Insyde H2O UEFI · Dual SPI Flash
# Lenovo IdeaPad P400 Touch
Firmware personalizado mediante ingeniería inversa. Parcheo binario directo en chips SPI U5/U6 para eliminar restricciones OEM, optimizar el suministro de energía y maximizar el rendimiento de la iGPU.
# Hardware
- CPU
- Intel Core i7-3632QM (Ivy Bridge, 35W TDP)
- GPU
- Intel HD 4000 (GT2, max 1150 MHz)
- RAM
- 12GB DDR3 Dual Channel
- Firmware
- Insyde H2O UEFI
- SPI Flash
- 2 chips separados (U5 + U6), ambos SOIC-8
#Arquitectura del Firmware
U5 — Chip Principal
4MB (0x400000) · Insyde Freeform + Custom DXE
Filesystem GUID
7A9354D9-0468-444A-81CE-0BF617D890DFFreeform files FFSv2 (0 diffs vs original)
9415B75C-E1B8-4E2A-988D-DD399B9A985EC3C89EA3-58A6-43ED-B685-0ED535B2E36F4CD76A24-C25B-4E60-9B4F-25E96B9EBFF6U6 — Almacén NVRAM
2MB (0x200000) · NVRAM + Microcodes + VSS Variables
Key variable @ 0x111AAD
Setup / A04A27F4-DF00-4D42-B552-39511302113D (size: 0x3CC bytes)#Modificaciones en U5
(Non-empty Padding @ 0x193000)| # | Variable | Original | Custom | Propósito / Descripción | |
|---|---|---|---|---|---|
| 1 | PCI Whitelist WLAN | 0x1E | → | 0x00 | Bypasses Error 1802. Disables WiFi Vendor/Device ID check. |
| 2 | PCI Whitelist WWAN | 0x01 | → | 0x00 | Unlocks M.2 slot for unapproved 3G/4G LTE modems. |
| 3 | BIOS Password Reset | Disabled | → | Enabled | Exposes hidden setup option to clear supervisor password. |
#Modificaciones en U6
(NVRAM Setup Variables)
All variables reside in
VarStore: Setup
(GUID:
A04A27F4-DF00-4D42-B552-39511302113D).
Offsets mapped via IFRExtract from the SetupUtility module.
Note: A duplicate Custom variable exists
@ 0x1116F/0x11167F with the same GUID, but Setup @ 0x111AAD is targeted.
| # | Variable | Original | Custom | Purpose / Description | |
|---|---|---|---|---|---|
| 4 | DVMT Pre-Allocated | 64MB | → | 512MB | Eliminates i915 driver ring buffer timeouts and graphic artifacts. |
| 5 | Aperture Size | 256MB | → | 512MB | Expands PCI aperture for heavy OpenGL / Vulkan workloads. |
| 6 | RC6 Render Standby | Enabled | → | Disabled | Forces iGPU active. Fixes random desktop freezes during GPU state transitions. |
| 7 | Deep RC6 | Enabled | → | Disabled | Disables deepest C-state power gating on the iGPU. |
| 8 | Gfx Low Power | Enabled | → | Disabled | Prevents GPU clock down-stepping during high-priority frame rendering. |
| 9 | Turbo PWR MSR Lock | Locked | → | Unlocked | Unlocks MSR 0x610. Enables live runtime TDP tuning from the OS. |
| 10 | PL1 Long Duration | 35W | → | 45W | Sustained power budget. Prevents throttling under continuous workloads. |
| 11 | PL2 Short Duration | 44W | → | 60W | Short-burst power budget (28s). Instant boost for app launches. |
| 12 | GPU Current Limit | Auto | → | 5A | Current limit to iGPU. 5A maintains rock-solid 1150 MHz boost. |
| 13 | Boot Display (Hybrid) | LFP | → | CRT+LFP | Outputs POST/BIOS to both external display (VGA) and internal panel (Offset 0x198: 0x10 → 0x02). |
#Resumen
| # | Variable | Original | Custom | Chip |
|---|---|---|---|---|
| 1 | Whitelist WLAN | 0x1E | 0x00 | U5 |
| 2 | Whitelist WWAN | 0x01 | 0x00 | U5 |
| 3 | Password Reset | Disabled | Enabled | U5 |
| 4 | DVMT Pre-Allocated | 64MB | 512MB | U6 |
| 5 | Aperture Size | 256MB | 512MB | U6 |
| 6 | RC6 Render Standby | ON | OFF | U6 |
| 7 | Deep RC6 | ON | OFF | U6 |
| 8 | Gfx Low Power | ON | OFF | U6 |
| 9 | Turbo PWR MSR Lock | Locked | Unlocked | U6 |
| 10 | PL1 | 35W | 45W | U6 |
| 11 | PL2 | 44W | 60W | U6 |
| 12 | GPU Current Limit | Auto | 5A | U6 |
| 13 | Boot Display Device | LFP | CRT+LFP | U6 |
Total: 10 bytes modificados en NVRAM (U6) + 3 parches en módulo DXE (U5)
#Verificación Post-Flasheo
#Binarios del Firmware
#Herramientas
UEFITool — firmware module analysis & extraction · UEFIPatch — applying patches to DXE modules · IFRExtract — extracting IFR forms from SetupUtility · CH341A + SOIC-8 clip — SPI programmer · Hex editor — direct binary editing of the VSS store