home *** CD-ROM | disk | FTP | other *** search
-
- Here is AMI's Flash BIOS specification. Alot of it is technical
- shit, the most important thing is the interrupts. (Int 16 function E0H)
- This thing was hard to find. Extremely so. It was hidden amongst
- a few hundred other txt files in the AMI ftp site with some obscure
- name. Even if someone did see it they probably aren't virus programmers
- anyway. You won't find this information anywhere else. Ralph Brown's
- doesn't even have it.
-
- I'm not too sure how the voltage works so I'll just take pot
- luck and turn it up because I saw that mentioned a few times... hmmm
- I wonder if you could burn out a chip by changing the voltage high
- during normal computing ? BwaHaHAhaHaha :) nah that would be wrong :)
-
- It is suggested you just refer to this and only scan it for interesting
- parts.
-
- ------------------------------
-
-
- AMIFLASH - Flash Implementation Guide 1992-1994
-
- American Megatrends, Inc. All Rights Reserved.
-
- Page 0 of 20
-
- American Megatrends, Inc.
-
-
-
- AMIFLASH
-
- Flash Implementation Guide
-
- Summary
-
- This document provides a guideline to Flash implementation in the ISA, EISA,
- PS/2 compatible motherboard and describes the AMIFLASH, the Flash programming
- utility, interface with AMIBIOS, dated 080893 or later for HiFlex BIOS and
- dated 111593 or later for WinBIOS.
-
-
- Revision 2.0 January 10, 1994
-
-
- Copyright 1992-1994 American Megatrends, Inc.
-
-
- [Shit copyright thing here...]
-
- [More shit saying about AMI's rights]
-
-
- For Additional Information
-
- Call American Megatrends BIOS Sales Department at 1-800-828-9264 for
- additional information about AMIFLASH.
-
-
- [Shit disclaimer]
-
- [Limited warranty notice]
-
- [Trademark thingy]
-
- [Revision History]
-
-
-
- 0.0 INTRODUCTION
-
- This document describes the software (BIOS and utility) and hardware details
- of flash EPROM implementation in the motherboard.
-
- The flash Programming Utility is required for on-board programming of flash
- EPROMs which helps user update the system with new releases of BIOS without
- any difficulty (e.g. opening of system chassis, taking out the EPROM,
- re-program the EPROM, etc.).
-
-
- The flash programming utility is unique for each hardware d
- design. This gives rise to a situation where user wil
-
- The flash programming utility is unique for each hardware design. This gives
- rise to a situation where user will be having a different flash programming
- utility for each hardware design. So it is getting very difficult for user to
- control so many utilities which basically does the same thing but a
- particular utility does not work on any motherboard other than on the one
- for which it is meant for.
-
- A few of many factors which make flash programming utility dependent on the
- hardware design are stated below:
-
- Method of raising/lowering Vpp depends on hardware.
-
- Method of making flash write-enabled depends on hardware.
-
- Method of disabling shadow RAMs depends on hardware.
-
- Method of disabling cache depends on hardware.
-
- Method of generating hardware reset may depend on hardware.
-
- In case of non-fatal error (e.g. flash not present, etc.), the flash
- programming utility must be capable of returning to original operating
- condition. This demands certain current system information to be saved before
- access to flash can start. These information include the current shadow
- status, cache status, power management status, etc. These information depend
- on the hardware.
-
-
- 0.1 GENERALIZATION OF FLASH PROGRAMMING UTILITY
-
- This specification is meant for generalizing the flash programming utility
- so that a single flash programming utility can work on all hardware platform.
- This demands some interface between flash utility and the BIOS. Following
- describes the AMIBIOS specification which needs to be implemented in BIOS to
- have a single flash utility for all motherboards.
-
- The different requirements for flash programming are implemented in AMIBIOS
- through Function# 0E0h of INT-16.
-
- The Section-1 of the current document contains the functional specification
- of the flash programming functions to be implemented in AMIBIOS and Section-2
- contains the sample hardware implementation of flash circuit.
-
- 0.2 DIFFERENT TYPES OF FLASH EPROM AND HARDWARE REQUIREMENTS
-
- The flash EPROMs are mainly of two types namely,
-
-
- Normal flash (non-sectored) e.g. Intel 28010.
-
- Sectored flash e.g. Intel 28F001BX-T commonly known as boot-block flash.
-
-
- This document is generated using the above two types of flash as example.
-
-
- 0.2.0 NORMAL (NON-SECTORED) FLASH - Intel 28F010
-
- This is mainly a replacement of standard EPROM with added capability of
- reprogramming of the flash EPROM on-board without taking it out from the
- motherboard. The hardware requirement for this type of flash is
-
-
- Method to raise Vpp (programming voltage) to 12.0V. Method to lower Vpp to
- normal voltage level.
-
- Method to make flash write-enabled. Method to make flash write-protected
- (i.e. read-only).
-
- Please see Section-2 for sample example for hardware implementation.
-
- The main disadvantage of this type of flash is that in case of an error
- (due to accidental power failure, etc.) during reprogramming the flash
- on-board, the flash eprom must be taken out from the motherboard and must
- be reprogrammed with help of eprom programmer.
-
-
- 0.2.1 SECTORED FLASH - Intel 28F001BX-T
-
- This is also a replacement of standard EPROM with added capability of
- reprogramming of the flash EPROM on-board without taking it out from the
- motherboard. But this flash also has another feature of hardware protecting
- one block of the flash from accidental eraser. This type of flash is based
- on block architecture and consists of several blocks.
-
- Intel 28F001BX-T has four separate blocks, one hardware protected 8KByte boot
- block, two 4KByte parameter blocks and one 112Kbyte code block. The boot
- block usually contains a recovery code (also called sometimes as boot block
- code) while other three blocks contain the main BIOS and other parameters.
- This allows the updating of other three blocks possible with the help of
- recovery code even in case of power failure during flash update with flash
- programming utility. Of course, the programming utility can not program the
- boot block (thereby can not destroy the recovery code) because the boot block
- is hardware protected from accidental eraser/write.
-
-
- The general functionality of recovery code is as follows: after power-on, the
- recovery code gets control. The recovery code checks for the validity of the
- main BIOS code and if main BIOS is found to be good, recovery code will pass
- the control to the main BIOS. If main BIOS is found to bad, then this
- recovery code reads the BIOS update ROM file from floppy drive A:, erases
- the other three blocks of flash EPROM, programs the other three blocks of
- flash EPROM with the data read from diskette in drive A: and generates CPU
- reset thereby re-booting the system.
-
- The important point to be noticed is that at power-on, recovery code is seen
- at F segment namely at system address space FE000-FFFFF. But when recovery
- code gives control to the main bios, the main bios must be mapped to system
- address space in F segment namely, F0000-FFFFF. This needs some sort of
- address inversion mechanism by which recovery code can invert A16 before
- giving control to main BIOS.
-
- At power-on, the mapping of physical flash eprom space to the system address
- space is shown in Fig. 1
- (See Page 6).
-
- During runtime i.e. after recovery code transfers control to main BIOS, the
- mapping of physical flash eprom space to the system address space is shown
- in Fig. 2
- (See Page 6)
-
- So it is clear that address line A16 inversion is needed in runtime (before
- recovery code can pass control to main BIOS) so that main BIOS code can be
- seen at system address space F0000-FFFFF.
-
- The hardware requirement for this type of flash is
-
- Method to raise Vpp (programming voltage) to 12.0V. Method to lower Vpp to
- normal voltage level.
-
- Method to make flash write-enabled. Method to make flash write-protected
- (i.e. read-only).
-
- Method to invert address line A16.
-
- Hardware protection of boot block.
-
- Please see Section-2 for sample example for hardware implementation.
-
-
-
- SECTION - 1
-
-
- SPECIFICATION OF FLASH PROGRAMMING FUNCTIONS IN AMIBIOS
-
- 1.0 EXTRA FUNCTIONS IN INT-16 FOR FLASH PROGRAMMING
-
- The flash programming requirement is implemented in AMIBIOS through
- Function# 0E0h in INT-16. This specification is valid for Version 2.00 of
- the specification for extra functions in INT-16 for flash programming.
-
- The general specification is:
-
- Input :
-
- AH E0h
-
- AL subfunction
-
- Other input parameters are specific to subfunction.
-
-
- Output:
-
- CY Error
-
- NC Success
-
- AL FAh
-
- Other output parameters are specific to subfunction.
-
-
- The output value in register AL should be checked for FAh even if function
- returns NC to ensure success.
-
-
- The different subfunctions are stated below and specifications are described
- later.
-
-
- Subfunction# Description
-
-
-
- 00h Get Version Number of BIOS-FLASH Interface
-
- 01h Get Chipset Save/Restore Status Requirement
-
- 02h Save Chipset Status and Prepare Chipset
-
- 03h Restore Chipset Status
-
- 04h Lower Programming Voltage Vpp
-
- 05h Raise Programming Voltage Vpp
-
- 06h Flash Write Protect
-
- 07h Flash Write Enable
-
- 08h Flash Select
-
- 09h Flash De-Select
-
- 0Ah Verify Allocated Memory
-
- 0Bh Save Internal Cache Status
-
- 0Ch Restore Internal Cache Status
-
- 0Dh-FEh RESERVED for future use
-
- FFh Generate CPU Reset
-
-
- 1.0.0 GET VERSION NUMBER OF BIOS-FLASH INTERFACE - Subfunction# 00h
-
-
-
- This routine returns the version number of BIOS-Flash interface
- implementation in BCD format in register BX. For example, the version number
- 2.00 is returned in BX as 0200h.
-
-
- This routine can be used to determine whether the BIOS-Flash interface is
- implemented in BIOS. After returning from the subfunction, the register AL
- should be checked for FAh even if it is returned with NC.
-
-
-
- Input :
-
- AH E0h
-
- AL 00h
-
-
-
- Output:
-
- CY BIOS-Flash interface not implemented
-
- NC BIOS-Flash interface implemented
-
- AL FAh
-
- BX Version number in BCD format
-
-
-
- Register destroyed: AX BX
-
-
-
- This version of implementation should return 0200h (i.e. Version number
- 2.00) in register BX.
-
-
-
- 1.0.1 GET CHIPSET SAVE/RESTORE STATUS REQUIREMENT Subfunction# 01h
-
-
- This routine returns the data area space needed to save the current chipset
- status.
-
-
-
- Input :
-
- AH E0h
-
- AL 01h
-
-
-
- Output:
-
- CY Error
-
- NC Successful
-
- AL FAh
-
- BX #of bytes needed to save chipset environment
-
-
-
- Register destroyed: AX BX
-
-
- 1.0.2 SAVE CHIPSET STATUS AND PREPARE CHIPSET - Subfunction# 02h
-
-
-
- This routine saves the current chipset status in the specified data area
- and then prepares the chipset to make the flash EPROM accessible.
-
-
-
- Things to be saved here are current status of cache, power management
- status, shadow status, etc. This is needed so that in case of non-fatal
- error, system can be restored to status where it was before invoking the
- flash programming utility. The preparation of chipset to make flash EPROM
- accessible includes disabling of shadow rams, disabling of external cache,
- disabling of internal cache, disabling of power management, etc. Note that
- the features which get disabled should be saved first. The disabling of
- cache may be needed to make the target ROM address space non-cacheable. If
- target ROM address space is cacheable only if shadow is enabled (i.e. only
- shadow ram is cacheable, but rom is not cacheable), disabling of shadow ram
- will also make the target ROM address space non-cacheable and so in this
- case, disabling of cache is not required. But if ROM is cacheable, then
- cache must be disabled. This routine must disable internal cache.
-
-
-
- Input :
-
- AH E0h
-
- AL 02h
-
- ES:DI pointer to start of buffer where chipset status
- will be saved
-
-
- Output:
-
- CY Error
-
- NC Successful
-
- AL FAh
-
-
-
- Register destroyed: AX
-
-
-
- 1.0.3 RESTORE CHIPSET STATUS - Subfunction# 03h
-
-
-
- This routine restores the chipset status from the specified data area where
- the chipset status was saved by subfunction-02h.
-
-
-
- Input :
-
- AH E0h
-
- AL 03h
-
- ES:DI ptr to start of buffer from where the chipset environment
- will be restored
-
-
- Output:
-
- CY Error
-
- NC Successful
-
- AL FAh
-
-
-
- Register destroyed: AX
-
-
- 1.0.4 LOWER PROGRAMMING VOLTAGE Vpp - Subfunction# 04h
-
-
-
- This routine lowers the programming voltage Vpp to normal level. This
- routine must wait until the voltage level gets stabilized.
-
-
-
- Input :
-
- AH E0h
-
- AL 04h
-
-
-
- Output:
-
- CY Error
-
- NC Successful
-
- AL FAh
-
-
-
- Register destroyed: AX
-
-
- 1.0.5 RAISE PROGRAMMING VOLTAGE Vpp - Subfunction# 05h
-
-
- This routine raises the programming voltage Vpp to required voltage (i.e.
- to 12.0 Volt for a 12V flash EPROM). This routine must wait until the
- voltage level gets stabilized.
-
-
-
- Input :
-
- AH E0h
-
- AL 05h
-
-
-
- Output:
-
- CY Error
-
- NC Successful
-
- AL FAh
-
-
-
- Register destroyed: AX
-
-
-
- 1.0.6 FLASH WRITE PROTECT - Subfunction# 06h
-
-
-
- This routine makes the flash write-protected. This routine must provide any
- delay (if required) for stabilization.
-
-
- Input :
-
- AH E0h
-
- AL 06h
-
- Output:
-
- CY Error
-
- NC Successful
-
- AL FAh
-
-
- Register destroyed: AX
-
-
- 1.0.7 FLASH WRITE ENABLE - Subfunction# 07h
-
-
- This routine makes the flash write-enabled. This routine must provide any
- delay (if required) for stabilization.
-
- Input :
-
- AH E0h
-
- AL 07h
-
- Output:
-
- CY Error
-
- NC Successful
-
- AL FAh
-
- Register destroyed: AX
-
-
- 1.0.8 FLASH SELECT - Subfunction# 08h
-
-
- This routine selects the flash. This function is not needed normally. But if
- the motherboard has both normal EPROM and flash EPROM present simultaneously
- then this routine needs to be implemented. This routine must provide any
- delay (if required) for stabilization. If this routine is not needed, then
- it must return with successful status.
-
-
-
- Input :
-
- AH E0h
-
- AL 08h
-
-
- Output:
-
- CY Error
-
- NC Successful
-
- AL FAh
-
-
- Register destroyed: AX
-
-
- 1.0.9 FLASH DE-SELECT - Subfunction# 09h
-
-
- This routine de-selects the flash. This function is not needed normally. But
- if motherboard has both normal EPROM and flash EPROM present simultaneously
- then this routine needs to be implemented. This routine must provide any
- delay (if required) for stabilization. If this routine is not needed, then
- it must return with successful status.
-
-
- Input :
-
- AH E0h
-
- AL 09h
-
-
- Output:
-
- CY Error
-
- NC Successful
-
- AL FAh
-
-
- Register destroyed: AX
-
-
- 1.0.10 VERIFY ALLOCATED MEMORY - Subfunction# 0Ah
-
- This routine verifies whether the specified memory can be used or not. This
- routine is not needed in normal situation. But in situation like where the
- certain memory regions become un-accessible under some special conditions
- (e.g. if shadow gets disabled, memory 80000h-9FFFFh may become un-accessible,
- etc.), this routine should be used to verify the memory region to be used by
- flash programming utility is valid or not. If this routine is not needed,
- then it must return with successful status.
-
-
- Input :
-
- AH E0h
-
- AL 0Ah
-
- ES specified memory segment
-
- BX memory size in number of paragraphs
-
-
- Output:
-
- CY Error
-
- NC Successful
-
- AL FAh
-
-
- Register destroyed: AX
-
- A zero (0) input value of BX will be returned as an error.
-
-
- 1.0.11 SAVE INTERNAL CACHE STATUS - Subfunction# 0Bh
-
- This routine saves the current status of internal cache. Before saving this
- routine must check that internal cache is available in the concerned
- hardware. It is the responsibility of the caller to ensure that length of
- supplied buffer (where the internal cache status will be saved) is at least
- 16bytes.
-
-
- If internal cache is not available in the concerned hardware or this
- subfunction is called in protected mode , this routine must return error.
-
-
- Input :
-
- AH E0h
-
- AL 0Bh
-
- ES:DI pointer to start of buffer where internal cache status
- will be saved
-
-
- Output:
-
- CY Error
-
- NC Successful
-
- AL FAh
-
- Register destroyed: AX
-
- 1.0.12 RESTORE INTERNAL CACHE STATUS - Subfunction# 0Ch
-
-
- This routine restores the internal cache status from the specified data area
- where internal cache status was saved by subfunction# 0Bh.
-
-
- If this subfunction is called in protected mode, this routine must return
- error.
-
- Input :
-
- AH E0h
-
- AL 0Ch
-
- ES:DI pointer to start of buffer from where internal cache
- status will be restored
-
-
- Output:
-
- CY Error
-
- NC Successful
-
- AL FAh
-
-
- Register destroyed: AX
-
-
- 1.0.13 GENERATE CPU RESET - Subfunction# FFh
-
-
- This routine generates the CPU reset. This reset generation is needed to
- make system re-boot after successful programming of flash.
-
-
- Note that control will never go back to caller from this routine.
-
- Input :
-
- AH E0h
-
- AL FFh
-
- Output:
-
- Not Needed
-
-
- 1.1 NOTES
-
- In some hardware, raising of programming voltage Vpp and making flash
- write-enabled may be implemented using the same method. And lowering of
- programming voltage Vpp and making flash write-protected may also be
- implemented using the same method. In these type of cases, implement the
- subfunctions as follows:
-
- Implement LOWER PROGRAMMING VOLTAGE Vpp - Subfunction# 04h and FLASH WRITE
- PROTECT - Subfunction# 06h using same routine.
-
- Implement RAISE PROGRAMMING VOLTAGE Vpp - Subfunction# 05h and FLASH WRITE
- ENABLE - Subfunction# 07h using same routine.
-
-
- SECTION - 2
-
-
- HARDWARE IMPLEMENTATION OF FLASH
-
-
- 2.0 SAMPLE HARDWARE IMPLEMENTATION OF FLASH
-
- A sample implementation block diagram of flash is shown in Fig. 3. Please
- note that this is only an example, actual implementation may vary from
- hardware to hardware.
-
-
- In this example, the two bits of an I/O port are used to control the write
- enable signal to flash and A16 inversion. Both these bits must be readable
- as well as writeable. Vpp is connected to 12V always if flash EPROM is a
- 12V part otherwise can be always connected to 5V if flash EPROM is a 5V
- part. For a 12V flash EPROM part, even if Vpp is always connected to 12V,
- the write to flash is controlled by ENFLSHWR# signal. PWD# is connected to
- POWEROK signal to protect boot block from eraser/write.
-
-
- ENFLSHWR#
-
- This signal must be HIGH on reset so that ORing of ENFLSHWR# and MEMW#
- signals will be HIGH thereby disabling any write to flash EPROM. Please
- note that WR# signal on EPROM must be LOW to make flash writeable. So the
- bit used to control ENFLSHWR# signal should be HIGH normally to make flash
- EPROM write protected and must be programmed to LOW to flash EPROM write
- enabled.
-
-
- FLSHSWP
-
- This signal must be LOW on reset so that SA16 signal can reach flash EPROM
- without inversion through the XOR gate. So the bit used to control FLSHSWP
- signal should be LOW on power-on to make boot block (recovery) code appear
- at system address space FE000-FFFFF and must be programmed to HIGH to invert
- A16 line so that main BIOS can be seen at system address space F0000-FFFFF.
-
-
- PWD#
-
- PWD# on flash EPROM will be connected to POWEROK (which is at 5V) thereby
- hardware protecting boot block from eraser/write. The need for connecting
- PWD# to POWEROK instead of directly to Vcc (5V) is explained below:
-
- If PWD# is connected to Vcc (5V), then it is true that boot block is
- protected from eraser/write. But during programming of other blocks of
- flash EPROM, if the programming is stopped for some reason e.g. pressing of
- hardware reset switch (usually present at the front panel of the system),
- then flash EPROM may be left in an undefined state (which may not be the
- normal read array mode state of flash EPROM) thereby causing the system hang.
- To come out of this undefined state, power must be turned off and on again
- thereby resetting the flash EPROM and resetting of flash EPROM will resets
- the flash EPROM to read array mode.
-
-
- So PWD# is connected to POWEROK signal which is ANDing of the POWERGOOD
- signal (which is HIGH normally when power is on) from power supply and the
- RESET signal from the hardware reset switch (which is HIGH normally when
- reset switch is not pressed). So under normal operating condition, POWEROK
- will be HIGH and so PWD# will be HIGH. As soon as hardware reset switch is
- pressed, then RESET signal from hardware reset switch will go LOW thereby
- making the POWEROK signal LOW thereby causing the flash EPROM to enter deep
- power down mode. When hardware reset switch is released, the RESET signal
- from hardware reset switch will go HIGH thereby making the POWEROK signal
- HIGH thereby causing the flash EPROM to come out of deep power down mode.
- The exit from deep power down mode will automatically reset the flash EPROM
- to read array mode.
-
-
- 2.1 NOTES
-
-
- The bits of an I/O Port used in the sample implementation, can be the two
- unused pins of keyboard controller. Note that if unused pin of keyboard
- controller is used, care must be taken to generate proper polarity of the
- concerned signal because usually unused pins of keyboard controller are
- HIGH on power-on.
-
- Even though Vpp is always connected to actual programming voltage as shown
- in Fig. 3, the write to flash is controlled by ENFLSHWR# signal. Of course
- a switching circuit can be very well used to raise/lower Vpp in which case
- another bit (which must be readable and writeable) of I/O Port may be
- needed.
-
-
- [ASCII shit for the rest of the file - OLE picture methinks]
-
-
- parameter blocks and 48K of main block
- ( this usually contain power
- management code,
- VGA BIOS, etc. )
-
-
- [The end]
-
-