diff --git a/src/cpu/intel/haswell/Makefile.inc b/src/cpu/intel/haswell/Makefile.inc
index 3b52294..f83d5db 100644
--- a/src/cpu/intel/haswell/Makefile.inc
+++ b/src/cpu/intel/haswell/Makefile.inc
@@ -28,6 +28,8 @@
 
 postcar-y += ../car/non-evict/exit_car.S
 
+verstage-y += tsc_freq.c
+
 subdirs-y += ../../x86/tsc
 subdirs-y += ../../x86/mtrr
 subdirs-y += ../../x86/lapic
diff --git a/src/mainboard/google/beltino/Makefile.inc b/src/mainboard/google/beltino/Makefile.inc
index 5e45472..bb90e97 100644
--- a/src/mainboard/google/beltino/Makefile.inc
+++ b/src/mainboard/google/beltino/Makefile.inc
@@ -15,6 +15,7 @@
 
 romstage-$(CONFIG_CHROMEOS) += chromeos.c
 ramstage-$(CONFIG_CHROMEOS) += chromeos.c
+verstage-$(CONFIG_VBOOT_SEPARATE_VERSTAGE) += chromeos.c
 ramstage-y += lan.c
 
 smm-$(CONFIG_HAVE_SMI_HANDLER) += smihandler.c variants/$(VARIANT_DIR)/led.c
diff --git a/src/mainboard/intel/baskingridge/Makefile.inc b/src/mainboard/intel/baskingridge/Makefile.inc
index 5ef8363..06e86c1 100644
--- a/src/mainboard/intel/baskingridge/Makefile.inc
+++ b/src/mainboard/intel/baskingridge/Makefile.inc
@@ -15,5 +15,6 @@
 
 romstage-y += chromeos.c
 ramstage-y += chromeos.c
+verstage-$(CONFIG_VBOOT_SEPARATE_VERSTAGE) += chromeos.c
 
 smm-$(CONFIG_HAVE_SMI_HANDLER) += mainboard_smi.c
diff --git a/src/northbridge/intel/haswell/Kconfig b/src/northbridge/intel/haswell/Kconfig
index 242ab18..e0c55d2 100644
--- a/src/northbridge/intel/haswell/Kconfig
+++ b/src/northbridge/intel/haswell/Kconfig
@@ -27,9 +27,25 @@
 
 if NORTHBRIDGE_INTEL_HASWELL
 
+config HASWELL_VBOOT_IN_BOOTBLOCK
+	depends on VBOOT
+	bool "Start verstage in bootblock"
+	default y
+	select VBOOT_STARTS_IN_BOOTBLOCK
+	select VBOOT_SEPARATE_VERSTAGE
+	help
+	  Haswell can either start verstage in a separate stage
+	  right after the bootblock has run or it can start it
+	  after romstage for compatibility reasons.
+	  Haswell however uses a mrc.bin to initialse memory which
+	  needs to be located at a fixed offset. Therefore even with
+	  a separate verstage starting after the bootblock that same
+	  binary is used meaning a jump is made from RW to the RO region
+	  and back to the RW region after the binary is done.
+
 config VBOOT
 	select VBOOT_OPROM_MATTERS
-	select VBOOT_STARTS_IN_ROMSTAGE
+	select VBOOT_STARTS_IN_ROMSTAGE if !HASWELL_VBOOT_IN_BOOTBLOCK
 
 config VGA_BIOS_ID
 	string
@@ -93,4 +109,11 @@
 	  VBIOS. On those systems we need to wait for a bit before executing
 	  the VBIOS.
 
+# The UEFI System Agent binary needs to be at a fixed offset in the flash
+# and can therefore only reside in the COREBOOT fmap region
+config RO_REGION_ONLY
+	string
+	depends on VBOOT
+	default "mrc.bin"
+
 endif
diff --git a/src/southbridge/intel/common/Makefile.inc b/src/southbridge/intel/common/Makefile.inc
index ac339a2..1085f6c 100644
--- a/src/southbridge/intel/common/Makefile.inc
+++ b/src/southbridge/intel/common/Makefile.inc
@@ -29,6 +29,7 @@
 
 ifeq ($(CONFIG_SOUTHBRIDGE_INTEL_COMMON),y)
 
+verstage-y += pmbase.c
 romstage-y += pmbase.c
 ramstage-y += pmbase.c
 postcar-y += pmbase.c
@@ -59,6 +60,7 @@
 
 smm-$(CONFIG_SOUTHBRIDGE_INTEL_COMMON_FINALIZE) += finalize.c
 
+verstage-y += rtc.c
 romstage-y += rtc.c
 ramstage-y += rtc.c
 postcar-y += rtc.c
diff --git a/src/southbridge/intel/lynxpoint/Makefile.inc b/src/southbridge/intel/lynxpoint/Makefile.inc
index 62766df..fd00f6c 100644
--- a/src/southbridge/intel/lynxpoint/Makefile.inc
+++ b/src/southbridge/intel/lynxpoint/Makefile.inc
@@ -55,4 +55,7 @@
 smm-$(CONFIG_HAVE_SMI_HANDLER) += lp_gpio.c
 endif
 
+verstage-$(CONFIG_VBOOT_SEPARATE_VERSTAGE) += pmutil.c
+verstage-$(CONFIG_VBOOT_SEPARATE_VERSTAGE) += lp_gpio.c
+
 endif
diff --git a/src/southbridge/intel/lynxpoint/pmutil.c b/src/southbridge/intel/lynxpoint/pmutil.c
index 3c63723..cc49477 100644
--- a/src/southbridge/intel/lynxpoint/pmutil.c
+++ b/src/southbridge/intel/lynxpoint/pmutil.c
@@ -24,6 +24,9 @@
 #include <device/pci.h>
 #include <device/pci_def.h>
 #include <console/console.h>
+#include <security/vboot/vbnv.h>
+#include <security/vboot/vboot_common.h>
+#include <southbridge/intel/common/rtc.h>
 #include "pch.h"
 
 #if CONFIG(INTEL_LYNXPOINT_LP)