Got it, the lock is inside BiosRegionLockDxe:
1
2
3
4
5
6
7
2
3
4
5
6
7
56c: e8 d7 05 00 00 call 0xb48
571: 0f ba e0 0f bt eax,0xf
575: 72 0f jb 0x586
577: ba 00 80 00 00 mov edx,0x8000
57c: 48 dec eax
57d: 8b cb mov ecx,ebx
57f: e8 74 06 00 00 call 0xbf8
Replacing 0x80 with 0x00 avoids settings the FLOCKDN bit:
1
2
3
4
5
6
7
8
9
2
3
4
5
6
7
8
9
[*] HSFS = 0x6000 << Hardware Sequencing Flash Status Register (SPIBAR + 0x4)
[00] FDONE = 0 << Flash Cycle Done
[01] FCERR = 0 << Flash Cycle Error
[02] AEL = 0 << Access Error Log
[03] BERASE = 0 << Block/Sector Erase Size
[05] SCIP = 0 << SPI cycle in progress
[13] FDOPSS = 1 << Flash Descriptor Override Pin-Strap Status
[14] FDV = 1 << Flash Descriptor Valid
[15] FLOCKDN = 0 << Flash Configuration Lock-Down
Which allows me to remove the flash protected range:
1
2
3
4
5
6
7
8
2
3
4
5
6
7
8
[CHIPSEC] Read SPIBAR + 0x84: 0x87FF06C0
[CHIPSEC] Read SPIBAR + 0x88: 0x853F0220
[CHIPSEC] Write SPIBAR + 0x84: 0x00000000
[CHIPSEC] Write SPIBAR + 0x88: 0x00000000
[CHIPSEC] Read SPIBAR + 0x84: 0x00000000
[CHIPSEC] Read SPIBAR + 0x88: 0x00000000