diff --git a/src/soc/intel/xeon_sp/finalize.c b/src/soc/intel/xeon_sp/finalize.c
index 6b8395c783..7830a4b27f 100644
--- a/src/soc/intel/xeon_sp/finalize.c
+++ b/src/soc/intel/xeon_sp/finalize.c
@@ -16,17 +16,6 @@
 
 #include "chip.h"
 
-static void lock_pam0123(void)
-{
-	const struct device *dev;
-
-	if (get_lockdown_config() != CHIPSET_LOCKDOWN_COREBOOT)
-		return;
-
-	dev = pcidev_path_on_bus(get_stack_busno(1), PCI_DEVFN(SAD_ALL_DEV, SAD_ALL_FUNC));
-	pci_or_config32(dev, SAD_ALL_PAM0123_CSR, PAM_LOCK);
-}
-
 DECLARE_SPIN_LOCK(msr_ppin_lock);
 
 static void lock_msr_ppin_ctl(void *unused)
diff --git a/src/soc/intel/xeon_sp/include/soc/util.h b/src/soc/intel/xeon_sp/include/soc/util.h
index c794ac5b9d..52afc48704 100644
--- a/src/soc/intel/xeon_sp/include/soc/util.h
+++ b/src/soc/intel/xeon_sp/include/soc/util.h
@@ -6,7 +6,9 @@
 #include <cpu/x86/msr.h>
 #include <hob_iiouds.h>
 
+void lock_pam0123(void);
 void unlock_pam_regions(void);
+
 msr_t read_msr_ppin(void);
 int get_platform_thread_count(void);
 const IIO_UDS *get_iio_uds(void);
diff --git a/src/soc/intel/xeon_sp/util.c b/src/soc/intel/xeon_sp/util.c
index c6ef5a5837..c4a10f9a9c 100644
--- a/src/soc/intel/xeon_sp/util.c
+++ b/src/soc/intel/xeon_sp/util.c
@@ -6,13 +6,28 @@
 #include <delay.h>
 #include <device/device.h>
 #include <device/pci.h>
+#include <intelblocks/cfg.h>
 #include <intelblocks/cpulib.h>
+#include <intelpch/lockdown.h>
 #include <soc/pci_devs.h>
 #include <soc/msr.h>
 #include <soc/soc_util.h>
 #include <soc/util.h>
 #include <timer.h>
 
+void lock_pam0123(void)
+{
+	if (get_lockdown_config() != CHIPSET_LOCKDOWN_COREBOOT)
+		return;
+
+	/* section 16.3.19 of Intel doc. #612246 */
+	uint32_t pam0123_lock = 0x33333331;
+	uint32_t bus1 = get_socket_ubox_busno(0);
+
+	pci_s_write_config32(PCI_DEV(bus1, SAD_ALL_DEV, SAD_ALL_FUNC),
+		SAD_ALL_PAM0123_CSR, pam0123_lock);
+}
+
 void unlock_pam_regions(void)
 {
 	uint32_t pam0123_unlock_dram = 0x33333330;