Здравствуйте, надо записать информацию в чип биос, или хотя бы его стереть(чип). Южный мост ICH8, чип MATRONIX MX25L1605. Использовал следующую процедуру для стирания: Код (Text): org 100h use16 ;open a20 line in al, 92h or al, 02h out 92h, al mov eax, cs mov ds, ax ;save old_cs mov ax, cs mov [ds:old_cs], ax ;save real mode return point mov word [ds:offset_r_mode], r_mode ;init code 32 descr mov eax, cs shl eax, 4 mov edi, descr8+2 mov [ds:edi], ax bswap eax inc edi inc edi mov [ds:edi], ah ;init code 16 descr mov eax, dword [ds:descr8+2] mov dword [ds:descr18+2], eax ;calculating linear address of GDT mov eax, cs shl eax, 4 mov [ds:GdtLinAdr], eax add [ds:GdtLinAdr], descr0 cli lgdt fword [ds:GdtSize] mov eax, cr0 or al, 1 mov cr0, eax jmp 08h:p_mode32 use32 ;32 bit protected mode p_mode32: mov al, 1 out 80h, al mov cx, 10h ;32 bit data descr mov ds, cx mov es, cx mov ss, cx call ClearFlash mov cx, 20h ;16 bit data decsr mov ds, cx db 0eah dd pm16 dw 18h ;16 bit code descr pm16: use16 mov eax, cr0 btr eax, 0 mov cr0, eax db 0eah offset_r_mode dw 11 ;jmp 08h:r_mode old_cs dw 0 r_mode: sti mov ax, cs mov ds, ax mov es, ax mov ss, ax mov ax, 4c00h int 21h use32 GetPCIDword: push edx mov edx,0cf8h out dx, eax mov edx,0cfch in eax, dx pop edx ret GetRCBA: mov eax, 8000F8F0h call GetPCIDword ret ReadBiosCntlReg: push edx mov eax, 8000F8DCh mov edx,0cf8h out dx, eax mov edx,0cfch in al, dx pop edx ret ScanOpcodeMenu: push ecx push edx mov ecx,[ds:ebx+098h] ; ECX=OpCode menu, bytes 0-3 mov edx,[ds:ebx+09Ch] ; EDX=OpCode menu, bytes 4-7 mov ah,al ; AH = Pattern for compare mov al,0 ; Position counter = 0 Scan_OpCode: cmp cl,ah je Exit_OpCode ; Exit if match, also CF=0(NC) shrd ecx,edx,8 shr edx,8 ; Shift OpCodes inc ax cmp al,8 jb Scan_OpCode stc ; CF=1(NC) if not found Exit_OpCode: pop edx pop ecx ret ScanPrefixMenu: push dx mov dx,[ds:ebx+94h] ; DX = Prefix Config. reg. mov ah,al ; AH = Pattern for compare mov al,0 cmp dl,ah ; Compare position [0] db 66h je Exit_Prefix ; Go if position [0] match inc ax cmp dh,ah ; Compare position [1] db 66h je Exit_Prefix ; Go if position [1] match stc ; CF=1(NC) if not found Exit_Prefix: pop dx ret ;-------------------------------------------------------------; ; Wait for Flash ROM ready, use BUSY bit in the status reg. ; ; Input: DS:EBX = Base address of RCBA\SPIBAR ; ; Output: CF = Error flag: ; ; 0(NC) = Flash EPROM ready ; ; 1(C) = Flash EPROM timeout or access error ; ;-------------------------------------------------------------; Wait_Flash_Ready: push ecx push eax xor cx,cx Wait_Erase: push cx mov al,05h ; 05h = Read Status command call ScanOpcodeMenu jc Ready_Error_1 ; Go if missing opcode error and eax,7 ; Select bit field shl eax,12 ; Positioning bit field or eax,00400200h ; EAX = Command for ICH8 (Read Status) xor ecx,ecx ; ECX = Address = 0 call Read_SPI ; Output EAX=Data xchg ax,cx Ready_Error_1: pop cx jc Ready_Error test al,00000001b ; Check BUSY bit loopnz Wait_Erase jnz Ready_Error ; Exit if timeout error ;--- Exit points --- clc ; CF=0(NC) means no errors pop eax pop ecx ret Ready_Error: stc ; CF=1(C) means error pop eax pop ecx ret ;---------------------------------------------------------; ; Write Command to SPI EPROM (for Intel ICH8) ; ; Input: EAX = Operation code (status+control) ; ; ECX = Address in the SPI flash device ; ; EDX = Data pattern ; ; DS:EBX = Base address of RCBA\SPIBAR ; ; Output: CF = Error flag: 0(NC)=OK, 1(C)=Error ; ;---------------------------------------------------------; Write_SPI: pushad ;--- Pre-clear status --- mov byte [ds:ebx+090h],00001100b test byte [ds:ebx+090h],00001101b jnz @@SPI_Wr_Error ; Still active ? ;--- Prepare data pattern --- mov [ds:ebx+010h],edx cmp [ds:ebx+010h],edx jne @@SPI_Wr_Error ; Not writeable ? ;--- Set address for SPI --- mov [ds:ebx+008h],ecx ;--- Start command --- mov [ds:ebx+090h],eax ;--- Wait for operation complete --- push ecx mov ecx,00200000h @@SPI_Wait_W: mov al,[ds:ebx+90h] ; Read status mov ah,al and al,00000101b ; D2=Done, D0=Progr. cmp al,00000100b loopne @@SPI_Wait_W ; Cycle for wait pop ecx jne @@SPI_Wr_Error ; Timeout ? ;--- Check status --- test ah,00011000b ; D4=AEL, D3=FCERR jnz @@SPI_Wr_Error ; Error flags set ? ;--- Post-clear status --- mov BYTE [ds:ebx+090h],00001100b test BYTE [ds:ebx+090h],00001101b jnz @@SPI_Wr_Error ; Still active ? ;--- Exit points --- @@SPI_Wr_Ok: clc ; CF=0(NC) means no errors popad ret @@SPI_Wr_Error: stc ; CF=1(C) means error popad ret ;*********************************************************** ; Процедура чтения двойного слова с использованием SPI ; Вход: ebx - SPIBAR ; ecx - смещение от начала чипа ; eax - сформированная команда чтения ; Выход: eax - данные ; в случае ошибки cf = 1 ;*********************************************************** Read_SPI: push ecx mov byte [ds:ebx+90h], 00001100b test byte [ds:ebx+90h], 00001101b jnz SPI_Rd_Err mov dword [ds:ebx+08h], ecx ; set address mov dword [ds:ebx+90h], eax ; start command push cx xor cx, cx SPI_Wait_R: mov al, byte [ds:ebx+90h] ; get status register mov ah, al and al, 00000101b cmp al, 00000100b loopne SPI_Wait_R pop cx jne SPI_Rd_Err test ah, 00011000b jnz SPI_Rd_Err mov byte [ds:ebx+90h], 00001100b test byte [ds:ebx+90h], 00001101b jnz SPI_Rd_Err mov eax, dword [ds:ebx+10h] pop ecx clc ret SPI_Rd_Err: pop ecx stc ret ClearFlash: push edx mov eax, 8000F8DCh mov edx,0cf8h out dx, eax mov edx,0cfch in al, dx or al, 1 out dx, al pop edx call GetRCBA test eax, 1 jz @@error ;spibar lea ebx, [eax+3020h-1] ;формируем команду mov al, 20h ; erase sector call ScanOpcodeMenu jc @@error and eax, 7 shl eax, 12 xchg ecx, eax mov al, 06h call ScanPrefixMenu jc @@error and eax, 1 shl eax, 11 or eax, ecx or eax, 0600h xor edx, edx mov ecx, 180000h call Write_SPI jc @@error call Wait_Flash_Ready jc @@error clc ret @@error: stc ret ; //////////////////////////////////////////////////////////////////////// descr0 db 0,0,0,0,0,0,0,0; descr8 db 0ffh,0ffh,0,0,0,09ah,04fh,0;32 code descr10 db 0ffh,0ffh,0,0,0,092h,0cfh,0;32 data descr18 db 0ffh,0ffh,0,0,0,09ah,0fh,0; 16 code descr20 db 0ffh,0ffh,0,0,0,092h,8fh,0; 16 data descr28 db 0ffh,0ffh,0,0,0,09ah,2fh,0 ; 64 code descr30 db 0ffh, 0ffh, 0h, 0h, 0h, 9fh, 4fh, 0h; 32-bit compatibility mode GdtSize dw 8*7 GdtLinAdr dd 0 Но приходит ошибка, почему не понимаю. С помощью процедуры Read_SPI я читаю чип нормально, а записать никак не могу. Состояние регистра BIOS CONTROL (B031:F0:off 0DCh) 1h. Сделал дампы регистров до и после подачи команды. Может кто уже сталкивался с этой проблемой? Также не очень понимаю значения регистров защиты по смещению 50h. Просветите пожалуйста Не крепится архив, там дампы, их частичный анализ и даташит на чип. http://zalil.ru/32310187
