3 files changed, 20 insertions, 0 deletions
diff --git a/src/soc/intel/xeon_sp/cpx/include/soc/pci_devs.h b/src/soc/intel/xeon_sp/cpx/include/soc/pci_devs.h
index 7b16945958..7f4a04583d 100644
--- a/src/soc/intel/xeon_sp/cpx/include/soc/pci_devs.h
+++ b/src/soc/intel/xeon_sp/cpx/include/soc/pci_devs.h
@@ -11,6 +11,7 @@
 #define SAD_ALL_DEV			29
 #define SAD_ALL_FUNC			0
 #define SAD_ALL_PAM0123_CSR		0x40
+#define   PAM_LOCK			BIT(0)
 #define SAD_ALL_PAM456_CSR		0x44
 
 #if !defined(__SIMPLE_DEVICE__)
diff --git a/src/soc/intel/xeon_sp/finalize.c b/src/soc/intel/xeon_sp/finalize.c
index bfcf212558..044c1cc138 100644
--- a/src/soc/intel/xeon_sp/finalize.c
+++ b/src/soc/intel/xeon_sp/finalize.c
@@ -4,12 +4,30 @@
 #include <console/console.h>
 #include <console/debug.h>
 #include <cpu/x86/smm.h>
+#include <device/pci.h>
+#include <intelpch/lockdown.h>
+#include <soc/pci_devs.h>
+#include <soc/util.h>
+
+#include "chip.h"
+
+static void lock_pam0123(void)
+{
+	const struct device *dev;
+
+	if (get_lockdown_config() != CHIPSET_LOCKDOWN_COREBOOT)
+		return;
+
+	dev = pcidev_path_on_bus(get_stack_busno(1), PCI_DEVFN(SAD_ALL_DEV, SAD_ALL_FUNC));
+	pci_or_config32(dev, SAD_ALL_PAM0123_CSR, PAM_LOCK);
+}
 
 static void soc_finalize(void *unused)
 {
 	printk(BIOS_DEBUG, "Finalizing chipset.\n");
 
 	apm_control(APM_CNT_FINALIZE);
+	lock_pam0123();
 
 	post_code(POST_OS_BOOT);
 }
diff --git a/src/soc/intel/xeon_sp/skx/include/soc/pci_devs.h b/src/soc/intel/xeon_sp/skx/include/soc/pci_devs.h
index 96239baf03..01e86e199f 100644
--- a/src/soc/intel/xeon_sp/skx/include/soc/pci_devs.h
+++ b/src/soc/intel/xeon_sp/skx/include/soc/pci_devs.h
@@ -24,6 +24,7 @@
 #define SAD_ALL_DEV			29
 #define SAD_ALL_FUNC			0
 #define SAD_ALL_PAM0123_CSR		0x40
+#define   PAM_LOCK			BIT(0)
 #define SAD_ALL_PAM456_CSR		0x44
 
 #if !defined(__SIMPLE_DEVICE__)