среда, 18 января 2017 г., 5:46:30 UTC+3 пользователь [email protected] написал: > On Tuesday, January 17, 2017 at 11:18:06 PM UTC+4, [email protected] wrote: > > вторник, 17 января 2017 г., 10:16:18 UTC-5 пользователь [email protected] > > написал: > > > On Saturday, January 14, 2017 at 3:26:04 PM UTC+4, [email protected] > > > wrote: > > > > 26 December 2016 г., 18:00:43 UTC-5 [email protected] написал: > > > > > Lenovo is a shitty company if you care about security, they have > > > > > stuck > > > > > irremovable rootkits their BIOS 4 separate times and they are > > > > > partially > > > > > owned by the PRC government > > > > > > > > Having a PRC backdoor is better than NSA one! (most laptop companies > > > > are American, so...) By the way, why not to get a Lenovo G505S laptop? > > > > 1) It is the latest AMD-based laptop which is supported by coreboot > > > > open source BIOS (so no closed source BIOS backdoors), and it does not > > > > have Intel ME backdoor. G505S's APUs are Richland - the last generation > > > > before AMD started to embed their own version of Intel ME, "AMD > > > > Security Processor" or PSP ( > > > > http://www.extremetech.com/wp-content/uploads/2013/11/AMDRoadmap-Mobility.png > > > > ) Although a closed source vga blob is still required for working > > > > graphics, luckily a coreboot's YABEL prevents the possible undocumented > > > > accesses of vga blob to other PCI devices > > > > 2) Supported by Qubes 3.2 - see HCL, > > > > https://groups.google.com/d/msg/qubes-users/TS1zfKZ7q8w/JQFkVF4xBgAJ . > > > > Most likely to be supported by Qubes 4.0 ( HVM=y, IOMMU=y, SLAT=y) and > > > > seems to meet its certification criteria so far - > > > > https://www.qubes-os.org/news/2016/07/21/new-hw-certification-for-q4/ > > > > <-- webcam could be covered, speakers and wireless card are not > > > > soldered and could be removed, and just checked the last concerning > > > > thing - embedded microphone is a PCI device, not USB connected ;) > > > > 3) High end version of G505S has a top of the Richland generation > > > > A10-5750M APU, 3352 score at Passmark cpu-benchmark. If to compare with > > > > i5-6200U of Lenovo T460s, 3933 score - 17% faster. But i5-6200U is dual > > > > core, while A10-5750M is quad core. Also, despite being three years > > > > older, A10-5750M integrated graphics is faster than of i5-6200U. > > > > According to Passmark: Intel HD 520 - 844 G3D score, AMD HD 8650G - 950 > > > > G3D score, 13% faster. > > > > 3) In contrast with many modern laptops, G505S has two slots for RAM > > > > (instead of one) and its RAM is not soldered. That means: when your RAM > > > > fails a memtest after some years, instead of paying a fortune for the > > > > RAM chips replacement you could just remove RAM and install a new one. > > > > Also you could easily upgrade to 16 GB RAM (2x8GB), which helps not to > > > > think of RAM usage while using Qubes (currently running 14 VMs at the > > > > same time, with a lot of applications started, and they eat just 13 GB > > > > out of 16 GB) > > > > 4) G505S has either integrated or both integrated and discrete graphics > > > > (depends on G505S version). In any case, it is AMD only - which has > > > > great open source drivers for Linux. No need for NVIDIA closed source > > > > proprietary drivers with telemetry... > > > > 5) Almost all the components could be replaced by user, even a CPU is > > > > not soldered. Easy to tear down a laptop and assemble it back. Thanks > > > > to open source BIOS, no WiFi card whitelist, so possible to install any > > > > wireless card which has open source drivers for Linux (such as AR9462) > > > > Currently it is almost impossible to buy a new G505S, but the used ones > > > > are selling for cheap (e.g. 3 auctions currently at eBay for G505S > > > > version with A10-5750M APU, 1 UK and 2 US-based, one of them with buy > > > > it now price $250 - half of the original $500) > > > > > > I have an old G505 kicking around somewhere, will give it a go with Qubes > > > 3.2 and then try Coreboot. Thanks for the reminder ! Wonder if this means > > > I can get the KDE Desktop Cube animation to work. > > > > Steve, do you have G505 or G505S ? This "S" letter is important: while > > Lenovo G505S is supported by coreboot, tested and works OK, - there is no > > information if G505 is supported. Luckily G505 and G505S hardware seems to > > be quite similar, but there are some differences which could result in that > > G505S coreboot build does not work for G505. Some additional coreboot > > coding could be required - or maybe not required, please read till the > > end... > > > > G505 and G505S have different motherboard model: G505S has either Compal > > LA-A091P (with discrete graphics) or LA-A092P (without discrete), while > > G505 has either LA-9911P (with discrete) or LA-9912P (without discrete). If > > you make the google requests like "motherboard-model pdf" you will find > > their datasheets > > > > There are similarities in these motherboards (the same hardware could be > > found in both of them, such as ENE KB9012 Embedded Controller) as well as > > differences: > > > > G505S has a fusion controller hub FCH A76M Bolton-M3, while G505 has FCH > > A70M Hudson-M3 . > > https://www.coreboot.org/pipermail/coreboot/2014-May/078000.html tells > > that A76M is upgraded A70M, means their FCH are different but probably not > > by much. Go to coreboot github mirror > > (https://github.com/coreboot/coreboot), at right upper corner you could > > search their repository and see - it mentions both Hudson and Bolton. Also, > > if you go to Kolibri forum thread mentioned in my HCL message here ( > > https://groups.google.com/d/msg/qubes-users/TS1zfKZ7q8w/JQFkVF4xBgAJ ), > > download coreboot.zip with G505S config, you could see - despite G505S has > > Bolton, that config mentions CONFIG_SOUTHBRIDGE_AMD_AGESA_HUDSON=y and no > > mention of Bolton, which could mean that this build is compatible with both > > Hudson and Bolton (but needs to be tested!) > > > > Physical differences: G505 has a more convenient board shape, but it has a > > soldered CPU (which sucks a bit - couldnt upgrade or replace, and results > > in more expensive replacement motherboards), while G505S CPU is socketed > > CPU ; also, in case of motherboards with discrete graphics, G505S has a > > better heatsink - two heatpipes (one heatpipe is shared between CPU and > > discrete GPU, but GPU rarely gets hot if you dont play games, means two > > heatpipes for CPU), while Lenovo was greedy while making G505 and there is > > only one heatpipe which is shared between CPU and discrete graphics - > > higher temperatures, must use good thermal paste! > > > > It will be interesting if you could test my coreboot build - will be great > > if it works not just on Lenovo G505S but on G505 as well ;) > > I dug out the laptop and its a G505S , I would like to install a Coreboot > (haven't done this before), do you have a link, thx
First of all we need to make sure that you are prepared for flashing. coreboot image cannot be flashed internally on Lenovo G505S through a purely software way (I tried with internal:laptop=force_I_want_a_brick flashrom option, it always fails, cant do that!) . To install a coreboot, you will have to: 1) get some hardware tools like screwdrivers, CH341A USB flasher and SOIC-8 test clip 2) tear down your laptop to access the motherboard 3) take SOIC-8 test clip and attach its wires to USB flasher that is supported by flashrom (such as CH341A), then attach SOIC-8 test clip to BIOS chip with 8 legs, then plug USB flasher device to another computer with Linux (while it is still connected to G505S motherboard through wires and SOIC-8 test clip) 4) using flashrom, make a dump of your existing BIOS just in case, then flash a new coreboot image with verification 5) assemble your laptop in reverse order . That is exactly how computer repair shops are repairing laptops with failed BIOS updates, and are earning pretty good money on it Here is a hardware flashing manual - http://dangerousprototypes.com/docs/Flashing_a_BIOS_chip_with_Bus_Pirate . Everything is described in a great detail here: complete list of tools and where you could buy them (need to spend from $0 to $30, depends on what tools you already have), how to connect these tools properly, a lot of helpful photos - for example, photo of G505S motherboard, so you could easily see where is that BIOS chip with 8 legs is located, dont need to spend time reading the motherboard chip labels. While this instruction mentions Bus Pirate USB flasher, the instructions for CH341A USB flasher are exactly the same - only a flashrom command is different (could see this command at the end of page) My current coreboot build is from December 2016 - it is not the latest, but still pretty recent, so I am not going to rebuild it from scratch yet. Still, there is one component inside BIOS image that could be easily updated: KolibriOS, tiny wonderful open source operating system that fits on a floppy. It could be launched from SeaBIOS Boot Menu, and works as a RamDisk (no changes to your computer saved). After you tell that you are prepared for hardware BIOS flashing, I will take KolibriOS latest daily build, add it to ROM and send a complete coreboot BIOS ROM to you Please reply if you have any questions Best regards, qmastery -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/64027757-52c0-4d10-93df-b16c3569bf85%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
