diff --git a/src/mainboard/emulation/qemu-i440fx/memmap.c b/src/mainboard/emulation/qemu-i440fx/memmap.c
index b30b3816c5..75ab352b69 100644
--- a/src/mainboard/emulation/qemu-i440fx/memmap.c
+++ b/src/mainboard/emulation/qemu-i440fx/memmap.c
@@ -4,6 +4,7 @@
 #include <arch/io.h>
 #include <arch/romstage.h>
 #include <console/console.h>
+#include <cpu/x86/smm.h>
 #include "memory.h"
 #include "fw_cfg.h"
 
@@ -50,6 +51,11 @@ void *cbmem_top_chipset(void)
 		top = (uintptr_t)qemu_get_memory_size() * 1024;
 	}
 
+	if (CONFIG(BOARD_EMULATION_QEMU_X86_Q35)) {
+		size_t smm_size;
+		smm_region(&top, &smm_size);
+	}
+
 	return (void *)top;
 }
 
diff --git a/src/mainboard/emulation/qemu-q35/Makefile.inc b/src/mainboard/emulation/qemu-q35/Makefile.inc
index ddcf6da062..4bd91f0217 100644
--- a/src/mainboard/emulation/qemu-q35/Makefile.inc
+++ b/src/mainboard/emulation/qemu-q35/Makefile.inc
@@ -2,17 +2,21 @@ bootblock-y += bootblock.c
 
 romstage-y += ../qemu-i440fx/fw_cfg.c
 romstage-y += ../qemu-i440fx/memmap.c
+romstage-y += memmap.c
 
 postcar-y += ../qemu-i440fx/fw_cfg.c
 postcar-y += ../qemu-i440fx/memmap.c
 postcar-y += ../qemu-i440fx/exit_car.S
+postcar-y += memmap.c
 
 ramstage-y += ../qemu-i440fx/fw_cfg.c
 ramstage-y += ../qemu-i440fx/memmap.c
 ramstage-y += ../qemu-i440fx/northbridge.c
+ramstage-y += memmap.c
 
 verstage-$(CONFIG_CHROMEOS) += chromeos.c
 verstage-$(CONFIG_CHROMEOS) += ../qemu-i440fx/fw_cfg.c
 ramstage-$(CONFIG_CHROMEOS) += chromeos.c
 
 smm-$(CONFIG_HAVE_SMI_HANDLER) += smi.c
+smm-$(CONFIG_HAVE_SMI_HANDLER) += memmap.c
diff --git a/src/mainboard/emulation/qemu-q35/memmap.c b/src/mainboard/emulation/qemu-q35/memmap.c
new file mode 100644
index 0000000000..a8b1433714
--- /dev/null
+++ b/src/mainboard/emulation/qemu-q35/memmap.c
@@ -0,0 +1,43 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+#define __SIMPLE_DEVICE__
+
+#include <console/console.h>
+#include <cpu/x86/smm.h>
+#include <device/pci_ops.h>
+#include <mainboard/emulation/qemu-i440fx/memory.h>
+#include <mainboard/emulation/qemu-i440fx/fw_cfg.h>
+
+#define EXT_TSEG_MBYTES	0x50
+
+#define SMRAMC	0x9d
+#define G_SMRAME	(1 << 3)
+#define D_LCK		(1 << 4)
+#define D_CLS		(1 << 5)
+#define D_OPEN		(1 << 6)
+#define ESMRAMC	0x9e
+#define T_EN		(1 << 0)
+#define TSEG_SZ_MASK	(3 << 1)
+#define H_SMRAME	(1 << 7)
+
+void smm_region(uintptr_t *start, size_t *size)
+{
+	uint8_t esmramc = pci_read_config8(PCI_DEV(0, 0, 0), ESMRAMC);
+
+	switch ((esmramc & TSEG_SZ_MASK) >> 1) {
+	case 0:
+		*size = 1 * MiB;
+		break;
+	case 1:
+		*size = 2 * MiB;
+		break;
+	case 2:
+		*size = 8 * MiB;
+		break;
+	default:
+		*size = pci_read_config16(PCI_DEV(0, 0, 0), EXT_TSEG_MBYTES) * MiB;
+	}
+
+	*start = qemu_get_memory_size() * KiB - *size;
+	printk(BIOS_SPEW, "SMM_BASE: 0x%08lx, SMM_SIZE: %zu MiB\n", *start, *size / MiB);
+}