Ardent Tool of Capitalism

IBM SCSI Serial Console

Introduction
Versions
Hardware Interface
Entering the Console
Commands
Memory Map
Further Reading

Content by Tomáš Slavotínek. Last update: 08 Oct 2023

Introduction

The Serial Console discussed here is a feature of the microcode of all IBM SCSI subsystems (excluding OEM solutions — "Patriot"). It can be used to debug the SCSI microcode and monitor the status of the SCSI subsystem. The console can't be accessed from the host system; a terminal connected to the adapter's diagnostic port is required.

Note: The console is not documented or even mentioned in any known IBM resource. The information presented here was obtained via reverse engineering by Tomáš Slavotínek. Please report any discrepancies or omissions.

Disclaimer: The author is not responsible for damage or data loss caused by the use of the published information. You are proceeding at your own risk!

Versions

Different versions of the console exist. What version is available depends on the architecture of the SCSI subsystem — specifically the used microcontroller (8032, 80188, or 80186) and host bus structure (MCA or local bus):

Note: It appears that all firmware builds for a particular architecture come with the same console version, regardless of the microcode level. However, not all microcode images were available at the time of writing.

Hardware Interface

The implementation of the diagnostic port differs between the various adapters/planars, but the RXD, TXD, and GND pins are present in all cases:

• SCSI Adapter/A, Old SCSI A/16 & 2/3 Length SCSI/A
  Location: "Reserved" pins of the external SCSI connector
  Signals: GND - pin 58, RXD - pin 59, TXD - pin 60
• Old SCSI w/ Cache & Newer SCSI w/ Cache
  Location: pads for 4-pin header (1 key) next to the internal SCSI port
  Signals (left to right): TXD, GND, KEY, RXD
• Newest SCSI w/ Cache
  Location: 2x5-pin edge-card next to the internal SCSI port
  Signals (pinout HERE): GND (3x), +5V (2x), RXD, TXD, CHRESET, BURNIN, ITS
• 2/3 Length SCSI w/ cache
  Location: "Reserved" pins of the external SCSI connector + set of test points
  Signals ext.: GND - pin 58, RXD - pin 59, TXD - pin 60
  Signals int.: RXD - TP1, GND - TP2, TXD - TP3
• New Japanese SCSI A/16
  Location: pads for 6-pin connector next to the internal SCSI port
  Signals (left to right): CHRESET, ITS, BURNIN, TXD, RXD, GND
• Old Japanese SCSI A/32 & New Japanese SCSI A/32
  Location: pads for 7-pin connector next to the internal SCSI port
  Signals (left to right): +5V, ITS, BURNIN, CHRESET, TXD, RXD, GND
• SCSI-2 F/W & SCSI-2 Differential F/W
  Location: 6-pin header next to the internal SCSI port
  Signals (pinout HERE): +5V, ALIVE, BURNIN, RXD, TXD, GND
• 9556 / 9557, 9585 "X" & Bermuda, possibly also 8556 / 8557
  Location: pads for 4-pin header (1 key) next to the internal SCSI port
  Signals (pins 1-4): RXD, GND, KEY, TXD (RXD/TXD are swapped compared to Spock)

Here is a description of the signals (not all are required for the console connection):

Legend:

Dir.	Signal direction (O - output from the SCSI subsys., I - input to the SCSI subsys.)
*	The CHRESET signal is produced by the planar logic and is then passed through the SCSI adapter to the debug interface.

All signals use TTL levels (0 - 5 V). Do NOT connect a regular RS-232 port to this interface — damage may occur because of different logic levels. Use an RS232-TTL or USB-TTL UART adapter or other suitable TTL-compatible device to interface with the port. If you want to attach another PS/2 machine for debugging, use the TTL Async Adapter or an RS-232-TTL adapter plugged into a standard RS-232 port.

8032-based Adapters

Connect the TXD pin of one device to the RXD pin of the other.
Connect the ground of both devices together to provide a common reference point.

The TXD and RXD signals of these adapters are NOT logically inverted and can be connected directly to the UART IC on the terminal's side.

The "Terminal" block represents the USB-TTL, RS232-TTL or other UART interface.

80188 & 80186-based Adapters

The TXD and RXD signals of these adapters are logically inverted. It's, therefore, necessary to invert them again. Otherwise, neither device will be able to decode the serial data from the other side (this cannot be done after the fact in software because even the idle level and start/stop bits need to be inverted, not just the actual data). Some UART ICs can be configured to invert the RXD/TXD lines internally — e.g. the FT232R USB UART (the device must be re-flashed using FTDI's FT_PROG utility). If your UART IC allows this, you don't need the external inverters.

Additionally, a breakable loopback connection is required. This can be achieved by shorting the SCSI adapter's TXD and RXD lines together — i.e. a push button connected between the two pins. See "Entering the Console" below for more information on why this is necessary.

Refer to the schematic below to see how the inverters and the "loopback" button should be wired.

The "Terminal" block represents the USB-TTL, RS232-TTL, or other UART interface.

Switch debouncing is a good practice but it's not absolutely required here.

The inversion can be achieved using any suitable device — e.g. the 74F04 Hex Inverter connected as follows:

• terminal TXD → 74F04 pin 1 (input A0)
• 74F04 pin 2 (output -O0) → SCSI RXD (and one side of the button)
• SCSI TXD (and the other side of the button) → 74F04 pin 3 (input A1)
• 74F04 pin 4 (output -O1) → terminal TXD
• terminal GND, SCSI GND, and 74F04 pin 7 (GND) connected together
• terminal +5V (or SCSI +5V*) → 74F04 pin 14 (Vcc)

* Do not connect the terminal +5V and SCSI adapter +5V rails together! Use one source and leave the other unconnected. Otherwise, damage may occur. The SCSI adapter's +5V supply is unfused! Many USB-TTL dongles have an onboard fuse, and the USB port itself should have internal protection too. It may therefore be safer to supply the voltage from the USB dongle.

Entering the Console

Serial Link Parameters

All implementations use the same serial link settings:

• 1200 bauds
• 8 bits/character
• No parity
• 1 stop bit (1.5 or 2 stop bits work too)
• No flow control

This is also known as the "1200 8N1" configuration.

Any terminal emulator should work — HyperTerminal (included with Windows up to XP), PuTTY, RealTerm, Tera Term, etc.

The console invocation method differs between the 8032 and 80188/80186 implementations.

8032-based Adapters

The console of the 8032-based adapters can be entered by simply sending a "carriage return" character (0x0Dh) over the serial interface — i.e. pressing the Enter key.

You need to enable "Local Echo" (sometimes also called "Half Duplex") in the terminal settings to see your keyboard input when connected to an 8032-based subsystem.

80188 & 80186-based Adapters

On the 80188 & 80186-based adapters, the console can't be invoked from the terminal. Instead, the MCU pulls the TXD line high and checks whether the RXD line is at the same level. If yes, it pulls TXD low and checks if RXD follows the change. If a mismatch is detected, the process is aborted and retried after a delay (with the MCU performing other tasks in the meantime). Ultimately, 128 low/high pulses are transmitted, and if all of them are received back, the microcode activates the console. The pulses are not valid UART traffic. The MCU writes and reads them as quickly as possible with a period of ~7.32 µs (~136.6 kHz) and the entire burst taking slightly less than a millisecond (all values are for the SCSI-2 F/W adapter). The interval between (unsuccessful) attempts depends on the implementation and computational load (~24 ms for the Newest SCSI w/ Cache when idle; ~13.5 ms for the SCSI-2 F/W adapter when idle).

Given the nature of the pulses, they can't be echoed using a serial terminal. Instead, a loopback connection must be created temporarily. A crude but sufficient implementation may consist of a simple pushbutton connected across the SCSI adapter's RXD and TXD pins, as described in the "Hardware Interface" section. The timing of the button press is not critical — wait for the adapter to initialize and then press the button briefly. The only downside of this method is that the loopback connection lasts significantly longer than it should (~1 ms). As a result, the initial console announcement may get suppressed. If that happens, press the Enter key, and the ">" prompt should appear if the console is active.

Note: Ideally, the switch should be replaced by a more sophisticated device that disconnects the loopback shortly after the last impulse (a logic circuit or an MCU).

The 80188 & 80186-based implementations echo the keyboard automatically, and "Local Echo" should be turned off to prevent character duplication.

Console Announcement

The version 1.0 & 1.2 console announces itself by printing the version string followed by the ">" prompt:

Console Version 1.0

>

The version 2.2 console prints the version string, followed by the Trace output, and finally the ">" prompt:

Console Version 2.2

F000:0223 A80174
>

The version 3.1 console prints the version string, followed by the Register dump, and finally the ">" prompt:

Console Version 3.1

AX=F302  BX=01EA  CX=B000  DX=B000  SP=F6CC  BP=0000  SI=0017  DI=0980
DS=1000  ES=B000  SS=0000  CS=2000  IP=0943   NV UP EI PL NZ NA PO NC
2000:0943 B90000
>

Commands

The console provides a set of commands partially inspired by the DEBUG utility shipped with most versions of MS-DOS/PC DOS.

Here is an alphabetical list of commands across all architectures/console versions:

Arguments in [brackets] are optional.

Below is a complete list of commands supported by the different console versions (in the same order as they are defined in the microcode):

If an unsupported command or missing/invalid argument is detected, the console responds with the following message:

Syntax Error

All displayed and entered values are hexadecimal. The input is case insensitive (both commands and values).

B - Dump

Otherwise the same as the D command.

D - Dump

Displays (dumps) the contents of memory in 128 B blocks. The valid address range and segment assignments are architecture-dependent.

If no address is supplied, the dump continues where it stopped the last time the command was used.

If only one value is supplied on the 80188/801866 it is used as the offset while the segment remains unmodified.

Example for 8032

>d 0
			ROM SEGMENT
0000  02 00 AC 02 52 8A 00 00-00 00 00 02 06 4D 00 00   ..¬.R.......M..
0010  00 00 00 02 07 E6 00 00-00 00 00 02 06 99 00 00   .....ć.........
0020  00 00 00 02 06 9E 00 00-00 00 00 02 05 D3 49 42   ............ÓIB
0030  4D 20 50 53 2F 32 20 4D-49 43 52 4F 43 48 41 4E   M PS/2 MICROCHAN
0040  4E 45 4C 20 53 43 53 49-20 41 44 41 50 54 45 52   NEL SCSI ADAPTER
0050  20 4D 49 43 52 4F 43 4F-44 45 56 45 52 53 49 4F    MICROCODEVERSIO
0060  4E 20 30 30 31 32 28 43-29 20 43 4F 50 59 52 49   N 0012(C) COPYRI
0070  47 48 54 20 49 42 4D 20-43 4F 52 50 20 31 39 38   GHT IBM CORP 198

Note: Certain characters may cause the output formatting to break.

Example for 80188/80186

>d 2000:0000
2000:0000  E9 00 01 49 42 4D 20 50-53 2F 32 20 4D 69 63 72   ...IBM PS/2 Micr
2000:0010  6F 63 68 61 6E 6E 65 6C-20 53 43 53 49 20 44 75   ochannel SCSI Du
2000:0020  61 6C 20 42 75 73 20 41-64 61 70 74 65 72 20 52   al Bus Adapter R
2000:0030  65 76 69 73 69 6F 6E 20-4C 65 76 65 6C 20 30 30   evision Level 00
2000:0040  37 33 20 28 43 29 20 43-6F 70 79 72 69 67 68 74   73 (C) Copyright
2000:0050  20 49 42 4D 20 43 6F 72-70 2E 20 31 39 38 39 2D    IBM Corp. 1989-
2000:0060  31 39 39 34 20 41 6C 6C-20 72 69 67 68 74 73 20   1994 All rights
2000:0070  72 65 73 65 72 76 65 64-2E 20 55 53 20 47 6F 76   reserved. US Gov

E - Enter

Enters a single-byte value to a specified address in memory.

The command prints the original value first and then prompts the user to enter the new value (or press Enter to continue without modification).

If only one value is supplied on the 80188/801866 it is used as the offset while the segment is set to 0.

Example for 8032

The following example changes the byte at address 8000h from 00h to DEh:

>e 8000
8000	00.de

Example for 80188/80186

The following example changes the byte at address 1000:0000h from D2h to 46h:

>e 1000:0000
1000:0000	D2.46

F - Fill

Fills a block of memory with a specified byte value (8032) or pattern (80186).

The available patterns for the 80186-based subsystem are:

Example for 8032

The following example fills a 16-byte long block of memory starting at address 8100h with the CDh byte value:

>f 8100 10 cd

The following example demonstrates an attempt to fill a read-only memory segment:

>f 1000 1 1
ERROR: Cannot fill ROM

Example for 80186

The following example fills a 16-byte long block of memory starting at address 1000:1234h with the "AAh 55h" pattern (ptrn #2):

>f 10 0 12 34 0 10 2

ID - Internal Dump

Displays (dumps) the contents of the MCU's internal RAM in 128 B blocks.

If no address is supplied, the dump continues where it stopped the last time the command was used.

Example

>id 20
			INTERNAL RAM
0020  30 00 10 00 00 F9 02 59-04 07 72 14 6F 08 81 6C   0....ů.Y..r.o.l
0030  6F E4 05 30 00 30 00 00-00 00 00 00 00 00 00 00   oä.0.0..........
0040  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
0050  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
0060  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 32   ...............2
0070  20 07 44 00 00 00 00 00-00 00 00 00 00 00 00 00    .D.............
0080  81 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ...............
0090  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................

Note: Certain characters may cause the output formatting to break.

IE - Internal Enter

Enters a single-byte value to a specified address of the MCU's internal RAM.

The command prints the original value first and then prompts the user to enter the new value (or press Enter to continue without modification).

Example

The following example changes the byte at address 0010h of the MCU's internal RAM from 56h to ABh:

>ie 10
0010	56.ab

T - Trace

Used to step through (trace) MCU instructions one at a time.

Once an instruction is executed the command displays the new instruction pointer (IP) address and the value of the three bytes located at said address (machine code).

Example

>t

F000:0188 50521E

"50521E" represents the following instruction sequence: "push ax" (op code 50h), "push dx" (52h), and "push ds" (1Eh).

R - Register

If no register name is supplied, the command displays the contents of all 80188/80186 registers, the status of the Flags register, followed by the Trace output.

If a register name is supplied, the command displays the current value of said register first and then prompts the user to enter a new value (or press Enter to continue without modification).

List of the labels indicating the status of the 80188/80186 Flags register:

Example

>r
AX=F302  BX=01EA  CX=B000  DX=B000  SP=F6CC  BP=0000  SI=0017  DI=0980
DS=1000  ES=B000  SS=0000  CS=2000  IP=0943   NV UP EI PL NZ NA PO NC
2000:0943 B90000

"B90000" represents the "mov cx, 0" instruction with opcode B9h located at the instruction pointer (IP) address. All Flags except for Interrupt (EI) are clear.

The following example changes the value of the AX register from 0001h to 2000h:

>r ax
AX 0001
:2000

I - Input

Reads a value from a specified I/O port. The port number must be within the <0 .. FFh> range for the 8032-based implementations and <0 .. FFFFh> for the 80188/80186.

Example

The following example reads the value 80h from the I/O at address 10h:

>i 10
80

O - Output

Writes a value to a specified I/O port. The port number must be within the <0 .. FFh> range for the 8032-based implementations and <0 .. FFFFh> for the 80188/80186.

Example

The following example writes the value ABh to the I/O at address 10h:

>o 10 ab

LED - LED Control

Controls the diagnostic LED. The value can be either 0 (off) or 1 (on).

The LED is present on the following boards:

• Corvette (CR2 — solder side, near the SCSI edge connector)
• Corvette Turbo (CR1 — component side, near the microcode flash)
• Enhanced Corvette Turbo (CR1 — component side, near the microcode flash)
• 9585-K/N Planar (CR1 — component side, next to the bottom-most MCA slot)
• 7012-397 Planar (CR1 — component side, next to the first MCA slot)

Example

The following example turns the diagnostic LED on:

>led 1

REV - Revision

Prints revision levels of the following items:

• SCSI microcode
• MCA bus interface chip "Malibu"
• Internal SCSI controller "Cutlass"
• External SCSI controller "Cutlass"

Example

>rev
Microcode Revision Level        = 73
Malibu Revision Level           = 02
Internal Cutlass Revision Level = 04
External Cutlass Revision Level = 04

FI - Failure Info

Prints failure information?

Example

>fi
Failure ID = D000   Test Number = 2C

STAT - Status

Prints status information for the various SCSI subsystem components?

Example for 80188

>stat
       ISR ESR
KORBEL  7C 31
SPICOLI 00 00

It's currently unknown where "Korbel" and "Spicoli" are on the SCSI w/ cache adapters ("Spock" & "Spock Prime"). Possibly the two large ASICs?

Example for 80186

>stat
        ISR ESRI ESRII
MALIBU  1F  00   00

"Malibu" is the MCA bus interface chip used on the SCSI-2 F/W adapters.

RC1A - Register Channel 1 A
RC1B - Register Channel 1 B
RC3 - Register Channel 1 3?

Prints contents of some registers.

Example

>rc1a
Channel 1 A Registers:

        ADDRESS  XFER CONTROL
KORBEL  00000000 0000 00
SPICOLI   000000 0000 00

>rc1b
Channel 1 B Registers:

        ADDRESS  XFER CONTROL
KORBEL  00000000 0000 00
SPICOLI   000000 0000 00

>rc3
Channel 1 3 Registers:

        ADDRESS  XFER CONTROL
          000000 0000 00

RLTB - Register LTB

Prints contents of the Local Transfer Bus (LTB) registers?

Example

>rltb
LTB Channel  Registers:

        ADDRESS   XFER   CONTROL

MALIBU  0000300F  000000 00

RSCB - Register SCB

Prints contents of the Subsystem Control Block (SCB) registers?

Example

>rscb
SCB Channel  Registers:

        ADDRESS   XFER   CONTROL

MALIBU  00026664  2424   00

Q - Quit

Leaves the Serial Console environment.

Example

>q
Leaving Console

@ - Recall

Recalls the last command. The user can edit the command before resubmitting it (by pressing Enter).

Memory Map

8032 Internal Memory

8032 External Memory

The 8032-based MCA SCSI architecture has the following memory segments (console version 1.0):

The 8032-based Local Bus SCSI architecture ("Jalpa" & "Monarch") has the following memory segments (console version 1.2):

80188 External Memory

The 80188-based MCA SCSI architecture has the following memory segments (console version 2.2):

80186 External Memory

The 80186-based MCA SCSI architecture has the following memory segments (console version 3.1):

Legend:

Dec. Size

Decoded size - in some cases larger than the actual size of the mapped device.

Further Reading

• MCS 51 8-Bit Control-Oriented Microcontrollers (Intel; datasheet)
• MCS 51 Microcontroller Family User's Manual (Intel)
• Intel 80186/80188 Documentation (directory)
• AMD 80186/80188 Documentation (directory)
• DOS DEBUG Commands (by Joe Toone)