New Lenovo laptops: X1 (4th Gen), T460/p, and T560

[Andrew David Wong]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Has anyone had a chance to test (or is in a position to test) Qubes
compatibility with any of the new higher-end Lenovo laptops, such as
the X1 Carbon (4th Gen), the T460/p, or the T560?

The only information I'm aware of so far is Linus' (very helpful)
thread about the T460s:
https://groups.google.com/d/topic/qubes-users/-xXKdAkIjxU/discussion

- --
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCgAGBQJXJFsCAAoJENtN07w5UDAwE3oQAII3XlO37ZKDrp1fIItG14ds
0e/W6vsJpxgPABH+w5thxpvyNhwWaxuAtVE4QknE8WcgeyixkP6C0wnoxlZreRj9
oG2e3LLoy7b4oMLr4emeQ/GOKJrajr6HFRkosEhEg4M6s9MrWKmQNronzIVoeSVW
RibT9CntK5lRzcBZio9T/VR9bARjIJ1PDpI6RPdqwUkBKqBsvm5HjL8FFGSIx5hU
PHLKPElxlUq8+4w1PJ+Pw3oDdDUIMwa7ax7kRED2AhXAUg0pgw9j/ynkgWf2blKV
flnkDHfu2ASORS5AojteugFO/CjjZeUZPvq01ghLD9AxwWCOIaWt8XRP+nFiDxl5
VUs0Jqe+JVsGxqo+vI7U56UqP2QyJTFs/S9igx95d9GVN15xHb4bAA1bDBqGrysk
Tab9webV7BOQuSM3AnH/t/4G4m71gA15AQMTtH2aIImK2N8HFQYKsAQufpEj0/5E
Dy/2+sYJ4/L3TII9JueXHyUlWdWE3ujNfe5OHo+JRT9q6IeJERsxTU+KZIzt3H9Z
IhWS5W17eBcVfAn2hKknUPoploHNOCdsPcwclh1NNSJzRT1Ig5toUbJKJqOUgfTr
xzUjaIVqy7Bd/ZFKVkg+LGj/WGhMQQl5OvF/ZiwJ/epKKVr4filh22x5FcAJ6MYx
qb41Yl51YuswBuEDikP2
=mC+z
-----END PGP SIGNATURE-----

[Holger Levsen]

On Sat, Apr 30, 2016 at 12:13:13AM -0700, Andrew David Wong wrote:
> Has anyone had a chance to test (or is in a position to test) Qubes
> compatibility with any of the new higher-end Lenovo laptops, such as
> the X1 Carbon (4th Gen), the T460/p, or the T560?

they need kernels with proper skylake support, so 4.5 at least, probably
better 4.6 or 4.7. Not sure whether this also needs newer X. With kernel
4.1.13 from qubes, the graphics are completly broken after suspend and
the power consumption is at least double of what it should be (=less
than half of the battery time than under 4.5).

According to http://mjg59.dreamwidth.org/41713.html running this
hardware with such an old kernel might actually harm the CPU physically.


--
cheers,
Holger

[Achim Patzner]

On 04/30/2016 09:49 AM, Holger Levsen wrote:


> they need kernels with proper skylake support, so 4.5 at least, probably
> better 4.6 or 4.7. Not sure whether this also needs newer X.

My Lenovo P70 (Xeon-bases) is not really able to run on battery power
(lasting 45 minutes at most, not even running at full CPU speed) and the
current X is having problems on EFI frame buffer (not getting access to
the lower 60 lines) and on the Intel driver. So yes, much more recent
sources should be used.

> With kernel
> 4.1.13 from qubes

I'm already running the 4.2.8 package from the repository.


Achim

[Olivier Médoc]

On 04/30/2016 09:49 AM, Holger Levsen wrote:

I can confirm that a Qubes 3.2 can boot on a Lenovo T560, however it
requires the kernel4.8 present in the qubes-dom0-unstable repository.

Without this kernel, the installer, or an already installed system will
reboot.

It is however possible to install the system on an external disk and
update the kernel from the unstable repository. The hard drive with the
updated system will then properly boot if used on the Lenovo T560.

[Olivier Médoc]

On 04/30/2016 09:13 AM, Andrew David Wong wrote:
> Has anyone had a chance to test (or is in a position to test) Qubes
> compatibility with any of the new higher-end Lenovo laptops, such as
> the X1 Carbon (4th Gen), the T460/p, or the T560?
>
> The only information I'm aware of so far is Linus' (very helpful)
> thread about the T460s:
> https://groups.google.com/d/topic/qubes-users/-xXKdAkIjxU/discussion
>

Qubes R3.2 works on Lenovo Thinkpad T560, however the installer is not
working properly as it does not use at least kernel 4.5.

In order to install it, I had :

1/ to extract the T560 laptop SSD, install Qubes using a different
supported laptop, and pluging the extracted SSD as an external hard drive.

2/ Then, the kernel must be upgraded to unstable (kernel 4.8), still on
the supported laptop by enabling qubes-dom0-unstable.

3/ Finally, shutdown the laptop, reinstall the SSD inside the Lenovo
T560, and it should work straightaway.

It seems to work properly, I have not tested thoroughly all features.

Maybe, Qubes installer bootloader could support both stable and unstable
kernels, in order to support new hardware ?

Regards,
Olivier Médoc

[Tai...@gmx.com]

Lenovo is a shitty company if you care about security, they have stuck
irremovable rootkits their BIOS 4 separate times and they are partially
owned by the PRC government.
Not to mention how they've ruined the thinkpad line and made it just
another consumer level laptop.

I wouldn't buy from them.

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Mon, Dec 26, 2016 at 08:29:55PM +0100, 'Olivier Médoc' via qubes-users wrote:
> Maybe, Qubes installer bootloader could support both stable and unstable
> kernels, in order to support new hardware ?

I'd wait for the next longterm support kernel, then maybe release
updated installation disk with it.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJYYaPoAAoJENuP0xzK19csvZMH/R16udTk/sYcGotx1OK+GOHt
y1mmDYBkTHJ3Moapd/AAoBuSlZolz9FuYst5XwPx5paWgVj9vFeuvfd+ZmHozUin
xnwD47XAh56AEycdbm4BK54NtOPZ9xohK018R/29s/RhAvZsWiMCu4a1k6FXbP4X
iArEfOGraZmJ95MF23VM2jnaPORaNXkMhUhydDYsS44lku4SefddpxCsIIbK6H7R
YXCibjXF8BgZmyZFK0IZUxJjpeNpKorD2uDd1j5hIM3zAnKUUZHRIQ4OiWUBIL7y
WPNYMRRnssnb3gycCw3bWXQD91pQjyX8YpOmRylhRKbVHUv3nPSCvxpPzH2zJJA=
=Jw8Z
-----END PGP SIGNATURE-----

[Olivier Médoc]

On 12/27/2016 12:12 AM, Marek Marczykowski-Górecki wrote:
> On Mon, Dec 26, 2016 at 08:29:55PM +0100, 'Olivier Médoc' via
> qubes-users wrote:
> > Maybe, Qubes installer bootloader could support both stable and unstable
> > kernels, in order to support new hardware ?
>
> I'd wait for the next longterm support kernel, then maybe release
> updated installation disk with it.
>

Hello,

That would be perfect. For now I can at least install it on older hardware.

Thanks.

[sbor...@gmail.com]

I somehow overlooked this discussion before ordering a new laptop; thus,
I am stuck with a Lenovo T560 which reboots immediately/endlessly when
trying to install.

Thus, is there a (documented) way to add a newer kernel to the 3.2 install image? I'd rather avoid taking the SSD out and install qubes in my older
machine.

Thanks in advance,

Stefan

[Curiously, I could install debian jessie with a 3.16 kernel (obviously no Xen!) without problems and aside from wireless networking everythings seems to work out of the box]

[Ángel]

sbor...@gmail.com wrote:
> Thus, is there a (documented) way to add a newer kernel to the 3.2 install image? I'd rather avoid taking the SSD out and install qubes in my older
> machine.
>
> Thanks in advance,
>
> Stefan

For booting the install or for being installed?

I expect that changing the kernel being used during the install should
be as simple as replacing the isolinux/vmlinuz* / EFI/BOOT/vmlinuz plus
initrd in the install media.

Changing the kernel that is getting installed may be harder, although it
can surely be inserted into Packages/ but anyway you could drop the
right file into the boot partition just until you get to install it
correctly.

Make sure you only replace them with a trusted binary, though.

[justin.h...@gmail.com]

On Saturday, April 30, 2016 at 12:13:18 AM UTC-7, Andrew David Wong wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Has anyone had a chance to test (or is in a position to test) Qubes
> compatibility with any of the new higher-end Lenovo laptops, such as
> the X1 Carbon (4th Gen), the T460/p, or the T560?

I've been using 3.2 on a (hidpi) T460p for a couple of months now and it works great. Here are some quick bullet points:

* Intel graphics only. There's an NVidia card in there as well, but it's unused in Qubes.
* Wifi works flawlessly.
* Integrated webcam works great with USB passthrough.
* No installer issues at all--everything just worked.
* Sleep/resume functionality isn't perfect, but it works about 80+% of the time. Better than Ubuntu 16.10, FWIW.

[qmast...@gmail.com]

26 December 2016 г., 18:00:43 UTC-5 Tai...@gmx.com написал:

> Lenovo is a shitty company if you care about security, they have stuck
> irremovable rootkits their BIOS 4 separate times and they are partially
> owned by the PRC government

Having a PRC backdoor is better than NSA one! (most laptop companies are American, so...) By the way, why not to get a Lenovo G505S laptop?
1) It is the latest AMD-based laptop which is supported by coreboot open source BIOS (so no closed source BIOS backdoors), and it does not have Intel ME backdoor. G505S's APUs are Richland - the last generation before AMD started to embed their own version of Intel ME, "AMD Security Processor" or PSP ( http://www.extremetech.com/wp-content/uploads/2013/11/AMDRoadmap-Mobility.png ) Although a closed source vga blob is still required for working graphics, luckily a coreboot's YABEL prevents the possible undocumented accesses of vga blob to other PCI devices
2) Supported by Qubes 3.2 - see HCL, https://groups.google.com/d/msg/qubes-users/TS1zfKZ7q8w/JQFkVF4xBgAJ . Most likely to be supported by Qubes 4.0 ( HVM=y, IOMMU=y, SLAT=y) and seems to meet its certification criteria so far - https://www.qubes-os.org/news/2016/07/21/new-hw-certification-for-q4/ <-- webcam could be covered, speakers and wireless card are not soldered and could be removed, and just checked the last concerning thing - embedded microphone is a PCI device, not USB connected ;)
3) High end version of G505S has a top of the Richland generation A10-5750M APU, 3352 score at Passmark cpu-benchmark. If to compare with i5-6200U of Lenovo T460s, 3933 score - 17% faster. But i5-6200U is dual core, while A10-5750M is quad core. Also, despite being three years older, A10-5750M integrated graphics is faster than of i5-6200U. According to Passmark: Intel HD 520 - 844 G3D score, AMD HD 8650G - 950 G3D score, 13% faster.
3) In contrast with many modern laptops, G505S has two slots for RAM (instead of one) and its RAM is not soldered. That means: when your RAM fails a memtest after some years, instead of paying a fortune for the RAM chips replacement you could just remove RAM and install a new one. Also you could easily upgrade to 16 GB RAM (2x8GB), which helps not to think of RAM usage while using Qubes (currently running 14 VMs at the same time, with a lot of applications started, and they eat just 13 GB out of 16 GB)
4) G505S has either integrated or both integrated and discrete graphics (depends on G505S version). In any case, it is AMD only - which has great open source drivers for Linux. No need for NVIDIA closed source proprietary drivers with telemetry...
5) Almost all the components could be replaced by user, even a CPU is not soldered. Easy to tear down a laptop and assemble it back. Thanks to open source BIOS, no WiFi card whitelist, so possible to install any wireless card which has open source drivers for Linux (such as AR9462)
Currently it is almost impossible to buy a new G505S, but the used ones are selling for cheap (e.g. 3 auctions currently at eBay for G505S version with A10-5750M APU, 1 UK and 2 US-based, one of them with buy it now price $250 - half of the original $500)

[sbor...@gmail.com]

Hi,

delayed thanks for your feedback. I guess this should work, and one could
probably replace the kernel rpms (to be installed) with the newer ones, but the hurdle for me was to get a valid iso image back to the usb stick .. [I assume this is simple, provided one knows how to ..]

Anyways, time for the screwdriver .. and I can confirm that installing
vanilla qubes 3.2 on a supported laptop and upgrading the kernel to 4.8.x (from
the unstable repo) resulted in a (mostly) working system.

The first boot in the target hardware led to several failures of service VMs not
starting, as the wrong PCI devices had been passed through to them. Fortunately, some qvm-pci commands and a reboot later, this was resolved.

At present, I have working graphics, Ethernet and WIFI. Sound is
working as well. After waking up from
sleep, the network is gone, but I am optimistic that this can be sorted out.
(Had this problem in the past ..)

I will report for the HCL when this is really up and running.

For future reference, it would be great though if there were a howto for making
an updated install usb / image ...

Thanks,

Stefan

[steve....@gmail.com]

I have an old G505 kicking around somewhere, will give it a go with Qubes 3.2 and then try Coreboot. Thanks for the reminder ! Wonder if this means I can get the KDE Desktop Cube animation to work.

[qmast...@gmail.com]

вторник, 17 января 2017 г., 10:16:18 UTC-5 пользователь steve....@gmail.com написал:

Steve, do you have G505 or G505S ? This "S" letter is important: while Lenovo G505S is supported by coreboot, tested and works OK, - there is no information if G505 is supported. Luckily G505 and G505S hardware seems to be quite similar, but there are some differences which could result in that G505S coreboot build does not work for G505. Some additional coreboot coding could be required - or maybe not required, please read till the end...

G505 and G505S have different motherboard model: G505S has either Compal LA-A091P (with discrete graphics) or LA-A092P (without discrete), while G505 has either LA-9911P (with discrete) or LA-9912P (without discrete). If you make the google requests like "motherboard-model pdf" you will find their datasheets

There are similarities in these motherboards (the same hardware could be found in both of them, such as ENE KB9012 Embedded Controller) as well as differences:

G505S has a fusion controller hub FCH A76M Bolton-M3, while G505 has FCH A70M Hudson-M3 . https://www.coreboot.org/pipermail/coreboot/2014-May/078000.html tells that A76M is upgraded A70M, means their FCH are different but probably not by much. Go to coreboot github mirror (https://github.com/coreboot/coreboot), at right upper corner you could search their repository and see - it mentions both Hudson and Bolton. Also, if you go to Kolibri forum thread mentioned in my HCL message here ( https://groups.google.com/d/msg/qubes-users/TS1zfKZ7q8w/JQFkVF4xBgAJ ), download coreboot.zip with G505S config, you could see - despite G505S has Bolton, that config mentions CONFIG_SOUTHBRIDGE_AMD_AGESA_HUDSON=y and no mention of Bolton, which could mean that this build is compatible with both Hudson and Bolton (but needs to be tested!)

Physical differences: G505 has a more convenient board shape, but it has a soldered CPU (which sucks a bit - couldnt upgrade or replace, and results in more expensive replacement motherboards), while G505S CPU is socketed CPU ; also, in case of motherboards with discrete graphics, G505S has a better heatsink - two heatpipes (one heatpipe is shared between CPU and discrete GPU, but GPU rarely gets hot if you dont play games, means two heatpipes for CPU), while Lenovo was greedy while making G505 and there is only one heatpipe which is shared between CPU and discrete graphics - higher temperatures, must use good thermal paste!

It will be interesting if you could test my coreboot build - will be great if it works not just on Lenovo G505S but on G505 as well ;)

[steve....@gmail.com]

I dug out the laptop and its a G505S , I would like to install a Coreboot (haven't done this before), do you have a link, thx

[qmast...@gmail.com]

среда, 18 января 2017 г., 5:46:30 UTC+3 пользователь steve....@gmail.com написал:

First of all we need to make sure that you are prepared for flashing. coreboot image cannot be flashed internally on Lenovo G505S through a purely software way (I tried with internal:laptop=force_I_want_a_brick flashrom option, it always fails, cant do that!) . To install a coreboot, you will have to: 1) get some hardware tools like screwdrivers, CH341A USB flasher and SOIC-8 test clip 2) tear down your laptop to access the motherboard 3) take SOIC-8 test clip and attach its wires to USB flasher that is supported by flashrom (such as CH341A), then attach SOIC-8 test clip to BIOS chip with 8 legs, then plug USB flasher device to another computer with Linux (while it is still connected to G505S motherboard through wires and SOIC-8 test clip) 4) using flashrom, make a dump of your existing BIOS just in case, then flash a new coreboot image with verification 5) assemble your laptop in reverse order . That is exactly how computer repair shops are repairing laptops with failed BIOS updates, and are earning pretty good money on it

Here is a hardware flashing manual - http://dangerousprototypes.com/docs/Flashing_a_BIOS_chip_with_Bus_Pirate . Everything is described in a great detail here: complete list of tools and where you could buy them (need to spend from $0 to $30, depends on what tools you already have), how to connect these tools properly, a lot of helpful photos - for example, photo of G505S motherboard, so you could easily see where is that BIOS chip with 8 legs is located, dont need to spend time reading the motherboard chip labels. While this instruction mentions Bus Pirate USB flasher, the instructions for CH341A USB flasher are exactly the same - only a flashrom command is different (could see this command at the end of page)

My current coreboot build is from December 2016 - it is not the latest, but still pretty recent, so I am not going to rebuild it from scratch yet. Still, there is one component inside BIOS image that could be easily updated: KolibriOS, tiny wonderful open source operating system that fits on a floppy. It could be launched from SeaBIOS Boot Menu, and works as a RamDisk (no changes to your computer saved). After you tell that you are prepared for hardware BIOS flashing, I will take KolibriOS latest daily build, add it to ROM and send a complete coreboot BIOS ROM to you

Please reply if you have any questions

Best regards,
qmastery

[Asterysk]

Hi, I've started a new Post specifically for this, I think we will have a few more exchanges and I thought best if its in a thread by itself. I'm also switching to my Google Groups email account. have asked a question on the new thread.

[qmast...@gmail.com]

среда, 18 января 2017 г., 14:39:47 UTC+3 пользователь Asterysk написал:

Okay, our G505S/QubesOS/Coreboot discussion will continue at this new thread. Here is a direct link - https://groups.google.com/d/msg/qubes-users/WEppbuqRpfY/mOoARrZ6CQAJ . BTW someone bought one G505S with A10 CPU, now only two G505S with A10 CPU versions left (one from USA, another from UK) - could type "g505s a10" in ebay search field to find them. Problem that these lazy sellers don't write the full technical specs, e.g. don't know if they have a discrete GPU (discrete GPU models have a second heatpipe which helps to cool CPU as well) Additional questions need to be asked by those who care... P.S. Although it is possible to get G505S with A8 and upgrade it to A10 CPU later, it is a waste of money

[guneet...@gmail.com]

This happens probably because of the more powerful chips used in the P70. 8 cores. Now to fix this issue either you can check lenovo p70 manual- https://guideusermanual.com/product-name-p70-a-smartphone-manual&po=331753&lang=English or follow these steps:
he battery pack cannot be fully charged by the power-off method in the standard charge time for your compute
Solution: The battery pack might be over-discharged. Do the following:

- Turn off the device.
- Make sure that the over-discharged battery pack is in the device.
- Connect the AC adapter to the device and let it charge.
- If the optional Quick Charger is available, use it to charge the over-discharged battery pack.
- If the battery pack cannot be fully charged in 24 hours, use a new battery pack.