CMOS Memory Map v1.25 June, 1995 [Last Change: 8/13/95] Compiled from multiple sources by Padgett Peterson Corrections/additions/comments to: padgett@tccslr.dnet.mmc.com No guarantees of any kind. Copyrights/Trademarks belong to whoever they may belong to. Found: Algorithm used by IBM in calculating CRC checksums for PS/2 (see bytes 32h-33h). Complex (recursive part is 12 lines of assembly) and not yet validated for every model. Background The CMOS (complementary metal oxide semiconductor) memory is actually a 64 or 128 byte battery-backed RAM memory module that is a part of the system clock chip. Some IBM PS/2 models have the capability for a 2k (2048 byte) CMOS ROM Extension. First used with clock-calender cards for the IBM PC-XT, when the PC/AT (Advanced Technology) was introduced in 1985, the Motorola MC146818 became a part of the motherboard. Since the clock only uses fourteen of the RAM bytes, the rest are available for storing system configuration data. Interestingly, the original IBM-PC/AT (Advanced Technology) standard for the region 10h-3Fh is nearly universal with one notable exception: The IBM PS/2 systems deviate considerably (Note: AMSTRAD 8086 machines were among the first to actively use the CMOS memory available and since they *predate* the AT, do not follow the AT standard). This is just another example of how IBM created a standard, lost control of it, tried to replace it, failed and lost market share in the process. Originally, the IBM PC/AT only made use of a small portion of CMOS memory and was defined in the IBM PC/AT Technical Reference Manual, specifically bytes 10h, 12h, 14h-18h, 2Eh-33h. The balance was left undefined but was quickly appropriated by various BIOS manufacturers for such user-selectable options such as wait states, clock speeds, initial boot drive selection, and password storage. Later, as CMOS memory requirements grew, newer clock chips with 128 bytes of RAM came into use. However the fact remains that once the AT standard was established, only IBM has tried to change the definitions of that first description. Accessing the CMOS The CMOS memory exists outside of the normal address space and cannot contain directly executable code. It is reachable through IN and OUT commands at port number 70h (112d) and 71h (113d). To read a CMOS byte, an OUT to port 70h is executed with the address of the byte to be read and an IN from port 71h will then retrieve the requested information. The following BASIC fragment will read 128 CMOS bytes and print them to the screen in 8 rows of 16 values. CMOS RAM space has an upper limit of 128 bytes because of the structure of port 70: only bits 0-6 are used for addressing, bit 7 is used to enable (0) or disable (1) Non-Maskable Interrupts (NMI) and explains why IBM uses 80h OR
to read/write data & follows with a "throw-away" call. Note that if the CMOS only has 64 bytes available, addressing will generally wrap and addresses from 40h-7Fh will mirror 00h-3Fh. Output will be hexadecimal. 10 CLS 20 FOR i = 0 TO &H7F 30 OUT &H70, i 40 PRINT USING "\ \"; HEX$(INP(&H71)); 50 NEXT i 60 PRINT " " Note: where not otherwise noted, all data points are expressed as BYTES these are eight bit values and are read from MSB to LSB e.g. 0000 0000 0101 1010 binary would be written as 5Ah 7654 3210 where only some bits are used this is represented with Xs e.g bits 5-3 would be shown as 00xx x000 Note: the entries for AMI WinBIOS also apply to AMIBIOS with core dates of 12/15/95 or later Organization of CMOS Memory - Clock 00h-0Eh is defined by the clock hardware and all must follow it. Other manufacturers generally follow the same format as specified for the region 10h - 2Fh. Some also follow the IBM format for 30h-33h but not all (Zenith in particular is different). The first fourteen bytes are dedicated to the MC146818 chip clock functions and consist of ten read/write data registers and four status registers, two of which are read/write and two of which are read only. The format of the ten clock data registers (bytes 00h-09h) is: 00h Seconds (BCD 00-59, Hex 00-3B) Note: Bit 7 is read only 01h Second Alarm (BCD 00-59, Hex 00-3B; "don't care" if C0-FF) 02h Minutes (BCD 00-59, Hex 00-3B) 03h Minute Alarm (BCD 00-59, Hex 00-3B; "don't care" if C0-FF)) 04h Hours (BCD 00-23, Hex 00-17 if 24 hr mode) (BCD 01-12, Hex 01-0C if 12 hr am) (BCD 81-92. Hex 81-8C if 12 hr pm) 05h Hour Alarm (same as hours; "don't care" if C0-FF)) 06h Day of Week (01-07 Sunday=1) 07h Date of Month (BCD 01-31, Hex 01-1F) 08h Month (BCD 01-12, Hex 01-0C) 09h Year (BCD 00-99, Hex 00-63) BCD/Hex selection depends on Bit 2 of register B (0Bh) 12/24 Hr selection depends on Bit 1 of register B (0Bh) Alarm will trigger when contents of all three Alarm byte registers match their companions. The following is the on-chip status register information. 0Ah Status Register A (read/write) (usu 26h) Bit 7 - (1) time update cycle in progress, data ouputs undefined (bit 7 is read only) Bit 6,5,4 - 22 stage divider. 010b - 32.768 Khz time base (default) Bit 3-0 - Rate selection bits for interrupt. 0000b - none 0011b - 122 microseconds (minimum) 1111b - 500 milliseconds 0110b - 976.562 microseconds (default) 0Bh Status Register B (read/write) Bit 7 - 1 enables cycle update, 0 disables Bit 6 - 1 enables periodic interrupt Bit 5 - 1 enables alarm interrupt Bit 4 - 1 enables update-ended interrupt Bit 3 - 1 enables square wave output Bit 2 - Data Mode - 0: BCD, 1: Binary Bit 1 - 24/12 hour selection - 1 enables 24 hour mode Bit 0 - Daylight Savings Enable - 1 enables 0Ch Status Register C (Read only) Bit 7 - Interrupt request flag - 1 when any or all of bits 6-4 are 1 and appropriate enables (Register B) are set to 1. Generates IRQ 8 when triggered. Bit 6 - Periodic Interrupt flag Bit 5 - Alarm Interrupt flag Bit 4 - Update-Ended Interrupt Flag Bit 3-0 ??? 0Dh Status Register D (read only) Bit 7 - Valid RAM - 1 indicates batery power good, 0 if dead or disconnected. Bit 6-0 ??? --------------------------------------------- Organization of CMOS Memory - non-Clock The last two bytes in the first hexadecimal decade (hexade ?) were not specified in the PC/AT but may have the following use on some systems: 0Eh (PS/2) Diagnostic Status Byte Bit 7 - When set (1) indicates clock has lost power Bit 6 - (1) indicates incorrect checksum Bit 5 - (1) indicates that equipment configuration is incorrect power-on check requires that atleast one floppy be installed Bit 4 - (1) indicates error in memory size Bit 3 - (1) indicates that controller or disk drive failed initialization Bit 2 - (1) indicates that time is invalid Bit 1 - (1) indicates installed adaptors do not match configuration Bit 0 - (1) indicates a time-out while reading adaptor ID 0Eh (AMSTRAD) 6 BYTEs time and date machine last used --------------------------------------------- 0Fh Reset Code (IBM PS/2 "Shutdown Status Byte") 00h-03h perform power-on reset 00h software reset or unexpected reset 01h reset after memory size check in real/virtual mode (or: chip set initialization for real mode reentry) 02h reset after successful memory test in real/virtual mode 03h reset after failed memory test in real/virtual mode 04h INT 19h reboot 05h flush keyboard (issue EOI) and jump via 40h:0067h 06h reset (after successful test in virtual mode) (or: jump via 40h:0067h without EOI) 07h reset (after failed test in virtual mode) 08h used by POST during protected-mode RAM test (return to POST) 09h used for INT 15/87h (block move) support 0Ah resume execution by jump via 40h:0067h 0Bh resume execution via IRET via 40h:0067h 0Bh resume execution via RETF via 40h:0067h 0Dh-FFh perform power-on reset --------------------------------------------- The second group of values extends from address 10h to 2Dh. The word at 2Eh-2Fh is a byte-wise summation of the values in these bytes. Most BIOSes will generate a CMOS Checksum error if this value is invalid however many programs ignore the checksum and report the apparent value. The current version of MSD reports my XT as having 20+ MB of extended memory. Where a definiton appears universal, no identification is made. Where the definition is thought to be specific to a manufacturer/model (AMI, AMSTRAD, IBM AT, IBM PS/2) the identification is enclosed in parens. The AMSTAD definitions appear to relate to 8088/8086 (PC and PC/XT class) mchines only. AT class machines appear to adhere to IBM PC/AT fornat. --------------------------------------------- 10h - Floppy Drive Type Bits 7-4 - First Floppy Disk Drive Type 0h No Drive 1h 360 KB 5.25 Drive 2h 1.2 MB 5.25 Drive - note: not listed in PS/2 technical manual 3h 720 KB 3.5 Drive 4h 1.44 MB 3.5 Drive 5h 2.88 MB 3.5 drive 6h-Fh unused Bits 3-0 Second Floppy Disk Drive Type (bit settings same as A) Hence a PC having a 5 1/4 1.2 Mb A: drive and a 1.44 Mb B: drive will have a value of 24h in byte 10h. With a single 1.44 drive: 40h. --------------------------------------------- 11h - (IBM-PS/2) First Fixed Disk Drive Type Byte (00-FFh) Note: if IBM ESDI or SCSI drive controller is used, CMOS drive type will be zero (00 - no drive) and INT 13h will be directed to controller ROM. 11h - (older AMI Hi-Flex BIOS) Keyboard Typematic Data Bit 7 Enable Typematic (1 = On) Bits 6-5 Typematic Delay (wait before begin repeating) 00b 250 ms 01b 500 ms 10b 750 ms 11b 100 ms Bits 4-0 Typematic Rate char/sec e.g. 01010b = 12.0 cps 00000b - 300 01000b - 159 10000b - 75 11000b - 37 00001b - 267 01001b - 133 10001b - 67 11001b - 33 00010b - 240 01010b - 120 10010b - 60 11010b - 30 00011b - 218 01011b - 109 10011b - 55 11011b - 27 00100b - 200 01100b - 100 10100b - 50 11100b - 25 00101b - 185 01101b - 92 10101b - 46 11101b - 23 00110b - 171 01110b - 86 10110b - 43 11110b - 21 00111b - 160 01111b - 80 10111b - 40 11111b - 20 11h - (AMI) Advanced Setup Options bit 7 mouse enabled bit 6 test memory above 1 megabyte bit 5 generate clicks during memory test bit 4 enable memory parity check bit 3 display key for Setup while booting bit 2 store user-defined disk data at top of memory instead of 0030h:0000h bit 1 request F1 keypress on boot error 11h - (AMI WinBIOS) Boot Options bit 7 systems boots with high CPU speed bit 6 memory test above 1MB enabled bit 5 memory test tick sound enabled bit 4 floppy drive seek at boot enabled bit 3 "Hit " message enabled bit 2 BIOS extended RAM area takes 1K at top of memory instead of 30h:0000h bit 1 wait for F1 key on error bit 0 NumLock enabled at boot see also 13h"AMI" 11h - (AWARD) Configuration Bits Bit 7 NumLock ON at reboot. Bit 6 IDE Block Mode enabled. Bit 5 ??? Bit 4 Shadow ROM BIOS at CC00-CFFF Bit 3 Shadow ROM BIOS at C800-CBFF Bit 2 ??? Bit 1 BIOS Password Enabled Bit 0 0 = Password controls BIOS Setup Only 1 = Password required to enter System 11h - (Quadtel HT12 BIOS 03.05.03) configuration bits bit 7 640K RAM present bit 6 extension type (=CPU's Machine Status Word) bit 3-2 NumLock state at boot time 00 Auto 01 NumLock on 10 Numlock off bit 0 384K RAM relocated to top of memory --------------------------------------------- 12h - (IBM PS/2) Second Fixed Disk Drive Type (00-FFh) - see 11h 12h - Hard Disk Data Bits 7-4 First Hard Disk Drive 00 No drive 01-0Eh Hard drive Type 1-14 0Fh Hard Disk Type 16-255 (actual Hard Drive Type is in CMOS RAM 19h) Bits 3-0 Second Hard Disk Drive Type (same as above except extrnded type will be found in 1Ah). A PC with a single type 2 (20 Mb ST-225) hard disk will have 20h in byte 12h Note: some PCs utilizing external disk controller ROMs will use type 0 to disable ROM BIOS (e.g. Zenith 248 with Plus HardCard). --------------------------------------------- 13h (AMI Hi-Flex BIOS) Advanced Setup Options bit 7 Mouse Enabled (1 = On) bit 6 Test Memory above 1 MB (1 = On) bit 5 Memory Test Tick Sound (1 = On) bit 4 Memory Parity Error Check (1 = On) bit 3 Press to Disable Memory Test (1 = On) bit 2 User-Defined Hard Disk (1 = Type 47 data area at address 0:300h) bit 1 Wait for Message if Error (1 = On) bit 0 Turn Num Lock On at boot (1 = On) see also 11h"WinBIOS" 13h (AMI WinBIOS) Peripheral Options bits 7-5 typematic rate 000-111 = 6,8,10,12,15,20,24,30 cps bit 4: numeric processor test enabled 13h (PS/2 MCA) internal POST operations bit 7 POST sets VGA pel information bit 6 RTC battery OK bit 5 invoke ROM BASIC from POST bit 4 POST sets typematic to 30cps/250ms delay instead of 10.9cps/500ms bit 3-2 unused or unknown bit 1 network password installed bit 0 power-on password installed 13h - (AWARD) Configuration Bits bit 7 Set Keyboard Typematic Rate bit 4-6 Keyboard Repeat Rate 000 = 6 cps 001 = 8 cps 010 = 10 cps 011 = 12 cps 100 = 15 cps 101 = 20 cps 110 = 24 cps 111 = 30 cps bit 2-3 Keyboard Typematic Delay 00 = 250 Msec 01 = 500 Msec 10 = 750 Msec 11 = 1000 Msec bit 1 ??? bit 0 Boot Up Floppy Seek --------------------------------------------- 14h - Equipment Byte Bits 7-6 Number of Floppy Drives (system must have at least one) 00b 1 Drive 01b 2 Drives 10b ??? 3 Drives 11b ??? 4 Drives Bits 5-4 Monitor Type 00b Not CGA or MDA (observed for EGA & VGA) 01b 40x25 CGA 10b 80x25 CGA 11b MDA (Monochrome) Bit 3 Display Enabled (1 = On) (turned off to enable boot of rackmount) Bit 2 Keyboard Enabled (1 = On) (turn off to enable boot of rackmount) Bit 1 Math coprocessor Installed (1 = On) Bit 0 Floppy Drive Installed (1 = On) (turned off for rackmount boot) 14h - (AMSTRAD) BYTE user RAM checksum LSB of sum of all user bytes should be AAh --------------------------------------------- 15h - Base Memory in K, Low Byte 15h - (AMSTRAD) WORD Enter key scancode/ASCII code default: 1C0Dh - emulates Return key --------------------------------------------- 16h Base Memory in K, High Byte The value in 15h-16h should be the same as in 0:413h and that returned by Int 12h. A PC having 640k (280h) of conventional memory will return 80h in byte 15h and 02h in byte 16h. --------------------------------------------- 17h - Extended Memory in K, Low Byte 17h - (AMSTRAD) WORD Forward delete key scancode/ASCII code default: 2207h - emulates ^G (bell/beep) --------------------------------------------- 18h - Extended Memory in K, High Byte (some systems will only accommodate 15 Mb extended or 16 Mb total) Format is the same as in 15h-16h --------------------------------------------- 19h - First Extended Hard Disk Drive Type (not in original AT specification but now nearly universally used except for PS/2). 0-Fh unused (would not require extension. Note: this has the effect of making type 0Fh (15d) unavailable. 10h-FFh First Extended Hard Drive Type 16d-255d 19h - (MCA) Slot 0 adapter card ID 19h - (AMI) bits 3-0: ??? bits 7-4: ??? For most manufacturers the last drive type (typically either 47d or 49d) is "user defined" and parameters are stored elsewhere in the CMOS. 19h - (AMSTRAD) WORD Joystick fire button 1 scancode/ASCII code default: FFFFh - (no translation) --------------------------------------------- 1Ah - Second Extended Hard Disk Drive Type (see 19h above) 1Ah - (MCA) Slot 0 adapter card ID --------------------------------------------- 1Bh - (MCA) Slot 1 adapter card ID 1Bh - (AMI) First Hard Disk (type 47) user defined: # of Cylinders, LSB 1Bh - (AMSTRAD) WORD Joystick fire button 2 scancode/ASCII code default: FFFFh - (no translation) 1Bh - (PHOENIX) LSB of Word to 82335 RC1 roll compare register 1Bh - (AWARD) Configuration Bits Bit 7-4 ??? Bit 3 Shadow ROM BIOS at DC00-DFFF Bit 2 " " " " D800-DBFF Bit 1 " " " " D400-D7FF Bit 0 " " " " D000-D3FF --------------------------------------------- 1Ch - (MCA) Slot 1 adapter card ID 1Ch - (AMI) First Hard Disk user defined: # of Cylinders, High Byte 1Ch - (PHOENIX) MSB of Word to 82335 RC1 roll compare register 1Ch,1Dh - (AWARD) Password Stored as a checksum or CRC using unknown algorithm. (See byte 11h to enable) --------------------------------------------- 1Dh - (MCA) Slot 2 adapter card ID 1Dh - (AMI) First Hard Disk user defined: Number of Heads 1Dh - (AMSTRAD) WORD mouse button 1 scancode/ASCII code default: FFFFh - (no translation) 1Dh - (Zenith Z-200 monitor) Boot Drive Selection Bits 6-5 (0xx0 0000) 00 - MFM Monitor 01 - First floppy drive (A:) 10 - First fixed disk (C:) 11 - First floppy drive (A:). If not there then First fixed disk (C:) (this is the default). 1Dh - (PHOENIX) LSB of Word to 82335 RC2 roll compare register 1Dh - (AWARD) MSB of password checksum (see byte 1Ch) 1Dh - (Quadtel HT 12 BIOS) first user def. drive: # of cylinders low byte --------------------------------------------- 1Eh - (MCA) Slot 2 adapter card ID 1Eh - (AMI) First Hard Disk user defined: Write Precompensation Cylinder, Low Byte 1Eh - (PHOENIX) MSB of Word to 82335 RC2 roll compare register 1Eh - (AWARD) 2nd Hard Disk user defined (type 48): # of Cylinders Low Byte 1Eh - (Quadtel HT 12 BIOS) first user def. drive bits 7-4: number of heads bits 3-0: # of cylinders MSB --------------------------------------------- 1Fh - (MCA) Slot 3 adapter card ID 1Fh - (AMI) First Hard Disk user defined: Write Precompensation Cylinder, High Byte 1Fh - (AMSTRAD) WORD mouse button 2 scancode/ASCII code default: FFFFh - (no translation) 1Fh - (AWARD) 2nd Hard Disk user defined (type 48): # of Cylinders High Byte 1Fh - (Quadtel HT 12 BIOS) first user def. drive: write precom. cyl. low byte --------------------------------------------- 20h - (MCA) Slot 3 adapter card ID 20h - (AMI) First Hard Disk user defined: Control Byte bits 7-6 no retries (1) bit 5 bad sector map at last cylinder+1 bit 4 unused (0) bit 3 more than 8 heads bits 2-0 unused (0) 20h - (AMI WinBIOS) First Hard Disk user defined: Landing Zone, Low Byte 20h - (PHOENIX) First user defined hard disk (type 48) Cylinders LSB 20h - (AWARD) 2nd Hard Disk user defined (type 48): Number of Heads 20h - (Quadtel HT 12 BIOS) first user def. drive bits 7-4: landing zone MSB bits 3-0: write precom. cyl. MSB --------------------------------------------- 21h - (MCA) Programmable Option Select configuration byte 2 21h - (AMI) First Hard Disk user defined: Landing Zone, Low Byte 21h - (AMI WinBIOS) First Hard Disk user defined: Landing Zone, High Byte 21h - (AMSTRAD) BYTE mouse X scaling factor, default: 0Ah 21h - (PHOENIX) First user defined hard disk (type 48) Cylinders MSB 21h - (AWARD) 2nd Hard Disk user defined (type 48): Write Precomp Low Byte 21h - (Quadtel HT 12 BIOS) first user def. drive: landing zone low byte --------------------------------------------- 22h - (MCA) Programmable Option Select configuration byte 3 22h - (AMI) First Hard Disk user defined: Landing Zone, High Byte 22h - (AMI WinBIOS) First Hard Disk user defined: # of Sectors per track 22h - (AMSTRAD) BYTE mouse Y scaling factor default: 0Ah 22h - (PHOENIX) First user defined hard disk (type 48) of Heads 22h - (AWARD) 2nd Hard Disk user defined (type 48): Write Precomp High Byte 22h - (Quadtel HT 12 BIOS) first user def. drive: sectors per track --------------------------------------------- 23h - (MCA) Programmable Option Select configuration byte 4 23h - (AMI) First Hard Disk user defined: # of Sectors per track 23h - (AMI WinBIOS) Second Hard Disk user defined: # of Cylinders, Low Byte 23h - (AMSTRAD) BYTE initial VDU mode and drive count default: 20h bit 7: enables extended serial flow control (NB this is buggy) bit 6: set if two floppy drives installed bits 5 & 4: (from Amstrad 1640 tech ref) 0 0 Internal video adapter 0 1 CGA card added; 40 x 25 mode 1 0 CGA card added; 80 x 25 mode 1 1 mono card added; 80 x 25 mode 23h - (PHOENIX) First user defined hard disk (type 48) Write Precomp. LSB 23h - (AWARD) 2nd Hard Disk user defined (type 48): Landing Zone Low Byte 23h - (Quadtel HT 12 BIOS) second user def. drive: # of cylinders low byte --------------------------------------------- 24h - (MCA) Programmable Option Select configuration byte 5 24h - (AMI) Second Hard Disk user defined: # of Cylinders, Low Byte 24h - (AMI WinBIOS) Second Hard Disk user defined: # of Cylinders, High Byte 24h - (AMSTRAD) BYTE initial VDU character attribute, default: 7h 24h - (PHOENIX) First user defined hard disk (type 48) Write Precomp. MSB 24h - (AWARD) 2nd Hard Disk user defined (type 48): Landing Zone High Byte 24h - (Quadtel HT 12 BIOS) second user def. drive bits 7-4: number of heads bits 3-0: # of cylinders MSB --------------------------------------------- 25h - (AMI) Second Hard Disk user defined: # of Cylinders, High Byte 25h - (AMI WinBIOS) Second Hard Disk user defined: Number of Heads 25h - (AMSTRAD) BYTE size of RAM disk in 2K blocks default: 0 - only used by the RAMDISK software supplied. 25h - (PHOENIX) First user defined hard disk (type 48) Parking zone LSB 25h - (AWARD) 2nd Hard Disk user defined (type 48): Sectors per Track 25h - (Quadtel HT 12 BIOS) second user def. drive: write precom. cyl. low byte --------------------------------------------- 26h - (AMI) Second Hard Disk user defined: Number of Heads 26h - (AMI WinBIOS) Second Hard Disk user defined: Write Precompensation Cylinder, Low Byte 26h - (AMSTRAD) BYTE initial system UART setup byte default: E3h - format as for Int 14h fn 0 26h - (PHOENIX) First user defined hard disk (type 48) Parking zone MSB 26h - (AWARD) 1st Hard Disk user defined (type 49): # of Cylinders Low Byte 26h - (Quadtel HT 12 BIOS) second user def. drive bits 7-4: landing zone MSB bits 3-0: write precom. cyl. MSB --------------------------------------------- 27h - (AMI) Second Hard Disk user defined: Write Precompensation Cylinder, Low Byte 27h - (AMI WinBIOS) Second Hard Disk user defined: Write Precompensation Cylinder, High Byte 27h - (AMSTRAD) BYTE initial external UART setup byte default: E3h - format as for Int 14h fn 0 27h - (PHOENIX) First user defined hard disk (type 48) Sectors per track 27h - (AWARD) 1st Hard Disk user defined (type 49): # of Cylinders High Byte 27h - (Quadtel HT 12 BIOS) second user def. drive: landing zone low byte --------------------------------------------- 28h - (AMI) Second Hard Disk user defined: Write Precompensation Cylinder, High Byte 28h - (AMI WinBIOS) Second Hard Disk user defined: Landing Zone, Low Byte 28h - (HP Vectra) checksum over bytes 29h-2Dh 28h - (AWARD) 1st Hard Disk user defined (type 49): Number of Heads 28h - (Quadtel HT 12 BIOS) second user def. drive: sectors per track 28h-3Fh (AMSTRAD) 24 BYTEs user applications default: zeroes --------------------------------------------- 29h - (AMI) Second Hard Disk user defined: Control Byte (80h if # of heads is equal or greater than 8) 29h - (AMI WinBIOS) Second Hard Disk user defined: Landing Zone, High Byte 29h - (PHOENIX) LSB word to Intel 82335 CC0 compare register 29h - (AWARD) 1st Hard Disk user defined (type 49): Write Precomp Low Byte 29h - (HP Vectra) officially reserved "CMOS_HPCONFIG" bit 7: include byte 2Ch in checksum (default = 0) bit 6: select second ROM video adapter as primary (default = 0) bits 5-1: reserved bit 0: manufacturing test enabled --------------------------------------------- 2Ah - (AMI) Second Hard Disk user defined: Landing Zone, Low Byte 2Ah - (AMI WinBIOS) Second Hard Disk user defined: # of Sectors per track 2Ah - (HP Vectra) officially reserved 2Ah - (PHOENIX) MSB word to Intel 82335 CC0 compare register 2Ah - (AWARD) 1st Hard Disk user defined (type 49): Write Precomp High Byte --------------------------------------------- 2Bh - (AMI) Second Hard Disk user defined: Landing Zone, High Byte 2Bh - (AMI WinBIOS) IDE and shadowing control bit 7: LBA mode enabled bit 6: IDE block mode enabled bit 5: 32-bit transfer enabled bit 4: unused bit 3: shadowing of DC00h enabled bit 2: shadowing of D800h enabled bit 1: shadowing of D400h enabled bit 0: shadowing of D000h enabled 2Bh - (HP Vectra) officially reserved 2Bh - (PHOENIX) LSB word to Intel 82335 CC1 compare register 2Bh - (AWARD) 1st Hard Disk user defined (type 49): Landing Zone Low Byte --------------------------------------------- 2Ch - (AMI) Second Hard Disk user defined: # of Sectors per track 2Ch - (AMI WinBIOS) cache control bit 7: external RAM cache enabled bit 6: internal RAM cache enabled bit 5: shadowing of E000h enabled bit 4: shadowing of CC00h enabled bit 3: shadowing of C800h enabled bit 2: shadowing of C400h (video ROM) enabled bit 1: shadowing of C000h (video ROM) enabled bit 0: shadowing of system BIOS (F000h, 64K) enabled 2Ch - (HP Vectra) officially reserved 2Ch - (COMPAQ) bit 6: 0 - numlock OFF on boot, 1 - numlock ON at boot 2Ch - (PHOENIX) MSB word to Intel 82335 CC1 compare register 2Ch - (AWARD) 1st Hard Disk user defined (type 49): Landing Zone High Byte --------------------------------------------- 2Dh - (AMI Hi-Flex BIOS) Configuration Options bit 7 Weitek Installed bit 6 Floppy Drive Seek - turn off for fast boot bit 5 Boot Order 0 - Drive C:, then A: 1 - Drive A:, then C: bit 4 Boot Speed (0 - Low; 1 - High) bit 3 External Cache Enable (1 = On) bit 2 Internal Cache Enable (1 = On) bit 1 Use Fast Gate A20 after boot (1 = On) bit 0 Turbo Switch (1 = On) 2Dh - (AMI WinBIOS) bit 7 Weitek Installed bit 6 bootsector virus protection enabled bit 5 mouse enabled bit 4 password checking (0 setup, 1 always) bit 3 parity error check enabled bits 2-1 boot order (00 = C:A:, 01 = A:C:) bit 0 turbo switch enabled 2Dh - (HP Vectra) officially reserved 2Dh - (PHOENIX) Checks for values AAh or CCh 2Dh - (AWARD) 1st Hard Disk user defined (type 49): Sectors per Track --------------------------------------------- 2Eh - Standard CMOS Checksum, High Byte 2Fh - Standard CMOS Checksum, Low Byte 2Eh and 2Fh are as defined by the original IBM PC/AT specification and represent a byte-wise additive sum of the values in locations 10h-2Dh only, 00h-0Fh and 30h-33h are not included. This definition is used by most clone manufacturers including AMI, Compaq, Tandon, NEC, and Zenith. The IBM PS/2 line does not follow this standard with the range 19h-31h being undefined. On the original HP Vectra, this checksum only covers locations 10h to 20h, with a separate checksum for bytes 29h-2Ch (see offset 28h). --------------------------------------------- 30h - Extended Memory in K, Low Byte --------------------------------------------- 31h - Extended Memory in K, High Byte (this appears to mirror the value in bytes 17h-18h.) --------------------------------------------- 32h - Century Byte (BCD value for the century - currently 19h) 32h - (IBM-PS2) Configuration CRC low byte. CRC for range 10h-31h --------------------------------------------- 33h - Information Flag bit 7 128K (??? believe this indicates the presence of the special 128k memory expansion board for the AT to boost the "stock" 512k to 640k - all machines surveyed have this bit set) bits 6-0 ??? 33h - (IBM PS/2) Configuration CRC high byte (see entry for 32h) 33h - (PHOENIX) Bit 4 (000x 0000) bit 4 from Intel CPU register CR0 33h - (AMI WinBIOS) bit 7: IBM-defined top 128K present bits 6-4 CPU internal clock frequency 000-011 = 25, 33, 40, 50 MHz 100 = 60/66 MHz 101 = 75 MHz 110 = 80 MHz 111 = 90/100 MHz bits 2-1 CPU internal clock multiplier 00-11 = 1,2,3,4 bit 0 FlashROM programming enabled (Ctrl-Home pressed at power on) Note: this location is not included in any CMOS checksum fields 33h - (Quadtel HT12 BIOS 03.05.03) bit 7 = 1 640K RAM present bit 6 = extension type (=CPU's Machine Status Word) bit 1 = 1 print welcome message --------------------------------------------- 34h - (AMI) Shadowing & Boot Password Bits 7-6 Password Selection 00b Disable 10b Reserved 01b Set 11b Boot Bit 5 C8000h Shadow ROM (Bit 1 = On) Bit 4 CC000h Shadow ROM (Bit 1 = On) Bit 3 D0000h Shadow ROM (Bit 1 = On) Bit 2 D4000h Shadow ROM (Bit 1 = On) Bit 1 D8000h Shadow ROM (Bit 1 = On) Bit 0 DC000h Shadow ROM (Bit 1 = On) 24h - (AMI WinBIOS) system-specific information (bits 3-1) 34h-3Ah - (AWARD) ??? unused ??? Defaults to all FFh's. --------------------------------------------- 35h - (AMI) Shadowing bit 7 E0000h Shadow ROM (Bit 1 = On) bit 6 E4000h Shadow ROM (Bit 1 = On) bit 5 E8000h Shadow ROM (Bit 1 = On) bit 4 EC000h Shadow ROM (Bit 1 = On) bit 3 F0000h Shadow ROM (Bit 1 = On) bit 2 C0000h Shadow ROM (Bit 1 = On) bit 1 C4000h Shadow ROM (Bit 1 = On) bit 0 Reserved 35h - (AMI WinBIOS) extended memory size in 64K blocks, low byte 35h - (PHOENIX) Second user defined hard disk (type 48) Cylinders LSB NOTE: used only when PS/2 style password is NOT in effect. 35h - (AMI 1990 Hyundai super-NB368S notebook) bit 3-1 = 000 shadow disabled = 011 video BIOS shadowed = 100 main BIOS shadowed = 111 both bit 0 coprocessor enabled --------------------------------------------- 36h - (PHOENIX) Second user defined hard disk (type 48) Cylinders MSB NOTE: used only when PS/2 style password is NOT in effect. 36h - (AWARD) bit 6: IDE 32-bit transfer mode 36h - (AMI) bits 1-0: ??? bits 3-2: ??? 36h - (AMI WinBIOS) extended memory size in 64K blocks, high byte 36h - (AMI 1990 Hyundai super-NB368S notebook) bit 7 = 1 LCD, 0 CRT at boot time bit 6 = 1 reversed, 0 normal video mode bit 5 = 1 external, 0 internal keyboard bit 4-3 = 00 cpu speed high 01 cpu speed medium 10 cpu speed low bit 2-1 harddisk vendor 1,2,3,4 bit 0 = 1 relocation enabled, 0 disabled 36h - (Quadtel HT12 BIOS 03.05.03) extended memory, low byte --------------------------------------------- 37h - (IBM PS/2) Date Century Byte 37h - (PHOENIX) Second user defined hard disk (type 48) # of heads NOTE: used only when PS/2 style password is NOT in effect. 37h - (AMI Hi-Flex BIOS) ??? bit 7: ??? 37h - (AMI WinBIOS) bits 7-4 password seed bits 3-0 WinBIOS/AMIBIOS setup color options 37h - (Quadtel HT12 BIOS 03.05.03) extended memory, high byte 37h-3Ah - (AMI 1990 Hyundai super-NB368S notebook) encoded password, max 4 bytes. --------------------------------------------- 38h - (PHOENIX) Second user defined hard disk (type 48) Write Precomp. LSB NOTE: used only when PS/2 style password is NOT in effect. 38h-3Dh (AMI) Encrypted Password 38h-3Fh ??? (IBM PS/2) Encrypted Password. Initialized to 00h in all bytes. Will accept from 1-7 scan codes. --------------------------------------------- 39h - (PHOENIX) Second user defined hard disk (type 48) Write Precomp. MSB NOTE: used only when PS/2 style password is NOT in effect. --------------------------------------------- 3Ah - (PHOENIX) Second user defined hard disk (type 48) Parking Zone LSB NOTE: used only when PS/2 style password is NOT in effect. --------------------------------------------- 3Bh - (PHOENIX) Second user defined hard disk (type 48) Parking Zone MSB NOTE: used only when PS/2 style password is NOT in effect. 3Bh - (AWARD) Configuration Bits Bit 4-7 Screen Colors Used in Setup 0 Yellow/White on Blue (Default) 1 Magenta/White on Blue 2 Yellow/Black on Green 3 Yellow/Green on Cyan 4 Black/Yellow on Cyan 5 Brown/White on Cyan 6 White/Green on Red 7 White/White on Red 8 Green/White on Magenta 9 Yellow/Red on Magenta Ah Red/White on Grey Bh Yellow/White on Grey Ch Cyan/White on Grey Dh Cyan/Yellow on Black Eh White on Black (Monochrome) Fh Green/Red on Black Bit 3 ??? Default = 0 Bit 2 ??? Default = 0 Bit 1 ??? Default = 1 Bit 0 Enable External Cache --------------------------------------------- 3Ch - (PHOENIX) Second user defined hard disk (type 48) Sectors per track NOTE: used only when PS/2 style password is NOT in effect. 3Ch - (AWARD) Boot Configuration Bits bit 7 1 = Disable Virus Warning on Boot bit 6,5 ??? bit 4 Quick POST Enabled bit 3,2 ??? bit 1 Enable Turbo Switch Input bit 0 0 = Boot from A, then C 1 = Boot from C, then A 3Ch - (Quadtel HT12 BIOS 03.05.03) total memory, low byte --------------------------------------------- 3Dh - (AWARD) ??? 3Dh - (Phoenix) bit 3: base memsize 512K/640K 3Dh - (Quadtel HT12 BIOS 03.05.03) total memory, high byte --------------------------------------------- 3Eh - (AMI) Extended CMOS Checksum, High Byte (includes 34h - 3Dh) 3Eh - (AWARD) Boot Configuration Bits bit 7 Shadow Video BIOS at C000h bit 6,5 ??? bit 4 Swap Floppy Drive bit 3 ??? bit 2 Don't Halt on Diskette Errors at Boot bit 1 Don't Halt on Keyboard Errors at Boot bit 0 Never Halt for any error at Boot 3Eh - (Quadtel HT12 BIOS 03.05.03) bit 2 = 1 system error occurred ?? (timer/RTC) bit 0 = 0 extended system configuration loaded = 1 checksum error 3Eh - (Phoenix) shadowing control bit 7 relocate enable bit 1 shadow video enable bit 0 shadow BIOS enable --------------------------------------------- 3Fh - (AMI) Extended CMOS Checksum, Low Byte (includes 34h - 3Dh) 3Fh - (AWARD) ??? --------------------------------------------- End of original 64 CMOS RAM bytes. Many modern chips now contain 128 bytes and the IBM PS/2 has provision for 2k of "Expansion CMOS". The AMI HI-FLEX description is below. If the chip does have only 64 bytes, addresses will wrap so that requests for bytes 40h-7Fh will return the same values as 00h-3Fh. --------------------------------------------- 40h ??? 40h - (AMI 1990 Hyundai super-NB368S notebook) bit 7 = 1 power save enabled bit 6-0 HD power save wait, units of 1 minute (0-20) 40h - (AWARD) Motherboard Chipset (SiS 85C501/85C502 shown) bit 7-1 ??? bit 0 Automatic Configuration Enabled (Default: 1=enabled) --------------------------------------------- 40h-55h - (AMI WinBIOS) PCI BIOS setup data --------------------------------------------- 41h - (AMI) Bits 7-6 IOR/IOW Wait states Bits 5-4 16-bit DMA Wait States Bits 3-2 8-bit DMA Wait States Bit 1 EMR bit Bit 0 DMA Clock Source --------------------------------------------- 42h-43h ??? 42h-44h - (AWARD) ??? chipset setup ??? --------------------------------------------- 44h - (AMI) Bit 4 NMI Power Fail Warning Bit 3 NMI Local Bus Timeout --------------------------------------------- 45h - (AMI) Bits 7-6 AT Bus 32-Bit Delay Bits 5-4 AT Bus 16-Bit Delay Bits 3-2 AT Bus 8-Bit Delay Bits 1-0 AT Bus I/O Delay 45h - (AWARD) Motherboard Chipset (SiS 85C501/85C502 shown) Bit 7 System BIOS Cacheable (Default: 1=enabled) Bit 6 Video BIOS Cacheable (Default: 1=enabled) Bit 6-0 ??? --------------------------------------------- 46h - (AMI) Bits 7-6 AT Bus 32 Bit Wait States Bits 5-4 AT Bus 16 Bit Wait States Bits 3-2 AT Bus 8 Bit Wait States Bits 1-0 AT Bus Clock Source 46h thru 47h - (AWARD) ??? chipset setup ??? --------------------------------------------- 47h-50h ??? 48h-4Fh - (AWARD) ??? unused ??? Defaults to all FFh's. --------------------------------------------- 50h - (AWARD) PCI Bus Slot 1 Latency Timer 0-255 (default: 0) --------------------------------------------- 51h - (AMI) Bit 7 Bank 0/1 RAS Precharge Bit 6 Bank 0/1 Access Wait States Bits 3-2 Bank 0/1 Wait States 51h - (AWARD) PCI Bus Setup Bit 7 PIRQ0# Interrupt Triggering 0 = Edge Sensitive, 1 = Level Sensitive Bit 6-2 ??? Default: all 1's Bit 0-1 Slot 1 IRQ Setup 00 = A-PIRQ0 (Default) 01 = B-PIRQ1 10 = C-PIRQ2 11 = D-PIRQ3 --------------------------------------------- 52h ??? 52h - (AWARD) PCI Bus Slot 2 Latency Timer 0-255 (default: 0) --------------------------------------------- 53h - (AMI) Bit 7 Bank 2/3 RAS Precharge Bit 6 Bank 2/3 Access Wait States Bits 3-2 Bank 2/3 Wait States 53h - (AWARD) PCI Bus Setup Bit 7 PIRQ1# Interrupt Triggering 0 = Edge Sensitive, 1 = Level Sensitive Bit 6-2 ??? Default: all 1's Bit 0-1 Slot 2 IRQ Setup 00 = A-PIRQ1 (Default) 01 = B-PIRQ2 10 = C-PIRQ3 11 = D-PIRQ0 --------------------------------------------- 54h-7Fh ??? 54h - (AWARD) PCI Bus Slot 3 Latency Timer 0-255 (default: 0) --------------------------------------------- 55h - (AWARD) PCI Bus Setup Bit 7 PIRQ2# Interrupt Triggering 0 = Edge Sensitive, 1 = Level Sensitive Bit 6-2 ??? Default: all 1's Bit 0-1 Slot 3 IRQ Setup 00 = A-PIRQ2 (Default) 01 = B-PIRQ3 10 = C-PIRQ0 11 = D-PIRQ1 --------------------------------------------- 56h - (AWARD) ?? reserved for PCI Bus Slot 4 Latency Timer ?? --------------------------------------------- 57h - (AWARD) PCI Bus Setup Bit 7 PIRQ3# Interrupt Triggering 0 = Edge Sensitive, 1 = Level Sensitive Bit 6-0 ??not used Default: all 1's --------------------------------------------- 58h - (AWARD) ?? reserved for PCI Bus Slot 5 Latency Timer ?? bit 3: onboard CMD IDE Mode 3 --------------------------------------------- 59h - (AWARD) ?? reserved for PCI Bus Setup ?? --------------------------------------------- 5Ah - (AWARD) PCI Bus IRQ Setup Bit 4-7 PIRQ1# Interrupt Line (0=none, Bh=IRQ11, etc) Bit 0-3 PIRQ0# Interrupt Line " " " --------------------------------------------- 5Bh - (AWARD) PCI Bus IRQ Setup Bit 4-7 PIRQ3# Interrupt Line (0=none, Bh=IRQ11, etc) Bit 0-3 PIRQ2# Interrupt Line " " " --------------------------------------------- 5Ch-5Fh - (AWARD) ??? unused ??? Defaults to all FFh's. --------------------------------------------- 5Eh - (AMI 1990 Hyundai super-NB368S notebook) - ??? 00h when values from bios defaults 34h when values from power up defaults --------------------------------------------- 60h-77h - (AMI WinBIOS) PCI chipset-specific setup information --------------------------------------------- 60h - (AWARD) Power Management Bit 7 ??? Bit 6 Video Off Method 1 = V/H SYNC + Blank (default) 0 = Blank Screen Bit 4,5 Video Off Option 00 = Always On (default) 01 = Suspend -> Off 10 = Suspend, Standby -> Off 11 = All Modes -> Off Bit 3 PM Control by APM (1=Yes) Bit 2 ??? Bit 0,1 Power Management Setup 00 User Defined 01 Disabled (default) 10 Minimum Power Savings (40 Minutes for all events) 11 Maximum Power Savings (20 Seconds for all events) --------------------------------------------- 61h - (AWARD) Power Management Bit 7 PM Event on HDD Ports Activity (1=enable) Bit 6 PM Event on LPT Port Activity (1=enable) Bit 5 PM Event on COM Port Activity (1=enable) Bit 4 HDD Power Down on Suspend Bit 0-3 HDD Power Down Time 0 Disabled 1-15 Time in Minutes --------------------------------------------- 62h - (AMI 1990 Hyundai super-NB368S notebook) FFh when values from bios defaults FEh when values from power up defaults 62h - (AWARD) Power Management Bit 7-4 Standby Mode Setting (for User Defined) 0 Disabled 1 20 Seconds 2 1 Minute 3 5 Minutes 4 10 Minutes 5 15 Minutes 6 20 Minutes 7 30 Minutes 8 40 Minutes Bit 0-3 Doze Mode Setting (for User Defined) (See Standby Mode above) --------------------------------------------- 63h - (AWARD) Power Management Bit 7 Disable PM Event on IRQ3 Activity (COM2) (1=disable) Bit 6 PM Event on VGA Activity (1=enable) Bit 5 ??? (Defaults to 1) Bit 4 PM Event on PCI/ISA Master Activity (1=enable) Bit 0-3 Suspend Mode Setting (for User Defined) (See Standby Mode above) --------------------------------------------- 64h - (AMI 1990 Hyundai super-NB368S notebook) - ??? 64h - (AWARD) Power Management Bit 7 Disable PM Event on IRQ11 Activity (1=disable) Bit 6 Disable PM Event on IRQ10 Activity (1=disable) Bit 5 Disable PM Event on IRQ9 Activity (IRQ2 Redir) (1=disable) Bit 4 Disable PM Event on IRQ8 Activity (RTC Alarm) (1=disable) Bit 3 Disable PM Event on IRQ7 Activity (LPT1) (1=disable) Bit 2 Disable PM Event on IRQ6 Activity (Floppy) (1=disable) Bit 1 Disable PM Event on IRQ5 Activity (LPT2) (1=disable) Bit 0 Disable PM Event on IRQ4 Activity (COM1) (1=disable) --------------------------------------------- 65h - (AWARD) Power Management Bit 7-4 ??? may be unused. Defaults to all 1's Bit 3 Disable PM Event on IRQ15 Activity (1=disable) Bit 2 Disable PM Event on IRQ14 Activity (Hard Disk) (1=disable) Bit 1 Disable PM Event on IRQ13 Activity (Coprocessor) (1=disable) Bit 0 Disable PM Event on IRQ12 Activity (PS/2 Mouse) (1=disable) --------------------------------------------- 66h - (AMI 1990 Hyundai super-NB368S notebook) doze mode timeout 00-0F, from table (0,12 -14 sec) --------------------------------------------- 66h-79h - (AWARD) ??? unused ??? Defaults to all FFh's. --------------------------------------------- 67h - (AMI 1990 Hyundai super-NB368S notebook) sleep mode timeout 00-0F, units of 1 second --------------------------------------------- 68h - (AMI 1990 Hyundai super-NB368S notebook) suspend mode timeout 01-0F, units of 5 minutes --------------------------------------------- 68h-6Fh - (AWARD) IDE hard disk params for first drive on secondary IDE port --------------------------------------------- 69h - (AMI 1990 Hyundai super-NB368S notebook) LCD mode timeout 01-0F, units of 1 minute --------------------------------------------- 6Ah - (AMI 1990 Hyundai super-NB368S notebook) - ??? --------------------------------------------- 70h-77h - (AWARD) IDE hard disk params for second drive on secondary IDE port --------------------------------------------- 78h-7Dh - (AMI WinBIOS) used by BIOS as scratch RAM --------------------------------------------- 7Ah - (AWARD) Extended CMOS Checksum, High Byte --------------------------------------------- 7Bh - (AWARD) Extended CMOS Checksum, Low Byte Award's extended checksum is the arithmetic sum of all the bytes from 40h (64 decimal) through 79h (121 decimal). --------------------------------------------- 7Eh-7Fh - (AMI WinBIOS) used as scratch RAM by power management code --------------------------------------------- Revision History v1.25 June 1995 Added AMI WinBIOS info from Daniel Miller (Ralf) v1.24 Jan, 1995 Added Award info from Tim Farley (Ralf) v1.23 June, 1994 Added some MCA info from _The_Undocumented_PC_ v1.22 Feb, 1994 Added NMI mask note v1.21 Jan, 1994 Added note for PS/2 checksum found v1.20 Sept, 1993 PHOENIX data from Wim Osterholt added additional AMI data from Howie (hjh@gwd.dst.gov.au) v1.15 June, 1993 AMSTRAD data updated v1.1 June, 1993 AMSTRAD & PS/2 data added v1.0 June, 1993 First release: Motorola MC 146818, PC-AT & AMI "Hi-Flex" information baselined