"so we can assume that only BIOS setup application can touch BIOS flash"
Nope. Intel (at least) let you program the flash controller so it'll forbid writes from the OS but permit writes from System Management Mode. Load the firmware into RAM, hand a list of addresses to an SMM trap and wait for it to flash it. Entirely secure, as long as you're using signed images.
Comments
"so we can assume that only BIOS setup application can touch BIOS flash"
Nope. Intel (at least) let you program the flash controller so it'll forbid writes from the OS but permit writes from System Management Mode. Load the firmware into RAM, hand a list of addresses to an SMM trap and wait for it to flash it. Entirely secure, as long as you're using signed images.
How is non-SMM code prevented from doing the same stuff this SMM routine does?
The flash controller knows if you're in SMM or not.