BUG Report in BIOS HP Sure Start - Laptop stuck in a loop or bricked

[cmiguel]

Hi,

I want to report a BIOS bug I just dettected.

It happens with Sure Start when it attempts to prevent Secure Boot Key change.

To replicate the bug you need to follow there steps:

1 - Disable Secure Boot, and clear it's keys. (With Sure Start secure boot keys protection disabled).

2 - Reset the Security Features (this should  change Sure Start option to start protecting the Secure Boot Keys).

3 - You will get a warning, after restarting, saying that there is not platform key. (This is because we have cleared the secure boot keys in step 1).

4 - Enter the Bios and Select Apply Factory Defaults And Restart

5 - After restarting Sure Start will complain that an attempted is being made to change the Secure Boot Keys. The only option it gives you is to press OK.

6 - After pressing OK, the laptop restarts again

7 - After restarting Sure Start will complain that an attempt is being made to change the Secure Boot Keys. The only option it gives you is to press OK.

8 - After pressing OK, the laptop restarts again. Go to step 5.

And it's stuck in this loop. It's impossible to enter the BIOS. Pressing ESC or F10 doesn't enter the BIOS.

The warning that an attempt is being made to change the Secure Boot Keys appears, and the only option is to enter ok, which restarts the laptop just to see the same message.

I want to bring this to the attention of HP.

I don't see a simple way to do it, I hope some staff member on this forum manages to report the issue.

I am going to try, and remove the CMOS battery, hoping to fix something.

Here is a video showing the exact problem: https://drive.google.com/file/d/151wButJoEk4rAMGpcayWDFYdxf8jsl3U/view

[cmiguel]

I disconnected the Battery and the CMOS battery.

Sadly it did not solve my problem. Every time I power on the laptop I receive the same warning:

HP Sure Start Recovery

HP Sure Start detected an unauthorized change to the Secure Boot Keys.

The Keys were restored automatically and there is no further action required.

The repeated occurrence of this problem indicates a security problem that should not be ignored.

I have removed the SSD from the laptop.

I think what is introducing the change in the security boot keys, is the BIOS firmware itself trying to install the default keys.

I can't believe I am stuck with this problem. I don't seem to be able to fix this, and I need help to do it.

All I did was: Cleared Secure Boot Keys. - Pre Condition.

Decided to restore defaults, and first restored the Security Defaults, and then the BIOS factory defaults.

My laptop appears to be bricked. Can please someone help me?

Jesus Christ HP... Why do you do this? First you ruined the G5 keyboard by adding the Skype for business elusive keys, and now this bricked BIOS.

[cmiguel]

I contacted HP today, and was given the [personal information removed].

I was given the impression that I would have to pay to fix this, but the case is gonna be evaluated.

I don't know what to do. Or how to fix this.

I pretty sure this problem can be replicated on other HP computers with the same BIOS version. I don't understand this as being miss use, or something that can be my fault.

[IT_WinSec]

Hi,

I am sorry to hear about your problem.

Just picked up a an Elitebook 800 G5 notebook with BIOS Q78/01.17.

Windows 10 20H2

I afraid I was unable to replicate your issue. Following your steps  after (4) resetting to default settings everything went back to normal.

Do you know what BIOS version you had/have ?

[IT_WinSec]

Have you tried following this article >> https://support.hp.com/us-en/document/c06979955

[cmiguel]

Hi, Thank you for checking this, I am a bit desperate as my my laptop doesn't boot from any device, or let me enter the BIOS setup. Is just stuck on that message.

About the steps I took to get this bug: Here are some pictures that show how I had my BIOS configured, before this "Bug" showed up. Additionally to what is showned in the pictures, I also had Intel AMT/ME disabled, and the TPM State was also disabled. -- I am not sure if that is relevant. Another thing that could be relevant, the SSD installed on my laptop is uninitialized, booting up from WinPE I used "Diskpart"  and issued a clean command the drive.

With the BIOS configured like that, this weekend I upgraded from version 01.17.00 Rev.A to version 01.19.20 Rev.A. Before the upgrade, or after the upgrade, I didn't change any BIOS options, or applyed factory defaults. The upgrade went fine, and the computer was behaving normally, so I don't think this upgrade was a part of the problem, or a link in the chain that got me where I am, but for completness I am describing it here. It was after this upgrade that I booted up WinPE from a USB flash drive to clean the SSD using diskpart.

Now with all this conditions met. I noticed HP released another BIOS upgrade this week and I though I should try to upgrade to it, before reinstalling windows on my machine.

This time, however, I decided to apply the factory defaults before doing it. And I did it in the order described before, First applied the ones in the Security Tab, and then the ones in the Main tab.

If you are on version 1.17.00 Rev.A could you apply the same settings I used in my BIOS. I tried to be as complete as possible, I also had disabled thunderbolt, only used USB-C, and Smart Card power savings, but I don't think that would matter. But for completeness, if you could apply the same as mine. Then upgrade to version 01.19.20 Rev.A. Clean the SSD drive, and then try to apply the defaults on that order?

I am not sure what settings would interfeer or not, I can't think on any other I had changed.

[cmiguel]

@IT_WinSec

I checked that HP article.

I am not able to follow it, the message I get doesn't offer me the option to enter BIOS setup.

Also F10 doesn't allow me to enter the BIOS. Pressing F10 displays the message: "Entering BIOS Setup" in the corner of the screen, but after that I get the Sure Start message, which forces me to restart the computer. And then the message displays again.

I also saw this HP: https://support.hp.com/us-en/document/c06572866

Same message as the one I get, but I cannot enter the BIOS Setup, and my laptop doesn't boot to any OS. The laptop is stuck in this loop that the Sure Start message appears, and after hitting ok and restarting again, it reapers again.

[IT_WinSec]

---

@cmiguel wrote:

About the steps I took to get this bug: Here are some pictures that show how I had my BIOS configured, before this "Bug" showed up.

(...)

With the BIOS configured like that, this weekend I upgraded from version 01.17.00 Rev.A to version 01.19.20 Rev.A. Before the upgrade, or after the upgrade, I didn't change any BIOS options, or applyed factory defaults. The upgrade went fine, and the computer was behaving normally, so I don't think this upgrade was a part of the problem,

(...)

This time, however, I decided to apply the factory defaults before doing it. And I did it in the order described before, First applied the ones in the Security Tab, and then the ones in the Main tab.

If you are on version 1.17.00 Rev.A could you apply the same settings I used in my BIOS. I tried to be as complete as possible,

---

Hello,

It does not matter what settings you had before... If you applied factory default security and factory default BIOS settings, you are on default settings, no matter what settings you had before. So, on 01.19.20 you are on default settings.

I just upgraded two Elitebooks 800 G5 to 01.19.20 and to 01.20.00  (both from 01.17.00). Also clean wiped the SSDs on both of them.
Let me see what my tests will show following your instructions. Posting back soon

[IT_WinSec]

Following your steps from initial post (and subsequent posts) I was unable to replicate your issue again. Personally, I would not consider it as a bug as it worked here on 2 separate devices doing exactly what you did, with the BIOS versions you reported.

Following your steps after resetting to default security and then default settings everything goes back to normal.

[IT_WinSec]

Can you try power resetting/hard resetting your notebook >> https://support.hp.com/us-en/document/ish_1997208-1551050-16

1. Turn off the computer, and then unplug the power cord.

2. Disconnect any peripheral devices, and then remove the computer from any port replicator or docking station.

3. With the power cord unplugged, press and hold the Power button for approximately 15 seconds.

4. After you drain the capacitors, plug in the power cord. Leave peripheral devices disconnected.

5. Turn on the computer.

   You may try doing it again for 30 seconds (step 3)

   When you attempt to start your computer, immediately after you press the power-on button, begin hitting the Esc button repeatedly (like tap-tap-tap), as shown here >> https://www.youtube.com/watch?v=GSN0qzXayUY

   - > Does HP Startup menu appear (with options to select extra menus such as F1 System Information, F2 System Diagnostic, etc) ?

   Even if you see the HP SureStart Recovery message, hit ok but then continue pressing the Esc button repeatedly (tap-tap-tap, etc...)

   If the HP Start up menu appears, keep it like that, that is a good sign (the better option)