KB38xx/KB39xx

Here are summarized info from Ene KB3700 doc and from output of INDX RAM from ectool

Command

Usual legacy EC commands over 62h/64h port - widely known

Extended EC commands:

You may use EC Index IO mode to access the EC register space (F400h ~FFFFh). The EC Index IO base is set in LPC register FE92h, FE93h. The base address + 1 is index high byte address. The base address + 2 is index low byte address. The base address + 3 is data port for reading from or writing to EC internal register space.

Extended commands:

The system host communicates with 8051 via CMD (0x10h offset), ARG1 (0x11h offset), ARG2 (0x12h offset), and ARG3 (ox13 offset) registers in EC space. A non-zero value of CMD will cause the 8051 P0IE.0 interrupt to take place informing the 8051 firmware, and the 8051 firmware will take the responsibility to carry this command.

Valid CMDs :

• 01h Query Status
• 02h Idle
• 03h Power down
• 04h Init flash write - The 8051 should return OK status to grant host system to write flash. After the completion of this command, the 8051 should enter IDLE mode or reset condition (set CFG (offset 0x14h) bit 0 = 1) to prevent from 8051 fetching instruction code. CFG (offset 0x14h bit 6 - Enable 8051 memory write cycle to off-chip The purpose of this bit is to prevent 8051 firmware from writing to BIOS If not enabled, the 8051 can only access to on-chip peripherals in EC Space.

• enter : ARG1 - if 01 - update all flash content, including 8051 code region, if 02 - update system BIOS, not including 8051 code region.

• exit : CMD 00h ARG1 if 00h - OK, the host can write flash now, if 01h - Error, no AC Adapter (the AC should be plugged during update flash), if 02h - Error, unknown condition.

LPC

There are two memory address segments that are decoded by KB38xx/39xx

1. 000Y_0000h ~ 000F_FFFFh, where Y is selectable to C/E/Fh in register LFMSM(FE91h)
2. FFXX_0000h~FFFF_FFFFh, where XX is selectable to FE/FC/F8/F0/E0/C0/80h in register LFMSM(FE91h).