diff --git a/misc/config_tools/data/cfl-k700-i7/hybrid_rt.xml b/misc/config_tools/data/cfl-k700-i7/hybrid_rt.xml
index 1e8c40a14..a5565d7fc 100644
--- a/misc/config_tools/data/cfl-k700-i7/hybrid_rt.xml
+++ b/misc/config_tools/data/cfl-k700-i7/hybrid_rt.xml
@@ -17,6 +17,7 @@
         <MULTIBOOT2>y</MULTIBOOT2>
         <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
         <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+        <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
         <RDT>
             <RDT_ENABLED>n</RDT_ENABLED>
             <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/cfl-k700-i7/industry.xml b/misc/config_tools/data/cfl-k700-i7/industry.xml
index 09425e1b3..badf8d5c5 100644
--- a/misc/config_tools/data/cfl-k700-i7/industry.xml
+++ b/misc/config_tools/data/cfl-k700-i7/industry.xml
@@ -17,6 +17,7 @@
         <MULTIBOOT2>y</MULTIBOOT2>
         <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
         <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+        <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
         <RDT>
             <RDT_ENABLED>n</RDT_ENABLED>
             <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/ehl-crb-b/fusa_partition.xml b/misc/config_tools/data/ehl-crb-b/fusa_partition.xml
index 7897ea56d..849a6b3c3 100644
--- a/misc/config_tools/data/ehl-crb-b/fusa_partition.xml
+++ b/misc/config_tools/data/ehl-crb-b/fusa_partition.xml
@@ -16,6 +16,7 @@
             <MULTIBOOT2>y</MULTIBOOT2>
             <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
             <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+            <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
             <RDT>
                 <RDT_ENABLED>n</RDT_ENABLED>
                 <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/ehl-crb-b/hybrid.xml b/misc/config_tools/data/ehl-crb-b/hybrid.xml
index 6b94a75f5..50f079587 100644
--- a/misc/config_tools/data/ehl-crb-b/hybrid.xml
+++ b/misc/config_tools/data/ehl-crb-b/hybrid.xml
@@ -16,6 +16,7 @@
             <MULTIBOOT2>y</MULTIBOOT2>
             <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
             <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+            <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
             <RDT>
                 <RDT_ENABLED>n</RDT_ENABLED>
                 <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/ehl-crb-b/hybrid_rt.xml b/misc/config_tools/data/ehl-crb-b/hybrid_rt.xml
index a4c2ec187..ee3bcbe05 100644
--- a/misc/config_tools/data/ehl-crb-b/hybrid_rt.xml
+++ b/misc/config_tools/data/ehl-crb-b/hybrid_rt.xml
@@ -16,6 +16,7 @@
             <MULTIBOOT2>y</MULTIBOOT2>
             <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
             <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+            <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
             <RDT>
                 <RDT_ENABLED>n</RDT_ENABLED>
                 <CDP_ENABLED>y</CDP_ENABLED>
diff --git a/misc/config_tools/data/ehl-crb-b/hybrid_rt_fusa.xml b/misc/config_tools/data/ehl-crb-b/hybrid_rt_fusa.xml
index 05cdb509d..6deb7bfeb 100644
--- a/misc/config_tools/data/ehl-crb-b/hybrid_rt_fusa.xml
+++ b/misc/config_tools/data/ehl-crb-b/hybrid_rt_fusa.xml
@@ -16,6 +16,7 @@
             <MULTIBOOT2>y</MULTIBOOT2>
             <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
             <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+            <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
             <RDT>
                 <RDT_ENABLED>n</RDT_ENABLED>
                 <CDP_ENABLED>y</CDP_ENABLED>
diff --git a/misc/config_tools/data/ehl-crb-b/industry.xml b/misc/config_tools/data/ehl-crb-b/industry.xml
index b543cd94e..aa860ca35 100644
--- a/misc/config_tools/data/ehl-crb-b/industry.xml
+++ b/misc/config_tools/data/ehl-crb-b/industry.xml
@@ -16,6 +16,7 @@
             <MULTIBOOT2>y</MULTIBOOT2>
             <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
             <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+            <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
             <RDT>
                 <RDT_ENABLED>y</RDT_ENABLED>
                 <CDP_ENABLED>y</CDP_ENABLED>
diff --git a/misc/config_tools/data/ehl-crb-b/logical_partition.xml b/misc/config_tools/data/ehl-crb-b/logical_partition.xml
index d853418ef..4fb9ee765 100644
--- a/misc/config_tools/data/ehl-crb-b/logical_partition.xml
+++ b/misc/config_tools/data/ehl-crb-b/logical_partition.xml
@@ -16,6 +16,7 @@
             <MULTIBOOT2>y</MULTIBOOT2>
             <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
             <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+            <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
             <RDT>
                 <RDT_ENABLED>n</RDT_ENABLED>
                 <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/ehl-crb-b/sdc.xml b/misc/config_tools/data/ehl-crb-b/sdc.xml
index 727869212..6376709ab 100644
--- a/misc/config_tools/data/ehl-crb-b/sdc.xml
+++ b/misc/config_tools/data/ehl-crb-b/sdc.xml
@@ -16,6 +16,7 @@
             <MULTIBOOT2>y</MULTIBOOT2>
             <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
             <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+            <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
             <RDT>
                 <RDT_ENABLED>n</RDT_ENABLED>
                 <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/generic_board/hybrid.xml b/misc/config_tools/data/generic_board/hybrid.xml
index c216f89ea..d6e9e9ed2 100644
--- a/misc/config_tools/data/generic_board/hybrid.xml
+++ b/misc/config_tools/data/generic_board/hybrid.xml
@@ -15,6 +15,7 @@
       <MULTIBOOT2>y</MULTIBOOT2>
       <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
       <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+      <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
       <RDT>
         <RDT_ENABLED>n</RDT_ENABLED>
         <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/generic_board/industry.xml b/misc/config_tools/data/generic_board/industry.xml
index 1b60f95b6..b56ce266f 100644
--- a/misc/config_tools/data/generic_board/industry.xml
+++ b/misc/config_tools/data/generic_board/industry.xml
@@ -15,6 +15,7 @@
       <MULTIBOOT2>y</MULTIBOOT2>
       <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
       <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+      <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
       <RDT>
         <RDT_ENABLED>n</RDT_ENABLED>
         <CDP_ENABLED>y</CDP_ENABLED>
diff --git a/misc/config_tools/data/generic_board/logical_partition.xml b/misc/config_tools/data/generic_board/logical_partition.xml
index e1f8e9824..33dd550b7 100644
--- a/misc/config_tools/data/generic_board/logical_partition.xml
+++ b/misc/config_tools/data/generic_board/logical_partition.xml
@@ -15,6 +15,7 @@
       <MULTIBOOT2>y</MULTIBOOT2>
       <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
       <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+      <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
       <RDT>
         <RDT_ENABLED>n</RDT_ENABLED>
         <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/nuc11tnbi5/hybrid.xml b/misc/config_tools/data/nuc11tnbi5/hybrid.xml
index 003221dd6..578602e85 100644
--- a/misc/config_tools/data/nuc11tnbi5/hybrid.xml
+++ b/misc/config_tools/data/nuc11tnbi5/hybrid.xml
@@ -15,6 +15,7 @@
       <MULTIBOOT2>y</MULTIBOOT2>
       <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
       <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+      <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
       <RDT>
         <RDT_ENABLED>n</RDT_ENABLED>
         <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/nuc11tnbi5/industry.xml b/misc/config_tools/data/nuc11tnbi5/industry.xml
index 530e8cff0..abbb482f5 100644
--- a/misc/config_tools/data/nuc11tnbi5/industry.xml
+++ b/misc/config_tools/data/nuc11tnbi5/industry.xml
@@ -15,6 +15,7 @@
       <MULTIBOOT2>y</MULTIBOOT2>
       <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
       <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+      <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
       <RDT>
         <RDT_ENABLED>n</RDT_ENABLED>
         <CDP_ENABLED>y</CDP_ENABLED>
diff --git a/misc/config_tools/data/nuc11tnbi5/logical_partition.xml b/misc/config_tools/data/nuc11tnbi5/logical_partition.xml
index d4fb0378d..b6fe93563 100644
--- a/misc/config_tools/data/nuc11tnbi5/logical_partition.xml
+++ b/misc/config_tools/data/nuc11tnbi5/logical_partition.xml
@@ -15,6 +15,7 @@
       <MULTIBOOT2>y</MULTIBOOT2>
       <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
       <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+      <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
       <RDT>
         <RDT_ENABLED>n</RDT_ENABLED>
         <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/nuc7i7dnb/hybrid.xml b/misc/config_tools/data/nuc7i7dnb/hybrid.xml
index 420cf5abb..757e5e364 100644
--- a/misc/config_tools/data/nuc7i7dnb/hybrid.xml
+++ b/misc/config_tools/data/nuc7i7dnb/hybrid.xml
@@ -17,6 +17,7 @@
         <MULTIBOOT2>y</MULTIBOOT2>
         <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
         <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+        <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
         <RDT>
             <RDT_ENABLED>n</RDT_ENABLED>
             <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/nuc7i7dnb/industry.xml b/misc/config_tools/data/nuc7i7dnb/industry.xml
index f8d70d916..167184341 100644
--- a/misc/config_tools/data/nuc7i7dnb/industry.xml
+++ b/misc/config_tools/data/nuc7i7dnb/industry.xml
@@ -17,6 +17,7 @@
         <MULTIBOOT2>y</MULTIBOOT2>
         <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
         <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+        <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
         <RDT>
             <RDT_ENABLED>n</RDT_ENABLED>
             <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/nuc7i7dnb/logical_partition.xml b/misc/config_tools/data/nuc7i7dnb/logical_partition.xml
index c4a4bb7fb..382d89fda 100644
--- a/misc/config_tools/data/nuc7i7dnb/logical_partition.xml
+++ b/misc/config_tools/data/nuc7i7dnb/logical_partition.xml
@@ -17,6 +17,7 @@
         <MULTIBOOT2>y</MULTIBOOT2>
         <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
         <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+        <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
         <RDT>
             <RDT_ENABLED>n</RDT_ENABLED>
             <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/nuc7i7dnb/sdc.xml b/misc/config_tools/data/nuc7i7dnb/sdc.xml
index c64ced923..5e141a89c 100644
--- a/misc/config_tools/data/nuc7i7dnb/sdc.xml
+++ b/misc/config_tools/data/nuc7i7dnb/sdc.xml
@@ -17,6 +17,7 @@
         <MULTIBOOT2>y</MULTIBOOT2>
         <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
         <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+        <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
         <RDT>
             <RDT_ENABLED>n</RDT_ENABLED>
             <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/qemu/sdc.xml b/misc/config_tools/data/qemu/sdc.xml
index 730adca4a..f686602e4 100644
--- a/misc/config_tools/data/qemu/sdc.xml
+++ b/misc/config_tools/data/qemu/sdc.xml
@@ -17,6 +17,7 @@
         <MULTIBOOT2>y</MULTIBOOT2>
         <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
         <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+        <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
         <RDT>
             <RDT_ENABLED>n</RDT_ENABLED>
             <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/tgl-rvp/hybrid.xml b/misc/config_tools/data/tgl-rvp/hybrid.xml
index 70ed73100..258dceab6 100644
--- a/misc/config_tools/data/tgl-rvp/hybrid.xml
+++ b/misc/config_tools/data/tgl-rvp/hybrid.xml
@@ -17,6 +17,7 @@
         <MULTIBOOT2>y</MULTIBOOT2>
         <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
         <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+        <SECURITY_VM_FIXUP>y</SECURITY_VM_FIXUP>
         <RDT>
             <RDT_ENABLED>n</RDT_ENABLED>
             <CDP_ENABLED>n</CDP_ENABLED>
@@ -69,7 +70,7 @@
     <vm_type>SAFETY_VM</vm_type>
     <name>ACRN PRE-LAUNCHED VM0</name>
     <guest_flags>
-        <guest_flag>0</guest_flag>
+        <guest_flag>GUEST_FLAG_TPM2_FIXUP</guest_flag>
     </guest_flags>
     <cpu_affinity>
         <pcpu_id>3</pcpu_id>
diff --git a/misc/config_tools/data/tgl-rvp/hybrid_rt.xml b/misc/config_tools/data/tgl-rvp/hybrid_rt.xml
index 562435a40..e525277a2 100644
--- a/misc/config_tools/data/tgl-rvp/hybrid_rt.xml
+++ b/misc/config_tools/data/tgl-rvp/hybrid_rt.xml
@@ -17,6 +17,7 @@
         <MULTIBOOT2>y</MULTIBOOT2>
         <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
         <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+        <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
         <RDT>
             <RDT_ENABLED>n</RDT_ENABLED>
             <CDP_ENABLED>y</CDP_ENABLED>
diff --git a/misc/config_tools/data/tgl-rvp/industry.xml b/misc/config_tools/data/tgl-rvp/industry.xml
index a7d8ba473..9e08b64b5 100644
--- a/misc/config_tools/data/tgl-rvp/industry.xml
+++ b/misc/config_tools/data/tgl-rvp/industry.xml
@@ -15,6 +15,7 @@
       <MULTIBOOT2>y</MULTIBOOT2>
       <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
       <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+      <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
       <RDT>
         <RDT_ENABLED>n</RDT_ENABLED>
         <CDP_ENABLED>y</CDP_ENABLED>
diff --git a/misc/config_tools/data/tgl-rvp/logical_partition.xml b/misc/config_tools/data/tgl-rvp/logical_partition.xml
index 4815ce381..22d98e00a 100644
--- a/misc/config_tools/data/tgl-rvp/logical_partition.xml
+++ b/misc/config_tools/data/tgl-rvp/logical_partition.xml
@@ -17,6 +17,7 @@
         <MULTIBOOT2>y</MULTIBOOT2>
         <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
         <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+        <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
         <RDT>
             <RDT_ENABLED>n</RDT_ENABLED>
             <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/tgl-rvp/sdc.xml b/misc/config_tools/data/tgl-rvp/sdc.xml
index a7507ab69..c9a2f977a 100644
--- a/misc/config_tools/data/tgl-rvp/sdc.xml
+++ b/misc/config_tools/data/tgl-rvp/sdc.xml
@@ -17,6 +17,7 @@
         <MULTIBOOT2>y</MULTIBOOT2>
         <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
         <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+        <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
         <RDT>
             <RDT_ENABLED>n</RDT_ENABLED>
             <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/whl-ipc-i5/hybrid.xml b/misc/config_tools/data/whl-ipc-i5/hybrid.xml
index f71e3fb39..76c445db5 100644
--- a/misc/config_tools/data/whl-ipc-i5/hybrid.xml
+++ b/misc/config_tools/data/whl-ipc-i5/hybrid.xml
@@ -17,6 +17,7 @@
         <MULTIBOOT2>y</MULTIBOOT2>
         <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
         <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+        <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
         <RDT>
             <RDT_ENABLED>n</RDT_ENABLED>
             <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/whl-ipc-i5/hybrid_rt.xml b/misc/config_tools/data/whl-ipc-i5/hybrid_rt.xml
index f89948f31..68f1407bc 100644
--- a/misc/config_tools/data/whl-ipc-i5/hybrid_rt.xml
+++ b/misc/config_tools/data/whl-ipc-i5/hybrid_rt.xml
@@ -17,6 +17,7 @@
         <MULTIBOOT2>y</MULTIBOOT2>
         <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
         <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+        <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
         <RDT>
             <RDT_ENABLED>n</RDT_ENABLED>
             <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/whl-ipc-i5/industry.xml b/misc/config_tools/data/whl-ipc-i5/industry.xml
index e35f14e6d..d57ce744f 100644
--- a/misc/config_tools/data/whl-ipc-i5/industry.xml
+++ b/misc/config_tools/data/whl-ipc-i5/industry.xml
@@ -17,6 +17,7 @@
         <MULTIBOOT2>y</MULTIBOOT2>
         <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
         <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+        <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
         <RDT>
             <RDT_ENABLED>n</RDT_ENABLED>
             <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/whl-ipc-i5/logical_partition.xml b/misc/config_tools/data/whl-ipc-i5/logical_partition.xml
index 16198baab..98b0a2fc6 100644
--- a/misc/config_tools/data/whl-ipc-i5/logical_partition.xml
+++ b/misc/config_tools/data/whl-ipc-i5/logical_partition.xml
@@ -17,6 +17,7 @@
         <MULTIBOOT2>y</MULTIBOOT2>
         <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
         <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+        <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
         <RDT>
             <RDT_ENABLED>n</RDT_ENABLED>
             <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/whl-ipc-i5/sdc.xml b/misc/config_tools/data/whl-ipc-i5/sdc.xml
index 11771c8f8..5b66f5c7b 100644
--- a/misc/config_tools/data/whl-ipc-i5/sdc.xml
+++ b/misc/config_tools/data/whl-ipc-i5/sdc.xml
@@ -17,6 +17,7 @@
         <MULTIBOOT2>y</MULTIBOOT2>
         <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
         <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+        <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
         <RDT>
             <RDT_ENABLED>n</RDT_ENABLED>
             <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/whl-ipc-i7/hybrid.xml b/misc/config_tools/data/whl-ipc-i7/hybrid.xml
index 3ec66820d..fd56e3daa 100644
--- a/misc/config_tools/data/whl-ipc-i7/hybrid.xml
+++ b/misc/config_tools/data/whl-ipc-i7/hybrid.xml
@@ -17,6 +17,7 @@
         <MULTIBOOT2>y</MULTIBOOT2>
         <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
         <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+        <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
         <RDT>
             <RDT_ENABLED>n</RDT_ENABLED>
             <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/whl-ipc-i7/hybrid_rt.xml b/misc/config_tools/data/whl-ipc-i7/hybrid_rt.xml
index 1474bf821..e6f64a5fe 100644
--- a/misc/config_tools/data/whl-ipc-i7/hybrid_rt.xml
+++ b/misc/config_tools/data/whl-ipc-i7/hybrid_rt.xml
@@ -17,6 +17,7 @@
         <MULTIBOOT2>y</MULTIBOOT2>
         <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
         <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+        <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
         <RDT>
             <RDT_ENABLED>n</RDT_ENABLED>
             <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/whl-ipc-i7/industry.xml b/misc/config_tools/data/whl-ipc-i7/industry.xml
index a7888af50..39eeebd89 100644
--- a/misc/config_tools/data/whl-ipc-i7/industry.xml
+++ b/misc/config_tools/data/whl-ipc-i7/industry.xml
@@ -17,6 +17,7 @@
         <MULTIBOOT2>y</MULTIBOOT2>
         <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
         <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+        <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
         <RDT>
             <RDT_ENABLED>n</RDT_ENABLED>
             <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/whl-ipc-i7/logical_partition.xml b/misc/config_tools/data/whl-ipc-i7/logical_partition.xml
index 0ab3ea324..bab5ea8c8 100644
--- a/misc/config_tools/data/whl-ipc-i7/logical_partition.xml
+++ b/misc/config_tools/data/whl-ipc-i7/logical_partition.xml
@@ -17,6 +17,7 @@
         <MULTIBOOT2>y</MULTIBOOT2>
         <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
         <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+        <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
         <RDT>
             <RDT_ENABLED>n</RDT_ENABLED>
             <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/data/whl-ipc-i7/sdc.xml b/misc/config_tools/data/whl-ipc-i7/sdc.xml
index bcf126503..ca0d0620f 100644
--- a/misc/config_tools/data/whl-ipc-i7/sdc.xml
+++ b/misc/config_tools/data/whl-ipc-i7/sdc.xml
@@ -17,6 +17,7 @@
         <MULTIBOOT2>y</MULTIBOOT2>
         <ENFORCE_TURNOFF_AC>y</ENFORCE_TURNOFF_AC>
         <ENFORCE_TURNOFF_GP>n</ENFORCE_TURNOFF_GP>
+        <SECURITY_VM_FIXUP>n</SECURITY_VM_FIXUP>
         <RDT>
             <RDT_ENABLED>n</RDT_ENABLED>
             <CDP_ENABLED>n</CDP_ENABLED>
diff --git a/misc/config_tools/schema/config.xsd b/misc/config_tools/schema/config.xsd
index 495516f24..035e74817 100644
--- a/misc/config_tools/schema/config.xsd
+++ b/misc/config_tools/schema/config.xsd
@@ -118,6 +118,12 @@ UC lock, HV enable it and VMs can't disable. Set this to enforce turn off that #
 developer only.</xs:documentation>
       </xs:annotation>
     </xs:element>
+    <xs:element name="SECURITY_VM_FIXUP" type="Boolean" default="n">
+      <xs:annotation>
+        <xs:documentation>Enable to do fixup for TPM2 and SMBIOS for Security VM. If no
+Security VM, setting this option to ``n``</xs:documentation>
+      </xs:annotation>
+    </xs:element>
     <xs:element name="RDT" type="RDTType">
       <xs:annotation>
         <xs:documentation>Enable the Intel Resource Director Technology (RDT)
diff --git a/misc/config_tools/xforms/config_common.xsl b/misc/config_tools/xforms/config_common.xsl
index 13aa869a1..7245daea7 100644
--- a/misc/config_tools/xforms/config_common.xsl
+++ b/misc/config_tools/xforms/config_common.xsl
@@ -84,6 +84,10 @@
       <xsl:with-param name="key" select="'ENFORCE_TURNOFF_GP'" />
     </xsl:call-template>
 
+    <xsl:call-template name="boolean-by-key">
+      <xsl:with-param name="key" select="'SECURITY_VM_FIXUP'" />
+    </xsl:call-template>
+
     <xsl:call-template name="boolean-by-key-value">
       <xsl:with-param name="key" select="'RDT_ENABLED'" />
       <xsl:with-param name="value" select="RDT/RDT_ENABLED" />