TL;DR: On the xx30 series, the 4MB "top" chip is easily recoverable, even if you fail to make a backup. If you install the 1vyrain BIOS or use 1vyrain to install Coreboot, only the 4MB chip is affected. However, if you apply me_cleaner to the 8MB "bottom" chip and lose the backup, you cannot return to the stock BIOS!
A few years ago, I had wanted to try out Coreboot (using pre-built "Skulls" images), but didn't want to bother with buying and learning how to use a hardware chip programmer. So I used 1vyrain, as mentioned here: https://lemmy.ml/post/23117122
1vyrain just overwrites the 4MB chip with the supplied image. The 8MB chip is unaffected. Nothing on the 4MB chip is machine-specific. So if you can still boot into Linux but no longer want Coreboot, the recovery is trivial:
- Boot Linux with the kernel parameter
iomem=relaxed
- Install
flashrom if needed
- Get a copy of the stock 4MB image (I'd recommend v2.60): https://github.com/xy-tech/x330-bios/tree/main/stock/original
- Flash the image:
sudo flashrom -p internal -i bios --ifd -w /path/to/v2.60.bin --noverify-all
- Wait for it to finish and reboot
If it doesn't POST, you can do the same, but with a hardware programmer.
If you made a mistake with your Coreboot config, but can still boot, and just want to flash a new build of Coreboot, no need to restore stock BIOS and do 1vyrain again, just flash your coreboot.rom like so: sudo flashrom -p internal -i bios --ifd -w path/to/coreboot.rom --noverify-all
That's all that is relevant if you don't have a hardware programmer like the CH341a.
Now the mistake that made me write this post: I had extracted the bottom 8MB chip from one of my X230 and applied me_cleaner to it. Seeing it had worked so well, I jumped to the conclusion that a backup for one X230 would work for another X230. So I flashed my second X230 with the cleaned 8MB image without making a backup. Coreboot worked fine, but then I realized I forgot to apply the keyboard EC patch.
Turns out, the contents of the bottom chip are machine-specific and the stock BIOS will not boot if it has been tampered with or swapped with a backup from another machine. And without the stock BIOS, the EC cannot be flashed.
If I do find a way to make the stock BIOS boot again, I will post an update here.
It is bad. We should fight against the corporations and agencies that want to strip us of our privacy, and avoid using services that insist on invasive measures whenever possible. But the way things are going, especially living in the US, does not exactly inspire my optimism and my mind wants some certainty against all the what-if scenarios. Perhaps I should frame the separate device solution as my stopgap if we reach "rock bottom"?
I won't pretend to be an expert on how much isolation a separate device provides over a user profile, but it does give me peace of mind in the case of my work phone, which I only have powered up at the workplace and never connect to the same network as my other devices. Not everyone has the privilege, but I repurposed my old phone which otherwise would have sat idle for this purpose.