ITE IT8390 (IT8390E-256) programmer "ITE Download Board 4" user manual + firmware, flashing ITE ECs on the cheap

[H34TO]

Recently I've gotten into EC flashing due to my broken laptop(s) and started frantically searching methods for flashing the IT5571E-128 chip on the cheap(due to me beaing a student and not having a job) and noticed that ITE newer chips can be flashed via ISP (In-System Programming) either via SMBus or the KBC (EPP - Enhanced Parallel Port) interface. While these can be achieved with programmers like SVOD4/3 or the RT809H/F those options are WAYYY out of my budget so I was horrified. But recently I stumbled uppon some programmers on aliexpress that claim they can program a variety of ITE chips (inc. the IT5571E chip), these programmers(like the XZZ ITE Programmer, EC ITE RED programmer or ITE Lianyun EC...), all feature the IT8390 (E-256) EC chip.
These programmers are priced reasonably at around 25-30 Euro, so I bought one with some IT5571E-128 to test. But after soldering the chips either to the provided programming board or the motherboard they refuse to communicate with it, first I thought that the programmer is faulty but no, it was the EC chips I bought, bacuse after I connected it to a different(IT8252A) chip it recognised it and was able to read/write it.
After some digging I found out that these are clones of the original ITE flashing board called "ITE Download Board" and on it there is a KBC port not just an SMBus connections, so naturaly I would've like to try and program the chips via the KPC(EPP) interface (maybe they can't be programmed via the SMBus???), so I started searching for the datasheet of the IT8390 and spin up a custom PCB with connections to the KBC pins but couldn't find anything except the user manual of the ITE board and on some russian site the firmware of the chip that was read using an SVOD4(thank you russian guy!)
So I would like to ask whoever is reading this, please help me find a datasheet / pinout for the IT8390 and as an early thank you gift here is the PDF, firmware and program used for the tool attached!
Tags: IT8390, IT5571E, ITE_NewWinFlash, IT8390_Download-Board_User Guide

[DeXXter]

Hello, could you make it work? I'm in the same spot, trying to get a programmer for a reasonable price.

[mon2]

Very interesting thread and topic.

Which EC are you attempting to reflash? Which computer / motherboard are you planning to use for this exercise?

From the readings so far, you can reflash the EC using the proven but expensive tools from the EU. Their solutions appear to use the parallel KBC interface to perform the task. Alternatively, you can use SMBUS but before you can use this interface, a special SMBUS related but special open-key header must be transmitted to the target device. This special header requires timing that cannot be met with the CH341A USB to parallel bridge. Appears to be working with the FTDI USB to parallel interface controllers. Alternatively, use the referenced XZZ based tool which is supported by ITE factory and is built upon their own USB to SMBUS bridge controller.

Be sure the tools are able to reflash your specific target EC before proceeding.

[m1ch43lzm]

I recently bought "ITE Lianyun", uses the same IT8390 chip and software, thanks H34TO ; just packaged differently, looks like a USB stick on a clear case, with 4 wires, attached picture; tried it with 1 IT5570E-128 bought from same seller, soldered on the adapter PCB it came with
After some time figuring out the software, I noticed that I could erase the chip, but it failed programming; reading the data with the same programmer it only programmed few bytes at the start, the rest was FF FF FF (empty)
Adding a 10uF ceramic cap between 3.3V and GND on the purple adapter PCB it helped programming, now it read the chip contents fine after being programmed
Have yet to try reading a working EC in circuit (installed on the motherboard)
The instructions from XZZ IT8390 listings even say to only erase the chip for Lenovo, you know some sellers will sell used EC pulled from who knows which board

Lenovo Intel platform and all EC connected to BIOS do not require writing new programs, only clearing EC is needed.

[nikal]

Very useful tip with the capacitor on the purple board. I bought it too in order to revive a repaired Lenovo after a short circuit that destroyed the EC. I programmed it on board so the capacitor probably wasn't necessary in that case. The thing is that you need some time to accommodate with the programming SW but it works. Price is very low for what it does.

[H34TO]

Hello @m1ch43lzm, I've bought the exact same programmer, and I've given up on trying to flash the mentioned EC, because I couldnt do anything with it, I havent tried adding a cap between the pins, yet, might do it in the future thanks for the tip btw!

[m1ch43lzm]

I wrote a guide here: https://www.badcaps.net/forum/troubl...22#post3846222

There seems to be an issue with the purple board and IT5570E (may be the same with the IT5571E); if the chip is already programmed you can't read it while on the purple board for some reason; it seems that for whatever reason the EC doesn't stop code execution after being told by the programmer, but if you manage to erase it, then you can program it and read it after being programmed, until you disconnect the programmer from USB port, then you have to start over by erasing the chip just in time
The capacitor helps, otherwise it fails programming

But when the chip is already soldered to the motherboard, I tried with a dead CPU board with an IT8987E, it can be read/written properly

[robante15]

I need some guidance. I replaced the ITE8586E chip in a Lenovo L340-15IHR. It previously had a short on the +3VL_EC line, but this is no longer the case after the replacement.

To program it, I bought an XZZ ITE Programmer. I connected it to the battery's CL and CK pins, and when I select TypeAuto, it detects a W25Q128JV, which corresponds to the BIOS SPI ROM. If I read it, I can dump the BIOS from there, but it never shows the ITE.

I desoldered the BIOS so it wouldn't interfere, but now the program always gets stuck on "Please Turn On ITEEC Power".

What do you recommend? Should I remove the EC and try to program it by itself? Or am I doing something wrong? I want to clarify that the chip I got was already programmed, probably with something completely different.

I've also heard that the PCH can program the EC with the MAFS. How would that work?

[m1ch43lzm]

See the guide linked above https://www.badcaps.net/forum/troubl...on#post3846222
Make sure settings are as shown, make sure "Dual flash" is checked, you have to click "Internal Flash" button at the top

Anytime you get stuck at "Please turn on ITEEC power", try unplugging the programmer from USB port, reconnect the programmer, then connect the charger to the motherboard

Alternatively you can just erase the EC, it should program itself from the BIOS (some Lenovo models can do that)

[robante15]

Thank you so much, you're absolutely right, and it worked perfectly with the correct settings.

I was able to flash the EC, and the device is working correctly.

[MTT97]

I'm trying to erase the chip but it's not letting me. I soldered the cable directly to the board, EC_SMB_CK0 & EC_SMB_DA0 were the only EC channels that would detect the chip. My EC chip is it8226e-192 but i think i got a fake one (classic), i think it was able to read it, it's not even empty as i thought.

[m1ch43lzm]

I'm trying to erase the chip but it's not letting me. I soldered the cable directly to the board, EC_SMB_CK0 & EC_SMB_DA0 were the only EC channels that would detect the chip. My EC chip is it8226e-192 but i think i got a fake one (classic), i think it was able to read it, it's not even empty as i thought.

You connected the programmer to an IT8176FN (Chip ID=8176), 64KB, that's most likely a secondary KBC, don't erase it or the keyboard won't work
Find another test points that go to the IT8226

[MTT97]

You connected the programmer to an IT8176FN (Chip ID=8176), 64KB, that's most likely a secondary KBC, don't erase it or the keyboard won't work
Find another test points that go to the IT8226

You're right, thanks for letting me know. I can't seem to be able to detect the it8226 chip, i tried CK0/DA0, CK1/DA1, CK2/DA2 and the only one was reading anything is CK0/DA0 which is for the IT8176FN. I don't know what else to try, maybe i have a bad chip or something else is going on.


Device i'm working on:

Model: Lenovo legion y540 15irh
Model Name: 81SX

Board number/model:
FY515 / 516 / 517 / 518
FY523 / 524 / 525 / 526
(nm-c221 rev 2.0)

EC Chip: it8226e-192 bxa

[m1ch43lzm]

Try temporarily removing Q5820 from the board, it connects EC_SMB_CK0/DAT0 from IT8226E to IT8176E (AG_SMCLK/DAT), see if it detects the IT8226 after that

[MTT97]

Try temporarily removing Q5820 from the board, it connects EC_SMB_CK0/DAT0 from IT8226E to IT8176E (AG_SMCLK/DAT), see if it detects the IT8226 after that

I ended up desoldering the chip off the lenovo board and soldered it to the purple board that came with the programmer, but still no detect in fact the chip would get blazing hot which previously didn't, i think it's a fake and bad chip.

I already had another EC chip from a different seller, this one was listed as pre-programmed according to my board model. I soldered it and the laptop comes on and boots. That being said i still wanted to try out the programmer i bought so i soldered the cables to again to (SMCLK1 & SMDAT1, and 3v cable to +3VALW_R) and this time the programmer was able to detect the chip, i made a backup and erased the chip but turned out the programmer can't detect the chip anymore if it's empty. Luckily my Lenovo Legion (intel) is able to program itself from the bios, and now that the EC chip has data on it again the programmer can detect it just find. Any clue on why that is?

[m1ch43lzm]

So the previous chip was faulty, that explains it
I haven't tried this programmer with IT8226 yet, but since on some Lenovo Intel boards it can program itself from the BIOS if it's blank, you don't need to do anything else