CMOS Memory Map v1.20    September, 1993

Compiled from multiple sources by Padgett Peterson
Corrections/additions/comments to: padgett@tccslr.dnet.mmc.com

No guarantees of any kind.

Wanted: Algorithm used by IBM in calculating CRC checksums for PS/2
        (see bytes 32h-33h).

Copyrights/Trademarks belong to whoever they may belong to.

       Background

The CMOS (complementary metal oxide semiconductor) memory is actually
a 64 or 128 byte battery-backed RAM memory module that is a part of the
system clock chip. Some IBM PS/2 models have the capability for a
2k (2048 byte) CMOS ROM Extension.

First used with clock-calender cards for the IBM PC-XT, when the PC/AT
(Advanced Technology) was introduced in 1985, the Motorola MC146818
became a part of the motherboard. Since the clock only uses fourteen of
the RAM bytes, the rest are available for storing system configuration
data.

Interestingly, the original IBM-PC/AT (Advanced Technology) standard for
the region 10h-3Fh is nearly universal with one notable exception: The
IBM PS/2 systems deviate considerably (Note: AMSTRAD 8086 machines were
among the first to actively use the CMOS memory available and since they
*predate* the AT, do not follow the AT standard).

This is just another example of how IBM created a standard, lost control
of it, tried to replace it, failed and lost market share in the process.

Originally, the IBM PC/AT only made use of a small portion of CMOS memory
and was defined in the IBM PC/AT Technical Reference Manual, specifically
bytes 10h, 12h, 14h-18h, 2Eh-33h. The balance was left undefined but was
quickly appropriated by various BIOS manufacturers for such
user-selectable
options such as wait states, clock speeds, initial boot drive selection,
and
password storage.

Later, as CMOS memory requirements grew, newer clock chips with 128
bytes of RAM came into use. However the fact remains that once the AT
standard was established, only IBM has tried to change the definitions
of that first description.

       Accessing the CMOS

The CMOS memory exists outside of the normal address space and cannot
contain directly executable code. It is reachable through IN and OUT
commands at port number 70h (112d) and 71h (113d). To read a CMOS byte,
an OUT to port 70h is executed with the address of the byte to be read and
an IN from port 71h will then retrieve the requested information. The
following BASIC fragment will read 128 CMOS bytes and print them to the
screen in 8 rows of 16 values.

Note that if the CMOS only has 64 bytes available, addressing will
generally wrap and addresses from 40h-7Fh will mirror 00h-3Fh. Output will

be hexadecimal.

10 CLS
20 FOR i = 0 TO &H7F
30 OUT &H70, i
40 PRINT USING "\   \"; HEX$(INP(&H71));
50 NEXT i
60 PRINT " "

Note: where not otherwise noted, all data points are expressed as BYTES
      these are eight bit values and are read from MSB to LSB e.g.
      0000 0000     0101 1010 binary would be written as 5Ah
      7654 3210     where only some bits are used this is represented with
                    Xs e.g bits 5-3 would be shown as 00xx x000


      Organization of CMOS Memory - Clock

00h-0Eh is defined by the clock hardware and all must follow it. Other
manufacturers generally follow the same format as specified for the
region 10h - 2Fh. Some also follow the IBM format for 30h-33h but not all
(Zenith in particular is different).

The first fourteen bytes are dedicated to the MC146818 chip clock
functions
and consist of ten read/write data registers and four status registers,
two
of which are read/write and two of which are read only.

The format of the ten clock data registers (bytes 00h-09h) is:

 00h Seconds       (BCD 00-59, Hex 00-3B) Note: Bit 7 is read only
 01h Second Alarm  (BCD 00-59, Hex 00-3B)
 02h Minutes       (BCD 00-59, Hex 00-3B))
 03h Minute Alarm  (BCD 00-59, Hex 00-3B)
 04h Hours         (BCD 00-23, Hex 00-17 if 24 hr mode)