diff --git a/src/soc/intel/skylake/Kconfig b/src/soc/intel/skylake/Kconfig
index 1ac0647a40..9278cf1aa2 100644
--- a/src/soc/intel/skylake/Kconfig
+++ b/src/soc/intel/skylake/Kconfig
@@ -25,6 +25,7 @@ config CPU_SPECIFIC_OPTIONS
 	select MMCONF_SUPPORT
 	select MMCONF_SUPPORT_DEFAULT
 	select NO_FIXED_XIP_ROM_SIZE
+	select MRC_SETTINGS_PROTECT
 	select PARALLEL_MP
 	select PCIEXP_ASPM
 	select PCIEXP_COMMON_CLOCK
diff --git a/src/soc/intel/skylake/flash_controller.c b/src/soc/intel/skylake/flash_controller.c
index 0af0484082..3507b471cc 100644
--- a/src/soc/intel/skylake/flash_controller.c
+++ b/src/soc/intel/skylake/flash_controller.c
@@ -386,6 +386,43 @@ struct spi_slave *spi_setup_slave(unsigned int bus, unsigned int cs)
 	return slave;
 }
 
+int spi_flash_protect(u32 start, u32 size)
+{
+	pch_spi_regs *spi_bar = get_spi_bar();
+	u32 end = start + size - 1;
+	u32 reg;
+	int prr;
+
+	if (!spi_bar)
+		return -1;
+
+	/* Find first empty PRR */
+	for (prr = 0; prr < SPI_PRR_MAX; prr++) {
+		reg = read32(&spi_bar->pr[prr]);
+		if (reg == 0)
+			break;
+	}
+	if (prr >= SPI_PRR_MAX) {
+		printk(BIOS_ERR, "ERROR: No SPI PRR free!\n");
+		return -1;
+	}
+
+	/* Set protected range base and limit */
+	reg = SPI_PRR(start, end) | SPI_PRR_WPE;
+
+	/* Set the PRR register and verify it is protected */
+	write32(&spi_bar->pr[prr], reg);
+	reg = read32(&spi_bar->pr[prr]);
+	if (!(reg & SPI_PRR_WPE)) {
+		printk(BIOS_ERR, "ERROR: Unable to set SPI PRR %d\n", prr);
+		return -1;
+	}
+
+	printk(BIOS_INFO, "%s: PRR %d is enabled for range 0x%08x-0x%08x\n",
+	       __func__, prr, start, end);
+	return 0;
+}
+
 #if ENV_RAMSTAGE
 /*
  * spi_init() needs run unconditionally in every boot (including resume) to
diff --git a/src/soc/intel/skylake/include/soc/spi.h b/src/soc/intel/skylake/include/soc/spi.h
index 7991c1632a..c930b5818c 100644
--- a/src/soc/intel/skylake/include/soc/spi.h
+++ b/src/soc/intel/skylake/include/soc/spi.h
@@ -40,6 +40,17 @@
 /* STRAP Data Register*/
 #define SPIBAR_RESET_DATA 0xF8
 
+#define SPI_PRR_MAX		5
+#define SPI_PRR_SHIFT		12
+#define SPI_PRR_MASK		0x7fff
+#define SPI_PRR_BASE_SHIFT	0
+#define SPI_PRR_LIMIT_SHIFT	16
+#define SPI_PRR_RPE		(1 << 15) /* Read Protect */
+#define SPI_PRR_WPE		(1 << 31) /* Write Protect */
+#define SPI_PRR(base, limit)	\
+	(((((limit) >> SPI_PRR_SHIFT) & SPI_PRR_MASK) << SPI_PRR_LIMIT_SHIFT) |\
+	 ((((base) >> SPI_PRR_SHIFT) & SPI_PRR_MASK) << SPI_PRR_BASE_SHIFT))
+
 #define SPI_OPMENU_0 0x01 /* WRSR: Write Status Register */
 #define SPI_OPTYPE_0 0x01 /* Write, no address */
 
@@ -119,6 +130,7 @@
 #define  SPIBAR_BC_LE           (1 << 2)
 #define  SPIBAR_BC_WPD		(1 << 0)
 
-
 void *get_spi_bar(void);
+int spi_flash_protect(u32 start, u32 size);
+
 #endif