





I unlocked the hidden AMD CBS overclocking controls on a Lenovo IdeaPad Gaming 3 — RAM timings, FCLK/UCLK, SoC VID, C-states, PPT and more
I’ve been reverse-engineering the InsydeH2O firmware of a Lenovo IdeaPad Gaming 3 15ARH05 with a Ryzen 7 4800H.
What started as a failed attempt to reveal the Advanced BIOS using Fn+R+N turned into a complete firmware-research project.
I extracted Lenovo’s official BIOS update, recovered the 16 MiB ROM, parsed the AMD PSP directory, reconstructed the firmware IFR and identified the hidden form-set visibility mechanism inside H2OFormBrowserDxe.
The latest result: I have now successfully exposed the hidden Advanced, AMD PBS and AMD CBS menus on the physical laptop using a runtime SREP patch—without flashing a modified BIOS.
The amount of tuning hidden by Lenovo is much larger than I expected.
Memory overclocking
The exposed AMD CBS pages include:
- Memory Clock Speed from
667 MHzto1800 MHz - Primary timings such as
Tcl,Trcdrd,Trcdwr,TrpandTras - Additional secondary and tertiary timing fields
AddrCmdSetup,CsOdtSetupandCkeSetup- CAD bus drive strengths from
120to20 ohms RttNom,RttWrandRttParkRZQ/1throughRZQ/7termination ratios- UCLK divider control:
UCLK = MEMCLKorMEMCLK/2 - Memory-channel interleaving and interleave size
- DRAM map inversion
- MBIST, aggressor testing and Data Eye controls
- ECC, parity, Write CRC, data scrambling and TSME options
CPU, fabric and power controls
I also found:
- FCLK frequency control
- VDDR_SOC overclock VID
- Global CPU C-state control
- Core Performance Boost
- L1/L2 stream hardware prefetch controls
- P-state policy
- CPPC controls
- STAPM configuration
- SmartShift and SmartShift A+A
- APU-only, sustained, fast and slow PPT limits
- Configurable system profiles from
10 Wup to54 W - Fan policy, forced PWM and fan-table controls
- Temperature-tracking options
- SVM, SVM Lock and SMM Code Lock
There are also PCIe PSPP/GPP policies, Above 4G MMIO, SATA/AHCI/RAID, ACPI C2/C3, HPET and a large number of platform-specific PBS controls.
I photographed and documented the complete successful session here:
https://github.com/root-hunter/lenovo_bios
>Important: a visible control is not automatically a working or safe control.
I have confirmed that these forms render on FCCN19WW, but I have not validated every value or established safe tuning ranges. Some options—particularly SoC VID, memory training, impedance, power limits and unsupported POR profiles—can cause instability, loss of display or a complete no-boot condition.
Before making real changes, I intend to prepare a verified SPI backup and recovery path.
For the experienced Renoir tuners here: which controls would you test first, and what would be your safest validation sequence?
I’m particularly interested in determining:
- Whether the Ryzen 7 4800H will actually accept memory clocks above the stock configuration
- Whether FCLK and UCLK can be kept synchronized
- Which PPT/STAPM limits are genuinely enforced
- Whether the exposed
54 Wprofile changes sustained boost behavior - Which memory timings can be adjusted without triggering failed training
Technical feedback, recovery advice and reproducible test suggestions are very welcome.