Install Libreboot on HP EliteBook 820 G2

Return to index

!!BACKUP everything!! just in case something fails.

Specifications
Manufacturer	HP
Name	EliteBook 820 G2
Variants	EB 720/740/750/820/840/850, ZBook 14/15u G2
Released	2014
Chipset	Wildcat Point-LP
CPU	Intel i5-5200U, i5-5300U, i7-5500U, i7-5600U
Graphics	Intel HD 5500, optional AMD graphics
Display	12,5" -> 15,6"; 1366x768 -> 1920x1080
Memory	DDR3L SODIMMs (max. 32 GB, 2x16 GB)
Architecture	x86_64
EC	SMSC MEC1324 in main boot flash
Original boot firmware	HP UEFI firmware
Intel ME/AMD PSP	Present. Can be disabled with me_cleaner.
Flash chip	2x SOIC-8; 16MB Main & 2MB HP Sure Start

W+: Works without vendor firmware;
N: Doesn't work;
W*: Works with vendor firmware;
U: Untested;
P+: Partially works;
P*: Partially works with vendor firmware

Features
Internal flashing with original boot firmware	N
Display (if Intel GPU)	W+
Audio	W+
RAM Init	W+
External output	W+
Display brightness	W+

Payloads supported
GRUB	Works
SeaBIOS	Works
SeaBIOS with GRUB	Works

Download from release

If you’re using a release ROM, please ensure that you’ve inserted extra firmware required refer to the guide for that (, failure to adhere to this advice will result in a bricked machine):

• Intel ME

Build from source

The build target, when building from source, is thus:

./mk -b coreboot hp820g2_12mb

This ROM image is confirmed to work with all variants. (Even if a complete 16MB libreboot firmware+ec backup is made, then flashed into a different variant with hp surestart erased.)

Software

Before internal flashing, Disable /dev/mem protection first.

In short add this kernel parameter: iomem=relaxed(linux distro)/kernel.securelevel=-1(bsd distro)

THEN REMOVE THIS KERNEL PARAMETER TO PREVENT UNAUTHORIZED/MALICIOUS ACCESS TO YOUR SYSTEM AFTER FLASHING LIBREBOOT.

(An important reminder for those who might forget to delete it, even better, replace it with lockdown=integrity / lockdown=confidentiality)

Backup the previous (working) firmware (atleast) twice (to check and compare if reading it gone wrong and backups differs.)

flashprog -p internal -r Backup1.bin

flashprog -p internal -r Backup2.bin

Check and compare those if reading from the flash were successful:

diff Backup1.bin Backup2.bin

For more than 2:

shasum Backup1.bin Backup2.bin Backup3.bin

If those differs, something gone wrong and proceeding further may (DON’T) leave your device unrecoverable (without a reliable backup) if flashing fails as well.

Works with libreboot, but not with vendor firmware:

flashprog -p internal --ifd -i gbe -w libreboot16.rom --noverify-all
flashprog -p internal --ifd -i bios -w libreboot16.rom --noverify-all
flashprog -p internal --ifd -i me -w libreboot16.rom --noverify-all
flashprog -p internal --ifd -i fd -w libreboot16.rom --noverify-all

Hardware Flashing

Backup the previous (working) firmware twice (to check and compare if reading it gone wrong and backups differs.)

flashprog -p serprog:dev=/dev/ttyACM0,spispeed=16M -r Backup1.bin

flashprog -p serprog:dev=/dev/ttyACM0,spispeed=16M -r Backup2.bin

Check and compare those if reading from the flash were successful:

diff Backup1.bin Backup2.bin

For more than 2:

shasum Backup1.bin Backup2.bin Backup3.bin

If those differs, something gone wrong and proceeding further may (DON’T) leave your device unrecoverable (without a reliable backup) if flashing fails as well.

720/820 g2 motherboard flash chips

740/840/850/14/15u g2 motherboard flash chips

BACKUP every flash chip first, then erase the HP Safe Start flash chip (the 2MB one);

• On the 720/820 motherboards it is just above the battery, between the wwan slot and the cpu.
• On the other boards, it is between the wwan slot and the cmos battery, the unhighlighted/unframed one.

flashprog -p PROGRAMMER -r priv.rom

flashprog -p PROGRAMMER --erase

After it is erased (so the ec firmware cannot load the backup data from it to brick the libreboot installed laptop) expand the libreboot ROM file:

dd if=/dev/zero of=4mb.bin bs=4M count=1
cat libreboot.rom 4mb.bin > libreboot16.rom

Do not fully flash libreboot16.rom to avoid touching the 4MB EC firmware.

• On the 720/820 motherboards it is just above the battery connector.
• On the other boards, it is between the wwan slot and the cpu just, above the cmos battery, the highlighted/white framed one.

In case your boards uses Macronix MX25L12873F, include the -c “MX25L12833F/MX25L12835F/MX25L12845E/MX25L12865E/MX25L12873F” like:

flashprog -p serprog:dev=/dev/ttyACM0,spispeed=16M -c ""MX25L12833F/MX25L12835F/MX25L12845E/MX25L12865E/MX25L12873F"" -r uefi+ec.rom

With the 16MB image, BACKUP, then write the libreboot rom split in 4 commands;

flashprog -p PROGRAMMER -r uefi+ec.rom

flashprog -p PROGRAMMER --ifd -i gbe -w libreboot16.rom
flashprog -p PROGRAMMER --ifd -i bios -w libreboot16.rom
flashprog -p PROGRAMMER --ifd -i me -w libreboot16.rom
flashprog -p PROGRAMMER --ifd -i fd -w libreboot16.rom

Replace PROGRAMMER according to whichever flasher you’re using.

Make sure to Modify MAC addresses with nvmutil in the flash.

DO NOT DO THIS WITH ORIGINAL BOOT FIRMWARE, IT BECAMES UNBOOTABLE; SEE

The onboard TPM is an SLB 9660 TPM 1.2, which is upgradable to TPM 2.0, but incompatible with stock rom.

Only by externally backing up the stock flash and private flash, flashing libreboot, booting to OS, downgrading the TPM, then reflashing stock firmware from backup would make it work again. Untested, may work with HP TPM Configuration Utility on Windows.

Upgradable with TPMFactoryUpd tool from iavael’s or crass’s github repo with SLB 966x firmware;

After making it and checking the machine’s tpm version with;

TPMFactoryUpd -info

Before upgrading, make sure the ownership is unclaimed and tpm enabled. to upgrade, use config file in the firmware folder inside the downloaded package_1.5.zip and extract the 9665FW update folder, then start the upgrade process:

TPMFactoryUpd -update config-file -config TPM12_latest.cfg

Not yet used meaningfully by Libreboot itself, but the TPM can be used to implement things like measured boot.

In some cases, users report that the system never boots at all (orange blinking status LED) when doing the installation.

Although not yet confirmed scientifically (in code or otherwise), one user reported that removing the CMOS/NVRAM battery will remedy this because, according to them, some of the state pertaining to EC firmware is preserved while the battery is connected.

If you have problems, try removing the CMOS battery. This doesn’t happen on every machine tested, so perhaps there might be a setting somewhere (in the UEFI setup menu of the vendor firmware) pertaining to this? Or maybe the ones that were previously tested successfully had dead/dying CMOS batteries?

If you’re one of these people, please do report to the Libreboot project your own findings, via the contact page. Thank you.

If needed, you may ask for a complete libreboot rom image with a clean EC firmware. (At your own risk and trust, of course.)

The EC firmware is fully compatible among the listed variants.

The extra gpu needs a propetiary blob (vbios) extracted from the original vendor firmware and included in the build process. It is untested and may not be advised in libreboot.

• 840/850 g2: AMD Radeon R7 M260X (system shared vRAM)
• 14 g2: AMD FirePro M4150 FireGL (1 GB GDDR5 vRAM)
• 15u g2: AMD FirePro M4170 FireGL (1 GB GDDR5 vRAM)

• Non-touchscreen ones can be upgraded with it, but needs another similar cable with 4 connectors (the extra 1 for the touch screen) as it is on top of the display. HP elitebook/zbook G1 parts are fully compatible as well. (G3 untested, it might work).

• Higher clocked memory modules works (1866mhz tested without problems)

• Wifi button does not works above the keyboard, but shows enabled/disabled lights if controlled from the OS settings.

• Intel Wifi 7 wlan cards may not work after a turn off/reboot (outdated, not tried with recent releases)

• Some NVMe ssd-s are buggy in the M.2 PCIe slot (for example; WD PC sn530 NVMe is buggy, but MZ-ALQ256B Samsung PM991A works just fine without issues)

*1 HP 2013 UltraSlim Docking Station compatible.

SPDX-License-Identifier: GFDL-1.3-or-later

Markdown file for this page: https://libreboot.org/docs/install/hp820g2.md

Site map

This HTML page was generated by the Libreboot Static Site Generator.