c0d3z3r0 / i2ite

Tool for talking to ITE ECs via SMBus debug interface (DBGR/SMB)

I2ITE

Tool for talking to ITE ECs via SMBus debug interface (DBGR/SMB).

Wiring

Check your board´s schematics for SDA/SCL on the battery connector. D0 of your FTDI interface goes to SCL, while D1+D2 togeter form SDA.

                                  +---+
+------+                          | 1 |
|   D2 |--+-----------+           | 2 |
|      |  |           |           | 3 |
|   D1 |--+           |           | 4 |
|      |              +-----------| 5 | SDA
|   D0 |--------------------------| 6 | SCL
|      |                          | 7 |
|  GND |--------------------------| 8 | GND
+------+                          | 9 |
                                  +---+
FT2232H/FT4232H/FT232H            Battery connector
                                  (in this example: Clevo L140CU)

Dependencies

I2ITE depends on pyftdi. To be able to really relax the bus and allow other devices to communicate, you should use this additional patch: https://github.com/eblot/pyftdi/pull/314/commits/051ccb2d087fe43e92b9d688cf81649276db1d6b

Example usage

Read some data

$ ./i2ite.py ftdi://ftdi:4232/2 0xff24
ff24: 07

Write some data

$ ./i2ite.py ftdi://ftdi:4232/2 0xffab 0x00

... or in some python shell like ipython:

import i2ite
> i = i2ite.I2ITE("ftdi://ftdi:4232/2")
> i.xram_dump(0, 0x10)
      00 01 02 03  04 05 06 07  08 09 0a 0b  0c 0d 0e 0f
      -- -- -- --  -- -- -- --  -- -- -- --  -- -- -- --
0000: 05 b1 11 34  12 b1 00 00  00 00 00 00  00 00 00 00
0010: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00

License

Copyright (c) 2021 Michael Niewöhner

This is open source software, licensed under GPLv2. See LICENSE file for details.

i2ite's Issues

what binary are you "reverese engineering" here? (help with JTAG instrumentation)

Hi,
I've recently gotten back to poking at it8225e, and I've managed to successfully use i2ec to interact with the JTAG bridge mentioned in the it81202 datasheet to the extent of clocking out 3d 06 00 10 with the IDCODE instruction.
I have further managed to find this file: https://github.com/andestech/nds-openocd/blob/ast-v5_1_0-branch/src/jtag/aice/aice_vendor.c
which seems to add support for directly using JTAG on andes cores (as opposed to targeting their usb adapter like the drivers which they actually upstreamed to OpenOCD), and it would seem that this is precisely the JTAG interface exposed by the bridge (at least for the it81202 for which I have a datasheet) - additionally, that same OpenOCD fork also mentions that 0x1000063d is the JTAG ID for an nds32 CPU core, confirming that ite8225 is indeed similar to it81202 in that way.

I have however been unable to get a satisfactory result from my attempts at manually reading a word using the ACCESS_MEM_W instruction, which using 64 bits for data doesn't even bring the question of how to handle clocking in/out 33 bits by sending out 8 bits at a time.

I have failed to locate the official software from ITE for the purposes of reverse enginnering, but seeing as you're mentioning reverse engineering I gather you may be in possesion of said software and could help me with writing an OpenOCD driver for this peculiar interface, such that one could use andes' OpenOCD fork to debug the core over i2ec or d2ec

no response

Which ITE chip have you try?
I can't get any response from it8585e and it8512e.
How you get i2c slave address ?
It is software configurable from ec bios.