diff --git a/src/soc/intel/skylake/chip_fsp20.c b/src/soc/intel/skylake/chip_fsp20.c
index 4cff6688a8..c5ecc97b01 100644
--- a/src/soc/intel/skylake/chip_fsp20.c
+++ b/src/soc/intel/skylake/chip_fsp20.c
@@ -203,6 +203,14 @@ void platform_fsp_silicon_init_params_cb(FSPS_UPD *supd)
 	tconfig->PchLockDownGlobalSmi = config->LockDownConfigGlobalSmi;
 	tconfig->PchLockDownBiosInterface = config->LockDownConfigBiosInterface;
 	tconfig->PchLockDownRtcLock = config->LockDownConfigRtcLock;
+	/*
+	 * To disable HECI, the Psf needs to be left unlocked
+	 * by FSP till end of post sequence. Based on the devicetree
+	 * setting, we set the appropriate PsfUnlock policy in FSP,
+	 * do the changes and then lock it back in coreboot during finalize.
+	 */
+	tconfig->PchSbAccessUnlock = (config->HeciEnabled == 0) ? 1 : 0;
+
 	params->PchLockDownBiosLock = config->LockDownConfigBiosLock;
 	params->PchLockDownSpiEiss = config->LockDownConfigSpiEiss;
 	params->PchSubSystemVendorId = config->PchConfigSubSystemVendorId;
diff --git a/src/soc/intel/skylake/finalize.c b/src/soc/intel/skylake/finalize.c
index 34f26eb8cb..9759382149 100644
--- a/src/soc/intel/skylake/finalize.c
+++ b/src/soc/intel/skylake/finalize.c
@@ -49,7 +49,7 @@ static void pch_configure_endpoints(device_t dev, int epmask_id, uint32_t mask)
 	pci_write_config32(dev, PCH_P2SB_EPMASK(epmask_id), reg32 | mask);
 }
 
-static void pch_disable_heci(void)
+static void disable_sideband_access(void)
 {
 	device_t dev;
 	u8 reg8;
@@ -57,6 +57,35 @@ static void pch_disable_heci(void)
 
 	dev = PCH_DEV_P2SB;
 
+	/*
+	 * Set p2sb PCI offset EPMASK5 C4h [29, 28, 27, 26] to disable Sideband
+	 * access for PCI Root Bridge.
+	 * Set p2sb PCI offset EPMASK5 C4h [17, 16,10, 1] to disable Sideband
+	 * access for MIPI controller.
+	 */
+	mask = (1 << 29) | (1 << 28) | (1 << 27) | (1 << 26) | (1 << 17) |
+			 (1 << 16) | (1 << 10) | (1 << 1);
+	pch_configure_endpoints(dev, 5, mask);
+
+	/*
+	 * Set p2sb PCI offset EPMASK7 CCh ports E6, E5 (bits 6, 5)
+	 * to disable Sideband access for XHCI controller.
+	 */
+	mask = (1 << 6) | (1 << 5);
+	pch_configure_endpoints(dev, 7, mask);
+
+	/* Set the "Endpoint Mask Lock!", P2SB PCI offset E2h bit[1] to 1. */
+	reg8 = pci_read_config8(dev, PCH_P2SB_E0 + 2);
+	pci_write_config8(dev, PCH_P2SB_E0 + 2, reg8 | (1 << 1));
+
+	/* hide p2sb device */
+	pci_write_config8(dev, PCH_P2SB_E0 + 1, 1);
+}
+
+static void pch_disable_heci(void)
+{
+	device_t dev = PCH_DEV_P2SB;
+
 	/*
 	 * if p2sb device 1f.1 is not present or hidden in devicetree
 	 * p2sb device becomes NULL
@@ -71,17 +100,7 @@ static void pch_disable_heci(void)
 	pcr_or32(PID_PSF1, PSF_BASE_ADDRESS + PCR_PSFX_T0_SHDW_PCIEN,
 		PCR_PSFX_T0_SHDW_PCIEN_FUNDIS);
 
-	/* Remove the host accessing right to PSF register range. */
-	/* Set p2sb PCI offset EPMASK5 C4h [29, 28, 27, 26] to [1, 1, 1, 1] */
-	mask = (1 << 29) | (1 << 28) | (1 << 27)  | (1 << 26);
-	pch_configure_endpoints(dev, 5, mask);
-
-	/* Set the "Endpoint Mask Lock!", P2SB PCI offset E2h bit[1] to 1. */
-	reg8 = pci_read_config8(dev, PCH_P2SB_E0 + 2);
-	pci_write_config8(dev, PCH_P2SB_E0 + 2, reg8 | (1 << 1));
-
-	/* hide p2sb device */
-	pci_write_config8(dev, PCH_P2SB_E0 + 1, 1);
+	disable_sideband_access();
 }
 
 static void pch_finalize_script(void)