diff --git a/spinor.c b/spinor.c
index 7a30307..8cc6e95 100644
--- a/spinor.c
+++ b/spinor.c
@@ -287,6 +287,85 @@ static inline int spinor_info(struct xfel_ctx_t * ctx, struct spinor_pdata_t * p
 	return 0;
 }
 
+static inline uint8_t spinor_read_sr3(struct xfel_ctx_t * ctx, struct spinor_pdata_t * pdat)
+{
+	uint8_t tx[1];
+	uint8_t rx[1];
+
+	tx[0] = 0x15;
+	rx[0] = 0x0;
+	fel_spi_xfer(ctx, pdat->swapbuf, pdat->swaplen, pdat->cmdlen, tx, 1, rx, 1);
+	return rx[0];
+}
+
+static inline int spinor_global_unlock(struct xfel_ctx_t * ctx, struct spinor_pdata_t * pdat)
+{
+	uint8_t cbuf[256];
+	uint32_t clen = 0;
+	uint8_t sr3 = spinor_read_sr3(ctx, pdat);
+
+	/* spi select */
+	cbuf[clen++] = SPI_CMD_SELECT;
+	/* write enable */
+	cbuf[clen++] = SPI_CMD_FAST;
+	cbuf[clen++] = 1;
+	cbuf[clen++] = pdat->info.opcode_write_enable;
+	/* spi deselect */
+	cbuf[clen++] = SPI_CMD_DESELECT;
+
+	/* spi select */
+	cbuf[clen++] = SPI_CMD_SELECT;
+	/* global block/sector unlock */
+	cbuf[clen++] = SPI_CMD_FAST;
+	cbuf[clen++] = 1;
+	cbuf[clen++] = 0x98;
+	/* spi deselect */
+	cbuf[clen++] = SPI_CMD_DESELECT;
+
+	/* spi select */
+	cbuf[clen++] = SPI_CMD_SELECT;
+	/* wait busy */
+	cbuf[clen++] = SPI_CMD_SPINOR_WAIT;
+	/* spi deselect */
+	cbuf[clen++] = SPI_CMD_DESELECT;
+
+	/* spi select */
+	cbuf[clen++] = SPI_CMD_SELECT;
+	/* write enable */
+	cbuf[clen++] = SPI_CMD_FAST;
+	cbuf[clen++] = 1;
+	cbuf[clen++] = pdat->info.opcode_write_enable;
+	/* spi deselect */
+	cbuf[clen++] = SPI_CMD_DESELECT;
+
+	/* spi select */
+	cbuf[clen++] = SPI_CMD_SELECT;
+	/* write status 3 and clear wps bit */
+	cbuf[clen++] = SPI_CMD_FAST;
+	cbuf[clen++] = 2;
+	cbuf[clen++] = 0x11;
+	cbuf[clen++] = sr3 & ~(0x1 << 4);
+	/* spi deselect */
+	cbuf[clen++] = SPI_CMD_DESELECT;
+
+	/* spi select */
+	cbuf[clen++] = SPI_CMD_SELECT;
+	/* wait busy */
+	cbuf[clen++] = SPI_CMD_SPINOR_WAIT;
+	/* spi deselect */
+	cbuf[clen++] = SPI_CMD_DESELECT;
+
+	/* end */
+	cbuf[clen++] = SPI_CMD_END;
+	if(clen <= pdat->cmdlen)
+	{
+		fel_chip_spi_run(ctx, cbuf, clen);
+		return 1;
+	}
+	return 0;
+}
+
+
 static int spinor_helper_init(struct xfel_ctx_t * ctx, struct spinor_pdata_t * pdat)
 {
 	uint8_t cbuf[256];
@@ -370,6 +449,7 @@ static int spinor_helper_init(struct xfel_ctx_t * ctx, struct spinor_pdata_t * p
 		if(clen <= pdat->cmdlen)
 		{
 			fel_chip_spi_run(ctx, cbuf, clen);
+			spinor_global_unlock(ctx, pdat);
 			return 1;
 		}
 	}

		/* spi select */
		cbuf[clen++] = SPI_CMD_SELECT;
		/* chip reset */
		cbuf[clen++] = SPI_CMD_FAST;
		cbuf[clen++] = 2;
		cbuf[clen++] = 0x66;
		cbuf[clen++] = 0x99;
		/* spi deselect */
		cbuf[clen++] = SPI_CMD_DESELECT;

		/* spi select */
		cbuf[clen++] = SPI_CMD_SELECT;
		/* wait busy */
		cbuf[clen++] = SPI_CMD_SPINOR_WAIT;
		/* spi deselect */
		cbuf[clen++] = SPI_CMD_DESELECT;

		/* spi select */
		cbuf[clen++] = SPI_CMD_SELECT;
		/* write enable */
		cbuf[clen++] = SPI_CMD_FAST;
		cbuf[clen++] = 1;
		cbuf[clen++] = pdat->info.opcode_write_enable;
		/* spi deselect */
		cbuf[clen++] = SPI_CMD_DESELECT;

		/* spi select */
		cbuf[clen++] = SPI_CMD_SELECT;
		/* write status */
		cbuf[clen++] = SPI_CMD_FAST;
		cbuf[clen++] = 2;
		cbuf[clen++] = OPCODE_WRSR;
		cbuf[clen++] = 0;
		/* spi deselect */
		cbuf[clen++] = SPI_CMD_DESELECT;

		/* spi select */
		cbuf[clen++] = SPI_CMD_SELECT;
		/* wait busy */
		cbuf[clen++] = SPI_CMD_SPINOR_WAIT;
		/* spi deselect */
		cbuf[clen++] = SPI_CMD_DESELECT;

进入fel有多种方式，1，空flash，2，短路flash，3利用系统自带的efex相关指令进入。lock flash仅可能发生在运行部分代码后导致的结果。

@whycan 目前烧录进两块板子都是这个问题，读spinor正常，写入（包括擦除）显示正常，实际是没写（擦除）进去的，排除硬件问题。spinor能读，img能够通过刷机工具刷进去，驱动应该没问题。实在疑惑，解决这个问题好多天了，哈哈哈。谢谢晕哥的解答了，我再研究研究吧。

不排除xfel工具有bug。

写入全是0xFF文件，然后读出来，是否正常？

板子硬件正常，理论上不会写不进去

如果确实想用xfel烧录的话，得曲线解决：

先用官方刷机软件烧进去，然后xfel读出来，再用xfel烧进去（逃