Lenovo G505S hacking

From DP

Jump to: navigation , search

Contents

Introduction

Lenovo G505S is the latest most powerful laptop from the Supported Motherboards list of coreboot open source BIOS ( FAQ about coreboot ) which does not contain the Intel ME / AMD PSP hardware backdoors inside its' CPU. That makes this laptop very unique and valuable to any hardware/software hacker, and hopefully this page could be of a great interest - and maybe even useful! - to you, the visitor of DangerousPrototypes

Current status

The software of this laptop is already 98% open source and free-as-in-freedom ; this page will describe the hacking efforts to liberate the remaining 2% as well as to make this laptop truly future-proof by collecting the described spare parts and upgrading its' various components

Future plans

1) Fill this page with a lot of truly valuable information (a bit unexpected? ;)

2) Create a new "Lenovo G505S spare parts" page ( maybe would come up with a better title )

3) Describe the great-to-have software patches on top of the mainline code of coreboot open-source BIOS ( hopefully we'll get our changes merged and these descriptions would not be needed )

...

Under construction

This page is currently under construction and may be significantly changed without further notice ;)

awokd's info dump:

Coreboot G505s page

Caveats: Sleep mode does not work under Qubes. Good to disable both XHCI options in Coreboot menu or the left side ports won't work at all. Disabled they sort of function as USB 2.0 (or 1.1?) ports, but you may have to use irqpoll (on sys-usb kernel options if using Qubes).

Patch to update CPU microcode blob to version 0x06001119 (required for Qubes 4). 1) I got it by executing the following on a Debian Stretch install: dd skip=5284 iflag=skip_bytes if=/lib/firmware/amd-ucode/microcode_amd_fam15h.bin of=amd.bin xxd -i amd.bin Then copying and pasting. Executing these steps against coreboot/3rdparty/blobs/cpu/amd/family_15h/microcode_amd_fam15h.bin provides identical results. 2) It's internally dated July 13, 2012.

and

src/vendorcode/amd/agesa/f15tn/Proc/CPU/Family/0x15/TN/F15TnEquivalenceTable.c from:

STATIC CONST UINT16 ROMDATA CpuF15TnMicrocodeEquivalenceTable[] = {

 0x6101, 0x6101,
 0x6100, 0x6100

};

// Unencrypted equivalent STATIC CONST UINT16 ROMDATA CpuF15TnUnEncryptedMicrocodeEquivalenceTable[] = {

 0x6101, 0x6901,
 0x6100, 0x6900

};

TO:

STATIC CONST UINT16 ROMDATA CpuF15TnMicrocodeEquivalenceTable[] = {

 0x6131, 0x6101,
 0x6101, 0x6101,
 0x6100, 0x6100

};

// Unencrypted equivalent STATIC CONST UINT16 ROMDATA CpuF15TnUnEncryptedMicrocodeEquivalenceTable[] = {

 0x6131, 0x6901,
 0x6101, 0x6901,
 0x6100, 0x6900

};

Clean blobs.

Flashing KB9012.

After flashing with coreboot, you can use the following command for internal flashes:

flashrom -p internal:laptop=force_I_want_a_brick,amd_imc_force=yes -w cb112017.rom

A10-5750M processor is cpu fam 21/0x15, mod 19/0x13, step 1 raw 00610f31

If your model has a secondary GPU, need to add xen-pciback.hide=(02:00.0) to boot options (02:00.0 is an example, check first) to use with Qubes.

To locate the firmware in the OEM image, use UEFITool and search for your BIOS version in reverse byte order, like for version 0x06001119, search for 0x19110006.