GPIOs on it8772E chip

marinaru · Aug 19, 2019, 9:36 PM

Hello all,
I got a N3150 computer made by Acer, and uses a IT8772E chip for I/O (fans/led etc).
Using ACPI I only get one thermal sensor, that's off (and doesn't change), and I can see basically nothing else.
The chip has two GPIO breakouts on the pcb, and I'd very much like to use them to control two relays.
I've tried superiotool and it reports the chip under 0x2E address.
I've tried compiling and loading acpi_ibm but no luck. I think I need to modify the address of the chip somewhere.
The GPIO pins are 63 and 64.
Forgot to mention that I also compiled mbmon but doesn't find anything, even with -p it87.
Attached the datasheet for the chip, and some relevant info:
*can't seem to add the pdf. searching for IT8772E pdf should bring it up.

stephenw10 · Aug 20, 2019, 6:11 PM

How do you know those pins are using GP31/32?

Why have you highlighted what looks like UART pads?

The ITE superio chips require more hoop-jumping than the Winbond compatible type but it's not hard to configure them.

Steve

marinaru · Aug 20, 2019, 9:47 PM

I traced them on the pcb. they run direct to the chip, pin 63/64. each one's pair is 1Kohm to ground, so I presume it's for LEDs maybe?
I traced the image for someone else. That's the bios eeprom, I presume uart is for direct access to the chip. GP31/32 are RI/CTS for COM1 on the chip for main role, but can be used as independent GPIO.

stephenw10 · Aug 20, 2019, 10:05 PM

You can write the SuperIO chip directly to set those GPIOs if needed. For example:
https://github.com/stephenw10/WGXepc/blob/7f688371751925586d047bc8a2b13bc03e92b64b/WGXepc.c#L998

Some experimenting probably required.

Steve

marinaru · Aug 21, 2019, 12:52 AM

I tried with WGXepc64 but I get this:

Firebox not detected.
If this is a Firebox it's either one we don't know about or it's running a bios we haven't seen.
Hit the pfSense forums to let us know more.

Should I try to compile your code on freeBSD 11.2? I have pfSense 2.4.4.

superiotool found the chip at 0x2e. and the environment controller at0x0a35. Maybe I could update your script with the correct address?
edit:
also made a dump and got ASL file, but need to do a bit of research on this subject as I can't readily find the GPIO pins. There's no activity on them on bootup or shutdown. They are pulled low. If they are used at bios update, I'll make sure I disconnect them before update.

and this is pciconf -lv:

hostb0@pci0:0:0:0:      class=0x060000 card=0x09531025 chip=0x22808086 rev=0x21 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series SoC Transaction Register'
    class      = bridge
    subclass   = HOST-PCI
vgapci0@pci0:0:2:0:     class=0x030000 card=0x09531025 chip=0x22b18086 rev=0x21 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Integrated Graphics Controller'
    class      = display
    subclass   = VGA
ahci0@pci0:0:19:0:      class=0x010601 card=0x09531025 chip=0x22a38086 rev=0x21 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series SATA Controller'
    class      = mass storage
    subclass   = SATA
xhci0@pci0:0:20:0:      class=0x0c0330 card=0x09531025 chip=0x22b58086 rev=0x21 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series USB xHCI Controller'
    class      = serial bus
    subclass   = USB
none0@pci0:0:26:0:      class=0x108000 card=0x09531025 chip=0x22988086 rev=0x21 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series Trusted Execution Engine'
    class      = encrypt/decrypt
hdac0@pci0:0:27:0:      class=0x040300 card=0x09531025 chip=0x22848086 rev=0x21 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series High Definition Audio Controller'
    class      = multimedia
    subclass   = HDA
pcib1@pci0:0:28:0:      class=0x060400 card=0x09531025 chip=0x22c88086 rev=0x21 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = 'Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series PCI Express Port'
    class      = bridge
    subclass   = PCI-PCI
pcib5@pci0:0:28:3:      class=0x060400 card=0x09531025 chip=0x22ce8086 rev=0x21 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = 'Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series PCI Express Port'
    class      = bridge
    subclass   = PCI-PCI
isab0@pci0:0:31:0:      class=0x060100 card=0x09531025 chip=0x229c8086 rev=0x21 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series PCU'
    class      = bridge
    subclass   = PCI-ISA
none1@pci0:0:31:3:      class=0x0c0500 card=0x09531025 chip=0x22928086 rev=0x21 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx SMBus Controller'
    class      = serial bus
    subclass   = SMBus
pcib2@pci0:1:0:0:       class=0x060400 card=0x00000000 chip=0x8018111d rev=0x0e hdr=0x01
    vendor     = 'Integrated Device Technology, Inc. [IDT]'
    device     = 'PES12N3A PCI Express Switch'
    class      = bridge
    subclass   = PCI-PCI
pcib3@pci0:2:2:0:       class=0x060400 card=0x00000000 chip=0x8018111d rev=0x0e hdr=0x01
    vendor     = 'Integrated Device Technology, Inc. [IDT]'
    device     = 'PES12N3A PCI Express Switch'
    class      = bridge
    subclass   = PCI-PCI
pcib4@pci0:2:4:0:       class=0x060400 card=0x00000000 chip=0x8018111d rev=0x0e hdr=0x01
    vendor     = 'Integrated Device Technology, Inc. [IDT]'
    device     = 'PES12N3A PCI Express Switch'
    class      = bridge
    subclass   = PCI-PCI

and pciconf -lb:

hostb0@pci0:0:0:0:      class=0x060000 card=0x09531025 chip=0x22808086 rev=0x21 hdr=0x00
vgapci0@pci0:0:2:0:     class=0x030000 card=0x09531025 chip=0x22b18086 rev=0x21 hdr=0x00
    bar   [10] = type Memory, range 64, base 0x80000000, size 16777216, enabled
    bar   [18] = type Prefetchable Memory, range 64, base 0x90000000, size 268435456, enabled
    bar   [20] = type I/O Port, range 32, base 0xf000, size 64, enabled
ahci0@pci0:0:19:0:      class=0x010601 card=0x09531025 chip=0x22a38086 rev=0x21 hdr=0x00
    bar   [20] = type I/O Port, range 32, base 0xf060, size 32, enabled
    bar   [24] = type Memory, range 32, base 0x81715000, size 2048, enabled
xhci0@pci0:0:20:0:      class=0x0c0330 card=0x09531025 chip=0x22b58086 rev=0x21 hdr=0x00
    bar   [10] = type Memory, range 64, base 0x81700000, size 65536, enabled
none0@pci0:0:26:0:      class=0x108000 card=0x09531025 chip=0x22988086 rev=0x21 hdr=0x00
    bar   [10] = type Memory, range 32, base 0x81100000, size 1048576, enabled
    bar   [14] = type Memory, range 32, base 0x81000000, size 1048576, enabled
hdac0@pci0:0:27:0:      class=0x040300 card=0x09531025 chip=0x22848086 rev=0x21 hdr=0x00
    bar   [10] = type Memory, range 64, base 0x81710000, size 16384, enabled
pcib1@pci0:0:28:0:      class=0x060400 card=0x09531025 chip=0x22c88086 rev=0x21 hdr=0x01
pcib5@pci0:0:28:3:      class=0x060400 card=0x09531025 chip=0x22ce8086 rev=0x21 hdr=0x01
isab0@pci0:0:31:0:      class=0x060100 card=0x09531025 chip=0x229c8086 rev=0x21 hdr=0x00
none1@pci0:0:31:3:      class=0x0c0500 card=0x09531025 chip=0x22928086 rev=0x21 hdr=0x00
    bar   [10] = type Memory, range 32, base 0x81714000, size 32, enabled
    bar   [20] = type I/O Port, range 32, base 0xf040, size 32, enabled
pcib2@pci0:1:0:0:       class=0x060400 card=0x00000000 chip=0x8018111d rev=0x0e hdr=0x01
pcib3@pci0:2:2:0:       class=0x060400 card=0x00000000 chip=0x8018111d rev=0x0e hdr=0x01
pcib4@pci0:2:4:0:       class=0x060400 card=0x00000000 chip=0x8018111d rev=0x0e hdr=0x01

stephenw10 · Aug 21, 2019, 1:19 AM

Yeah you would need to develop your own code for those GPIOs. I just meant that as an example of how it can be done. I'm sure it can be done much better than that too, my code is pretty awful!

When I looked at different hardware I used programs to raw read and write to the I/O space to find what was where first.

Steve

marinaru · Aug 21, 2019, 3:30 AM

Yes I was just using your readio64 tool to poke around but have no idea of what I'm doing.
I presume it's not just as simple as writing certain value to 0x2e adrress for example? with writeio I mean.

I'm trying to understand this. superiotool identified the correct ITE chip at 0x2e address. Is that like an address that should be reported by pciconf but it's not (reported by pciconf)?

devinfo -vr:

isab0 pnpinfo vendor=0x8086 device=0x229c subvendor=0x1025 subdevice=0x0953 class=0x060100 at slot=31 function=0 dbsf=pci0:0:31:0 handle=\_SB_.PCI0.SBRG
          isa0
            sc0
            vga0
            atkbdc0
            fdc0
            ppc0
            uart0
                Interrupt request lines:
                    0x4
                I/O ports:
                    0x3f8
            uart1
        unknown pnpinfo vendor=0x8086 device=0x2292 subvendor=0x1025 subdevice=0x0953 class=0x0c0500 at slot=31 function=3 dbsf=pci0:0:31:3 handle=\_SB_.PCI0.SBUS
            I/O ports:
                0xf040-0xf05f
            I/O memory addresses:
                0x81714000-0x8171401f
    unknown pnpinfo _HID=none _UID=0 at handle=\_SB_.PCI0.ISP3.ID3C
    unknown pnpinfo _HID=PNP0C09 _UID=1 at handle=\_SB_.PCI0.SBRG.H_EC (disabled)
    unknown pnpinfo _HID=PNP0C0A _UID=0 at handle=\_SB_.PCI0.SBRG.H_EC.BAT0 (disabled)
    unknown pnpinfo _HID=PNP0C0A _UID=1 at handle=\_SB_.PCI0.SBRG.H_EC.BAT1 (disabled)
    unknown pnpinfo _HID=PNP0C0A _UID=2 at handle=\_SB_.PCI0.SBRG.H_EC.BAT2 (disabled)
    unknown pnpinfo _HID=INT0800 _UID=0 at handle=\_SB_.PCI0.SBRG.FWHD
        I/O memory addresses:
            0xff000000-0xffffffff
    unknown pnpinfo _HID=PNP0000 _UID=0 at handle=\_SB_.PCI0.SBRG.IPIC
        I/O ports:
            0x20-0x21
            0x24-0x25
            0x28-0x29
            0x2c-0x2d
            0x30-0x31
            0x34-0x35
            0x38-0x39
            0x3c-0x3d
            0xa0-0xa1
            0xa4-0xa5
            0xa8-0xa9
            0xac-0xad
            0xb0-0xb1
            0xb4-0xb5
            0xb8-0xb9
            0xbc-0xbd
            0x4d0-0x4d1
    acpi_sysresource0 pnpinfo _HID=PNP0C02 _UID=2 at handle=\_SB_.PCI0.SBRG.LDRC
    attimer0 pnpinfo _HID=PNP0100 _UID=0 at handle=\_SB_.PCI0.SBRG.TIMR
        Interrupt request lines:
            0x0
        I/O ports:
            0x40-0x43
            0x50-0x53
    unknown pnpinfo _HID=MSFT0001 _UID=0 at handle=\_SB_.PCI0.SBRG.PS2K (disabled)
    unknown pnpinfo _HID=MSFT0003 _UID=0 at handle=\_SB_.PCI0.SBRG.PS2M (disabled)
    acpi_sysresource1 pnpinfo _HID=PNP0C02 _UID=0 at handle=\_SB_.PCI0.SBRG.SIO1
    unknown pnpinfo _HID=PNP0C08 _UID=0 at handle=\_SB_.PCI0.SBRG.GPIO (disabled)
    unknown pnpinfo _HID=PNP0C08 _UID=1 at handle=\_SB_.PCI0.SBRG.SHWM (disabled)
    acpi_sysresource2 pnpinfo _HID=PNP0C02 _UID=44258 at handle=\_SB_.PCI0.ACE2
    unknown pnpinfo _HID=80860F14 _UID=1 at handle=\_SB_.PCI0.SDHA (disabled)
    unknown pnpinfo _HID=INT33BB _UID=2 at handle=\_SB_.PCI0.SDHB (disabled)
    unknown pnpinfo _HID=BCM43241 _UID=0 at handle=\_SB_.PCI0.SDHB.BRCM (disabled)
    unknown pnpinfo _HID=80860F14 _UID=3 at handle=\_SB_.PCI0.SDHC (disabled)
    unknown pnpinfo _HID=INTL9C60 _UID=1 at handle=\_SB_.PCI0.GDM1 (disabled)
    unknown pnpinfo _HID=INTL9C60 _UID=2 at handle=\_SB_.PCI0.GDM3 (disabled)
    unknown pnpinfo _HID=80862288 _UID=1 at handle=\_SB_.PCI0.PWM1 (disabled)
    unknown pnpinfo _HID=80862288 _UID=2 at handle=\_SB_.PCI0.PWM2 (disabled)
    unknown pnpinfo _HID=8086228A _UID=1 at handle=\_SB_.PCI0.URT1 (disabled)
    unknown pnpinfo _HID=BCM2E1A _UID=0 at handle=\_SB_.PCI0.URT1.BTH0 (disabled)
    unknown pnpinfo _HID=BCM2E64 _UID=0 at handle=\_SB_.PCI0.URT1.BTH1
    unknown pnpinfo _HID=8086228A _UID=2 at handle=\_SB_.PCI0.URT2 (disabled)
    unknown pnpinfo _HID=BCM4752 _UID=0 at handle=\_SB_.PCI0.URT2.GPS0 (disabled)
    unknown pnpinfo _HID=BCM4752 _UID=0 at handle=\_SB_.PCI0.URT2.GPS1
    unknown pnpinfo _HID=8086228E _UID=1 at handle=\_SB_.PCI0.SPI1 (disabled)
    unknown pnpinfo _HID=AUTH2750 _UID=0 at handle=\_SB_.PCI0.SPI1.FPNT (disabled)
    unknown pnpinfo _HID=8086228E _UID=2 at handle=\_SB_.PCI0.SPI2 (disabled)
    unknown pnpinfo _HID=8086228E _UID=3 at handle=\_SB_.PCI0.SPI3 (disabled)
    unknown pnpinfo _HID=NXP1002 _UID=1 at handle=\_SB_.PCI0.NFC2 (disabled)
    unknown pnpinfo _HID=808622C1 _UID=1 at handle=\_SB_.PCI0.I2C1 (disabled)
    unknown pnpinfo _HID=SMO91D0 _UID=1 at handle=\_SB_.PCI0.I2C1.SHUB
    unknown pnpinfo _HID=808622C1 _UID=2 at handle=\_SB_.PCI0.I2C2 (disabled)
    unknown pnpinfo _HID=10EC5670 _UID=1 at handle=\_SB_.PCI0.I2C2.RTEK (disabled)
    unknown pnpinfo _HID=IMPJ0002 _UID=1 at handle=\_SB_.PCI0.I2C2.IMP2 (disabled)
    unknown pnpinfo _HID=IMPJ0003 _UID=1 at handle=\_SB_.PCI0.I2C2.IMP3 (disabled)
    unknown pnpinfo _HID=808622C1 _UID=3 at handle=\_SB_.PCI0.I2C3 (disabled)
    unknown pnpinfo _HID=none _UID=0 at handle=\_SB_.PCI0.I2C3.CLK0
    unknown pnpinfo _HID=INT33F7 _UID=1 at handle=\_SB_.PCI0.I2C3.CAMD (disabled)
    unknown pnpinfo _HID=808622C1 _UID=4 at handle=\_SB_.PCI0.I2C4 (disabled)
    unknown pnpinfo _HID=none _UID=0 at handle=\_SB_.PCI0.I2C4.CLK0
    unknown pnpinfo _HID=none _UID=0 at handle=\_SB_.PCI0.I2C4.CLK1
    unknown pnpinfo _HID=INTCF1A _UID=1 at handle=\_SB_.PCI0.I2C4.CAM1 (disabled)
    unknown pnpinfo _HID=INT33FB _UID=1 at handle=\_SB_.PCI0.I2C4.CAM2 (disabled)
    unknown pnpinfo _HID=INTCF1C _UID=1 at handle=\_SB_.PCI0.I2C4.STRA (disabled)
    unknown pnpinfo _HID=INT33BE _UID=1 at handle=\_SB_.PCI0.I2C4.CAM3 (disabled)
    unknown pnpinfo _HID=INTCF1C _UID=1 at handle=\_SB_.PCI0.I2C4.STRB
    unknown pnpinfo _HID=808622C1 _UID=5 at handle=\_SB_.PCI0.I2C5 (disabled)
    unknown pnpinfo _HID=MSFT0002 _UID=1 at handle=\_SB_.PCI0.I2C5.TPDC (disabled)
    unknown pnpinfo _HID=808622C1 _UID=6 at handle=\_SB_.PCI0.I2C6 (disabled)
    unknown pnpinfo _HID=ATML7000 _UID=0 at handle=\_SB_.PCI0.I2C6.TSC0 (disabled)
    unknown pnpinfo _HID=ATML1000 _UID=1 at handle=\_SB_.PCI0.I2C6.TCS1
    unknown pnpinfo _HID=MSFT0002 _UID=1 at handle=\_SB_.PCI0.I2C6.TPD1
    unknown pnpinfo _HID=808622C1 _UID=7 at handle=\_SB_.PCI0.I2C7 (disabled)
    unknown pnpinfo _HID=NXP7471 _UID=1 at handle=\_SB_.PCI0.I2C7.NFC1 (disabled)
    unknown pnpinfo _HID=808622D8 _UID=0 at handle=\_SB_.PCI0.IISH (disabled)
    unknown pnpinfo _HID=808622A8 _UID=1 at handle=\_SB_.PCI0.LPEA (disabled)
    unknown pnpinfo _HID=ADMA22A8 _UID=1 at handle=\_SB_.PCI0.LPEA.ADMA (disabled)
    unknown pnpinfo _HID=AMCR22A8 _UID=1 at handle=\_SB_.PCI0.AMCR (disabled)
    unknown pnpinfo _HID=HAD022A8 _UID=1 at handle=\_SB_.PCI0.HAD0 (disabled)
    unknown pnpinfo _HID=808622B7 _UID=0 at handle=\_SB_.PCI0.UOTG (disabled)
    acpi_sysresource3 pnpinfo _HID=PNP0C02 _UID=3 at handle=\_SB_.PCI0.SPRC
    acpi_sysresource4 pnpinfo _HID=PNP0C02 _UID=1 at handle=\_SB_.PCI0.PDRC
    pci_link0 pnpinfo _HID=PNP0C0F _UID=1 at handle=\_SB_.LNKA
    pci_link1 pnpinfo _HID=PNP0C0F _UID=2 at handle=\_SB_.LNKB
    pci_link2 pnpinfo _HID=PNP0C0F _UID=3 at handle=\_SB_.LNKC
    pci_link3 pnpinfo _HID=PNP0C0F _UID=4 at handle=\_SB_.LNKD
    pci_link4 pnpinfo _HID=PNP0C0F _UID=5 at handle=\_SB_.LNKE
    pci_link5 pnpinfo _HID=PNP0C0F _UID=6 at handle=\_SB_.LNKF
    pci_link6 pnpinfo _HID=PNP0C0F _UID=7 at handle=\_SB_.LNKG
    pci_link7 pnpinfo _HID=PNP0C0F _UID=8 at handle=\_SB_.LNKH
    unknown pnpinfo _HID=PNP0C0D _UID=0 at handle=\_SB_.LID0 (disabled)
    unknown pnpinfo _HID=PNP0C14 _UID=0 at handle=\_SB_.WMID
    unknown pnpinfo _HID=none _UID=0 at handle=\_SB_.USBC
    acpi_button0 pnpinfo _HID=PNP0C0C _UID=0 at handle=\_SB_.PWRB
    acpi_button1 pnpinfo _HID=PNP0C0E _UID=0 at handle=\_SB_.SLPB
    unknown pnpinfo _HID=INT0002 _UID=1 at handle=\_SB_.GPED (disabled)
    unknown pnpinfo _HID=INT33FF _UID=1 at handle=\_SB_.GPO0 (disabled)
    unknown pnpinfo _HID=INT33FF _UID=2 at handle=\_SB_.GPO1 (disabled)
    unknown pnpinfo _HID=INT33FF _UID=3 at handle=\_SB_.GPO2 (disabled)
    unknown pnpinfo _HID=INT33FF _UID=4 at handle=\_SB_.GPO3 (disabled)
    unknown pnpinfo _HID=INTCFD9 _UID=0 at handle=\_SB_.TBAD (disabled)
    unknown pnpinfo _HID=INT3497 _UID=0 at handle=\_SB_.PIND (disabled)
    unknown pnpinfo _HID=MSFT0101 _UID=1 at handle=\_SB_.TPM_
        I/O memory addresses:
            0x7ff00000-0x7ff00fff
    unknown pnpinfo _HID=none _UID=0 at handle=\_TZ_.FN00
    unknown pnpinfo _HID=PNP0C0B _UID=0 at handle=\_TZ_.FAN0
    acpi_tz0 pnpinfo _HID=none _UID=0 at handle=\_TZ_.TZ01
    acpi_timer0 pnpinfo unknown at unknown
        ACPI I/O ports:
            0x408-0x40b

_SB_.PCI0.SBRG.GPIO (disabled)

I looked in ASL file and found:

Device (GPIO)
                {
                    Name (_HID, EisaId ("PNP0C08") /* ACPI Core Hardware */)  // _HID: Hardware ID
                    Name (_UID, Zero)  // _UID: Unique ID
                    Name (LDN, 0x07)
                    Method (_STA, 0, NotSerialized)  // _STA: Status
                    {
                        Return (Zero)
                    }
                }

Datasheet states that they are writable if LDN = 07h. That seems to be the definition that's in the bios if it dumped everything.
Funnily enough I found definitions for BCM4752 which is a GPS receiver. I guess they used the bios in other embedded systems.
So does this mean they can't be accessed?

marinaru · Aug 21, 2019, 6:10 AM

after loading ichsmb module this:

unknown pnpinfo vendor=0x8086 device=0x2292 subvendor=0x1025 subdevice=0x0953 class=0x0c0500 at slot=31 function=3 dbsf=pci0:0:31:3 handle=\_SB_.PCI0.SBUS
            I/O ports:
                0xf040-0xf05f
            I/O memory addresses:
                0x81714000-0x8171401f

changed to this:

ichsmb0 pnpinfo vendor=0x8086 device=0x2292 subvendor=0x1025 subdevice=0x0953 class=0x0c0500 at slot=31 function=3 dbsf=pci0:0:31:3 handle=\_SB_.PCI0.SBUS
            Interrupt request lines:
                0x12
            I/O ports:
                0xf040-0xf05f
            I/O memory addresses:
                0x81714000-0x8171401f
          smbus0
            smb0

still no /dev/led or /dev/gpio

stephenw10 · Aug 21, 2019, 2:03 PM

You will not find any driver existing for the GPIO pins on that chip. If it had been using the SoC GPIOs one of the existing FreeBSD drivers may have worked.

@marinaru said in GPIOs on it8772E chip:

I presume it's not just as simple as writing certain value to 0x2e adrress for example? with writeio I mean.

It pretty much is that simple. There are hoops to jump through though. Not being able to dump the registers with superiotool makes it more complex as you have to explore it manually. But you would want to do something like:

Put the chip in extended config mode (mbpnp mode for ITE).
Select logical device 7.
Check the GPIOs are set as a GPIO and are set as output.
Set the output registers.
Leave config mode.

You can do all that using writeio64 initially. I haven't read the specific data sheet for that chip but I doubt it's much different to the IT8718 I was working with.

Steve

stephenw10 · Aug 21, 2019, 6:54 PM

Ok the access sequence looks the same the same so you should be able to do this.
Be sure not to have the dashboard up or anything else that might be reading the superio chip or you will see the chip leave mbpnp mode all the time with confusing results.

Be aware that messing with the superio chip that controls the cooling and can control the power is potentially risky!

Set the chip in mbpnp mode:

./writeio64 2e 87
./writeio64 2e 01
./writeio64 2e 55
./writeio64 2e 55

Make sure you are looking at the correct chip and it's responding as expected.
Read the Chip ID:

./writeio64 2e 20
./readio64 2f
./writeio64 2e 21
./readio64 2f

Should return 87 72

Set LDN 7 so we can check the GPIOs

./writeio64 2e 07
./writeio64 2f 07

Read the config registers for GPIO set 3:

./writeio64 2e 27
./readio64 2f
./writeio64 2e ba
./readio64 2f
./writeio64 2e ca
./readio64 2f
./writeio64 2e f8
./readio64 2f
./writeio64 2e f9
./readio64 2f
./writeio64 2e fa
./readio64 2f
./writeio64 2e fb
./readio64 2f

Check that output against the data sheet to make sure the GPIOs are configured correctly.

Leave mbpnp mode:

./writeio64 2e 02
./writeio64 2f 02

Steve

marinaru · Aug 21, 2019, 11:02 PM

./writeio64 2e 20
./readio64 2f
./writeio64 2e 81
./readio64 2f

I presume it's 21 not 81. it reads the correct chip.

Reading 2f :87
Reading 2f :72

so basically you are writing a command (byte) to 2e, and that command makes the chip do stuff, and then serves the info in 2f?

Is this something like bit-banging? When no drivers/functions available, just directly access the memory?

stephenw10 · Aug 21, 2019, 11:05 PM

Yup, sorry typo'd that.

Yes, there's no driver so just write directly. Since speed is not really required here it's not a problem.

Steve

marinaru · Aug 22, 2019, 4:23 AM

./writeio64 2e 27
Setting 2e to 27
./readio64 2f
Reading 2f :e

Index 27 is 0x0e. That means 0000 1110? Are these 8th - 1st? If so, then GP31/32/33 are enabled as GPIO by default. Which is good, means there's another pin on board, and I suspect it's the one right next to the other two I was trying to initially control.
The other indexes are blank 00h, as per datasheet.
So far so good, and I understood what I'm doing.

Where did you get the info to put the chip in mbpnp mode (and what's that?)?
*edit: got it at page 25 :

So I need CAh to 0x0E so I output on these 3 gpio, instead of input. They are always bit 1/2/3 for GP64/63/62 in each index? As in every bit 1 of each index (that's of interest in LDN 07) is always for GP64 let's say?
I don't understand Index C2h, 1 - simple I/O function, 0 - Alternate function. Isn't that defined in Index 27h?
I don't understand which Index deals with on/off 0/1 on the gpio pins.
Also, if I want to modify CAh index to set GP31-33 as output, I use let's say:

./writeio64 2e ca
./writeio64 2f e

Ok, so I managed to get them to flash! I used the alternate function, set to 1hz rate, set as output and pulled high, otherwise it wouldn't work. Also used the location mapping table for which gpio to flash.
Now looking at using on/off. So far so good!
Got it!!!
So I'm using B2h index (LDN=07h) which is the gpio polarity, inverting/non-inverting. That way I can turn them on and off.
Going to check the second GPIO pin, and then check if I also have the third next to them.
Thank you so much for making me understand! Also your tools rock! Thank you very much for them!

And here's the moneyshot:

Thing is, if I want to control them separately, I basically have to keep track of the other as I write to the memory.
So this is the shortest sequence:

./writeio64 2e 87
./writeio64 2e 01
./writeio64 2e 55
./writeio64 2e 55

./writeio64 2e 07
./writeio64 2f 07

./writeio64 2e ba
./writeio64 2f 6 // 2 turns on GP31 and GP32 off, 4 turns GP31 off and GP32 on, 6 turns both on, 0 turns both off

./writeio64 2e 02
./writeio64 2f 02

Tried to make a bash script but if I use /bin/sh /root/script I get some errors:

#!/bin/sh
/bin/sh /root/writeio64 2e 87
/bin/sh /root/writeio64 2e 01
/bin/sh /root/writeio64 2e 55
/bin/sh /root/writeio64 2e 55
/bin/sh /root/writeio64 2e 07
/bin/sh /root/writeio64 2f 07
/bin/sh /root/writeio64 2e ba
/bin/sh /root/writeio64 2f 2
/bin/sh /root/writeio64 2e 02
/bin/sh /root/writeio64 2f 02

: not found
/root/writeio64: 1: Syntax error: word unexpected (expecting ")")
/root/writeio64: 5: Syntax error: Error in command substitution

works with ./writeio64... tho

#!/bin/sh
./writeio64 2e 87
./writeio64 2e 01
./writeio64 2e 55
./writeio64 2e 55
./writeio64 2e 07
./writeio64 2f 07
./writeio64 2e ba
./writeio64 2f 6
./writeio64 2e 02
./writeio64 2f 02

As you can see in the picture, the wifi board is powered from 12V from the atx unpopulated socket. I checked the mosfets powering it and they are more than capable for the job. The PC had a 3.5" HDD, that I replaced for a 2.5" ssd. Issue is that even if I reboot the pfSense machine, the main caps from the wifi board keep it powered for the short time it takes the PC to power back on, and I can't reboot the wifi board by rebooting the pfSense machine. Also shouldn't be a problem as the wifi board is fused.
I think I'll use two relays and a timer for each board (two for wifi and two for raspberry) so I implement some kind of crude softstart with a resistor. PC's power supply is swiched and can deliver too much current. If I turn on the wifi board after the PC starts, I get a brownout and PC resets. Those wifi main caps draw large current at startup. Original power supply brick for the wifi was a linear transformer. Don't want to bust the pfSense machine.

stephenw10 · Aug 22, 2019, 1:41 PM

Nice!

Yeah the ITE chip is weird compared with Winbond and clones of that. I mean:

0: Input mode
1: Output mode

What drugs were they on that day?!

But also it doesn't have a register to directly set the output. Instead you set the default pull up or pull down and then set the invert register. Or at least that's what I did on the one box I have with one of these.

Setting the complete register using a hex value is a hack. If you look at 'real' code what you should do is use a bit-mask so you you are only setting whatever bits you needs to and others remain unchanged. I've never had to do that in that program I wrote as it only runs at boot. I'm not sure I've seen it done in a shell script rather than in C but it probably is possible.

You should only need to use ./ in the script if you're running from the command line and in that folder. Otherwise I have used just:

#!/bin/sh
/writeio64 2e 87
/writeio64 2e 01
/writeio64 2e 55
/writeio64 2e 55
....

Do you have a serial console between those boards internally?

Steve

marinaru · Aug 22, 2019, 4:44 PM

Yes I was thinking at masking, just flipping the needed bit, but it works this way. With two GPIOs it's doable. More would become cumbersome.
There's only the ethernet cable linking the pfSense machine and the wifi board (it's a tplink wdr-4300 that I pulled out of it's enclosure and 3D printed some standoffs for the case) and it's running openwrt. Good enough for my needs.
I guess I could link them via USB but no need at the moment.

stephenw10 · Aug 22, 2019, 5:00 PM

Mmm, might be fun to connect the TTL serial header an the TPLink to that UART1 header on the Acer board. You'd have to check that is also TTL but it would give you much better access to OpenWRT.

Steve

marinaru · Aug 22, 2019, 5:41 PM

that would be nice to explore.
I see a uart port on the wifi board:

I mean I suppose it's one as it's near the eeprom.
I need to sniff both out and see if there's any relevant info.
Is there direct access to the UART of the Acer board? From freeBSD?

stephenw10 · Aug 22, 2019, 7:24 PM

Yes, it would probably be:

cu -l cuau1 -s 115200

Assuming cuau0 is an external serial port. But you could easily change that for whatever port it is.

You can also add a line to the remotes file so you can use 'tip' instead. You have to add a one-line script to replace it at each boot but it makes it very easy:

[2.4.4-RELEASE][root@pfsense.fire.box]/root: tip switch
connected

General Commands:
-----------------
Help/?: Get help on a group or a specific command
Up    : Move one command level up
Logout: Exit CLI

Command Groups:
---------------
System      : System settings and reset options
IP          : IP configuration and Ping
Port        : Port management
MAC         : MAC address table
VLAN        : Virtual LAN
PVLAN       : Private VLAN
Security    : Security management
STP         : Spanning Tree Protocol
Aggr        : Link Aggregation
LACP        : Link Aggregation Control Protocol
LLDP        : Link Layer Discovery Protocol
EEE         : Energy Efficient Ethernet
QoS         : Quality of Service
Mirror      : Port mirroring
Config      : Load/Save of configuration via TFTP
Firmware    : Download of firmware via TFTP
Loop Protect: Loop Protection
IPMC        : MLD/IGMP Snooping
Debug       : Switch debug facilities

Type '<group>' to enter command group, e.g. 'port'.
Type '<group> ?' to get list of group commands, e.g. 'port ?'.
Type '<command> ?' to get help on a command, e.g. 'port mode ?'.
Commands may be abbreviated, e.g. 'por co' instead of 'port configuration'.
>

Steve

marinaru · Aug 23, 2019, 4:33 AM

I'll have a look at it this weekend.
Are there standard commands for controlling the wifi board? Or maybe chipset dependent?
*edit:
I found this:
https://github.com/freebsd/freebsd-wifi-build/wiki/TPLink-TL-WDR3600
Does this mean that freeBSD knows the chips? Mine has the same hardware. I don't need NAT or firewall. All that is managed from pfSense.

stephenw10 · Aug 23, 2019, 6:48 PM

Linking the com ports would give you access to OpenWRTs command line should you ever be locked out of it's network ports for some reason. So you can do there whatever OpenWRT will allow which is pretty much everything, the webgui is optional in OpenWRT. It doesn't mean pfSense would be aware of any of the wifi hardware on the TP-Link.

It would be interesting to try running FreeBSD on the TP-Link directly but I would expect significant effort there to get anything working and less functionality than OpenWRT. I would only try that as a project.

Steve