cmos.lst

中断列表(4) 712K

CMOS-Memory Map			Release 60		Last change 03jan99

Compiled from multiple sources by Padgett Peterson
Corrections/additions/comments to: [e-mail]

No guarantees of any kind.

Copyrights/Trademarks belong to whoever they may belong to.

Found: Algorithm used by IBM in calculating CRC checksums for PS/2
       (see bytes 32h-33h). Complex (recursive part is 12 lines of
       assembly) and not yet validated for every model.
--------!---Note-----------------------------
			Background

The CMOS (complementary metal oxide semiconductor) memory is actually 
a 64 or 128 byte battery-backed RAM memory module that is a part of the 
system clock chip. Some IBM PS/2 models have the capability for a
2k (2048 byte) CMOS ROM Extension.

First used with clock-calender cards for the IBM PC-XT, when the PC/AT
(Advanced Technology) was introduced in 1985, the Motorola MC146818 
became a part of the motherboard. Since the clock only uses fourteen of 
the RAM bytes, the rest are available for storing system configuration data.

Interestingly, the original IBM-PC/AT (Advanced Technology) standard for 
the region 10h-3Fh is nearly universal with one notable exception: The 
IBM PS/2 systems deviate considerably (Note: AMSTRAD 8086 machines were 
among the first to actively use the CMOS memory available and since they 
*predate* the AT, do not follow the AT standard).

This is just another example of how IBM created a standard, lost control 
of it, tried to replace it, failed and lost market share in the process. 

Originally, the IBM PC/AT only made use of a small portion of CMOS memory
and was defined in the IBM PC/AT Technical Reference Manual, specifically 
bytes 10h, 12h, 14h-18h, 2Eh-33h. The balance was left undefined but was 
quickly appropriated by various BIOS manufacturers for such user-selectable 
options such as wait states, clock speeds, initial boot drive selection, and 
password storage.

Later, as CMOS memory requirements grew, newer clock chips with 128
bytes of RAM came into use. However the fact remains that once the AT 
standard was established, only IBM has tried to change the definitions 
of that first description.

			Accessing the CMOS

The CMOS memory exists outside of the normal address space and cannot
contain directly executable code. It is reachable through IN and OUT
commands at port number 70h (112d) and 71h (113d). To read a CMOS byte,
an OUT to port 70h is executed with the address of the byte to be read and
an IN from port 71h will then retrieve the requested information. The 
following BASIC fragment will read 128 CMOS bytes and print them to the 
screen in 8 rows of 16 values.

The CMOS RAM space has an upper limit of 128 bytes because of the structure
of port 70: only bits 0-6 are used for addressing, bit 7 is used to 
enable (0) or disable (1) Non-Maskable Interrupts (NMI) and explains why
IBM uses 80h OR <address> to read/write data & follows with  a "throw-away"
call.

Note that if the CMOS only has 64 bytes available, addressing will 
generally wrap and addresses from 40h-7Fh will mirror 00h-3Fh. Output will 
be hexadecimal.

10 CLS
20 FOR i = 0 TO &H7F 
30 OUT &H70, i
40 PRINT USING "\   \"; HEX$(INP(&H71));
50 NEXT i
60 PRINT " " 

Note: where not otherwise noted, all data points are expressed as BYTES
      these are eight bit values and are read from MSB to LSB e.g.
      0000 0000	    0101 1010 binary would be written as 5Ah
      7654 3210	    where only some bits are used this is represented with
		    Xs e.g bits 5-3 would be shown as 00xx x000

Note: the entries for AMI WinBIOS also apply to AMIBIOS with core dates of 
	12/15/95 or later

--------!---Note-----------------------------
		Organization of CMOS Memory - Clock

00h-0Eh is defined by the clock hardware and all must follow it. Other 
manufacturers generally follow the same format as specified for the
region 10h - 2Fh. Some also follow the IBM format for 30h-33h but not all 
(Zenith in particular is different).

The first fourteen bytes are dedicated to the MC146818 chip clock functions 
and consist of ten read/write data registers and four status registers, two 
of which are read/write and two of which are read only.

The format of the ten clock data registers (bytes 00h-09h) is:

----------R00--------------------------------
CMOS 00h - RTC - SECONDS
Desc:	(BCD 00-59, Hex 00-3B)
Note: Bit 7 is read only	
SeeAlso: CMOS 01h,CMOS 02h,CMOS 04h
----------R01--------------------------------
CMOS 01h - RTC - SECOND ALARM
Desc:	(BCD 00-59, Hex 00-3B; "don't care" if C0-FF)
SeeAlso: CMOS 00h,CMOS 03h,CMOS 05h,CMOS 7Dh
----------R02--------------------------------
CMOS 02h - RTC - MINUTES
Desc:	(BCD 00-59, Hex 00-3B)
SeeAlso: CMOS 00h,CMOS 03h,CMOS 04h
----------R03--------------------------------
CMOS 03h - RTC - MINUTE ALARM
Desc:	(BCD 00-59, Hex 00-3B; "don't care" if C0-FF))	
SeeAlso: CMOS 00h,CMOS 02h,CMOS 05h,CMOS 7Dh,CMOS 7Eh"AMD-645"
----------R04--------------------------------
CMOS 04h - RTC - HOURS
Desc:	(BCD 00-23, Hex 00-17 if 24 hr mode)
	(BCD 01-12, Hex 01-0C if 12 hr am)
	(BCD 81-92. Hex 81-8C if 12 hr pm)	      
SeeAlso: CMOS 00h,CMOS 02h,CMOS 05h
----------R05--------------------------------
CMOS 05h - RTC - HOUR ALARM
Desc:	(same as hours; "don't care" if C0-FF))	    
SeeAlso: CMOS 01h,CMOS 03h,CMOS 04h
----------R06--------------------------------
CMOS 06h - RTC - DAY OF WEEK
Desc:	(01-07 Sunday=1)    
SeeAlso: CMOS 07h,CMOS 08h,CMOS 09h
----------R07--------------------------------
CMOS 07h - RTC - DATE OF MONTH
Desc:	(BCD 01-31, Hex 01-1F)
SeeAlso: CMOS 06h,CMOS 08h,CMOS 09h
----------R08--------------------------------
CMOS 08h - RTC - MONTH
Desc:	(BCD 01-12, Hex 01-0C)	  
SeeAlso: CMOS 06h,CMOS 07h,CMOS 09h
----------R09--------------------------------
CMOS 09h - RTC - YEAR
Desc:	(BCD 00-99, Hex 00-63)	  
Notes:	BCD/Hex selection depends on Bit 2 of register B (0Bh)
	12/24 Hr selection depends on Bit 1 of register B (0Bh)
	Alarm will trigger when contents of all three Alarm byte registers
	  match their companions.
SeeAlso: CMOS 06h,CMOS 07h,CMOS 08h

The following is the on-chip status register information. 

----------R0A--------------------------------
CMOS 0Ah - RTC - STATUS REGISTER A (read/write) (usu 26h)

Bitfields for Real-Time Clock status register A:
Bit(s)	Description	(Table C0001)
 7	=1 time update cycle in progress, data ouputs undefined 
	(bit 7 is read only)
 6-4	22 stage divider
	010 = 32768 Hz time base (default)
 3-0	rate selection bits for interrupt
	0000 none
	0011 122 microseconds (minimum)
	1111 500 milliseconds	
	0110 976.562 microseconds (default 1024 Hz)
SeeAlso: #C0002,#C0003,#C0004
----------R0B--------------------------------
CMOS 0Bh - RTC - STATUS REGISTER B (read/write) 

Bitfields for Real-Time Clock status register B:
Bit(s)	Description	(Table C0002)
 7	enable clock setting by freezing updates
 6	enable periodic interrupt
 5	enable alarm interrupt
 4	enable update-ended interrupt
 3	enable square wave output
 2	Data Mode - 0: BCD, 1: Binary
 1	24/12 hour selection - 1 enables 24 hour mode
 0	Daylight Savings Enable
	=1 enables automatic switching to/from DST in April and October
SeeAlso: #C0001,#C0003,#C0004
----------R0C--------------------------------
CMOS 0Ch - RTC - STATUS REGISTER C (Read only)

Bitfields for Real-Time Clock status register C:
Bit(s)	Description	(Table C0003)
 7	Interrupt request flag
	=1 when any or all of bits 6-4 are 1 and appropriate enables
	  (Register B) are set to 1. Generates IRQ 8 when triggered.
 6	Periodic Interrupt flag
 5	Alarm Interrupt flag 
 4	Update-Ended Interrupt Flag
 3-0	unused
SeeAlso: #C0001,#C0002,#C0004
----------R0D--------------------------------
CMOS 0Dh - RTC - STATUS REGISTER D (read only)

Bitfields for Real-Time Clock status register D:
Bit(s)	Description	(Table C0004)
 7	Valid RAM - 1 indicates batery power good, 0 if dead or disconnected.
 6-0	unused (0)
--------!---Note-----------------------------
		Organization of CMOS Memory - non-Clock

The last two bytes in the first hexadecimal decade (hexade ?) were not 
specified in the PC/AT but may have the following use on some systems:
----------R0E--------------------------------
CMOS 0Eh  - IBM PS/2 - DIAGNOSTIC STATUS BYTE 

Bitfields for IBM PS/2 diagnostic status byte:
Bit(s)	Description	(Table C0005)
 7	indicates clock has lost power
 6	incorrect checksum>
 5	equipment configuration is incorrect
	  (power-on check requires that atleast one floppy be installed)
 4	error in memory size
 3	controller or disk drive failed initialization
 2	time is invalid
 1	installed adaptors do not match configuration
 0	time-out while reading adaptor ID
----------R0E13------------------------------
CMOS 0Eh-13h - AMSTRAD - TIME AND DATE MACHINE LAST USED
----------R0F--------------------------------
CMOS 0Fh - IBM - RESET CODE (IBM PS/2 "Shutdown Status Byte")

(Table C0006)
Values for Reset Code / Shutdown Status Byte:
 00h-03h perform power-on reset
   00h	software reset or unexpected reset
   01h	reset after memory size check in real/virtual mode
	(or: chip set initialization for real mode reentry)
   02h	reset after successful memory test in real/virtual mode
   03h	reset after failed memory test in real/virtual mode
 04h	INT 19h reboot
 05h	flush keyboard (issue EOI) and jump via 40h:0067h
 06h	reset (after successful test in virtual mode)
	(or: jump via 40h:0067h without EOI)
 07h	reset (after failed test in virtual mode)
 08h	used by POST during protected-mode RAM test (return to POST)
 09h	used for INT 15/87h (block move) support
 0Ah	resume execution by jump via 40h:0067h
 0Bh	resume execution via IRET via 40h:0067h
 0Ch	resume execution via RETF via 40h:0067h
 0Dh-FFh perform power-on reset
--------!---Note-----------------------------

The second group of values extends from address 10h to 2Dh. The word at
2Eh-2Fh is a byte-wise summation of the values in these bytes. Most BIOSes
will generate a CMOS Checksum error if this value is invalid however many 
programs ignore the checksum and report the apparent value. The current
version of MSD reports my XT as having 20+ MB of extended memory. 

Where a definiton appears universal, no identification is made. Where
the definition is thought to be specific to a manufacturer/model (AMI, 
AMSTRAD, IBM AT, IBM PS/2) the identification is enclosed in parens. The
AMSTAD definitions appear to relate to 8088/8086 (PC and PC/XT class)
mchines only. AT class machines appear to adhere to IBM PC/AT fornat.

----------R10--------------------------------
CMOS 10h - IBM - FLOPPY DRIVE TYPE
Note:	a PC having a 5 1/4 1.2 Mb A: drive and a 1.44 Mb B: drive will
	  have a value of 24h in byte 10h. With a single 1.44 drive: 40h.

Bitfields for floppy drives A/B types:
Bit(s)	Description	(Table C0007)
 7-4	first floppy disk drive type (see #C0008)
 3-0	second floppy disk drive type (see #C0008)

(Table C0008)
Values for floppy drive type:
 00h	no drive
 01h	360 KB 5.25 Drive
 02h	1.2 MB 5.25 Drive - note: not listed in PS/2 technical manual
 03h	720 KB 3.5 Drive
 04h	1.44 MB 3.5 Drive
 05h	2.88 MB 3.5 drive
 06h-0Fh unused
SeeAlso: #C0007
----------R11--------------------------------
CMOS 11h - IBM PS/2 - FIRST FIXED DISK DRIVE TYPE BYTE (00-FFh)
Note:	if IBM ESDI or SCSI drive controller is used, CMOS drive type will be
	  zero (00 - no drive) and INT 13h will be directed to controller ROM.
----------R11--------------------------------
CMOS 11h - older AMI Hi-Flex BIOS - KEYBOARD TYPEMATIC DATA 

Bitfields for AMI Hi-Flex BIOS keyboard typematic data:
Bit(s)	Description	(Table C0009)
 7	enable Typematic
 6-5	Typematic Delay (wait before begin repeating)
	00b 250 ms
	01b 500 ms
	10b 750 ms
	11b 100 ms
 4-0	Typematic Rate (char/sec)
	00000b - 30.0	 01000b - 15.9	10000b - 7.5  11000b - 3.7
	00001b - 26.7	 01001b - 13.3	10001b - 6.7  11001b - 3.3
	00010b - 24.0	 01010b - 12.0	10010b - 6.0  11010b - 3.0
	00011b - 21.8	 01011b - 10.9	10011b - 5.5  11011b - 2.7
	00100b - 20.0	 01100b - 10.0	10100b - 5.0  11100b - 2.5
	00101b - 18.5	 01101b -  9.2	10101b - 4.6  11101b - 2.3
	00110b - 17.1	 01110b -  8.6	10110b - 4.3  11110b - 2.1
	00111b - 16.0	 01111b -  8.0	10111b - 4.0  11111b - 2.0
----------R11--------------------------------
CMOS 11h - AMI - ADVANCED SETUP OPTIONS

Bitfields for AMI advanced setup options:
Bit(s)	Description	(Table C0010)
 7	mouse enabled
 6	test memory above 1 megabyte
 5	generate clicks during memory test
 4	enable memory parity check
 3	display key for Setup while booting
 2	store user-defined disk data at top of memory instead of 0030h:0000h
 1	request F1 keypress on boot error
----------R11--------------------------------
CMOS 11h - AMI WinBIOS - BOOT OPTIONS
SeeAlso: CMOS 13h"AMI"

Bitfields for AMI WinBIOS boot options:
Bit(s)	Description	(Table C0011)
 7	systems boots with high CPU speed
 6	memory test above 1MB enabled
 5	memory test tick sound enabled
 4	floppy drive seek at boot enabled
 3	"Hit <Del>" message enabled
 2	BIOS extended RAM area takes 1K at top of memory instead of 30h:0000h
 1	wait for F1 key on error
 0	NumLock enabled at boot
----------R11--------------------------------
CMOS 11h - AWARD - CONFIGURATION BITS
SeeAlso: CMOS 5Eh"AWARD"

Bitfields for AWARD configuration bits:
Bit(s)	Description	(Table C0012)
 7	NumLock ON at reboot
 6	IDE Block Mode enabled
 5	???
 4	Shadow ROM BIOS at CC00-CFFF
 3	Shadow ROM BIOS at C800-CBFF
 2	???
 1	BIOS Password Enabled (supervisor)
 0	0 = Password controls BIOS Setup Only
	1 = Password required to enter System
SeeAlso: #C0083

Code snippet by Jens Rehsack:
   FUNCTION CalcPossiblePassword( PasswordValue: WORD ): STRING[8];