BIOS update disable / toggle in the BIOS

[mkopec]

The problem you're addressing (if any)

Add a toggle to completely disable write accesses to the BIOS flash for better security

Describe the solution you'd like

An option in the BIOS to lock the SPI flash completely

Where is the value to a user, and who might that user be?

Added security in certain scenarios, where Verified Boot may not be enough

Describe alternatives you've considered

n/a

Additional context

Certain enterprise laptops have the option to disable BIOS updates.

[miczyg1]

Disabling BIOS update != disabling SPI flash access. That kind of options typically disable capsule update. What you would probably want to achieve is something different. Make BIOS writable only in SMM?

[mkopec]

SMM_BWP flash protection was implemented for #120 so this issue can be closed now.