diff --git a/infra/corenix/.gitignore b/infra/corenix/.gitignore
new file mode 100644
index 00000000000..b2be92b7db0
--- /dev/null
+++ b/infra/corenix/.gitignore
@@ -0,0 +1 @@
+result
diff --git a/infra/corenix/COPYING b/infra/corenix/COPYING
new file mode 100644
index 00000000000..0dbfac1c59d
--- /dev/null
+++ b/infra/corenix/COPYING
@@ -0,0 +1,20 @@
+Copyright (c) 2020 Milan Pässler and the corenix contributors
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/infra/corenix/README.md b/infra/corenix/README.md
new file mode 100644
index 00000000000..5a70e2b7ce9
--- /dev/null
+++ b/infra/corenix/README.md
@@ -0,0 +1,20 @@
+## corenix
+
+#### *Configure and build coreboot using the Nix package manager*
+
+*How to use:*
+
+1. Create a configuration file for your device in `configs/`
+2. Add an entry to flake.nix, i.e. `my-device = makeDevice ./configs/my-device.nix;`
+3. Build the coreboot rom: `nix build -A pkgs.my-device`
+
+*Features*
+
+- Specify the build parameters with NixOS-style modules
+- Share declarative configuration across devices
+- Use cached coreboot and payload builds for different device/payload combinations
+- Use GRUB2, TianoCore or SeaBIOS as primary payload
+
+*Limitations*
+
+- currently only `x86_64-linux` host and target systems are supported
diff --git a/infra/corenix/configs/boards/t440p.nix b/infra/corenix/configs/boards/t440p.nix
new file mode 100644
index 00000000000..c61f438e00a
--- /dev/null
+++ b/infra/corenix/configs/boards/t440p.nix
@@ -0,0 +1,12 @@
+{ ... }:
+
+{
+  corenix.corebootConfig = {
+    CONFIG_VENDOR_LENOVO = "y";
+    CONFIG_BOARD_LENOVO_THINKPAD_T440P = "y";
+  };
+
+  seabios.ps2Timeout = 5000;
+
+  # TODO: fetch mrc.bin
+}
diff --git a/infra/corenix/configs/boards/t60.nix b/infra/corenix/configs/boards/t60.nix
new file mode 100644
index 00000000000..3528594ac4e
--- /dev/null
+++ b/infra/corenix/configs/boards/t60.nix
@@ -0,0 +1,10 @@
+{ ... }:
+
+{
+  corenix.corebootConfig = {
+    CONFIG_VENDOR_LENOVO = "y";
+    CONFIG_BOARD_LENOVO_T60 = "y";
+  };
+
+  seabios.ps2Timeout = 5000;
+}
diff --git a/infra/corenix/configs/boards/x1c.nix b/infra/corenix/configs/boards/x1c.nix
new file mode 100644
index 00000000000..a67c2a731dd
--- /dev/null
+++ b/infra/corenix/configs/boards/x1c.nix
@@ -0,0 +1,10 @@
+{ ... }:
+
+{
+  corenix.corebootConfig = {
+    CONFIG_VENDOR_LENOVO = "y";
+    CONFIG_BOARD_LENOVO_X1_CARBON_GEN1 = "y";
+  };
+
+  seabios.ps2Timeout = 5000;
+}
diff --git a/infra/corenix/configs/boards/x220.nix b/infra/corenix/configs/boards/x220.nix
new file mode 100644
index 00000000000..6385e7a379b
--- /dev/null
+++ b/infra/corenix/configs/boards/x220.nix
@@ -0,0 +1,10 @@
+{ ... }:
+
+{
+  corenix.corebootConfig = {
+    CONFIG_VENDOR_LENOVO = "y";
+    CONFIG_BOARD_LENOVO_X220 = "y";
+  };
+
+  seabios.ps2Timeout = 5000;
+}
diff --git a/infra/corenix/configs/boards/x230-fhd/0001-lenovo-x230-introduce-FHD-variant.patch b/infra/corenix/configs/boards/x230-fhd/0001-lenovo-x230-introduce-FHD-variant.patch
new file mode 100644
index 00000000000..a2a54884628
--- /dev/null
+++ b/infra/corenix/configs/boards/x230-fhd/0001-lenovo-x230-introduce-FHD-variant.patch
@@ -0,0 +1,613 @@
+From da0f4171a9318ac01d9220f31f3f0b2cee05ccf3 Mon Sep 17 00:00:00 2001
+From: Alexander Couzens <lynxis@fe80.eu>
+Date: Sat, 6 Oct 2018 00:31:49 +0200
+Subject: [PATCH] lenovo/x230: introduce FHD variant
+
+There is a modification for the x230 which uses the 2nd DP from the dock
+as the integrated panel's connection, which allows using a Full HD (FHD)
+eDP panel instead of the stock LVDS display.
+
+To make this work with coreboot, the internal LVDS connector should be
+disabled in libgfxinit. The VBT has been modified as well, which allows
+brightness controls to work out of the box.
+
+The modifications done to the VBT are:
+- Remove the LVDS port entry.
+- Move the DP-3 (which is the 2nd DP on the dock) entry to the first
+  position on the list.
+- Set the DP-3 as internally connected.
+
+This has been reported to work with panel LP125WF2 SPB4.
+
+Change-Id: I0355d39a61956792e69bccd5274cfc2749d72bf0
+Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
+---
+ src/mainboard/lenovo/x230/Kconfig             |  13 +-
+ src/mainboard/lenovo/x230/Kconfig.name        |   3 +
+ .../x230/variants/x230_fhd/board_info.txt     |   7 +
+ .../lenovo/x230/variants/x230_fhd/data.vbt    | Bin 0 -> 3986 bytes
+ .../x230/variants/x230_fhd/early_init.c       |  28 ++
+ .../x230/variants/x230_fhd/gma-mainboard.ads  |  21 ++
+ .../lenovo/x230/variants/x230_fhd/gpio.c      | 284 ++++++++++++++++++
+ .../lenovo/x230/variants/x230_fhd/hda_verb.c  |  82 +++++
+ .../x230/variants/x230_fhd/overridetree.cb    |  16 +
+ 9 files changed, 451 insertions(+), 3 deletions(-)
+ create mode 100644 src/mainboard/lenovo/x230/variants/x230_fhd/board_info.txt
+ create mode 100644 src/mainboard/lenovo/x230/variants/x230_fhd/data.vbt
+ create mode 100644 src/mainboard/lenovo/x230/variants/x230_fhd/early_init.c
+ create mode 100644 src/mainboard/lenovo/x230/variants/x230_fhd/gma-mainboard.ads
+ create mode 100644 src/mainboard/lenovo/x230/variants/x230_fhd/gpio.c
+ create mode 100644 src/mainboard/lenovo/x230/variants/x230_fhd/hda_verb.c
+ create mode 100644 src/mainboard/lenovo/x230/variants/x230_fhd/overridetree.cb
+
+diff --git a/src/mainboard/lenovo/x230/Kconfig b/src/mainboard/lenovo/x230/Kconfig
+index 7d563efb2b..4e6cd37cf8 100644
+--- a/src/mainboard/lenovo/x230/Kconfig
++++ b/src/mainboard/lenovo/x230/Kconfig
+@@ -1,4 +1,4 @@
+-if BOARD_LENOVO_X230 || BOARD_LENOVO_X230T
++if BOARD_LENOVO_X230 || BOARD_LENOVO_X230T || BOARD_LENOVO_X230_FHD
+ 
+ config BOARD_SPECIFIC_OPTIONS
+ 	def_bool y
+@@ -20,7 +20,8 @@ config BOARD_SPECIFIC_OPTIONS
+ 	select MAINBOARD_HAS_LPC_TPM
+ 	select MAINBOARD_HAS_TPM1
+ 	select MAINBOARD_HAS_LIBGFXINIT
+-	select GFX_GMA_PANEL_1_ON_LVDS
++	select GFX_GMA_PANEL_1_ON_LVDS if BOARD_LENOVO_X230 || BOARD_LENOVO_X230T
++	select GFX_GMA_PANEL_1_ON_EDP if BOARD_LENOVO_X230_FHD
+ 	select INTEL_GMA_HAVE_VBT
+ 	select MAINBOARD_USES_IFD_GBE_REGION
+ 
+@@ -50,10 +51,16 @@ config MAINBOARD_DIR
+ 	string
+ 	default "lenovo/x230"
+ 
++config VARIANT_DIR
++	string
++	default "x230" if BOARD_LENOVO_X230 || BOARD_LENOVO_X230T
++	default "x230_fhd" if BOARD_LENOVO_X230_FHD
++
+ config MAINBOARD_PART_NUMBER
+ 	string
+ 	default "ThinkPad X230" if BOARD_LENOVO_X230
+ 	default "ThinkPad X230t" if BOARD_LENOVO_X230T
++	default "ThinkPad X230 FHD" if BOARD_LENOVO_X230_FHD
+ 
+ config MAX_CPUS
+ 	int
+@@ -81,4 +88,4 @@ config PS2K_EISAID
+ config PS2M_EISAID
+ 	default "LEN0020"
+ 
+-endif # BOARD_LENOVO_X230 || BOARD_LENOVO_X230T
++endif # BOARD_LENOVO_X230 || BOARD_LENOVO_X230T || BOARD_LENOVO_X230_FHD
+diff --git a/src/mainboard/lenovo/x230/Kconfig.name b/src/mainboard/lenovo/x230/Kconfig.name
+index 10fdc2ed11..e278e2ffe7 100644
+--- a/src/mainboard/lenovo/x230/Kconfig.name
++++ b/src/mainboard/lenovo/x230/Kconfig.name
+@@ -3,3 +3,6 @@ config BOARD_LENOVO_X230
+ 
+ config BOARD_LENOVO_X230T
+ 	bool "ThinkPad X230t"
++
++config BOARD_LENOVO_X230_FHD
++	bool "ThinkPad X230 Nitrocaster Full HD mod"
+diff --git a/src/mainboard/lenovo/x230/variants/x230_fhd/board_info.txt b/src/mainboard/lenovo/x230/variants/x230_fhd/board_info.txt
+new file mode 100644
+index 0000000000..7be565b634
+--- /dev/null
++++ b/src/mainboard/lenovo/x230/variants/x230_fhd/board_info.txt
+@@ -0,0 +1,7 @@
++Category: laptop
++Board name: ThinkPad X230 FHD
++ROM package: SOIC-8
++ROM protocol: SPI
++ROM socketed: n
++Flashrom support: n
++Release year: 2012
+diff --git a/src/mainboard/lenovo/x230/variants/x230_fhd/data.vbt b/src/mainboard/lenovo/x230/variants/x230_fhd/data.vbt
+new file mode 100644
+index 0000000000000000000000000000000000000000..1aaf54226c937b0e63b6062c1a4ed3b49e61e858
+GIT binary patch
+literal 3986
+zcmdT`eQXp(6o0e3cegjY+g`VPTn}glFmQzywk_0JOW3<!ORtpn`ayFL2rb-!B!$)j
+zS`rf$yaWiw9MKRoM9;r8{Gphbs4>B+iPn%9QWO3nrY6QH|A_G`B5=Ohy(<kxdVUb~
+zZGQXS&b;~Uo0<1!_o2RUFY5_)M7D&xqmd2GRht+~fB~nA8}L3;!qLv29g$FPXh*oc
+zvuPuH1?Is(@$G8>2|{$O#;AWJy8mEuFxXwuGq68#c<0F8#GWMEG_-T?V3Ng}qAav)
+zS8^~pGH@`NU_E^sLX1;tG<<09V1jiV+P5<~(!e5N&a@T>u<A9dYS%DUZLF>}R@WHS
+z24hBT!<yQL+FFf9nwvT|#iH$@-e_kB>+EKcXiuo8r+HJjeG7|qceX~u(cb2WMxB{7
+z4GkY2*}LblgDluo!D<Y{sKQ$<vqNT0LnFhhSZHvNb#tEstUGxiIr2m@u}Y(yVN8@I
+z<RLEb5R-Us)j&it-ICxXKm}QqWRVCiB56cYh~Od8Tp~3SsYsGrBs0k5R#WzYpb-H{
+z7R&JQDENE?`52GQ3*hD&48laNCAiW*-N6Ik;_cugjE@5IE(e*9;lc<LY~xSd*lfNJ
+z%0a}rNDINJSyNZv&}fDuEv;?svF_f!_||RK(PK}i0&w$n49=di9i(Fw5d%JSm%~;u
+z2**VMPK)(0A&$cmw*i~oei%laLOkn{VZx)sSBRexvaG`*nZj~JHR4f3E20~*4Y3<B
+zia3UN25|<FL7Ydtg}8_qM@%5DBECjkN8CV2UJ6AB_jb6M6)eClL$OFsmpB@H5<FW0
+z*125!xqQ3rJ^L-2^?2ZR_A@_Zv+_FrCiA+)*M~$<b7{@#c3X>LEce`tny+3w_nghr
+zOF%8DU(9B+?`N~%iVJybEZ^oaT~3?n8O~XjCzG@6*WnGv=H%bBluux>g>l&RgLS||
+zBCg>@Tu+IG)^rEKHFAH4sgZf(ZiamOl>Yk;YALi~HH&g%s@$gCjB9*U6X6$eyvPgW
+zIoDSB&Q%4)rvUTqfr-~SaSG-4rND<V+r>&`ei}(K9#de-d@mSw+)Ly?7=pgo#q$~m
+z%78~2k#d~(?<%?TB3-o;KL6TM2E~FG&rwW(oXU6Q^_-W$9T2l1P7+U}slb>qImhR3
+zt%LX%+(pceiE+WxI9@Ua)p0*#{k+GQ9}S+yDf2GlpX!;nk%wU)B{DB&TZ~i@KzmDU
+zM{Hn!a<F4yU$Vf5`K^#B12Y864F8Ebhs<xRfU{j-n8t9a(^CH0>e0!rz%ny_Hs8{^
+z-ZXYzs4>m4e2YH_bw@;Jz16xSF1}*`XpyvCZ)mys{$X2L5X#^NUS*Ib43mRj<CrSW
+zRY~qx0c0^3jKgIQMf^xkl>Rp@KCeO~=m!A~*q+W|?F`DGs(2p6pS)}V)vG9dn6m9u
+zAENXyWiM0xO-kRR>`SWuK<O>YmMZ#Mg|1gvQqiAO=uw5es_5@3^dp6RtLVQe)TOeO
+zs=iL88&tMW)sLw3q{`k<^$%2fNoC)wx`@9t8mraxW{q}g?2x7(*XU`Dy{+k=YV>oB
+z{i^9o5uID4t+*~(!X&XuFvV~q<q;L$Q7Vaw`m(2z_)xoxm*Xekiq}fB$wfZ7e~B}x
+za@_k|J}|7B*%>m$46AA(3tDrg7zA7|6ctlPoX)`CJv|1O9m9p?8LKN5Fbq})#zm~l
+zGM<x8{$brqoT2f)vzVFuJeQrk9d!i?Vi;vz0iWrcDj!}0_ED-9#xS$oID`FvsG9Bz
+z1;jA3JbCrmr-s^x=il^|y!USIUfg%S3(Ad_bZ#&FxRPo6XvI(pS%;@qr8E73a+B|c
+zEtn5d8h><gH!V*gvj{d?nc)jdkzvIYgDY)+@YIYeRlqD>tjJvMN-Z&BFU+4}5J9nH
+zFx`bP7%R;2{#3&7cjf98XCY!bqRhz2d#~h-1J-8H90nIFU>4T`kcqMRhH5nNQ2?AF
+zjrC}+WWAja_peQ%!SX*|UuDLt?(BsK#Wn+eT-~$RMTH6d7L@k;d?kF869azlQPcuI
+zHvb#9l>^}JxQai@=bd|7GeNs;;!ex--oIv7&V`dLxOh>Zuo+^IfJ$-(z7gSf$xWeS
+
+literal 0
+HcmV?d00001
+
+diff --git a/src/mainboard/lenovo/x230/variants/x230_fhd/early_init.c b/src/mainboard/lenovo/x230/variants/x230_fhd/early_init.c
+new file mode 100644
+index 0000000000..9c97a199d1
+--- /dev/null
++++ b/src/mainboard/lenovo/x230/variants/x230_fhd/early_init.c
+@@ -0,0 +1,28 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++
++#include <northbridge/intel/sandybridge/raminit_native.h>
++#include <southbridge/intel/bd82x6x/pch.h>
++#include <southbridge/intel/common/gpio.h>
++
++const struct southbridge_usb_port mainboard_usb_ports[] = {
++	{ 1, 0, 0 }, /* P0 (left, fan side), OC 0 */
++	{ 1, 0, 1 }, /* P1 (left touchpad side), OC 1 */
++	{ 1, 1, 3 }, /* P2: dock, OC 3 */
++	{ 1, 1, -1 }, /* P3: wwan, no OC */
++	{ 1, 1, -1 }, /* P4: Wacom tablet on X230t, otherwise empty */
++	{ 1, 1, -1 }, /* P5: Expresscard, no OC */
++	{ 0, 0, -1 }, /* P6: Empty */
++	{ 1, 2, -1 }, /* P7: dock, no OC */
++	{ 1, 0, -1 },
++	{ 1, 2, 5 }, /* P9: Right (EHCI debug), OC 5 */
++	{ 1, 1, -1 }, /* P10: fingerprint reader, no OC */
++	{ 1, 1, -1 }, /* P11: bluetooth, no OC. */
++	{ 1, 1, -1 }, /* P12: wlan, no OC */
++	{ 1, 1, -1 }, /* P13: webcam, no OC */
++};
++
++void mainboard_get_spd(spd_raw_data *spd, bool id_only)
++{
++	read_spd (&spd[0], 0x50, id_only);
++	read_spd (&spd[2], 0x51, id_only);
++}
+diff --git a/src/mainboard/lenovo/x230/variants/x230_fhd/gma-mainboard.ads b/src/mainboard/lenovo/x230/variants/x230_fhd/gma-mainboard.ads
+new file mode 100644
+index 0000000000..f7cf0bc264
+--- /dev/null
++++ b/src/mainboard/lenovo/x230/variants/x230_fhd/gma-mainboard.ads
+@@ -0,0 +1,21 @@
++-- SPDX-License-Identifier: GPL-2.0-or-later
++
++with HW.GFX.GMA;
++with HW.GFX.GMA.Display_Probing;
++
++use HW.GFX.GMA;
++use HW.GFX.GMA.Display_Probing;
++
++private package GMA.Mainboard is
++
++   ports : constant Port_List :=
++     (DP1,
++      DP2,
++      DP3,
++      HDMI1,
++      HDMI2,
++      HDMI3,
++      Analog,
++      others => Disabled);
++
++end GMA.Mainboard;
+diff --git a/src/mainboard/lenovo/x230/variants/x230_fhd/gpio.c b/src/mainboard/lenovo/x230/variants/x230_fhd/gpio.c
+new file mode 100644
+index 0000000000..8de285b34f
+--- /dev/null
++++ b/src/mainboard/lenovo/x230/variants/x230_fhd/gpio.c
+@@ -0,0 +1,284 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++
++#include <southbridge/intel/common/gpio.h>
++
++static const struct pch_gpio_set1 pch_gpio_set1_mode = {
++	.gpio0  = GPIO_MODE_GPIO,
++	.gpio1  = GPIO_MODE_GPIO,
++	.gpio2  = GPIO_MODE_GPIO,
++	.gpio3  = GPIO_MODE_GPIO,
++	.gpio4  = GPIO_MODE_GPIO,
++	.gpio5  = GPIO_MODE_GPIO,
++	.gpio6  = GPIO_MODE_GPIO,
++	.gpio7  = GPIO_MODE_GPIO,
++	.gpio8  = GPIO_MODE_GPIO,
++	.gpio9  = GPIO_MODE_NATIVE,
++	.gpio10 = GPIO_MODE_GPIO,
++	.gpio11 = GPIO_MODE_NATIVE,
++	.gpio12 = GPIO_MODE_NATIVE,
++	.gpio13 = GPIO_MODE_GPIO,
++	.gpio14 = GPIO_MODE_NATIVE,
++	.gpio15 = GPIO_MODE_GPIO,
++	.gpio16 = GPIO_MODE_NATIVE,
++	.gpio17 = GPIO_MODE_GPIO,
++	.gpio18 = GPIO_MODE_NATIVE,
++	.gpio19 = GPIO_MODE_NATIVE,
++	.gpio20 = GPIO_MODE_NATIVE,
++	.gpio21 = GPIO_MODE_GPIO,
++	.gpio22 = GPIO_MODE_GPIO,
++	.gpio23 = GPIO_MODE_NATIVE,
++	.gpio24 = GPIO_MODE_GPIO,
++	.gpio25 = GPIO_MODE_NATIVE,
++	.gpio26 = GPIO_MODE_NATIVE,
++	.gpio27 = GPIO_MODE_GPIO,
++	.gpio28 = GPIO_MODE_GPIO,
++	.gpio29 = GPIO_MODE_GPIO,
++	.gpio30 = GPIO_MODE_NATIVE,
++	.gpio31 = GPIO_MODE_NATIVE,
++};
++
++static const struct pch_gpio_set1 pch_gpio_set1_direction = {
++	.gpio0  = GPIO_DIR_INPUT,
++	.gpio1  = GPIO_DIR_INPUT,
++	.gpio2  = GPIO_DIR_INPUT,
++	.gpio3  = GPIO_DIR_INPUT,
++	.gpio4  = GPIO_DIR_INPUT,
++	.gpio5  = GPIO_DIR_INPUT,
++	.gpio6  = GPIO_DIR_INPUT,
++	.gpio7  = GPIO_DIR_INPUT,
++	.gpio8  = GPIO_DIR_OUTPUT,
++	.gpio9  = GPIO_DIR_INPUT,
++	.gpio10 = GPIO_DIR_OUTPUT,
++	.gpio11 = GPIO_DIR_INPUT,
++	.gpio12 = GPIO_DIR_OUTPUT,
++	.gpio13 = GPIO_DIR_INPUT,
++	.gpio14 = GPIO_DIR_INPUT,
++	.gpio15 = GPIO_DIR_OUTPUT,
++	.gpio16 = GPIO_DIR_INPUT,
++	.gpio17 = GPIO_DIR_INPUT,
++	.gpio18 = GPIO_DIR_INPUT,
++	.gpio19 = GPIO_DIR_INPUT,
++	.gpio20 = GPIO_DIR_INPUT,
++	.gpio21 = GPIO_DIR_INPUT,
++	.gpio22 = GPIO_DIR_OUTPUT,
++	.gpio23 = GPIO_DIR_INPUT,
++	.gpio24 = GPIO_DIR_OUTPUT,
++	.gpio25 = GPIO_DIR_INPUT,
++	.gpio26 = GPIO_DIR_INPUT,
++	.gpio27 = GPIO_DIR_INPUT,
++	.gpio28 = GPIO_DIR_OUTPUT,
++	.gpio29 = GPIO_DIR_OUTPUT,
++	.gpio30 = GPIO_DIR_OUTPUT,
++	.gpio31 = GPIO_DIR_INPUT
++};
++
++static const struct pch_gpio_set1 pch_gpio_set1_level = {
++	.gpio0  = GPIO_LEVEL_HIGH,
++	.gpio1  = GPIO_LEVEL_HIGH,
++	.gpio2  = GPIO_LEVEL_LOW,
++	.gpio3  = GPIO_LEVEL_HIGH,
++	.gpio4  = GPIO_LEVEL_HIGH,
++	.gpio5  = GPIO_LEVEL_HIGH,
++	.gpio6  = GPIO_LEVEL_HIGH,
++	.gpio7  = GPIO_LEVEL_HIGH,
++	.gpio8  = GPIO_LEVEL_LOW,
++	.gpio9  = GPIO_LEVEL_HIGH,
++	.gpio10 = GPIO_LEVEL_HIGH,
++	.gpio11 = GPIO_LEVEL_HIGH,
++	.gpio12 = GPIO_LEVEL_HIGH,
++	.gpio13 = GPIO_LEVEL_HIGH,
++	.gpio14 = GPIO_LEVEL_HIGH,
++	.gpio15 = GPIO_LEVEL_LOW,
++	.gpio16 = GPIO_LEVEL_HIGH,
++	.gpio17 = GPIO_LEVEL_HIGH,
++	.gpio18 = GPIO_LEVEL_HIGH,
++	.gpio19 = GPIO_LEVEL_HIGH,
++	.gpio20 = GPIO_LEVEL_HIGH,
++	.gpio21 = GPIO_LEVEL_HIGH,
++	.gpio22 = GPIO_LEVEL_HIGH,
++	.gpio23 = GPIO_LEVEL_HIGH,
++	.gpio24 = GPIO_LEVEL_LOW,
++	.gpio25 = GPIO_LEVEL_HIGH,
++	.gpio26 = GPIO_LEVEL_HIGH,
++	.gpio27 = GPIO_LEVEL_LOW,
++	.gpio28 = GPIO_LEVEL_LOW,
++	.gpio29 = GPIO_LEVEL_HIGH,
++	.gpio30 = GPIO_LEVEL_HIGH,
++	.gpio31 = GPIO_LEVEL_LOW,
++};
++
++static const struct pch_gpio_set1 pch_gpio_set1_invert = {
++	.gpio1 = GPIO_INVERT,
++	.gpio6 = GPIO_INVERT,
++	.gpio13 = GPIO_INVERT,
++};
++
++static const struct pch_gpio_set2 pch_gpio_set2_mode = {
++	.gpio32 = GPIO_MODE_NATIVE,
++	.gpio33 = GPIO_MODE_GPIO,
++	.gpio34 = GPIO_MODE_GPIO,
++	.gpio35 = GPIO_MODE_GPIO,
++	.gpio36 = GPIO_MODE_GPIO,
++	.gpio37 = GPIO_MODE_GPIO,
++	.gpio38 = GPIO_MODE_GPIO,
++	.gpio39 = GPIO_MODE_GPIO,
++	.gpio40 = GPIO_MODE_NATIVE,
++	.gpio41 = GPIO_MODE_NATIVE,
++	.gpio42 = GPIO_MODE_NATIVE,
++	.gpio43 = GPIO_MODE_GPIO,
++	.gpio44 = GPIO_MODE_NATIVE,
++	.gpio45 = GPIO_MODE_NATIVE,
++	.gpio46 = GPIO_MODE_NATIVE,
++	.gpio47 = GPIO_MODE_NATIVE,
++	.gpio48 = GPIO_MODE_GPIO,
++	.gpio49 = GPIO_MODE_GPIO,
++	.gpio50 = GPIO_MODE_GPIO,
++	.gpio51 = GPIO_MODE_GPIO,
++	.gpio52 = GPIO_MODE_GPIO,
++	.gpio53 = GPIO_MODE_GPIO,
++	.gpio54 = GPIO_MODE_GPIO,
++	.gpio55 = GPIO_MODE_GPIO,
++	.gpio56 = GPIO_MODE_NATIVE,
++	.gpio57 = GPIO_MODE_GPIO,
++	.gpio58 = GPIO_MODE_NATIVE,
++	.gpio59 = GPIO_MODE_NATIVE,
++	.gpio60 = GPIO_MODE_NATIVE,
++	.gpio61 = GPIO_MODE_NATIVE,
++	.gpio62 = GPIO_MODE_NATIVE,
++	.gpio63 = GPIO_MODE_NATIVE,
++};
++
++static const struct pch_gpio_set2 pch_gpio_set2_direction = {
++	.gpio32 = GPIO_DIR_INPUT,
++	.gpio33 = GPIO_DIR_INPUT,
++	.gpio34 = GPIO_DIR_OUTPUT,
++	.gpio35 = GPIO_DIR_INPUT,
++	.gpio36 = GPIO_DIR_INPUT,
++	.gpio37 = GPIO_DIR_INPUT,
++	.gpio38 = GPIO_DIR_INPUT,
++	.gpio39 = GPIO_DIR_INPUT,
++	.gpio40 = GPIO_DIR_INPUT,
++	.gpio41 = GPIO_DIR_INPUT,
++	.gpio42 = GPIO_DIR_INPUT,
++	.gpio43 = GPIO_DIR_OUTPUT,
++	.gpio44 = GPIO_DIR_INPUT,
++	.gpio45 = GPIO_DIR_INPUT,
++	.gpio46 = GPIO_DIR_INPUT,
++	.gpio47 = GPIO_DIR_INPUT,
++	.gpio48 = GPIO_DIR_INPUT,
++	.gpio49 = GPIO_DIR_INPUT,
++	.gpio50 = GPIO_DIR_INPUT,
++	.gpio51 = GPIO_DIR_OUTPUT,
++	.gpio52 = GPIO_DIR_OUTPUT,
++	.gpio53 = GPIO_DIR_OUTPUT,
++	.gpio54 = GPIO_DIR_INPUT,
++	.gpio55 = GPIO_DIR_OUTPUT,
++	.gpio56 = GPIO_DIR_INPUT,
++	.gpio57 = GPIO_DIR_INPUT,
++	.gpio58 = GPIO_DIR_INPUT,
++	.gpio59 = GPIO_DIR_INPUT,
++	.gpio60 = GPIO_DIR_INPUT,
++	.gpio61 = GPIO_DIR_OUTPUT,
++	.gpio62 = GPIO_DIR_OUTPUT,
++	.gpio63 = GPIO_DIR_OUTPUT,
++};
++
++static const struct pch_gpio_set2 pch_gpio_set2_level = {
++	.gpio32 = GPIO_LEVEL_HIGH,
++	.gpio33 = GPIO_LEVEL_HIGH,
++	.gpio34 = GPIO_LEVEL_LOW,
++	.gpio35 = GPIO_LEVEL_LOW,
++	.gpio36 = GPIO_LEVEL_LOW,
++	.gpio37 = GPIO_LEVEL_LOW,
++	.gpio38 = GPIO_LEVEL_HIGH,
++	.gpio39 = GPIO_LEVEL_LOW,
++	.gpio40 = GPIO_LEVEL_HIGH,
++	.gpio41 = GPIO_LEVEL_HIGH,
++	.gpio42 = GPIO_LEVEL_HIGH,
++	.gpio43 = GPIO_LEVEL_HIGH,
++	.gpio44 = GPIO_LEVEL_HIGH,
++	.gpio45 = GPIO_LEVEL_HIGH,
++	.gpio46 = GPIO_LEVEL_HIGH,
++	.gpio47 = GPIO_LEVEL_HIGH,
++	.gpio48 = GPIO_LEVEL_HIGH,
++	.gpio49 = GPIO_LEVEL_HIGH,
++	.gpio50 = GPIO_LEVEL_HIGH,
++	.gpio51 = GPIO_LEVEL_HIGH,
++	.gpio52 = GPIO_LEVEL_HIGH,
++	.gpio53 = GPIO_LEVEL_HIGH,
++	.gpio54 = GPIO_LEVEL_HIGH,
++	.gpio55 = GPIO_LEVEL_HIGH,
++	.gpio56 = GPIO_LEVEL_HIGH,
++	.gpio57 = GPIO_LEVEL_HIGH,
++	.gpio58 = GPIO_LEVEL_HIGH,
++	.gpio59 = GPIO_LEVEL_HIGH,
++	.gpio60 = GPIO_LEVEL_HIGH,
++	.gpio61 = GPIO_LEVEL_HIGH,
++	.gpio62 = GPIO_LEVEL_LOW,
++	.gpio63 = GPIO_LEVEL_HIGH,
++};
++
++static const struct pch_gpio_set3 pch_gpio_set3_mode = {
++	.gpio64 = GPIO_MODE_GPIO,
++	.gpio65 = GPIO_MODE_GPIO,
++	.gpio66 = GPIO_MODE_GPIO,
++	.gpio67 = GPIO_MODE_GPIO,
++	.gpio68 = GPIO_MODE_GPIO,
++	.gpio69 = GPIO_MODE_GPIO,
++	.gpio70 = GPIO_MODE_GPIO,
++	.gpio71 = GPIO_MODE_GPIO,
++	.gpio72 = GPIO_MODE_NATIVE,
++	.gpio73 = GPIO_MODE_NATIVE,
++	.gpio74 = GPIO_MODE_NATIVE,
++	.gpio75 = GPIO_MODE_NATIVE,
++};
++
++static const struct pch_gpio_set3 pch_gpio_set3_direction = {
++	.gpio64 = GPIO_DIR_INPUT,
++	.gpio65 = GPIO_DIR_INPUT,
++	.gpio66 = GPIO_DIR_INPUT,
++	.gpio67 = GPIO_DIR_INPUT,
++	.gpio68 = GPIO_DIR_INPUT,
++	.gpio69 = GPIO_DIR_INPUT,
++	.gpio70 = GPIO_DIR_INPUT,
++	.gpio71 = GPIO_DIR_INPUT,
++	.gpio72 = GPIO_DIR_INPUT,
++	.gpio73 = GPIO_DIR_INPUT,
++	.gpio74 = GPIO_DIR_INPUT,
++	.gpio75 = GPIO_DIR_INPUT,
++};
++
++static const struct pch_gpio_set3 pch_gpio_set3_level = {
++	.gpio64 = GPIO_LEVEL_HIGH,
++	.gpio65 = GPIO_LEVEL_HIGH,
++	.gpio66 = GPIO_LEVEL_HIGH,
++	.gpio67 = GPIO_LEVEL_HIGH,
++	.gpio68 = GPIO_LEVEL_LOW,
++	.gpio69 = GPIO_LEVEL_LOW,
++	.gpio70 = GPIO_LEVEL_HIGH,
++	.gpio71 = GPIO_LEVEL_HIGH,
++	.gpio72 = GPIO_LEVEL_HIGH,
++	.gpio73 = GPIO_LEVEL_HIGH,
++	.gpio74 = GPIO_LEVEL_HIGH,
++	.gpio75 = GPIO_LEVEL_HIGH,
++};
++
++const struct pch_gpio_map mainboard_gpio_map = {
++	.set1 = {
++		.mode		= &pch_gpio_set1_mode,
++		.direction	= &pch_gpio_set1_direction,
++		.level		= &pch_gpio_set1_level,
++		.invert		= &pch_gpio_set1_invert,
++
++	},
++	.set2 = {
++		.mode		= &pch_gpio_set2_mode,
++		.direction	= &pch_gpio_set2_direction,
++		.level		= &pch_gpio_set2_level,
++	},
++	.set3 = {
++		.mode		= &pch_gpio_set3_mode,
++		.direction	= &pch_gpio_set3_direction,
++		.level		= &pch_gpio_set3_level,
++	},
++};
+diff --git a/src/mainboard/lenovo/x230/variants/x230_fhd/hda_verb.c b/src/mainboard/lenovo/x230/variants/x230_fhd/hda_verb.c
+new file mode 100644
+index 0000000000..05fb3fd775
+--- /dev/null
++++ b/src/mainboard/lenovo/x230/variants/x230_fhd/hda_verb.c
+@@ -0,0 +1,82 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++
++/* Bits 31:28 - Codec Address */
++/* Bits 27:20 - NID */
++/* Bits 19:8 - Verb ID */
++/* Bits 7:0  - Payload */
++
++#include <device/azalia_device.h>
++
++const u32 cim_verb_data[] = {
++	/* --- Codec #0 --- */
++	0x10ec0269,	/* Codec Vendor / Device ID: Realtek ALC269VC */
++	0x17aa21fa,	/* Subsystem ID */
++	19,		/* Number of 4 dword sets */
++	AZALIA_SUBVENDOR(0, 0x17aa21fa),
++
++	/* Ext. Microphone Connector:	External,Right; MicIn,3.5mm; Black,JD; DA,Seq */
++	AZALIA_PIN_CFG(0, 0x0a, 0x04a11020),
++
++	/* Headphones Connector:	External,Right; HP,3.5mm; Black,JD; DA,Seq */
++	AZALIA_PIN_CFG(0, 0x0b, 0x0421101f),
++
++	/* Not connected:		N/A,N/A; Other,Unknown; Unknown,JD; DA,Seq */
++	AZALIA_PIN_CFG(0, 0x0c, 0x40f000f0),
++
++	/* Internal Speakers		Fixed,Int; Speaker,Other Analog; Unknown,nJD; DA,Seq */
++	AZALIA_PIN_CFG(0, 0x0d, 0x90170110),
++
++	/* Not connected */
++	AZALIA_PIN_CFG(0, 0x0f, 0x40f000f0),
++
++	/* Internal Microphone:		Fixed,Int,Top; Mic In,ATIPI; Unknown,nJD; DA,Seq */
++	AZALIA_PIN_CFG(0, 0x11, 0xd5a30140),
++	AZALIA_PIN_CFG(0, 0x12, 0x90a60140),
++	AZALIA_PIN_CFG(0, 0x14, 0x90170110),
++	AZALIA_PIN_CFG(0, 0x15, 0x03211020),
++	AZALIA_PIN_CFG(0, 0x18, 0x03a11830),
++	AZALIA_PIN_CFG(0, 0x19, 0x411111f0),
++	AZALIA_PIN_CFG(0, 0x1a, 0x411111f0),
++	AZALIA_PIN_CFG(0, 0x1d, 0x40138205),
++	AZALIA_PIN_CFG(0, 0x1e, 0x411111f0),
++
++	/* Misc entries */
++	0x01970804,
++	0x01870803,
++	0x01470740,
++	0x00970640,
++
++	0x00370680,
++	0x00270680,
++	0x01470c02,
++	0x01570c02,
++
++	/* ALC coefficients. */
++	/* 08 */
++	0x02050008,
++	0x02040700,
++	/* 18 */
++	0x02050018,
++	0x02045184,
++	/* 1c */
++	0x0205001c,
++	0x02042800,
++
++	0x01870724, /* Enable Vrefout for mic */
++	0x00170500, /* Set power state to D0 */
++
++	/* --- Codec #3 --- */
++	0x80862806,	/* Codec Vendor / Device ID: Intel PantherPoint HDMI */
++	0x80860101,	/* Subsystem ID */
++	4,		/* Number of 4 dword sets */
++	AZALIA_SUBVENDOR(3, 0x80860101),
++	AZALIA_PIN_CFG(3, 0x05, 0x18560010),
++	AZALIA_PIN_CFG(3, 0x06, 0x18560020),
++	AZALIA_PIN_CFG(3, 0x07, 0x18560030),
++};
++
++const u32 pc_beep_verbs[] = {
++	0x02177a00, /* Digital PCBEEP Gain: 0h=-9db, 1h=-6db ... 4h=+3db, 5h=+6db */
++};
++
++AZALIA_ARRAY_SIZES;
+diff --git a/src/mainboard/lenovo/x230/variants/x230_fhd/overridetree.cb b/src/mainboard/lenovo/x230/variants/x230_fhd/overridetree.cb
+new file mode 100644
+index 0000000000..97e48b8c2a
+--- /dev/null
++++ b/src/mainboard/lenovo/x230/variants/x230_fhd/overridetree.cb
+@@ -0,0 +1,16 @@
++chip northbridge/intel/sandybridge
++	device domain 0 on
++		chip southbridge/intel/bd82x6x # Intel Series 7 Panther Point PCH
++			register "docking_supported" = "1"
++			register "pcie_hotplug_map" = "{ 0, 0, 1, 0, 0, 0, 0, 0 }"
++			device pci 1c.2 on
++				smbios_slot_desc "7" "3" "ExpressCard Slot" "8"
++			end # PCIe Port #3 (expresscard)
++			device pci 1f.0 on # LPC bridge
++				chip ec/lenovo/h8
++					register "eventa_enable" = "0x01"
++				end
++			end # LPC Controller
++		end
++	end
++end
+-- 
+2.28.0
+
diff --git a/infra/corenix/configs/boards/x230-fhd/default.nix b/infra/corenix/configs/boards/x230-fhd/default.nix
new file mode 100644
index 00000000000..d2d8f6d4432
--- /dev/null
+++ b/infra/corenix/configs/boards/x230-fhd/default.nix
@@ -0,0 +1,19 @@
+{ pkgs, ... }:
+
+{
+  corenix.corebootConfig = {
+    CONFIG_VENDOR_LENOVO = "y";
+    CONFIG_BOARD_LENOVO_X230_FHD = "y";
+  };
+
+  corenix.package = pkgs.coreboot.overrideAttrs (oA: {
+    src = pkgs.fetchgit {
+      url = "https://github.com/petabyteboy/coreboot.git";
+      rev = "6e36562d08112d8a93088ee3d2b2ef0da6947e81";
+      fetchSubmodules = true;
+      sha256 = "06iaksr0cqp42r91aa02v5ww0sx1h2v0knfbw0mj86sg5bhybcs1";
+    };
+  });
+
+  seabios.ps2Timeout = 5000;
+}
diff --git a/infra/corenix/configs/boards/x230.nix b/infra/corenix/configs/boards/x230.nix
new file mode 100644
index 00000000000..293fc81c560
--- /dev/null
+++ b/infra/corenix/configs/boards/x230.nix
@@ -0,0 +1,10 @@
+{ ... }:
+
+{
+  corenix.corebootConfig = {
+    CONFIG_VENDOR_LENOVO = "y";
+    CONFIG_BOARD_LENOVO_X230 = "y";
+  };
+
+  seabios.ps2Timeout = 5000;
+}
diff --git a/infra/corenix/configs/boards/x230t.nix b/infra/corenix/configs/boards/x230t.nix
new file mode 100644
index 00000000000..6ae211ae6dc
--- /dev/null
+++ b/infra/corenix/configs/boards/x230t.nix
@@ -0,0 +1,10 @@
+{ ... }:
+
+{
+  corenix.corebootConfig = {
+    CONFIG_VENDOR_LENOVO = "y";
+    CONFIG_BOARD_LENOVO_X230T = "y";
+  };
+
+  seabios.ps2Timeout = 5000;
+}
diff --git a/infra/corenix/configs/common.nix b/infra/corenix/configs/common.nix
new file mode 100644
index 00000000000..1e091cc29cd
--- /dev/null
+++ b/infra/corenix/configs/common.nix
@@ -0,0 +1,11 @@
+{ lib, ... }:
+
+{
+  corenix.corebootConfig = {
+    CONFIG_PAYLOAD_NONE = "y"; # payload is added later
+    CONFIG_CBFS_SIZE = lib.mkDefault "0x300000";
+    CONFIG_USE_OPTION_TABLE = lib.mkDefault "y";
+    CONFIG_PCIEXP_CLK_PM = lib.mkDefault "y";
+    CONFIG_GENERIC_LINEAR_FRAMEBUFFER = lib.mkDefault "y";
+  };
+}
diff --git a/infra/corenix/configs/milan/common.nix b/infra/corenix/configs/milan/common.nix
new file mode 100644
index 00000000000..dd3df22758b
--- /dev/null
+++ b/infra/corenix/configs/milan/common.nix
@@ -0,0 +1,14 @@
+{ ... }:
+
+{
+  imports = [ ../common.nix ];
+
+  grub2.enable = true;
+  grub2.users.root.password = "grub.pbkdf2.sha512.10000.EAE4FDF9D98694628FF5F90A0BB4995BB8B85429D5BDCA849F1F94EA353645C86D553193DF1253908B1A25673898AD9586E117C45BA445B906AA887322DE42A5.4B7D4DF5E8E9F6958ECB3D9EA8FDBE7F3590DB03A287FF29960CDDFE7260D94AE2C50A8D399A54C3764E7F5F20DDD2D2FD9EA2C252DC02CA568C18F87DE45B0E";
+  seabios.enable = true;
+  seabios.asSecondaryPayload = true;
+  tianocore.asSecondaryPayload = true;
+  coreinfo.enable = true;
+  nvramcui.enable = true;
+  tint.enable = true;
+}
diff --git a/infra/corenix/configs/milan/milan-x1c.nix b/infra/corenix/configs/milan/milan-x1c.nix
new file mode 100644
index 00000000000..9e49e54b643
--- /dev/null
+++ b/infra/corenix/configs/milan/milan-x1c.nix
@@ -0,0 +1,13 @@
+{ lib, ... }:
+
+{
+  imports = [ ./common.nix ../boards/x1c.nix ];
+
+  corenix.corebootConfig = {
+    CONFIG_LINEAR_FRAMEBUFFER_MAX_WIDTH = "1600";
+    CONFIG_LINEAR_FRAMEBUFFER_MAX_HEIGHT = "900";
+    CONFIG_CBFS_SIZE = "0x6f0000";
+  };
+
+  tianocore.enable = true;
+}
diff --git a/infra/corenix/configs/milan/milan-x230-fhd.nix b/infra/corenix/configs/milan/milan-x230-fhd.nix
new file mode 100644
index 00000000000..f4d42a81452
--- /dev/null
+++ b/infra/corenix/configs/milan/milan-x230-fhd.nix
@@ -0,0 +1,13 @@
+{ ... }:
+
+{
+  imports = [ ./common.nix ../boards/x230-fhd ];
+
+  corenix.corebootConfig = {
+    CONFIG_LINEAR_FRAMEBUFFER_MAX_WIDTH = "1920";
+    CONFIG_LINEAR_FRAMEBUFFER_MAX_HEIGHT = "1080";
+    CONFIG_CBFS_SIZE = "0xbe5000";
+  };
+
+  tianocore.enable = true;
+}
diff --git a/infra/corenix/configs/milan/milan-x230t.nix b/infra/corenix/configs/milan/milan-x230t.nix
new file mode 100644
index 00000000000..ee3b349916c
--- /dev/null
+++ b/infra/corenix/configs/milan/milan-x230t.nix
@@ -0,0 +1,11 @@
+{ ... }:
+
+{
+  imports = [ ./common.nix ../boards/x230t.nix ];
+
+  corenix.corebootConfig = {
+    CONFIG_LINEAR_FRAMEBUFFER_MAX_WIDTH = "1600";
+    CONFIG_LINEAR_FRAMEBUFFER_MAX_HEIGHT = "900";
+    CONFIG_CBFS_SIZE = "0x500000";
+  };
+}
diff --git a/infra/corenix/default.nix b/infra/corenix/default.nix
new file mode 100644
index 00000000000..1fbe5432622
--- /dev/null
+++ b/infra/corenix/default.nix
@@ -0,0 +1,6 @@
+(import (fetchTarball {
+  url =
+    "https://github.com/edolstra/flake-compat/archive/94cf59784c73ecec461eaa291918eff0bfb538ac.tar.gz";
+  sha256 = "03qz7h3hpb7jhlyidd4jxxncns40kvw8aqsq5l8d0rsdq9nj02qj";
+}) { src = ./.; }).defaultNix
+
diff --git a/infra/corenix/flake.lock b/infra/corenix/flake.lock
new file mode 100644
index 00000000000..dcfe647d911
--- /dev/null
+++ b/infra/corenix/flake.lock
@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1604414673,
+        "narHash": "sha256-Z8yNdN5G17J8Ro9Go9LGN5NtEwL2oleZAZkEhdC4q7I=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "a9f4945fa4e0ec655554149e82bdac935c9ba747",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "master",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/infra/corenix/flake.nix b/infra/corenix/flake.nix
new file mode 100644
index 00000000000..6864f384090
--- /dev/null
+++ b/infra/corenix/flake.nix
@@ -0,0 +1,49 @@
+{
+  inputs.nixpkgs = {
+    type = "github";
+    owner = "nixos";
+    repo = "nixpkgs";
+    ref = "master";
+  };
+
+  description = "A collections of derivations for coreboot and payloads";
+  outputs = { self, nixpkgs }:
+    let
+      nixpkgsOptions = {
+        system = "x86_64-linux";
+        overlays = [ (import ./pkgs/overlay.nix) ];
+      };
+      pkgs = import nixpkgs nixpkgsOptions;
+      inherit (pkgs) lib;
+
+      makeDevice = configFile:
+        (lib.evalModules {
+          modules = [
+            ({ ... }: { nixpkgs = nixpkgsOptions; })
+            ("${nixpkgs}/nixos/modules/misc/assertions.nix")
+            ("${nixpkgs}/nixos/modules/misc/nixpkgs.nix")
+            ./modules
+            configFile
+          ];
+        }).config.corenix.rom;
+
+      exportedPkgs = {
+        inherit (pkgs)
+          coreboot coreboot-payload-grub2 coreboot-payload-tianocore
+          coreboot-payload-seabios coreboot-payload-tint
+          coreboot-payload-nvramcui coreboot-payload-coreinfo;
+
+        milan-x1c = makeDevice ./configs/milan/milan-x1c.nix;
+        milan-x230t = makeDevice ./configs/milan/milan-x230t.nix;
+        milan-x230-fhd = makeDevice ./configs/milan/milan-x230-fhd.nix;
+      };
+
+    in {
+      lib = { inherit makeDevice; };
+
+      packages.x86_64-linux = exportedPkgs;
+
+      # shortcut for use with flake-compat
+      pkgs = exportedPkgs;
+    };
+}
diff --git a/infra/corenix/modules/coreinfo/default.nix b/infra/corenix/modules/coreinfo/default.nix
new file mode 100644
index 00000000000..d1a2a19ecf3
--- /dev/null
+++ b/infra/corenix/modules/coreinfo/default.nix
@@ -0,0 +1,28 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let cfg = config.coreinfo;
+in {
+  options.coreinfo = {
+    enable = mkEnableOption "coreinfo coreboot secondary payload";
+
+    coreinfoConfig = mkOption {
+      type = types.attrsOf (types.nullOr types.str);
+      default = { };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    corenix.extraFiles = {
+      "img/coreinfo" = {
+        type = "payload";
+        src = "${
+            pkgs.coreboot-payload-coreinfo.override {
+              inherit (cfg) coreinfoConfig;
+            }
+          }/coreinfo.elf";
+      };
+    };
+  };
+}
diff --git a/infra/corenix/modules/corenix/default.nix b/infra/corenix/modules/corenix/default.nix
new file mode 100644
index 00000000000..0ab4e996ff2
--- /dev/null
+++ b/infra/corenix/modules/corenix/default.nix
@@ -0,0 +1,64 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.corenix;
+
+  fileOptions.options = {
+    src = mkOption { type = types.nullOr types.path; };
+
+    type = mkOption {
+      type = types.str;
+      default = "raw";
+    };
+  };
+in {
+  options.corenix = {
+    installCommands = mkOption { type = types.lines; };
+
+    extraFiles =
+      mkOption { type = types.attrsOf (types.submodule fileOptions); };
+
+    corebootConfig = mkOption {
+      type = types.attrsOf (types.nullOr types.str);
+      default = { };
+    };
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.coreboot;
+    };
+
+    rom = mkOption {
+      readOnly = true;
+      type = types.path;
+    };
+  };
+
+  config = {
+    corenix.installCommands = let
+      filteredFiles = filterAttrs (k: v: v.src != null) cfg.extraFiles;
+      filesList = mapAttrsToList (k: v: v // { name = k; }) filteredFiles;
+    in concatMapStringsSep "\n" (file:
+      if file.type == "payload" then ''
+        cbfstool $out/coreboot.rom add-payload \
+          -f "${file.src}" \
+          -n "${file.name}" \
+      '' else ''
+        cbfstool $out/coreboot.rom add \
+          -f "${file.src}" \
+          -n "${file.name}" \
+          -t "${file.type}"
+      '') filesList;
+
+    corenix.rom =
+      let base = cfg.package.override { inherit (cfg) corebootConfig; };
+      in pkgs.runCommand "coreboot-rom" {
+        buildInputs = with pkgs; [ cbfstool ];
+      } ''
+        install -D ${base}/coreboot.rom -t $out
+        ${cfg.installCommands}
+      '';
+  };
+}
diff --git a/infra/corenix/modules/default.nix b/infra/corenix/modules/default.nix
new file mode 100644
index 00000000000..c461f820cab
--- /dev/null
+++ b/infra/corenix/modules/default.nix
@@ -0,0 +1,6 @@
+{ ... }:
+
+{
+  imports =
+    [ ./corenix ./grub2 ./tianocore ./seabios ./tint ./nvramcui ./coreinfo ];
+}
diff --git a/infra/corenix/modules/grub2/default.nix b/infra/corenix/modules/grub2/default.nix
new file mode 100644
index 00000000000..39fa13f7302
--- /dev/null
+++ b/infra/corenix/modules/grub2/default.nix
@@ -0,0 +1,123 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.grub2;
+  payloadName =
+    if cfg.asSecondaryPayload then "img/grub2" else "fallback/payload";
+
+  configText = (readFile ./files/grub.cfg) + cfg.extraConfig
+    + (optionalString (cfg.scanDevices) (readFile ./files/grub-scan.cfg))
+    + (optionalString (cfg.users != { }) ((concatStringsSep "\n" (mapAttrsToList
+      (n: u: ''
+        ${
+          if u.passwordIsHashed then "password_pbkdf2" else "password"
+        } ${n} ${u.password}
+      '') cfg.users)) + ''
+        set superusers="${
+          concatStringsSep " "
+          (attrNames (filterAttrs (n: u: u.superuser) cfg.users))
+        }"
+        export superusers
+      '')) + (optionalString cfg.generateSecondaryPayloadEntries
+        (concatMapStrings (n: ''
+          menuentry '${removePrefix "img/" n}' {
+            chainloader (cbfsdisk)/${n}
+          }
+        '') (filter (hasPrefix "img/") (attrNames config.corenix.extraFiles))));
+
+  userOpts = { ... }: {
+    options = {
+      superuser = mkOption {
+        type = types.bool;
+        default = true;
+      };
+      password = mkOption { type = types.str; };
+      passwordIsHashed = mkOption {
+        type = types.bool;
+        default = true;
+      };
+    };
+  };
+in {
+  options.grub2 = {
+    enable = mkEnableOption "grub2 coreboot primary payload";
+
+    asSecondaryPayload = mkOption {
+      type = types.bool;
+      default = false;
+    };
+
+    generateSecondaryPayloadEntries = mkOption {
+      type = types.bool;
+      default = true;
+    };
+
+    scanDevices = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Scan internal and external storage devices for GRUB2/syslinux/isolinux/NetBSD
+        configs and at runtime and create boot entries for each of them.
+      '';
+    };
+
+    extraConfig = mkOption {
+      type = types.lines;
+      default = "";
+    };
+
+    configFile = mkOption { type = types.path; };
+
+    users = mkOption {
+      type = types.attrsOf (types.submodule userOpts);
+      default = { };
+    };
+
+    font = mkOption {
+      type = types.path;
+      default = "${pkgs.unifont}/share/fonts/truetype/unifont.ttf";
+      example = "${pkgs.dejavu_fonts}/share/fonts/truetype/DejaVuSansMono.ttf";
+    };
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.coreboot-payload-grub2;
+    };
+
+    extraPayloadModules = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+    };
+  };
+
+  config = mkIf cfg.enable {
+    grub2.configFile = pkgs.writeText "grub.cfg" configText;
+    grub2.extraPayloadModules = [
+      "png"
+      "gfxmenu"
+      "gfxterm_background"
+      "ls"
+      "cat"
+      "echo"
+      "linux"
+      "xfs"
+      "bsd"
+    ];
+
+    corenix.extraFiles = {
+      ${payloadName} = {
+        type = "payload";
+        src = "${
+            cfg.package.override { inherit (cfg) extraPayloadModules; }
+          }/default_payload.elf";
+      };
+      "font.pf2".src =
+        (pkgs.runCommand "font.pf2" { buildInputs = with pkgs; [ grub2 ]; }
+          "grub-mkfont --range=0x20-0x7E,0x2501-0x251F,0x2191-0x2193 --size=14 -o $out ${cfg.font}");
+      "etc/grub.cfg".src = cfg.configFile;
+      "background.png".src = ./files/background.png;
+    };
+  };
+}
diff --git a/infra/corenix/modules/grub2/files/background.png b/infra/corenix/modules/grub2/files/background.png
new file mode 100644
index 00000000000..29275058f28
Binary files /dev/null and b/infra/corenix/modules/grub2/files/background.png differ
diff --git a/infra/corenix/modules/grub2/files/grub-scan.cfg b/infra/corenix/modules/grub2/files/grub-scan.cfg
new file mode 100644
index 00000000000..5aced43ebc3
--- /dev/null
+++ b/infra/corenix/modules/grub2/files/grub-scan.cfg
@@ -0,0 +1,30 @@
+for x in (ahci*,*) (usb*,*) ; do
+	if [ -f "${x}/netbsd" ] ; then
+		menuentry "Load NetBSD from $x" $x { 
+			root=$2
+			knetbsd /netbsd
+		}
+	fi
+	for path in '' /grub /grub2 /boot /boot/grub /boot/grub2 /efi/boot; do
+		if [ -f "${x}${path}/grub.cfg" ] ; then
+			menuentry "Load config from ${x}" $x $path { 
+				root=$2
+				configfile "/${3}/grub.cfg"
+			}
+		fi
+	done
+	for path in '' /boot; do
+		if [ -f "${x}${path}/syslinux/syslinux.cfg" ] ; then
+			menuentry "Load syslinux config from ${x}" $x $path { 
+				root=$2
+				syslinux_configfile -s "${3}/syslinux/syslinux.cfg"
+			}
+		fi
+		if [ -f "${x}${path}/isolinux/isolinux.cfg" ] ; then
+			menuentry "Load isolinux config from ${x}" $x $path { 
+				root=$2
+				syslinux_configfile -i "${3}/isolinux/isolinux.cfg"
+			}
+		fi
+	done
+done
diff --git a/infra/corenix/modules/grub2/files/grub.cfg b/infra/corenix/modules/grub2/files/grub.cfg
new file mode 100644
index 00000000000..9b4548fbf04
--- /dev/null
+++ b/infra/corenix/modules/grub2/files/grub.cfg
@@ -0,0 +1,46 @@
+insmod regexp
+insmod ahci
+insmod part_msdos
+insmod part_gpt
+
+function load_video {
+	if [ x$feature_all_video_module = xy ]; then
+		insmod all_video
+	else
+		insmod efi_gop
+		insmod efi_uga
+		insmod ieee1275_fb
+		insmod vbe
+		insmod vga
+		insmod video_bochs
+		insmod video_cirrus
+	fi
+}
+
+
+if loadfont (cbfsdisk)/font.pf2 ; then
+	set gfxmode=auto
+	load_video
+	insmod gfxterm
+	set locale_dir=$prefix/locale
+	set lang=en_US
+	insmod gettext
+fi
+
+terminal_input console
+terminal_output gfxterm
+gfxpayload=keep
+
+if [ x$feature_timeout_style = xy ] ; then
+	set timeout_style=menu
+	set timeout=1
+# Fallback normal timeout code in case the timeout_style feature is
+# unavailable.
+else
+	set timeout=5
+fi
+
+insmod png
+if background_image (cbfsdisk)/background.png; then
+	true
+fi
diff --git a/infra/corenix/modules/nvramcui/default.nix b/infra/corenix/modules/nvramcui/default.nix
new file mode 100644
index 00000000000..b2838a2ff4c
--- /dev/null
+++ b/infra/corenix/modules/nvramcui/default.nix
@@ -0,0 +1,19 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let cfg = config.nvramcui;
+in {
+  options.nvramcui = {
+    enable = mkEnableOption "nvramcui coreboot secondary payload";
+  };
+
+  config = lib.mkIf cfg.enable {
+    corenix.extraFiles = {
+      "img/nvramcui" = {
+        type = "payload";
+        src = "${pkgs.coreboot-payload-nvramcui}/nvramcui.elf";
+      };
+    };
+  };
+}
diff --git a/infra/corenix/modules/seabios/default.nix b/infra/corenix/modules/seabios/default.nix
new file mode 100644
index 00000000000..711fc2c84f1
--- /dev/null
+++ b/infra/corenix/modules/seabios/default.nix
@@ -0,0 +1,61 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.seabios;
+  payloadName =
+    if cfg.asSecondaryPayload then "img/seabios" else "fallback/payload";
+
+in {
+  options.seabios = {
+    enable = mkEnableOption "seabios coreboot primary payload";
+
+    withVgaBios = mkOption {
+      type = types.bool;
+      default = true;
+    };
+
+    asSecondaryPayload = mkOption {
+      type = types.bool;
+      default = false;
+    };
+
+    ps2Timeout = mkOption {
+      type = types.int;
+      default = 0;
+    };
+
+    seabiosConfig = mkOption {
+      type = types.attrsOf (types.nullOr types.str);
+      default = { };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    seabios.seabiosConfig = {
+      CONFIG_COREBOOT = "y";
+    } // (lib.optionalAttrs cfg.withVgaBios {
+      CONFIG_VGA_COREBOOT = "y";
+      CONFIG_BUILD_VGABIOS = "y";
+    });
+
+    corenix.extraFiles = let
+      package =
+        pkgs.coreboot-payload-seabios.override { inherit (cfg) seabiosConfig; };
+    in {
+      ${payloadName} = {
+        type = "payload";
+        src = "${package}/bios.bin.elf";
+      };
+    } // (optionalAttrs cfg.withVgaBios {
+      "vgaroms/seavgabios.bin".src = "${package}/vgabios.bin";
+    });
+
+    corenix.installCommands = optionalString (cfg.ps2Timeout != 0) ''
+      cbfstool $out/coreboot.rom add-int \
+        -i ${toString cfg.ps2Timeout} \
+        -n etc/ps2-keyboard-spinup
+    '';
+  };
+}
diff --git a/infra/corenix/modules/tianocore/default.nix b/infra/corenix/modules/tianocore/default.nix
new file mode 100644
index 00000000000..59266c1aa05
--- /dev/null
+++ b/infra/corenix/modules/tianocore/default.nix
@@ -0,0 +1,28 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.tianocore;
+  payloadName =
+    if cfg.asSecondaryPayload then "img/tianocore" else "fallback/payload";
+
+in {
+  options.tianocore = {
+    enable = mkEnableOption "tianocore coreboot primary payload";
+
+    asSecondaryPayload = mkOption {
+      type = types.bool;
+      default = false;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    corenix.extraFiles = {
+      ${payloadName} = {
+        type = "payload";
+        src = "${pkgs.coreboot-payload-tianocore}/FV/UEFIPAYLOAD.fd";
+      };
+    };
+  };
+}
diff --git a/infra/corenix/modules/tint/default.nix b/infra/corenix/modules/tint/default.nix
new file mode 100644
index 00000000000..35f292be17f
--- /dev/null
+++ b/infra/corenix/modules/tint/default.nix
@@ -0,0 +1,17 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let cfg = config.tint;
+in {
+  options.tint = { enable = mkEnableOption "tint coreboot secondary payload"; };
+
+  config = lib.mkIf cfg.enable {
+    corenix.extraFiles = {
+      "img/tint" = {
+        type = "payload";
+        src = "${pkgs.coreboot-payload-tint}/tint.elf";
+      };
+    };
+  };
+}
diff --git a/infra/corenix/pkgs/coreboot-payload-coreinfo/default.nix b/infra/corenix/pkgs/coreboot-payload-coreinfo/default.nix
new file mode 100644
index 00000000000..0ecb41add1c
--- /dev/null
+++ b/infra/corenix/pkgs/coreboot-payload-coreinfo/default.nix
@@ -0,0 +1,15 @@
+{ coreboot, lib, stdenv, writeText, coreinfoConfig ? { } }:
+
+stdenv.mkDerivation rec {
+  pname = "coreboot-payload-coreinfo";
+  inherit (coreboot.drvAttrs) version src postPatch;
+
+  preConfigure = "cd payloads/coreinfo";
+  configurePhase = ''
+    runHook preConfigure
+    cp ${coreboot.writeConfig coreinfoConfig} .config
+    make olddefconfig
+    runHook postConfigure
+  '';
+  installPhase = "install -D build/coreinfo.elf -t $out";
+}
diff --git a/infra/corenix/pkgs/coreboot-payload-grub2/default.nix b/infra/corenix/pkgs/coreboot-payload-grub2/default.nix
new file mode 100644
index 00000000000..958872cd4cd
--- /dev/null
+++ b/infra/corenix/pkgs/coreboot-payload-grub2/default.nix
@@ -0,0 +1,12 @@
+{ grub2, lib, extraPayloadModules ? [ ] }:
+
+grub2.overrideAttrs (oA: {
+  pname = "coreboot-payload-${oA.pname}";
+  configureFlags = oA.configureFlags
+    ++ [ "--with-platform=coreboot" "--enable-boot-time" ];
+  postBuild = ''
+    make -j $NIX_BUILD_CORES default_payload.elf EXTRA_PAYLOAD_MODULES="${
+      lib.concatStringsSep " " extraPayloadModules
+    }"'';
+  installPhase = "install -D default_payload.elf -t $out";
+})
diff --git a/infra/corenix/pkgs/coreboot-payload-nvramcui/default.nix b/infra/corenix/pkgs/coreboot-payload-nvramcui/default.nix
new file mode 100644
index 00000000000..2c9ddb36286
--- /dev/null
+++ b/infra/corenix/pkgs/coreboot-payload-nvramcui/default.nix
@@ -0,0 +1,9 @@
+{ coreboot, stdenv }:
+
+stdenv.mkDerivation rec {
+  pname = "coreboot-payload-nvramcui";
+  inherit (coreboot.drvAttrs) version src postPatch;
+
+  preConfigure = "cd payloads/nvramcui";
+  installPhase = "install -D nvramcui.elf -t $out";
+}
diff --git a/infra/corenix/pkgs/coreboot-payload-seabios/default.nix b/infra/corenix/pkgs/coreboot-payload-seabios/default.nix
new file mode 100644
index 00000000000..72a104e1b04
--- /dev/null
+++ b/infra/corenix/pkgs/coreboot-payload-seabios/default.nix
@@ -0,0 +1,20 @@
+{ seabios, coreboot, stdenv, fetchurl, seabiosConfig ? {
+  CONFIG_COREBOOT = "y";
+  CONFIG_VGA_COREBOOT = "y";
+  CONFIG_BUILD_VGABIOS = "y";
+} }:
+
+seabios.overrideAttrs (oA: rec {
+  pname = "coreboot-payload-seabios";
+
+  configurePhase = ''
+    runHook preConfigure
+    cp ${coreboot.writeConfig seabiosConfig} .config
+    make olddefconfig
+    runHook postConfigure
+  '';
+  installPhase = ''
+    install -D out/bios.bin.elf -t $out
+    [ -f out/vgabios.bin ] && install -D out/vgabios.bin -t $out
+  '';
+})
diff --git a/infra/corenix/pkgs/coreboot-payload-tianocore/default.nix b/infra/corenix/pkgs/coreboot-payload-tianocore/default.nix
new file mode 100644
index 00000000000..5c3e5362462
--- /dev/null
+++ b/infra/corenix/pkgs/coreboot-payload-tianocore/default.nix
@@ -0,0 +1,78 @@
+{ fetchFromGitHub, python2, stdenv, libuuid, bc, utillinux, nasm, iasl, seabios
+}:
+
+# we can not override the source in edk2, so we had to copy the entire thing
+
+let
+  src = fetchFromGitHub {
+    owner = "MrChromebox";
+    repo = "edk2";
+    rev = "860a8d95c2ee89c9916d6e11230f246afa1cd629";
+    sha256 = "1bykw3lzfjl6idca37i736mwpqv60haczp7davhgqlmlb3nw6y3s";
+    fetchSubmodules = true;
+  };
+
+  version = "unstable";
+
+  pythonEnv = python2.withPackages (ps: [ ps.tkinter ]);
+
+  toolchain = stdenv.mkDerivation {
+    pname = "edk2-coreboot";
+
+    inherit version src;
+
+    buildInputs = [ libuuid pythonEnv ];
+
+    makeFlags = [ "-C BaseTools" ];
+
+    NIX_CFLAGS_COMPILE = "-Wno-return-type -Wno-error=stringop-truncation";
+
+    hardeningDisable = [ "format" "fortify" ];
+
+    installPhase = ''
+      mkdir -vp $out
+      mv -v BaseTools $out
+      mv -v edksetup.sh $out
+    '';
+
+    enableParallelBuilding = true;
+  };
+
+in stdenv.mkDerivation {
+  pname = "coreboot-payload-tianocore";
+  inherit version src;
+
+  buildInputs = [ bc pythonEnv utillinux nasm iasl ];
+
+  prePatch = ''
+    rm -rf BaseTools
+    ln -sv ${toolchain}/BaseTools BaseTools
+  '';
+
+  configurePhase = ''
+    runHook preConfigure
+    export WORKSPACE="$PWD"
+    . ${toolchain}/edksetup.sh BaseTools
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+    build -a X64 -a IA32 -b RELEASE -t GCC5 -p CorebootPayloadPkg/CorebootPayloadPkgIa32X64.dsc -n $NIX_BUILD_CORES -D CSM_ENABLE
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mv -v Build/*/* $out
+    runHook postInstall
+  '';
+
+  hardeningDisable = [ "format" "stackprotector" "pic" "fortify" ];
+
+  postPatch = ''
+    cp ${seabios}/Csm16.bin OvmfPkg/Csm/Csm16/Csm16.bin
+  '';
+
+  dontPatchELF = true;
+}
diff --git a/infra/corenix/pkgs/coreboot-payload-tint/default.nix b/infra/corenix/pkgs/coreboot-payload-tint/default.nix
new file mode 100644
index 00000000000..b953c773336
--- /dev/null
+++ b/infra/corenix/pkgs/coreboot-payload-tint/default.nix
@@ -0,0 +1,24 @@
+{ coreboot, stdenv, fetchurl }:
+
+# the original tint does not support building as a coreboot payload
+# the patches from the coreboot repo require building tint in-tree
+# this makes everything a bit more complicated here
+
+stdenv.mkDerivation rec {
+  pname = "coreboot-payload-tint";
+  version = "0.04+nmu1";
+  inherit (coreboot.drvAttrs) src postPatch;
+
+  preConfigure = "cd payloads/external/tint";
+  preBuild = ''
+    tar -xf ${
+      fetchurl {
+        url =
+          "https://mirror.fsf.org/trisquel/pool/main/t/tint/tint_${version}.tar.gz";
+        sha256 = "17gbga1lha9yp5hpyr5vn1sc93fx413cksxmpyl8zv3b5rjvzsy1";
+      }
+    }
+    mv tint{-${version},}
+  '';
+  installPhase = "install -D tint/tint.elf -t $out";
+}
diff --git a/infra/corenix/pkgs/coreboot/default.nix b/infra/corenix/pkgs/coreboot/default.nix
new file mode 100644
index 00000000000..cc0c2f39b20
--- /dev/null
+++ b/infra/corenix/pkgs/coreboot/default.nix
@@ -0,0 +1,62 @@
+{ fetchgit, fetchurl, stdenv, m4, flex, bison, zlib, gnat, curl, writeText
+, callPackage, lib, corebootConfig ? { CONFIG_PAYLOAD_NONE = "y"; } }:
+
+let
+  version = "4.12";
+  src = fetchgit {
+    url = "https://review.coreboot.org/coreboot.git";
+    rev = "${version}";
+    fetchSubmodules = true;
+    sha256 = "1l140zbvn6pkbrr55lymhi4lycimhpy8xgm45shl4zv6a9vjd66z";
+  };
+
+  toolchain = stdenv.mkDerivation rec {
+    pname = "coreboot-toolchain";
+    inherit version src;
+    nativeBuildInputs = [ curl stdenv m4 flex bison zlib gnat ];
+    buildPhase = ''
+      mkdir -p util/crossgcc/tarballs
+      ${lib.concatMapStringsSep "\n"
+      (file: "ln -s ${file.archive} util/crossgcc/tarballs/${file.name}")
+      (callPackage ./files.nix { })}
+      NIX_HARDENING_ENABLE="$\{NIX_HARDENING_ENABLE/ format/\}" make crossgcc-i386 CPUS=$NIX_BUILD_CORES
+    '';
+    installPhase = ''
+      cp -r util/crossgcc $out
+    '';
+  };
+
+  writeConfig = config:
+    let
+      filteredConfig = lib.filterAttrs (n: v: v != null) config;
+      lines =
+        lib.mapAttrsToList (name: value: "${name}=${value}") filteredConfig;
+      configFile = writeText "config" (lib.concatStringsSep "\n" lines);
+    in configFile;
+
+in stdenv.mkDerivation rec {
+
+  pname = "coreboot";
+  inherit version src;
+
+  postPatch = ''
+    rm -rf util/crossgcc
+    cp -r ${toolchain} util/crossgcc
+    chmod u+rwX -R util/crossgcc
+    patchShebangs util/xcompile/xcompile
+  '';
+
+  configurePhase = ''
+    runHook preConfigure
+    cp ${writeConfig corebootConfig} .config
+    make olddefconfig
+    runHook postConfigure
+  '';
+
+  installPhase = ''
+    mkdir -p $out
+    cp build/coreboot.rom $out
+  '';
+
+  passthru = { inherit toolchain writeConfig corebootConfig; };
+}
diff --git a/infra/corenix/pkgs/coreboot/files.nix b/infra/corenix/pkgs/coreboot/files.nix
new file mode 100644
index 00000000000..f5d71ec46b5
--- /dev/null
+++ b/infra/corenix/pkgs/coreboot/files.nix
@@ -0,0 +1,67 @@
+{ fetchurl }:
+
+# from util/crossgcc/buildgcc
+[
+  (rec {
+    version = "6.1.2";
+    name = "gmp-${version}.tar.xz";
+    archive = fetchurl {
+      sha256 = "04hrwahdxyqdik559604r7wrj9ffklwvipgfxgj4ys4skbl6bdc7";
+      url = "mirror://gnu/gmp/${name}";
+    };
+  })
+
+  (rec {
+    version = "4.0.2";
+    name = "mpfr-${version}.tar.xz";
+    archive = fetchurl {
+      sha256 = "12m3amcavhpqygc499s3fzqlb8f2j2rr7fkqsm10xbjfc04fffqx";
+      url = "mirror://gnu/mpfr/${name}";
+    };
+  })
+
+  (rec {
+    version = "1.1.0";
+    name = "mpc-${version}.tar.gz";
+    archive = fetchurl {
+      sha256 = "0biwnhjm3rx3hc0rfpvyniky4lpzsvdcwhmcn7f0h4iw2hwcb1b9";
+      url = "mirror://gnu/mpc/${name}";
+    };
+  })
+
+  (rec {
+    version = "8.3.0";
+    name = "gcc-${version}.tar.xz";
+    archive = fetchurl {
+      sha256 = "0b3xv411xhlnjmin2979nxcbnidgvzqdf4nbhix99x60dkzavfk4";
+      url = "mirror://gnu/gcc/${name}";
+    };
+  })
+
+  (rec {
+    version = "2.33.1";
+    name = "binutils-${version}.tar.xz";
+    archive = fetchurl {
+      sha256 = "1grcf8jaw3i0bk6f9xfzxw3qfgmn6fgkr108isdkbh1y3hnzqrmb";
+      url = "mirror://gnu/binutils/${name}";
+    };
+  })
+
+  (rec {
+    version = "20200110";
+    name = "acpica-unix2-${version}.tar.gz";
+    archive = fetchurl {
+      sha256 = "1hb4g6r7w8s4bhlkk36fmb4qxghnrwvad7f18cpn6zz0b4sjs7za";
+      url = "https://acpica.org/sites/acpica/files/${name}";
+    };
+  })
+
+  (rec {
+    version = "2.14.02";
+    name = "nasm-${version}.tar.bz2";
+    archive = fetchurl {
+      sha256 = "1g409sr1kj7v1089s9kv0i4azvddkcwcypnbakfryyi71b3jdz9l";
+      url = "https://www.nasm.us/pub/nasm/releasebuilds/${version}/${name}";
+    };
+  })
+]
diff --git a/infra/corenix/pkgs/overlay.nix b/infra/corenix/pkgs/overlay.nix
new file mode 100644
index 00000000000..f997739f2b7
--- /dev/null
+++ b/infra/corenix/pkgs/overlay.nix
@@ -0,0 +1,15 @@
+final: prev:
+let inherit (final) callPackage;
+in {
+  coreboot = callPackage ./coreboot { };
+
+  # primary payloads
+  coreboot-payload-grub2 = callPackage ./coreboot-payload-grub2 { };
+  coreboot-payload-tianocore = callPackage ./coreboot-payload-tianocore { };
+  coreboot-payload-seabios = callPackage ./coreboot-payload-seabios { };
+
+  # secondary payloads
+  coreboot-payload-nvramcui = callPackage ./coreboot-payload-nvramcui { };
+  coreboot-payload-tint = callPackage ./coreboot-payload-tint { };
+  coreboot-payload-coreinfo = callPackage ./coreboot-payload-coreinfo { };
+}