Attention! This document is compiled from various sources and may contain errors! Use it on your own risk.

KB has 64KB address space which can be accessed via I/O ports 0x381 — 0x383. To access some byte from KB memory you have to put high and low bytes of address (which is unsigned short integer) into ports 0x381 and 0x382 correspondingly, first high-byte then low-byte. After that you can read/write value from port 0x383.

Address map

| Abbreviation | Full name | Address range | |:-----------------|:--------------|:------------------| | Flash | Program space mapped to system BIOS | 0x0000 — 0xF3FF | | XRAM | Embedded SRAM | 0xF400 — 0xFBFF | | GPIO | General Purpose IO (include ADC, DAC) | 0xFC00 — 0xFC7F | | KBC | Keyboard Controller | 0xFC80 — 0xFC9F | | IKB | Internal KB | 0xFCA0 — 0xFDFF | | PWM | Pulse Width Modulation | 0xFE00 — 0xFE1F | | FAN | Fan Controller | 0xFE20 — 0xFE4F | | GPT | General Purpose 16-bit timer | 0xFE50 — 0xFE6F | | SDI | SPI Device Interface | 0xFE70 — 0xFE7F | | WDT | Watchdog Timer | 0xFE80 — 0xFE8F | | LPC | Low Pin Count | 0xFE90 — 0xFE9F | | XBI | X-BUS Interface | 0xFEA0 — 0xFECF | | XIO | IO Expender | 0xFED0 — 0xFEDF | | PS2 | PS2 | 0xFEE0 — 0xFEFF | | EC | Embedded Controller (hardware EC Space) | 0xFF00 — 0xFF1F | | GPWU | General Purpose wakeup (hardware EC Space) | 0xFF20 — 0xFE7F | | SMBus | System Management Bus (hardware EC Space) | 0xFF80 — 0xFFFF |

Known locations

0xF451

CPU temperature

0xF463

PWM (Pulse Width Modulator) in percents, 0% means that FAN is off, 100% — fan rotating on maximum speed.

0xF466 and 0xF467

High and low bytes of fan speed (revolutions per minute).

Suspicious locations

Battery charge level

KB uses ADC (Analog to Digital Converter) to obtain values from battery chip. Register 0xFF15 (ADDAEN) contains information about enabled DAC (bit_4 — bit_7) and ADC (bit_0 — bit_3). It looks like battery uses ADC channels 0, 2 and 3 (i.e. bit_0|bit_2|bit_3). To obtain converted digital values registers 0xFF18 (ADCTRL) and 0xFF19 (ADCDAT) should be used.

Control register ADCTRL has the following structure: | bit | meaning | |:--------|:------------| | 0 | put «1» to start ADC converter and enable ADC converter interrupt | | 1 | ADC test mode | | 2,3 | put here number of ADC-channel | | 4 — 7 | RESERVED |

After setting ADCTRL-register ADC Data output port (ADCDAT) will contain converted ADC value.