CMOS map

Partial CMOS memory map for PS/1 model 2011.

0Eh	Bit 3: set to 1 if HDD error (F000:465E)

13h	PS/2 MCA - INTERNAL POST OPERATIONS
	Bit 6: RTC battery OK? (F000:2245, F000:1AD0)
	Bit 5: if 0 during POST then Bit 6 is cleared (BIOS:2274)
	Bit 4: typematic F000:3245


14h	copied to 40h:10h (Equipment list flags) (F000:0E44)
	Bit 0: if 1 during POST then CMOS 13h Bit 6 is cleared (BIOS:227B)

16h	MSB of base memory size in KB	
	Bit 6,7: are used to check CMOS (BIOS:2260)
		if ==11b then burn-in mode (BIOS:0E2D)
		they are masked out when the value of mem size is needed (F000:129E)

29h	extended memory size low byte (POST 51 F000:128B)
2Ah	extended memory size high byte (POST 51 F000:1292)

2Bh	in case of floppy error, if is <>0 then error 601 (F000:1EB5)
	tested also at POST 69 F000:1B5E
	it seems to contain a replica of CMOS[10h]: "previous" value of CMOS[10h], set at POST 69, 
	used to detect variation in the configuration.

2Ch	HDD type byte previous value (F000:46A0)

2Dh	if bit 7 is 0 then bit 5 set to 1, 
	bit 7 set to 1 and result written do 40:96 Keyboard status byte 1 (F000:1CE6)
	if bit0 OR bit1 during ROM DOS boot checks (POST DD F000:2E7F) then skip to post 70

2Eh	if bit0 OR bit1 during ROM DOS boot checks (POST DD F000:2E77) then skip to post 70

	2Dh and 2Eh are so special that IBM created two specific INT 15 functions to manipulate them: 
	INT 15/2300 to read 2Dh to CL and 2Eh to CH
	INT 15/2301 to set 2Dh from CL and 2Eh from CH

	The meaning of these bytes is still largely unknown but, reading the US Patent 5,307,497, I suspect they may 
	have these 11 bits in an unknown structure:

	SSSSS - SYS-DRIVE
		Represents a valid disk or diskette drive number from 0-25. 
		If the system has a hard disk, the default is 2, c: drive. 
		If there is no hard disk, the value is O, A: drive.

	B - conventional boot
		set=1 to boot as if there is no ROM DOS
		set=0 boot from ROM

	D - boot diskette
		set=1 to try and boot from diskette

	C - CONFIG
		set=0 to use default CONFIG.SYS in ROM
		set=1 to use CONFIG.SYS in default drive.

	A - AUTOEXEC
		set=0 to use default AUTOEXEC.BAT in ROM
		set=1 to use AUTOEXECBAT in default drive.

	R — ROMSHELL
		set=1 to load COMMAND.COM with /R option to load ROMSHELL
		set=0 to load default COMMAND.COM to display command line prompt.

	I - INITIAL ROMSHELL STATE
		set=0 for ROMSHELL to initialize with first panel
		set=1 for ROMSHELL to begin directly with a subpanel.

	Hypothesis:
	SSSSS : bits 2-6 of CMOS 2Eh (F000:2EDC)
	B: bit 1 of CMOS 2Eh (F000:30AD)
	D: bit 0 of CMOS 2Eh (F000:2F78)

2Fh	Bit 2: see POST 5A
	Bit 4: 1 if audio card option installed (F000:1CB8)

30h	set to the segment containing the system ROM with the Boot flag byte set to 1 (byte 3) (POST 0B F000:16B1)
	The rom dos.

34h	number of COM ports, POST 6B (F000:1C0D)

35h	extended memory size low byte (POST 1F F000:0D74)
36h	extended memory size high byte (POST 1F F000:0D7B)

38h	used during POST burn-in mode to store the current POST code (BIOS:245D)

3Ah	used in CMOS_POST_LOG (F000:22B9)
3Bh	used in CMOS_POST_LOG (F000:22C0)

3Ch	F000:1C46 (only if burn-in)
3Dh	F000:1C4D (only if burn-in)
3Eh	F000:1C3F (only if burn-in)

3Fh	checked at F000:2286, if !=0 then clear CMOS[13][6]