Hey everyone,
I recently went down the deepest of rabbit holes trying to reclaim some thermal headroom on my HP EliteBook 840 G7 (Intel 10th Gen Comet Lake, S70 platform). My goal was simple: disable CFG Lock (MSR 0xE2) and unlock the Overclocking/FIVR Lock so I could undervolt in Arch Linux (and maybe tinker with Native Hackintosh).
I spent weeks hitting a massive brick wall. If you are getting the infamous 0x8 Write Protect / Access Denied error in RU.efi or modGRUBShell, this post is for you. Here is the technical reality of HP’s enterprise security, why your software tweaks are failing, and the only way to actually fix it.
** The Problem: The "Titanium Vault"
Normally, on consumer laptops (like ASUS or MSI), you can boot into an EFI shell, use (setup_var) to change the hidden NVRAM offset for CFG Lock from 0x01 to 0x00, and you’re done.
If you try this on a modern HP EliteBook running a recent BIOS (like v01.23.00), you will fail. Why?
- Intel Chipset Guards: Early in the boot phase (PEI/DXE), the Intel PCH flips the BIOS Lock Enable (BLE) switch and locks the memory addresses using PRR (Protected Range Registers). Silicon physically drops your write requests.
- SMM (Ring -2): If you try to force the write, it triggers a System Management Interrupt (SMI). The CPU pauses your EFI shell, runs a hidden HP security script, and spits out the 0x8 Access Denied error.
- HP Sure Start: Even if you bypassed the Intel blocks, HP has a dedicated physical chip (Embedded Controller) constantly auditing the BIOS chip. If it sees you changed a hidden variable, it instantly cuts power and overwrites your changes with a clean backup.
** Why you can't just downgrade the BIOS via USB
Okay, so you realize the new BIOS is locked down because of Intel's Plundervolt mitigations. The solution is to flash the pre-Plundervolt "Golden Version" from mid-2020 (BIOS v01.01.05 - SP104203), right?
Wrong. You put it on a USB, go to the F10 menu, hit update, and get an "Excluded" or "Signature Failure" error—even with Unrestricted Rollback enabled, I have tried this using 2023 BIOS just to figure if HP allows downgrade,
The reason: Hardware eFuses. HP burns a Security Version Number (SVN) into the motherboard. Your current BIOS has a higher SVN than the 2020 BIOS. The hardware physically refuses to let you install an older SVN Even if you set BIOS to Unrestricted Bios Rollback.
Help Needed: I dug into but couldn't find S70 Plateform late 2021 Bios It would be appreciated if you have an archive for HP Elitebook G7 late 2021 Bios before the Plundervolt patch :) ?
** The Microcode Trap
"Fine," you think. "What if I just extract my current v01.23.00 BIOS, find the new offsets, and hardware flash the unlocked NVRAM?"
Even if you do that, your undervolt still won't work. The new BIOS contains updated Intel Microcode. The CPU has essentially been given permanent "earmuffs" to ignore any voltage offset requests from the OS to prevent Plundervolt attacks.
** The Ultimate Solution: The Hardware Heist
To get undervolting to work, you have to bypass the software guards, bypass the SVN downgrade block, and downgrade the Intel Microcode.
The only way to do this is with a CH341A SPI Hardware Programmer.
- Buy a $15 CH341A kit with a SOIC8 test clip from Amazon/AliExpress.
- Unplug your laptop battery (this is crucial—it puts HP Sure Start, the CPU, and the Chipset to sleep).
- Clip directly onto the Winbond SPI Flash Chip on your motherboard.
- Using a second PC, completely erase the chip and physically flash the extracted .bin of the 2020 v01.01.05 BIOS.
Because the laptop is dead/asleep while you do this, HP Sure Start can't stop you. The SVN eFuse can't block the downgrade. When you plug the battery back in and turn it on, HP Sure Start just assumes it has always been on the 2020 version. You are now free from the microcode earmuffs and the PRR locks, and you can finally undervolt!
:) Hopefully, this saves someone the weeks of headaches I went through trying to do this purely through software! Let me know if you have the Internet Archive links for the older HP SoftPaqs?, as HP has deleted them from their main servers.