diff --git a/src/device/Kconfig b/src/device/Kconfig
index 71292e8f15..9c9ecd1973 100644
--- a/src/device/Kconfig
+++ b/src/device/Kconfig
@@ -531,6 +531,15 @@ config PCI
 
 if PCI
 
+config DOMAIN_RESOURCE_32BIT_LIMIT
+	hex
+	default 0xfe000000
+	help
+	  When the default pci_domain_read_resources() is used,
+	  keep 32-bit memory resources below this limit. This is
+	  used as a workaround for missing/wrong reservations of
+	  chipset resources that usually reside above this limit.
+
 config NO_ECAM_MMCONF_SUPPORT
 	bool
 	default n
diff --git a/src/device/pci_device.c b/src/device/pci_device.c
index e600f34fe6..5c5a5fb8dc 100644
--- a/src/device/pci_device.c
+++ b/src/device/pci_device.c
@@ -7,6 +7,7 @@
 
 #include <acpi/acpi.h>
 #include <assert.h>
+#include <cbmem.h>
 #include <device/pci_ops.h>
 #include <bootmode.h>
 #include <console/console.h>
@@ -561,8 +562,22 @@ void pci_domain_read_resources(struct device *dev)
 	res->flags = IORESOURCE_IO | IORESOURCE_SUBTRACTIVE |
 		     IORESOURCE_ASSIGNED;
 
-	/* Initialize the system-wide memory resources constraints. */
+	/*
+	 * Initialize 32-bit memory resource constraints.
+	 *
+	 * There are often undeclared chipset resources in lower memory
+	 * and memory right below the 4G barrier. Hence, only allow
+	 * one big range from cbmem_top to the configured limit.
+	 */
 	res = new_resource(dev, IOINDEX_SUBTRACTIVE(1, 0));
+	res->base  = (uintptr_t)cbmem_top();
+	res->limit = CONFIG_DOMAIN_RESOURCE_32BIT_LIMIT - 1;
+	res->flags = IORESOURCE_MEM | IORESOURCE_SUBTRACTIVE |
+		     IORESOURCE_ASSIGNED;
+
+	/* Initialize 64-bit memory resource constraints above 4G. */
+	res = new_resource(dev, IOINDEX_SUBTRACTIVE(2, 0));
+	res->base  = 4ULL * GiB;
 	res->limit = (1ULL << cpu_phys_address_size()) - 1;
 	res->flags = IORESOURCE_MEM | IORESOURCE_SUBTRACTIVE |
 		     IORESOURCE_ASSIGNED;
diff --git a/src/soc/intel/common/block/systemagent/Kconfig b/src/soc/intel/common/block/systemagent/Kconfig
index d8c217f25a..4d14fc127e 100644
--- a/src/soc/intel/common/block/systemagent/Kconfig
+++ b/src/soc/intel/common/block/systemagent/Kconfig
@@ -6,6 +6,9 @@ config SOC_INTEL_COMMON_BLOCK_SA
 
 if SOC_INTEL_COMMON_BLOCK_SA
 
+config DOMAIN_RESOURCE_32BIT_LIMIT
+	default 0xe0000000
+
 config ECAM_MMCONF_BASE_ADDRESS
 	default 0xe0000000