diff --git a/configs/config.msi_ms7d25_ddr4 b/configs/config.msi_ms7d25_ddr4
index a5ff6176b1f..05c89eaa8e9 100644
--- a/configs/config.msi_ms7d25_ddr4
+++ b/configs/config.msi_ms7d25_ddr4
@@ -1,4 +1,4 @@
-CONFIG_LOCALVERSION="v1.1.7-rc2"
+CONFIG_LOCALVERSION="v1.1.7-rc3"
 CONFIG_OPTION_BACKEND_NONE=y
 CONFIG_SBOM=y
 CONFIG_SBOM_PAYLOAD=y
@@ -36,10 +36,14 @@ CONFIG_PCIEXP_LANE_ERR_STAT_CLEAR=y
 CONFIG_DRIVERS_EFI_VARIABLE_STORE=y
 CONFIG_DRIVERS_EFI_FW_INFO=y
 CONFIG_DRIVERS_EFI_MAIN_FW_GUID="0f3e8ba6-19d3-461b-bbbc-8b5689fe8097"
-CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x01010702
+CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x01010703
 CONFIG_DRIVERS_EFI_MAIN_FW_LSV=0x01010701
 CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=y
 CONFIG_TPM2=y
+CONFIG_STM=y
+CONFIG_STM_STMPE_ENABLED=y
+CONFIG_STM_TTYS0_BASE=0x0f0
+CONFIG_STM_CBMEM_CONSOLE=y
 CONFIG_BOOTMEDIA_LOCK_CONTROLLER=y
 CONFIG_BOOTMEDIA_LOCK_WPRO_VBOOT_RO=y
 CONFIG_BOOTMEDIA_LOCK_IN_VERSTAGE=y
diff --git a/configs/config.msi_ms7d25_ddr5 b/configs/config.msi_ms7d25_ddr5
index 6c1bcc96027..7e8e6de625e 100644
--- a/configs/config.msi_ms7d25_ddr5
+++ b/configs/config.msi_ms7d25_ddr5
@@ -1,4 +1,4 @@
-CONFIG_LOCALVERSION="v1.1.7-rc2"
+CONFIG_LOCALVERSION="v1.1.7-rc3"
 CONFIG_OPTION_BACKEND_NONE=y
 CONFIG_SBOM=y
 CONFIG_SBOM_PAYLOAD=y
@@ -36,10 +36,14 @@ CONFIG_PCIEXP_LANE_ERR_STAT_CLEAR=y
 CONFIG_DRIVERS_EFI_VARIABLE_STORE=y
 CONFIG_DRIVERS_EFI_FW_INFO=y
 CONFIG_DRIVERS_EFI_MAIN_FW_GUID="119059ec-1a5e-4844-b2e6-6f573b257570"
-CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x01010702
+CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x01010703
 CONFIG_DRIVERS_EFI_MAIN_FW_LSV=0x01010701
 CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=y
 CONFIG_TPM2=y
+CONFIG_STM=y
+CONFIG_STM_STMPE_ENABLED=y
+CONFIG_STM_TTYS0_BASE=0x0f0
+CONFIG_STM_CBMEM_CONSOLE=y
 CONFIG_BOOTMEDIA_LOCK_CONTROLLER=y
 CONFIG_BOOTMEDIA_LOCK_WPRO_VBOOT_RO=y
 CONFIG_BOOTMEDIA_LOCK_IN_VERSTAGE=y
diff --git a/configs/config.msi_ms7e06_ddr4 b/configs/config.msi_ms7e06_ddr4
index 617d7979416..a759be88c2a 100644
--- a/configs/config.msi_ms7e06_ddr4
+++ b/configs/config.msi_ms7e06_ddr4
@@ -1,4 +1,4 @@
-CONFIG_LOCALVERSION="v0.9.5-rc2"
+CONFIG_LOCALVERSION="v0.9.5-rc3"
 CONFIG_OPTION_BACKEND_NONE=y
 CONFIG_SBOM=y
 CONFIG_SBOM_PAYLOAD=y
@@ -36,10 +36,14 @@ CONFIG_PCIEXP_LANE_ERR_STAT_CLEAR=y
 CONFIG_DRIVERS_EFI_VARIABLE_STORE=y
 CONFIG_DRIVERS_EFI_FW_INFO=y
 CONFIG_DRIVERS_EFI_MAIN_FW_GUID="91e6522e-25e1-4543-9b38-02e2aeafc9ed"
-CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x00090502
+CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x00090503
 CONFIG_DRIVERS_EFI_MAIN_FW_LSV=0x00090501
 CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=y
 CONFIG_TPM2=y
+CONFIG_STM=y
+CONFIG_STM_STMPE_ENABLED=y
+CONFIG_STM_TTYS0_BASE=0x0f0
+CONFIG_STM_CBMEM_CONSOLE=y
 CONFIG_BOOTMEDIA_LOCK_CONTROLLER=y
 CONFIG_BOOTMEDIA_LOCK_WPRO_VBOOT_RO=y
 CONFIG_BOOTMEDIA_LOCK_IN_VERSTAGE=y
diff --git a/configs/config.msi_ms7e06_ddr5 b/configs/config.msi_ms7e06_ddr5
index 235699a483f..764d0454cd0 100644
--- a/configs/config.msi_ms7e06_ddr5
+++ b/configs/config.msi_ms7e06_ddr5
@@ -1,4 +1,4 @@
-CONFIG_LOCALVERSION="v0.9.5-rc2"
+CONFIG_LOCALVERSION="v0.9.5-rc3"
 CONFIG_OPTION_BACKEND_NONE=y
 CONFIG_SBOM=y
 CONFIG_SBOM_PAYLOAD=y
@@ -36,10 +36,14 @@ CONFIG_PCIEXP_LANE_ERR_STAT_CLEAR=y
 CONFIG_DRIVERS_EFI_VARIABLE_STORE=y
 CONFIG_DRIVERS_EFI_FW_INFO=y
 CONFIG_DRIVERS_EFI_MAIN_FW_GUID="58301b3d-5b6d-4562-9ec1-fbce40f15253"
-CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x00090502
+CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x00090503
 CONFIG_DRIVERS_EFI_MAIN_FW_LSV=0x00090501
 CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=y
 CONFIG_TPM2=y
+CONFIG_STM=y
+CONFIG_STM_STMPE_ENABLED=y
+CONFIG_STM_TTYS0_BASE=0x0f0
+CONFIG_STM_CBMEM_CONSOLE=y
 CONFIG_BOOTMEDIA_LOCK_CONTROLLER=y
 CONFIG_BOOTMEDIA_LOCK_WPRO_VBOOT_RO=y
 CONFIG_BOOTMEDIA_LOCK_IN_VERSTAGE=y
diff --git a/payloads/external/Makefile.mk b/payloads/external/Makefile.mk
index 9347c1267b8..b711919d347 100644
--- a/payloads/external/Makefile.mk
+++ b/payloads/external/Makefile.mk
@@ -213,14 +213,10 @@ $(obj)/UEFIPAYLOAD.fd: $(DOTCONFIG) $(IPXE_EFI)
 		CONFIG_SOC_AMD_COMMON_BLOCK_PSP_GEN2=$(CONFIG_SOC_AMD_COMMON_BLOCK_PSP_GEN2) \
 		CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=$(CONFIG_DRIVERS_EFI_UPDATE_CAPSULES) \
 		CONFIG_DRIVERS_EFI_MAIN_FW_GUID=$(CONFIG_DRIVERS_EFI_MAIN_FW_GUID) \
-		GCC_CC_x86_32=$(GCC_CC_x86_32) \
-		GCC_CC_x86_64=$(GCC_CC_x86_64) \
-		GCC_CC_arm=$(GCC_CC_arm) \
-		GCC_CC_arm64=$(GCC_CC_arm64) \
-		OBJCOPY_x86_32=$(OBJCOPY_x86_32) \
-		OBJCOPY_x86_64=$(OBJCOPY_x86_64) \
-		OBJCOPY_arm=$(OBJCOPY_arm) \
-		OBJCOPY_arm64=$(OBJCOPY_arm64) \
+		GCC_IA32_PREFIX=$(patsubst %gcc,%,$(GCC_CC_x86_32)) \
+		GCC_X64_PREFIX=$(patsubst %gcc,%,$(GCC_CC_x86_64)) \
+		GCC_ARM_PREFIX=$(patsubst %gcc,%,$(GCC_CC_arm)) \
+		GCC_AARCH64_PREFIX=$(patsubst %gcc,%,$(GCC_CC_arm64)) \
 		MFLAGS= MAKEFLAGS= \
 		CONFIG_EDK2_ABOVE_4G_MEMORY=$(CONFIG_EDK2_ABOVE_4G_MEMORY) \
 		CONFIG_EDK2_BATTERY_CONFIG_OPTION=$(CONFIG_EDK2_BATTERY_CONFIG_OPTION) \
@@ -308,7 +304,8 @@ $(obj)/UEFIPAYLOAD.fd: $(DOTCONFIG) $(IPXE_EFI)
 		CONFIG_EDK2_VGA_BIOS_VENDOR_ID=0x$(word 1,$(subst $(comma),$(spc),$(call strip_quotes,$(CONFIG_VGA_BIOS_ID)))) \
 		CONFIG_EDK2_VGA_BIOS_DEVICE_ID=0x$(word 2,$(subst $(comma),$(spc),$(call strip_quotes,$(CONFIG_VGA_BIOS_ID)))) \
 		CONFIG_VGA_BIOS_FILE=$(CONFIG_VGA_BIOS_FILE) \
-		CONFIG_BOOTSPLASH_REGION_LOGO_FILE=$(CONFIG_BOOTSPLASH_REGION_LOGO_FILE)
+		CONFIG_BOOTSPLASH_REGION_LOGO_FILE=$(CONFIG_BOOTSPLASH_REGION_LOGO_FILE) \
+		CONFIG_STM=$(CONFIG_STM)
 
 $(obj)/ShimmedUniversalPayload.elf: $(DOTCONFIG)
 	$(MAKE) -C payloads/external/edk2 UniversalPayload \
@@ -341,14 +338,10 @@ $(obj)/ShimmedUniversalPayload.elf: $(DOTCONFIG)
 		CONFIG_ECAM_MMCONF_LENGTH=$(CONFIG_ECAM_MMCONF_LENGTH) \
 		CONFIG_CPU_XTAL_HZ=$(CONFIG_CPU_XTAL_HZ) \
 		CONFIG_SMMSTORE_V2=$(CONFIG_SMMSTORE_V2) \
-		GCC_CC_x86_32=$(GCC_CC_x86_32) \
-		GCC_CC_x86_64=$(GCC_CC_x86_64) \
-		GCC_CC_arm=$(GCC_CC_arm) \
-		GCC_CC_arm64=$(GCC_CC_arm64) \
-		OBJCOPY_x86_32=$(OBJCOPY_x86_32) \
-		OBJCOPY_x86_64=$(OBJCOPY_x86_64) \
-		OBJCOPY_arm=$(OBJCOPY_arm) \
-		OBJCOPY_arm64=$(OBJCOPY_arm64) \
+		GCC_IA32_PREFIX=$(patsubst %gcc,%,$(GCC_CC_x86_32)) \
+		GCC_X64_PREFIX=$(patsubst %gcc,%,$(GCC_CC_x86_64)) \
+		GCC_ARM_PREFIX=$(patsubst %gcc,%,$(GCC_CC_arm)) \
+		GCC_AARCH64_PREFIX=$(patsubst %gcc,%,$(GCC_CC_arm64)) \
 		MFLAGS= MAKEFLAGS=
 
 # FILO
diff --git a/payloads/external/edk2/Kconfig.dasharo b/payloads/external/edk2/Kconfig.dasharo
index 23453d49228..2252e0a26f1 100644
--- a/payloads/external/edk2/Kconfig.dasharo
+++ b/payloads/external/edk2/Kconfig.dasharo
@@ -4,7 +4,7 @@ config EDK2_REPOSITORY
 	default "https://github.com/Dasharo/edk2"
 
 config EDK2_TAG_OR_REV
-	default "61ce35c29bb384240028d4319755b5759affbbe1"
+	default "6d5a8a9a6363e2b30657c4ee4d2088ec11356f0b"
 
 config EDK2_SYSTEM76_EC_LOGGING
 	bool "Enable edk2 logging to System76 EC"
diff --git a/payloads/external/edk2/Makefile b/payloads/external/edk2/Makefile
index dd33e8148dd..95607858076 100644
--- a/payloads/external/edk2/Makefile
+++ b/payloads/external/edk2/Makefile
@@ -25,7 +25,15 @@ else
 export PACKAGES_PATH := $(EDK2_PATH)
 endif
 
-OBJCOPY = $(GCC_PREFIX)objcopy
+OBJCOPY = $(GCC_IA32_PREFIX)objcopy
+
+export GCC_IA32_PREFIX
+export GCC_X64_PREFIX
+export GCC_ARM_PREFIX
+export GCC_AARCH64_PREFIX
+# tools_def.txt maps GCC_IA32_PREFIX and GCC_X64_PREFIX both to ENV(GCC_BIN).
+# Use the X64 prefix as GCC_BIN since x86_64-elf-gcc handles IA32 (-m32) too.
+export GCC_BIN := $(GCC_X64_PREFIX)
 
 PAYLOAD_NAME=DasharoPayloadPkg
 
@@ -460,6 +468,10 @@ BUILD_STR += -D USE_AMD_PLATFORM_GOP=TRUE
 BUILD_STR += --pcd gDasharoPayloadPkgTokenSpaceGuid.AmdVbiosOptionRomVendorId=$(CONFIG_EDK2_VGA_BIOS_VENDOR_ID)
 BUILD_STR += --pcd gDasharoPayloadPkgTokenSpaceGuid.AmdVbiosOptionRomDeviceId=$(CONFIG_EDK2_VGA_BIOS_DEVICE_ID)
 endif
+# PcdShowSecurityStmOption = FALSE
+ifeq ($(CONFIG_STM),y)
+BUILD_STR += --pcd gDasharoSystemFeaturesTokenSpaceGuid.PcdShowSecurityStmOption=TRUE
+endif
 
 BUILD_STR += --pcd gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareVersionString=$(CONFIG_EDK2_FW_VERSION)
 BUILD_STR += --pcd gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareVendor=$(CONFIG_EDK2_FW_VENDOR)
diff --git a/src/cpu/x86/smm/smm_module_handler.c b/src/cpu/x86/smm/smm_module_handler.c
index d9f64204d6d..68e3870577d 100644
--- a/src/cpu/x86/smm/smm_module_handler.c
+++ b/src/cpu/x86/smm/smm_module_handler.c
@@ -130,6 +130,25 @@ bool smm_region_overlaps_handler(const struct region *r)
 	return region_overlap(&r_smm, r) || region_overlap(&r_aseg, r);
 }
 
+void smm_stm_restore_smram_to_vmcs(void *smm_save_state)
+{
+	if (!CONFIG(STM))
+		return;
+
+	/*
+	 * Signal STM to propagate SMRAM save state changes back to the
+	 * interrupted guest VMCS on RSM. Required for return values written to
+	 * EAX (e.g. SMMSTORE result) to be visible in OS context after RSM.
+	 * Without this bit set, ReadSyncSmmStateSaveArea() in the STM runtime
+	 * skips the sync entirely, so the guest sees stale pre-SMI register
+	 * values instead of the handler's return code.
+	 */
+	TXT_PROCESSOR_SMM_DESCRIPTOR *psd =
+		(TXT_PROCESSOR_SMM_DESCRIPTOR *)
+		((uintptr_t)smm_save_state - STM_PSD_SIZE);
+	psd->smm_resume_state.smram_to_vmcs_restore_required = 1;
+}
+
 asmlinkage void smm_handler_start(void *arg)
 {
 	const struct smm_module_params *p;
diff --git a/src/cpu/x86/smm/smm_module_loader.c b/src/cpu/x86/smm/smm_module_loader.c
index dff2dde857a..0c4398a6f9e 100644
--- a/src/cpu/x86/smm/smm_module_loader.c
+++ b/src/cpu/x86/smm/smm_module_loader.c
@@ -358,7 +358,13 @@ static void setup_smihandler_params(struct smm_runtime *mod_params,
 			return;
 		}
 
-		void *ptr = cbmem_add(CBMEM_ID_SMM_COMBUFFER, info.block_size);
+		/*
+		 * Add additional 4KiB for parameters, so that arguments can be in the same
+		 * communication buffer, instead of arbitrary memory allocated by the caller.
+		 * It helps with STM resource reporting and keeping the SMI handlers from
+		 * accessing memory it doesn't have to access.
+		 */
+		void *ptr = cbmem_add(CBMEM_ID_SMM_COMBUFFER, info.block_size + 4 * KiB);
 		if (!ptr) {
 			printk(BIOS_ERR, "SMMSTORE: Failed to add com buffer\n");
 			return;
diff --git a/src/drivers/intel/fsp2_0/include/fsp/api.h b/src/drivers/intel/fsp2_0/include/fsp/api.h
index fa3c42c94ef..c4840347623 100644
--- a/src/drivers/intel/fsp2_0/include/fsp/api.h
+++ b/src/drivers/intel/fsp2_0/include/fsp/api.h
@@ -6,6 +6,7 @@
 #include <stddef.h>
 #include <stdint.h>
 #include <fsp/soc_binding.h>
+#include <fsp/fsp_status_x64_to_x86.h>
 #include <soc/intel/common/mma.h>
 
 #define FSP_SUCCESS	EFI_SUCCESS
diff --git a/src/drivers/intel/fsp2_0/include/fsp/fsp_status_x64_to_x86.h b/src/drivers/intel/fsp2_0/include/fsp/fsp_status_x64_to_x86.h
new file mode 100644
index 00000000000..e713c8b9e39
--- /dev/null
+++ b/src/drivers/intel/fsp2_0/include/fsp/fsp_status_x64_to_x86.h
@@ -0,0 +1,53 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef _FSP2_0_STATUS_X64_TO_X86_H_
+#define _FSP2_0_STATUS_X64_TO_X86_H_
+
+/* Fixup definitions for x86_64 mode when FSP uses 32bit mode */
+#if CONFIG(PLATFORM_USES_FSP2_X86_32) && CONFIG(USE_X86_64_SUPPORT)
+
+#undef MAX_BIT
+#undef ENCODE_RESET_REQUEST
+#undef FSP_STATUS_RESET_REQUIRED_COLD
+#undef FSP_STATUS_RESET_REQUIRED_WARM
+#undef FSP_STATUS_RESET_REQUIRED_3
+#undef FSP_STATUS_RESET_REQUIRED_4
+#undef FSP_STATUS_RESET_REQUIRED_5
+#undef FSP_STATUS_RESET_REQUIRED_6
+#undef FSP_STATUS_RESET_REQUIRED_7
+#undef FSP_STATUS_RESET_REQUIRED_8
+#undef FSP_STATUS_VARIABLE_REQUEST
+
+#undef EFI_SUCCESS
+#undef EFI_INVALID_PARAMETER
+#undef EFI_UNSUPPORTED
+#undef EFI_DEVICE_ERROR
+#undef EFI_NOT_FOUND
+#undef EFI_NOT_STARTED
+
+#define MAX_BIT				0x80000000
+#define ENCODE_RESET_REQUEST(ResetType)	\
+		((UINT32)((MAX_BIT >> 1) | (ResetType)))
+#define FSP_STATUS_RESET_REQUIRED_COLD	ENCODE_RESET_REQUEST(1)
+#define FSP_STATUS_RESET_REQUIRED_WARM	ENCODE_RESET_REQUEST(2)
+#define FSP_STATUS_RESET_REQUIRED_3	ENCODE_RESET_REQUEST(3)
+#define FSP_STATUS_RESET_REQUIRED_4	ENCODE_RESET_REQUEST(4)
+#define FSP_STATUS_RESET_REQUIRED_5	ENCODE_RESET_REQUEST(5)
+#define FSP_STATUS_RESET_REQUIRED_6	ENCODE_RESET_REQUEST(6)
+#define FSP_STATUS_RESET_REQUIRED_7	ENCODE_RESET_REQUEST(7)
+#define FSP_STATUS_RESET_REQUIRED_8	ENCODE_RESET_REQUEST(8)
+#define FSP_STATUS_VARIABLE_REQUEST	ENCODE_RESET_REQUEST(10)
+
+#define ENCODE_EFI_STATUS(Status)	\
+		((UINT32)((MAX_BIT) | (Status)))
+
+#define EFI_SUCCESS			0
+#define EFI_INVALID_PARAMETER		ENCODE_EFI_STATUS(2)
+#define EFI_UNSUPPORTED			ENCODE_EFI_STATUS(3)
+#define EFI_DEVICE_ERROR		ENCODE_EFI_STATUS(7)
+#define EFI_NOT_FOUND			ENCODE_EFI_STATUS(14)
+#define EFI_NOT_STARTED			ENCODE_EFI_STATUS(19)
+
+#endif
+
+#endif  /* _FSP2_0_STATUS_X64_TO_X86_H_ */
\ No newline at end of file
diff --git a/src/drivers/smmstore/store.c b/src/drivers/smmstore/store.c
index 00b02832d0a..9adf427d39d 100644
--- a/src/drivers/smmstore/store.c
+++ b/src/drivers/smmstore/store.c
@@ -419,7 +419,7 @@ static void *mmap_com_buf(struct region_device *com_buf, uint32_t offset, uint32
 
 	void *ptr = rdev_mmap(com_buf, offset, bufsize);
 	if (!ptr)
-		printk(BIOS_ERR, "smm store: not enough space for new data\n");
+		printk(BIOS_ERR, "smm store: could not mmap com buffer\n");
 
 	return ptr;
 }
@@ -478,7 +478,7 @@ int smmstore_rawwrite_region(uint32_t block_id, uint32_t offset, uint32_t bufsiz
 		return -1;
 
 	if (rdev_chain(&store, &store, block_id * SMM_BLOCK_SIZE + offset, bufsize)) {
-		printk(BIOS_ERR, "smm store: not enough space for new data\n");
+		printk(BIOS_ERR, "smm store: could not create subregion rdev\n");
 		return -1;
 	}
 
diff --git a/src/include/cpu/x86/smm.h b/src/include/cpu/x86/smm.h
index 948c9ccef22..bbe537506f4 100644
--- a/src/include/cpu/x86/smm.h
+++ b/src/include/cpu/x86/smm.h
@@ -141,6 +141,12 @@ void *smm_get_save_state(int cpu);
 /* Returns true if the region overlaps with the SMM */
 bool smm_region_overlaps_handler(const struct region *r);
 
+/*
+ * Sets the bit to restore modified SMRAM to VMCS when STM is enabled.
+ * Requird to be called by all SMI handler that modify save state.
+ */
+void smm_stm_restore_smram_to_vmcs(void *smm_save_state);
+
 /* Returns true if the memory pointed to overlaps with SMM reserved memory. */
 static inline bool smm_points_to_smram(const void *ptr, const size_t len)
 {
diff --git a/src/mainboard/msi/ms7d25/Kconfig b/src/mainboard/msi/ms7d25/Kconfig
index 04052c947bf..05cb0e030c5 100644
--- a/src/mainboard/msi/ms7d25/Kconfig
+++ b/src/mainboard/msi/ms7d25/Kconfig
@@ -95,4 +95,20 @@ config INTEL_FIT_LOC
 
 endif
 
+if STM
+
+config IED_REGION_SIZE
+	default 0x0
+
+config SMM_TSEG_SIZE
+	default 0x1000000
+
+config MSEG_SIZE
+	default 0xCD0000
+
+config STM_HEAPSIZE
+	default 0xB47000
+
+endif
+
 endif
diff --git a/src/mainboard/msi/ms7d25/Makefile.mk b/src/mainboard/msi/ms7d25/Makefile.mk
index 6b9791768ac..8f444768b00 100644
--- a/src/mainboard/msi/ms7d25/Makefile.mk
+++ b/src/mainboard/msi/ms7d25/Makefile.mk
@@ -8,6 +8,7 @@ romstage-y += romstage_fsp_params.c
 
 ramstage-y += mainboard.c
 ramstage-y += smbios.c
+ramstage-$(CONFIG_STM) += stm.c
 
 all-y += die.c
 smm-y += die.c
diff --git a/src/mainboard/msi/ms7d25/stm.c b/src/mainboard/msi/ms7d25/stm.c
new file mode 100644
index 00000000000..836a52ea784
--- /dev/null
+++ b/src/mainboard/msi/ms7d25/stm.c
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+#include <security/intel/stm/SmmStm.h>
+#include <security/intel/stm/StmPlatformResource.h>
+
+// Nuvoton SIO resources
+static STM_RSC_IO_DESC rsc_sio_io = {{IO_RANGE, sizeof(STM_RSC_IO_DESC)},
+				     0x4e, 2};
+
+static STM_RSC_IO_DESC rsc_hwm_io = {{IO_RANGE, sizeof(STM_RSC_IO_DESC)},
+				     0xa20, 8};
+
+int mainboard_stm_add_resources(void)
+{
+	int Status = 0;
+
+	Status |= add_pi_resource((void *)&rsc_sio_io, 1);
+	Status |= add_pi_resource((void *)&rsc_hwm_io, 1);
+
+	return Status;
+}
diff --git a/src/mainboard/msi/ms7e06/Kconfig b/src/mainboard/msi/ms7e06/Kconfig
index 30d29ded341..6fc99feec76 100644
--- a/src/mainboard/msi/ms7e06/Kconfig
+++ b/src/mainboard/msi/ms7e06/Kconfig
@@ -94,5 +94,20 @@ config INTEL_FIT_LOC
 
 endif
 
+if STM
+
+config IED_REGION_SIZE
+	default 0x0
+
+config SMM_TSEG_SIZE
+	default 0x1000000
+
+config MSEG_SIZE
+	default 0xCD0000
+
+config STM_HEAPSIZE
+	default 0xB47000
+
+endif
 
 endif
diff --git a/src/mainboard/msi/ms7e06/Makefile.mk b/src/mainboard/msi/ms7e06/Makefile.mk
index cc0df70e7bd..364196ef067 100644
--- a/src/mainboard/msi/ms7e06/Makefile.mk
+++ b/src/mainboard/msi/ms7e06/Makefile.mk
@@ -9,6 +9,7 @@ romstage-y += romstage_fsp_params.c
 
 ramstage-y += mainboard.c
 ramstage-y += smbios.c
+ramstage-$(CONFIG_STM) += stm.c
 
 all-y += die.c
 smm-y += die.c
diff --git a/src/mainboard/msi/ms7e06/stm.c b/src/mainboard/msi/ms7e06/stm.c
new file mode 100644
index 00000000000..836a52ea784
--- /dev/null
+++ b/src/mainboard/msi/ms7e06/stm.c
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+#include <security/intel/stm/SmmStm.h>
+#include <security/intel/stm/StmPlatformResource.h>
+
+// Nuvoton SIO resources
+static STM_RSC_IO_DESC rsc_sio_io = {{IO_RANGE, sizeof(STM_RSC_IO_DESC)},
+				     0x4e, 2};
+
+static STM_RSC_IO_DESC rsc_hwm_io = {{IO_RANGE, sizeof(STM_RSC_IO_DESC)},
+				     0xa20, 8};
+
+int mainboard_stm_add_resources(void)
+{
+	int Status = 0;
+
+	Status |= add_pi_resource((void *)&rsc_sio_io, 1);
+	Status |= add_pi_resource((void *)&rsc_hwm_io, 1);
+
+	return Status;
+}
diff --git a/src/security/intel/stm/Kconfig b/src/security/intel/stm/Kconfig
index 8f1774896ea..6851d65be7a 100644
--- a/src/security/intel/stm/Kconfig
+++ b/src/security/intel/stm/Kconfig
@@ -89,7 +89,7 @@ config STM_HEAPSIZE
 
 config STM_TTYS0_BASE
 	hex "stm uart"
-	default TTYS0_BASE if TTYS0_BASE
+	default TTYS0_BASE if TTYS0_BASE != 0x0
 	default 0x000
 	help
 	  Defines the serial port for STM console output.  0x000 indicates
@@ -107,7 +107,7 @@ choice
 
 config STM_CONSOLE_DEBUG
 	bool "Debug output"
-	depends on STM_CBMEM_CONSOLE || STM_TTYS0_BASE
+	depends on STM_CBMEM_CONSOLE || STM_TTYS0_BASE != 0x0
 	help
 	  "Produces all STM console output"
 
diff --git a/src/security/intel/stm/Makefile b/src/security/intel/stm/Makefile
index 31e5bdd88aa..207355e3951 100644
--- a/src/security/intel/stm/Makefile
+++ b/src/security/intel/stm/Makefile
@@ -13,17 +13,27 @@ ifeq ($(CONFIG_STM_CONSOLE_RELEASE),y)
 STM_BUILD="release"
 endif
 
+# STM needs string.h, provide it from coreboot includes
+STM_COREBOOT_INC=-isystem $(top)/src/include
+STM_COREBOOT_INC+= -isystem $(top)/src/commonlib/include
+STM_COREBOOT_INC+= -isystem $(top)/src/commonlib/bsd/include
+# STM needs elf.h, provide it from cbfstool
+STM_COREBOOT_INC+= -isystem $(top)/util/cbfstool
 
 all: build
 
 build:
 	echo "STM - Build"
-	echo "--  WARNING: This uses the system toolchain instead of"
-	echo "    the coreboot toolchain, so is not reproducible."
 	cd $(project_dir)/Stm; \
 	mkdir -p build; \
 	cd build; \
 	cmake .. -DBIOS=coreboot \
+		-DCMAKE_SYSTEM_NAME=Generic \
+		-DCMAKE_TRY_COMPILE_TARGET_TYPE=STATIC_LIBRARY \
+		-DCMAKE_C_COMPILER=$(shell which $(GCC_CC_x86_64)) \
+		-DCMAKE_ASM_COMPILER=$(shell which $(GCC_CC_x86_64)) \
+		-DCMAKE_OBJCOPY=$(shell which $(OBJCOPY_x86_64)) \
+		-DCMAKE_C_FLAGS="$(STM_COREBOOT_INC)" \
 		-DUART=$(CONFIG_STM_TTYS0_BASE) \
 		-DHEAPSIZE=$(CONFIG_STM_HEAPSIZE) \
 		-DCBMEM_ENABLE=$(CONFIG_STM_CBMEM_CONSOLE) \
diff --git a/src/security/intel/stm/Makefile.mk b/src/security/intel/stm/Makefile.mk
index 90b7c188f7f..bab7354cc3a 100644
--- a/src/security/intel/stm/Makefile.mk
+++ b/src/security/intel/stm/Makefile.mk
@@ -5,6 +5,7 @@
 cbfs-files-$(CONFIG_STM) += stm.bin
 stm.bin-file := $(CONFIG_STM_BINARY_FILE)
 stm.bin-type := raw
+stm.bin-compression := LZMA
 
 ramstage-$(CONFIG_STM) += SmmStm.c
 ramstage-$(CONFIG_STM) += StmPlatformSmm.c
@@ -18,4 +19,6 @@ ramstage-$(CONFIG_STM) += StmPlatformResource.c
 		CONFIG_STM_CONSOLE_RELEASE=$(CONFIG_STM_CONSOLE_RELEASE) \
 		CONFIG_STM_GIT_BRANCH=$(CONFIG_STM_GIT_BRANCH) \
 		CONFIG_STM_STMPE_ENABLED=$(CONFIG_STM_STMPE_ENABLED) \
-		CONFIG_STM_CBMEM_CONSOLE=$(CONFIG_STM_CBMEM_CONSOLE)
+		CONFIG_STM_CBMEM_CONSOLE=$(CONFIG_STM_CBMEM_CONSOLE) \
+		GCC_CC_x86_64=$(GCC_CC_x86_64) \
+		OBJCOPY_x86_64=$(OBJCOPY_x86_64)
diff --git a/src/security/intel/stm/SmmStm.c b/src/security/intel/stm/SmmStm.c
index 64a4877ed4b..fed77ede44c 100644
--- a/src/security/intel/stm/SmmStm.c
+++ b/src/security/intel/stm/SmmStm.c
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: BSD-2-Clause */
 
 #include <console/console.h>
+#include <cpu/cpu.h>
 #include <cpu/x86/cr.h>
 #include <cpu/x86/mp.h>
 #include <cpu/x86/msr.h>
@@ -448,7 +449,7 @@ static uint32_t get_resource_size(STM_RSC *resource_list, uint32_t num_entries)
 		resource =
 			(STM_RSC *)((void *)resource + resource->header.length);
 	}
-	return (uint32_t)((uint32_t)resource - (uint32_t)resource_list);
+	return (uint32_t)((uintptr_t)resource - (uintptr_t)resource_list);
 }
 
 /*
@@ -580,38 +581,69 @@ static uint32_t get_vmcs_size(void)
 
 /*
  *  Create 4G page table for STM.
- *  2M PTEs for x86_64 or 2M PTEs for x86_32.
  *
  *  @param pageable_base        The page table base in MSEG
  */
-void stm_gen_4g_pagetable_x64(uint32_t pagetable_base)
+void stm_gen_4g_pagetable_x64(uintptr_t pagetable_base)
 {
+	uint32_t pml4_index;
 	uint32_t index;
-	uint32_t sub_index;
+	uint64_t sub_index;
+	uint32_t num_pml4;
+	uint32_t num_pdp;
 	uint64_t *pde;
 	uint64_t *pte;
 	uint64_t *pml4;
+	uint64_t page_addr;
+	uint32_t addr_bits = cpu_phys_address_size();
+	bool page1G = false;
 
-	pml4 = (uint64_t *)(uint32_t)pagetable_base;
-	pagetable_base += PTP_SIZE;
-	*pml4 = pagetable_base | IA32_PG_RW | IA32_PG_P;
+	if (cpu_cpuid_extended_level() >= 0x80000001) {
+		if (cpuid_edx(0x80000001) & (1 << 26))
+			page1G = true;
+	}
+
+	/* Do not use 5-level paging for now */
+	if (addr_bits > 48)
+		addr_bits = 48;
+
+	num_pml4 = 1 << (addr_bits - 39);
+	addr_bits = 39;
+	num_pdp = 1 << (addr_bits - 30);
 
-	pde = (uint64_t *)(uint32_t)pagetable_base;
+	page_addr = 0;
+
+	pml4 = (uint64_t *)pagetable_base;
 	pagetable_base += PTP_SIZE;
-	pte = (uint64_t *)(uint32_t)pagetable_base;
 
-	for (index = 0; index < 4; index++) {
-		*pde = pagetable_base | IA32_PG_RW | IA32_PG_P;
-		pde++;
+	for (pml4_index = 0; pml4_index < num_pml4; pml4_index++, pml4++) {
+		*pml4 = pagetable_base | IA32_PG_RW | IA32_PG_P;
+
+		pde = (uint64_t *)pagetable_base;
 		pagetable_base += PTP_SIZE;
 
-		for (sub_index = 0; sub_index < SIZE_4KB / sizeof(*pte);
-		     sub_index++) {
-			*pte = (((index << 9) + sub_index) << 21) | IA32_PG_PS
-			       | IA32_PG_RW | IA32_PG_P;
-			pte++;
+		if (page1G) {
+			for (index = 0; index < (SIZE_4KB / sizeof(*pde));
+			    index++, pde++, page_addr += GiB) {
+				*pde = page_addr | IA32_PG_PS | IA32_PG_RW | IA32_PG_P;
+			}
+		} else {
+			for (index = 0;
+			     index < (num_pml4 == 1 ? num_pdp : SIZE_4KB / sizeof(*pde));
+			     index++, pde++) {
+				*pde = pagetable_base | IA32_PG_RW | IA32_PG_P;
+				pte = (uint64_t *)pagetable_base;
+				pagetable_base += PTP_SIZE;
+				for (sub_index = 0; sub_index < SIZE_4KB / sizeof(*pte);
+				     sub_index++, pte++, page_addr += (2 * MiB)) {
+					*pte = page_addr | IA32_PG_PS | IA32_PG_RW | IA32_PG_P;
+				}
+			}
+			memset(pde, 0, (512 - index) * sizeof(*pde));
 		}
 	}
+
+	memset(pml4, 0, (512 - pml4_index) * sizeof(*pml4));
 }
 
 /*
diff --git a/src/security/intel/stm/SmmStm.h b/src/security/intel/stm/SmmStm.h
index 8db770dc235..4f110f82d76 100644
--- a/src/security/intel/stm/SmmStm.h
+++ b/src/security/intel/stm/SmmStm.h
@@ -103,6 +103,6 @@ void stm_gen_4g_pagetable_ia32(uint32_t pagetable_base);
  *
  *  @param pagetable_base        The page table base in MSEG
  */
-void stm_gen_4g_pagetable_x64(uint32_t pagetable_base);
+void stm_gen_4g_pagetable_x64(uintptr_t pagetable_base);
 
 #endif
diff --git a/src/security/intel/stm/StmApi.h b/src/security/intel/stm/StmApi.h
index 1a594a7dd0f..af57341fc91 100644
--- a/src/security/intel/stm/StmApi.h
+++ b/src/security/intel/stm/StmApi.h
@@ -42,7 +42,7 @@ typedef struct {
 	uint32_t additional_dynamic_memory_size;
 	STM_FEAT stm_features;
 	uint32_t number_of_rev_ids;
-	uint32_t stm_smm_rev_id[];
+	uint32_t stm_smm_rev_id[1];
 
 	// The total STM_HEADER should be 4K.
 } SOFTWARE_STM_HEADER;
@@ -65,7 +65,7 @@ typedef struct {
 typedef struct {
 	uint32_t image_size;
 	uint32_t reserved;
-	uint64_t image_page_base[]; //[NumberOfPages];
+	uint64_t image_page_base[1]; //[NumberOfPages];
 } TXT_BIOS_COMPONENT_UPDATE;
 
 typedef struct {
@@ -413,7 +413,7 @@ typedef struct {
 	uint16_t length;
 	uint8_t originating_bus_number;
 	uint8_t last_node_index;
-	STM_PCI_DEVICE_PATH_NODE pci_device_path[];
+	STM_PCI_DEVICE_PATH_NODE pci_device_path[1];
 	// STM_PCI_DEVICE_PATH_NODE  PciDevicePath[LastNodeIndex + 1];
 } STM_RSC_PCI_CFG_DESC;
 
@@ -524,7 +524,7 @@ typedef enum {
 
 typedef struct {
 	uint32_t page_count;
-	uint64_t pages[]; // number of elements is PageCount
+	uint64_t pages[1]; // number of elements is PageCount
 } STM_EVENT_LOG_MANAGEMENT_REQUEST_DATA_LOG_BUFFER;
 
 typedef union {
diff --git a/src/security/intel/stm/StmPlatformResource.c b/src/security/intel/stm/StmPlatformResource.c
index 62559873c33..b3798d7a8b1 100644
--- a/src/security/intel/stm/StmPlatformResource.c
+++ b/src/security/intel/stm/StmPlatformResource.c
@@ -10,8 +10,23 @@
 #else
 #include <soc/pm.h>
 #endif
+
+#if CONFIG(SOC_INTEL_COMMON_BLOCK_FAST_SPI)
+#include <intelblocks/fast_spi.h>
+#include <soc/intel/common/block/fast_spi/fast_spi_def.h>
+#endif
+
+#if CONFIG(SOC_INTEL_COMMON_BLOCK_P2SB)
+#include <soc/iomap.h>
+#endif
+
+#include <arch/pci_io_cfg.h>
+#include <cbmem.h>
 #include <cpu/x86/msr.h>
+#include <cpu/intel/msr.h>
 #include <console/console.h>
+#include <console/uart.h>
+#include <security/intel/txt/txt_register.h>
 
 #define RDWR_ACCS 3
 #define FULL_ACCS 7
@@ -24,20 +39,77 @@ static STM_RSC_MEM_DESC rsc_tseg_memory = {{MEM_RANGE, sizeof(STM_RSC_MEM_DESC)}
 				    0,
 				    FULL_ACCS};
 
+// SMMSTORE communication buffer
+static STM_RSC_MEM_DESC rsc_smmstore_comm_buffer_memory = {
+				{MEM_RANGE, sizeof(STM_RSC_MEM_DESC)},
+				0,
+				0,
+				RDWR_ACCS};
+
+// cbmem console buffer
+static STM_RSC_MEM_DESC rsc_cbmemc_memory = {
+				{MEM_RANGE, sizeof(STM_RSC_MEM_DESC)},
+				0,
+				0,
+				RDWR_ACCS};
+
+// TPM PPI buffer
+static STM_RSC_MEM_DESC rsc_tpm_ppi_memory = {
+				{MEM_RANGE, sizeof(STM_RSC_MEM_DESC)},
+				0,
+				0,
+				RDWR_ACCS};
+
 // Flash part
 static STM_RSC_MEM_DESC rsc_spi_memory = {
 				{MEM_RANGE, sizeof(STM_RSC_MEM_DESC)},
-				0xFE000000,
+				0xFF000000,
 				0x01000000,
 				FULL_ACCS};
 
+static STM_RSC_MEM_DESC rsc_ext_spi_memory = {
+				{MEM_RANGE, sizeof(STM_RSC_MEM_DESC)},
+				CONFIG_EXT_BIOS_WIN_BASE,
+				CONFIG_EXT_BIOS_WIN_SIZE,
+				FULL_ACCS};
+
+// P2SB
+#if CONFIG(SOC_INTEL_COMMON_BLOCK_P2SB)
+static STM_RSC_MMIO_DESC rsc_p2sb_mmio = {{MMIO_RANGE, sizeof(STM_RSC_MMIO_DESC)},
+					   P2SB_BAR,
+					   P2SB_SIZE, // Length
+					   RDWR_ACCS};
+#endif
+
+#if CONFIG(SOC_INTEL_COMMON_BLOCK_P2SB2)
+static STM_RSC_MMIO_DESC rsc_p2sb2_mmio = {{MMIO_RANGE, sizeof(STM_RSC_MMIO_DESC)},
+					   P2SB2_BAR,
+					   P2SB2_SIZE, // Length
+					   RDWR_ACCS};
+#endif
+
+#if CONFIG(SOC_INTEL_COMMON_BLOCK_IOE_P2SB)
+static STM_RSC_MMIO_DESC rsc_ioe_p2sb_mmio = {{MMIO_RANGE, sizeof(STM_RSC_MMIO_DESC)},
+					      IOE_P2SB_BAR,
+					      IOE_P2SB_SIZE, // Length
+					      RDWR_ACCS};
+#endif
+
 // ACPI
 static STM_RSC_IO_DESC rsc_pm_io = {{IO_RANGE, sizeof(STM_RSC_IO_DESC)}, 0, 128};
 
+// PCI IO
+static STM_RSC_IO_DESC rsc_pci_io = {{IO_RANGE, sizeof(STM_RSC_IO_DESC)},
+				     PCI_IO_CONFIG_INDEX, PCI_IO_CONFIG_PORT_COUNT};
+
+// UART
+static STM_RSC_IO_DESC rsc_uart_io = {{IO_RANGE, sizeof(STM_RSC_IO_DESC)}, 0, 8};
+static STM_RSC_IO_DESC rsc_uart_mmio = {{MMIO_RANGE, sizeof(STM_RSC_IO_DESC)}, 0, 8, RDWR_ACCS};
+
 // PCIE MMIO
 static STM_RSC_MMIO_DESC rsc_pcie_mmio = {{MMIO_RANGE, sizeof(STM_RSC_MMIO_DESC)},
-				   0,
-				   0, // Length
+				   CONFIG_ECAM_MMCONF_BASE_ADDRESS,
+				   CONFIG_ECAM_MMCONF_LENGTH, // Length
 				   RDWR_ACCS};
 
 // Local APIC
@@ -52,6 +124,18 @@ static STM_RSC_TRAPPED_IO_DESC rsc_sw_smi_trap_io = {
 				0xB2,
 				2};
 
+// SPI MMIO
+static STM_RSC_MMIO_DESC rsc_spi_mmio = {{MMIO_RANGE, sizeof(STM_RSC_MMIO_DESC)},
+				0,
+				0x1000, // Length
+				RDWR_ACCS};
+
+// TXT MMIO
+static STM_RSC_MMIO_DESC rsc_txt_mmio = {{MMIO_RANGE, sizeof(STM_RSC_MMIO_DESC)},
+				TXT_PRIVATE_SPACE,
+				0x20000, // Length
+				RDWR_ACCS};
+
 // End of list
 static STM_RSC_END rsc_list_end __attribute__((used)) = {
 			{END_OF_RESOURCES, sizeof(STM_RSC_END)}, 0};
@@ -73,6 +157,21 @@ STM_RSC_PCI_CFG_DESC rsc_lpc_bridge_pci = {
 	},
 };
 
+// SPI controller
+STM_RSC_PCI_CFG_DESC rsc_spi_pci = {
+	{PCI_CFG_RANGE, sizeof(STM_RSC_PCI_CFG_DESC)},
+	RDWR_ACCS,
+	0,
+	0,
+	0x1000,
+	0,
+	0,
+	{
+		{1, 1, sizeof(STM_PCI_DEVICE_PATH_NODE), SPI_FUNCTION,
+		 LPC_DEVICE},
+	},
+};
+
 // Template for MSR resources.
 STM_RSC_MSR_DESC rsc_msr_tpl = {
 	{MACHINE_SPECIFIC_REG, sizeof(STM_RSC_MSR_DESC)},
@@ -90,16 +189,60 @@ MSR_TABLE_ENTRY msr_table[] = {
 	// MASK64 means need access, MASK0 means no need access.
 	{SMRR_PHYSBASE_MSR, MASK64, MASK0},
 	{SMRR_PHYSMASK_MSR, MASK64, MASK0},
+#if !CONFIG(SOC_INTEL_COMMON_BLOCK_SMM_NO_MSR_SPCL_CHIPSET_USAGE)
+	{MSR_SPCL_CHIPSET_USAGE, MASK64, BIT(0)},
+#endif
 };
 
-/*
- *  Fix up PCIE resource.
- */
-static void fixup_pciex_resource(void)
+static int fixup_cbmem_resource(uint32_t cbmem_id, uint64_t *base, uint64_t *length)
+{
+	const struct cbmem_entry *e;
+
+	e = cbmem_entry_find(cbmem_id);
+	if (!e)
+		return -1;
+
+	*base = (uintptr_t)cbmem_entry_start(e);
+	*length = cbmem_entry_size(e);
+
+	return 0;
+}
+
+static int add_fast_spi_resource(void)
 {
-	// Find max bus number and PCIEX length
-	rsc_pcie_mmio.length = CONFIG_ECAM_MMCONF_LENGTH; // 0x10000000;// 256 MB
-	rsc_pcie_mmio.base = CONFIG_ECAM_MMCONF_BASE_ADDRESS;
+	int Status = 0;
+
+	rsc_spi_mmio.base = (uintptr_t)fast_spi_get_bar();
+
+	Status |= add_pi_resource((void *)&rsc_spi_mmio, 1);
+	Status |= add_pi_resource((void *)&rsc_spi_pci, 1);
+
+	if (CONFIG(FAST_SPI_SUPPORTS_EXT_BIOS_WINDOW))
+		Status |= add_pi_resource((void *)&rsc_ext_spi_memory, 1);
+
+	return Status;
+}
+
+static int add_smm_debug_resource(void)
+{
+	int Status = 0;
+
+	if (CONFIG(CONSOLE_CBMEM) &&
+		!fixup_cbmem_resource(CBMEM_ID_CONSOLE,
+					&rsc_cbmemc_memory.base,
+					&rsc_cbmemc_memory.length)) {
+		Status |= add_pi_resource((void *)&rsc_cbmemc_memory, 1);
+	}
+
+	if (CONFIG(CONSOLE_SERIAL) && CONFIG(DRIVERS_UART_8250IO)) {
+		Status |= add_pi_resource((void *)&rsc_uart_io, 1);
+	} else if (CONFIG(CONSOLE_SERIAL) && CONFIG(DRIVERS_UART_8250IO)) {
+		rsc_uart_mmio.base = uart_platform_base(CONFIG_UART_FOR_CONSOLE);
+		if (rsc_uart_mmio.base != 0)
+			Status |= add_pi_resource((void *)&rsc_uart_mmio, 1);
+	}
+
+	return Status;
 }
 
 /*
@@ -126,19 +269,49 @@ static void add_simple_resources(void)
 	rsc_apic_mmio.base = ((uint64_t)ReadMsr.lo & 0xFFFFF000) |
 				((uint64_t)(ReadMsr.hi & 0x0000000F) << 32);
 
-	// PCIEX BAR
-	fixup_pciex_resource();
-
 	Status |= add_pi_resource((void *)&rsc_tseg_memory, 1);
 	Status |= add_pi_resource((void *)&rsc_spi_memory, 1);
 
 	Status |= add_pi_resource((void *)&rsc_pm_io, 1);
+	Status |= add_pi_resource((void *)&rsc_pci_io, 1);
 	Status |= add_pi_resource((void *)&rsc_pcie_mmio, 1);
 	Status |= add_pi_resource((void *)&rsc_apic_mmio, 1);
+	Status |= add_pi_resource((void *)&rsc_txt_mmio, 1);
 	Status |= add_pi_resource((void *)&rsc_sw_smi_trap_io, 1);
 
 	Status |= add_pi_resource((void *)&rsc_lpc_bridge_pci, 1);
 
+#if CONFIG(SOC_INTEL_COMMON_BLOCK_P2SB)
+	Status |= add_pi_resource((void *)&rsc_p2sb_mmio, 1);
+#endif
+#if CONFIG(SOC_INTEL_COMMON_BLOCK_P2SB2)
+	Status |= add_pi_resource((void *)&rsc_p2sb2_mmio, 1);
+#endif
+#if CONFIG(SOC_INTEL_COMMON_BLOCK_IOE_P2SB)
+	Status |= add_pi_resource((void *)&rsc_ioe_p2sb_mmio, 1);
+#endif
+
+	/* FIXME: Handle SOUTHBRIDGE_INTEL_COMMON_SPI */
+	if (CONFIG(SOC_INTEL_COMMON_BLOCK_FAST_SPI))
+		Status |= add_fast_spi_resource();
+
+	if (CONFIG(SMMSTORE_V2) &&
+	    !fixup_cbmem_resource(CBMEM_ID_SMM_COMBUFFER,
+				  &rsc_smmstore_comm_buffer_memory.base,
+				  &rsc_smmstore_comm_buffer_memory.length)) {
+		Status |= add_pi_resource((void *)&rsc_smmstore_comm_buffer_memory, 1);
+	}
+
+	if (CONFIG(TPM_PPI_UEFIVAR_BACKED) &&
+	    !fixup_cbmem_resource(CBMEM_ID_TPM_PPI,
+				  &rsc_tpm_ppi_memory.base,
+				  &rsc_tpm_ppi_memory.length)) {
+		Status |= add_pi_resource((void *)&rsc_tpm_ppi_memory, 1);
+	}
+
+	if (CONFIG(DEBUG_SMI))
+		Status |= add_smm_debug_resource();
+
 	if (Status != 0)
 		printk(BIOS_DEBUG, "STM - Error in adding simple resources\n");
 }
@@ -163,10 +336,14 @@ static void add_msr_resources(void)
 		printk(BIOS_DEBUG, "STM - Error in adding MSR resources\n");
 }
 
+__weak int mainboard_stm_add_resources(void)
+{
+	return 0;
+}
+
 /*
  * Add resources to BIOS resource database.
  */
-
 extern uint8_t *m_stm_resources_ptr;
 
 void add_resources_cmd(void)
@@ -176,4 +353,7 @@ void add_resources_cmd(void)
 	add_simple_resources();
 
 	add_msr_resources();
+
+	if (mainboard_stm_add_resources() != 0)
+		printk(BIOS_DEBUG, "STM - Error in adding mainboard resources\n");
 }
diff --git a/src/security/intel/stm/StmPlatformResource.h b/src/security/intel/stm/StmPlatformResource.h
index eaadab739eb..99a2bce3195 100644
--- a/src/security/intel/stm/StmPlatformResource.h
+++ b/src/security/intel/stm/StmPlatformResource.h
@@ -10,6 +10,7 @@
 
 #define LPC_DEVICE 31
 #define LPC_FUNCTION 0
+#define SPI_FUNCTION 5
 #define R_ACPI_PM_BASE 0x40
 #define ACPI_PM_BASE_MASK 0xFFF8
 
@@ -17,4 +18,6 @@
  *  Add resources to BIOS resource database.
  */
 void add_resources_cmd(void);
+int mainboard_stm_add_resources(void);
+
 #endif
diff --git a/src/security/intel/stm/StmPlatformSmm.c b/src/security/intel/stm/StmPlatformSmm.c
index 99e62c77c03..ea2dbfeefe2 100644
--- a/src/security/intel/stm/StmPlatformSmm.c
+++ b/src/security/intel/stm/StmPlatformSmm.c
@@ -7,6 +7,7 @@
 #include <cpu/x86/gdt.h>
 #include <cpu/x86/smm.h>
 #include <cpu/x86/msr.h>
+#include <dasharo/options.h>
 
 #include <cbfs.h>
 #include <console/console.h>
@@ -48,8 +49,7 @@ int load_stm_image(uintptr_t mseg)
 
 	stm_header = mseg_base;
 
-	stm_gen_4g_pagetable_x64((uint32_t)mseg_base
-				 + stm_header->hw_stm_hdr.cr3_offset);
+	stm_gen_4g_pagetable_x64((uintptr_t)mseg_base + stm_header->hw_stm_hdr.cr3_offset);
 
 	// Debug stuff
 	printk(BIOS_DEBUG,
@@ -58,9 +58,9 @@ int load_stm_image(uintptr_t mseg)
 	       stm_header->hw_stm_hdr.monitor_features,
 	       stm_header->hw_stm_hdr.cr3_offset);
 	printk(BIOS_DEBUG,
-	       "STM: Header-StaticImageSize: %d  Cr3Location: 0x%08x\n",
+	       "STM: Header-StaticImageSize: %d  Cr3Location: 0x%08lx\n",
 	       stm_header->sw_stm_hdr.static_image_size,
-	       ((uint32_t)mseg_base + stm_header->hw_stm_hdr.cr3_offset));
+	       ((uintptr_t)mseg_base + stm_header->hw_stm_hdr.cr3_offset));
 
 	status = 0; // always return good for now
 
@@ -142,9 +142,16 @@ void stm_setup(uintptr_t mseg, int cpu, uintptr_t smbase,
 	msr_t InitMseg;
 	msr_t MsegChk;
 	msr_t vmx_basic;
+	static int stm_en = -1;
 
 	uintptr_t addr_calc;  // used to calculate the stm resource heap area
 
+	if (stm_en == -1)
+		stm_en = (int)get_stm_option();
+
+	if (stm_en == 0)
+		return;
+
 	printk(BIOS_DEBUG, "STM: set up for cpu %d\n", cpu);
 
 	vmx_basic = rdmsr(IA32_VMX_BASIC_MSR);
diff --git a/src/soc/intel/alderlake/fsp_params.c b/src/soc/intel/alderlake/fsp_params.c
index 82246def092..5225c9f29a6 100644
--- a/src/soc/intel/alderlake/fsp_params.c
+++ b/src/soc/intel/alderlake/fsp_params.c
@@ -771,8 +771,14 @@ static void fill_fsps_uart_params(FSP_S_CONFIG *s_cfg,
 {
 	if (CONFIG(FSP_USES_CB_DEBUG_EVENT_HANDLER) && CONFIG(CONSOLE_SERIAL) &&
 			 CONFIG(FSP_ENABLE_SERIAL_DEBUG))
-		s_cfg->FspEventHandler = (UINT32)((FSP_EVENT_HANDLER *)
-				fsp_debug_event_handler);
+#if CONFIG(USE_X86_64_SUPPORT)
+	s_cfg->FspEventHandler = (UINT32)(EFI_PHYSICAL_ADDRESS)
+			fsp_debug_event_handler;
+#else
+	s_cfg->FspEventHandler = (UINT32)((FSP_EVENT_HANDLER *)
+			fsp_debug_event_handler);
+#endif
+
 	/* PCH UART selection for FSP Debug */
 	s_cfg->SerialIoDebugUartNumber = CONFIG_UART_FOR_CONSOLE;
 	ASSERT(ARRAY_SIZE(s_cfg->SerialIoUartAutoFlow) > CONFIG_UART_FOR_CONSOLE);
@@ -1347,7 +1353,7 @@ static void wait_for_panel_power_cycle_done(const struct soc_intel_alderlake_con
 		return;
 
 	bar0 = pci_read_config32(SA_DEV_IGD, PCI_BASE_ADDRESS_0);
-	mmio = (void *)(bar0 & ~PCI_BASE_ADDRESS_MEM_ATTR_MASK);
+	mmio = (void *)((uintptr_t)bar0 & ~PCI_BASE_ADDRESS_MEM_ATTR_MASK);
 	if (!mmio)
 		return;
 
@@ -1434,10 +1440,11 @@ void soc_load_logo_by_fsp(FSPS_UPD *supd)
 	if (s_cfg->LidStatus == 0)
 		config->panel_orientation = LB_FB_ORIENTATION_NORMAL;
 
-	fsp_load_and_convert_bmp_to_gop_blt(&supd->FspsConfig.LogoPtr,
+	fsp_load_and_convert_bmp_to_gop_blt(
+			 (efi_uintn_t *)&supd->FspsConfig.LogoPtr,
 			 &supd->FspsConfig.LogoSize,
-			 &supd->FspsConfig.BltBufferAddress,
-			 &supd->FspsConfig.BltBufferSize,
+			 (efi_uintn_t *)&supd->FspsConfig.BltBufferAddress,
+			 (efi_uintn_t *)&supd->FspsConfig.BltBufferSize,
 			 &supd->FspsConfig.LogoPixelHeight,
 			 &supd->FspsConfig.LogoPixelWidth,
 			 config->panel_orientation);
diff --git a/src/soc/intel/alderlake/romstage/fsp_params.c b/src/soc/intel/alderlake/romstage/fsp_params.c
index 16132fe8313..14d3ab9f025 100644
--- a/src/soc/intel/alderlake/romstage/fsp_params.c
+++ b/src/soc/intel/alderlake/romstage/fsp_params.c
@@ -526,8 +526,13 @@ void platform_fsp_memory_init_params_cb(FSPM_UPD *mupd, uint32_t version)
 	if (CONFIG(FSP_USES_CB_DEBUG_EVENT_HANDLER)) {
 		if (CONFIG(CONSOLE_SERIAL) && CONFIG(FSP_ENABLE_SERIAL_DEBUG)) {
 			enum fsp_log_level log_level = fsp_map_console_log_level();
+#if CONFIG(USE_X86_64_SUPPORT)
+			arch_upd->FspEventHandler = (UINT32)(EFI_PHYSICAL_ADDRESS)
+					fsp_debug_event_handler;
+#else
 			arch_upd->FspEventHandler = (UINT32)((FSP_EVENT_HANDLER *)
 					fsp_debug_event_handler);
+#endif
 			/* Set Serial debug message level */
 			m_cfg->PcdSerialDebugLevel = log_level;
 			/* Set MRC debug level */
diff --git a/src/soc/intel/baytrail/smihandler.c b/src/soc/intel/baytrail/smihandler.c
index 9fcd6621f94..f2cb3962977 100644
--- a/src/soc/intel/baytrail/smihandler.c
+++ b/src/soc/intel/baytrail/smihandler.c
@@ -266,6 +266,8 @@ static void southbridge_smi_store(void)
 	/* drivers/smmstore/smi.c */
 	ret = smmstore_exec(sub_command, (void *)reg_ebx);
 	io_smi->rax = ret;
+
+	smm_stm_restore_smram_to_vmcs(io_smi);
 }
 
 static void southbridge_smi_tpm_ppi(void)
@@ -282,6 +284,8 @@ static void southbridge_smi_tpm_ppi(void)
 	/* drivers/tpm/ppi_smm.c */
 	tpm_ppi_process_request_smm(reg_ebx);
 	io_smi->rax = 0;
+
+	smm_stm_restore_smram_to_vmcs(io_smi);
 }
 
 static void southbridge_smi_apmc(void)
diff --git a/src/soc/intel/braswell/smihandler.c b/src/soc/intel/braswell/smihandler.c
index 24b10e49cee..9ffa54e14d3 100644
--- a/src/soc/intel/braswell/smihandler.c
+++ b/src/soc/intel/braswell/smihandler.c
@@ -239,6 +239,8 @@ static void southbridge_smi_store(void)
 	/* drivers/smmstore/smi.c */
 	ret = smmstore_exec(sub_command, (void *)reg_ebx);
 	io_smi->rax = ret;
+
+	smm_stm_restore_smram_to_vmcs(io_smi);
 }
 
 static void southbridge_smi_tpm_ppi(void)
@@ -255,6 +257,8 @@ static void southbridge_smi_tpm_ppi(void)
 	/* drivers/tpm/ppi_smm.c */
 	tpm_ppi_process_request_smm(reg_ebx);
 	io_smi->rax = 0;
+
+	smm_stm_restore_smram_to_vmcs(io_smi);
 }
 
 static void southbridge_smi_apmc(void)
diff --git a/src/soc/intel/broadwell/pch/smihandler.c b/src/soc/intel/broadwell/pch/smihandler.c
index 940f0d5ce5d..533d0f43f2f 100644
--- a/src/soc/intel/broadwell/pch/smihandler.c
+++ b/src/soc/intel/broadwell/pch/smihandler.c
@@ -293,6 +293,8 @@ static void southbridge_smi_store(void)
 	/* drivers/smmstore/smi.c */
 	ret = smmstore_exec(sub_command, (void *)reg_ebx);
 	io_smi->rax = ret;
+
+	smm_stm_restore_smram_to_vmcs(io_smi);
 }
 
 static void southbridge_smi_tpm_ppi(void)
@@ -309,6 +311,8 @@ static void southbridge_smi_tpm_ppi(void)
 	/* drivers/tpm/ppi_smm.c */
 	tpm_ppi_process_request_smm(reg_ebx);
 	io_smi->rax = 0;
+
+	smm_stm_restore_smram_to_vmcs(io_smi);
 }
 
 static void southbridge_smi_apmc(void)
diff --git a/src/soc/intel/common/block/fast_spi/fast_spi.c b/src/soc/intel/common/block/fast_spi/fast_spi.c
index 8757850b6f4..2ce5851bf59 100644
--- a/src/soc/intel/common/block/fast_spi/fast_spi.c
+++ b/src/soc/intel/common/block/fast_spi/fast_spi.c
@@ -549,9 +549,22 @@ static void fast_spi_fill_ssdt(const struct device *dev)
 
 static void fast_spi_read_resources(struct device *dev)
 {
+	uintptr_t spi_bar = (uintptr_t)fast_spi_get_bar();
+
 	/* Read standard PCI resources. */
 	pci_dev_read_resources(dev);
 
+	/*
+	 * Do not move the SPI MMIO. Otherwise it will be impossible to pass
+	 * correct base address to STM, because CPU init with STM loading
+	 * happens before resource allocation in coreboot on FSP platforms.
+	 */
+	struct resource *res = probe_resource(dev, PCI_BASE_ADDRESS_0);
+	if (CONFIG(STM) && res && (spi_bar != 0)) {
+		res->base = spi_bar;
+		res->flags |= IORESOURCE_FIXED;
+	}
+
 	/* Add SPI flash MMIO window as a reserved resource. */
 	mmio_range(dev, 0, FLASH_BASE_ADDR, FLASH_MMIO_SIZE);
 	/* Add extended SPI flash MMIO window as reserved resource if enabled. */
diff --git a/src/soc/intel/common/block/smm/smihandler.c b/src/soc/intel/common/block/smm/smihandler.c
index 7abea21b542..4609587bc21 100644
--- a/src/soc/intel/common/block/smm/smihandler.c
+++ b/src/soc/intel/common/block/smm/smihandler.c
@@ -33,6 +33,9 @@
 #include <soc/smbus.h>
 #include <spi-generic.h>
 #include <stdint.h>
+#if CONFIG(STM)
+#include <security/intel/stm/StmApi.h>
+#endif
 
 /* SoC overrides. */
 
@@ -266,6 +269,7 @@ static void southbridge_smi_gsmi(
 	/* drivers/elog/gsmi.c */
 	ret = gsmi_exec(sub_command, &reg_ebx);
 	save_state_ops->set_reg(io_smi, RAX, ret);
+	smm_stm_restore_smram_to_vmcs(io_smi);
 }
 
 static void set_insmm_sts(const bool enable_writes)
@@ -314,6 +318,7 @@ static void southbridge_smi_store(
 	/* drivers/smmstore/smi.c */
 	ret = smmstore_exec(sub_command, (void *)(uintptr_t)reg_ebx);
 	save_state_ops->set_reg(io_smi, RAX, ret);
+	smm_stm_restore_smram_to_vmcs(io_smi);
 
 	if (wp_enabled) {
 		fast_spi_enable_wp();
@@ -349,6 +354,7 @@ static void southbridge_smi_tpm_ppi(
 	/* drivers/tpm/ppi_smm.c */
 	tpm_ppi_process_request_smm(reg_ebx);
 	save_state_ops->set_reg(io_smi, RAX, 0);
+	smm_stm_restore_smram_to_vmcs(io_smi);
 
 	if (wp_enabled) {
 		fast_spi_enable_wp();
diff --git a/src/soc/intel/denverton_ns/smihandler.c b/src/soc/intel/denverton_ns/smihandler.c
index 835a614e16e..2d4b3374f61 100644
--- a/src/soc/intel/denverton_ns/smihandler.c
+++ b/src/soc/intel/denverton_ns/smihandler.c
@@ -200,6 +200,8 @@ static void southbridge_smi_store(void)
 	/* drivers/smmstore/smi.c */
 	ret = smmstore_exec(sub_command, (void *)reg_ebx);
 	io_smi->rax = ret;
+
+	smm_stm_restore_smram_to_vmcs(io_smi);
 }
 
 static void southbridge_smi_tpm_ppi(void)
@@ -216,6 +218,8 @@ static void southbridge_smi_tpm_ppi(void)
 	/* drivers/tpm/ppi_smm.c */
 	tpm_ppi_process_request_smm(reg_ebx);
 	io_smi->rax = 0;
+
+	smm_stm_restore_smram_to_vmcs(io_smi);
 }
 
 static void southbridge_smi_apmc(void)
diff --git a/src/southbridge/intel/common/smihandler.c b/src/southbridge/intel/common/smihandler.c
index ee596d54e78..a5eca3e8f5a 100644
--- a/src/southbridge/intel/common/smihandler.c
+++ b/src/southbridge/intel/common/smihandler.c
@@ -293,6 +293,8 @@ static void southbridge_smi_store(void)
 	ret = smmstore_exec(sub_command, (void *)reg_rbx);
 	io_smi->rax = ret;
 
+	smm_stm_restore_smram_to_vmcs(io_smi);
+
 	if (wp_enabled)
 		spi_set_wp(true);
 }
@@ -318,6 +320,8 @@ static void southbridge_smi_tpm_ppi(void)
 	tpm_ppi_process_request_smm(reg_rbx);
 	io_smi->rax = 0;
 
+	smm_stm_restore_smram_to_vmcs(io_smi);
+
 	if (wp_enabled)
 		spi_set_wp(true);
 }
diff --git a/src/southbridge/intel/lynxpoint/smihandler.c b/src/southbridge/intel/lynxpoint/smihandler.c
index 4dfa48993da..9db69299a63 100644
--- a/src/southbridge/intel/lynxpoint/smihandler.c
+++ b/src/southbridge/intel/lynxpoint/smihandler.c
@@ -242,6 +242,8 @@ static void southbridge_smi_store(void)
 	/* drivers/smmstore/smi.c */
 	ret = smmstore_exec(sub_command, (void *)reg_ebx);
 	io_smi->rax = ret;
+
+	smm_stm_restore_smram_to_vmcs(io_smi);
 }
 
 static void southbridge_smi_tpm_ppi(void)
@@ -265,6 +267,8 @@ static void southbridge_smi_tpm_ppi(void)
 	tpm_ppi_process_request_smm(reg_rbx);
 	io_smi->rax = 0;
 
+	smm_stm_restore_smram_to_vmcs(io_smi);
+
 	if (wp_enabled)
 		spi_set_wp(true);
 }
diff --git a/src/vendorcode/dasharo/include/dasharo/options.h b/src/vendorcode/dasharo/include/dasharo/options.h
index 39d2aeac5f7..22dcb14900c 100644
--- a/src/vendorcode/dasharo/include/dasharo/options.h
+++ b/src/vendorcode/dasharo/include/dasharo/options.h
@@ -336,4 +336,13 @@ bool get_ibecc_option(bool ibecc_default);
  */
 bool dasharo_is_disk_capsules_boot(void);
 
+/* Looks Dasharo/"STM" variable to check SMI Transfer Monitor (STM) should be
+ * enabled.
+ *
+ * Result:
+ *  - true  - STM enabled
+ *  - false - STM disabled
+ */
+bool get_stm_option(void);
+
 #endif /* DASHARO_OPTIONS_H */
diff --git a/src/vendorcode/dasharo/options.c b/src/vendorcode/dasharo/options.c
index 58370705160..77888edc837 100644
--- a/src/vendorcode/dasharo/options.c
+++ b/src/vendorcode/dasharo/options.c
@@ -559,6 +559,16 @@ bool get_ibecc_option(bool ibecc_default)
 	return ibecc_en;
 }
 
+bool get_stm_option(void)
+{
+	bool stm_enabled = false;
+
+	if (CONFIG(DRIVERS_EFI_VARIABLE_STORE) && CONFIG(STM))
+		read_bool_var("STM", &stm_enabled);
+
+	return stm_enabled;
+}
+
 bool dasharo_is_disk_capsules_boot(void)
 {
 	if (!CONFIG(EDK2_CAPSULES_V2))