> not sure what you are looking for, but I guess this is what you need,

> (microcode updates are publicly available and gfx init is
> open source)

I'd like to have system updated against spectre, and other possible vulnerabilities as much as possible.
If lenovo (or any other vendor) releases updates, which in this case address spectre vulnerability,
then I'd need to get binary blobs from this update, compare them against previous BIOS version blobs
 and in case they differ, bundle them into coreboot BIOS, then save coreboot onto x220. The extra step I do is intel ME neutralization.

That's why I (believe I) need the blobs from the newest update. Is the reasoning correct, or I could do it more wise?
blobs I've initially taken are:
flashregion_0_flashdescriptor.bin
flashregion_2_intel_me.bin
flashregion_3_gbe.bin

but:
1. If I neutralize me.bin, then maybe updating it does not make sense?
    Otherwise, maybe I could use MEanalyzer + its database to get newest ME, then neutralize it?
2. as I know spectre fixes reside in CPU microcodes. If so, then maybe coreboot can be compiled with
   newest CPU microcode for given CPUID (I've found one on CPUmicrocodes @ github). Or maybe the only
   place where fixes are possible to appear is CPU microcode?
3. flashdescriptor.bin - can it contain vulnerabilities? If yes, where to get it from?
4. gbe.bin - the same questions here.