Posted by RvdH under Computer & Peripherals on Feb 17 2018

Somehow a while back I have been able to corrupt my HP Pavilion 500-0xx BIOS trying to flash updated Intel ME firmware into it.
Just a black screen, no POST messages, no nothing! Normal emergency recovery did nothing. That was a real bummer, as always...the warranty just expired!

I took out the motherboard and examined it, I found something called a ROM_RECOVERY header, Information how to use the ROM_RECOVERY header is very limited, my guess...HP doesn't want us to know! HP States, the ROM_RECOVERY header allows qualified technicians, and I like to believe hobbyist like myself, to reload firmware into the SPI boot flash in case there is problem with it. The HP Pavilion 500-0xx and ENVY 700-0xx series have a Pegatron IPM87-MP Memphis-S motherboard, Although this guide might also work for Pegatron Memphis-B, Memphis2-S or other similar motherboards as long the ROM_RECOVERY header exist.

Although I already had a replacement motherboard I got convinced, after searching and reading quite a bit (mostly on Win-RAID Forum), I could get this motherboard back into working state using a simple SPI programmer. I ordered a (cheap) CH341A programmer and some 1P 2.54mm Female to 2P 2.0mm Female Jumper Wire Cable from eBay, above items cost me around  €5,- in total. The items had to come from China, so be prepared to be waiting a while.. it took about two weeks to get delivered here in the Netherlands.

On the Win-RAID Forums I also found a Windows version of flashrom & driver for the CH341A programmerflashrom is a utility for identifying, reading, writing, verifying and erasing flash chips. It is designed to flash BIOS/EFI/coreboot/firmware/optionROM images on mainboards, network/graphics/storage controller cards, and various other programmer devices.

The ROM_RECOVERY Header on the motherboard.

Now we are going to connect the CH341A programmer with the ROM_RECOVERY header on the motherboard, if your jumper wires are short, you may like to use a USB extension cable to connect the CH341A programmer. First take out the CMOS battery, then take off the jumper covering the two SPI_CS# pins on the motherboard. The schema displayed below should get you settled, just make sure you connect the left SPI_CS# (nr.1) to the CS connector on the CH341A, the rest of the pins both on the motherboard and CH341A programmer should be self explanatory.

I do not know the use of the two topmost pins on the motherboard, but as I discovered along the way these are not needed to erase, read, write and verify using the CH341A programmer and flashrom.

 

 
Once everything is connected properly, insert the CH341A programmer into a USB port on the system you are going to be programming the flash chip on. Extract the flashrom_windows.zip file downloaded from the Win-RAID Forum archive and execute Install.cmd, it will automatically install the CH341A WinUSB driver and open a command shell to access flashrom. Enter flashrom in the command shell to probe for the device and connected flash chips.
 
Calibrating delay loop... OK.
Found Macronix flash chip "MX25L6405" (8192 kB, SPI) on ch341a_spi.
Found Macronix flash chip "MX25L6405D" (8192 kB, SPI) on ch341a_spi.
Found Macronix flash chip "MX25L6406E/MX25L6408E" (8192 kB, SPI) on ch341a_spi.
Found Macronix flash chip "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E" (8192 kB, SPI) on ch341a_spi.
Multiple flash chip definitions match the detected chip(s): "MX25L6405", "MX25L6405D", "MX25L6406E/MX25L6408E", "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E"
Please specify which chip definition to use with the -c <chipname> option.
No chip detected? See the note at the bottom of this page.
Sometimes flashrom identifies several flash chip types, in such case you have to manually specify the chip type. The Pegatron Memphis-S motherboard is equipped with a either a Macronix MX25L6473E or a Winbond W25Q64.V flash chip.
In my case it contained a Macronix MX25L6473E flash chip and we need to call flashrom with the chip definition like:

flashrom -c "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E"
Calibrating delay loop... OK.
Found Macronix flash chip "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E" (8192 kB, SPI) on ch341a_spi.
No operations were specified.
If you follow this guide using a different motherboard make sure the flashrom flashchip nr. matches the nr. printed on the chip, in my case the chip was located directly beside the ROM_RECOVERY header.  

Backup (I actually forgot this step, but might come in handy to recover DMI data from)
flashrom -c "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E" -r backup.bin
Calibrating delay loop... OK.
Found Macronix flash chip "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E" (8192 kB, SPI) on ch341a_spi.
Reading flash... done.
Erase
flashrom -c "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E" -E
Calibrating delay loop... OK.
Found Macronix flash chip "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E" (8192 kB, SPI) on ch341a_spi.
Erasing and writing flash chip... Erase/write done.
Write and Verify 
BIOS.BIN represents the bios file downloaded from HP support website matching your SSID, in my case this was BIOS version 80.23 Rev.A for SSID: 2AF7
flashrom -c "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E" -w BIOS.BIN
Calibrating delay loop... OK.
Found Macronix flash chip "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E" (8192 kB, SPI) on ch341a_spi.
Reading old flash chip contents... done.
Erasing and writing flash chip... Erase/write done.
Verifying flash... VERIFIED.
Reseat the CMOS battery, place the jumper back on the two SPI_CS# pins on the motherboard. Now reassemble the system, reattach all cables, devices, fans, etc...

If everything went OK the system should now boot again. At least it did for me!

Download
I have attached the Windows flashrom package to this article just in case the Win-RAID Forum link goes down
(NOTE: the version on Win-RAID Forum might be newer!)
flashrom_windows.zip

Requirements
  1. 1P 2.54mm Female to 2P 2.0mm Female Jumper Wire Cable
  2. CH341A programmer
Note
I have read reports in some cases the CH341A 5v pin had to be connected to the 3VSB pin on the ROM_RECOVERY header on the motherboard instead of the CH341A 3.3v pin to be able to detect BIOS chip with flashrom.

Applicable models:
HP 110-axx Desktop PC
HP ENVY 700-0xx PC
HP Pavilion Slimline 400-0xx PC
HP Pavilion 500-0xx PC
Last edited Mar 16 2019


comments


@Ant
Wow, you've been shooting comments :-)
Glad this guide/tutorial has helped you reanimate your motherboard!

Posted by RvdH on Mar 23 2019 02:00
One final word is that there was a misprint on the board of my mini programmer. One pin was marked mios instead of miso. Not a biggie even for a novice like me but just for the sake of completeness...

Thank you again for saving my motherboard with your excellent research and tutorial.

Posted by Ant on Mar 17 2019 21:56
Sorted it. Wasn't the card itself but the fact the PC was trying to boot from it as a last resort. Used F10 to get into the BIOS and disabled that. All good now. Better BIOS than the one it had. More suited to running pcie GPU cards without issues.

So happy. Thank you for this most excellent tutorial.

Posted by Ant on Mar 17 2019 11:57
Ah, I think all is well. I had removed the mini pcie wificard before flashing and forgot to put it back. This caused the error messages. Sorry. I was all excited. I should have checked better before posting.

Posted by Ant on Mar 17 2019 10:46
I should mention you only see error messages if there is no disk attached. With the ssd installed it boots into windows almost instantly. Faster than it did on its old BIOS when it was still working.

It's a big win but I had fun and am up for more perfecting it.

Posted by Ant on Mar 17 2019 10:31
We suspect the Chinese knew this and what seems like a faulty design was clever minimalism to create a device which would program at either voltage level automatically. Perhaps a bit stressful on the internal diodes of the 3.3v ROM. A 5v device wouldn't try to pull too much current so the voltage would remain stable.

Posted by Ant on Mar 17 2019 10:18
In practice my long USB extension lead caused some voltage drop and the CH341A chip cannot supply the high current the ROM chip might try to draw if its internal diodes are overwhelmed by high voltage. If it tries the voltage drops and the whole thing becomes self limiting. This is the wisdom of Tom, my friend.

Posted by Ant on Mar 17 2019 10:14
Quite happy to reflash it now I know how. I quite enjoyed the process. It was my first time flashing anything.

I used the black board mini programmer without problem or modification. Although it uses the usb supplied 5v for the signal lines the 3.3v chip was fine. I did use the 3.3v from the on board regulator to power the rom.

Posted by Ant on Mar 17 2019 10:12
The internal graphics work. It takes an external GPU without issue, memory is fine, the usb ports work, only the audio complains it needs drivers, although the same drive used to run it without problem before.

I think perhaps I don't have quite the right BIOS bin. I have the same model pegatron motherboard. It is ver1.03. It is not the memphis B as it doesn't have Bluetooth. It does have a winbond ROM chip. Perhaps the Memphis 2 S? It seems to date from 2013. Any idea?

Posted by Ant on Mar 17 2019 10:10
Whilst I now have a live board instead of a dead one there are some issues.

It does not offer a way to enter the BIOS as it boots. It boots blazingly fast into windows from my ssd but along the way it complains about GBE family controller and PXE something. It ends by saying exiting PXE ROM then boots into windows. Any insight?

Posted by Ant on Mar 17 2019 10:08
The instructions given here worked well. I followed them carefully and in half an hour my motherboard was reanimated. I note the commands are case sensitive and using the up arrow to repeat the last command before modifying it saved typing.

I am massively reassured that my CPU and MB both work.

Posted by Ant on Mar 17 2019 10:07
Oops, that was definitely a typo, corrected!

Posted by RvdH on Mar 16 2019 17:19
The file on the HP website is actually revision 80.23 not 20.23. It is an exe not a bin. You can use 7zip to peer inside and find the 80.23 bin file. That extracts to a nice round 8mb, which seems promising.

That's as far as I have gotten so far but I thought it worth mentioning for others who might be as confused as I was.

Posted by Ant on Mar 16 2019 11:40


post your comment

 (*) - required