diff --git a/src/southbridge/intel/i82801gx/lpc.c b/src/southbridge/intel/i82801gx/lpc.c
index ab426ab..acc57a7 100644
--- a/src/southbridge/intel/i82801gx/lpc.c
+++ b/src/southbridge/intel/i82801gx/lpc.c
@@ -645,6 +645,40 @@
 	}
 }
 
+#define SPIBAR16(x) RCBA16(0x3020 + x)
+#define SPIBAR32(x) RCBA32(0x3020 + x)
+
+static void lpc_final(struct device *dev)
+{
+	u16 tco1_cnt;
+
+	if (!IS_ENABLED(CONFIG_INTEL_CHIPSET_LOCKDOWN))
+		return;
+
+	SPIBAR16(PREOP) = SPI_OPPREFIX;
+	/* Set SPI opcode menu */
+	SPIBAR16(OPTYPE) = SPI_OPTYPE;
+	SPIBAR32(OPMENU) = SPI_OPMENU_LOWER;
+	SPIBAR32(OPMENU + 4) = SPI_OPMENU_UPPER;
+
+	/* Lock SPIBAR */
+	SPIBAR16(0) = SPIBAR16(0) | (1 << 15);
+
+	/* BIOS Interface Lockdown */
+	RCBA32(0x3410) |= 1 << 0;
+
+	/* Global SMI Lock */
+	pci_or_config16(dev, GEN_PMCON_1, 1 << 4);
+
+	/* TCO_Lock */
+	tco1_cnt = inw(DEFAULT_PMBASE + 0x60 + TCO1_CNT);
+	tco1_cnt |= (1 << 12); /* TCO lock */
+	outw(tco1_cnt, DEFAULT_PMBASE + 0x60 + TCO1_CNT);
+
+	/* Indicate finalize step with post code */
+	outb(POST_OS_BOOT, 0x80);
+}
+
 static void set_subsystem(struct device *dev, unsigned int vendor,
 			  unsigned int device)
 {
@@ -698,6 +732,7 @@
 	.scan_bus		= scan_lpc_bus,
 	.enable			= i82801gx_enable,
 	.ops_pci		= &pci_ops,
+	.final			= lpc_final,
 };
 
 /* 27b0: 82801GH (ICH7 DH) */