Sometimes a BIOS chip reads perfectly but refuses to be erased or written. The programmer reports a verification failure, or the chip comes back unchanged after a "successful" write. The cause is usually not a faulty chip but its write protection: a few bits in the chip's status register, sometimes combined with the WP pin, that tell it to ignore erase and program commands for some or all of its memory. This guide explains those bits and how to clear them safely.
The status register
Every SPI flash chip has one or more status registers — small internal registers that report the chip's state and hold its configuration. The programmer reads them with a dedicated command and can write some of them with another. The layout below follows the widely used Winbond-style arrangement; other manufacturers use similar ideas with some bits in different places, so always check the datasheet for your exact chip.
Status register 1 (typical layout)
| Bit | Name | Meaning |
|---|---|---|
| 0 | BUSY / WIP | Chip is busy with an erase or write |
| 1 | WEL | Write enable latch — set before each write or erase |
| 2–4 | BP0–BP2 | Block protect: how much of the memory is protected |
| 5 | TB | Top/bottom: whether protection starts from the top or bottom |
| 6 | SEC | Sector or block granularity for protection |
| 7 | SRP0 | Status register protect, works with the WP pin |
Status register 2 (typical layout)
| Bit | Name | Meaning |
|---|---|---|
| 0 | SRP1 | Further status register protection |
| 1 | QE | Quad enable — repurposes the WP and HOLD pins as data lines |
| 3–5 | LB1–LB3 | One-time lock bits for security registers |
| 6 | CMP | Complement — inverts the protected area |
Converting a register value to bits is quick with the Hex, Decimal and Binary Converter.
How block protection works
The BP bits, together with TB, SEC and CMP, select a protected area — for example the top quarter of the chip, or all of it. Erase and program commands aimed at that area are ignored. Reads still work normally. So a chip with all BP bits set reads perfectly and silently refuses to change.
The WP pin and SRP bits
The status register itself can be protected:
- With SRP0 = 0, the status register can be written freely.
- With SRP0 = 1 and the WP pin low, the status register cannot be changed — hardware protection.
- With SRP0 = 1 and WP high, it can be changed.
- Some combinations with SRP1 make the protection last until power is removed, or permanent.
On a laptop board, WP is usually tied high through a resistor, or controlled by the chipset. When reading in circuit, the board's state of WP matters; when the chip is out of circuit in a programmer socket, the adapter normally holds WP high.
The QE bit
When QE is set, the chip uses its WP and HOLD pins as extra data lines for fast quad reads. In that mode, the WP pin no longer acts as write protect. Laptop chipsets often use quad reads, so QE may be set on a chip read from a board. Programmers handle this, but be aware that clearing QE on a chip that the board expects to read in quad mode can stop the board starting. Leave QE as it was unless you know why to change it.
Lock bits
LB bits lock the chip's small security registers permanently. They do not affect the main memory. Once set they cannot be cleared; that is by design.
Symptoms of write protection
| Symptom | Likely cause |
|---|---|
| Read works, erase does nothing | BP bits protecting the area |
| Write "succeeds" but verify fails | Protected area ignored the write |
| Cannot change the status register | SRP with WP low, or permanent protection |
| Only part of the chip changes | Partial block protection |
Clearing protection safely
- Read and save the chip first, twice, with matching checksums.
- Read the status registers with the programmer software or flashrom.
- Note the original values — you may want to restore them after writing.
- Make sure WP is high, or the chip is in a socket.
- Clear the BP bits (and CMP if set) by writing the status register.
- Erase, write and verify the image.
- Restore protection bits if the board's design expects them.
Most programmer software clears block protection automatically before writing; flashrom does so for many chips. When it does not, the steps above apply. Using flashrom is covered in Using flashrom on Linux to Read a Laptop BIOS Chip.
Reading the registers in practice
Most programmer applications have a menu item or button to show the status registers; flashrom prints protection information in verbose mode and can change protection on chips it supports. Record the raw values in hexadecimal before changing anything — they are the quickest way to restore the original state and to compare with what the board had.
Protection set by the firmware
On a working laptop, the firmware itself may set protection bits during start-up so that malware cannot rewrite the chip from the operating system. A chip read from such a board shows protection bits that were set deliberately. When you write a new image, the firmware will usually set them again at the next start; there is no need to set them by hand. If a board behaves differently after a write, compare the register values with the original read.
Manufacturer differences
Not every chip uses the same bit layout. Macronix, for example, places its quad-enable and status-register write-disable bits differently from the Winbond-style layout above. GigaDevice follows a layout close to Winbond's on many parts. The datasheet for the exact chip is the only reliable reference; the families are introduced in SPI Flash Chips Explained: The 25-Series BIOS Memory, and the concept under write protection.
When protection is not the problem
If the chip will not write even with protection cleared:
- check that WP and HOLD are really at their inactive levels during the write;
- check the supply voltage during erase, which draws more current than reading;
- suspect the connection — see CH341A Cannot Detect the Chip: Causes and Fixes;
- finally, suspect the chip itself.
Example: a chip that would not take a new image
A technician writes a corrected image to a 16 MB chip; verification fails in the upper part of the chip. Reading the status register shows BP bits set to protect the top quarter. The chip is in a socket, so WP is held high. Clearing the BP bits, then erasing and writing again, gives a clean verify. The original status register values are noted and restored, matching what the board had before.
FAQ
Why does my chip read but not write?
Block protection bits in the status register are probably set, or WP is holding the register locked.
Is it safe to clear the BP bits?
Yes, after saving the chip's content and its register values. Restore them afterwards if needed.
What does QE do?
It enables quad mode, turning WP and HOLD into data pins. Leave it as found unless you know the board's requirements.
Can protection be permanent?
Some modes make the status register permanently locked. That is rare on laptop BIOS chips but possible.
Do all chips use the same bits?
No. Layouts differ between manufacturers. Check the datasheet.
Bottom line
SPI flash chips can protect their memory with BP, TB, SEC and CMP bits, and protect their status register with SRP bits and the WP pin. A chip that reads but will not write is usually protected. Save everything first, read the registers, hold WP high, clear protection, write and verify, then restore the original settings if the board expects them.