Accessing the CMOS
The CMOS memory exists outside of the normal address space and cannot
contain directly executable code. It is reachable through IN and OUT
commands at port number 70h (112d) and 71h (113d). To read a CMOS byte,
an OUT to port 70h is executed with the address of the byte to be read and
an IN from port 71h will then retrieve the requested information. The
following BASIC fragment will read 128 CMOS bytes and print them to the
screen in 8 rows of 16 values.
The CMOS RAM space has an upper limit of 128 bytes because of the structure
of port 70: only bits 0-6 are used for addressing, bit 7 is used to
enable (0) or disable (1) Non-Maskable Interrupts (NMI) and explains why
IBM uses 80h OR <address> to read/write data & follows with a "throw-away"
call.
Note that if the CMOS only has 64 bytes available, addressing will
generally wrap and addresses from 40h-7Fh will mirror 00h-3Fh. Output will
be hexadecimal.
10 CLS
20 FOR i = 0 TO &H7F
30 OUT &H70, i
40 PRINT USING "\ \"; HEX$(INP(&H71));
50 NEXT i
60 PRINT " "
Note: where not otherwise noted, all data points are expressed as BYTES
these are eight bit values and are read from MSB to LSB e.g.
0000 0000 0101 1010 binary would be written as 5Ah
7654 3210 where only some bits are used this is represented with
Xs e.g bits 5-3 would be shown as 00xx x000
Note: the entries for AMI WinBIOS also apply to AMIBIOS with core dates of
12/15/95 or later
--------!---Note-----------------------------
Organization of CMOS Memory - Clock
00h-0Eh is defined by the clock hardware and all must follow it. Other
manufacturers generally follow the same format as specified for the
region 10h - 2Fh. Some also follow the IBM format for 30h-33h but not all
(Zenith in particular is different).
The first fourteen bytes are dedicated to the MC146818 chip clock functions
and consist of ten read/write data registers and four status registers, two
of which are read/write and two of which are read only.
The format of the ten clock data registers (bytes 00h-09h) is:
----------R00--------------------------------
CMOS 00h - RTC - SECONDS
Desc: (BCD 00-59, Hex 00-3B)
Note: Bit 7 is read only
See Also: CMOS 01h,CMOS 02h,CMOS 04h
----------R01--------------------------------
CMOS 01h - RTC - SECOND ALARM
Desc: (BCD 00-59, Hex 00-3B; "don't care" if C0-FF)
See Also: CMOS 00h,CMOS 03h,CMOS 05h
----------R02--------------------------------
CMOS 02h - RTC - MINUTES
Desc: (BCD 00-59, Hex 00-3B)
See Also: CMOS 00h,CMOS 03h,CMOS 04h
----------R03--------------------------------
CMOS 03h - RTC - MINUTE ALARM
Desc: (BCD 00-59, Hex 00-3B; "don't care" if C0-FF))
See Also: CMOS 00h,CMOS 02h,CMOS 05h
----------R04--------------------------------
CMOS 04h - RTC - HOURS
Desc: (BCD 00-23, Hex 00-17 if 24 hr mode)
(BCD 01-12, Hex 01-0C if 12 hr am)
(BCD 81-92. Hex 81-8C if 12 hr pm)
See Also: CMOS 00h,CMOS 02h,CMOS 05h
----------R05--------------------------------
CMOS 05h - RTC - HOUR ALARM
Desc: (same as hours; "don't care" if C0-FF))
See Also: CMOS 01h,CMOS 03h,CMOS 04h
----------R06--------------------------------
CMOS 06h - RTC - DAY OF WEEK
Desc: (01-07 Sunday=1)
See Also: CMOS 07h,CMOS 08h,CMOS 09h
----------R07--------------------------------
CMOS 07h - RTC - DATE OF MONTH
Desc: (BCD 01-31, Hex 01-1F)
See Also: CMOS 06h,CMOS 08h,CMOS 09h
----------R08--------------------------------
CMOS 08h - RTC - MONTH
Desc: (BCD 01-12, Hex 01-0C)
See Also: CMOS 06h,CMOS 07h,CMOS 09h
----------R09--------------------------------
CMOS 09h - RTC - YEAR
Desc: (BCD 00-99, Hex 00-63)
Notes: BCD/Hex selection depends on Bit 2 of register B (0Bh)
12/24 Hr selection depends on Bit 1 of register B (0Bh)
Alarm will trigger when contents of all three Alarm byte registers
match their companions.
See Also: CMOS 06h,CMOS 07h,CMOS 08h
The following is the on-chip status register information.
----------R0A--------------------------------
CMOS 0Ah - RTC - STATUS REGISTER A (read/write) (usu 26h)
Bitfields for Real-Time Clock status register A:
Bit(s) Description (Table C001)
7 =1 time update cycle in progress, data ouputs undefined
(bit 7 is read only)
6-4 22 stage divider
010 = 32768 Hz time base (default)
3-0 rate selection bits for interrupt
0000 none
0011 122 microseconds (minimum)
1111 500 milliseconds
0110 976.562 microseconds (default 1024 Hz)
See Also: #C002,#C003,#C004
----------R0B--------------------------------
CMOS 0Bh - RTC - STATUS REGISTER B (read/write)
Bitfields for Real-Time Clock status register B:
Bit(s) Description (Table C002)
7 enable cycle update
6 enable periodic interrupt
5 enable alarm interrupt
4 enable update-ended interrupt
3 enable square wave output
2 Data Mode - 0: BCD, 1: Binary
1 24/12 hour selection - 1 enables 24 hour mode
0 Daylight Savings Enable - 1 enables
See Also: #C001,#C003,#C004
----------R0C--------------------------------
CMOS 0Ch - RTC - STATUS REGISTER C (Read only)
Bitfields for Real-Time Clock status register C:
Bit(s) Description (Table C003)
7 Interrupt request flag
=1 when any or all of bits 6-4 are 1 and appropriate enables
(Register B) are set to 1. Generates IRQ 8 when triggered.
6 Periodic Interrupt flag
5 Alarm Interrupt flag
4 Update-Ended Interrupt Flag
3-0 unused???
See Also: #C001,#C002,#C004
----------R0D--------------------------------
CMOS 0Dh - RTC - STATUS REGISTER D (read only)
Bitfields for Real-Time Clock status register D:
Bit(s) Description (Table C004)
7 Valid RAM - 1 indicates batery power good, 0 if dead or disconnected.
6-0 unused??? (0)
--------!---Note-----------------------------
Organization of CMOS Memory - non-Clock
The last two bytes in the first hexadecimal decade (hexade ?) were not
specified in the PC/AT but may have the following use on some systems:
----------R0E--------------------------------
CMOS 0Eh - IBM PS/2 - DIAGNOSTIC STATUS BYTE
Bitfields for IBM PS/2 diagnostic status byte:
Bit(s) Description (Table C005)
7 indicates clock has lost power
6 incorrect checksum>
5 equipment configuration is incorrect
(power-on check requires that atleast one floppy be installed)
4 error in memory size
3 controller or disk drive failed initialization
2 time is invalid
1 installed adaptors do not match configuration
0 time-out while reading adaptor ID
----------R0E13------------------------------
CMOS 0Eh-13h - AMSTRAD - TIME AND DATE MACHINE LAST USED
----------R0F--------------------------------
CMOS 0Fh - IBM - RESET CODE (IBM PS/2 "Shutdown Status Byte")
(Table C006)
Values for Reset Code / Shutdown Status Byte:
00h-03h perform power-on reset
00h software reset or unexpected reset
01h reset after memory size check in real/virtual mode
(or: chip set initialization for real mode reentry)
02h reset after successful memory test in real/virtual mode
03h reset after failed memory test in real/virtual mode
04h INT 19h reboot
05h flush keyboard (issue EOI) and jump via 40h:0067h
06h reset (after successful test in virtual mode)
(or: jump via 40h:0067h without EOI)
07h reset (after failed test in virtual mode)
08h used by POST during protected-mode RAM test (return to POST)
09h used for INT 15/87h (block move) support
0Ah resume execution by jump via 40h:0067h
0Bh resume execution via IRET via 40h:0067h
0Ch resume execution via RETF via 40h:0067h
0Dh-FFh perform power-on reset
--------!---Note-----------------------------
The second group of values extends from address 10h to 2Dh. The word at
2Eh-2Fh is a byte-wise summation of the values in these bytes. Most BIOSes
will generate a CMOS Checksum error if this value is invalid however many
programs ignore the checksum and report the apparent value. The current
version of MSD reports my XT as having 20+ MB of extended memory.
Where a definiton appears universal, no identification is made. Where
the definition is thought to be specific to a manufacturer/model (AMI,
AMSTRAD, IBM AT, IBM PS/2) the identification is enclosed in parens. The
AMSTAD definitions appear to relate to 8088/8086 (PC and PC/XT class)
mchines only. AT class machines appear to adhere to IBM PC/AT fornat.
----------R10--------------------------------
CMOS 10h - IBM - FLOPPY DRIVE TYPE
Note: a PC having a 5 1/4 1.2 Mb A: drive and a 1.44 Mb B: drive will
have a value of 24h in byte 10h. With a single 1.44 drive: 40h.
Bitfields for floppy drives A/B types:
Bit(s) Description (Table C007)
7-4 first floppy disk drive type (see #C008)
3-0 second floppy disk drive type (see #C008)
(Table C008)
Values for floppy drive type:
00h no drive
01h 360 KB 5.25 Drive
02h 1.2 MB 5.25 Drive - note: not listed in PS/2 technical manual
03h 720 KB 3.5 Drive
04h 1.44 MB 3.5 Drive
05h 2.88 MB 3.5 drive
06h-0Fh unused
See Also: #C007
----------R11--------------------------------
CMOS 11h - IBM PS/2 - FIRST FIXED DISK DRIVE TYPE BYTE (00-FFh)
Note: if IBM ESDI or SCSI drive controller is used, CMOS drive type will be
zero (00 - no drive) and INT 13h will be directed to controller ROM.
----------R11--------------------------------
CMOS 11h - older AMI Hi-Flex BIOS - KEYBOARD TYPEMATIC DATA
Bitfields for AMI Hi-Flex BIOS keyboard typematic data:
Bit(s) Description (Table C009)
7 enable Typematic
6-5 Typematic Delay (wait before begin repeating)
00b 250 ms
01b 500 ms
10b 750 ms
11b 100 ms
4-0 Typematic Rate (char/sec)
00000b - 30.0 01000b - 15.9 10000b - 7.5 11000b - 3.7
00001b - 26.7 01001b - 13.3 10001b - 6.7 11001b - 3.3
00010b - 24.0 01010b - 12.0 10010b - 6.0 11010b - 3.0
00011b - 21.8 01011b - 10.9 10011b - 5.5 11011b - 2.7
00100b - 20.0 01100b - 10.0 10100b - 5.0 11100b - 2.5
00101b - 18.5 01101b - 9.2 10101b - 4.6 11101b - 2.3
00110b - 17.1 01110b - 8.6 10110b - 4.3 11110b - 2.1
00111b - 16.0 01111b - 8.0 10111b - 4.0 11111b - 2.0
----------R11--------------------------------
CMOS 11h - AMI - ADVANCED SETUP OPTIONS