diff --git a/src/arch/x86/cpu_common.c b/src/arch/x86/cpu_common.c
index e674afae30..af4e7b001d 100644
--- a/src/arch/x86/cpu_common.c
+++ b/src/arch/x86/cpu_common.c
@@ -49,8 +49,11 @@ int cpu_phys_address_size(void)
 	if (!(cpu_have_cpuid()))
 		return 32;
 
-	if (cpu_cpuid_extended_level() >= 0x80000008)
-		return cpuid_eax(0x80000008) & 0xff;
+	if (cpu_cpuid_extended_level() >= 0x80000008) {
+		int size = cpuid_eax(0x80000008) & 0xff;
+		size -= get_reserved_phys_addr_bits();
+		return size;
+	}
 
 	if (cpuid_edx(1) & (CPUID_FEATURE_PAE | CPUID_FEATURE_PSE36))
 		return 36;
diff --git a/src/arch/x86/include/arch/cpu.h b/src/arch/x86/include/arch/cpu.h
index 1355096abe..96cf23bb76 100644
--- a/src/arch/x86/include/arch/cpu.h
+++ b/src/arch/x86/include/arch/cpu.h
@@ -316,4 +316,15 @@ size_t get_cache_size(const struct cpu_cache_info *info);
  */
 bool fill_cpu_cache_info(uint8_t level, struct cpu_cache_info *info);
 
+#if CONFIG(CPU_INTEL_COMMON)
+int get_reserved_phys_addr_bits(void);
+#else
+/* Default implementation */
+static inline int get_reserved_phys_addr_bits(void)
+{
+	/* Default implementation */
+	return 0;
+}
+#endif
+
 #endif /* ARCH_CPU_H */
diff --git a/src/cpu/intel/common/Makefile.inc b/src/cpu/intel/common/Makefile.inc
index c4ac57ebcf..8b247abe17 100644
--- a/src/cpu/intel/common/Makefile.inc
+++ b/src/cpu/intel/common/Makefile.inc
@@ -1,6 +1,8 @@
 ## SPDX-License-Identifier: GPL-2.0-only
 
+bootblock-$(CONFIG_CPU_INTEL_COMMON) += common_init.c
 romstage-$(CONFIG_CPU_INTEL_COMMON) += common_init.c
+postcar-$(CONFIG_CPU_INTEL_COMMON) += common_init.c
 ramstage-$(CONFIG_CPU_INTEL_COMMON) += common_init.c
 ramstage-$(CONFIG_CPU_INTEL_COMMON) += hyperthreading.c
 ramstage-$(CONFIG_CPU_INTEL_COMMON_VOLTAGE) += voltage.c
diff --git a/src/cpu/intel/common/common_init.c b/src/cpu/intel/common/common_init.c
index f8608ae029..ff00f0247f 100644
--- a/src/cpu/intel/common/common_init.c
+++ b/src/cpu/intel/common/common_init.c
@@ -238,3 +238,28 @@ bool is_tme_supported(void)
 	cpuid_regs = cpuid_ext(CPUID_STRUCT_EXTENDED_FEATURE_FLAGS, 0x0);
 	return (cpuid_regs.ecx & CPUID_EXT_FEATURE_TME_SUPPORTED);
 }
+
+/*
+ * Get number of address bits used by Total Memory Encryption (TME)
+ *
+ * Returns TME_ACTIVATE[MK_TME_KEYID_BITS] (MSR 0x982 Bits[32-35]).
+ *
+ * NOTE: This function should be called after MK-TME features has been
+ * configured in the MSRs according to the capabilities and platform
+ * configuration. For instance, after FSP-M.
+ */
+static int get_tme_keyid_bits(void)
+{
+	msr_t msr;
+
+	msr = rdmsr(MSR_TME_ACTIVATE);
+	return msr.hi & TME_ACTIVATE_HI_KEYID_BITS_MASK;
+}
+
+int get_reserved_phys_addr_bits(void)
+{
+	if (!is_tme_supported())
+		return 0;
+
+	return get_tme_keyid_bits();
+}
diff --git a/src/include/cpu/intel/msr.h b/src/include/cpu/intel/msr.h
index 8efe4e2c62..75c12a8be9 100644
--- a/src/include/cpu/intel/msr.h
+++ b/src/include/cpu/intel/msr.h
@@ -33,4 +33,7 @@
 
 #define MSR_PKG_C10_RESIDENCY	0x632
 
+#define MSR_TME_ACTIVATE			0x982
+#define  TME_ACTIVATE_HI_KEYID_BITS_MASK	0xf
+
 #endif /* CPU_INTEL_MSR_H */