We're reviewing the STM code, of course.
While we're on the topic, can someone please ask the NSA to honor our coding style? ;) I don't want to get involved because it's really not my area, but it looks pretty terrible at the moment (full of camelCase and ALL_CAPS identifiers, C99 comments, typedefs to non-coreboot types, commented-out code, incorrect or missing license headers, #pragma pack() instead of __packed, etc.). If they just want to copy&paste wholesale UEFI files to coreboot, they should dump them in vendorcode instead.