT_HANDLER) && CONFIG(CONSOLE_SERIAL) &&
 			 CONFIG(FSP_ENABLE_SERIAL_DEBUG))
-		s_cfg->FspEventHandler = (UINT32)((FSP_EVENT_HANDLER *)
-				fsp_debug_event_handler);
+#if CONFIG(USE_X86_64_SUPPORT)
+	s_cfg->FspEventHandler = (UINT32)(EFI_PHYSICAL_ADDRESS)
+			fsp_debug_event_handler;
+#else
+	s_cfg->FspEventHandler = (UINT32)((FSP_EVENT_HANDLER *)
+			fsp_debug_event_handler);
+#endif
+
 	/* PCH UART selection for FSP Debug */
 	s_cfg->SerialIoDebugUartNumber = CONFIG_UART_FOR_CONSOLE;
 	ASSERT(ARRAY_SIZE(s_cfg->SerialIoUartAutoFlow) > CONFIG_UART_FOR_CONSOLE);
@@ -1347,7 +1353,7 @@ static void wait_for_panel_power_cycle_done(const struct soc_intel_alderlake_con
 		return;
 
 	bar0 = pci_read_config32(SA_DEV_IGD, PCI_BASE_ADDRESS_0);
-	mmio = (void *)(bar0 & ~PCI_BASE_ADDRESS_MEM_ATTR_MASK);
+	mmio = (void *)((uintptr_t)bar0 & ~PCI_BASE_ADDRESS_MEM_ATTR_MASK);
 	if (!mmio)
 		return;
 
@@ -1434,10 +1440,11 @@ void soc_load_logo_by_fsp(FSPS_UPD *supd)
 	if (s_cfg->LidStatus == 0)
 		config->panel_orientation = LB_FB_ORIENTATION_NORMAL;
 
-	fsp_load_and_convert_bmp_to_gop_blt(&supd->FspsConfig.LogoPtr,
+	fsp_load_and_convert_bmp_to_gop_blt(
+			 (efi_uintn_t *)&supd->FspsConfig.LogoPtr,
 			 &supd->FspsConfig.LogoSize,
-			 &supd->FspsConfig.BltBufferAddress,
-			 &supd->FspsConfig.BltBufferSize,
+			 (efi_uintn_t *)&supd->FspsConfig.BltBufferAddress,
+			 (efi_uintn_t *)&supd->FspsConfig.BltBufferSize,
 			 &supd->FspsConfig.LogoPixelHeight,
 			 &supd->FspsConfig.LogoPixelWidth,
 			 config->panel_orientation);
diff --git a/src/soc/intel/alderlake/romstage/fsp_params.c b/src/soc/intel/alderlake/romstage/fsp_params.c
index 16132fe8313..14d3ab9f025 100644
--- a/src/soc/intel/alderlake/romstage/fsp_params.c
+++ b/src/soc/intel/alderlake/romstage/fsp_params.c
@@ -526,8 +526,13 @@ void platform_fsp_memory_init_params_cb(FSPM_UPD *mupd, uint32_t version)
 	if (CONFIG(FSP_USES_CB_DEBUG_EVENT_HANDLER)) {
 		if (CONFIG(CONSOLE_SERIAL) && CONFIG(FSP_ENABLE_SERIAL_DEBUG)) {
 			enum fsp_log_level log_level = fsp_map_console_log_level();
+#if CONFIG(USE_X86_64_SUPPORT)
+			arch_upd->FspEventHandler = (UINT32)(EFI_PHYSICAL_ADDRESS)
+					fsp_debug_event_handler;
+#else
 			arch_upd->FspEventHandler = (UINT32)((FSP_EVENT_HANDLER *)
 					fsp_debug_event_handler);
+#endif
 			/* Set Serial debug message level */
 			m_cfg->PcdSerialDebugLevel = log_level;
 			/* Set MRC debug level */

From 40e0405ab8832c6d7b8e07189f1bec8f5fa8be7a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20=C5=BBygowski?= <michal.zygowski@3mdeb.com>
Date: Mon, 6 Jul 2026 09:39:54 +0200
Subject: [PATCH 06/22] security/intel/stm/StmApi.h: Sync header with submodule
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Synchronize the header copy in coreboot with its original source in
STM submodule. Certain structures have different definitions, thus
using sizeof can lead to different results. For example the
PCI_CFG_RANGE resource passed from coreboot has incorrect size
of 16 bytes, instead of expected 22 bytes. An error can be seen in STM:

(STM) Resource invalid (FromMle - 0, ForLogging - 0):
(STM) ResourceNode:
(STM) PCI_CFG_RANGE:
(STM)   RscType       : 00000005
(STM)   RscLength     : 0010
(STM)   ReturnStatus  : 0001
(STM)   IgnoreResource: 0000
(STM)   RWAttributes  : 0003
(STM)   Base          : 0000
(STM)   Length        : 1000
(STM)   OriginatingBus: 00
(STM)   LastNodeIndex : 00
(STM)   Type          : 04
(STM)   Subtype       : 00
(STM)   Length        : 0000
(STM)   PciDevice     : 00
(STM)   PciFunction   : 20
(STM) 0 LaunchBack - ValidateBiosResourceList fail!

Upstream-Status: Pending
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
---
 src/security/intel/stm/StmApi.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/security/intel/stm/StmApi.h b/src/security/intel/stm/StmApi.h
index 1a594a7dd0f..af57341fc91 100644
--- a/src/security/intel/stm/StmApi.h
+++ b/src/security/intel/stm/StmApi.h
@@ -42,7 +42,7 @@ typedef struct {
 	uint32_t additional_dynamic_memory_size;
 	STM_FEAT stm_features;
 	uint32_t number_of_rev_ids;
-	uint32_t stm_smm_rev_id[];
+	uint32_t stm_smm_rev_id[1];
 
 	// The total STM_HEADER should be 4K.
 } SOFTWARE_STM_HEADER;
@@ -65,7 +65,7 @@ typedef struct {
 typedef struct {
 	uint32_t image_size;
 	uint32_t reserved;
-	uint64_t image_page_base[]; //[NumberOfPages];
+	uint64_t image_page_base[1]; //[NumberOfPages];
 } TXT_BIOS_COMPONENT_UPDATE;
 
 typedef struct {
@@ -413,7 +413,7 @@ typedef struct {
 	uint16_t length;
 	uint8_t originating_bus_number;
 	uint8_t last_node_index;
-	STM_PCI_DEVICE_PATH_NODE pci_device_path[];
+	STM_PCI_DEVICE_PATH_NODE pci_device_path[1];
 	// STM_PCI_DEVICE_PATH_NODE  PciDevicePath[LastNodeIndex + 1];
 } STM_RSC_PCI_CFG_DESC;
 
@@ -524,7 +524,7 @@ typedef enum {
 
 typedef struct {
 	uint32_t page_count;
-	uint64_t pages[]; // number of elements is PageCount
+	uint64_t pages[1]; // number of elements is PageCount
 } STM_EVENT_LOG_MANAGEMENT_REQUEST_DATA_LOG_BUFFER;
 
 typedef union {

From f605988f74d5d7bb2d66feffc56f2175d7ca8d72 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20=C5=BBygowski?= <michal.zygowski@3mdeb.com>
Date: Mon, 6 Jul 2026 09:46:47 +0200
Subject: [PATCH 07/22] security/intel/stm/StmPlatformResource.c: Fix flash
 mmapped range
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The flash resides at 0xff000000 and spands 16MB, not at 0xfe000000.

Upstream-Status: Pending
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
---
 src/security/intel/stm/StmPlatformResource.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/security/intel/stm/StmPlatformResource.c b/src/security/intel/stm/StmPlatformResource.c
index 62559873c33..7b0ce8b3309 100644
--- a/src/security/intel/stm/StmPlatformResource.c
+++ b/src/security/intel/stm/StmPlatformResource.c
@@ -27,7 +27,7 @@ static STM_RSC_MEM_DESC rsc_tseg_memory = {{MEM_RANGE, sizeof(STM_RSC_MEM_DESC)}
 // Flash part
 static STM_RSC_MEM_DESC rsc_spi_memory = {
 				{MEM_RANGE, sizeof(STM_RSC_MEM_DESC)},
-				0xFE000000,
+				0xFF000000,
 				0x01000000,
 				FULL_ACCS};
 

From f992ed88a6cf0af45c4abf4ac8cdc21b11e6cb42 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20=C5=BBygowski?= <michal.zygowski@3mdeb.com>
Date: Mon, 6 Jul 2026 10:28:15 +0200
Subject: [PATCH 08/22] security/intel/stm: Prepare for 64 bit mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use uintptr_t instead of fixed length variabels where appropriate
to compile STM code in 64bit mode.

Upstream-Status: Pending
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
---
 src/security/intel/stm/SmmStm.c         | 12 ++++++------
 src/security/intel/stm/SmmStm.h         |  2 +-
 src/security/intel/stm/StmPlatformSmm.c |  7 +++----
 3 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/src/security/intel/stm/SmmStm.c b/src/security/intel/stm/SmmStm.c
index 64a4877ed4b..aa20f0ab8dc 100644
--- a/src/security/intel/stm/SmmStm.c
+++ b/src/security/intel/stm/SmmStm.c
@@ -448,7 +448,7 @@ static uint32_t get_resource_size(STM_RSC *resource_list, uint32_t num_entries)
 		resource =
 			(STM_RSC *)((void *)resource + resource->header.length);
 	}
-	return (uint32_t)((uint32_t)resource - (uint32_t)resource_list);
+	return (uint32_t)((uintptr_t)resource - (uintptr_t)resource_list);
 }
 
 /*
@@ -584,21 +584,21 @@ static uint32_t get_vmcs_size(void)
  *
  *  @param pageable_base        The page table base in MSEG
  */
-void stm_gen_4g_pagetable_x64(uint32_t pagetable_base)
+void stm_gen_4g_pagetable_x64(uintptr_t pagetable_base)
 {
 	uint32_t index;
-	uint32_t sub_index;
+	uint64_t sub_index;
 	uint64_t *pde;
 	uint64_t *pte;
 	uint64_t *pml4;
 
-	pml4 = (uint64_t *)(uint32_t)pagetable_base;
+	pml4 = (uint64_t *)pagetable_base;
 	pagetable_base += PTP_SIZE;
 	*pml4 = pagetable_base | IA32_PG_RW | IA32_PG_P;
 
-	pde = (uint64_t *)(uint32_t)pagetable_base;
+	pde = (uint64_t *)pagetable_base;
 	pagetable_base += PTP_SIZE;
-	pte = (uint64_t *)(uint32_t)pagetable_base;
+	pte = (uint64_t *)pagetable_base;
 
 	for (index = 0; index < 4; index++) {
 		*pde = pagetable_base | IA32_PG_RW | IA32_PG_P;
diff --git a/src/security/intel/stm/SmmStm.h b/src/security/intel/stm/SmmStm.h
index 8db770dc235..4f110f82d76 100644
--- a/src/security/intel/stm/SmmStm.h
+++ b/src/security/intel/stm/SmmStm.h
@@ -103,6 +103,6 @@ void stm_gen_4g_pagetable_ia32(uint32_t pagetable_base);
  *
  *  @param pagetable_base        The page table base in MSEG
  */
-void stm_gen_4g_pagetable_x64(uint32_t pagetable_base);
+void stm_gen_4g_pagetable_x64(uintptr_t pagetable_base);
 
 #endif
diff --git a/src/security/intel/stm/StmPlatformSmm.c b/src/security/intel/stm/StmPlatformSmm.c
index 8e9da237738..ea2dbfeefe2 100644
--- a/src/security/intel/stm/StmPlatformSmm.c
+++ b/src/security/intel/stm/StmPlatformSmm.c
@@ -49,8 +49,7 @@ int load_stm_image(uintptr_t mseg)
 
 	stm_header = mseg_base;
 
-	stm_gen_4g_pagetable_x64((uint32_t)mseg_base
-				 + stm_header->hw_stm_hdr.cr3_offset);
+	stm_gen_4g_pagetable_x64((uintptr_t)mseg_base + stm_header->hw_stm_hdr.cr3_offset);
 
 	// Debug stuff
 	printk(BIOS_DEBUG,
@@ -59,9 +58,9 @@ int load_stm_image(uintptr_t mseg)
 	       stm_header->hw_stm_hdr.monitor_features,
 	       stm_header->hw_stm_hdr.cr3_offset);
 	printk(BIOS_DEBUG,
-	       "STM: Header-StaticImageSize: %d  Cr3Location: 0x%08x\n",
+	       "STM: Header-StaticImageSize: %d  Cr3Location: 0x%08lx\n",
 	       stm_header->sw_stm_hdr.static_image_size,
-	       ((uint32_t)mseg_base + stm_header->hw_stm_hdr.cr3_offset));
+	       ((uintptr_t)mseg_base + stm_header->hw_stm_hdr.cr3_offset));
 
 	status = 0; // always return good for now
 

From 179a20bb7a39eaf2776052159018e4dd16300ba3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20=C5=BBygowski?= <michal.zygowski@3mdeb.com>
Date: Mon, 6 Jul 2026 13:33:24 +0200
Subject: [PATCH 09/22] security/intel/stm/SmmStm.c: Create page tables for
 whole memory space
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Create page tables for whole memory from STM. Previously, only the
first 4GB of memory were covered with pages causing page faults in STM
when the VMCS from host OS allocated it above 4G:

(STM) InitPe - PE initialization complete
(STM) 0 SmiVmcsPtr - 000000004BD4E000
(STM) 0 SmmVmcsPtr - 000000004BD4F000
(STM) 0 CurrentVmcs - 00000001185C0000 VmcsSize 1000
(STM) STM Page Fault at 0x00000001185C0000, Rip 0x000000004B14B45E
    Cr2 0x00000001185C0000

Upstream-Status: Pending
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
---
 src/security/intel/stm/SmmStm.c | 58 +++++++++++++++++++++++++--------
 1 file changed, 45 insertions(+), 13 deletions(-)

diff --git a/src/security/intel/stm/SmmStm.c b/src/security/intel/stm/SmmStm.c
index aa20f0ab8dc..fed77ede44c 100644
--- a/src/security/intel/stm/SmmStm.c
+++ b/src/security/intel/stm/SmmStm.c
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: BSD-2-Clause */
 
 #include <console/console.h>
+#include <cpu/cpu.h>
 #include <cpu/x86/cr.h>
 #include <cpu/x86/mp.h>
 #include <cpu/x86/msr.h>
@@ -580,38 +581,69 @@ static uint32_t get_vmcs_size(void)
 
 /*
  *  Create 4G page table for STM.
- *  2M PTEs for x86_64 or 2M PTEs for x86_32.
  *
  *  @param pageable_base        The page table base in MSEG
  */
 void stm_gen_4g_pagetable_x64(uintptr_t pagetable_base)
 {
+	uint32_t pml4_index;
 	uint32_t index;
 	uint64_t sub_index;
+	uint32_t num_pml4;
+	uint32_t num_pdp;
 	uint64_t *pde;
 	uint64_t *pte;
 	uint64_t *pml4;
+	uint64_t page_addr;
+	uint32_t addr_bits = cpu_phys_address_size();
+	bool page1G = false;
+
+	if (cpu_cpuid_extended_level() >= 0x80000001) {
+		if (cpuid_edx(0x80000001) & (1 << 26))
+			page1G = true;
+	}
+
+	/* Do not use 5-level paging for now */
+	if (addr_bits > 48)
+		addr_bits = 48;
+
+	num_pml4 = 1 << (addr_bits - 39);
+	addr_bits = 39;
+	num_pdp = 1 << (addr_bits - 30);
+
+	page_addr = 0;
 
 	pml4 = (uint64_t *)pagetable_base;
 	pagetable_base += PTP_SIZE;
-	*pml4 = pagetable_base | IA32_PG_RW | IA32_PG_P;
 
-	pde = (uint64_t *)pagetable_base;
-	pagetable_base += PTP_SIZE;
-	pte = (uint64_t *)pagetable_base;
+	for (pml4_index = 0; pml4_index < num_pml4; pml4_index++, pml4++) {
+		*pml4 = pagetable_base | IA32_PG_RW | IA32_PG_P;
 
-	for (index = 0; index < 4; index++) {
-		*pde = pagetable_base | IA32_PG_RW | IA32_PG_P;
-		pde++;
+		pde = (uint64_t *)pagetable_base;
 		pagetable_base += PTP_SIZE;
 
-		for (sub_index = 0; sub_index < SIZE_4KB / sizeof(*pte);
-		     sub_index++) {
-			*pte = (((index << 9) + sub_index) << 21) | IA32_PG_PS
-			       | IA32_PG_RW | IA32_PG_P;
-			pte++;
+		if (page1G) {
+			for (index = 0; index < (SIZE_4KB / sizeof(*pde));
+			    index++, pde++, page_addr += GiB) {
+				*pde = page_addr | IA32_PG_PS | IA32_PG_RW | IA32_PG_P;
+			}
+		} else {
+			for (index = 0;
+			     index < (num_pml4 == 1 ? num_pdp : SIZE_4KB / sizeof(*pde));
+			     index++, pde++) {
+				*pde = pagetable_base | IA32_PG_RW | IA32_PG_P;
+				pte = (uint64_t *)pagetable_base;
+				pagetable_base += PTP_SIZE;
+				for (sub_index = 0; sub_index < SIZE_4KB / sizeof(*pte);
+				     sub_index++, pte++, page_addr += (2 * MiB)) {
+					*pte = page_addr | IA32_PG_PS | IA32_PG_RW | IA32_PG_P;
+				}
+			}
+			memset(pde, 0, (512 - index) * sizeof(*pde));
 		}
 	}
+
+	memset(pml4, 0, (512 - pml4_index) * sizeof(*pml4));
 }
 
 /*

From fb89df372cd4ebb39703c0879a3c4a384f30ce5d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20=C5=BBygowski?= <michal.zygowski@3mdeb.com>
Date: Wed, 5 Aug 2026 14:44:37 +0200
Subject: [PATCH 10/22] drivers/smmstore/store.c: Make error messages unique
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Make the errors unique so that debugging is easier when something
goes wrong.

Upstream-Status: Pending
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
---
 src/drivers/smmstore/store.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/drivers/smmstore/store.c b/src/drivers/smmstore/store.c
index 00b02832d0a..9adf427d39d 100644
--- a/src/drivers/smmstore/store.c
+++ b/src/drivers/smmstore/store.c
@@ -419,7 +419,7 @@ static void *mmap_com_buf(struct region_device *com_buf, uint32_t offset, uint32
 
 	void *ptr = rdev_mmap(com_buf, offset, bufsize);
 	if (!ptr)
-		printk(BIOS_ERR, "smm store: not enough space for new data\n");
+		printk(BIOS_ERR, "smm store: could not mmap com buffer\n");
 
 	return ptr;
 }
@@ -478,7 +478,7 @@ int smmstore_rawwrite_region(uint32_t block_id, uint32_t offset, uint32_t bufsiz
 		return -1;
 
 	if (rdev_chain(&store, &store, block_id * SMM_BLOCK_SIZE + offset, bufsize)) {
-		printk(BIOS_ERR, "smm store: not enough space for new data\n");
+		printk(BIOS_ERR, "smm store: could not create subregion rdev\n");
 		return -1;
 	}
 

From 0c62ab6e49e8989e206a7c0d4c34c86d666382df Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20=C5=BBygowski?= <michal.zygowski@3mdeb.com>
Date: Wed, 5 Aug 2026 14:52:12 +0200
Subject: [PATCH 11/22] cpu/x86/smm: Allocate additional 4K for SMM
 communication buffer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Allocate additional page for communication buffer so that the arguments
can be passed in the communication buffer offset equal to the block
size. In that case the SMI handler does not need to access arbitrary
memory allocated by the SMMSTORE caller. Instead the caller may place
the arguments in the same communication buffer.

When STM is enabled, it helps to restrict the memory accessed by
SMMSTORE handler. Otherwise, an EPT violation handler will prevent
access the the caller's	memory buffer with arguments.

TEST=EDK2 SMMSTORE library places the arguments in the communication
buffer and the STM no longer raises EPT violation when the SMMSTORE
SMI handler trie to access the parameters passed by the	caller.

Upstream-Status: Pending

Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
---
 src/cpu/x86/smm/smm_module_loader.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/cpu/x86/smm/smm_module_loader.c b/src/cpu/x86/smm/smm_module_loader.c
index dff2dde857a..0c4398a6f9e 100644
--- a/src/cpu/x86/smm/smm_module_loader.c
+++ b/src/cpu/x86/smm/smm_module_loader.c
@@ -358,7 +358,13 @@ static void setup_smihandler_params(struct smm_runtime *mod_params,
 			return;
 		}
 
-		void *ptr = cbmem_add(CBMEM_ID_SMM_COMBUFFER, info.block_size);
+		/*
+		 * Add additional 4KiB for parameters, so that arguments can be in the same
+		 * communication buffer, instead of arbitrary memory allocated by the caller.
+		 * It helps with STM resource reporting and keeping the SMI handlers from
+		 * accessing memory it doesn't have to access.
+		 */
+		void *ptr = cbmem_add(CBMEM_ID_SMM_COMBUFFER, info.block_size + 4 * KiB);
 		if (!ptr) {
 			printk(BIOS_ERR, "SMMSTORE: Failed to add com buffer\n");
 			return;

From dad0f80def2323c7666a568c4dc2191a0d6306a2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20=C5=BBygowski?= <michal.zygowski@3mdeb.com>
Date: Thu, 6 Aug 2026 12:20:43 +0200
Subject: [PATCH 12/22] security/intel/stm: Describe all resources used by
 coreboot SMI handlers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Describe all resources used by coreboot SMI handlers to avoid EPT
violations in STM.

TEST=Run STM on MSI PRO Z790-P with DEBUG_SMI and SMMSTORE, try to set
BootNext variable via efibootmgr under Linux with running STM module.

Upstream-Status: Pending
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
---
 src/security/intel/stm/StmPlatformResource.c | 206 +++++++++++++++++--
 src/security/intel/stm/StmPlatformResource.h |   3 +
 2 files changed, 196 insertions(+), 13 deletions(-)

diff --git a/src/security/intel/stm/StmPlatformResource.c b/src/security/intel/stm/StmPlatformResource.c
index 7b0ce8b3309..b3798d7a8b1 100644
--- a/src/security/intel/stm/StmPlatformResource.c
+++ b/src/security/intel/stm/StmPlatformResource.c
@@ -10,8 +10,23 @@
 #else
 #include <soc/pm.h>
 #endif
+
+#if CONFIG(SOC_INTEL_COMMON_BLOCK_FAST_SPI)
+#include <intelblocks/fast_spi.h>
+#include <soc/intel/common/block/fast_spi/fast_spi_def.h>
+#endif
+
+#if CONFIG(SOC_INTEL_COMMON_BLOCK_P2SB)
+#include <soc/iomap.h>
+#endif
+
+#include <arch/pci_io_cfg.h>
+#include <cbmem.h>
 #include <cpu/x86/msr.h>
+#include <cpu/intel/msr.h>
 #include <console/console.h>
+#include <console/uart.h>
+#include <security/intel/txt/txt_register.h>
 
 #define RDWR_ACCS 3
 #define FULL_ACCS 7
@@ -24,6 +39,27 @@ static STM_RSC_MEM_DESC rsc_tseg_memory = {{MEM_RANGE, sizeof(STM_RSC_MEM_DESC)}
 				    0,
 				    FULL_ACCS};
 
+// SMMSTORE communication buffer
+static STM_RSC_MEM_DESC rsc_smmstore_comm_buffer_memory = {
+				{MEM_RANGE, sizeof(STM_RSC_MEM_DESC)},
+				0,
+				0,
+				RDWR_ACCS};
+
+// cbmem console buffer
+static STM_RSC_MEM_DESC rsc_cbmemc_memory = {
+				{MEM_RANGE, sizeof(STM_RSC_MEM_DESC)},
+				0,
+				0,
+				RDWR_ACCS};
+
+// TPM PPI buffer
+static STM_RSC_MEM_DESC rsc_tpm_ppi_memory = {
+				{MEM_RANGE, sizeof(STM_RSC_MEM_DESC)},
+				0,
+				0,
+				RDWR_ACCS};
+
 // Flash part
 static STM_RSC_MEM_DESC rsc_spi_memory = {
 				{MEM_RANGE, sizeof(STM_RSC_MEM_DESC)},
@@ -31,13 +67,49 @@ static STM_RSC_MEM_DESC rsc_spi_memory = {
 				0x01000000,
 				FULL_ACCS};
 
+static STM_RSC_MEM_DESC rsc_ext_spi_memory = {
+				{MEM_RANGE, sizeof(STM_RSC_MEM_DESC)},
+				CONFIG_EXT_BIOS_WIN_BASE,
+				CONFIG_EXT_BIOS_WIN_SIZE,
+				FULL_ACCS};
+
+// P2SB
+#if CONFIG(SOC_INTEL_COMMON_BLOCK_P2SB)
+static STM_RSC_MMIO_DESC rsc_p2sb_mmio = {{MMIO_RANGE, sizeof(STM_RSC_MMIO_DESC)},
+					   P2SB_BAR,
+					   P2SB_SIZE, // Length
+					   RDWR_ACCS};
+#endif
+
+#if CONFIG(SOC_INTEL_COMMON_BLOCK_P2SB2)
+static STM_RSC_MMIO_DESC rsc_p2sb2_mmio = {{MMIO_RANGE, sizeof(STM_RSC_MMIO_DESC)},
+					   P2SB2_BAR,
+					   P2SB2_SIZE, // Length
+					   RDWR_ACCS};
+#endif
+
+#if CONFIG(SOC_INTEL_COMMON_BLOCK_IOE_P2SB)
+static STM_RSC_MMIO_DESC rsc_ioe_p2sb_mmio = {{MMIO_RANGE, sizeof(STM_RSC_MMIO_DESC)},
+					      IOE_P2SB_BAR,
+					      IOE_P2SB_SIZE, // Length
+					      RDWR_ACCS};
+#endif
+
 // ACPI
 static STM_RSC_IO_DESC rsc_pm_io = {{IO_RANGE, sizeof(STM_RSC_IO_DESC)}, 0, 128};
 
+// PCI IO
+static STM_RSC_IO_DESC rsc_pci_io = {{IO_RANGE, sizeof(STM_RSC_IO_DESC)},
+				     PCI_IO_CONFIG_INDEX, PCI_IO_CONFIG_PORT_COUNT};
+
+// UART
+static STM_RSC_IO_DESC rsc_uart_io = {{IO_RANGE, sizeof(STM_RSC_IO_DESC)}, 0, 8};
+static STM_RSC_IO_DESC rsc_uart_mmio = {{MMIO_RANGE, sizeof(STM_RSC_IO_DESC)}, 0, 8, RDWR_ACCS};
+
 // PCIE MMIO
 static STM_RSC_MMIO_DESC rsc_pcie_mmio = {{MMIO_RANGE, sizeof(STM_RSC_MMIO_DESC)},
-				   0,
-				   0, // Length
+				   CONFIG_ECAM_MMCONF_BASE_ADDRESS,
+				   CONFIG_ECAM_MMCONF_LENGTH, // Length
 				   RDWR_ACCS};
 
 // Local APIC
@@ -52,6 +124,18 @@ static STM_RSC_TRAPPED_IO_DESC rsc_sw_smi_trap_io = {
 				0xB2,
 				2};
 
+// SPI MMIO
+static STM_RSC_MMIO_DESC rsc_spi_mmio = {{MMIO_RANGE, sizeof(STM_RSC_MMIO_DESC)},
+				0,
+				0x1000, // Length
+				RDWR_ACCS};
+
+// TXT MMIO
+static STM_RSC_MMIO_DESC rsc_txt_mmio = {{MMIO_RANGE, sizeof(STM_RSC_MMIO_DESC)},
+				TXT_PRIVATE_SPACE,
+				0x20000, // Length
+				RDWR_ACCS};
+
 // End of list
 static STM_RSC_END rsc_list_end __attribute__((used)) = {
 			{END_OF_RESOURCES, sizeof(STM_RSC_END)}, 0};
@@ -73,6 +157,21 @@ STM_RSC_PCI_CFG_DESC rsc_lpc_bridge_pci = {
 	},
 };
 
+// SPI controller
+STM_RSC_PCI_CFG_DESC rsc_spi_pci = {
+	{PCI_CFG_RANGE, sizeof(STM_RSC_PCI_CFG_DESC)},
+	RDWR_ACCS,
+	0,
+	0,
+	0x1000,
+	0,
+	0,
+	{
+		{1, 1, sizeof(STM_PCI_DEVICE_PATH_NODE), SPI_FUNCTION,
+		 LPC_DEVICE},
+	},
+};
+
 // Template for MSR resources.
 STM_RSC_MSR_DESC rsc_msr_tpl = {
 	{MACHINE_SPECIFIC_REG, sizeof(STM_RSC_MSR_DESC)},
@@ -90,16 +189,60 @@ MSR_TABLE_ENTRY msr_table[] = {
 	// MASK64 means need access, MASK0 means no need access.
 	{SMRR_PHYSBASE_MSR, MASK64, MASK0},
 	{SMRR_PHYSMASK_MSR, MASK64, MASK0},
+#if !CONFIG(SOC_INTEL_COMMON_BLOCK_SMM_NO_MSR_SPCL_CHIPSET_USAGE)
+	{MSR_SPCL_CHIPSET_USAGE, MASK64, BIT(0)},
+#endif
 };
 
-/*
- *  Fix up PCIE resource.
- */
-static void fixup_pciex_resource(void)
+static int fixup_cbmem_resource(uint32_t cbmem_id, uint64_t *base, uint64_t *length)
+{
+	const struct cbmem_entry *e;
+
+	e = cbmem_entry_find(cbmem_id);
+	if (!e)
+		return -1;
+
+	*base = (uintptr_t)cbmem_entry_start(e);
+	*length = cbmem_entry_size(e);
+
+	return 0;
+}
+
+static int add_fast_spi_resource(void)
 {
-	// Find max bus number and PCIEX length
-	rsc_pcie_mmio.length = CONFIG_ECAM_MMCONF_LENGTH; // 0x10000000;// 256 MB
-	rsc_pcie_mmio.base = CONFIG_ECAM_MMCONF_BASE_ADDRESS;
+	int Status = 0;
+
+	rsc_spi_mmio.base = (uintptr_t)fast_spi_get_bar();
+
+	Status |= add_pi_resource((void *)&rsc_spi_mmio, 1);
+	Status |= add_pi_resource((void *)&rsc_spi_pci, 1);
+
+	if (CONFIG(FAST_SPI_SUPPORTS_EXT_BIOS_WINDOW))
+		Status |= add_pi_resource((void *)&rsc_ext_spi_memory, 1);
+
+	return Status;
+}
+
+static int add_smm_debug_resource(void)
+{
+	int Status = 0;
+
+	if (CONFIG(CONSOLE_CBMEM) &&
+		!fixup_cbmem_resource(CBMEM_ID_CONSOLE,
+					&rsc_cbmemc_memory.base,
+					&rsc_cbmemc_memory.length)) {
+		Status |= add_pi_resource((void *)&rsc_cbmemc_memory, 1);
+	}
+
+	if (CONFIG(CONSOLE_SERIAL) && CONFIG(DRIVERS_UART_8250IO)) {
+		Status |= add_pi_resource((void *)&rsc_uart_io, 1);
+	} else if (CONFIG(CONSOLE_SERIAL) && CONFIG(DRIVERS_UART_8250IO)) {
+		rsc_uart_mmio.base = uart_platform_base(CONFIG_UART_FOR_CONSOLE);
+		if (rsc_uart_mmio.base != 0)
+			Status |= add_pi_resource((void *)&rsc_uart_mmio, 1);
+	}
+
+	return Status;
 }
 
 /*
@@ -126,19 +269,49 @@ static void add_simple_resources(void)
 	rsc_apic_mmio.base = ((uint64_t)ReadMsr.lo & 0xFFFFF000) |
 				((uint64_t)(ReadMsr.hi & 0x0000000F) << 32);
 
-	// PCIEX BAR
-	fixup_pciex_resource();
-
 	Status |= add_pi_resource((void *)&rsc_tseg_memory, 1);
 	Status |= add_pi_resource((void *)&rsc_spi_memory, 1);
 
 	Status |= add_pi_resource((void *)&rsc_pm_io, 1);
+	Status |= add_pi_resource((void *)&rsc_pci_io, 1);
 	Status |= add_pi_resource((void *)&rsc_pcie_mmio, 1);
 	Status |= add_pi_resource((void *)&rsc_apic_mmio, 1);
+	Status |= add_pi_resource((void *)&rsc_txt_mmio, 1);
 	Status |= add_pi_resource((void *)&rsc_sw_smi_trap_io, 1);
 
 	Status |= add_pi_resource((void *)&rsc_lpc_bridge_pci, 1);
 
+#if CONFIG(SOC_INTEL_COMMON_BLOCK_P2SB)
+	Status |= add_pi_resource((void *)&rsc_p2sb_mmio, 1);
+#endif
+#if CONFIG(SOC_INTEL_COMMON_BLOCK_P2SB2)
+	Status |= add_pi_resource((void *)&rsc_p2sb2_mmio, 1);
+#endif
+#if CONFIG(SOC_INTEL_COMMON_BLOCK_IOE_P2SB)
+	Status |= add_pi_resource((void *)&rsc_ioe_p2sb_mmio, 1);
+#endif
+
+	/* FIXME: Handle SOUTHBRIDGE_INTEL_COMMON_SPI */
+	if (CONFIG(SOC_INTEL_COMMON_BLOCK_FAST_SPI))
+		Status |= add_fast_spi_resource();
+
+	if (CONFIG(SMMSTORE_V2) &&
+	    !fixup_cbmem_resource(CBMEM_ID_SMM_COMBUFFER,
+				  &rsc_smmstore_comm_buffer_memory.base,
+				  &rsc_smmstore_comm_buffer_memory.length)) {
+		Status |= add_pi_resource((void *)&rsc_smmstore_comm_buffer_memory, 1);
+	}
+
+	if (CONFIG(TPM_PPI_UEFIVAR_BACKED) &&
+	    !fixup_cbmem_resource(CBMEM_ID_TPM_PPI,
+				  &rsc_tpm_ppi_memory.base,
+				  &rsc_tpm_ppi_memory.length)) {
+		Status |= add_pi_resource((void *)&rsc_tpm_ppi_memory, 1);
+	}
+
+	if (CONFIG(DEBUG_SMI))
+		Status |= add_smm_debug_resource();
+
 	if (Status != 0)
 		printk(BIOS_DEBUG, "STM - Error in adding simple resources\n");
 }
@@ -163,10 +336,14 @@ static void add_msr_resources(void)
 		printk(BIOS_DEBUG, "STM - Error in adding MSR resources\n");
 }
 
+__weak int mainboard_stm_add_resources(void)
+{
+	return 0;
+}
+
 /*
  * Add resources to BIOS resource database.
  */
-
 extern uint8_t *m_stm_resources_ptr;
 
 void add_resources_cmd(void)
@@ -176,4 +353,7 @@ void add_resources_cmd(void)
 	add_simple_resources();
 
 	add_msr_resources();
+
+	if (mainboard_stm_add_resources() != 0)
+		printk(BIOS_DEBUG, "STM - Error in adding mainboard resources\n");
 }
diff --git a/src/security/intel/stm/StmPlatformResource.h b/src/security/intel/stm/StmPlatformResource.h
index eaadab739eb..99a2bce3195 100644
--- a/src/security/intel/stm/StmPlatformResource.h
+++ b/src/security/intel/stm/StmPlatformResource.h
@@ -10,6 +10,7 @@
 
 #define LPC_DEVICE 31
 #define LPC_FUNCTION 0
+#define SPI_FUNCTION 5
 #define R_ACPI_PM_BASE 0x40
 #define ACPI_PM_BASE_MASK 0xFFF8
 
@@ -17,4 +18,6 @@
  *  Add resources to BIOS resource database.
  */
 void add_resources_cmd(void);
+int mainboard_stm_add_resources(void);
+
 #endif

From 4355ced2187fe191d663a6c5e7929b337091b55b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20=C5=BBygowski?= <michal.zygowski@3mdeb.com>
Date: Thu, 6 Aug 2026 13:14:51 +0200
Subject: [PATCH 13/22] soc/intel/common/block/fast_spi: Do not reallocate SPI
 MMIO
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Do not reallocate SPI MMIO. SPI MMIO base is needed for flash access
in SMM, so STM needs to know the location of SPI registers. However,
STM is loaded before coreboot allocator runs on FSP platforms. So it is
not possible to provide correct SPI MMIO base address to STM.

To workaround that problem, report the SPI MMIO as fixed resource, so
that coreboot does not move it.

Upstream-Status: Pending
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
---
 src/soc/intel/common/block/fast_spi/fast_spi.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/src/soc/intel/common/block/fast_spi/fast_spi.c b/src/soc/intel/common/block/fast_spi/fast_spi.c
index 8757850b6f4..2ce5851bf59 100644
--- a/src/soc/intel/common/block/fast_spi/fast_spi.c
+++ b/src/soc/intel/common/block/fast_spi/fast_spi.c
@@ -549,9 +549,22 @@ static void fast_spi_fill_ssdt(const struct device *dev)
 
 static void fast_spi_read_resources(struct device *dev)
 {
+	uintptr_t spi_bar = (uintptr_t)fast_spi_get_bar();
+
 	/* Read standard PCI resources. */
 	pci_dev_read_resources(dev);
 
+	/*
+	 * Do not move the SPI MMIO. Otherwise it will be impossible to pass
+	 * correct base address to STM, because CPU init with STM loading
+	 * happens before resource allocation in coreboot on FSP platforms.
+	 */
+	struct resource *res = probe_resource(dev, PCI_BASE_ADDRESS_0);
+	if (CONFIG(STM) && res && (spi_bar != 0)) {
+		res->base = spi_bar;
+		res->flags |= IORESOURCE_FIXED;
+	}
+
 	/* Add SPI flash MMIO window as a reserved resource. */
 	mmio_range(dev, 0, FLASH_BASE_ADDR, FLASH_MMIO_SIZE);
 	/* Add extended SPI flash MMIO window as reserved resource if enabled. */

From 5da72077c2420b03fa7fbcf656c047640fc99ac9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20=C5=BBygowski?= <michal.zygowski@3mdeb.com>
Date: Thu, 6 Aug 2026 12:23:30 +0200
Subject: [PATCH 14/22] mb/msi/ms7d25,ms7e06: Add board-specific STM resources
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Describe resource specific to the mainboard that are used by
board's SMI handlers.

Upstream-Status: Pending
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
---
 src/mainboard/msi/ms7d25/Makefile.mk |  1 +
 src/mainboard/msi/ms7d25/stm.c       | 21 +++++++++++++++++++++
 src/mainboard/msi/ms7e06/Makefile.mk |  1 +
 src/mainboard/msi/ms7e06/stm.c       | 21 +++++++++++++++++++++
 4 files changed, 44 insertions(+)
 create mode 100644 src/mainboard/msi/ms7d25/stm.c
 create mode 100644 src/mainboard/msi/ms7e06/stm.c

diff --git a/src/mainboard/msi/ms7d25/Makefile.mk b/src/mainboard/msi/ms7d25/Makefile.mk
index 6b9791768ac..8f444768b00 100644
--- a/src/mainboard/msi/ms7d25/Makefile.mk
+++ b/src/mainboard/msi/ms7d25/Makefile.mk
@@ -8,6 +8,7 @@ romstage-y += romstage_fsp_params.c
 
 ramstage-y += mainboard.c
 ramstage-y += smbios.c
+ramstage-$(CONFIG_STM) += stm.c
 
 all-y += die.c
 smm-y += die.c
diff --git a/src/mainboard/msi/ms7d25/stm.c b/src/mainboard/msi/ms7d25/stm.c
new file mode 100644
index 00000000000..836a52ea784
--- /dev/null
+++ b/src/mainboard/msi/ms7d25/stm.c
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+#include <security/intel/stm/SmmStm.h>
+#include <security/intel/stm/StmPlatformResource.h>
+
+// Nuvoton SIO resources
+static STM_RSC_IO_DESC rsc_sio_io = {{IO_RANGE, sizeof(STM_RSC_IO_DESC)},
+				     0x4e, 2};
+
+static STM_RSC_IO_DESC rsc_hwm_io = {{IO_RANGE, sizeof(STM_RSC_IO_DESC)},
+				     0xa20, 8};
+
+int mainboard_stm_add_resources(void)
+{
+	int Status = 0;
+
+	Status |= add_pi_resource((void *)&rsc_sio_io, 1);
+	Status |= add_pi_resource((void *)&rsc_hwm_io, 1);
+
+	return Status;
+}
diff --git a/src/mainboard/msi/ms7e06/Makefile.mk b/src/mainboard/msi/ms7e06/Makefile.mk
index cc0df70e7bd..364196ef067 100644
--- a/src/mainboard/msi/ms7e06/Makefile.mk
+++ b/src/mainboard/msi/ms7e06/Makefile.mk
@@ -9,6 +9,7 @@ romstage-y += romstage_fsp_params.c
 
 ramstage-y += mainboard.c
 ramstage-y += smbios.c
+ramstage-$(CONFIG_STM) += stm.c
 
 all-y += die.c
 smm-y += die.c
diff --git a/src/mainboard/msi/ms7e06/stm.c b/src/mainboard/msi/ms7e06/stm.c
new file mode 100644
index 00000000000..836a52ea784
--- /dev/null
+++ b/src/mainboard/msi/ms7e06/stm.c
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+#include <security/intel/stm/SmmStm.h>
+#include <security/intel/stm/StmPlatformResource.h>
+
+// Nuvoton SIO resources
+static STM_RSC_IO_DESC rsc_sio_io = {{IO_RANGE, sizeof(STM_RSC_IO_DESC)},
+				     0x4e, 2};
+
+static STM_RSC_IO_DESC rsc_hwm_io = {{IO_RANGE, sizeof(STM_RSC_IO_DESC)},
+				     0xa20, 8};
+
+int mainboard_stm_add_resources(void)
+{
+	int Status = 0;
+
+	Status |= add_pi_resource((void *)&rsc_sio_io, 1);
+	Status |= add_pi_resource((void *)&rsc_hwm_io, 1);
+
+	return Status;
+}

From 2c9c8e082cccefb44a1869a81bead1a79cee9bf4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20=C5=BBygowski?= <michal.zygowski@3mdeb.com>
Date: Thu, 6 Aug 2026 15:12:21 +0200
Subject: [PATCH 15/22] security/intel/stm/Kconfig: Fix checks on TTYS0_BASE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix check of TTYS0_BASE to allwo debug builds when serial port
base is set for STM.

Upstream-Status: Pending
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
---
 src/security/intel/stm/Kconfig | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/security/intel/stm/Kconfig b/src/security/intel/stm/Kconfig
index 8f1774896ea..6851d65be7a 100644
--- a/src/security/intel/stm/Kconfig
+++ b/src/security/intel/stm/Kconfig
@@ -89,7 +89,7 @@ config STM_HEAPSIZE
 
 config STM_TTYS0_BASE
 	hex "stm uart"
-	default TTYS0_BASE if TTYS0_BASE
+	default TTYS0_BASE if TTYS0_BASE != 0x0
 	default 0x000
 	help
 	  Defines the serial port for STM console output.  0x000 indicates
@@ -107,7 +107,7 @@ choice
 
 config STM_CONSOLE_DEBUG
 	bool "Debug output"
-	depends on STM_CBMEM_CONSOLE || STM_TTYS0_BASE
+	depends on STM_CBMEM_CONSOLE || STM_TTYS0_BASE != 0x0
 	help
 	  "Produces all STM console output"
 

From 1adf8437451a4de82f893d29bfd9c9acb7a6d3b1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20=C5=BBygowski?= <michal.zygowski@3mdeb.com>
Date: Thu, 6 Aug 2026 15:30:45 +0200
Subject: [PATCH 16/22] sb/intel,soc/intel: Set smram_to_vmcs_restore_required
 when STM enabled
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signal STM to propagate SMRAM save state changes back to the
interrupted guest VMCS on RSM. Required for return values written to
EAX (e.g. SMMSTORE result) to be visible in OS context after RSM.
Without this bit set, ReadSyncSmmStateSaveArea() in the STM runtime
skips the sync entirely, so the guest sees stale pre-SMI register
values instead of the handler's return code.

TEST=Use efibootmgr to set timeout in Linux with STM launched by
stm_linux_module on MSI PRO Z790-P.

Upstream-Status: Pending
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
---
 src/cpu/x86/smm/smm_module_handler.c         | 19 +++++++++++++++++++
 src/include/cpu/x86/smm.h                    |  6 ++++++
 src/soc/intel/baytrail/smihandler.c          |  4 ++++
 src/soc/intel/braswell/smihandler.c          |  4 ++++
 src/soc/intel/broadwell/pch/smihandler.c     |  4 ++++
 src/soc/intel/common/block/smm/smihandler.c  |  6 ++++++
 src/soc/intel/denverton_ns/smihandler.c      |  4 ++++
 src/southbridge/intel/common/smihandler.c    |  4 ++++
 src/southbridge/intel/lynxpoint/smihandler.c |  4 ++++
 9 files changed, 55 insertions(+)

diff --git a/src/cpu/x86/smm/smm_module_handler.c b/src/cpu/x86/smm/smm_module_handler.c
index d9f64204d6d..68e3870577d 100644
--- a/src/cpu/x86/smm/smm_module_handler.c
+++ b/src/cpu/x86/smm/smm_module_handler.c
@@ -130,6 +130,25 @@ bool smm_region_overlaps_handler(const struct region *r)
 	return region_overlap(&r_smm, r) || region_overlap(&r_aseg, r);
 }
 
+void smm_stm_restore_smram_to_vmcs(void *smm_save_state)
+{
+	if (!CONFIG(STM))
+		return;
+
+	/*
+	 * Signal STM to propagate SMRAM save state changes back to the
+	 * interrupted guest VMCS on RSM. Required for return values written to
+	 * EAX (e.g. SMMSTORE result) to be visible in OS context after RSM.
+	 * Without this bit set, ReadSyncSmmStateSaveArea() in the STM runtime
+	 * skips the sync entirely, so the guest sees stale pre-SMI register
+	 * values instead of the handler's return code.
+	 */
+	TXT_PROCESSOR_SMM_DESCRIPTOR *psd =
+		(TXT_PROCESSOR_SMM_DESCRIPTOR *)
+		((uintptr_t)smm_save_state - STM_PSD_SIZE);
+	psd->smm_resume_state.smram_to_vmcs_restore_required = 1;
+}
+
 asmlinkage void smm_handler_start(void *arg)
 {
 	const struct smm_module_params *p;
diff --git a/src/include/cpu/x86/smm.h b/src/include/cpu/x86/smm.h
index 948c9ccef22..bbe537506f4 100644
--- a/src/include/cpu/x86/smm.h
+++ b/src/include/cpu/x86/smm.h
@@ -141,6 +141,12 @@ void *smm_get_save_state(int cpu);
 /* Returns true if the region overlaps with the SMM */
 bool smm_region_overlaps_handler(const struct region *r);
 
+/*
+ * Sets the bit to restore modified SMRAM to VMCS when STM is enabled.
+ * Requird to be called by all SMI handler that modify save state.
+ */
+void smm_stm_restore_smram_to_vmcs(void *smm_save_state);
+
 /* Returns true if the memory pointed to overlaps with SMM reserved memory. */
 static inline bool smm_points_to_smram(const void *ptr, const size_t len)
 {
diff --git a/src/soc/intel/baytrail/smihandler.c b/src/soc/intel/baytrail/smihandler.c
index 9fcd6621f94..f2cb3962977 100644
--- a/src/soc/intel/baytrail/smihandler.c
+++ b/src/soc/intel/baytrail/smihandler.c
@@ -266,6 +266,8 @@ static void southbridge_smi_store(void)
 	/* drivers/smmstore/smi.c */
 	ret = smmstore_exec(sub_command, (void *)reg_ebx);
 	io_smi->rax = ret;
+
+	smm_stm_restore_smram_to_vmcs(io_smi);
 }
 
 static void southbridge_smi_tpm_ppi(void)
@@ -282,6 +284,8 @@ static void southbridge_smi_tpm_ppi(void)
 	/* drivers/tpm/ppi_smm.c */
 	tpm_ppi_process_request_smm(reg_ebx);
 	io_smi->rax = 0;
+
+	smm_stm_restore_smram_to_vmcs(io_smi);
 }
 
 static void southbridge_smi_apmc(void)
diff --git a/src/soc/intel/braswell/smihandler.c b/src/soc/intel/braswell/smihandler.c
index 24b10e49cee..9ffa54e14d3 100644
--- a/src/soc/intel/braswell/smihandler.c
+++ b/src/soc/intel/braswell/smihandler.c
@@ -239,6 +239,8 @@ static void southbridge_smi_store(void)
 	/* drivers/smmstore/smi.c */
 	ret = smmstore_exec(sub_command, (void *)reg_ebx);
 	io_smi->rax = ret;
+
+	smm_stm_restore_smram_to_vmcs(io_smi);
 }
 
 static void southbridge_smi_tpm_ppi(void)
@@ -255,6 +257,8 @@ static void southbridge_smi_tpm_ppi(void)
 	/* drivers/tpm/ppi_smm.c */
 	tpm_ppi_process_request_smm(reg_ebx);
 	io_smi->rax = 0;
+
+	smm_stm_restore_smram_to_vmcs(io_smi);
 }
 
 static void southbridge_smi_apmc(void)
diff --git a/src/soc/intel/broadwell/pch/smihandler.c b/src/soc/intel/broadwell/pch/smihandler.c
index 940f0d5ce5d..533d0f43f2f 100644
--- a/src/soc/intel/broadwell/pch/smihandler.c
+++ b/src/soc/intel/broadwell/pch/smihandler.c
@@ -293,6 +293,8 @@ static void southbridge_smi_store(void)
 	/* drivers/smmstore/smi.c */
 	ret = smmstore_exec(sub_command, (void *)reg_ebx);
 	io_smi->rax = ret;
+
+	smm_stm_restore_smram_to_vmcs(io_smi);
 }
 
 static void southbridge_smi_tpm_ppi(void)
@@ -309,6 +311,8 @@ static void southbridge_smi_tpm_ppi(void)
 	/* drivers/tpm/ppi_smm.c */
 	tpm_ppi_process_request_smm(reg_ebx);
 	io_smi->rax = 0;
+
+	smm_stm_restore_smram_to_vmcs(io_smi);
 }
 
 static void southbridge_smi_apmc(void)
diff --git a/src/soc/intel/common/block/smm/smihandler.c b/src/soc/intel/common/block/smm/smihandler.c
index 7abea21b542..4609587bc21 100644
--- a/src/soc/intel/common/block/smm/smihandler.c
+++ b/src/soc/intel/common/block/smm/smihandler.c
@@ -33,6 +33,9 @@
 #include <soc/smbus.h>
 #include <spi-generic.h>
 #include <stdint.h>
+#if CONFIG(STM)
+#include <security/intel/stm/StmApi.h>
+#endif
 
 /* SoC overrides. */
 
@@ -266,6 +269,7 @@ static void southbridge_smi_gsmi(
 	/* drivers/elog/gsmi.c */
 	ret = gsmi_exec(sub_command, &reg_ebx);
 	save_state_ops->set_reg(io_smi, RAX, ret);
+	smm_stm_restore_smram_to_vmcs(io_smi);
 }
 
 static void set_insmm_sts(const bool enable_writes)
@@ -314,6 +318,7 @@ static void southbridge_smi_store(
 	/* drivers/smmstore/smi.c */
 	ret = smmstore_exec(sub_command, (void *)(uintptr_t)reg_ebx);
 	save_state_ops->set_reg(io_smi, RAX, ret);
+	smm_stm_restore_smram_to_vmcs(io_smi);
 
 	if (wp_enabled) {
 		fast_spi_enable_wp();
@@ -349,6 +354,7 @@ static void southbridge_smi_tpm_ppi(
 	/* drivers/tpm/ppi_smm.c */
 	tpm_ppi_process_request_smm(reg_ebx);
 	save_state_ops->set_reg(io_smi, RAX, 0);
+	smm_stm_restore_smram_to_vmcs(io_smi);
 
 	if (wp_enabled) {
 		fast_spi_enable_wp();
diff --git a/src/soc/intel/denverton_ns/smihandler.c b/src/soc/intel/denverton_ns/smihandler.c
index 835a614e16e..2d4b3374f61 100644
--- a/src/soc/intel/denverton_ns/smihandler.c
+++ b/src/soc/intel/denverton_ns/smihandler.c
@@ -200,6 +200,8 @@ static void southbridge_smi_store(void)
 	/* drivers/smmstore/smi.c */
 	ret = smmstore_exec(sub_command, (void *)reg_ebx);
 	io_smi->rax = ret;
+
+	smm_stm_restore_smram_to_vmcs(io_smi);
 }
 
 static void southbridge_smi_tpm_ppi(void)
@@ -216,6 +218,8 @@ static void southbridge_smi_tpm_ppi(void)
 	/* drivers/tpm/ppi_smm.c */
 	tpm_ppi_process_request_smm(reg_ebx);
 	io_smi->rax = 0;
+
+	smm_stm_restore_smram_to_vmcs(io_smi);
 }
 
 static void southbridge_smi_apmc(void)
diff --git a/src/southbridge/intel/common/smihandler.c b/src/southbridge/intel/common/smihandler.c
index ee596d54e78..a5eca3e8f5a 100644
--- a/src/southbridge/intel/common/smihandler.c
+++ b/src/southbridge/intel/common/smihandler.c
@@ -293,6 +293,8 @@ static void southbridge_smi_store(void)
 	ret = smmstore_exec(sub_command, (void *)reg_rbx);
 	io_smi->rax = ret;
 
+	smm_stm_restore_smram_to_vmcs(io_smi);
+
 	if (wp_enabled)
 		spi_set_wp(true);
 }
@@ -318,6 +320,8 @@ static void southbridge_smi_tpm_ppi(void)
 	tpm_ppi_process_request_smm(reg_rbx);
 	io_smi->rax = 0;
 
+	smm_stm_restore_smram_to_vmcs(io_smi);
+
 	if (wp_enabled)
 		spi_set_wp(true);
 }
diff --git a/src/southbridge/intel/lynxpoint/smihandler.c b/src/southbridge/intel/lynxpoint/smihandler.c
index 4dfa48993da..9db69299a63 100644
--- a/src/southbridge/intel/lynxpoint/smihandler.c
+++ b/src/southbridge/intel/lynxpoint/smihandler.c
@@ -242,6 +242,8 @@ static void southbridge_smi_store(void)
 	/* drivers/smmstore/smi.c */
 	ret = smmstore_exec(sub_command, (void *)reg_ebx);
 	io_smi->rax = ret;
+
+	smm_stm_restore_smram_to_vmcs(io_smi);
 }
 
 static void southbridge_smi_tpm_ppi(void)
@@ -265,6 +267,8 @@ static void southbridge_smi_tpm_ppi(void)
 	tpm_ppi_process_request_smm(reg_rbx);
 	io_smi->rax = 0;
 
+	smm_stm_restore_smram_to_vmcs(io_smi);
+
 	if (wp_enabled)
 		spi_set_wp(true);
 }

From 44136a65afb367a0713efc2ab463148af404c26d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20=C5=BBygowski?= <michal.zygowski@3mdeb.com>
Date: Fri, 7 Aug 2026 11:50:58 +0200
Subject: [PATCH 17/22] payloads/external/edk2/Makefile: Use coreboot toolchain
 instead of host GCC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use coreboot's toolchain instead of host GCC to ensure reproducibility.

Upstream-Status: Pending
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
---
 payloads/external/Makefile.mk   | 24 ++++++++----------------
 payloads/external/edk2/Makefile | 10 +++++++++-
 2 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/payloads/external/Makefile.mk b/payloads/external/Makefile.mk
index 1fd46312b06..b711919d347 100644
--- a/payloads/external/Makefile.mk
+++ b/payloads/external/Makefile.mk
@@ -213,14 +213,10 @@ $(obj)/UEFIPAYLOAD.fd: $(DOTCONFIG) $(IPXE_EFI)
 		CONFIG_SOC_AMD_COMMON_BLOCK_PSP_GEN2=$(CONFIG_SOC_AMD_COMMON_BLOCK_PSP_GEN2) \
 		CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=$(CONFIG_DRIVERS_EFI_UPDATE_CAPSULES) \
 		CONFIG_DRIVERS_EFI_MAIN_FW_GUID=$(CONFIG_DRIVERS_EFI_MAIN_FW_GUID) \
-		GCC_CC_x86_32=$(GCC_CC_x86_32) \
-		GCC_CC_x86_64=$(GCC_CC_x86_64) \
-		GCC_CC_arm=$(GCC_CC_arm) \
-		GCC_CC_arm64=$(GCC_CC_arm64) \
-		OBJCOPY_x86_32=$(OBJCOPY_x86_32) \
-		OBJCOPY_x86_64=$(OBJCOPY_x86_64) \
-		OBJCOPY_arm=$(OBJCOPY_arm) \
-		OBJCOPY_arm64=$(OBJCOPY_arm64) \
+		GCC_IA32_PREFIX=$(patsubst %gcc,%,$(GCC_CC_x86_32)) \
+		GCC_X64_PREFIX=$(patsubst %gcc,%,$(GCC_CC_x86_64)) \
+		GCC_ARM_PREFIX=$(patsubst %gcc,%,$(GCC_CC_arm)) \
+		GCC_AARCH64_PREFIX=$(patsubst %gcc,%,$(GCC_CC_arm64)) \
 		MFLAGS= MAKEFLAGS= \
 		CONFIG_EDK2_ABOVE_4G_MEMORY=$(CONFIG_EDK2_ABOVE_4G_MEMORY) \
 		CONFIG_EDK2_BATTERY_CONFIG_OPTION=$(CONFIG_EDK2_BATTERY_CONFIG_OPTION) \
@@ -342,14 +338,10 @@ $(obj)/ShimmedUniversalPayload.elf: $(DOTCONFIG)
 		CONFIG_ECAM_MMCONF_LENGTH=$(CONFIG_ECAM_MMCONF_LENGTH) \
 		CONFIG_CPU_XTAL_HZ=$(CONFIG_CPU_XTAL_HZ) \
 		CONFIG_SMMSTORE_V2=$(CONFIG_SMMSTORE_V2) \
-		GCC_CC_x86_32=$(GCC_CC_x86_32) \
-		GCC_CC_x86_64=$(GCC_CC_x86_64) \
-		GCC_CC_arm=$(GCC_CC_arm) \
-		GCC_CC_arm64=$(GCC_CC_arm64) \
-		OBJCOPY_x86_32=$(OBJCOPY_x86_32) \
-		OBJCOPY_x86_64=$(OBJCOPY_x86_64) \
-		OBJCOPY_arm=$(OBJCOPY_arm) \
-		OBJCOPY_arm64=$(OBJCOPY_arm64) \
+		GCC_IA32_PREFIX=$(patsubst %gcc,%,$(GCC_CC_x86_32)) \
+		GCC_X64_PREFIX=$(patsubst %gcc,%,$(GCC_CC_x86_64)) \
+		GCC_ARM_PREFIX=$(patsubst %gcc,%,$(GCC_CC_arm)) \
+		GCC_AARCH64_PREFIX=$(patsubst %gcc,%,$(GCC_CC_arm64)) \
 		MFLAGS= MAKEFLAGS=
 
 # FILO
diff --git a/payloads/external/edk2/Makefile b/payloads/external/edk2/Makefile
index cb1718d14fa..95607858076 100644
--- a/payloads/external/edk2/Makefile
+++ b/payloads/external/edk2/Makefile
@@ -25,7 +25,15 @@ else
 export PACKAGES_PATH := $(EDK2_PATH)
 endif
 
-OBJCOPY = $(GCC_PREFIX)objcopy
+OBJCOPY = $(GCC_IA32_PREFIX)objcopy
+
+export GCC_IA32_PREFIX
+export GCC_X64_PREFIX
+export GCC_ARM_PREFIX
+export GCC_AARCH64_PREFIX
+# tools_def.txt maps GCC_IA32_PREFIX and GCC_X64_PREFIX both to ENV(GCC_BIN).
+# Use the X64 prefix as GCC_BIN since x86_64-elf-gcc handles IA32 (-m32) too.
+export GCC_BIN := $(GCC_X64_PREFIX)
 
 PAYLOAD_NAME=DasharoPayloadPkg
 

From 12532bec1beae44cc323e6cd349cbcd017919764 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20=C5=BBygowski?= <michal.zygowski@3mdeb.com>
Date: Fri, 7 Aug 2026 12:36:30 +0200
Subject: [PATCH 18/22] security/intel/stm: Build STM with coreboot toolchain
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add necessary parameters to Cmake to use coreboot's toolchain to
compile STM.

Now that STM is built with coreboot toolchain, the reproducibility
warning can be removed.

Upstream-Status: Pending
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
---
 src/security/intel/stm/Makefile    | 14 ++++++++++++--
 src/security/intel/stm/Makefile.mk |  4 +++-
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/src/security/intel/stm/Makefile b/src/security/intel/stm/Makefile
index 31e5bdd88aa..207355e3951 100644
--- a/src/security/intel/stm/Makefile
+++ b/src/security/intel/stm/Makefile
@@ -13,17 +13,27 @@ ifeq ($(CONFIG_STM_CONSOLE_RELEASE),y)
 STM_BUILD="release"
 endif
 
+# STM needs string.h, provide it from coreboot includes
+STM_COREBOOT_INC=-isystem $(top)/src/include
+STM_COREBOOT_INC+= -isystem $(top)/src/commonlib/include
+STM_COREBOOT_INC+= -isystem $(top)/src/commonlib/bsd/include
+# STM needs elf.h, provide it from cbfstool
+STM_COREBOOT_INC+= -isystem $(top)/util/cbfstool
 
 all: build
 
 build:
 	echo "STM - Build"
-	echo "--  WARNING: This uses the system toolchain instead of"
-	echo "    the coreboot toolchain, so is not reproducible."
 	cd $(project_dir)/Stm; \
 	mkdir -p build; \
 	cd build; \
 	cmake .. -DBIOS=coreboot \
+		-DCMAKE_SYSTEM_NAME=Generic \
+		-DCMAKE_TRY_COMPILE_TARGET_TYPE=STATIC_LIBRARY \
+		-DCMAKE_C_COMPILER=$(shell which $(GCC_CC_x86_64)) \
+		-DCMAKE_ASM_COMPILER=$(shell which $(GCC_CC_x86_64)) \
+		-DCMAKE_OBJCOPY=$(shell which $(OBJCOPY_x86_64)) \
+		-DCMAKE_C_FLAGS="$(STM_COREBOOT_INC)" \
 		-DUART=$(CONFIG_STM_TTYS0_BASE) \
 		-DHEAPSIZE=$(CONFIG_STM_HEAPSIZE) \
 		-DCBMEM_ENABLE=$(CONFIG_STM_CBMEM_CONSOLE) \
diff --git a/src/security/intel/stm/Makefile.mk b/src/security/intel/stm/Makefile.mk
index 94e5ea8070b..bab7354cc3a 100644
--- a/src/security/intel/stm/Makefile.mk
+++ b/src/security/intel/stm/Makefile.mk
@@ -19,4 +19,6 @@ ramstage-$(CONFIG_STM) += StmPlatformResource.c
 		CONFIG_STM_CONSOLE_RELEASE=$(CONFIG_STM_CONSOLE_RELEASE) \
 		CONFIG_STM_GIT_BRANCH=$(CONFIG_STM_GIT_BRANCH) \
 		CONFIG_STM_STMPE_ENABLED=$(CONFIG_STM_STMPE_ENABLED) \
-		CONFIG_STM_CBMEM_CONSOLE=$(CONFIG_STM_CBMEM_CONSOLE)
+		CONFIG_STM_CBMEM_CONSOLE=$(CONFIG_STM_CBMEM_CONSOLE) \
+		GCC_CC_x86_64=$(GCC_CC_x86_64) \
+		OBJCOPY_x86_64=$(OBJCOPY_x86_64)

From 3c5290dbe50c06efc0f2ebca065c9293fc0c1414 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20=C5=BBygowski?= <michal.zygowski@3mdeb.com>
Date: Fri, 7 Aug 2026 13:36:20 +0200
Subject: [PATCH 19/22] payloads/external/edk2/Kconfig.dasharo: Update EDK2
 default revision
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update EDK2 revision to include STM option.

Upstream-Status: Inappropriate [Dasharo downstream]
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
---
 payloads/external/edk2/Kconfig.dasharo | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/payloads/external/edk2/Kconfig.dasharo b/payloads/external/edk2/Kconfig.dasharo
index 23453d49228..2252e0a26f1 100644
--- a/payloads/external/edk2/Kconfig.dasharo
+++ b/payloads/external/edk2/Kconfig.dasharo
@@ -4,7 +4,7 @@ config EDK2_REPOSITORY
 	default "https://github.com/Dasharo/edk2"
 
 config EDK2_TAG_OR_REV
-	default "61ce35c29bb384240028d4319755b5759affbbe1"
+	default "6d5a8a9a6363e2b30657c4ee4d2088ec11356f0b"
 
 config EDK2_SYSTEM76_EC_LOGGING
 	bool "Enable edk2 logging to System76 EC"

From 3c62653af10417e7f92730ce8c1eeb28f3e471f7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20=C5=BBygowski?= <michal.zygowski@3mdeb.com>
Date: Fri, 7 Aug 2026 13:37:52 +0200
Subject: [PATCH 20/22] configs/config.msi_{ms7d25,ms7e06}: Enable STM by
 default
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Include STM in the builds by default. To allow the STM to print to
cbmem only, use 0xF0 as the serial port base. This port is unused
and prevents STM CMAKE files from selecting the default 0x3f8 base
for serial. Otherwise, one has to build a release version of STM
without debugging.

Upstream-Status: Inappropriate [custom configs]
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
---
 configs/config.msi_ms7d25_ddr4 | 4 ++++
 configs/config.msi_ms7d25_ddr5 | 4 ++++
 configs/config.msi_ms7e06_ddr4 | 4 ++++
 configs/config.msi_ms7e06_ddr5 | 4 ++++
 4 files changed, 16 insertions(+)

diff --git a/configs/config.msi_ms7d25_ddr4 b/configs/config.msi_ms7d25_ddr4
index a5ff6176b1f..b8f93aee7cb 100644
--- a/configs/config.msi_ms7d25_ddr4
+++ b/configs/config.msi_ms7d25_ddr4
@@ -40,6 +40,10 @@ CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x01010702
 CONFIG_DRIVERS_EFI_MAIN_FW_LSV=0x01010701
 CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=y
 CONFIG_TPM2=y
+CONFIG_STM=y
+CONFIG_STM_STMPE_ENABLED=y
+CONFIG_STM_TTYS0_BASE=0x0f0
+CONFIG_STM_CBMEM_CONSOLE=y
 CONFIG_BOOTMEDIA_LOCK_CONTROLLER=y
 CONFIG_BOOTMEDIA_LOCK_WPRO_VBOOT_RO=y
 CONFIG_BOOTMEDIA_LOCK_IN_VERSTAGE=y
diff --git a/configs/config.msi_ms7d25_ddr5 b/configs/config.msi_ms7d25_ddr5
index 6c1bcc96027..f34c3a66677 100644
--- a/configs/config.msi_ms7d25_ddr5
+++ b/configs/config.msi_ms7d25_ddr5
@@ -40,6 +40,10 @@ CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x01010702
 CONFIG_DRIVERS_EFI_MAIN_FW_LSV=0x01010701
 CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=y
 CONFIG_TPM2=y
+CONFIG_STM=y
+CONFIG_STM_STMPE_ENABLED=y
+CONFIG_STM_TTYS0_BASE=0x0f0
+CONFIG_STM_CBMEM_CONSOLE=y
 CONFIG_BOOTMEDIA_LOCK_CONTROLLER=y
 CONFIG_BOOTMEDIA_LOCK_WPRO_VBOOT_RO=y
 CONFIG_BOOTMEDIA_LOCK_IN_VERSTAGE=y
diff --git a/configs/config.msi_ms7e06_ddr4 b/configs/config.msi_ms7e06_ddr4
index 617d7979416..6efa6bc5e38 100644
--- a/configs/config.msi_ms7e06_ddr4
+++ b/configs/config.msi_ms7e06_ddr4
@@ -40,6 +40,10 @@ CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x00090502
 CONFIG_DRIVERS_EFI_MAIN_FW_LSV=0x00090501
 CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=y
 CONFIG_TPM2=y
+CONFIG_STM=y
+CONFIG_STM_STMPE_ENABLED=y
+CONFIG_STM_TTYS0_BASE=0x0f0
+CONFIG_STM_CBMEM_CONSOLE=y
 CONFIG_BOOTMEDIA_LOCK_CONTROLLER=y
 CONFIG_BOOTMEDIA_LOCK_WPRO_VBOOT_RO=y
 CONFIG_BOOTMEDIA_LOCK_IN_VERSTAGE=y
diff --git a/configs/config.msi_ms7e06_ddr5 b/configs/config.msi_ms7e06_ddr5
index 235699a483f..e2b04ee9281 100644
--- a/configs/config.msi_ms7e06_ddr5
+++ b/configs/config.msi_ms7e06_ddr5
@@ -40,6 +40,10 @@ CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x00090502
 CONFIG_DRIVERS_EFI_MAIN_FW_LSV=0x00090501
 CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=y
 CONFIG_TPM2=y
+CONFIG_STM=y
+CONFIG_STM_STMPE_ENABLED=y
+CONFIG_STM_TTYS0_BASE=0x0f0
+CONFIG_STM_CBMEM_CONSOLE=y
 CONFIG_BOOTMEDIA_LOCK_CONTROLLER=y
 CONFIG_BOOTMEDIA_LOCK_WPRO_VBOOT_RO=y
 CONFIG_BOOTMEDIA_LOCK_IN_VERSTAGE=y

From c34809f8a1ed0283d876974dd01b86890156e5be Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20=C5=BBygowski?= <michal.zygowski@3mdeb.com>
Date: Sat, 8 Aug 2026 16:51:09 +0200
Subject: [PATCH 21/22] configs/config.msi_ms7d25: Bump to v1.1.7-rc3
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Upstream-Status: Inappropriate [custom configs]
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
---
 configs/config.msi_ms7d25_ddr4 | 4 ++--
 configs/config.msi_ms7d25_ddr5 | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/configs/config.msi_ms7d25_ddr4 b/configs/config.msi_ms7d25_ddr4
index b8f93aee7cb..05c89eaa8e9 100644
--- a/configs/config.msi_ms7d25_ddr4
+++ b/configs/config.msi_ms7d25_ddr4
@@ -1,4 +1,4 @@
-CONFIG_LOCALVERSION="v1.1.7-rc2"
+CONFIG_LOCALVERSION="v1.1.7-rc3"
 CONFIG_OPTION_BACKEND_NONE=y
 CONFIG_SBOM=y
 CONFIG_SBOM_PAYLOAD=y
@@ -36,7 +36,7 @@ CONFIG_PCIEXP_LANE_ERR_STAT_CLEAR=y
 CONFIG_DRIVERS_EFI_VARIABLE_STORE=y
 CONFIG_DRIVERS_EFI_FW_INFO=y
 CONFIG_DRIVERS_EFI_MAIN_FW_GUID="0f3e8ba6-19d3-461b-bbbc-8b5689fe8097"
-CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x01010702
+CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x01010703
 CONFIG_DRIVERS_EFI_MAIN_FW_LSV=0x01010701
 CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=y
 CONFIG_TPM2=y
diff --git a/configs/config.msi_ms7d25_ddr5 b/configs/config.msi_ms7d25_ddr5
index f34c3a66677..7e8e6de625e 100644
--- a/configs/config.msi_ms7d25_ddr5
+++ b/configs/config.msi_ms7d25_ddr5
@@ -1,4 +1,4 @@
-CONFIG_LOCALVERSION="v1.1.7-rc2"
+CONFIG_LOCALVERSION="v1.1.7-rc3"
 CONFIG_OPTION_BACKEND_NONE=y
 CONFIG_SBOM=y
 CONFIG_SBOM_PAYLOAD=y
@@ -36,7 +36,7 @@ CONFIG_PCIEXP_LANE_ERR_STAT_CLEAR=y
 CONFIG_DRIVERS_EFI_VARIABLE_STORE=y
 CONFIG_DRIVERS_EFI_FW_INFO=y
 CONFIG_DRIVERS_EFI_MAIN_FW_GUID="119059ec-1a5e-4844-b2e6-6f573b257570"
-CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x01010702
+CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x01010703
 CONFIG_DRIVERS_EFI_MAIN_FW_LSV=0x01010701
 CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=y
 CONFIG_TPM2=y

From f917f0103d8ed94de0bfe5c21a5cfe11b7bba8ec Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20=C5=BBygowski?= <michal.zygowski@3mdeb.com>
Date: Sat, 8 Aug 2026 16:52:36 +0200
Subject: [PATCH 22/22] configs/config.msi_ms7e06: Bump to v0.9.5-rc3
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Upstream-Status: Inappropriate [custom configs]
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
---
 configs/config.msi_ms7e06_ddr4 | 4 ++--
 configs/config.msi_ms7e06_ddr5 | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/configs/config.msi_ms7e06_ddr4 b/configs/config.msi_ms7e06_ddr4
index 6efa6bc5e38..a759be88c2a 100644
--- a/configs/config.msi_ms7e06_ddr4
+++ b/configs/config.msi_ms7e06_ddr4
@@ -1,4 +1,4 @@
-CONFIG_LOCALVERSION="v0.9.5-rc2"
+CONFIG_LOCALVERSION="v0.9.5-rc3"
 CONFIG_OPTION_BACKEND_NONE=y
 CONFIG_SBOM=y
 CONFIG_SBOM_PAYLOAD=y
@@ -36,7 +36,7 @@ CONFIG_PCIEXP_LANE_ERR_STAT_CLEAR=y
 CONFIG_DRIVERS_EFI_VARIABLE_STORE=y
 CONFIG_DRIVERS_EFI_FW_INFO=y
 CONFIG_DRIVERS_EFI_MAIN_FW_GUID="91e6522e-25e1-4543-9b38-02e2aeafc9ed"
-CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x00090502
+CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x00090503
 CONFIG_DRIVERS_EFI_MAIN_FW_LSV=0x00090501
 CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=y
 CONFIG_TPM2=y
diff --git a/configs/config.msi_ms7e06_ddr5 b/configs/config.msi_ms7e06_ddr5
index e2b04ee9281..764d0454cd0 100644
--- a/configs/config.msi_ms7e06_ddr5
+++ b/configs/config.msi_ms7e06_ddr5
@@ -1,4 +1,4 @@
-CONFIG_LOCALVERSION="v0.9.5-rc2"
+CONFIG_LOCALVERSION="v0.9.5-rc3"
 CONFIG_OPTION_BACKEND_NONE=y
 CONFIG_SBOM=y
 CONFIG_SBOM_PAYLOAD=y
@@ -36,7 +36,7 @@ CONFIG_PCIEXP_LANE_ERR_STAT_CLEAR=y
 CONFIG_DRIVERS_EFI_VARIABLE_STORE=y
 CONFIG_DRIVERS_EFI_FW_INFO=y
 CONFIG_DRIVERS_EFI_MAIN_FW_GUID="58301b3d-5b6d-4562-9ec1-fbce40f15253"
-CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x00090502
+CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x00090503
 CONFIG_DRIVERS_EFI_MAIN_FW_LSV=0x00090501
 CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=y
 CONFIG_TPM2=y