diff --git a/src/include/cpu/intel/smm_reloc.h b/src/include/cpu/intel/smm_reloc.h
index 3d95efce44..6b1a525d6c 100644
--- a/src/include/cpu/intel/smm_reloc.h
+++ b/src/include/cpu/intel/smm_reloc.h
@@ -36,7 +36,8 @@ struct ied_header {
 /* These helpers are for performing SMM relocation. */
 void northbridge_write_smram(u8 smram);
 
-void smm_open_aseg(void);
+void smm_close(void);
+void smm_open(void);
 void smm_lock(void);
 void smm_relocate(void);
 
diff --git a/src/mainboard/emulation/qemu-q35/cpu.c b/src/mainboard/emulation/qemu-q35/cpu.c
index 58b1fa5d7f..c57ec500fe 100644
--- a/src/mainboard/emulation/qemu-q35/cpu.c
+++ b/src/mainboard/emulation/qemu-q35/cpu.c
@@ -18,8 +18,7 @@ static void get_smm_info(uintptr_t *perm_smbase, size_t *perm_smsize,
 
 	smm_subregion(SMM_SUBREGION_HANDLER, perm_smbase, perm_smsize);
 
-	if (CONFIG(SMM_ASEG))
-		smm_open_aseg();
+	smm_open();
 
 	/* FIXME: on X86_64 the save state size is smaller than the size of the SMM stub */
 	*smm_save_state_size = sizeof(amd64_smm_state_save_area_t);
@@ -77,6 +76,9 @@ static void relocation_handler(int cpu, uintptr_t curr_smbase,
 
 static void post_mp_init(void)
 {
+	/* Limit access to SMRAM to SMM module. */
+	smm_close();
+
 	/* Now that all APs have been relocated as well as the BSP let SMIs start flowing. */
 	global_smi_enable();
 
diff --git a/src/mainboard/emulation/qemu-q35/memmap.c b/src/mainboard/emulation/qemu-q35/memmap.c
index 34656134ff..3f3ced23f8 100644
--- a/src/mainboard/emulation/qemu-q35/memmap.c
+++ b/src/mainboard/emulation/qemu-q35/memmap.c
@@ -78,6 +78,26 @@ void smm_region(uintptr_t *start, size_t *size)
 	printk(BIOS_SPEW, "SMM_BASE: 0x%08lx, SMM_SIZE: %zu MiB\n", *start, *size / MiB);
 }
 
+void smm_open(void)
+{
+	/* Set D_OPEN */
+	if (CONFIG(SMM_ASEG))
+		pci_write_config8(HOST_BRIDGE, SMRAMC, D_OPEN | G_SMRAME | C_BASE_SEG);
+
+	if (CONFIG(SMM_TSEG))
+		pci_and_config8(HOST_BRIDGE, ESMRAMC, ~T_EN);
+}
+
+void smm_close(void)
+{
+	/* Clear D_OPEN */
+	if (CONFIG(SMM_ASEG))
+		pci_write_config8(HOST_BRIDGE, SMRAMC, G_SMRAME | C_BASE_SEG);
+
+	if (CONFIG(SMM_TSEG))
+		pci_or_config8(HOST_BRIDGE, ESMRAMC, T_EN);
+}
+
 void smm_lock(void)
 {
 	/*
@@ -87,13 +107,5 @@ void smm_lock(void)
 	 */
 	printk(BIOS_DEBUG, "Locking SMM.\n");
 
-	if (CONFIG(SMM_TSEG))
-		pci_or_config8(HOST_BRIDGE, ESMRAMC, T_EN);
-
-	pci_write_config8(PCI_DEV(0, 0, 0), SMRAMC, D_LCK | G_SMRAME | C_BASE_SEG);
-}
-
-void smm_open_aseg(void)
-{
-	pci_write_config8(PCI_DEV(0, 0, 0), SMRAMC, G_SMRAME | C_BASE_SEG | D_OPEN);
+	pci_write_config8(HOST_BRIDGE, SMRAMC, D_LCK | G_SMRAME | C_BASE_SEG);
 }