Hello, I have recently got a Thinkpad x230 16Gb RAM 
My goal is to mod it to become like a NitroPad x230, which is officially supported by Qubes.
[The NitroPad project is great, but I have time to invest on this, and I want to learn this stuff.]
This means (at least):
- install the opensource BIOS Coreboot/Heads.
- install Qubes.
For the moment I want to focus on task (1), as installing Qubes should not be too difficult (I have already installed it several times on other machines).
Researching a bit, i have found the Coreboot/Skulls project (LINK ) which is supposed to be a distro of Coreboot with simplified installation for x230 machines. It is also very convenient that from Skulls it is possible to install Heads by software, without the need of re-flashing the BIOS chips.
So my task now is to install Skulls.
The instructions for writing the new code to the 2 BIOS chips inside the x230 is here . I have ordered a cheap CH341A programmer from Amazon.
But before proceeding, there is something I’d like to ask, because I don’t understand it well.
Specifically, in the instructions (preliminaries, before writing the chips) they say:
original BIOS update / EC firmware (optional)
If the script, sudo ./skulls.sh -b x230 says "The installed original BIOS is very old.", it means that you have a BIOS version that may include an EC version older than 1.14.
If that's the case, consider doing one original Lenovo upgrade process. This is not supported anymore, once you're running coreboot (You'd have to manually flash back your backup images first, see later chapters).
This updates the BIOS and Embedded Controller (EC) firmware. The EC is not updated anymore, when running coreboot. Since official BIOS release 2.77 and its EC version 1.15 Lenovo includes a digital signature check, which prevents further firmware patching.
You have 2 options:
use the latest original CD and burn it, or
use the same, only with a patched EC firmware that allows using any aftermarket-battery: (this is only possible up to EC Firmware 1.14) By default, only original Lenovo batteries are allowed. Thanks to this project we can use Lenovo's bootable upgrade image, change it and create a bootable USB image (even with EC updates that allows one to use 3rd party aftermarket batteries). For this, follow instructions at github.com/hamishcoleman/thinkpad-ec.
From what I have read around, the EC contains some blobs of closed source code that controls a few low level things around, such as the keyboard, battery authenticity checks, etc.
Question 1: why does Skulls recommend to upgrade the EC using the “official” Lenovo process? Is this to include some bugfixes that Lenovo might have pushed? It is a bit confusing because it clearly says that with recent BIOS releases there is a signature check preventing further patching: so why would I want to install this newer release?
Question 2: do I understand correctly that Skulls/Coreboot will not (or even cannot) edit the EC firmware?
Question 3: coreboot is opensource but the original EC is not. Has somebody tried to reverse eng. the code running in the EC? Isn’t it a concern for security oriented users?
More generally, Any info regarding this EC is much appreciated. Or any info about hardening the security of the x270.
At some point I am sure I want to install a new (cheap) battery, so I need to get rid of any authenticity checks. Maybe I will also change the keyboard to a x220 keyboard, and I have read that editing modifying the EC code is necessary also in this case.
Thanks a lot!
References I have read, beside posts in this forum:
https://famicoman.com/2020/07/30/corebooting-the-thinkpad-x230-with-skulls/
Tagging @Plexus as they have installed Coreboot on many x230. 