                             CMOS Storage Layout

 AT-class PCs contain a battery-powered real-time clock (RTC) and 64-bytes of
 low-power, non-volatile CMOS memory.

 This memory contains a variety of information, including the current time
 and date, along with hardware configuration and a shut-down status byte (the
 shutdown byte is used in the mechanism which permits the AT to restart where
 it left off after issuing a processor reset to exit from protected mode).

 When you see the "Run Setup" prompt during POST it is because some hardware
 did not match the configuration record or because of some other problem with
 the CMOS RAM.

 Address Summary (detailed information follows)
 XXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 00H-0dH used by real-time clock
 0eH     POST diagnostics status byte
 0fH     shutdown status byte
 10H     diskette drive type      -----+
 11H     (reserved)                    |
 12H     hard disk types (if < 15)     |
 13H     (reserved)                    +-  checksum-protected
 14H     equipment byte                |   configuration record
 15H-16H Base memory size              |   (addresses 10H-20H)
 17H-18H extended memory above 1M      |
 19H     hard disk C type (if > 15)    |
 1aH     hard disk D type (if > 15)    |
 1bH-20H (reserved)               -----+
 21H-2dH (reserved)
 2eH-2fH storage for  checksum of CMOS addresses 10H through 20H
 30H-31H extended memory above 1M
 32H     current century in BCD (eg, 19H)
 33H     miscellaneous info.
 34H-3fH (reserved)

+----------------+
|Using CMOS Data | To read a byte from CMOS, do an OUT 70H,addr; followed by
+----------------+ IN 71H.  To write a byte to CMOS, do an OUT 70H,addr;
 followed by OUT 71H,value.

Example: ;------- read what type of hard disk is installed
         mov     al,12H
         out     70H,al        ;select CMOS address 12H
         jmp     $+2           ;this forces a slight delay to settle things
         in      al,71H        ;AL now has drive type (0-15)

 Addresses 10H through 20H are protected by a checksum to be able to detect
 when the battery has died or invalid information has been written into the
 configuration record.  This a simple 16-bit sum of the protected bytes.

+--------------------------+
|CMOS Memory Layout Detail | This layout applies to AT-class PC only.  =PS/2=
+--------------------------+ machines define the fields differently.
Addr Description
XXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 0   current second for real-time clock +------------------------------------+
 1   alarm second                       | All RTC quantities are stored in   |
 2   current minute                     | BCD-format as two decimal nibbles; |
 3   alarm minute                       | eg, 31 (decimal) is stored as 31H. |
 4   current hour                       +------------------------------------+
 5   alarm hour                                 +----------------------------+
 6   current day of week (1=Sunday)             | Note: for more info on the |
 7   current date of month                      | real-time clock, refer to  |
 8   current month                              | Motorolla MC146818 specs.  |
 9   current year  (final two digits; eg, 87)   +----------------------------+

0aH  RTC status register A
     +7+6+5+4+3+2+1+0+
     | |     |       |
     +++-+-+-+-+-+-+-+
      | +-+-+ +-----+-  rate selector (set to 0110)
      |   +-----------  22-stage divider (set to 010)
      +---------------  Update in progress (UIP) flag.  0 means OK to read.

0bH  RTC status register B
     +7+6+5+4+3+2+1+0+
     | | | | | | | | |
     +++++++++++++++++
      | | | | | | | +-  daylight savings enable.  0=standard time (set to 0)
      | | | | | | +---  12 or 24-hr mode.  0=12-hr mode (is set to 1)
      | | | | | +-----  BCD date mode. 1=binary, 0=BCD.  (is set to 0)
      | | | | +-------  enable square wave. 1=turn on square wave. (set to 0)
      | | | +---------  enable update-ended interrupt.0 disables. (set to 0)
      | | +-----------  enable alarm int. 0 disables (set to 0) See INT 1aH
      | +-------------  enable periodic interrupt 0 disables (set to 0)
      +---------------  Update in progress (UIP) flag.  0 = OK to read CMOS.

0cH  RTC status register C.  Read-only interrupt status bits.

0dH  RTC status register D. Bit 7=1 when a CMOS-RAM is receiving power
                                 =0 to indicate a dead battery.

0eH  POST diagnostics status byte
     +7+6+5+4+3+2+1+0+
     | | | | | | |0 0|
     +++++++++++++-+-+
      | | | | | +-----  Time valid (After POST, 1 means it's not Feb 30)
      | | | | +-------  Hard disk bad.  1 means can't boot from hard disk
      | | | +---------  RAM size not right. 1 = POST found different RAM size
      | | +-----------  Configuration record not right.  1=different equipment
      | +-------------  Checksum invalid.  1 means bad checksum in CMOS RAM
      +---------------  Power Lost.  1 means real-time clock battery died

0fH  shutdown status byte
     This byte is read upon startup after CPU reset in order to determine if
     the reset was used as a way to get out of 80286 protected mode.
         0 = soft reset (Ctrl-Alt-Del) or unexpected shutdown.  Skip POST
         1 = shutdown after memory size is determined
         2 = shutdown after memory test is performed
         3 = shutdown after memory error (parity check 1 or 2)
         4 = shutdown with bootstrap loader request
         5 = shutdown with FAR JMP (restart int ctrlr and jmp to 0:[0467H])
     6,7,8 = shutdown after passing a protected mode test
         9 = shutdown after performing block move.  See INT 15H SubFn 87H
       0aH = shutdown with FAR JMP (immediate jmp to address at 0:[0467H])

10H  diskette drive types
     +7+6+5+4+3+2+1+0+
     |       |       |
     +-+-+-+-+-+-+-+-+
      +--+--+ +-----+-  first diskette drive --+-  0000 = 0H = not installed
         +------------  second diskette drive -+   0001 = 1H = 360K drive
                                                   0010 = 2H = 1.2M drive

11H  reserved

12H  hard disk drive type  (for drives C: and D:, when between 1 and 14)
     +7+6+5+4+3+2+1+0+
     |       |       |
     +-+-+-+-+-+-+-+-+
      +--+--+ +-----+-  first hard disk (drive C:) --+- 0000 =not present
         +------------  second hard disk (drive D:) -+  else =type ID (below)
                                                        1111 =use addr 19H/1aH
     See AT BIOS Hard Disk Types for a list of BIOS-supported drives.

13H  reserved
14H  Equipment byte
     +7+6+5+4+3+2+1+0+
     |drv|dsp|0 0|7|d|
     +-+-+-+-+-+-+++-+
      +++ +++     | +-  1 = diskette drive(s) installed
       |   |      +---  1 = 80287 math co-processor installed
       |   +----------  primary display 00 = none or  EGA
       |                                01 = 40-clm CGA
       |                                10 = 80-clm CGA
       |                                11 = TTL Monochrome
       +--------------  diskette drives-1 (00=1, 01=2, 10=3, 11=4)

15H  Base memory (low byte)  --+-  0100H=256K, 0200H=512K, 0280H=640K
16H  Base memory (high byte)  -+
17H  extended memory above 1M (low byte)  --+-  (in K bytes. 0-3c00H)
18H  extended memory (high byte)  ----------+   See INT 15H SubFn 88H

19H  disk 0 (drive C:) hard disk type if (CMOS addr 12H & 0fH) is 0fH
1aH  disk 1 (drive D:) hard disk type if (CMOS addr 12H & f0H) is f0H

1bH-2dH reserved

2eH  checksum of CMOS addresses 10H through 20H  (high byte)
2fH                                              (low byte)

30H  extended memory above 1M (low byte)  --+-  (in K bytes. 0-3c00H)
31H  extended memory (high byte)  ----------+   See INT 15H SubFn 88H

32H  century in BCD (eg, 19H)

33H  miscellaneous info.  Bit 7=IBM 128K memory option installed
                          Bit 6=used by "Setup" utility

34H-3fH reserved.  Put your name here for everlasting amusement.

---------

The standard AT CMOS addresses from 00h to 3Fh are easy,

;    Read CMOS
mov al,addr     ; 'addr' ranges from 00h to 3Fh.
out 70h,al      ;  wakes up the port.
jmp $+2         ;  a delay loop..
in al,71h       ;  reads CMOS.

;    Write CMOS
mov al,addr     ; 'addr' ranges from 00h to 3Fh.
out 70h,al      ;  wakes up the port.
jmp $+2         ;  a delay loop..
out 71h, value  ;  Writes 'value' from 00h to FFh.
                ;    note that 'addr' 10h to 20h are checksummed.


Some CMOS info...

  addr        contents

  00h         Seconds
  01h         Second Alarm
  02h         Minutes
  03h         Minute Alarm
  04h         Hours
  05h         Hour Alarm
  06h         Day of the Week
  07h         Day of the Month
  08h         Month
  09h         Year
  0Ah         Status Register A
  0Bh         Status Register B
  0Ch         Status Register C
  0Dh         Status Register D
  0Eh         Diagnostic Status Byte
  0Fh         Shutdown Status Byte
  10h         Disk Drive Type for Drives A: and B:
              The drive-type bytes use bits 0:3 for the first
              drive and 4:7 for the other disk drive types.
  00h         no drive present
  01h         double sided 360k
  02h         high capacity (1.2 meg)
  03h-0Fh     reserved
  11h         (AT):Reserved    (PS/2):drive type for hard disk C:
  12h         (PS/2):drive type for hard disk D:
              (AT, XT/286):hard disk type for drives C: and D:
  Format of drive-type entry for AT, XT/286:
  0       number of cyls in drive (0-1023 allowed)
  2       number of heads per drive (0-15 allowed)
  3       starting reduced write compensation (not used on AT)
  5       starting cylinder for write compensation
  7       max. ECC data burst length, XT only
  8       control byte
  Bit
  7       disable disk-access retries
  6       disable ECC retries
  5-4     reserved, set to zero
  3       more than 8 heads
  2-0     drive option on XT (not used by AT)
  9       timeout value for XT (not used by AT)
  12      landing zone cylinder number
  14      number of sectors per track (default 17, 0-17 allowed)
  13h         Reserved
  14h         Equipment Byte (corresponds to sw. 1 on PC and XT)
  15h-16h     Base Memory Size      (low,high)
  17h-18h     Expansion Memory Size (low,high)
  19h-20h     Reserved
          (PS/2) POS information Model 50 (60 and 80 use a 2k
          CMOS RAM that is not accessible through software)
  21h-2Dh     Reserved (not checksumed)
  2Eh-2Fh     Checksum of Bytes 10 Through 20  (low,high)
  30h-31h     Exp. Memory Size as Det. by POST (low,high)
  32h         Date Century Byte
  33h         Information Flags (set during power-on)
  34h-3Fh     Reserved - Put Your Name Here.
 
Ŀ
FiLE PASSED THRU : [X$]  ZYXEL +49-(o)3o-341-2912 
ĴV.34  +49-(o)3o-342-o29o 
 10 GiGZ oNLiNE - LiNKED WoRLDWiDE! V.34  +49-(o)3o-342-9217 
    GREETiNX To: KATRiN SiEGMUND    V.34  +49-(o)3o-342-9457 
     AND MARY STUART MASTERSoN !    V.34  +49-(o)3o-342-9o96 
                                    V.32T +49-(o)3o-341-o493 
     ECSTASY - iT'S SoME KiND oF    DUAL  +49-(o)3o-341-o415 
    FUN, SoME KiND oF HAPPiNESS!            iSDN SooN!       


