Anyway to change BIOSWE, BLE, SMM_BWP & PR0-5 protection bits?

Hi all,

Machine: Lenovo X1 Carbon 1st Gen (2012, no Boot Guard)
Flashing tool: CH341A USB programmer + Debian Linux

I am trying to replace the OEM firmware with Coreboot 4.12 and then install OpenBSD into the machine and set it up as an internet facing firewall. I ran me_cleaner against the dumped SPI image already.

1. Can anyone please tell let me know how I can achieve the captioned objectives? I looked into ifdtool & uefitool but found nothing related to my goal. I also tried the "lock ME/TXE" option during make menuconfig but Intel chipsec is still reporting the captioned bits not set on my Coreboot-flashed X1 Carbon.

2. Is it correct to say that once the PR0-5 bits are set and Coreboot flashed into the machine, the values of the PR registers will be configured accordingly after machine boot up (when OS is having control)?

Thank you for looking into my questions!