Still recommended to manually update AMD microcodes for Lenovo G505s as described here? http://dangerousprototypes.com/docs/Lenovo_G505S_hacking#AMD_microcode_updat...
Yes, and it wouldn't be recommended only after my 28273 and 28370 changes will be merged. They haven't been merged yet because AMD haven't released them to the opensource community. I think Martin Roth has been communicating with AMD regarding this matter, but maybe didn't get any reply yet. So we could either wait few years until the official release or just start using it now. By the way I'm quite confident that coreboot won't get any DMCA requests regarding these blobs even if they'll be merged, also because platomav's famous repositories are fine.
How do you handle the AMD GPU AtomBIOS blobs?
There are two options: either you add the integrated GPU pci1002,990b.rom blob at coreboot's menuconfig setting ( CONFIG_VGA_BIOS / CONFIG_VGA_BIOS_FILE options ) and the second one later with cbfstool after your coreboot.rom build completes, or just build your coreboot without it and add both blobs using cbfstool. I'm usually following the first approach. And your commands should look like ./util/cbfstool/cbfstool $COREBOOT_ROM_PATH add -f $VGABIOS_PATH -n pci1002,990b.rom -t optionrom ./util/cbfstool/cbfstool $COREBOOT_ROM_PATH add -f $VGABIOS_PATH -n pci1002,6663.rom -t optionrom ^ two commands, you can't merge them into one.
However, adding the dGPU blob is useless at the moment because the set of patches by HJK required to make dGPU working haven't been submitted to coreboot yet. Sorry it's my fault, but I'm working on so many things in parallel that not enough free time to complete everything in time, but I'll try my best to help these patches in the near future.
What about TPM?
G505S doesn't have a hardware TPM module, and I don't know if it could be attached there at all. Also I haven't heard of any TPMs with 100% opensource implementation, which is very important. It seems that Free Software Foundation doesn't have a good opinion about the currently available TPMs - judging by the articles at their site. https://www.gnu.org/philosophy/can-you-trust.en.html