Posted by RvdH under Computer & Peripherals on Feb 17 2018

Somehow a while back I have been able to corrupt my HP Pavilion 500-0xx BIOS trying to flash updated Intel ME firmware into it.
Just a black screen, no POST messages, no nothing! Normal emergency recovery did nothing. That was a real bummer, as always...the warranty just expired!

I took out the motherboard and examined it, I found something called a ROM_RECOVERY header, Information how to use the ROM_RECOVERY header is very limited, my guess...HP doesn't want us to know! HP States, the ROM_RECOVERY header allows qualified technicians, and I like to believe hobbyist like myself, to reload firmware into the SPI boot flash in case there is problem with it. The HP Pavilion 500-0xx and ENVY 700-0xx series have a Pegatron IPM87-MP Memphis-S motherboard, Although this guide might also work for Pegatron Memphis-B, Memphis2-S or other similar motherboards as long the ROM_RECOVERY header exist.

Although I already had a replacement motherboard I got convinced, after searching and reading quite a bit (mostly on Win-RAID Forum), I could get this motherboard back into working state using a simple SPI programmer. I ordered a (cheap) CH341A programmer and some 1P 2.54mm Female to 2P 2.0mm Female Jumper Wire Cable from eBay, above items cost me around  €5,- in total. The items had to come from China, so be prepared to be waiting a while.. it took about two weeks to get delivered here in the Netherlands.

On the Win-RAID Forums I also found a Windows version of flashrom & driver for the CH341A programmerflashrom is a utility for identifying, reading, writing, verifying and erasing flash chips. It is designed to flash BIOS/EFI/coreboot/firmware/optionROM images on mainboards, network/graphics/storage controller cards, and various other programmer devices.

The ROM_RECOVERY Header on the motherboard.

Now we are going to connect the CH341A programmer with the ROM_RECOVERY header on the motherboard, if your jumper wires are short, you may like to use a USB extension cable to connect the CH341A programmer. First take out the CMOS battery, then take off the jumper covering the two SPI_CS# pins on the motherboard. The schema displayed below should get you settled, just make sure you connect the left SPI_CS# (nr.1) to the CS connector on the CH341A, the rest of the pins both on the motherboard and CH341A programmer should be self explanatory.

I do not know the use of the two topmost pins on the motherboard, but as I discovered along the way these are not needed to erase, read, write and verify using the CH341A programmer and flashrom.

 

 
Once everything is connected properly, insert the CH341A programmer into a USB port on the system you are going to be programming the flash chip on. Extract the flashrom_windows.zip file downloaded from the Win-RAID Forum archive and execute Install.cmd, it will automatically install the CH341A WinUSB driver and open a command shell to access flashrom. Enter flashrom in the command shell to probe for the device and connected flash chips.
 
Calibrating delay loop... OK.
Found Macronix flash chip "MX25L6405" (8192 kB, SPI) on ch341a_spi.
Found Macronix flash chip "MX25L6405D" (8192 kB, SPI) on ch341a_spi.
Found Macronix flash chip "MX25L6406E/MX25L6408E" (8192 kB, SPI) on ch341a_spi.
Found Macronix flash chip "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E" (8192 kB, SPI) on ch341a_spi.
Multiple flash chip definitions match the detected chip(s): "MX25L6405", "MX25L6405D", "MX25L6406E/MX25L6408E", "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E"
Please specify which chip definition to use with the -c <chipname> option.
No chip detected? See the note at the bottom of this page.
Sometimes flashrom identifies several flash chip types, in such case you have to manually specify the chip type. The Pegatron Memphis-S motherboard is equipped with a Macronix MX25L6473E flash chip, so we need to call flashrom with:

flashrom -c "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E"
Calibrating delay loop... OK.
Found Macronix flash chip "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E" (8192 kB, SPI) on ch341a_spi.
No operations were specified.
If you follow this guide using a different motherboard make sure the flashrom flashchip nr. matches the nr. printed on the chip, in my case the chip was located directly beside the ROM_RECOVERY header.  

Backup (I actually forgot this step, but might come in handy to recover DMI data from)
flashrom -c "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E" -r backup.bin
Calibrating delay loop... OK.
Found Macronix flash chip "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E" (8192 kB, SPI) on ch341a_spi.
Reading flash... done.
Erase
flashrom -c "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E" -E
Calibrating delay loop... OK.
Found Macronix flash chip "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E" (8192 kB, SPI) on ch341a_spi.
Erasing and writing flash chip... Erase/write done.
Write and Verify 
BIOS.BIN represents the bios file downloaded from HP support website matching your SSID, in my case this was BIOS version 20.23 Rev.A for SSID: 2AF7
flashrom -c "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E" -w BIOS.BIN
Calibrating delay loop... OK.
Found Macronix flash chip "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E" (8192 kB, SPI) on ch341a_spi.
Reading old flash chip contents... done.
Erasing and writing flash chip... Erase/write done.
Verifying flash... VERIFIED.
Reseat the CMOS battery, place the jumper back on the two SPI_CS# pins on the motherboard. Now reassemble the system, reattach all cables, devices, fans, etc...

If everything went OK the system should now boot again. At least it did for me!

Download
I have attached the Windows flashrom package to this article just in case the Win-RAID Forum link goes down
(NOTE: the version on Win-RAID Forum might be newer!)
flashrom_windows.zip

Requirements
  1. 1P 2.54mm Female to 2P 2.0mm Female Jumper Wire Cable
  2. CH341A programmer
Note
I have read reports in some cases the CH341A 5v pin had to be connected to the 3VSB pin on the ROM_RECOVERY header on the motherboard instead of the CH341A 3.3v pin to be able to detect BIOS chip with flashrom.

Applicable models:
HP 110-axx Desktop PC
HP ENVY 700-0xx PC
HP Pavilion Slimline 400-0xx PC
HP Pavilion 500-0xx PC


comments

there are no comments for this post. be the first to post one!


post your comment

 (*) - required