Intel® Server System Server System "Emerald Ridge ... - CTL

Intel ® Server System "Emerald Ridge”Integrated Baseboard ManagementControllerExternal Product SpecificationRevision 1.1May, 2010Enterprise Platforms and Services Division – Marketing

Revision History錯 誤 ! 尚 未 定 義 樣 式 。 EPSRevision HistoryDateRevModificationsApril 2009 0.3 Initial release. Based on Thurley Common Core FW EPS 1_0_6.May 2009 0.5 Updated 3.16 Standard Fan Management sectionUpdated Set fan Control configuration command in Table 67. SMM CommandsAdded new FSC SDR record format to the table.Updated Memory Hot Plug and Power Supply Fan management sectionsAdded section 14. Chassis management informationMoved Fan mapping table from Fan domain section to Chassis managementsection, updated Fan mapping table with sensor numbers and Chassis names.Updated fan present sensors numbers in sensors table.June 2009 .51 Incorporated internal review commentsUpdated i2c device tableAdded BMC reset command in restart causeJune 2009 .7 Incorporated feedback received for V .51Added DHCP HostnameAug 2009 .71 Section 3.31 BMC Self Test - Table 16: BMC Self Test Results is correctedAdded Section 4.9.6: DHCP HostnameMade changes to Power Supply Fan Speed ControlCorrected “:Acquire System Semaphore” commandMade changes to Power Supply Fan monitoring offsetsSensor Table modified for PS FansSept 2009 .80 Updated Thermal Profile data sdr record formatUpdated section 3.14.4 Processor Thermal Control MonitoringUpdated Get fan Control Configuration Command descriptionUpdated Set Fan Control Configuration command descriptionAdded domain 4 for PS and Revised Fan Domain definition with clear sensornumbers definition.Added “Heartbeat LED” SectionAdded “Global Fan Fault LED” sectionFixed few formatting issues and updated table numbersEmerald Ridge Tracker Fixedo 111766- Need the value of product id for ''Get Device ID'' commandin BMC EPS.o 111181-All Processors Thermal control events were logged whileheat one CPU to gererate it.o 109971- ''Set System GUID'' value isn't stored persistently.o 109726- 'Set SM Signal'' to revert FanPowerSpeed Signal resultreturns 0xC7.iiIntel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSRevision HistoryDateRevOct 2009 .90 Merged with Thurley EPS 1.12ModificationsChanged DIMM mapping section for Set Fault Indication and Set Fan ControlConfiguration.Changed Memory Power Failure Monitoring sectionChanged sensors characteristics for “Memory Power Fail”Changed stand-by availability for DIMM and Millbrook sensors.Updated “System Status LED Indicator “ tableFixed formatting / broken header and footersUpdated Fan Redundancy Detection section.Updated Fan redundancy sensor with supported offsets.Updated chassis section with “Global Fan Fault LED”Table 70 updated to reflect new PS Redundancy Configuration.Updated FAN Redundancy sensor with IPMI supported offsets.Dec 2009 .95 Updated section 3.5.4 – Removed LCP support Corrected OEM Get Reading cmd in Table 51Updated Get SM Signal in command tableUpdated sensor table - Processor status sensor - Presence de-assertion supportremoved.Updated CPU offline/online section.Updated IOH2 offline/online section.Remove IOH1 and IOH2 thermal trip scanning in standby modeUpdated FAN domains table with correct CPU and IOH Numbers.Added CSS LED SectionUpdated section: Power Supply Failure ManagementUpdated section: Server Chassis Support for QSSC-S4RReplaced SxxxR platform name with QSSC 0- S4RAdded MDR sectionAdded IPMIMessaging flag behavior in User modelTracker Fixed:112795-Get FRU Inventory Area Info for HSBP get response 0xCB 110217-Processor, Memory Riser cards numbering is not consistent in EPS 0.3.109990- Verify alerting behavior via the backup gateway failed.112985- There is discrepancy between the Number of possible sessions BMCreturns and the actual session establishment.112873: The description of section ''Server Chassis Support for SxxxxER'' onEPS 0.9 should be modified.113045: Power supply fan didn't back to normal speed after issue command torearm it from failure status.112857: Enabled user count does not matchexpected value during user access test.111858: [SLV] RMM3: ME version not displayed when signed in as an 'Operator'.112825 - The SEL length in BMC EPS v0.09 violates the IPMI spec.Revision 1.1Intel ® Confidentialiii

Revision History錯 誤 ! 尚 未 定 義 樣 式 。 EPSDateRevMarch 2010 1.0 Removed CPU offline/online section.Removed IOH2 offline/online section.ModificationsAdded the minimum length requirement for setting user name and passwordthrough Embedded Web Server.Reviewed and updated by technical writer.Updated Get Thermal Profile Data command response bytesMay 2010 1.1 Correct VRD Hot and SMI Timeout sensors behavior in “System Status LEDIndicator “ table. Correct event offset trigger for Memory Riser Power Fail sensor in table 76. Remove the unnecessary description in the section 3.14.4 Correct the Max number of PEF Alert Policy in the section 4.9.14 Add non-hot swap fans behavior in the section 3.16.1. Add PSx_TEMP_STBY sensors in table 76. Modify the PS Temperature sensor definition in the section 3.27.2.3.Update “Processor Voltage Regulator (VRD) Over-Temperature Sensor“ section.Update “Power Throttle Sensor” section. Add 2+0 PS configuration supported in the section 14.1.1.ivIntel ConfidentialRevision1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSDisclaimersDisclaimersInformation in this document is provided in connection with Intel ® products. No license, express or implied, byestoppels or otherwise, to any intellectual property rights is granted by this document. Except as provided in Intel’sTerms and Conditions of Sale for such products, Intel assumes no liability whatsoever, and Intel disclaims anyexpress or implied warranty, relating to sale and / or use of Intel products including liability or warranties relating tofitness for a particular purpose, merchantability, or infringement of any patent, copyright or other intellectual propertyright. Intel products are not intended for use in medical, life saving, or life sustaining applications. Intel may makechanges to specifications and product descriptions at any time, without notice.Designers must not rely on the absence or characteristics of any features or instructions marked “reserved” or“undefined.” Intel reserves these for future definition and shall have no responsibility whatsoever for conflicts orincompatibilities arising from future changes to them.This document contains information on products in the design phase of development. Do not finalize a design withthis information. Revised information will be published when the product is available. Verify with your local sales officethat you have the latest datasheet before finalizing a design.The 錯 誤 ! 尚 未 定 義 樣 式 。 may contain design defects or errors known as errata which may cause the product todeviate from published specifications. Current characterized errata are available on request.This document and the software described in it are furnished under license and may only be used or copied inaccordance with the terms of the license. The information in this manual is furnished for informational use only, issubject to change without notice, and should not be construed as a commitment by Intel Corporation. IntelCorporation assumes no responsibility or liability for any errors or inaccuracies that may appear in this document orany software that may be provided in association with this document.Except as permitted by such license, no part of this document may be reproduced, stored in a retrieval system, ortransmitted in any form or by any means without the express written consent of Intel Corporation.Intel, Pentium, Itanium, and Xeon are trademarks or registered trademarks of Intel Corporation.*Other brands and names may be claimed as the property of others.Copyright © Intel Corporation 2007 - 2010. All rights reserved.Revision 1.1Intel ® Confidentialv

Table of Contents錯 誤 ! 尚 未 定 義 樣 式 。 EPSTable of Contents1. Introduction ........................................................................................................................11.1 Order of Precedence..............................................................................................11.2 Audience................................................................................................................12. Architectural Overview.......................................................................................................22.1 Feature Support .....................................................................................................22.1.1 IPMI 2.0 Features...................................................................................................22.1.2 Non IPMI Features .................................................................................................32.1.3 Basic and Advanced Features................................................................................42.2 BMC Hardware: ServerEngines* Pilot II .................................................................42.2.1 ServerEngines* Pilot II Baseboard Management Controller Functionality...............43. Functional Specifications ..................................................................................................73.1 Power System ........................................................................................................73.1.1 Power Supply Interface Signals..............................................................................83.1.2 Power-Good Dropout .............................................................................................83.1.3 Power-up Sequence...............................................................................................83.1.4 Power Down Sequence..........................................................................................93.1.5 Power Control Sources ..........................................................................................93.1.6 Power State Retention .........................................................................................103.1.7 Power State Restoration ......................................................................................103.1.8 Wake-On-LAN (WOL) ..........................................................................................103.2 Advanced Configuration and Power Interface (ACPI)...........................................113.2.1 ACPI Power Control .............................................................................................113.2.2 ACPI State Synchronization .................................................................................113.3 System Reset Control ..........................................................................................113.3.1 Reset Signal Output .............................................................................................113.3.2 Reset Control Sources .........................................................................................123.3.3 Front Panel System Reset....................................................................................123.3.4 Soft Reset and Hard Reset...................................................................................123.3.5 BMC Command to Cause System Reset..............................................................123.3.6 Watchdog Timer Expiration ..................................................................................123.4 System Initialization..............................................................................................133.4.1 Processor TControl Setting ..................................................................................133.4.2 Fault Resilient Booting (FRB) ...............................................................................133.4.3 BSP Identification.................................................................................................143.4.4 Boot Control Support............................................................................................143.4.5 Post Code Display................................................................................................143.4.6 BMC Resident SMBIOS Data Storage (Managed Data Region)...........................14viIntel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSTable of Contents3.5 Integrated Front Panel User Interface ..................................................................153.5.1 Power LED...........................................................................................................153.5.2 System Status LED ..............................................................................................153.5.3 Chassis ID LED....................................................................................................163.5.4 LCD Panel: Intel ® Local Control Panel..................................................................173.5.5 Front Panel / Chassis Inputs ................................................................................173.5.6 Front Panel Lock-out Operation ...........................................................................183.6 Private Management I2C Buses...........................................................................183.7 Watchdog Timer...................................................................................................193.8 BMC Internal Timestamp Clock............................................................................193.8.1 BMC Clock Initialization........................................................................................193.8.2 System Clock Synchronization .............................................................................203.9 System Event Log (SEL) ......................................................................................203.9.1 Servicing Events ..................................................................................................203.9.2 SEL Entry Deletion...............................................................................................203.9.3 SEL Erasure.........................................................................................................203.10 Sensor Data Record (SDR) Repository ................................................................213.10.1 SDR Repository Erasure ......................................................................................213.10.2 Initialization Agent ................................................................................................213.11 Field Replaceable Unit (FRU) Inventory Device ...................................................213.11.1 BMC FRU Inventory Area Format.........................................................................223.11.2 BMC FRU ID Mapping..........................................................................................223.12 Diagnostics and Beep Code Generation...............................................................223.12.1 Signal Generation ................................................................................................233.13 Sensor Rearm Behavior .......................................................................................233.14 Processor Sensors...............................................................................................243.14.1 Processor Status Sensors....................................................................................253.14.2 Processor Voltage Regulator (VRD) Over-Temperature Sensor...........................263.14.3 Digital Thermal Sensor.........................................................................................263.14.4 Processor Thermal Control Monitoring (Prochot)..................................................263.15 Voltage Monitoring ...............................................................................................273.16 Standard Fan Management..................................................................................273.16.1 Hot-Swap Fans ....................................................................................................283.16.2 Fan Redundancy Detection ..................................................................................283.16.3 Fan Domains........................................................................................................293.16.4 Nominal Fan Speed..............................................................................................293.16.5 Thermal and Acoustic Management .....................................................................333.17 DIMM Thermal Margin Sensor .............................................................................343.18 IOH thermal Margin Sensor..................................................................................363.19 Memory Buffer thermal Margin Sensor.................................................................363.20 Add in card thermal margin sensor.......................................................................36Revision 1.1Intel ® Confidentialvii

Table of Contents錯 誤 ! 尚 未 定 義 樣 式 。 EPS3.21 Power Throttle Sensor..........................................................................................373.22 Memory Riser Power Failure Monitoring...............................................................373.23 Memory Hot Plug and Memory Offline/Online.......................................................383.23.1 Sequence of Operations during Memory Hot Plug................................................393.24 HeartBeat LED.....................................................................................................423.25 CSS LED..............................................................................................................423.26 Global Fan Fault LED...........................................................................................433.27 Power Management Bus (PMBus) .......................................................................433.27.1 PMBus Addressing...............................................................................................433.27.2 PMBus-specific Sensor Support...........................................................................433.28 Power Unit Management......................................................................................443.28.2 Power Supply Fan Monitoring ..............................................................................463.28.3 Power Supply Fan Speed Control ........................................................................473.28.4 Power Supply Failure Management......................................................................483.28.5 Power Supply Status Sensors ..............................................................................493.28.6 Power Unit Redundancy.......................................................................................493.29 Event Message Generation and Reception ..........................................................503.30 Event Logging Disabled Sensor ...........................................................................503.31 SMI Timeout Sensor.............................................................................................503.32 BMC Self Test......................................................................................................503.33 BMC Test Commands..........................................................................................513.34 Component Fault LED Control .............................................................................523.34.1 Set Fault Indication Command .............................................................................523.34.2 DIMM Mapping for Fault Indication and Fan Control Config: ................................533.35 Hot-Swap Controller.............................................................................................533.35.1 Backplane Types..................................................................................................533.36 LAN Leash Event Monitoring................................................................................543.37 CATERR Reporting..............................................................................................543.38 CMOS Battery Monitoring.....................................................................................544. Messaging Interfaces .......................................................................................................554.1 Channel Management..........................................................................................554.2 User Model...........................................................................................................564.3 Sessions ..............................................................................................................574.4 Media Bridging .....................................................................................................584.5 Request / Response Protocol...............................................................................594.6 Host to BMC Communication Interface.................................................................594.6.1 LPC / KCS Interface.............................................................................................594.6.2 Receive Message Queue .....................................................................................594.6.3 SMS / SMM Status Register.................................................................................604.6.4 Server Management Software (SMS) Interface ....................................................604.6.5 SMM Interface......................................................................................................61viiiIntel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSTable of Contents4.7 IPMB Communication Interface............................................................................614.7.1 BMC as I 2 C Master Controller on IPMB................................................................624.7.2 IPMB LUN Routing...............................................................................................624.7.3 Management Engine IPMB...................................................................................634.8 IPMI Serial Feature ..............................................................................................634.8.1 COM Port Switching.............................................................................................644.8.2 Terminal Mode .....................................................................................................644.9 LAN Interface .......................................................................................................654.9.1 IPMI 1.5 Messaging..............................................................................................654.9.2 IPMI 2.0 Messaging..............................................................................................654.9.3 RMCP / ASF Messaging ......................................................................................664.9.4 BMC Embedded LAN Channels ...........................................................................664.9.5 BMC IP Address Configuration.............................................................................674.9.6 DHCP BMC Hostname.........................................................................................694.9.7 Address Resolution Protocol (ARP)......................................................................704.9.8 Internet Control Message Protocol (ICMP) ...........................................................704.9.9 Virtual Local Area Network (VLAN) ......................................................................704.9.10 Secure Shell (SSH) ..............................................................................................704.9.11 Serial-over-LAN (SOL 2.0) ...................................................................................704.9.12 Platform Event Filter (PEF)...................................................................................704.9.13 LAN Alerting.........................................................................................................714.9.14 Alert Policy Table .................................................................................................715. BMC Flash Update............................................................................................................735.1 Logical Firmware Image Blocks............................................................................735.2 Firmware Transfer Mode Update..........................................................................735.2.1 Command Support during Firmware Transfer Mode.............................................745.3 Boot Recovery Mode............................................................................................755.4 Force Firmware Update Jumper...........................................................................755.5 Restore Default Configuration ..............................................................................765.6 Fast Firmware Update over USB..........................................................................766. Advanced Management Feature Support .......................................................................776.1 Enabling Advanced Management Features..........................................................776.1.1 Intel ® Remote Management Module 3 (Intel ® RMM3) ...........................................776.2 Keyboard, Video, Mouse (KVM) Redirection ........................................................776.2.1 Keyboard and Mouse ...........................................................................................776.2.2 Video....................................................................................................................776.2.3 Availability ............................................................................................................776.3 Media Redirection ................................................................................................776.3.1 Availability ............................................................................................................786.4 Web Services for Management (WS-MAN) ..........................................................786.4.1 Profiles.................................................................................................................78Revision 1.1Intel ® Confidentialix

Table of Contents錯 誤 ! 尚 未 定 義 樣 式 。 EPS6.4.2 Embedded Web Server ........................................................................................796.4.3 Local Directory Authentication Protocol (LDAP) ...................................................797. BMC-HSC Interactions .....................................................................................................807.1 HSC Availability....................................................................................................807.2 Interactions ..........................................................................................................808. BIOS-BMC Interactions ....................................................................................................819. Node Management (NM)...................................................................................................829.1 Overview..............................................................................................................829.2 Command Bridging ..............................................................................................829.2.1 External Communications Link .............................................................................829.2.2 Alerting.................................................................................................................829.2.3 System Information Passed to ME and POST Complete Notification ...................839.2.4 ACPI Mode Notification ........................................................................................839.2.5 Persistence across Boots.....................................................................................839.3 Management Engine (ME)....................................................................................839.3.1 Overview..............................................................................................................839.3.2 ME Firmware Update ...........................................................................................839.3.3 Management Engine Interaction...........................................................................8410. IPMI Command Interface..................................................................................................8510.1 Command Queuing ..............................................................................................8510.2 Power On / Off Issues Related to Commands ......................................................8510.3 BMC Command Tables ........................................................................................8610.4 Completion Codes..............................................................................................12710.5 Command Support .............................................................................................12811. RMCP+Command Interface............................................................................................13312. SMM Commands.............................................................................................................13413. Sensors ...........................................................................................................................13613.1 Sensor Type Codes............................................................................................13614. Chassis Management.....................................................................................................15414.1 BMC Chassis Management................................................................................15414.1.1 Server Chassis Support for QSSC-S4R .............................................................155Appendix A: OEM SDR Records ..........................................................................................160Power Unit Map Record.......................................................................................................161Fan Speed Control Record ..................................................................................................162System Information Record..................................................................................................163Fan Redundancy Map Record .............................................................................................163Voltage Sensor Scaling SDR Record...................................................................................164Fan Sensor Scaling SDR Record.........................................................................................164Thermal Profile Data SDR Record .......................................................................................165Fan Speed Control Record ..................................................................................................166OEM SDR Tag Record Format ............................................................................................171xIntel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSTable of ContentsNode Manager Discovery Record Format............................................................................172Chassis/FRU Fault LED Record Format ..............................................................................172Appendix B: Firmware Device Information Block Format..................................................174Glossary ................................................................................................................................177Reference Documents ..........................................................................................................180Revision 1.1Intel ® Confidentialxi

List of Figures錯 誤 ! 尚 未 定 義 樣 式 。 EPSList of FiguresFigure 1. BMC Hardware ............................................................................................................6Figure 2. BMC Power / Reset Signals .........................................................................................7Figure 3. SMBUS Topology.......................................................................................................19Figure 4. Stepwise Linear Control Hysteresis............................................................................31Figure 5. Clamp Control Hysteresis...........................................................................................32Figure 6. BMC/BIOS interactions for Memory Hot-Plug/On-line/Off-line Operations..................41Figure 7. BMC IPMB Message Reception.................................................................................63xiiIntel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSList of TablesList of TablesTable 1. Basic and Advanced Features.......................................................................................4Table 2. Power Control Initiators .................................................................................................9Table 3. ACPI Power States......................................................................................................11Table 4. System Reset Sources and Actions ............................................................................12Table 5. System Status LED Indicator States............................................................................16Table 6. List of I2C Buses .........................................................................................................18Table 7. FRU Device ID Map ....................................................................................................22Table 8. BMC Beep Codes .......................................................................................................22Table 9. NMI Signal Generation and Event Logging..................................................................23Table 10. Processor Sensors....................................................................................................24Table 11. Processor Status Sensor Implementation..................................................................25Table 12. Fan Profile Mapping ..................................................................................................33Table 13. PMBus Device Addressing ........................................................................................43Table 14. Power Unit Sensor Offsets ........................................................................................44Table 15. Supported Sensor Offsets .........................................................................................46Table 16 Example PS Fan Lookup Table..................................................................................48Table 17. Power Supply Fan Failure .........................................................................................48Table 18. Power Supply Sensor Offsets....................................................................................49Table 19. BMC Self Test Results ..............................................................................................50Table 20. Set SM Signal Command Signal Definition................................................................51Table 21. Get SM Signal Command Signal Definition ...............................................................51Table 22. DIMM Mapping for Fault Indication and Fan Control Config (Risers 1,3,5, and 7)......53Table 23. DIMM Mapping for Fault Indication and Fan Control Config (Risers 2, 4, 6, and 8)....53Table 24. Standard Channel Assignments ................................................................................55Table 25. Emerald Ridge Channel assignment .........................................................................56Table 26. Default User Values ..................................................................................................57Table 27. Keyboard Controller Style Interfaces .........................................................................59Table 28. SMS / SMM Status Register Bits ...............................................................................60Table 29. BMC IPMB LUN Routing ...........................................................................................62Table 30. Supported RMCP+ Cipher Suites..............................................................................66Table 31. Supported RMCP+ Payload Types............................................................................66Table 32. Factory Configured PEF Table Entries. .....................................................................71Table 33. Firmware Update Mode Commands..........................................................................74Table 34. BMC Intelligent Platform Management Interface (IPMI) Commands..........................86Table 35. BMC Watchdog Timer Commands ............................................................................88Table 36. BMC IPMI Messaging Support Commands ...............................................................88Table 37. BMC Chassis Commands .........................................................................................91Table 38. Chassis Control Command Results...........................................................................92Table 39. Boot Control Commands ...........................................................................................93Revision 1.1Intel ® Confidentialxiii

List of Tables錯 誤 ! 尚 未 定 義 樣 式 。 EPSTable 40. Supported Boot Option Parameters...........................................................................93Table 41. OEM Parameter Block Size.......................................................................................94Table 42. Boot Order Table Description ....................................................................................94Table 43. Slot Configuration Table............................................................................................97Table 44. BMC Event Receiver Device Commands ..................................................................98Table 45. PEF Commands........................................................................................................98Table 46. Supported PEF Configuration Parameters ................................................................99Table 47. BMC Sensor Device Commands ...............................................................................99Table 48. BMC FRU Inventory Device Commands .................................................................100Table 49. BMC SDR Repository Device Commands...............................................................100Table 50. BMC SEL Device Commands..................................................................................101Table 51. LAN Commands......................................................................................................102Table 52. Supported LAN Configuration Parameters...............................................................102Table 53. Emergency Management Port Commands..............................................................105Table 54. Supported Serial Configuration Parameters ............................................................105Table 55. Terminal Mode Commands .....................................................................................106Table 56. Intel General Application Commands ......................................................................107Table 57. Intel General Application Commands for Management Engine................................117Table 58. Advanced Support Configuration Parameters..........................................................119Table 59. Managed Data Command .......................................................................................120Table 60. Response Data bytes structure when we select Management Controller as option .122Table 61. BMC Firmware Transfer Commands .......................................................................123Table 62. SOL 2.0 Commands................................................................................................124Table 63. Supported SOL 2.0 Parameters ..............................................................................125Table 64. SMTP Configuration Commands .............................................................................125Table 65. Supported SMTP Configuration Parameters............................................................126Table 66. IPMI 2.0 Completion Codes.....................................................................................127Table 67. Command Support Matrix, Network Function = Application – 06h ...........................128Table 68. Command Support Matrix, Network Function = Chassis – 00h................................130Table 69. Command Support Matrix, Network Function = Sensor / Event – 04h .....................130Table 70. Command Support Matrix, Network Function = Storage – 0Ah................................130Table 71. Command Support Matrix, Network Function = Transport – 0Ch.............................131Table 72. Command Support Matrix, Network Function = Intel General Application – 30h......131Table 73. Command Support Matrix, Network Function = Immediate Firmware Update – 08h 132Table 74. BMC RMCP+ / RAKP Messages.............................................................................133Table 75. SMM Commands.....................................................................................................134Table 76. Emerald Ridge Sensors Supported .........................................................................138Table 77. Server Chassis Support...........................................................................................155Table 78. Fan Mapping Table .................................................................................................156Table 79. Intel OEM SDR Sub-types.......................................................................................160Table 80. Power Unit Map SDR Record Format......................................................................161xivIntel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSList of TablesTable 81. Example Power Unit Map SDR Record for a 2+1 Power Sub-system......................161Table 82. Fan Speed Control Record Format..........................................................................162Table 83. System Information SDR Record Format ................................................................163Table 84. Fan Redundancy Map SDR Record Format ............................................................163Table 85. Voltage Sensor Scaling SDR Format.......................................................................164Table 86. Fan Sensor Scaling SDR Format ............................................................................164Table 87. Thermal Profile Data SDR Record Format...............................................................165Table 88. Fan Sensor Scaling SDR Format ............................................................................166Table 89. Temperature Fan Speed Control SDR Record Format, Version 2 ...........................167Table 90. Stepwise Linear type Temperature Sensor sub-record............................................168Table 91. Clamp Type Temperature Sensor Sub-record .........................................................169Table 92. Boost value Sub-record...........................................................................................170Table 93 Sensor failure exclusion Sub-record.........................................................................170Table 94. OEM SDR Tag Record Format................................................................................171Table 95. Node Manager Discovery Record Format................................................................172Table 96. Chassis/FRU Fault LED Record Format..................................................................172Table 97: Operational Code Info Block Version 6....................................................................174Table 98: Boot Code Info Block Version 6...............................................................................174Table 99: PIA Info Block Version 3..........................................................................................175Table 100: EFS/Intel ® Remote Management Module 3 (Intel ® RMM3) Info Block Version 1....175Revision 1.1Intel ® Confidentialxv

List of Tables錯 誤 ! 尚 未 定 義 樣 式 。 EPSxviIntel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSIntroduction1. IntroductionThis Emerald Ridge external product specification (EPS) describes the functional specificationsfor the integrated baseboard management controller (BMC) for Intel ® Server Systems with theBoxboro chipset. It describes the functional blocks of the BMC and the interactions among them.It also describes the commands and codes necessary to access, control, and configure theBMC, and to create reliable communications with other controllers on the Intelligent PlatformManagement Bus (IPMB).The Intelligent Platform Management Interface Specification v2.0 describes the communicationinterfaces.1.1 Order of PrecedenceIn the event of a conflict between the text of this document and the references cited herein, thetext of this document takes precedence.1.2 AudienceThis document is intended for the following audiences:Server Management Firmware EngineersSystem BIOS EngineersServer Management Software and Utilities EngineersValidation EngineersPlatform ArchitectsTechnical Marketing EngineersOEM Design EngineersRevision 1.1Intel ® Confidential 1

錯 誤 ! 尚 未 定 義 樣 式 。Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPS2. Architectural Overview2.1 Feature Support2.1.1 IPMI 2.0 FeaturesBaseboard management controller (BMC).IPMI Watchdog timer.Messaging support, including command bridging and user/session support.Chassis device functionality, including power/reset control and BIOS boot flags support.Event receiver device: The BMC receives and processes events from other platformsubsystems.Field replaceable unit (FRU) inventory device functionality: The BMC supports access tosystem FRU devices using IPMI FRU commands.System event log (SEL) device functionality: The BMC supports and provides access to aSEL.Sensor device record (SDR) repository device functionality: The BMC supports storage andaccess of system SDRs.Sensor device and sensor scanning/monitoring: The BMC provides IPMI management ofsensors. It polls sensors to monitor and report system health.IPMI interfaces.- Host interfaces include system management software (SMS) with receive messagequeue support, and server management mode (SMM).- Terminal mode serial interface.- IPMB interface.- LAN interface that supports the IPMI-over-LAN protocol (RMCP, RMCP+).Serial-over-LAN (SOL).ACPI state synchronization: The BMC tracks ACPI state changes that are provided by theBIOS.BMC self test: The BMC performs initialization and run-time self-tests, and makes resultsavailable to external entities.See also the Intelligent Platform Management Interface Specification Second Generation v2.0.2Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSArchitectural Overview2.1.2 Non IPMI FeaturesThe BMC supports the following non-IPMI features. This list does not preclude support for futureenhancements or additions.In-circuit BMC firmware update.Fault resilient booting (FRB): FRB2 is supported by the watchdog timer functionality.Chassis intrusionBasic fan control using TControl version 2 SDRs.Fan redundancy monitoring and support.Power supply redundancy monitoring and support.Hot swap fan support.Acoustic management: Support for multiple fan profiles.Signal testing support: The BMC provides test commands for setting and getting platformsignal states.The BMC generates diagnostic beep codes for fault conditions.System GUID storage and retrieval.Front panel management: The BMC controls the system status LED and chassis ID LED. Itsupports secure lockout of certain front panel functionality and monitors button presses. Thechassis ID LED is turned on using a front panel button or a command.Power state retention.Power fault analysis.Intel ® Light-Guided Diagnostics.Power unit management: Support for power unit sensor. The BMC handles power-gooddropout conditions.Memory Power Failure MonitoringDIMM temperature monitoring: New sensors and improved acoustic management usingclosed-loop fan control algorithm taking into account DIMM temperature readings.Address Resolution Protocol (ARP): The BMC sends and responds to ARPs (supported onembedded NICs)Dynamic Host Configuration Protocol (DHCP): The BMC performs DHCP (supported onembedded NICs).Platform environment control interface (PECI) thermal management support.E-mail alerting.Embedded web server.Integrated KVM.Integrated Remote Media Redirection.Local Directory Access Protocol (LDAP) support.Node Management support.Revision 1.1Intel ® Confidential 3

錯 誤 ! 尚 未 定 義 樣 式 。Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPS2.1.3 Basic and Advanced FeaturesFTable 1 lists basic and advanced feature support.Table 1. Basic and Advanced FeaturesFeatureBasicAdvancedIPMI 2.0 Feature Support YES YESIn-circuit BMC Firmware Update YES YESFRB 2 YES YESChassis Intrusion Detection YES YESFan Redundancy Monitoring YES YESHot-Swap Fan Support YES YESAcoustic Management YES YESDiagnostic Beep Code Support YES YESPower State Retention YES YESARP/DHCP Support YES YESPECI Thermal Management Support YES YESE-mail Alerting YES YESEmbedded Web Server NO YESSSH Support YES YESIntegrated KVM NO YESIntegrated Remote Media Redirection NO YESLocal Directory Access Protocol (LDAP) NO YESNode Management Support YES YESSMASH CLP YES YESWS-Management NO YES2.2 BMC Hardware: ServerEngines* Pilot II2.2.1 ServerEngines* Pilot II Baseboard Management Controller FunctionalityThe BMC is provided by an embedded ARM9 controller and associated peripheral functionalitythat is required for IPMI-based server management. Firmware usage of these hardware featuresis platform dependant.The following is a summary of the BMC management hardware features utilized by the BMC:250 MHz 32-bit ARM9 ProcessorMemory Management Unit (MMU)Two 10/100 Ethernet Controllers with NC-SI support16 bit DDR2 667 MHz interfaceDedicated RTC12 10-bit ADCsEight Fan TachometersFour PWMs4Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPS 錯 誤 ! 尚 未 定 義 樣 式 。Battery-backed Chassis Intrusion I/O RegisterJTAG MasterSix I 2 C interfacesGeneral-purpose I/O Ports (16 direct, 64 serial)Additionally, ServerEngines* Pilot II integrates a super I/O module with the following features: KCS/BT Interface Two 16C550 Serial Ports Serial IRQ Support 12 GPIO Ports (shared with BMC) LPC to SPI Bridge SMI and PME SupportServerEngines* Pilot II contains an integrated KVMS subsystem and graphics controller with thefollowing features:USB 2.0 for Keyboard, Mouse, and Storage devicesUSB 1.1 interface for legacy PS/2 to USB bridging.Hardware Video Compression for text and graphicsHardware encryption2D Graphics AccelerationDDR2 graphics memory interfaceUp to 1600x1200 pixel resolutionPCI Express* x1 supportRevision 1.1Intel ® Confidential 5

錯 誤 ! 尚 未 定 義 樣 式 。Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSFigure 1. BMC Hardware6Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSFunctional Specification3. Functional Specifications3.1 Power SystemThe BMC is in-line with the system power control path. This is implemented by an integratedhardware signal pass-through. The pass-through allows the BMC to directly block power-on ifnecessary. If the BMC firmware is non-functional, the default state of the pass-through hardwareis to allow full system control. This is to provide a means of power control in case a BMCfirmware recovery is necessary.The following block diagram shows the power and reset signal interconnections to the BMC.The signals names and interconnections may not match the names in schematics. These arechosen to illustrate functional descriptions provided in this document.Figure 2. BMC Power / Reset SignalsRevision 1.1Intel ® Confidential 7

錯 誤 ! 尚 未 定 義 樣 式 。錯 誤 ! 尚 未 定 義 樣 式 。 EPS3.1.1 Power Supply Interface SignalsThe BMC controls the POWER_ON signal. It connects to the chassis power sub-system and isused to request power state changes (asserted = request power on). The PS_PWRGD signalfrom the chassis power sub-system indicates the current power state (asserted = power is on).Figure 2 shows the power supply control signals and their sources. To turn the system on, theBMC asserts the PS_ON signal and waits for the PS_PWRGD signal to assert in response,indicating that DC power is on.The PS_PWRGD signal is normally asserted within 1.5 seconds, but the timeout interval can beset longer to add flexibility in manufacturing test environments. The POWER_GOOD signalmust remain stable and not glitch when being asserted. The BMC uses the state of thePS_PWRGD signal to monitor whether the power supply is on and operational, and to confirmwhether the system power state matches the intended system on / off power state that wascommanded with the PS_ON signal.3.1.2 Power-Good DropoutDe-assertion of the PS_PWRGD signal generates an interrupt that the BMC uses to detecteither power sub-system failure or loss of AC power. A power-good dropout is defined as thePS_PWRGD signal de-asserting when the system should be in the DC power-on state asdetermined by the state of the PS_ON signal. The PS_PWRGD deassertion must also coincidewith the assertion of the “CPU Power Failure Status” bit in the chipset. Note that BIOS must deassertthe “CPU Power Failure Status” bit on a normal power-on.If the BMC detects a power-good dropout, the following occurs:1. Hardware powers down the system.2. The BMC asserts the Power Unit Failure offset of the Power Unit sensor and logs a SELevent. See Section 3.28.1.4.3. The BMC generates a beep code for a Power Fault. See Table 8.The BMC waits 10 seconds. If the power state retention feature is configured to poweron the server after an AC loss, it attempts to power up the server.The BMC responds to the power loss interrupt within 1-2 ms if it is in operational mode.3.1.3 Power-up SequenceTo power up the system, the BMC simulates the front panel power button press by disabling thepower button pass-through mode temporary, generating a 200 ms pulse of the power buttonsignal (Pilot II internally triggers a 100 ms pulse on each valid wakeup event; we double thelength for the button press signals), and checking the PS_PWRGD assertion. If thePS_PWRGD is not asserted, it waits for a second before retrying the power-up sequence againfor a maximum of eight retries, with a total duration of approximately 9.6 seconds. If thePS_PWRGD is still not asserted at the end of the eight retries, a fault is generated.After simulating the front panel power button press, the BMC initializes all sensors to theirpower-on initialization state. The initialization agent is run. The firmware handles this sequence.8Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSFunctional Specification3.1.4 Power Down SequenceTo power down the system, the BMC simulates the front panel power button press by disablingthe power button pass-through mode, generating a 200 ms pulse of the power button signal,and checking the PS_PWRGD drop. If the PS_PWRGD does not drop as expected, it waits fora second before sending another 200 ms pulse of the power button signal for a maximum ofeight retries. After the eight retires, if the PS_PWRGD is still asserted, the BMC will force thesimulation of the power button 4-second override mode. This guarantees that the system will bepowered off after the failure of eight power-down retries. A fault is not generated.Before initiating the system power down, the BMC stops scanning any sensors that should notbe scanned in the powered-down state.To power cycle the system via the IPMI command, the BMC simulates the front panel powerbutton to (1) power down the system, (2) wait for a second, and then (3) power up the system.Similar to the power-up sequence, if the BMC failed to power down the system, it takes controlby changing the ONCTLn signal. After a 5-second wait, the BMC gives control back to theexternal APCI logic. The system will be powered up by the SLPS3n/SLPS5n signals. Thefirmware handles this sequence.3.1.5 Power Control SourcesThe following sources can initiate power-up and / or power-down activity.Table 2. Power Control InitiatorsSourceExternal Signal Name orInternal Sub-systemCapabilitiesabilitiesPower button Front panel power button Turns power on or offBMC watchdog timer Internal BMC timer Turns power off, or power cycleCommand Routed through command processor Turns power on or off, or power cyclePower state retention Implemented via BMC internal logic Turns power on when AC power returnsChipsetSleep S4 / S5 signal (same asPOWER_ON)Turns power on or offCPU Thermal CPU Thermtrip Turns power off3.1.5.1 Power Button SignalThe POWER_BUTTON signal is filtered through a 16 ms hardware debounce. The signal mustbe in a constant state for more than 16 ms before it is treated as asserted.The signal is routed to the chipset power button signal through pass-through and SIO circuitrythat allows the BMC to lock out the signal. The chipset responds to the assertion of the signal; itreacts to the press of the button, not the release of it.3.1.5.2 Chipset Sleep S4 / S5The BMC is notified of S4/S5 transitions by the BIOS, through the SMM interface.Revision 1.1Intel ® Confidential 9

錯 誤 ! 尚 未 定 義 樣 式 。錯 誤 ! 尚 未 定 義 樣 式 。 EPS3.1.5.3 Power-On EnableThe front panel pass-through is set ‘on’ as the default. Although front panel lockout settings areavailable through BIOS setup screens, front panel lockout is controlled by the BMC firmware.BIOS should send the “Set Front Panel Button Enables” IPMI command to the BMC to set thelockout status. The BMC disables any valid wake-up event, including the power button press, for1 second after the power has been turned off. This feature protects the power supply fromrepeated on/off switching.Assertion of the FORCE_UPDATE jumper signal allows power on to occur. This includes thecase in which the BMC operational code is not functional.3.1.5.4 Power-down DisableThe BMC disables all wakeup events for 1 second after the power-down. This event is handledby firmware.3.1.6 Power State RetentionThe BMC persistently stores the latest power state that was attained due to a power statechange initiator. Refer to the power state sources in Table 2. This capability supports the powerstate restoration feature.3.1.7 Power State RestorationThe BMC provides the ability to control the AC power-on behavior of the server. The Set PowerRestore Policy command configures the BMC to restore the power state in one of three ways.Power always off – Leave power off when AC is restored.Power always on – Power server on when AC is restored.Restore power state – Restore power state to the state it was in when AC was lost.When standby power returns after an AC power loss, BMC firmware activates the server poweras directed by the configuration.3.1.8 Wake-OnOn-LAN (WOL)The BMC does not directly participate in WOL. The NICs directly interact with the chipset toinitiate the power on of the system via the SLPS3n and SLPS5n signals to the BMC as awakeup event.10Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSFunctional Specification3.2 Advanced Configuration and Power Interface (ACPI)StateSupportedS0 Yes WorkingTable 3. ACPI Power StatesDescriptionThe front panel power LED is on (not controlled by the BMC).The fans spin at the normal speed, as determined by sensor inputs.Front panel buttons work normally.S1 Yes Sleeping. Hardware context maintained; equates to processor and chipset clocks stopped.S2 No Not supportedS3 No Not supportedS4 No Not supportedS5 Yes Soft off.The front panel power LED blinks at a rate of 1 Hz with a 50% duty cycle (not controlledby the BMC).The watchdog timer is stopped.The power, reset, front panel NMI, and ID buttons are unprotected.Fan speed control is determined by available SDRs. Fans may be set to a fixed state, orbasic fan management can be applied.The BMC detects that the system has exited the ACPI S1 sleep state when it is notified bythe BIOS SMI handler.The front panel buttons are not locked.The fans are stopped.The power up process goes through the normal boot process.The power, reset, front panel NMI, and ID buttons are unlocked.3.2.1 ACPI Power ControlThe chipset implements ACPI-compatible power control. Power control requests are routed tothe BMC SLPS3n and SLPS5n pins.3.2.2 ACPI State SynchronizationThe BIOS keeps the BMC synchronized with the system ACPI state. The BIOS provides theACPI state when the server transitions between the power and the sleep states. It uses theSMM interface to provide the ACPI state.3.3 System Reset Control3.3.1 Reset Signal OutputThe BMC simulates a press of the front panel reset button to perform a system reset. The ICHperforms the rest of the system reset process. The BMC cannot hold the system in reset, andonce started, the process is asynchronous with respect to BMC operation.The reset portion of the power-on process is performed by the ICH.Revision 1.1Intel ® Confidential 11

錯 誤 ! 尚 未 定 義 樣 式 。錯 誤 ! 尚 未 定 義 樣 式 。 EPS3.3.2 Reset Control SourcesThe BMC runs a sensor initialization agent service whenever a reset is detected. See Section3.10.2. The initialization agent will restart when the BMC firmware resets. For more informationon the initialization agent, see Section 3.10.2.Table 4. System Reset Sources and ActionsReset SourceSystem ResetBMC Firmware ResetSystem powers-up Yes NoReset button or in-target probe (ITP) reset Yes NoSoft reset / warm boot (DOS + + ) Yes NoHard reset Yes NoCommand to reset the system Yes NoWatchdog timer configured for reset Yes NoAC Power applied Yes YesBMC Exits firmware transfer mode No YesSMI Timeout Yes NoBMC reset IPMI command No Yes3.3.3 Front Panel System ResetThe reset button is a momentary contact button on the front panel. Its signal is routed throughthe front panel connector to the BMC, which monitors and de-bounces it. The signal must bestable for at least 16 ms before a state change is recognized.If the reset button is locked by the BMC, then the button will not reset the system.3.3.4 Soft Reset and Hard ResetThe BMC monitors a BIOS signal called BIOS_POST_CMPLT_N, which deasserts at thebeginning of POST and asserts at the end of POST. The signal deassertion indicates that asystem reset has occurred. The BMC monitors this signal to detect hard resets.Soft resets, caused by assertion of the processor INIT pin, or keyboard + +, are converted by BIOS into CF9 resets. The BMC records these reset types as “OEM”type resets, as defined in the Intelligent Platform Management Interface Specification SecondGeneration v2.0, Tables 28-11.The BMC detects these resets but does not participate in the reset mechanism.3.3.5 BMC Command to Cause System ResetChassis Control is the primary command used to reset the system.3.3.6 Watchdog Timer ExpirationThe watchdog timer can be configured to cause a system reset when the timer expires. See theIntelligent Platform Management Interface Specification, Version 2.0.12Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSFunctional Specification3.4 System InitializationThe following items are initialized by both the BIOS and the BMC during system initialization.3.4.1 Processor TControl SettingProcessors used with this chipset implement a feature called Tcontrol, which provides aprocessor-specific value that can be used to adjust the fan control behavior to achieve optimumcooling and acoustics. The BMC reads these values directly from the CPU via PECI. The BMCuses these values as part of the fan speed control algorithm. See Section 3.16.4.2.3.4.2 Fault Resilient Booting (FRB)Fault resilient booting (FRB) is a set of BIOS and BMC algorithms and hardware support thatallow a multiprocessor system to boot even if the bootstrap processor (BSP) fails. Only FRB2 issupported, using watchdog timer commands.FRB2 refers to the FRB algorithm that detects system failures during the POST. The BIOS usesthe BMC watchdog timer to back up its operation during POST. The BIOS configures thewatchdog timer to indicate that the BIOS is using the timer for the FRB2 phase of the bootoperation.After the BIOS has identified and saved the BSP information, it sets the FRB2 timer use bit andloads the watchdog timer with the new timeout interval.If the watchdog timer expires while the watchdog use bit is set to FRB2, the BMC (if soconfigured) logs a watchdog expiration event showing the FRB2 timeout in the event data bytes.The BMC then hard resets the system, assuming the BIOS selected reset as the watchdogtimeout action.The BIOS is responsible for disabling the FRB2 timeout before initiating the option ROM scanand before displaying a request for a boot password. If the processor fails and causes an FRB2time-out, the BMC resets the system.The BIOS gets the watchdog expiration status from the BMC. If the status shows an expiredFRB2 timer, the BIOS enters the failure in the system event log (SEL). In the OEM bytes entryin the SEL, the last POST code generated during the previous boot attempt is written. FRB2failure is not reflected in the processor status sensor value.The FRB2 failure does not affect the front panel LEDs.3.4.2.1 Watchdog Timer Timeout Reason BitsTo implement FRB2, during POST the BIOS determines if a BMC watchdog timer timeoutoccurred on the previous boot attempt. If it finds a watchdog timeout did occur, it determineswhether that timeout was an FRB2 timeout, system management software (SMS) timeout, or anintentional, timed hard reset. The BMC provides the IPMI Get Watchdog Timer command tofacilitate determining the cause of the watchdog time out.The BMC maintains the timeout-reason bits across system resets and DC power cycles, but notacross AC power cycles.Revision 1.1Intel ® Confidential 13

錯 誤 ! 尚 未 定 義 樣 式 。錯 誤 ! 尚 未 定 義 樣 式 。 EPS3.4.3 BSP IdentificationThe BMC cannot indicate which processor is the BSP. Software that needs to identify the BSPshould use the multiprocessor specification tables. See the BIOS EPS.3.4.4 Boot Control SupportThe BMC supports the IPMI 2.0 boot control feature that allows the boot device and bootparameters to be managed remotely. Table 40 specifies the supported boot option parameters.The boot initiator mailbox is five 16-byte blocks.3.4.5 Post Code DisplayThe BMC, upon receiving standby power, initializes internal hardware to monitor port 80h(POST code) writes. Data written to port 80h is output to the system POST LEDs. Note thatalthough the port 80h data is read by a hardware FIFO, output to the LEDs is driven by firmware.This could lead to delays between the write and subsequent display on the LEDs. There is alsono flow control for port 80h writes, so a burst of data could result in the old POST codes beingdropped from the FIFO before being displayed on the LEDs.The BMC core firmware does not guarantee any specific rate at which the FIFO’s contents willbe displayed to the LEDs.The BMC deactivates POST LEDs after POST has completed.3.4.6 BMC Resident SMBIOS Data Storage (Managed Data Region)The BMC maintains a copy of a SMBIOS table header and all Type 04h, 16h, and 17h records.This SMBIOS data can be retrieved using OEM IPMI commands either in-band or out-of-band.Once retrieved, external applications may interpret this data by decoding the information asdescribed by the current SMBIOS Specification.Internally to the BMC, the SMBIOS data is stored in a multi-purpose Managed Data Region(MDR) that is maintained in BMC accessible RAM. Note that the MDR was originally defined bythe Compute Blade BMC Data Repository Specification.On all system boots following an AC cycle, the BIOS sends a copy of the relevant SMBIOS datato the BMC during POST. On all other system boots, the BIOS checks late in the POST processwhether the BMC already has SMBIOS data that matches the SMBIOS information which wouldbe sent by the BIOS. This determination is done by the BIOS querying the BMC to see if it hasSMBIOS data and, if it does, whether the length and checksum of the SMBIOS data matchesthe length and checksum of the information to be sent. If the BIOS determines that the BMCdata needs to be refreshed – it will send a fresh copy of the SMBIOS data to the BMC.Since the SMBIOS data is maintained by the BMC in RAM, it is not available following afirmware update, upon entering and exiting firmware transfer mode, or after any other time inwhich BMC restarts.Table 59 lists OEM IPMI command exposed to send and retrieve data. Due to IPMI commandlength limitations, multiple calls to the OEM IPMI interface will be required to obtain all of theembedded software information.14Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSFunctional Specification3.5 Integrated Front Panel User InterfaceThis section describes the BMC’s role in supporting the system front panel buttons and LEDs.The front panel has the following indicators: Power LED System status / fault LED Chassis ID LEDThe front panel provides the following buttons:Reset buttonPower buttonSystem diagnostic interrupt button (NMI button)Chassis ID button3.5.1 Power LEDThe Power LED is controlled by the system BIOS. The BMC is unable to change the state ofthis LED. Please see the system BIOS EPS for details on Power Status LED states.3.5.2 System Status LEDNote: The system status LED shows the state for the current, most severe fault. For example, ifthere was a critical fault due to one source and a non-critical fault due to another source, thesystem status LED state would be solid on (the state for the critical fault).The system status / fault LED is a bi-color LED. Green (status) indicates normal (solid-on) ordegraded (blink) operation. Amber (fault) indicates a failure state, and overrides the greenstatus. The system status LED is controlled by the BMC, but includes non-BMC-owned sensorsin fault determination (such as BIOS-owned sensors).The BMC-detected states are included in the LED states. For fault states that are monitored byBMC sensors, the contribution to the LED state follows the associated sensor state, with prioritygiven to the most critical asserted state.When the server is powered down (transitions to the DC-off state or S5), the BMC is still onstandby power and retains the sensor and front panel status LED state established before thepower-down event. If the system status is normal when the system is powered down (the LED isin a solid green state), the system status LED will be off.When AC power is first applied to the system, the status LED will turn solid amber, to indicatethat the BMC is booting. If, upon completing the boot, the BMC does not detect abnormalconditions, the LED will turn off until the system is commanded-on.Revision 1.1Intel ® Confidential 15

錯 誤 ! 尚 未 定 義 樣 式 。錯 誤 ! 尚 未 定 義 樣 式 。 EPSThe LED state information in below table is dependent on underlying sensor supportTable 5. System Status LED Indicator StatesColorStateCriticalityGreen Solid on Ok System booted and readyDescriptionGreen ~1 Hz blink Degraded System degraded: Non-critical temperature threshold is asserted.Non-critical voltage threshold is asserted.Non-critical fan threshold is asserted.Fan redundancy is lost; sufficient system cooling is maintained.This does not apply to non-redundant systems.Power supply predictive failure occurs.Power supply redundancy is lost. This does not apply to nonredundantsystems.Correctable errors occur over a threshold of 10 and migrate to aspare DIMM (memory sparing). This indicates that the user nolonger has spare DIMMs indicating a redundancy lost condition.Corresponding DIMM LED should light up. 1Amber ~1 Hz blink Non-critical Non-fatal alarm – system is likely to fail: CATERR is asserted.Amber Solid on Critical, nonrecoverableCritical temperature threshold is asserted.Critical voltage threshold is asserted.Critical fan threshold is asserted.Fatal alarm – system has failed or shutdown: CPU is missing.Thermtrip is asserted.VRD hot is asserted.SMI Timeout is asserted.Non-recoverable temperature threshold is asserted.Non-recoverable voltage threshold is asserted.Power fault / Power Control Failure occur.Fan redundancy is lost due to insufficient system cooling. Thisdoes not apply to non-redundant systems.Power supply redundancy is lost due to insufficient systempower. This does not apply to non-redundant systems.This state also happens when AC power is first applied to the system.This indicates that the BMC is booting.Off N/A Not ready AC power is off, if non-degraded, non-critical, critical, or nonrecoverableconditions exist.Note: This is BIOS-Driven functionality through IPMI “Set Fault Indication” command.3.5.3 Chassis ID LEDThe chassis ID LED provides a visual indication of a system being serviced. The state of thechassis ID LED is affected by the following actions:Toggled by turning the chassis ID button on or off.Controlled by the IPMI Chassis Identify command.- Chassis Identify command can be used to blink or deactivate the Chassis ID LED. Itcannot be used to set the LED in the solid-on state.16Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSFunctional SpecificationThere is no precedence or lock-out mechanism for the control sources. When a new requestarrives, previous requests are terminated. For example, if the chassis ID LED is blinking and thechassis ID button is pressed, then the chassis ID LED changes to solid on. If the button ispressed again, then the chassis ID LED turns off.3.5.4 LCD Panel: Intel ® Local Control PanelIntel ® Local Control Panel (LCP) is not supported on this platform.3.5.5 Front Panel / Chassis InputsThe BMC monitors the front panel buttons and other chassis signals. The front panel inputbuttons are momentary contact switches that are de-bounced by the BMC’s integrated hardware.The de-bounce time is 8 ms. BMC debouncing does not affect the operation of the power orreset button, since the power and reset buttons are connected to the chipset. The debouncing isonly for BMC monitoring.3.5.5.1 Chassis IntrusionEmerald Ridge Support a chassis intrusion sensor.. The BMC monitors the state of the Chassis Intrusion signal and makes the status of the signalavailable via the Get Chassis Status command and the Physical Security sensor state. Achassis intrusion state change causes the BMC to generate a Physical Security sensor eventmessage with a General Chassis Intrusion offset (00h).The BMC detects chassis intrusion and logs a SEL event when the system is in the on, sleep, orstandby state. Chassis intrusion is not detected when the system is in an AC power-off (AC lost)state.The BMC hardware cannot differentiate between a missing Chassis Intrusion cable or connector,and a true security violation. If the Chassis Intrusion cable or connector is removed or damaged,the BMC will treat it as if the chassis cover is open, and take the appropriate actions.System fans can be set to boost to maintain proper system cooling when a chassis intrusion isdetected. Please see the fan speed control sensor data records in Table 82 for more information.3.5.5.2 Power ButtonSee Section 3.1.5.3.5.5.3 Reset ButtonAn assertion of the Front Panel Reset signal to the BMC causes the system to start the resetand reboot process, as long as the BMC has not locked-out this input. This assertion isimmediate and without the cooperation of software or the operating system.See Section 3.3.3 for more information.3.5.5.4 Diagnostic Interrupt (Front Panel NMI)A diagnostic interrupt is a non-maskable interrupt or signal for generating diagnostic traces andcore dumps from the operating system. The diagnostic interrupt button is connected to the BMCRevision 1.1Intel ® Confidential 17

錯 誤 ! 尚 未 定 義 樣 式 。錯 誤 ! 尚 未 定 義 樣 式 。 EPSthrough a front panel connector. A diagnostic interrupt button press causes the BMC to do thefollowing:Generate a Critical Event sensor event message with a Front Panel NMI / Diagnosticinterrupt offset (00h).Generate a system NMI pulse.Once an NMI has been generated by the BMC, the BMC does not generate another until thesystem has been reset or powered down.3.5.5.5 Chassis IdentifyThe front panel chassis identify button toggles the state of the Chassis ID LED. If the LED is off,pushing the button lights the LED. It remains lit until the button is pushed again or until aChassis Identify command is received that changes the state of the LED.3.5.6 Front Panel Lock-out out OperationThe front panel can be locked using the Set Front Panel Enables command. You can check thefront panel lock-out status using the Get chassis Status command. Emerald Ridge platformdoesn’t support disabling NMI button using Set Front Panel Enables command.3.6 Private Management I2C BusesThe BMC controls multiple private I 2 C buses. The BMC is the sole master on these buses.External agents must use the BMC’s Master Write / Read command if they require directcommunication with a device on any of these buses. Only FRU devices are accessible in thismanner. Sensor devices should not be directly accessed by BMC clients.Table 6. List of I2C BusesBus NumberBus NameDescription0 (Public) IPMB HSBP Connectors, LCP Connector, Aux .IPMBConnector.1 (Private) Sensor Bus Temperature Sensors, Baseboard FRU.2 Private Unused N/A3 (Private) Host Bus4 (Private) SMLink ME, Power Supplies FRU5 Private NICs, Fan Board FRU, SAS FRU, Front Panel Temp.18Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSFunctional SpecificationBelow diagram represents SMBUS connections from BMCFigure 3. SMBUS Topology3.7 Watchdog TimerThe BMC implements a fully IPMI 2.0-compatible watchdog timer. See the Intelligent PlatformManagement Interface Specification Second Generation v2.0. The NMI / diagnostic interrupt foran IPMI 2.0 watchdog timer is associated with an NMI. A watchdog pre-timeout SMI orequivalent signal assertion is not supported.3.8 BMC Internal Timestamp ClockThe BMC maintains a four-byte internal timestamp clock. The timestamp value is derived froman RTC element that is internal to the BMC.This internal timestamp clock is read and set using the Get SEL Time and Set SEL Timecommands, respectively. The Get SDR Time command can also be used to read the timestampclock. These commands and the IPMI time format are specified in the Intelligent PlatformManagement Interface Specification Second Generation v2.0.3.8.1 BMC Clock InitializationDuring system initialization the BMC cannot guarantee the validity of its internal timestamp, so itresets its clock counter to zero. The BMC attempts to retrieve the current time from an internalRevision 1.1Intel ® Confidential 19

錯 誤 ! 尚 未 定 義 樣 式 。錯 誤 ! 尚 未 定 義 樣 式 。 EPSbattery-backed RTC element. If the RTC time is in the pre-init range of 0 to 0x20000000, thenthe BMC ignores it and continues counting from zero, and any SEL events have pre-inittimestamps relative to the approximate time of the BMC initialization.Whenever the BMC receives the Set SEL Time command, it updates the integrated RTC value.This helps ensure that the BMC internal clock maintains synchronization with the system clockacross BMC initializations. Using the Set SEL Time command to force the BMC to a pre-inittimestamp causes the RTC to be updated with the same value. Unless the Set SEL Timecommand is sent with a valid time before the next BMC initialization, the BMC ignores the preinittime stored in the RTC.3.8.2 System Clock SynchronizationThe BMC does not have direct access to the system clock used by BIOS and the operatingsystem. The BIOS must send the Set SEL Time command with the current system time to theBMC during system Power-on Self Test (POST). Synchronization during very early POST ispreferred, so any SEL entries recorded during system boot can be accurately time stamped.If the time is modified through an OS interface, then the BMC’s time is not synchronized until thenext system reboot.3.9 System Event Log (SEL)The BMC implements the system event log as specified in the Intelligent Platform ManagementInterface Specification, Version 2.0. The SEL is accessible regardless of the system power statevia the BMC's in-band and out-of-band interfaces. See Table 50 for more information on SELcommands.The BMC allocates 65,502 bytes (approx 64 KB) of non-volatile storage space to store systemevents. The SEL timestamps might not be in order. Up to 3,639 SEL records can be stored at atime. Any command that would result in an overflow of the SEL beyond the allocated space willbe rejected with an “Out of Space” IPMI completion code (C4h).3.9.1 Servicing EventsEvents can be received while the SEL is being cleared. The BMC implements an eventmessage queue to avoid the loss of messages. Up to three messages can be queued beforemessages are overwritten.The BMC recognizes duplicate event messages by comparing sequence numbers and themessage source. See the Intelligent Platform Management Interface Specification SecondGeneration v2.0. Duplicate event messages are discarded (filtered) by the BMC after they areread from the event message queue. The queue can contain duplicate messages.3.9.2 SEL Entry DeletionetionThe BMC does not support individual SEL entry deletion. The SEL may only be cleared as awhole.3.9.3 SEL ErasureSEL erasure is a background process. After initiating erasure with the Clear SEL command,additional Clear SEL commands must be executed to get the erasure status and determine20Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSFunctional Specificationwhen the SEL erasure is completed. This may take several seconds. SEL events that arriveduring the erasure process are queued until the erasure is complete and then committed to theSEL.SEL erasure generates an Event Logging Disabled (Log Area Reset / Cleared offset) sensorevent.3.10 Sensor Data Record (SDR) RepositoryThe BMC implements the sensor data record (SDR) repository as specified in the IntelligentPlatform Management Interface Specification, Version 2.0. The SDR is accessible through theBMC’s in-band and out-of-band interfaces regardless of the system power state The BMCallocates 65,519 bytes of non-volatile storage space for the SDR. See Table 49 for SDRcommand support.3.10.1 SDR Repository ErasureSDR repository erasure is a background process. After initiating erasure with the Clear SDRRepository command, additional Clear SDR Repository commands must be executed to geterasure status and determine when the SDR repository erasure is completed. This may takeseveral seconds. The SDR repository cannot be accessed or modified until the erasure iscompleted.3.10.2 Initialization AgentThe BMC implements the internal sensor initialization agent functionality specified in theIntelligent Platform Management Interface Specification, Version 2.0. When the BMC initializesor on a system boot, it scans the SDR repository and configures the IPMB devices that havemanagement controller records and the Init required bit set in their SDR repository. Thisincludes setting sensor thresholds, enabling or disabling sensor event message scanning, andenabling or disabling sensor event messages.The initialization process causes those IPMB micro-controllers to rearm their event generation.In some cases, this causes a duplicate event to be sent to the BMC. The BMC’s mechanism todetect and delete duplicate events should prevent any duplicate event messages from beinglogged. For details on the initialization agent, refer to the Intelligent Platform ManagementInterface Specification Second Generation v2.0.3.11 Field Replaceable Unit (FRU) Inventory DeviceThe BMC implements the interface for logical FRU inventory devices as specified in theIntelligent Platform Management Interface Specification, Version 2.0. This functionality providescommands used for accessing and managing the FRU inventory information. These commandscan be delivered via all interfaces.The BMC provides FRU device command access to its own FRU device and to the FRUdevices throughout the server. The FRU device ID mapping is defined in the table 7. The BMCcontrols the mapping of the FRU device ID to the physical device.Revision 1.1Intel ® Confidential 21

錯 誤 ! 尚 未 定 義 樣 式 。錯 誤 ! 尚 未 定 義 樣 式 。 EPS3.11.1 BMC FRU Inventory Area FormatSee the Platform Management FRU Information Storage Definition, Version 1.0.The BMC provides only low-level access to the FRU inventory area storage. It does not validateor interpret the data that is written. This includes the common header area. Applications cannotrelocate or resize any FRU inventory areas.Note: Fields in the internal use area are not for OEM use. Intel reserves the right to relocateand redefine these fields without prior notification. Definition of this area is part of the softwaredesign. The format in the internal use area may vary with different BMC firmware revisions.3.11.2 BMC FRU ID MappingTable 7. FRU Device ID MapFRU DeviceI2C BusI2C AddrFRU Hardware DeviceR/WFRU SizeID(in Bytes)00 1 AAh Baseboard RW 819201 1 ACh IO Riser Board RW 819202 1 A0h Memory Riser Board 1 RW 25603 1 A2h Memory Riser Board 2 RW 25604 1 A4h Memory Riser Board 3 RW 25605 1 A6h Memory Riser Board 4 RW 25606 1 A0h Memory Riser Board 5 RW 25607 1 A2h Memory Riser Board 6 RW 25608 1 A4h Memory Riser Board 7 RW 25609 1 A6h Memory Riser Board 8 RW 2560A 4 AAh Power Distribution Board RW 2560B 4 A0h Power Supply 1 RO 2560C 4 A2h Power Supply 2 RO 2560D 4 A4h Power Supply 3 RO 2560E 4 A8h Power Supply 4 RO 2560F 5 AEh Front Panel Fan Board RW 25610 5 A8h SAS ( Optional) RW 2563.12 Diagnostics and Beep Code GenerationThe BMC may generate beep codes upon detection of failure conditions. Beep codes aresounded each time the problem is discovered (for example, on each power-up attempt), but arenot sounded continuously. Supported codes are listed in Table 8. Each digit in the code isrepresented by a sequence of beeps whose count is equal to the digit.Table 8. BMC Beep CodesCodeReason for Beep1-5-2-1 No CPUs installed or first CPU socket isempty.Associated SensorsCPU Missing SensorSupportedYes22Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSFunctional SpecificationCodeReason for Beep1-5-4-2 Power fault: DC power unexpectedly lost(power good dropout).1-5-4-4 Power control fault (power good assertiontimeout).Associated SensorsPower unit – power unit failureoffset.Power unit – soft power controlfailure offset.SupportedYesYes3.12.1 Signal GenerationThe BMC generates an NMI pulse under certain conditions. The BMC-generated NMI pulseduration is at least 30 ms. once an NMI has been generated by the BMC, the BMC does notgenerate another until the system has been reset or powered down.The following actions will cause the BMC to generate an NMI pulse:Receiving a Chassis Control command to pulse the diagnostic interrupt. This commanddoes not cause an event to be logged in the SEL.Detecting that the front panel diagnostic interrupt button has been pressed. See Section3.5.5.4.Watchdog timer pre-timeout expiration with NMI / diagnostic interrupt pre-timeout actionenabled.The following table shows behavior regarding NMI signal generation and event logging by theBMC.Causal EventChassis Control command (pulse diagnosticinterrupt)Table 9. NMI Signal Generation and Event LoggingNMI (IA-32 Only)Signal GenerationFront Panel Diag Interrupt Sensor Event LoggingSupportX –Front panel diagnostic interrupt button pressed X XWatchdog Timer pre-timeout expiration with NMI/ diagnostic interrupt actionX –3.13 Sensor Rearm Behavior3.13.1.1 Manual vs. Rearm SensorsSensors can be either manual or automatic re-arm. An automatic re-arm sensor will "re-arm"(clear) the assertion event state for a threshold or offset if that threshold or offset is deassertedafter having been asserted. This allows a subsequent assertion of the threshold or offset togenerate a new event and associated side-effect. An example side-effect would be boostingfans due to an upper critical threshold crossing of a temperature sensor. The event state andthe input state (value) of the sensor track each other. Most sensors are auto-rearm.A manual re-arm sensor does not clear the assertion state even when the threshold or offsetbecomes deasserted. In this case, the event state and the input state (value) of the sensor donot track each other. The event assertion state is "sticky".The following methods can be used to re-arm a sensor: Automatic re-arm – Only applies to sensors that are designated as “auto-rearm”.Revision 1.1Intel ® Confidential 23

錯 誤 ! 尚 未 定 義 樣 式 。錯 誤 ! 尚 未 定 義 樣 式 。 EPSIPMI command Re-arm Sensor Event.BMC internal method – The BMC may re-arm certain sensors due to a trigger condition. Forexample, some sensors may be re-armed due to a system reset.3.13.1.2 Rearm and Event GenerationAll BMC-owned sensors that show an asserted event status generate a deassertion SEL eventwhen the sensor is rearmed, provided that the associated SDR is configured to enable adeassertion event for that condition. This applies regardless of whether the sensor is athreshold/analog sensor or a discrete sensor.To manually re-arm the sensors, the sequence is outlined below:1. A failure condition occurs and the BMC logs an assertion event.2. The sensor is rearmed by one of the methods described in the previous section.3. The BMC clears the sensor status and, if so configured, generates a deassertion event.4. The sensor is put into “reading-state-unavailable” state until it is polled again orotherwise updated.5. The sensor is updated and the “reading-state-unavailable” state is cleared. A newassertion event will be logged if the fault state is once again detected.There are some special cases, specifically for sensor offsets representing presence condition,where regeneration of events due to a manual rearm may be suppressed. This is noted in thesections describing the specific sensors.All auto-rearm sensors that show an asserted event status generate a deassertion SEL event atthe time the BMC detects that the condition causing the original assertion is no longer presentand the associated SDR is configured to enable a deassertion event for that condition.3.14 Processor SensorsThe BMC provides IPMI sensors for processors and associated components, such as voltageregulators and fans. The sensors are implemented on a per-processor basis.Table 10. Processor SensorsSensor NamePer-ProcProcDescriptionSocketProcessor Status Yes Processor presence and fault stateDigital Thermal Sensor Yes Relative temperature reading via PECIProcessor VRD Over-TemperatureIndicationYesDiscrete sensor that indicates a processor VRDhas crossed an upper operating temperaturethresholdProcessor Voltage Yes Threshold sensor that indicates a processorpower good stateProcessor Thermal Control(Prochot)YesPercentage of time a processor is throttling dueto thermal conditions24Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSFunctional Specification3.14.1 Processor Status SensorsThe BMC provides an IPMI sensor of type processor for monitoring status information for eachprocessor slot. If an event state (sensor offset) has been asserted, it remains asserted until oneof the following happens:A Rearm Sensor Events command is executed for the processor status sensor.AC or DC power cycle, system reset, or system boot occurs.The BMC provides system status indication to the front panel LEDs for processor faultconditions shown in the table below. See Section 3.6.2.CPU Presence status is not saved across AC power cycles and so will not generate adeassertion after cycling AC power.Table 11. Processor Status Sensor ImplementationOffsetProcessor StatusDetected By0 Internal error (IERR) Not Supported1 Thermal trip BMC2 FRB1 / BIST failure Not Supported3 FRB2 / Hang in POST failure BIOS 14 FRB3 / Processor startup / initialization failure (CPU fails tostart)5 Configuration error (for DMI) BIOS 1Not Supported6 SM BIOS uncorrectable CPU-complex error Not Supported7 Processor presence detected BMC8 Processor disabled Not Supported9 Terminator presence detected Not SupportedNote: Fault is not reflected in the processor status sensor.3.14.1.1 Processor PresenceWhen the BMC detects an empty processor socket, it sets the disable bit in the processor statusfor that socket and clears the remaining status bits.Upon BMC initialization, the processor presence offset is initialized to the de-asserted state. TheBMC then checks to see if the processor is present, setting the offset accordingly. This state isupdated at each DC power-on and at system resets. If a processor is removed while the systemhas AC power, and the system is then powered-on (DC-on), the appropriate deassertion eventwill be logged (if enabled). The net effect is that there should be one event logged for processorpresence at BMC initialization for each installed processor, assuming the SDR is configured togenerate the event. No additional events for processor presence are expected unless thesensor is manually re-armed using an IPMI command.3.14.1.2 Thermtrip MonitoringWhen a thermtrip occurs it is detected by the IOH and the system hardware will attempt topower-down the system. The BMC latches the thermtrip signal to retain a history for eachprocessor. This history tracks whether the processor has had a thermtrip since the lastRevision 1.1Intel ® Confidential 25

錯 誤 ! 尚 未 定 義 樣 式 。錯 誤 ! 尚 未 定 義 樣 式 。 EPSprocessor sensor re-arm or retest. If the BMC detects that a thermtrip occurred, then it sets thethermtrip offset for the applicable processor status sensor.Thermtrip signal latching is not persistent across AC or DC cycles.3.14.2 Processor Voltage Regulator (VRD) Over-Temperature SensorThis sensor monitors a digital signal that indicates whether a processor VRD is running overtemperature.3.14.3 Digital Thermal SensorThe processor supports a digital thermal sensor that provides a relative temperature readingthat is defined as the number of degrees below the processor’s thermal throttling trip point, alsocalled the PROCHOT threshold. When a processor reaches this temperature, the processor’sPROCHOT signal asserts, indicating that one or more of the processor’s built-in ThermalControl Circuits (TCC) has been activated to limit further increases in temperature by throttlingthe processor.The digital thermal sensor reading value is always less than or equal to zero. A reading of zeroindicates that the PROCHOT threshold has been reached. The reading remains at zero until thetemperature goes back below the PROCHOT threshold.The digital thermal sensors are located on the processor Platform Environment Control Interface(PECI) bus.The readings are capped at the core’s thermal throttling trip point (reading = 0), so thresholdsare not set and alert generation is not enabled for these sensors.3.14.3.1 PECI InterfaceThe platform environment control interface (PECI) is a one-wire, self-clocked bus interface thatprovides a communication channel between Intel ® Architecture Processors and chipsetcomponents to the BMC’s integrated PECI subsystem. The PECI bus communicatesenvironmental information, such as temperature data, between the managed components,referred to as the PECI client devices, and the management controller, referred to as the PECIsystem host. The PECI standard supersedes older methods, such as the thermal diode, forgathering thermal data.See the Platform Environment Control Interface (PECI) Reference Firmware ExternalArchitecture Specification for more information about this interface standard.3.14.4 Processor Thermal Control Monitoring (Prochot)The BMC monitors the processor’s internal thermal controls. The BMC provides thisfunctionality by reading the percentage of time that the processor ProcHot signal is assertedover a given measurement window (set to 5.8 seconds). This provides a value greater than orequal to zero.26Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSFunctional SpecificationThe BMC implements this as a threshold sensor (IPMI sensor type = processor, sensor name =Therm Margin) on a per-processor basis. This sensor supports one threshold, the upper-critical,and it is set for 50% by default in the SDRs.3.15 Voltage MonitoringThe BMC provides voltage monitoring capability for voltage sources on the main board andprocessors such that all major areas of the system are covered. This monitoring capability isinstantiated in the form of IPMI analog/threshold sensors.The BMC provides 10-bit A/Ds for voltage monitoring. The BMC FW reads this 10-bit value andscales it to fit into the 1-byte data field supported by IPMI. The BMC knows what scale factor touse by retrieving it from an OEM SDR which provides a scale factor for each voltage sensor inthe system.The BMC firmware computes the sensor value as follows:SensorValue = (A/D10-Bit reading * Scale Factor) / 10000BMC also uses external SMBUS devices to monitor CPU voltages sensors.3.16 Standard Fan ManagementThe BMC controls and monitors the system fans. Each fan is associated with a fan speedsensor that detects fan failure and may also be associated with a fan presence sensor for hotswapsupport. For redundant fan configurations, the fan failure and presence status determinesthe fan redundancy sensor state.The system fans are divided into fan domains, each of which has a separate fan speed controlsignal and a separate configurable fan control policy. A fan domain can have a set oftemperature and fan sensors associated with it. These are used to determine the current fandomain state.A fan domain has four states: sleep, nominal, and lower boost and boost. The sleep lower boostand boost states have fixed (but configurable via OEM SDRs) fan speeds associated with them.The nominal state has a variable speed determined by the fan domain policy. See Section3.16.4. An OEM SDR record is used to configure the fan domain policy. See the descriptions ofthe TControl Fan Speed Control Record formats in Appendix A. The Set SM Signal commandcan be used to manually force the fan domain speed to a selected value, overriding any othercontrol or policy.The fan domain state is controlled by several factors. In order of precedence, high to low:Boost- Associated fan in a critical state or missing. The SDR describes which fan domainsare boosted in response to a fan failure or removal in each domain.Revision 1.1Intel ® Confidential 27

錯 誤 ! 尚 未 定 義 樣 式 。錯 誤 ! 尚 未 定 義 樣 式 。 EPS- Any fan has failed, as indicated by its fan tach sensor reading crossing a lowercritical threshold.- Any fan is removed.- The BMC is in firmware update mode, or the operational firmware is corrupted.- If any of the above conditions apply, the fans are set to a fixed boost state speed.Lower Boost- Any system temperature sensor reading has crossed an upper criticalthreshold(Power supply temperature sensors do not contribute to this boosting)- Chassis intrusion is activeSleep- No boost conditions, the system is in ACPI S1 sleep state. Fan speed control isdetermined by the available SDRs. Fans may be set to a fixed state, or basic fanmanagement can be applied.Nominal- See Section 3.16.4.The fan control SDRs provide a means to set 2 different boost values for a specific fan domain(Lower Boost and Boost). One applies for fan failure or missing conditions. The other applies forcritical temperature and chassis intrusion conditions. If more than one condition issimultaneously present, then the higher boost value is applied.3.16.1 Hot-Swap FansHot-swap fans are supported in ROW Enterprise SKU chassis. These fans can be removed andreplaced while the system is powered on and operating. The BMC implements fan presencesensors (sensor type = Slot / Connector (21h), event / reading type = Sensor Specific (6Fh)) foreach hot swappable fan.When a fan is not present, the associated fan speed sensor is put into the reading/stateunavailable state, and any associated fan domains are put into the boost state. The fans mayalready be boosted due to a previous fan failure or fan removal.When a removed fan is inserted, the associated fan speed sensor is rearmed. If there are noother critical conditions causing a fan boost condition, the fan speed returns to the nominal state.Power-cycling or resetting the system rearms the fan speed sensors and clears fan failureconditions. If the failure condition is still present, the boost state returns once the sensor hasreinitialized and the threshold violation is detected again.ROW Entry SKU chassis doesn’t support hot-swap fans. For the reason, when a removed fan isinserted, the failure condition is still present until manual rearm.3.16.2 Fan Redundancy DetectionThe BMC supports redundant fan monitoring and implements a fan redundancy sensor. A fanredundancy sensor generates events when it’s associated set of fans transitions betweenredundant and non-redundant states, as determined by the number and health of the fans. Thedefinition of fan redundancy is configuration dependent. The BMC allows redundancy to beconfigured on a per fan-redundancy sensor basis via OEM SDR records.28Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSFunctional SpecificationA fan failure, or removal of hot-swap fans up to the number of redundant fans specified in theSDR, in a fan configuration is a degraded failure and is reflected in the front panel status assuch. A fan failure or removal that exceeds the number of redundant fans is a fatal insufficientresources condition and is reflected in the front panel status as a fatal error.Redundancy is checked only when the system is in the DC-on state. Fan redundancy changesthat occur when the system is DC-off, or when AC is removed will not be logged until the systemis turned-on.See the Chassis Management section for chassis specific fan redundancy configuration.3.16.3 Fan DomainsSystem fan speeds are controlled through pulse width modulation (PWM) signals, which aredriven separately for each domain by integrated PWM hardware. Fan speed is changed byadjusting the duty-cycle, which is the percentage of time the signal is driven high in each pulse.The BMC controls the average duty-cycle of each PWM signal through direct manipulation ofthe integrated PWM control registers.See the Chassis Management section for fan mapping information.3.16.4 Nominal Fan SpeedA fan domain’s nominal fan speed can be configured as static (fixed value) or controlled by thestate of one or more associated temperature sensors.OEM SDR records are used to configure which temperature sensors are associated with whichfan control domains and the algorithmic relationship between the temperature and fan speed.Multiple OEM SDRs can reference or control the same fan control domain, and multiple OEMSDRs can reference the same temperature sensors.The PWM duty-cycle value for a domain is computed as a percentage using one or moreinstances of a stepwise linear algorithm and a clamp algorithm. The transition from onecomputed nominal fan speed (PWM value) to another is ramped over time to minimize audibletransitions. The ramp rate is configurable via the OEM SDR.Multiple stepwise linear and clamp controls can be defined for each fan domain and usedsimultaneously. For each domain, the BMC uses the maximum of the domain’s stepwise linearcontrol contributions and the sum of the domain’s clamp control contributions to compute thedomain’s PWM value, except that a stepwise linear instance can be configured to provide thedomain maximum.Hysteresis can be specified to minimize fan speed oscillation and to smooth fan speedtransitions. If a Tcontrol SDR record does not contain a hysteresis definition, e.g. an SDRadhering to a legacy format, the BMC will assume a hysteresis value of zero.3.16.4.1 Stepwise Linear3.16.4.1.1 Fan Speed ContributionEach stepwise linear Tcontrol sub-record defines a lookup table that maps temperature sensorreadings to fan speeds. The table entries must be in increasing order of temperature. The BMCRevision 1.1Intel ® Confidential 29

錯 誤 ! 尚 未 定 義 樣 式 。錯 誤 ! 尚 未 定 義 樣 式 。 EPSgoes through the table, starting from the end, until it finds a temperature entry that is less thanor equal to the current reading of the associated temperature sensor. The corresponding fanspeed is used as the domain fan contribution of that sub-record. If the current reading is lessthan all temperature entries in the table, then the sub-record’s contribution remains unchanged.Fan speed shall not drop below the nominal value given in the Temperature Fan Speed ControlSDR.The basis for the final fan speed for each domain is the maximum of calculated contributions ofstepwise linear Tcontrol sub-records that are valid under the active profile for that domain. Allvalid clamp contributions are added to this base value.If no hysteresis is specified in the stepwise linear sub-record, then each reading is used torecalculate the fan speed contribution. This can result in oscillating fan behavior if the sensorreading alternates between two different values. The frequent change in fan speed can beirritating and might be interpreted as improper system behavior.Such oscillation can be prevented by specifying positive or negative hysteresis, or both. Eachtime the fan speed contribution is calculated, the BMC uses the hysteresis values to create awindow around the temperature value that was used for the calculation. The fan speed and thehysteresis window remain unchanged until a new sensor reading falls outside of the window.The process repeats with that new reading: it is used to recalculate the fan speed contributionand define a new hysteresis window. This cycle is independent of the lookup table values andapplies regardless of whether the new temperature reading affects the fan speed contribution.The BMC creates this window by applying the hysteresis values as follows:1. A new reading is retrieved from the BMC’s sensor subsystem.2. The last-applied reading, the reading that was used to calculate the sub-record’s current fanspeed contribution, is subtracted from the new reading.3. Hysteresis is applied to the difference:• If the difference is positive (the new reading is higher), the positive hysteresis issubtracted from the difference.• Otherwise, the change is non-positive (negative or zero), and the negative hysteresis isadded to the difference.4. The modified difference is evaluated:• If factoring in the hysteresis changed the calculated difference from positive to negativeor from non-positive to positive, the new reading is ignored and the previously calculatedfan speed contribution is used.• Otherwise, the reading obtained in step 1 is used to recalculate the fan speedcontribution, and it is used as the last applied reading until the hysteresis window isexceeded again.For example, if a stepwise linear sub-record specifies a positive hysteresis value of 3º C and anegative hysteresis of 2º C for an ambient temperature sensor. A sensor reading of 25º C isused to calculate the initial fan speed contribution for the sub-record. With the given hysteresis30Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSFunctional Specificationwindow, the BMC does not recalculate the fan speed until the sensor reads 28º C or higher, dueto the positive hysteresis, or 23º C or lower, due to the negative hysteresis. When one of thesetemperature ranges is reached, the fan speed is recalculated and the hysteresis window is resetbased upon the new reading. See the figure below.TemperatureFigure 4. Stepwise Linear Control HysteresisThis prevents oscillating fan speed behavior, although it is different from the IPMI sensorthreshold interpretation of hysteresis, which is applied to the thresholds not to the reading.3.16.4.1.2 Domain MaximumStepwise linear Tcontrol sub-records might have a flag set that indicates that the instanceprovides the fan domain maximum PWM value. These sub-records do not contribute to the fanspeed. Instead, the fan speed obtained through the table lookup is saved for reference. Whenthe final domain contribution is calculated, it is reduced, if necessary, to this domain maximumvalue. This limits the maximum noise output of the system for a given ambient temperature toensure acoustic specifications are met.Hysteresis is not applied to domain maximum sub-records.3.16.4.2 ClampClamp Tcontrol sub-records specify one temperature value and direct the BMC to increase thefan speed for the associated fan domain as necessary to maintain the value of thecorresponding temperature sensor below the clamp value. If the sensor reading exceeds theclamp value, then the fan speed contribution increases over time until either the fan speedreaches saturation (maximum speed) or the temperature drops below the threshold. If thetemperature is below the threshold, the sensor’s contribution is reduced over time until itreaches zero. Fan speed changes occur in the step size specified in the sub-record.Revision 1.1Intel ® Confidential 31

錯 誤 ! 尚 未 定 義 樣 式 。錯 誤 ! 尚 未 定 義 樣 式 。 EPSTo keep a minor change in the temperature from causing a rapid and dramatic increase in thefan speed, these sub-records allow a scan rate to be specified that lowers the frequency atwhich the sub-record’s contribution is recalculated. Increasing the scan rate allows more timefor increased cooling to take effect before increasing the fan speed again.If hysteresis is specified, it is only applied when the contribution direction might change frompositive to negative or vice versa. For example, if the BMC previously increased the fan speedcontribution from a given clamp sub-record, it factors in specified negative hysteresis whendetermining whether to change direction and start decreasing the fan contribution. If no action istaken due to hysteresis, the BMC continues to remember the previous direction.Figure 5. Clamp Control HysteresisClamp controls associated with processor temperature sensors are special-case. They musthave the “use Tcontrol bit set” in the SDR sub-record and a 1-based processor number must bespecified. The BMC uses the processor number to look up the Tcontrol value received fromBIOS for that processor. In the PECI implementation, the Tcontrol value is a positive numberrepresenting a negative offset, so the BMC subtracts the Tcontrol value from the clampthreshold in the SDR. This adjusted clamp threshold is used to determine fan speed contribution.32Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSFunctional SpecificationThe sum of calculated contributions of all Clamp Tcontrol sub-records that are valid under theactive profile for that domain is added to the maximum of valid stepwise linear contributions.3.16.4.3 Sensor FailureEach Tcontrol SDR sub-record has a failure control value field. The value in this field is used bythe BMC as that sub-record’s fan speed contribution if the associated sensor is enabled but ismarked reading/state unavailable. If the sensor is unreadable because it is disabled, or if afailure control value of FFh is specified, then the BMC ignores the sub-record’s fan speedcontribution.3.16.5 Thermal and Acoustic ManagementThis feature refers to enhanced fan management to keep the system optimally cooled whilereducing the amount of noise generated by the system fans. Aggressive acoustics standardsmight require a trade-off between fan speed and system performance parameters thatcontribute to the cooling requirements, primarily memory bandwidth. The BIOS, BMC, andSDRs work together to provide control over this trade-off determination.This capability requires the BMC to access temperature sensors on the individual memoryDIMMs. Emerald Ridge only supports RDIMMs.3.16.5.1 Fan Profiles.The server system supports multiple fan control profiles to support acoustic targets andASHRAE compliance. Fan profile will be selected based on the altitude setting. The BIOS Setuputility can be used to configure the correct altitude settingAlthough there are up to eight profiles available, the Emerald Ridge implementation supportsonly five profiles. There is one profile associated with each of four altitude settings. The fouraltitude settings are: 1) less than 300m, 2) between 301m and 900m, 3) between 901 and1500m, greater than 1501m. Additionally, a default profile is defined which the BMC appliesupon system power on until BIOS changes the enabled profile after system boot. This defaultprofile excludes all fan control based on DIMM and Memory Buffer temperature sensors andmust be configured to provide sufficient cooling capability under this constraint. If for any reason,the BMC cannot determine which primary profile to use, the BMC should be set to the defaultprofile.Table 12. Fan Profile MappingTypeProfileDefault 0 DefaultCLTT 1 less than 300m altitudeCLTT 2 between 301m and 900m,CLTT 3 between 901 and 1500mCLTT 4 greater than 1501mDetailsThe BMC provides commands that query for fan profile support and it provides a way to enablea fan profile. Enabling a fan profile determines which TControl SDRs are used for fanmanagement. The BMC only supports enabling a fan profile through the command if that profileis supported on all fan domains defined for the system. It is important to configure the SDRs soRevision 1.1Intel ® Confidential 33

錯 誤 ! 尚 未 定 義 樣 式 。錯 誤 ! 尚 未 定 義 樣 式 。 EPSthat all desired fan profiles are supported on each fan domain. If no single profile is supportedacross all domains, the BMC defaults to using profile 0 and do not allow it to be changed.At system boot, the BIOS can use the Get Fan Control Configuration command to query theBMC about which fan profiles are supported. The BIOS uses this information to display optionsin the BIOS Setup utility. The BIOS indicates the fan profile to the BMC, as dictated by the BIOSSetup Utility options for altitude, using the Set Fan Control Configuration command.The BMC uses this information as input to its fan control algorithm as supported by the TControlOEM SDR. The BMC only allows enabling fan profiles that the BMC indicates are supportedusing the Get Fan Control Configuration command. For example, if the Get Fan ControlConfiguration command indicates that only profile 1 is supported, then using the Set FanControl Configuration command to enable profile 2 will result in the return of an error completioncode.The BMC requires the BIOS to send the Set Fan Control Configuration command to the BMC onevery system boot. This must be done after BIOS has completed any throttling-related chipsetconfiguration.3.16.5.2 ASHRAE ComplianceSystem requirements for ASHRAE compliance is defined in the Common Fan Speed Control &Thermal Management Platform Architecture Specification. Altitude-related changes in fan speedcontrol are handled through profiles for different altitude ranges.3.17 DIMM Thermal Margin SensorEmerald Ridge platform supports system memory DIMMs with temperature sensing capabilities.DIMMs without temperature sensor are not supported. This section describes how thetemperature readings from the DIMMs are modeled as IPMI sensors.SDRs for these aggregate sensors should be set to “sensor scanning disabled” state and thatenabling/disabling of the sensors occurs by the BMC FW when BIOS updates DIMM map using“Set Fan Control Configuration” command.3.17.1.1 Discovery of Physical DIMM Temperature SensorsThe BIOS provides Physical DIMM presence information to the BMC using an IPMI command“Set Fan Control Configuration” during POST at each system boot as part of BIOS configurationof the BMC fan settings.During Memory Hot Plug and Memory Online/Offline operation BIOS must update BMCregarding new DIMM presence map.The temperature readings from the physical temperature sensors on each DIMM areaggregated into IPMI temperature margin sensors for each for memory risers 1&2, 3&4, 5&6,and 7&8 corresponding to CPU group 0,1,2,3.Each DIMM can potentially have a different nominal thermal operating range depending on themanufacturer, memory refresh rate, and other factors. Taking these factors into account, BIOS34Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSFunctional Specificationprograms one or more memory throttling temperature thresholds into the memory throttlingsubsystem during POST. These thresholds define the DIMM temperature value for whichdifferent levels of memory throttling take effect.The BMC uses one of these thresholds as the reference point to calculate the currenttemperature margin for an individual DIMM sensor. The DIMM with the most positive margin isconsidered the dominant margin of the group. This value becomes the current sensor readingfor the aggregate (IPMI) DIMM temperature sensorOnce the BMC has received notification that the DIMM temp sensor and memory throttlingconfiguration has completed, the BMC will enable any aggregate DIMM margin sensors definedfor the platform only if the throttling mode is CLTT (OLTT DIMMs are not supported) and thereare valid DIMM temp sensors present that are associated with the specific aggregate DIMMmargin sensor.If DIMMs with temperature sensors are present in the system and BMC monitoring of the DIMMtemperatures is enabled, then the BMC will periodically poll for these temperature readings in 3second of scan rate. These aggregate sensors are primarily used as input to the system fanmanagement control algorithms but may also be used for reporting temperature margininformation and SEL logging.This sensor is unavailable during a memory hot-plug or memory on-line/off-line operation that isperformed on a memory board associated with this sensor.These sensors are implemented as auto-rearm threshold margin sensors.3.17.1.2 DIMM Temperature Input to Fan Control AlgorithmThe BMC can use aggregate margin sensor as the input for a clamp algorithm that increasesfan speed if the margin exceeds a given clamp value. Each supported aggregate sensor may beused as a control input for one or more fan control domains. This configuration is specified usingTControl OEM SDRs.To support user choices regarding acoustic targets versus memory performance options, thefan control algorithm can utilize a different margin clamp value for each option. This isimplemented by using different Tcontrol SDRs for the Fan Profiles associated with each option.A negative aggregate margin sensor value means that all DIMMs are below their T1 values andno temperature-based memory throttling is in effect.If that sensor is linked to a Tcontrol Clamp sub-record with a negative clamp point, the BMCincreases fan speed before temperature-based throttling takes effect. This is associated with aperformance-optimized profile.If an aggregate margin sensor is linked to a Tcontrol Clamp sub-record with a positive clamppoint, temperature-based throttling takes effect before the BMC increases the fan speed. This isassociated with an aggressively acoustics-optimized profile. Acoustics-optimized profiles mayalso use negative clamp points and rely on more aggressive memory throttling (configured byBIOS) to reduce the overall cooling requirements.Revision 1.1Intel ® Confidential 35

錯 誤 ! 尚 未 定 義 樣 式 。錯 誤 ! 尚 未 定 義 樣 式 。 EPSIn order for the BMC to handle these values in its fan speed control algorithms, any TcontrolSDRs referencing these sensors must have the signed sensor flag bit set. The clamptemperature in the SDR is interpreted as a two’s-complement signed integer.3.18 IOH thermal Margin SensorEmerald Ridge platform support two IOH, each IOH supports on-die thermal sensor. The IPMIsensor reading is the negative of the corresponding IOH thermal sensor.3.19 Memory Buffer thermal Margin SensorEmerald Ridge supports maximum eight memory risers. Each memory riser has two memorybuffer devices. Among others capabilities, this component provides an on-die thermal sensor.SDRs for these aggregate sensors should be set to “sensor scanning disabled” state and thatenabling/disabling of the sensors occurs by the BMC FW when BIOS updates DIMM map using“Set Fan Control Configuration” command.During POST, BIOS must send memory buffers population along with DIMM population to BMCusing “Set Fan Control Configuration” OEM command, this is even applied during memory hotplug and online/offline memory operation. BMC will enable the corresponding aggregatememory buffer temperature sensor if and only if at least one of the associated memory bufferdevices is present.BMC will monitor the temperature sensors for memory buffers devices regardless of thepresence of any associated DIMMs.The BMC aggregates the calculated thermal margins for the memory buffers devices in a similarfashion as is done for the DIMM thermal margins, with one aggregate IPMI sensor each formemory risers 1&2, 3&4, 5&6,and 7&8. The most positive margin of a group of Mill Brookcomponents is taken as the dominant margin. This value then becomes the value of theassociated memory buffer aggregate thermal margin sensor. This sensor is implemented asauto rearm.3.20 Add in card thermal margin sensorThe BMC implements one IPMI thermal sensor for add-in card zone-1BMC calculates add in card thermal margin sensor from 3 physical discrete sensors (2 on thebaseboard and 1 on the IO Riser card). This IPMI sensor value is calculated according to thefollowing equation:Sensor value = T2 – T1 + TioT2 and T1 are discrete LM75 sensors located in add-in card zone-2 and zone-1 respectively.Tio is the discrete sensor located on IO riser board.The IPMI sensor is implemented as an auto-rearm threshold sensor.36Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSFunctional Specification3.21 Power Throttle SensorThe BMC supports a PLD Power Throttle sensor which is used to log a SEL event whenmemory controller and/or the CPUs are throttled encountering an over power drawn conditionfor the given power supply configuration and capabilities. When power supply utilization is morethan 80% of throttling limits, PDB FW will notify the PLD immediately and PLD FW will decidethe system need throttle memory controller and/or the CPUs or not. Moreover the throttlinglimits are established by the PDB controller based on the number of PSU installed and notbased on the FRUSDR setup of the power supply configuration. The power supply redundancyconfiguration in FRUSDR setup only influenced the SEL and the system status LED.System will throttle Memory controller when• All 4x power supplies are not installed in the system OR multiple power supplies failedeven though all 4x power supplies are installed (Don’t assert this signal with three ormore functional power supplies).AND• Memory VR current trip point (default setting: 90% of supported TDP current) is triggered.AND• System power utilization is high and exceeds a pre-set limit of 80%.System will throttle CPU when• All 4x power supplies are not installed in the system OR multiple power supplies failedeven though all 4x power supplies are installed (Don’t assert this signal with three ormore functional power supplies).AND• Processor VR current trip point (default setting: 90% of supported TDP current) istriggered.AND• System power utilization is high and exceeds a pre-set limit of 80%.BMC monitors throttling of CPU and Memory Controller and logs an SEL event. Power throttlesensor is implemented as manual rearm sensor.Upon assertion of the sensor offset, BMC starts an internal time of 30 mins. BMC will re-arm thesensor when the timer expires. The sensor is also re-armed when the system is reset or DCpower-cycled.3.22 Memory Riser Power Failure MonitoringThe BMC supports detection of memory riser power failures. As soon as power failure happensin any of memory riser/s, PLD detects power failures and powers down the server. BMC readsthe PLD status bits to find out location of failed memory riser and logs assertion event forMemory Riser Power Fail sensor assertion offset. BMC implements eight memory riser powerfailure sensors one for each memory riser, These sensors are readable in DC off state as well,so that users can see if these sensors are asserted by any of memory board failure. Memoryriser power failure sensors are implemented as auto-rearm sensors. Once the event is assertedby BMC due to failed memory riser, it would be de-asserted during DC reset.Revision 1.1Intel ® Confidential 37

錯 誤 ! 尚 未 定 義 樣 式 。錯 誤 ! 尚 未 定 義 樣 式 。 EPS3.23 Memory Hot Plug and Memory Offline/OnlineEmerald Ridge supports memory RAS features for memory hot-plug and on-lining/off-liningoperations.The memory hot-plug feature allows the end user to remove and/or insert memory boards whilethe system continues to run. Only a single memory board may be removed or inserted at a time.Memory Hot Plug is supported by the system BIOS and the BMC FW does not directlyparticipate, however there are interactions with the BMC’s polling of the DIMM temperaturesensors and Mill Brook temperature sensors, as described below.BIOS must utilize the appropriate SPD SMBus segment to access the DIMM SPD EEPROM aspart of the hot-plug/on-line/off-line operation. The BMC uses these same SPD SMBus segmentsfor polling of the DIMM and Memory Buffer temperature sensors. Since memory-hot plug andmemory on-lining can take place at any time.Additionally, just as it does during POST, when new memory is added or brought online; BIOSmust configure the DIMM temperature sensors appropriately and provide the BMC with the newDIMM population status as well as notification that the configuration has completed.When the memory hot-plug is initiated, DIMM and Memory Buffer temperature sensors are nolonger available to the BMC FW and the fan control algorithms will apply a default fan speed tofan zones controlled by these sensors. As the hot-plug operation completes, BIOS will updatethe BMC with new memory device and Memory Buffer population data and the BMC will regainaccess to the Sensors. Semaphore OperationTo facilitate sharing of these SMBus segments, semaphores are supported (one semaphore perSMBus segments attached to each CPU). In normal operational flow during runtime, ownershipof a semaphore is requested from the BMC by BIOS by use of an IPMI OEM command.However, in case the BMC is not responsive or otherwise does not give up the bus in a timelymanner, BIOS may forcibly take over the bus.The semaphores are instantiated in the form of 4 bits in one of the IBMC’s mailbox registers,which can be set or cleared by both the BMC and BIOS. The usage of these bits is defined asfollows:• A 0 indicates that BIOS owns the bus and a 1 indicates that the BMC owns the bus.• At AC power-on, the default state of these mailbox register bits is 0.• BIOS is the default owner of the all the busses once a reset has occurred until POSTcompletes. At the start of POST, BIOS clears all the semaphore bits (= BIOS ownership).Before POST completes, BIOS sets all the semaphore bits (= BMC ownership).• During runtime, if BIOS needs bus ownership, it must first try to acquire the busownership through the IPMI OEM command method. Only if the BMC doesn’t give upthe bus after a timeout and retry by BIOS, then BIOS may forcibly take over the bus byclearing the associated semaphore bit.38Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSFunctional Specification• During runtime, if BIOS needs to return bus ownership to the BMC, it must first try to dothis using the IPMI OEM command method. Only if the BMC doesn’t respond to the IPMIOEM command, then BIOS must reset the associated semaphore bit to indicate that theBMC now owns the bus.• During runtime, if BIOS needs to return bus ownership to the BMC, it must first try to dothis using the IPMI OEM command method. Only if the BMC doesn’t respond to the IPMIOEM command, then BIOS must reset the associated semaphore bit to indicate that theBMC now owns the bus.• The BMC FW checks that it is owner of the bus prior to initiating any transaction on thebus by inspecting the state of the associated mailbox semaphore bit.3.23.1 Sequence of Operations during Memory Hot PlugThe BIOS/BMC interactions are as follows:• BIOS owns all the bus segments until completion of POST. After POST completes, theBMC becomes the default owner.• When a memory hot-plug or memory on-line operation is initiated, BIOS must requestaccess of the applicable SMBus segment from the BMC using the Acquire SystemResource OEM IPMI command. If the BMC is in the middle of a SMBus transaction, itmust respond to the BIOS with an appropriate response code and halt any furthertransactions on that bus. After waiting to allow the BMC to finish its transaction for250ms, BIOS must retry its request for bus ownership. It is recommended that BIOSshould attempt a minimum of 2 retries. .If the BMC doesn’t relinquish the bus or is notresponding to the command request after BIOS has completed its retry attempts thenBIOS may assume ownership of the bus segment by forcibly clearing the semaphore bitin order to complete the hot-plug operation.• Once BIOS has gained ownership of the bus segment, BMC will no longer poll on thatbus until it regains ownership.• Once BIOS has completed the memory operation, BIOS sends new DIMM populationmapping data to the BMC.• BIOS must relinquish ownership to the BMC by resending the command after it hascompleted all bus accesses required for the operation. Note that if BIOS hangs anddoesn’t return the semaphore, the BMC will eventually detect an SMI timeout and resetthe system.• Once BMC has regained ownership of the SMBus segment and there are no pendingBIOS requests for access to the segment, then BMC begins polling temperature sensorsthat are present on that bus.When BIOS has ownership of a bus segment, then the BMC can no longer poll the DIMMtemperature sensors on that bus. The associated IPMI aggregate sensors, the DIMM ThermalMargin and Memory Buffer Thermal Margin sensors, will then enter and remain in the “readingRevision 1.1Intel ® Confidential 39

錯 誤 ! 尚 未 定 義 樣 式 。錯 誤 ! 尚 未 定 義 樣 式 。 EPSunavailable” sensor state as defined by the IPMI 2.0 Specification until the BMC once againgains ownership of that bus and resumes polling.The diagram below illustrates the BIOS/BMC interactions for memory hot-plug from the BMCperspective.40Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSFunctional SpecificationFigure 6. BMC/BIOS interactions for Memory Hot-Plug/On-line/Off-line OperationsRevision 1.1Intel ® Confidential 41

錯 誤 ! 尚 未 定 義 樣 式 。錯 誤 ! 尚 未 定 義 樣 式 。 EPS3.24 HeartBeat LEDEmerald Ridge platform has a heartbeat LED located on top of IO riser (next to IO Riser powerLED) which indicates BMC firmware health, it can be seen only if chassis is open. On normaloperating condition Heartbeat LED is green blinking with 1 sec of blink rate. In case of firmwarecrash or unavailability LED behavior will be not be blinking (either on or off)1. Heartbeat LED will be off when system is booted using force update mode jumperset( uboot mode)2. Enter firmware transfer command will have no impact to LED state3. Exit firmware transfer mode (BMC reset) will cause LED to stop blinking till firmware isup and running.4. No other sensors any fault or system status would cause any impact to Heartbeat LED.3.25 CSS LEDEmerald Ridge Platform has CSS LED on back of IO Riser, which indicates Memory and PowerSupply status, CSS LED supports only two states OFF and SOLID YELLOW. On normalcondition CSS LED will be OFF, CSS LED will be ON (SOLID YELLOW) when Memory ORpower supply errors are detected in the on, sleep, or standby state.a. Memory status.- Memory errors are detected by BIOS, When BIOS detects anymemory errors in POST, it notifies to BMC using “Set Fault Indication” command tolight the corresponding DIMM LED, in addition to light DIMM fault LED, BMC will alsolight CSS LED so that user doesn’t need to open the chassis and observe anymemory errors. The CSS LED will stay in SOLID YELLOW state until BIOS tellsBMC all DIMMs OK in future Power ON.b. Power Supply status- PS fail will happen in all power state. When the PS failoccurred, PS FW will assert the PS Alert (SMBAlert) signal. And BMC scans PS Alertsignal for any detectable errors and lights the CSS LED. Below are the assertionconditions for the alert signal.IOUT over current warningIOUT over current faultPOUT over power warningPOUT over power faultIIN over current warningPIN over power warningVIN under voltage warningVIN under voltage faultPower good de-assertsPower supply failures (includes over temperature and fan failure)42Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSFunctional Specification3.26 Global Fan Fault LEDEmerald Ridge platform has a Fan Fault LED located on front panel next to System Status LED,which indicates Fan Fault on system, since FAN LEDs are inside chassis, user can use thisLED to find out if there are any fan failures in the systemOn normal condition Global Fan Fault LED will be OFF. In case of fan fault (Any of system Fan),addition to relevant FAN fault LED, Global FAN fault LED will be amber solid,Global fan fault LED will be OFF only if NONE of system fan fault LED is ON and Global FanFault LED will be ON only if ANY of Fan fault LED is ON.None of other sensors and System status contributes to Global Fan Fault LEDIn case of fan fault when system is powered off ( DC off), Global Fan fault LED will be ON sothat user can see the fan fault without opening the chassis and it will be turned off till sensor isrearmed ( int agent in case of DC on)3.27 Power Management Bus (PMBus)The BMC firmware implements power-management features based on the Power ManagementBus (PMBus) 1.1 Specification.3.27.1 PMBus AddressingThe power supply device address locations are shown below.Table 13. PMBus Device AddressingPower Supply #Power Supply 1Power Supply 2Power Supply 3Power Supply 4B0hB2hB4hB6hPMBus Address3.27.2 PMBus-specific specific Sensor SupportThe following sensor types are supported for systems that contain PMBus-compliant powersupplies and a PMBus-compliant power distribution board.3.27.2.1 Power Supply Input Power SensorThis analog sensor monitors AC power input to the system.IPMI Sensor CharacteristicsEvent reading type code: 01h (Threshold)Sensor type code: 0Bh (Other Units)Rearm type: AutoConfigured thresholds: Upper critical/non-criticalRevision 1.1Intel ® Confidential 43

錯 誤 ! 尚 未 定 義 樣 式 。錯 誤 ! 尚 未 定 義 樣 式 。 EPSEvent generation: Assertion/deassertion events for all supported thresholds3.27.2.2 Power Supply Output Current SensorThe BMC supports one Power Supply Output Current sensor for each system power supplymodule. This sensor is only supported for systems that use PMBus-compliant power supplies.The BMC reads current for the main 12 V power rail coming out of the power supply andexpresses the reading as the percentage of max rated output current for the power rail.This monitoring capability is instantiated in the form of IPMI analog/threshold sensors.IPMI Sensor CharacteristicsEvent reading type code: 01h (Threshold)Sensor type code: 03h (Current)Rearm type: AutoConfigured thresholds: Upper critical/non-criticalEvent generation: Assertion/deassertion events for all supported thresholds3.27.2.3 Power Supply Temperature SensorThe BMC supports two Power Supply Temperature sensors for each system power supplymodule. One temperature sensor uses in standby mode, the other uses in active mode. Thestandby sensors would be available only when the system in standby mode, reading for thesesensors in power on state would result in "reading not available" state. The active mode sensorswould be available only when system power on more then 25 seconds due to BMC delays 25seconds after DC Power On to access these sensors. Reading for these sensors in standbystate and power on less then 25 seconds would result in "reading not available" state. Moreover,the standby sensors and active mode sensors have different thresholds.These sensors are only supported with systems that use PMBus-compliant power supplies. Thismonitoring capability is instantiated in the form of IPMI analog/threshold sensors. The location ofthe physical temperature sensor in the power supply helps to provide a measurement of inlet airtemperature to the power supply. These sensors are implemented as auto rearm.3.28 Power Unit ManagementThe BMC supports IPMI type 09h, power unit sensor, using the following offsets:Table 14. Power Unit Sensor OffsetsOffsetDescriptionEvent Logging00h Power off – Asserted whenever the system DC power is off. Assertion andDeassertion04h05hAC lost – Asserted momentarily for event generation when AC power isapplied to the system and the previous system power state was on.Soft power control failure – Asserted if the system fails to power-on due to thefollowing power control sources:Chassis Control commandPEF actionBMC Watchdog TimerPower State RetentionAssertion andDeassertionAssertion andDeassertion44Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSFunctional Specification06hPower unit failure – Asserted for the following conditions:Unexpected deassertion of system POWER_GOOD signal.System fails to respond to any power control source’s attempt to power downthe system.System fails to respond to any hardware power control source’s attempt topower on the system.Power Distribution Board (PDB) failure is detectedAssertion andDeassertion3.28.1.1 Power OffThe BMC asserts the Power Off offset whenever the system DC power is off.3.28.1.2 AC LostThe BMC asserts the AC lost offset when AC power is applied to the system and the previoussystem power state was on. This offset is for event generation only and does not remainasserted.3.28.1.3 Soft Power Control FaultThe BMC asserts the Soft Power Control Failure offset if the system fails to power-on within 8seconds as instructed by the following power control sources:Chassis control commandBMC watchdog timerPower state retentionThe BMC provides system status indication via the front panel LEDs. See Section 3.6.2. TheBMC generates a beep code for Power Control Fault. See Table 8.3.28.1.4 Power Unit FailureThe BMC asserts the Power Unit Failure offset of the Power Unit sensor for the followingsituations: Power-good dropout (see Section 3.1.2).The system fails to power down: The POWER_GOOD signal fails to transition to the deassertedstate within 1 second when any of the enabled power control sources attempt totransition the system to the power-off state.The system fails to power-on due to any enabled hardware power control source: ThePOWER_GOOD signal from the power sub-system fails to assert within 8 seconds inresponse to a chipset or front panel power button request to power on.The BMC provides system status indication via the front panel LEDs as described in Section3.6.2. The BMC generates a beep code for a power fault. See Table 8.A power distribution board (PDB) failure is detected.Revision 1.1Intel ® Confidential 45

錯 誤 ! 尚 未 定 義 樣 式 。錯 誤 ! 尚 未 定 義 樣 式 。 EPS3.28.2 Power Supply Fan MonitoringIn addition to the system fan monitoring supported the BMC monitors the power supply fans.These are monitored primarily to support power supply failure management as described insection 3.28.4. The BMC FW supports one PS Fan Fault sensor per power supply fan.Monitoring is implemented via IPMI discrete sensors, one for each power supply fan. The BMCpolls each installed power supply using the PBMus fan status commands to check for failureconditions for the power supply fans. The BMC asserts the “performance lags” offset of the IPMIsensor if a fan failure is detected.Power supply fan sensors are implemented as manual re-arm sensors because a failurecondition can result in boosting of the fans. This in turn may cause a failing fan’s speed to riseabove the “fault” threshold and can result in fan oscillations. As a result, these sensors do notauto-rearm when the fault condition goes away but rather are rearmed only when the system isreset or power-cycled.After the sensor is rearmed, if the fan is no longer showing a failed state, the failure condition inthe IPMI sensor shall be cleared and a deassertion event shall be logged.IPMI Sensor Characteristics Event reading type code: 03h (Generic – digital discrete) Sensor type code: 04h (Fan) Rearm type: ManualTable 15. Supported Sensor OffsetsOffsetDescriptionEvent Logging01h State asserted Assertion and deassertion46Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPSFunctional Specification3.28.3 Power Supply Fan Speed ControlA component of Emerald Ridge thermal management is BMC control of power supply fan speed.All control of power supply fans by the BMC is done via PMBus commands. Controlling of PSFan happens through setting PWM value. The fan control OEM SDRs used for power supplycontrol will therefore specify the control data as PWM values. In order for the fan speed controllogic to work correctly, the SDRs must be reloaded any time the power supply configuration ischanged in order to load the proper SDRs for the given power supplies.Power supplies have internal fans which provide cooling to the power supplies and to the harddisks. The power supply fan speed control is influenced by the power supply internal logic alongwith system level control. The power supply fans operate from distributed 12V power. If a powersupply is installed, the power supply fans will always have 12V power applied and allow fullPMBUS control, even if the power supply is failed.The following factors will influence the power supply fan speed.1) Internal control. Internal control is based on an internal temperature sensor along withpower supply load. These details are documented in the power supply specification.2) Front Panel Thermal Sensor Clipping curves. The front panel sensor must bemapped via the piecewise upper and lower clipping curves to the power supply fans.3) Lookup Table. In order to sufficiently cool the hard disks, the power supply fans speedmust also react to the main system fans speeds. Since the main system fans are in fourfan zones, the maximum aggregate system fan speed will be used in the lookup table.The following table shows an example of the lookup table. The specific values in thelookup table will be based on system testing. The table should be flexible and allowvalues to be changed through an SDR mechanism. There must be a unique lookup tablefor each power supply configuration. This results in four lookup tables, one for eachpower supply configuration. The lookup table will specify a power supply PWM value.Revision 1.1Intel ® Confidential 47

錯 誤 ! 尚 未 定 義 樣 式 。錯 誤 ! 尚 未 定 義 樣 式 。 EPSMaximumSystemFan SpeedPWMTable 16 Example PS Fan Lookup TableMinimum Power Supply Fan RPMOnePSModuleTwoPSModuleThreePSModuleFour PSModule20 55% 45% 40%30 55% 45% 40%40 55% 45% 40%50607080Always at 100%linearlinear90 100% 80% 80%100100% 80% 80%4) HSC Temp: Apart from system Fan contribution, PS Fan would boost when BPtemperature crosses threshold mentioned in clamp record. As BMC needs to poll HSCBP sensor continuously, new sensor 0xF0 has been added and the same is clamped forDomain 4 which is same as HSC BP temp sensor 0x01.As the power supplies and the hard disks must always have sufficient cooling, the finalpower supply fan speed RPM must be the maximum fan speed required by items 1, 2 3and 4 above.3.28.4 Power Supply Failure ManagementSince the system supports several power supply configurations, this section will describe thesystem level fan speed control reaction to some specific failure modes.System Configuration refers to the initial non-failure or non-hot swap configuration. Thefollowing table is limited to rotor failures for the power supply fans only. This is not based on anysystem fan failures.Table 17. Power Supply Fan FailureLinearSystem Configuration(# of PS installed)432432432Description of Failure or EventSingle rotor failureAny second rotor failure or anydouble faultHot swap operationNormalSystem ReactionAll Power Supply fans tomaximum speedNormalAll Power Supply fans tomaximum speed48Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPS 錯 誤 ! 尚 未 定 義 樣 式 。System ConfigurationDescription of Failure or EventSystem Reaction(# of PS installed)1 None All Power Supply fans tomaximum speed1 Any fault All Power Supply fans tomaximum speedThe table above is the default. System testing must be performed to validate these conditionsand the specific system reactions are subject to change based on system testing.Note: If there is a fan fault on one PS, PMBUS FW would boost other fans on the faulty PS to100% PWM. Even if the fault is de-asserted, PMBUS FW would keep all fans at 100% PWM tillPS is reset either by AC cycle or removing and inserting back the PS.3.28.5 Power Supply Status SensorsFor each power supply, the BMC supports an IPMI type 08h power supply sensor using thefollowing offsets:Table 18. Power Supply Sensor OffsetsOffset00h01h02h03h06hDescriptionPresence detected – Asserted if power supply module is present. Eventsare only logged for power supply presence upon changes in the presencestatus after AC power is applied (no events logged for initial state).Event LoggingAssertion andDeassertionPower supply failure detected – Asserted if power supply module has failed. Assertion andDeassertionPredictive failure – Asserted if a condition that is likely to lead to a powersupply module failure has been detected, such as a failing fan.Power supply AC lost – Asserted if there is no AC power input to a powersupply module.Configuration error – Asserted if the BMC cannot access the servermanagement features due to a power supply type mismatch.Assertion andDeassertionAssertion andDeassertionAssertion andDeassertion3.28.6 Power Unit RedundancyThe BMC supports redundant power sub-systems and implements a Power Unit Redundancysensor per platform. A Power Unit Redundancy sensor is of sensor type Power Unit (09h) andreading type Availability Status (0Bh). This sensor generates events when a power sub-systemtransitions between redundant and non-redundant states, as determined by the number andhealth of the power sub-system’s component power supplies. The definition of redundancy ispower sub-system dependent and sometimes even configuration dependent. The BMC allowsredundancy to be configured on a per power-unit-redundancy sensor basis via the OEM SDRrecords. See Table 80 and Table 81.Revision 1.1Intel ® Confidential 49

錯 誤 ! 尚 未 定 義 樣 式 。錯 誤 ! 尚 未 定 義 樣 式 。 EPS3.29 Event Message Generation and ReceptionThe BMC cannot be configured to act as an event generator on the IPMB, so the BMC does notaccept the Set Event Receiver command. The BMC does respond to the Get Event Receivercommand.3.30 Event Logging Disabled SensorThe BMC implements an Event Logging Disabled type (10h) sensor that is event only. Itsupports offset 02h – Log Area (SEL) Reset / Clear. Only assertion events are logged for thissensor.3.31 SMI Timeout SensorThe BMC supports an SMI timeout sensor (sensor type OEM (F3h), event type Discrete (03h))that asserts if the SMI signal has been asserted for more than 90 seconds. A continuouslyasserted SMI signal is an indication that the BIOS cannot service the condition that caused theSMI. This is usually because that condition prevents the BIOS from running.When an SMI timeout occurs, the BMC asserts the SMI timeout sensor and logs a SEL eventfor that sensor. The BMC will also reset the system.3.32 BMC Self TestThe BMC performs tests as part of its initialization. If a failure is determined, such as a corruptBMC SDR, then the BMC stores the error internally. BMC or BMC sub-system failures detectedduring regular BMC operation may also be stored internally. The IPMI 2.0 Get Self Test Resultscommand can be used to return the first error detected.Table 19 shows self-test errors that may be posted. Self test result monitoring occurs when theapplicable subsystem is accessed. This happens both at runtime and at BMC initialization.Table 19. BMC Self Test ResultsSecondPerformed DuringFirst ByteDescriptionByteBMC initialization55h 00h No error detected N/A57h 01h BMC operational code corrupted Yes57h 02h BMC boot / firmware update code corrupted Yes57h 08h SDR repository empty Yes57h 10h IPMB Signal Error No57h 20h BMC FRU device inaccessible Yes57h 40h BMC SDR repository inaccessible Yes57h 80h BMC SEL device inaccessible Yes50Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPS 錯 誤 ! 尚 未 定 義 樣 式 。3.33 BMC Test CommandsFor hardware and manufacturing test purposes, there are two Intel General Application netfunction commands: Get SM Signal (14h) and Set SM Signal (15h). These commands can beused to force the front panel LED and fan speed state, and to sense the state of the front panelbuttons without causing the BMC firmware to act on changes to them (button pushes).Each command request takes a signal type, a signal instance (to allow for supporting multiplesignals of a particular type), and an action to perform. The signal types are guaranteed to beconsistent across platforms, although some platforms may introduce new signal types forplatform-specific signals that can be accessed by these commands and may not providesupport for others that are not appropriate for the platform.Table 20 shows outputs that can be tested via the Set SM Signal command.Table 20. Set SM Signal Command Signal DefinitionSignal NameFan power/speedSystem Fault LED (amber)System Ready LED (green)Signal IDInstances05h Note 101h Note 10Fh Note 1NotesFor “force assert” actions, request byte 4 is required.For all other actions, request byte 4 is reserved, andshould not be sent with the request.Request byte 4 is optional, and has no effect on thecommand.Request byte 4 is optional, and has no effect on thecommand.Table 21 shows the inputs (buttons / switches) that can be tested via the Get Sm Signalcommand.Table 21. Get SM Signal Command Signal DefinitionSignal NameSignal IDPower button 00h N/AReset button 01h N/AFan Power/Speed 0Dh N/AInstancesFor information on using the Get/Set SM Signal commands, please see Table 56.Revision 1.1Intel ® Confidential 51

錯 誤 ! 尚 未 定 義 樣 式 。錯 誤 ! 尚 未 定 義 樣 式 。 EPS3.34 Component Fault LED ControlSeveral sets of component fault LEDs are supported. Some LEDs are owned by the BMC andsome by the BIOS.The BMC owns control of the following FRU / fault LEDs:Fan fault LEDs – A fan fault LED is associated with each fan. The BMC lights a fan faultLED if the associated fan tach sensor has a lower critical threshold event status asserted.Fan tach sensors are manual rearm sensors. Once the lower critical threshold is crossed,the LED remains lit until the sensor is rearmed. These sensors are rearmed at system DCpower-on and system reset. Whenever any of fan fault LED glows, the Global Fan FaultLED also glows; refer to Section 3.27-Global Fan Fault LED for more details on this.DIMM fault LEDs - The BMC owns the HW control for these LEDs. The LEDs reflect thestate of BIOS-owned event-only sensors. When BIOS detects a DIMM fault condition, itsends an IPMI OEM command (Set Fault Indication) to the BMC to instruct the BMC to turnon the associated DIMM Fault LED. These LEDs are only active when the system is in the‘on’ state. The BMC will not activate or change the state of the LEDs unless instructed bythe BIOS.BIOS must send updated fault( or clear fault) every time after POST, DIMM LEDstate doesn’t change during AC reset3.34.1 Set Fault Indication CommandThe Set Fault Indication command can be used by satellite controllers and system managementsoftware to communicate fan, temperature, power, and drive fault states to the BMC. The BMCconsolidates the state with its own system state when determining the overall system health. Ituses this consolidated state to set the front panel indicator LED states and to control otherbehavior, such as fan boosting.The Set Fault Indication command has a source field that allows the BMC to track the faultstates of multiple sources. Each source must use a separate unique source ID. For example,hot-swap controller 0 is represented by ID 1. Hot-swap controller 1 is represented by ID 2.The fault state of each source is tracked independently. Whenever a source sets the fault statefor a particular fault type, such as fan or power, the new state overrides the previous state. Thetracked fault state is cleared when the server is powered up or reset.52Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” ” Integrated Baseboard Management Controller EPS 錯 誤 ! 尚 未 定 義 樣 式 。3.34.2 DIMM Mapping for Fault Indication and Fan Control Config:BIOS must follow below population rules for sending DIMM Map for Fault Indication and Fancontrol configuration command.Table 22. DIMM Mapping for Fault Indication and Fan Control Config (Risers 1,3,5, and 7)DIMM IDDIMM Map forCPU Group 0, Riser 1CPU Group 1, Riser 3CPU Group 2, Riser 5CPU Group G3, Riser 7DIMM Location on riserDIMM_1B XXXXXXXX – XXXXXXXX – 00000000 – 00000001 D1/BDIMM_1D XXXXXXXX – XXXXXXXX – 00000000 – 00000010 D1/DDIMM_1A XXXXXXXX – XXXXXXXX – 00000000 – 00000100 D1/ADIMM_1C XXXXXXXX – XXXXXXXX – 00000000 – 00001000 D1/CDIMM_2B XXXXXXXX – XXXXXXXX – 00000000 – 00010000 D2/BDIMM_2D XXXXXXXX – XXXXXXXX – 00000000 – 00100000 D2/DDIMM_2A XXXXXXXX – XXXXXXXX – 00000000 – 01000000 D2/ADIMM_2C XXXXXXXX – XXXXXXXX – 00000000 – 10000000 D2/CTable 23. DIMM Mapping for Fault Indication and Fan Control Config (Risers 2, 4, 6, and 8)DIMM IDDIMM Map forCPU Group 0, Riser 2CPU Group 1, Riser 4CPU Group 2, Riser 6CPU Group 3, Riser 8DIMM Location on riserDIMM_1B XXXXXXXX – XXXXXXXX – 00000001– 00000000 D1/BDIMM_1D XXXXXXXX – XXXXXXXX – 00000010– 00000000 D1/DDIMM_1A XXXXXXXX – XXXXXXXX – 00000100– 00000000 D1/ADIMM_1C XXXXXXXX – XXXXXXXX – 00001000– 00000000 D1/CDIMM_2B XXXXXXXX – XXXXXXXX – 00010000– 00000000 D2/BDIMM_2D XXXXXXXX – XXXXXXXX – 00100000– 00000000 D2/DDIMM_2A XXXXXXXX – XXXXXXXX – 01000000– 00000000 D2/ADIMM_2C XXXXXXXX – XXXXXXXX – 10000000– 00000000 D2/C3.35 Hot-Swap Controller3.35.1 Backplane TypesSAS / SATA backplanes are supported in the following configurations.Modular hot-swap controller (HSC) using Vitesse* 410: This configuration uses a modularboard that plugs into SAS / SATA backplanes.Revision 1.1Intel ® Confidential 53

錯 誤 ! 尚 未 定 義 樣 式 。Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSThe Vitesse SEPs support the legacy BMC to SCSI Enclosure Processor (SEP) commands thatwere implemented on earlier server boards that used a Qlogic* GEM 424. These are supportedvia the IPMB interface. These commands are augmented with new commands capable ofsupporting up to 32 drives.3.36 LAN Leash Event MonitoringThe Physical Security sensor is used to monitor the LAN link and chassis intrusion status. Thisis implemented as a LAN Leash offset in this discrete sensor. This sensor monitors the link stateof the two BMC embedded LAN channels. It does not monitor the state of any optional NICs.The LAN Leash Lost offset asserts when one of the two BMC LAN channels loses a previouslyestablished link. It deasserts when at least one LAN channel has a new link established afterthe previous assertion. No action is taken if a link has never been established.LAN Leash events do not affect the front-panel system status LED.3.37 CATERR ReportingThe BMC supports a CATERR sensor for monitoring the system CATERR signal.The CATERR signal is defined as having 3 states; High (no event)Pulsed low (degraded)Low (fatal)All processors in a system have their CATERR pins tied together. The pin is used as acommunication path to signal a catastrophic system event to all CPUs. The BMC has directaccess to this aggregate CATERR signal.The BMC only monitors for the “CATERR held low” condition. A pulsed low condition is ignoredby the BMC.If a CATERR-low condition is detected, the BMC logs an error message to the SEL against theCATERR sensor. The BMC logs a SEL entry, and resets the system. Because the CATERRsignals are tied together, the BMC is unable to determine which processor caused the CATERRevent.The sensor is rearmed on power-on (AC or DC power on transitions). It is not rearmed onsystem resets to avoid multiple SEL events that could occur due to a potential reset loop if theCATERR keeps recurring, which would be the case if the CATERR was due to an MSIDmismatch condition.3.38 CMOS Battery MonitoringThe BMC monitors the voltage level from the CMOS battery; which provides battery backup tothe chipset RTC. This is monitored as an auto-rearm threshold sensor. See the “BB VBat”sensor in Table 88.54Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” ” Integrated Baseboard Management Controller EPS 錯 誤 ! 尚 未 定 義 樣 式 。4. Messaging InterfacesThis chapter describes the supported BMC communication interfaces:Host SMS Interface via low pin count (LPC) / keyboard controller style (KCS) interfaceHost SMM interface via low pin count (LPC) / keyboard controller style (KCS) interfaceIntelligent Platform Management Bus (IPMB) I 2 C interfaceEmergency management port (EMP) using the IPMI-over-serial protocols for serial remoteaccessLAN interface using the IPMI-over-LAN protocolsThese specifications are defined in the following sub-sections. Section 4.2 provides an overviewof the basic characteristics of the communication protocols used in all of the above interfaces.4.1 Channel ManagementEvery messaging interface is assigned an IPMI channel ID by IPMI 2.0. Commands areprovided to configure each channel for privilege levels and access modes. The following tableshows the standard channel assignments:Table 24. Standard Channel AssignmentsIPMBLAN 1Serial ChannelSMMInterfaceSelf 1 –SMS / Receive Message QueueSupportsSessionsNoYesYesNoNoNote: Refers to the channel used to send the request.Revision 1.1Intel ® Confidential 55

錯 誤 ! 尚 未 定 義 樣 式 。Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSSee table below for Emerald Ridge Channel assignmentTable 25. Emerald Ridge Channel assignmentChannel IDInterfaceSupportsSessions0 Primary IPMB No1 LAN 1Yes(Switchable between the four Kawela NIC ports on the baseboard)2 Reserved–(To be used on future products to support 2 LAN channels on the baseboard)3 LAN 2 1Yes(Provided by the RMM3 card)4 SerialYes(COM2 terminal mode only)5 USB No6 Secondary IPMB No7 SMM No8 – 0Dh Reserved –0Eh Self 2 –0Fh SMS / Receive Message Queue No4.2 User ModelThe BMC supports the IPMI 2.0 user model including User ID 1 support. 15 user IDs aresupported. These 15 users can be assigned to any channel. The following restrictions areplaced on user-related operations:1. User names for User IDs 1 and 2 cannot be changed. These will always be “” (Null/blank)and “root” respectively.• A “CCh” error completion code will be returned if a user attempts to modify thesenames.2. User 2 (“root”) will always have the administrator privilege level.• A “CCh” error completion code will be returned if a user attempts to modify this value.• Trying to set any parameter for User ID 2 (root user) with the Set User Accesscommand will fail with a CCh completion code.3. All user passwords (including passwords for 1 and 2) may be modified.4. User IDs 3-15 may be used freely, with the condition that user names are unique.Therefore, no other users can be named “” (Null), “root,” or any other existing user name.5. IPMIMessaging flag in Set User access command is used to restrict the user for establishthe IPMI1.5 session and IPMI 2 session per channel. IPMIMessaging flag should be enabledfor establishing the SOL session.56Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” ” Integrated Baseboard Management Controller EPS 錯 誤 ! 尚 未 定 義 樣 式 。Re-setting a user name to a value equivalent to its current value will result in a 0xCC error code.A list of default user values is given in Table 26.Table 26. Default User ValuesUsersUser namePasswordStatusDefault PrivilegeCharacteristicsUser 1 [Null] [Null] Disabled AdminUser 2 root superuser Disabled AdminUser 3 test1 superuser Disabled AdminUser 4 test2 superuser Disabled AdminUser 5 test3 superuser Disabled AdminUser 6-15 undefined undefined Disabled AdminPassword can bechanged.This user may not beused to access theembedded webserver.Password can bechangedUser name &password can bechangedUser name &password can bechangedUser name &password can bechangedUser name &password can bechanged4.3 SessionsMaximum/Minimum session support varies by interface type:IPMI Over LAN – Minimum of four sessions.Embedded Webserver (when advanced features are enabled) – Minimum of four sessions.Media Redirection – Minimum of two sessions.KVM – Minimum of two sessions.Serial Channel – One session.Revision 1.1Intel ® Confidential 57

錯 誤 ! 尚 未 定 義 樣 式 。Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSThe maximum number of sessions on a channel is not specific and is dependent on thefollowing:1. IPMI Specification.2. User Configuration (Set by the command SetUserAccess).3. Total Session Slots. (Hard-coded in the FW).4. Per channel Session limit imposed. (Hardcoded in the FW Configuration).5. (Dynamically dependent on) FW resource constraints.For example, on Serial Channel the Maximum sessions per channel is limited by the IPMIspecification (=1). This value is hardcoded in the FW and maintained as a non-read/writeconfiguration parameter (bullet 4). Where the Maximum is not defined by the specification, thehard-coded per channel value is still maintained in the FW. For Instance, the hard-coded value(bullet 4) for each of the LAN channels is 15.But, ∑ (per channel session limit) (bullet 4) > (total session slots) (bullet 3); this is done so thatthe available slots can be used optimally. Even then, the user might not be able to open theMaximum # sessions per channel on a particular channel. The Maximum per channel sessionlimit is used only to maintain fairness in session usage across the Channels. TheGetSessionInfo() command will return the hard-coded (see bullet 3) value of the total MAXsession slots available.The SetUserAccess() Command can be used to limit the number of concurrent sessions openper user. This user configured value together with the internal hard-coded per channel sessionlimits (bullet 4) might sometimes not allow the usage of all session slots. Finally (bullet 5) furtherresource constraints might not allow the full utilization of the session slots, in those cases theFW might dynamically reduce the number of slots available.On Emerald Ridge platform, maximum no of IPMI over LAN sessions are configured as 16 (parLAN channel) and to ensure web server availability, 4 session slots are reserved for EmbeddedWeb Server. Total no of possible sessions at any point of time are 36.4.4 Media BridgingThe BMC supports bridging between the LAN and IPMB interfaces. This allows the state ofother intelligent controllers in the chassis to be queried by remote console software. Requestsmay be directed to controllers on the IPMB, but requests originating on the IPMB cannot bedirected to the LAN interface unless the request is originated by the ME on the secondary IPMB.Available bridging combinations:KCS to IPMB (Primary)KCS to IPMB (Secondary)LAN to IPMB (Primary)LAN to IPMB (Secondary)IPMB (Secondary) to LAN58Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” ” Integrated Baseboard Management Controller EPS 錯 誤 ! 尚 未 定 義 樣 式 。4.5 Request / Response ProtocolThe protocols are request / response protocols. A request message is issued to an intelligentdevice. The intelligent device responds with a response message. For example, with respect tothe IPMB interface, both request messages and response messages are transmitted on the bususing I 2 C master write transfers. An intelligent device acting as an I 2 C master issues a requestmessage. This is received by an intelligent device as an I 2 C slave. The corresponding responsemessage is issued from the responding intelligent device as an I 2 C master, and is received bythe request originator as an I 2 C slave.4.6 Host to BMC Communication Interface4.6.1 LPC / KCS InterfaceThe BMC firmware supports two 8042 keyboard controller style (KCS) interface ports asdescribed in the Intelligent Platform Management Interface Specification Second Generationv2.0. These interfaces are mapped into the host I/O space and accessed via the chipset LPCbus. These interfaces are assigned with the following uses and addresses:Table 27. Keyboard Controller Style InterfacesNameUseAddressSMS Interface SMS, BIOS POST, and utility access 0CA2h – 0CA3hSMM Interface SMI handling for error logging 0CA4h – 0CA5hThe BMC gives higher priority to transfers occurring through the server management mode(SMM) interface. This provides minimum latency during SMI accesses. The BMC acts as abridge between the server management software (SMS) and the IPMB interfaces. Interfaceregisters provide a mechanism for communications between the BMC and the host system.Most platforms implement the interfaces as host I/O space mapped registers. The interfacesconsist of three sets of two 1-byte-wide registers.4.6.2 Receive Message QueueThe receive message queue is only accessible via the SMS interface since that interface is theBMC’s host / system interface. The queue is two entries in size. Per-channel queue slots are notprovided.Revision 1.1Intel ® Confidential 59

錯 誤 ! 尚 未 定 義 樣 式 。Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPS4.6.3 SMS / SMM Status RegisterBits in the status register provide interface and protocol state information. As an extension to theIPMI 2.0 KCS interface definition, the OEM1 and OEM2 bits in the SMS and SMM interfaceshave been defined to provide BMC status information. Table 28 summarizes the functions of thestatus register bits. Read/write is from the perspective of the host interface. All status registerbits are read-only to the host.BitName7 S16 S05 BMC State1 (OEM2)4 BMC State0 (OEM1)Table 28. SMS / SMM Status Register BitsDescriptionBits 7 and 6 indicate the current state of this KCS interface. The host software examinesthese bits to verify that they are in sync with the BMC. For more information on these bits,refer to the Intelligent Platform Management Interface Specification Second Generationv2.0.These bits provide a status indication of BMC health:00b – BMC ready01b – BMC hardware error (i.e., BMC memory test error)10b – BMC firmware checksum error11b – BMC is not ready3 C/D# Bit 3 specifies whether the last write was to the command register or the Data_In register(1=command, 0=data). It is set by hardware to indicate whether last write from the hostwas to command or Data_In register.2 SMS_ATN /SMM_ATNWhen the status register is used for an SMS interface, the SMS_ATN bit indicates thatthe BMC has a message for the SMS.When the status register is used for an SMM interface, the SMM_ATN bit indicates thatthe BMC has a message for the SMI handler.Set this bit to 1 when the BMC has a message for the SMS / SMI handler.See Sub-sections 4.6.4 and 4.6.5 for more details on these flag bits.1 IBF Input buffer is full. Set this bit to 1 when either the associated command or Data_Inregister has been written by system-side software. Cleared to 0 by the BMC reading thedata register.0 OBF Output buffer is full. Set this bit to 1 when the associated Data_Out register is written bythe BMC. Cleared to 0 by the host reading the data register.Note: When the BMC is reset from either a power-on or a hard reset, the protocol state bits(S0,S1) are initialized to 11b–Error State and the BMC state bits (BMC State 0/1) are initializedto 00b – BMC Ready. This allows host software to detect that the BMC has been reset and thatthe BMC has terminated any in-process messages.The BMC state bits are set to 11b – BMC not ready if the BMC is busy; such as during SEL orSDR erasure or while the Initialization Agent is running.4.6.4 Server Management Software (SMS) InterfaceThe SMS interface is the BMC host interface. The BMC implements the SMS KCS interface asdescribed in the Intelligent Platform Management Interface Specification Second Generationv2.0. The BMC implements the optional Get Status / Abort transaction on this interface. Onlylogical unit number (LUN) 0 is supported on this interface. The status register OEM1/2 bits arecovered in Section 4.6.3.60Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” ” Integrated Baseboard Management Controller EPS 錯 誤 ! 尚 未 定 義 樣 式 。With the Set BMC Global Enables command, the BMC can generate an interrupt requestingattention when setting the SMS_ATN bit in the status register.The SMS_ATN bit that is set indicates one or more of the following:There is at least one message in the BMC receive message queueAn event is in the event message buffer- Watchdog pre-timeout interrupt flag has been setAll conditions must be cleared and all BMC to SMS messages must be flushed for theSMS_ATN bit to be cleared.The host I/O address of the SMS interface is 0CA2h – 0CA3h.The operation of the SMS interface is described in the Intelligent Platform ManagementInterface Specification. See the chapter titled, “Keyboard Controller Style (KCS) Interface.”4.6.4.1 Canceling In-progress CommandsSoftware can cancel an in-progress transaction by issuing a new WRITE_START command tothe interface. However, there are cases where the BMC has accepted the command andqueued it up for execution. In these cases, the commands are executed even if the transactionhas been canceled.Since the SMS interface is single-threaded, the BMC does not accept a new command until thecurrent, canceled-in-progress command has completed execution. Until then, any newcommand sent via the SMS interface is responded to with a NODE_BUSY completion code.When the current, canceled-in-progress command is complete, the BMC discards the responseand the SMS interface accepts commands for execution.4.6.5 SMM InterfaceThe SMM interface is a KCS interface that is used by the BIOS when interface response time isa concern, for example with the BIOS SMI handler. The BMC gives this interface priority overother communication interfaces. The BMC has limits on how many back-to-back transactions itcan handle without loss in responsiveness. It must be able to handle up to 30 back-to-backcommands from the BIOS.The BMC implements the optional Get Status / Abort transaction on this interface. Only LUN 1 issupported on this interface. In addition, the status register OEM1/2 bits are defined as specifiedin Section 4.6.3.The event message buffer is shared across SMS and SMM interfaces.The host I/O address of the SMM interface is 0CA4h – 0CA5h.4.7 IPMB Communication InterfaceThe IPMB communication interface uses the 100 KB/s version of an I 2 C bus as its physicalmedium. For more information on I 2 C specifications, see The I 2 C Bus and How to Use It. TheIPMB implementation in the BMC is compliant with the IPMB v1.0, revision 1.0.Revision 1.1Intel ® Confidential 61

錯 誤 ! 尚 未 定 義 樣 式 。Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSThe BMC IPMB slave address is 20h.The BMC both sends and receives IPMB messages over the IPMB interface. Non-IPMBmessages received via the IPMB interface are discarded.Messages sent by the BMC can either be originated by the BMC, such as initialization agentoperation, or by another source. One example is KCS-IPMB bridging.For IPMB request messages originated by the BMC, the BMC implements a response timeoutinterval of 60 ms and a retry count of 3.4.7.1 BMC as I 2 C Master Controller on IPMBThe BMC allows access to devices on the IPMB as an I 2 C master. The following commands aresupported:Send Message: This command writes data to an I 2 C device as master.Master Write-Read: This command allows the following actions:- Writing data to an I2C device as a master.- Reading data from an I2C device as a master.- Writing data to I2C device as a master, issue an I2C Repeated Start, and reading aspecified number of bytes from I2C device as a master. Errors in I2C transmission orreception are communicated via completion codes in the command response.These functions support the most common operations for an I 2 C master controller. This includesaccess to common non-intelligent I 2 C devices like SEEPROMs. The Send Message commandis used to send IPMB messages to intelligent devices that use the IPMB protocol.4.7.2 IPMB LUN RoutingThe BMC can receive either request or response IPMB messages. The treatment of thesemessages depends on the destination logical unit number (LUN) in the IPMB message. ForIPMB request messages, the destination LUN is the responder’s LUN. For IPMB responsemessages, the destination LUN is the requester’s LUN. The disposition of these messages isdescribed in Table 29. The BMC accepts LUN 00b and LUN 10b.IPMB messages can be up to 36 bytes, including IPMB header and checksums.Table 29. BMC IPMB LUN RoutingLUNNameMessage Disposition00b BMC Request messages with this LUN are:Passed to the BMC command handler for execution.Compared with outstanding BMC originated requests. If there is a match, the BMC sub-systemthat sent the request is notified. Otherwise the message is discarded.01b Reserved Messages arriving with this LUN are discarded.10b SMS All messages arriving with this destination LUN are placed in the Receive Message Queue. Ifthat buffer is full, the message is discarded. No further action is completed.11b Reserved Messages arriving with this LUN are discarded.62Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” ” Integrated Baseboard Management Controller EPS 錯 誤 ! 尚 未 定 義 樣 式 。4.7.3 Management Engine IPMBThe BMC supports an additional IPMB-style interface for Management Engine (ME)communications. Although this bus supports IPMB and IPMI protocols, it is a private bus.Figure 7. BMC IPMB Message Reception4.8 IPMI Serial FeatureThe IPMI 2.0 Intel implementation of IPMI-over-serial was known as the emergencymanagement port (EMP) interface before IPMI 1.0. The EMP nomenclature is no longer used.The BMC only supports terminal mode – direct connect on the serial interface.The primary goal of providing an out-of-band RS-232 connection is to give systemadministrators the ability to access low-level server management firmware functions by usingcommonly available tools. To make it easy to use and to provide high-compatibility with LANand IPMB protocols, this protocol design adopts some features of both the LAN and IPMBprotocols.Revision 1.1Intel ® Confidential 63

錯 誤 ! 尚 未 定 義 樣 式 。Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSThe implementation shares serial function with the platform’s COM1 interface. The BMC hascontrol over which agent (BMC or System) has access to COM1. Hardware handshaking issupported as are the Ring Indicate and Data Carrier Detect signals.See the Intelligent Platform Management Interface Specification Second Generation v2.0.4.8.1 COM Port SwitchingThe integrated SIO is used for Com port sharing. It has two legacy UARTs and a MUX switchingarrangement that permits the BMC to monitor and intercept the serial traffic on serial port 1(COM1). Note that COM2 is not a supported interface for serial over LAN.If IPMI-over-serial is enabled, then the BMC watches the serial traffic on COM1. This is done torespond to in-band port switching requests.4.8.2 Terminal ModeThe BMC supports terminal mode, as specified in the Intelligent Platform Management InterfaceSpecification Second Generation v2.0. Terminal mode provides a printable ASCII text-basedway to deliver IPMI messages to the BMC over the serial channel or any packet-based interface.Messages can be delivered in two forms:Via hex-ASCII pair encoded IPMI commandsVia text SYS commandsThe terminal mode interface supports a maximum IPMI message length of 40 bytes. The linecontinuation character is supported over the serial channel in terminal mode only. The linecontinuation character is supported for both hex-ASCII and text commands.4.8.2.1 Input Restrictions4.8.2.1.1 Maximum Input LengthThe BMC supports up to 122 characters per line. The BMC stops accepting new characters andstops echoing input when the 122-character limit is reached. However, the , / , illegal, and input newline characters continue to be accepted andhandled after the character limit is reached.4.8.2.1.2 Maximum IPMI Message LengthThe terminal mode interface supports a maximum IPMI message length of 40 bytes.4.8.2.1.3 Line Continuation CharacterThe line continuation character is supported over the serial channel in terminal mode only. Theline continuation character is supported for both hex-ASCII and text commands.4.8.2.2 Command Support4.8.2.2.1 Text CommandsThe BMC supports all the text commands described in the Intelligent Platform ManagementInterface Specification Second Generation v2.0.64Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” ” Integrated Baseboard Management Controller EPS 錯 誤 ! 尚 未 定 義 樣 式 。4.8.2.2.2 Hex-ASCII CommandsThe BMC supports the IPMI binary commands specified in this document.The BMC supports the privilege level scheme for terminal mode text commands as specified inTable 554.8.2.3 BridgingThe BMC supports the optional bridging functionality described in the Intelligent PlatformManagement Interface Specification Second Generation v2.0.4.8.2.4 Invalid PasswordsIf three successive invalid Activate Session commands are received on the EMP interface, theBMC delays 30 seconds before accepting another Activate Session command.4.9 LAN InterfaceThe BMC implements both the IPMI 1.5 and IPMI 2.0 messaging models. These provide out-ofbandlocal area network (LAN) communication between the BMC and the network.See the Intelligent Platform Management Interface Specification Second Generation v2.0 fordetails about the IPMI-over-LAN protocol.Run-time determination of LAN channel capabilities can be determined both by standard IPMIdefined mechanisms.4.9.1 IPMI 1.5 MessagingThe communication protocol packet format consists of IPMI requests and responsesencapsulated in an IPMI session wrapper for authentication, and wrapped in an RMCP packet,which is wrapped in an IP/UDP packet. Although authentication is provided, no encryption isprovided, so administrating some settings, such as user passwords, through this interface is notadvised.Session establishment commands are IPMI commands that do not require authentication or anassociated session.The BMC supports the following authentication types over the LAN interface.None (no authentication)Straight password / keyMD54.9.2 IPMI 2.0 MessagingIPMI 2.0 messaging is built over RMCP+ and has a different session establishment protocol.The session commands are defined by RMCP+ and implemented at the RMCP+ level, not IPMIcommands. Authentication is implemented at the RMCP+ level. RMCP+ provides link payloadencryption, so it is possible to communicate private / sensitive data (confidentiality).The BMC supports the following cipher suites:Revision 1.1Intel ® Confidential 65

錯 誤 ! 尚 未 定 義 樣 式 。Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSTable 30. Supported RMCP+ Cipher SuitesIDAuthentication AlgorithmIntegrity Algorithm(s)Confidentiality Algorithm(s)0 1 RAKP-none None None1 RAKP-HMAC-SHA1 None None2 RAKP-HMAC-SHA1 HMAC-SHA1-96 None3 RAKP-HMAC-SHA1 HMAC-SHA1-96 AES-CBC-1286 RAKP-HMAC-MD5 None None7 RAKP-HMAC-MD5 HMAC-MD5-128 None8 RAKP-HMAC-MD5 HMAC-MD5-128 AES-CBC-12811 RAKP-HMAC-MD5 MD5-128 None12 RAKP-HMAC-MD5 MD5-128 AES-CBC-128Note:1. Cipher suite 0 defaults to callback privilege for security purposes. This may be changed by any administrator.For user authentication, the BMC can be configured with ‘null’ user names, whereby password /key lookup is done based on ‘privilege level only’, or with non-null user names, where the keylookup for the session is determined by user name.IPMI 2.0 messaging introduces payload types and payload IDs to allow data types other thanIPMI commands to be transferred. IPMI 2.0 serial-over-LAN is implemented as a payload type.Table 31. Supported RMCP+ Payload TypesPayload TypeFeatureIANA00h IPMI message N/A01h Serial-over-LAN N/A02h OEM explicit Intel (343)10h – 15h Session setup N/A4.9.3 RMCP / ASF MessagingThe BMC supports RMCP ping discovery in which the BMC responds with a pong message toan RMCP / ASF ping request. This is implemented per the Intelligent Platform ManagementInterface Specification Second Generation v2.0.4.9.4 BMC Embedded LAN ChannelsBMC hardware includes two dedicated 10/100 network interfaces,Interface 1: This interface is available from either of available NIC ports in system which can beshared with the host. Only one NIC may be enabled for management traffic at any time. Tochange the NIC enabled for management traffic, please use the “Write LAN Channel Port” OEMIPMI command. For more details on this command, please see Table 56.Interface 2: This interface is available from RMM3 which is dedicated management NIC and notshared with host.For these channels, support can be enabled for IPMI-over-LAN and DHCP.66Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” ” Integrated Baseboard Management Controller EPS 錯 誤 ! 尚 未 定 義 樣 式 。For security reasons, embedded LAN channels have the following default settings:IP Address: StaticAll users disabledIPMI-enabled network interfaces may not be placed on the same subnet. This includes the IntelRMM3’s onboard network interface, and either of the BMC’s embedded network interfaces.Host-BMC communication over the same physical LAN connection – also known as“loopback” – is not supported. This includes “ping” operations.4.9.5 BMC IP Address ConfigurationEnabling the BMC’s network interfaces requires using the Set LAN Configuration Parametercommand to configure LAN configuration parameter 4, IP Address Source. BMC supports thisparameter as follows:1h, static address (manually configured): Supported on all management NICs. This is theBMC’s default value.2h, address obtained by BMC running DHCP: Supported only on embedded managementNICs.IP Address Source value 4h, address obtained by BMC running other address assignmentprotocol, is not supported on any management NIC.Attempting to set an unsupported IP address source value has no effect, and the BMC returnserror code 0xCC, Invalid data field in request. Note that values 0h and 3h are no longersupported, and will return a 0xCC error completion code.4.9.5.1 Static IP Address (IP Address Source Values 0h, 1h, and 3h)The BMC supports static IP address assignment on all of its management NICs. The IP addresssource parameter must be set to “static” before the IP address, the subnet mask or gatewayaddress can be manually set.The BMC takes no special action when one of the following IP address sources is specified asthe IP address source for any management NIC:1h – Static address (manually configured)Therefore, any of these settings is equivalent to a static IP address configuration. The Set LANConfiguration Parameter command must be used to configure LAN configuration parameter 3,IP Address, with an appropriate value.The BIOS does not monitor the value of this parameter, and it does not execute DHCP for theBMC under any circumstances, regardless of the BMC configuration.4.9.5.1.1 Static LAN Configuration ParametersWhen the IP Address Configuration parameter is set to 01h (static), the following parametersmay be changed by the user:LAN configuration parameter 3 (IP Address)Revision 1.1Intel ® Confidential 67

錯 誤 ! 尚 未 定 義 樣 式 。Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSLAN configuration parameter 6 (Subnet Mask)LAN configuration parameter 12 (Default Gateway Address)When changing from DHCP to Static configuration, the initial values of these three parameterswill be equivalent to the existing DHCP-set parameters. Additionally, the BMC will observe thefollowing network safety precautions:1. The user may only set a subnet mask that is valid, per IPv4 and RFC 950 (InternetStandard Subnetting Procedure). Invalid subnet values will return a 0xCC (Invalid DataField in Request) completion code, and the subnet mask will not be set. If no valid maskhas been previously set, default subnet mask is 0.0.0.0.2. The user may only set a default gateway address that could potentially exist within thesubnet specified above. Default gateway addresses outside the BMC’s subnet aretechnically unreachable, and the BMC will not set the default gateway address to anunreachable value. The BMC will return a 0xCC (Invalid Data Field in Request)completion code for default gateway addresses outside its subnet.3. If a command is issued to set the default gateway IP address before the BMC’s IPaddress and subnet mask are set, the default gateway IP address will not be updated,and the bmc will return 0xCC.If the BMC’s IP address on a LAN channel changes while a LAN session is in progress over thatchannel, the BMC does not take action to close the session except through a normal sessiontimeout. The remote client must re-sync with the new IP address. The BMC’s new IP addresswill only be available in-band, through the “Get LAN Configuration Parameters” command.4.9.5.2 Enabling / Disabling Dynamic Host Configuration (DHCP) ProtocolThe BMC DHCP feature is activated by using the Set LAN Configuration Parameter commandto set LAN configuration parameter 4, IP Address Source, to 2h: “address obtained by BMCrunning DHCP.” Once this parameter is set, the BMC initiates the DHCP process withinapproximately 100 ms.If the BMC has previously been assigned an IP address through DHCP or the Set LANConfiguration Parameter command, it requests to be reassigned that same IP address. If theBMC does not receive the same IP address, system management software must bereconfigured to use the new IP address. The new address will only be available in-band,through the IPMI Get LAN Configuration Parameters command.Changing the IP Address Source parameter from 2h to any other supported value will cause theBMC to stop the DHCP process. The BMC uses the most recently obtained IP address until it isreconfigured.If the physical LAN connection is lost (i.e. the cable is unplugged), the BMC will not re-initiatethe DHCP process when the connection is reestablished.4.9.5.2.1 DHCP-related LAN Configuration ParametersUsers may not change the following LAN parameters while DHCP is enabled:68Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” ” Integrated Baseboard Management Controller EPS 錯 誤 ! 尚 未 定 義 樣 式 。LAN configuration parameter 3 (IP Address)LAN configuration parameter 6 (Subnet Mask)LAN configuration parameter 12 (Default Gateway Address)To prevent users from disrupting the BMC’s LAN configuration, the BMC treats theseparameters as read-only while DHCP is enabled for the associated LAN channel. Using the SetLAN Configuration Parameter command to attempt to change one of these parameters undersuch circumstances has no effect, and the BMC returns error code 0xD5, “Cannot ExecuteCommand. Command, or request parameter(s) are not supported in present state.”4.9.6 DHCP BMC HostnameThe BMC allows setting a DHCP Hostname using the Set/Get LAN Configuration Parameterscommand. For details on the parameter (199) bytes, please see Table 52.• DHCP Hostname can be set regardless of the IP Address source configured on the BMC.But this parameter will only be used if the IP Address source is set to DHCP.• When Byte 2 is set to “Update in progress”, all the 16 Block Data Bytes (Bytes 3 – 18)must be present in the request.• When Block Size < 16, it must be the last Block request in this series. In other wordsByte 2 is equal to “Update is complete” (1) on that request.• When ever Block Size < 16, the Block data bytes must end with a NULL Character orByte (=0).• All Block write requests are updated into a local Memory byte array. When Byte 2 is setto “Update is Complete”, the Local Memory is committed to the NV Storage. LocalMemory is reset to NULL after changes are committed.- When BYTE 1 (Block Selector = 1), FW will reset all the 64 bytes local memory. Thiscan be used to undo any changes after the last “Update in Progress”.- User should always set the hostname starting from block selector 1 after the last“Update is complete”. If the user skips block selector 1 while setting the hostname,the BMC will record the hostname as “NULL,” because the first block contains NULLdata.- This scheme effectively does not allow user to make a partial Hostname change. AnyHostname change needs to start from Block 1.• Byte 64 ( Block Selector 04h byte 16) is always ignored and set to NULL by BMC whicheffectively means we can set only 63 bytes.• User is responsible for keeping track of the Set series of commands and Local Memorycontents.While IBMC FW is in “Set Hostname in Progress” (Update not complete), the FW continuesusing the Previous Hostname for DHCP purposes.Revision 1.1Intel ® Confidential 69

錯 誤 ! 尚 未 定 義 樣 式 。Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPS4.9.7 Address Resolution Protocol (ARP)The BMC can receive and respond to ARP requests on BMC NICs; Gratuitous ARPs aresupported and disabled by default.4.9.8 Internet Control Message Protocol (ICMP)The BMC supports the following ICMP message types targeting the BMC over integrated NICs:Echo request (ping): The BMC sends an Echo Reply.Destination unreachable: If message is associated with an active socket connection withinthe BMC, the BMC closes the socket.4.9.9 Virtual Local Area Network (VLAN)Not supported4.9.10 Secure Shell (SSH)Secure Shell (SSH) connections are supported for SMASH-CLP sessions to the BMC.4.9.11 Serial-overover-LAN (SOL 2.0)The BMC supports IPMI 2.0 SOL.IPMI 2.0 introduced a standard serial-over-LAN feature. This is implemented as a standardpayload type (01h) over RMCP+.Three commands are implemented for SOL 2.0 configuration.“Get SOL 2.0 Configuration Parameters” and “Set SOL 2.0 Configuration Parameters”:These commands are used to get and set the values of the SOL configuration parameters.The parameters are implemented on a per-channel basis. See Table 62.“Activating SOL”: This command is not accepted by the BMC. It is sent by the BMC whenSOL is activated, to notify a remote client of the switch to SOL.Activating a SOL session requires an existing IPMI-over-LAN session. If encryption is used, itshould be negotiated when the IOL session is established. SOL sessions are only supported onserial port 1 (COM1).4.9.12 Platform Event Filter (PEF)The BMC includes the ability to generate a selectable action, such as a system power-off orreset, when a match occurs to one of a configurable set of events. This capability is calledPlatform Event Filtering, or PEF. One of the available PEF actions is to trigger the BMC to senda LAN alert to one or more destinations.The BMC supports 20 PEF filters. The first twelve entries in the PEF filter table arepreconfigured (but may be changed by the user). The remaining entries are left blank, and maybe configured by the user.70Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” ” Integrated Baseboard Management Controller EPS 錯 誤 ! 尚 未 定 義 樣 式 。Table 32. Factory Configured PEF Table Entries.Event FilterOffset MaskEventsNumber1 Non-critical, critical and non-recoverable Temperature sensor out of range2 Non-critical, critical and non-recoverable Voltage sensor out of range3 Non-critical, critical and non-recoverable Fan failure4 General chassis intrusion Chassis intrusion (security violation)5 Failure and predictive failure Power supply failure6 Uncorrectable ECC BIOS7 POST error BIOS: POST code error8 FRB2 Watchdog Timer expiration for FRB29 – Reserved (not preconfigured; reserved for future use)10 Power down, power cycle, and reset Watchdog timer11 OEM system boot event System restart (reboot)12 – Reserved (not preconfigured; reserved for future use)Additionally, the BMC supports the following PEF actions:• Power off• Power cycle• Reset• OEM action• AlertsThe “Diagnostic interrupt” action is not supported.4.9.13 LAN AlertingThe BMC supports sending embedded LAN alerts, called SNMP PET (Platform Event traps), aswell as SMTP email alerts.LAN Alert via Backup Gateway is not supported.The BMC supports a minimum of four LAN alert destinations.4.9.13.1 SNMP Platform Event Traps (PETs)This feature enables a target system to send SNMP traps to a designated IP address via LAN.These alerts are formatted per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0. A MIB file associated with the traps is provided with the BMC FW tofacilitate interpretation of the traps by external SW.The format of the MIB file is covered under RFC 2578.4.9.14 Alert Policy TableAssociated with each PEF entry is an alert policy that determines which IPMI channel the alertis to be sent. There is a maximum of 120 alert policy entries. There are no pre-configuredentries in the alert policy table because the destination types and alerts may vary by user. Eachentry in the alert policy table contains 4 bytes for a maximum table size of 80 bytes.Revision 1.1Intel ® Confidential 71

錯 誤 ! 尚 未 定 義 樣 式 。Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPS4.9.14.1 E-mail AlertingThe Embedded Email Alerting feature allows the user to receive e-mails alerts indicating issueswith the server. This allows e-mail alerting in an OS-absent (e.g., Pre-OS and OS-Hung)situation. This feature provides support for sending e-mail via SMTP, the Simple Mail TransportProtocol as defined in Internet RC 821. The e-mail alert provides a text string that describes asimple description of the event. SMTP alerting is configured using the embedded web server.Please see Table 64 for SMTP configuration OEM IPMI commands.Please see “LDAP: The Protocol [RFC4511]”for more information on LDAP.72Intel ConfidentialRevision1.1

Intel® Server System "Emerald Ridge” ” Integrated Baseboard Management Controller EPS 錯 誤 ! 尚 未 定 義 樣 式 。5. BMC Flash Update5.1 Logical Firmware Image BlocksThe BMC firmware is divided into four main functional blocks: Boot Block: Small firmware image containing a bootloader and cursory hardwareinitialization. It allows re-download of the operational code if it somehow becomes corrupted.Operational Code: The main runtime firmware. This includes the embedded Linux kernel,and all applications.Platform Information Area (PIA): Contains all the read/write configuration/status data usedby the Operational Code. This includes IPMI configuration, SEL, SDR, etc.Intel ® Remote Management Module 3 (Intel ® RMM3) (optional): Contains executables andread-only data needed by the advanced features. Resides on the Intel ® RMM3 Add-in cardflash.Firmware in any block may be updated individually. A normal update consists of updating theOperational Code and Intel ® RMM3, while preserving the contents of the PIA. In general, theboot block should not be updated on production systems.These blocks are mapped onto the following pieces of the Linux architecture: Boot Block: Uboot boot loader code. The Uboot environment variables data section is notmapped into any update block so it is never directly updated.Operation Code: Linux kernel and built-in drivers, and the Compressed ROM File system(CRAMFS) Root file system including all applications and loadable drivers. It includes theseparately built CRAMFS for the embedded web server, mounted as /usr/local/www.PIA: The Parameters section, a Journaling Flash Filesystem (JFF2) read/write flash filesystem that contains configuration and status files, mounted as /conf.Intel ® RMM3: An optional CRAMFS residing on the Intel ® RMM3 flash and mounted into theRoot file system when the Intel ® RMM3 is present as /usr/local/rmm3.Each block is preceded in the flash image by a Device Information Block (DIB) headeridentifying the type of block and what flash addresses it comprises. The update utilities use theDIBs to decide what ranges of flash need to be written to during an update.5.2 Firmware Transfer Mode UpdateThe BMC provides a Firmware Transfer mode that allows the BMC firmware to be updated.Data is sent to the BMC to be written into flash. Once complete, Firmware Transfer mode isexited and the BMC resets itself to resume normal operation. This mode is different from forceupdatemode.While in this mode only the firmware transfer commands are guaranteed to be supported, aswell as a few commands needed by the update process. Other commands may haveunpredictable results and should be avoided.The additional commands are:Revision 1.1Intel ® Confidential 73

BMC Flash UpdateIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSGet Device ID: Used to determine the current revision of the firmware, get the platform ID,and find out whether the BMC is in operational or update mode.Get Self Test Results: Used to see if the BMC has errors.Get Buffer Size: Used to indicate that larger KCS buffers are supported (at least 128 bytesverses the old 32 byte limit), for better KCS update performance.Get Advanced Support Configuration: Used to indicate if the Intel ® RMM3 card is present ornot. If present, it is normally updated when the Operational code is.Firmware Transfer mode is entered when the BMC receives the Enter Firmware Transfer Modecommand while in normal operational mode. While in this mode the BMC continues to functionwith the caveat that any writes to the PIA section do not go to flash but to a RAM shadow copy.This means that after the Exit Firmware Transfer Mode command is received and the BMCreturns to normal operation, any SEL, SDR, or IPMI configuration changes made while inFirmware Transfer mode will be lost.Firmware Transfer commands allow any area of the BMC flash to be updated. These functionsunderstand the sector structure of the flash device used on the server board, so the updateutility cannot issue sector erase commands. Instead flash sectors are implicitly erased asnecessary before the first write to a sector.After the Exit Firmware Transfer Mode command is successfully completed, the BMC resets,and the new image runs immediately after the bootloader boots the BMC. If there is a problembooting the new image, such as an invalid checksum, the BMC stays in the boot block. Formore information refer to the Boot Recovery mode section.No system events are logged when the BMC enters or exits firmware transfer mode.5.2.1 Command Support during Firmware Transfer ModeThe following commands are supported while the BMC is in forced-firmware update mode. Seesection 5.3 for more information on this mode.Table 33. Firmware Update Mode CommandsIPMI NetFunctionCommand NumberCommand NameApplication (06h) 01h Get Device IDApplication (06h) 04h Get Self Test ResultsApplication (06h) 37h Get System GUIDFirmware (08h) 00h Enter Firmware Transfer ModeFirmware (08h) 01h Firmware ProgramFirmware (08h) 02h Firmware ReadFirmware (08h) 03h Get Firmware Range ChecksumFirmware (08h) 04h Exit Firmware Transfer ModeFirmware (08h) 05h Set Program SegmentStorage (0Ah) 10h Get FRU Area InfoIntel General (30h) 66h Get Buffer SizeIntel General (30h) 71h Get Advanced Support Configuration74Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” ” Integrated Baseboard Management Controller EPS 錯 誤 ! 尚 未 定 義 樣 式 。During a standard firmware update, the BMC will respond normally to all IPMI commands.However, the BMC will not respond to commands for the 15 seconds after exiting firmwareupdate mode (either normal or force-update) while it reboots.5.3 Boot Recovery ModeThe BMC’s boot block (Uboot) also supports firmware transfer updates. It uses the samecommands as the operational Firmware Transfer mode, but writes directly to the flash.Operational Firmware Transfer mode preserves several of the files in the PIA Linux file system.Boot Recovery mode cannot preserve the files because it does not understand Linux filesystems, and treats it as a large binary data section. This means a Boot Recovery updatecompletely replaces the PIA with the factory default version: an empty SEL, a default SDR, anddefault IPMI configuration and user settings.Boot Recovery mode can successfully complete an update in some situations where theOperational Firmware Transfer mode will fail. If there is an incompatibility or bug in theoperational code causing it to crash or hang; only a Boot Recovery Mode Update will work.Another example is if the flash layout of the sections changes across an update. Since, theoperational Firmware Transfer mode tries to preserve the contents of the PIA section; in thiscase it will corrupt the flash where the old PIA section was, because the Boot Recovery mode isblindly writing binary data to flash, in this case it will succeed.Note: The flash layout should never change in a field update.There are two ways to enter Boot Recovery mode:The Force Firmware Update jumper is asserted when A/C power is applied.The operational code is corrupt and the boot loader cannot boot.In Boot Recovery mode the BMC only responds to the small set of commands listed above.Only the KCS SMS interface is supported. USB-based Fast Firmware Update is not supported.5.4 Force Firmware Update JumperThe Force Firmware Update jumper can be used to put the BMC in Boot Recovery mode for alow level update. It causes the BMC to abort its normal boot process and stay in the boot loaderwithout executing any Linux code.The jumper is normally in the deasserted position. The system must be completely powered off(A/C power removed) before the jumper is moved. After power is re-applied and the firmwareupdate is complete, the system must be powered off again and the jumper returned to thedeasserted position before normal operation can begin.There is no boot block write protection jumper.Revision 1.1Intel ® Confidential 75

BMC Flash UpdateIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPS5.5 Restore Default ConfigurationThe BMC supports an OEM command, RestoreConfiguration, to restore all configuration valuesto their defaults. All IPMI configuration parameters and all Linux user configuration files (passwd,group, etc.) are restored.When the Restore Configuration command is implemented by the BMC, configuration files arecopied from a read-only default directory (/etc/defconfig) to a standard read-write location (/conf).The SDR and SEL are not restored to defaults by this command, so these two files arepreserved. Standard IPMI commands should be used to clear the SEL and SDR. The IPMIconfiguration file PMConfig.dat is special because it does not exist by default (in which case theBMC uses configuration values from an internal default array), so this file is deleted from /conf.The BMC switches to using RAM shadow copies of the files before copying them to flash,similar to an Operational Firmware Transfer mode update, so the BMC must be reset before itcan use the new values from flash. The reset is completed by the utilities (FWPIAUPD andSysCfg) and not by the BMC for historical reasons.5.6 Fast Firmware Update over USBThe BMC supports a Fast Firmware Update mode in addition to the standard KCS SMSinterface. This is a special AMI proprietary protocol that goes over the USB connection betweenthe host and the BMC. Called “IPMI over USB”, it is implemented in the LIBIPMI library on bothhost and BMC sides to transfer large blocks of data (up to 32 K) much faster than KCS can.Note that block transfer size is independent of USB or KCS interface. IPMI commands areembedded in data written/read to a virtual CD-ROM device. See AMI LIBIPMI documentation fordetails.Update utilities should try to use this method first. If a USB session cannot be established, theupdate utilities should use the standard slower KCS interface. If the BMC is in Boot Recoverymode, only KCS updates are supported.76Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSAdvanced ManagementFeature Support6. Advanced Management Feature SupportThis section explains the advanced management features supported by BMC firmware.6.1 Enabling Advanced Management FeaturesAdvanced management features will only be enabled by the BMC when it detects the presenceof the Intel ® Remote Management Module 3 (Intel ® RMM3) card. Without the Intel ® RMM3, theadvanced features will be dormant.6.1.1 Intel ® Remote Management Module 3 (Intel ® RMM3)The Intel ® RMM3 provides the BMC with an additional dedicated network interface. Thededicated interface will consume its own LAN channel. Additionally, the Intel ® RMM3 will provideadditional flash storage for advanced features like WS-MAN.6.2 Keyboard, Video, Mouse (KVM) RedirectionThe BMC firmware supports keyboard, video, and mouse redirection (KVM) over LAN. Thisfeature is available remotely from the embedded web server as a Java applet. This feature isonly enabled when the Intel ® RMM3 is present. The client system must have a Java RuntimeEnvironment (JRE) version 5.0 or later to run the KVM or media redirection applets.6.2.1 Keyboard and MouseThe keyboard and mouse are emulated by the BMC as USB human interface devices.6.2.2 VideoVideo output from the KVM subsystem is equivalent to the video output on the local console.Video redirection is available from the point video is initialized by the system BIOS. The KVMvideo resolutions and refresh rates will always match the values set in the operating system.6.2.3 AvailabilityUp to two remote KVM sessions are supported. An error will be displayed on the web browserattempting to launch more than two KVM sessions.The default inactivity timeout is 30 minutes, but may be changed through the embedded webserver. Remote KVM activation does not disable the local system keyboard, video, or mouse.Remote KVM is not deactivated by local system input, unless the feature is disabled locally.KVM sessions will persist across system reset, but not across an AC power loss.6.3 Media RedirectionThe embedded web server provides a Java applet to enable remote media redirection. This maybe used in conjunction with the remote KVM feature, or as a standalone applet.The media redirection feature is intended to allow system administrators or users to mount aremote IDE or USB CD-ROM, floppy drive or a USB flash disk as a remote device to the server.Once mounted, the remote device appears just like a local device to the server, allowing systemRevision 1.1Intel ® Confidential 77

Advanced ManagementFeature SupportIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSadministrators or users to install software (including operating systems), and copy files, updateBIOS, etc., or boot the server from this device.The following capabilities are supported: The operation of remotely mounted devices is independent of the local devices on theserver. Both remote and local devices are useable in parallelEither IDE (CD-ROM, floppy) or USB devices can be mounted as a remote device to theserver.It is possible to boot all supported operating systems from the remotely mounted device andto boot from disk IMAGE (*.IMG) and CD-ROM or DVD-ROM ISO files. Please see theTested/supported Operating System List for more information.It is possible to mount at least two devices concurrently.The mounted device is visible to (and useable by) managed system’s OS and BIOS in bothpre-boot and post-boot states.The mounted device shows up in the BIOS boot order and it is possible to change the BIOSboot order to boot from this remote device.It is possible to install an operating system on a bare metal server (no OS present) using theremotely mounted device. This may also require the use of KVM-r to configure the OSduring install.If either a virtual IDE or virtual floppy device is remotely attached during system boot, bothvirtual IDE and virtual floppy will be presented as bootable devices. It is not possible to presentonly a single mounted device type to the system BIOS.6.3.1 AvailabilityThe default inactivity timeout is 30 minutes and is not user-configurable.Media redirection sessions will persist across system reset, but not across an AC power loss.6.4 Web Services for Management (WS-MAN)The BMC firmware supports the Web Services for Management (WS-MAN) Specification,version 1.0.6.4.1 ProfilesThe BMC supports the following DMTF profiles for WS-MAN:Base Server ProfileFan ProfilePhysical Asset ProfilePower State Management ProfileProfile Registration ProfileRecord Log ProfileSensor ProfileSoftware Inventory Profile (FW Version)78Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSAdvanced ManagementFeature Support6.4.2 Embedded Web ServerThe BMC provides an embedded web server for out-of-band management. User authenticationis handled by IPMI user names and passwords. Base functionality for the embedded web serverincludes:Power Control: Control limited by IPMI user privilege for IPMI Chassis NetFunctioncommands.Sensor Reading: Access limited by IPMI user privilege for IPMI Sensor NetFunctioncommands.SEL Reading: Access limited by IPMI user privilege for IPMI Storage NetFunctioncommands.KVM/Media Redirection: Access limited by IPMI user privilege. Only available when theIntel ® RMM3 is present.IPMI User Management: Access limited by IPMI user privilege for IPMI ApplicationNetFunction commands.The web server is available on all enabled LAN channels. If a LAN channel is enabled, properlyconfigured, and accessible, the web server will be available.The web server may be contacted via HTTP or HTTPS. SSL certificates may be modified usingthe web server. The web server’s port (80/81) may not be changed.For security reasons, the null user (user 1) may not be used to access the web server. Theminimum length for setting user name and password through EWS is 4 and 8 respectively. Thesession inactivity timeout for the embedded web server is 30 minutes. This is not userconfigurable.6.4.2.1 Network Port UsageThe KVM and media redirection features use the following ports:• 5120 – CD Redirection• 5123 – FD Redirection• 5124 – CD Redirection (Secure)• 5127 – FD Redirection (Secure)• 7578 – Video Redirection• 7582 – Video Redirection (Secure)6.4.3 Local Directory Authentication Protocol (LDAP)The BMC firmware supports the Local Directory Authentication Protocol (LDAP) protocol foruser authentication. IPMI users/passwords and sessions are not supported over LDAP.LDAP usage may be configured through the embedded web server for authentication of futureembedded web sessions.Revision 1.1Intel ® Confidential 79

BMC-HSC InteractionsIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPS7. BMC-HSC Interactions7.1 HSC AvailabilityEmerald Ridge supports Hot-Swap Controller (HSC); the HSC is not available when the systemis in standby. The HSC requires at least three seconds after DC-power-on to reach a workingstate where it will respond to IPMI commands. The state of the HSC is not preserved acrosssystem reset or AC/DC cycle.When a single HSC is present in a system, it will respond on the primary IPMB at address C0h.When two HSCs are present, the “primary” HSC will respond at address C0h, and the“secondary” HSC will respond at address C2h.7.2 InteractionsAll HSC interaction is dependent on a properly formatted type 12 (management controller) SDRentry per HSC. Without a type 12 entry for the HSC, the BMC will not attempt any HSCcommunication with the exception of IPMI bridging commands.For each type 12 SDR found, the BMC will:Attempt to verify the presence of the HSC using an IPMI “Get Device ID” command. Thisoccurs when the system is DC powered-on or reset.If the HSC is not found, or is in firmware update mode, the BMC will suspendcommunication with the HSC. Communication will resume if the HSC exits firmware transfermode, or the system is reset (at which time, the HSC will be queried again).Send sensor initialization commands during the BMC’s IPMI initialization agent runtime. Theinitialization command sequence is described in the Intelligent Platform ManagementInterface Specification Second Generation v2.0.Sensor initialization data for the HSC is kept within the BMC’s SDR, and is distributed aspart of the BMC’s SDR package.Push the current power state to the HSC using the HSC supported OEM command, SetPower Supply State. This happens in 30 second intervals, unless there is an emergencypower state change.For Details on the Set Power Supply State command, please see the appropriate platformHot Swap Controller (HSC) EPS.Scan HSC disk status sensors at a 30 second interval, and cause the system status LED toindicate a fault condition if any of the disks are experiencing a fault.Disk fault detection is done by the host bus adapter, and is not controlled by the HSC orBMC. The HSC receives disk fault status through a separate management bus. The BMCmay only read disk fault status from the HSC.The BMC firmware will always bridge commands through the BMC to the HSC via the IPMB.This is supported by the IPMI command, Send Message. This command is used by systemsoftware to access the HSC status or to update the HSC firmware.80Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSBIOS-BMC BMC Interactions8. BIOS-BMC BMC InteractionsBIOS-BMC interactions include the following:FRB2 Operation.POST Complete Signaling – BIOS asserts the POST Complete signal at the end of POST.BMC firmware monitors this signal.Retrieval of Platform Information – BIOS may query firmware revisions for the BMC andattached satellite controllers. BIOS may also read FRU device locator records from the BMC,to determine the system’s inventory. Additionally, BIOS must use subsystem information topopulate SMBIOS tables.System GUID Information – BIOS must send system GUID to the BMC on boot.SEL – The BIOS may add entries to the BMC’s system event log.Power Restore Policy – BIOS may operate on the BMC’s power restore policy to supportBIOS setup functionality.ACPI – BIOS must notify the BMC of ACPI state changes.Front Panel Lockout – BIOS may operate on the BMC’s front-panel lockout to support BIOSsetup functionality.Serial Port Sharing – BIOS must interact with the BMC to share the serial port for systemuse.Serial Console Redirection – BIOS redirects serial output to the BMC, for LAN-based serialredirection.BMC Self Test/Health – BIOS may query the BMC for self test results.Clock Synchronization – BIOS must synchronize the BMC’s clock with the system clockusing the Set SEL Time IPMI command.BIOS-monitored sensors – BIOS must notify the BMC of system faults such as DIMMfailures using OEM IPMI commands. The BMC uses this information to control theassociated fault LEDs.BIOS must read the thermal profile data records from the BMC to determine appropriatethermal settings.BIOS may clear the SEL, per BIOS setup options.BIOS must bridge host information to the ME, through the BMC.BMC may interact with BIOS if a Set System Boot Options command requires altering theboot order.BIOS may query the BMC for board SKU and revision ID values.During Memory Hot Plug/Memory Online operation BIOS needs to send new DIMMpopulation order to BMC, Memory Hot Plug and Memory Offline/Online section for detail.Revision 1.1Intel ® Confidential 81

Node Management (NM)Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPS9. Node Management (NM)9.1 OverviewNode Management (NM) provides the system with a method of monitoring power consumptionand thermal output, and adjusting system variables to control those factors. As opposed tocomponent-level power/thermal solutions (such as Demand Based Switching), NodeManagement functions at the platform level.NM is only available on platforms that support PMBus-compliant power supplies. The BMCsupports NM specification version 1.5. Additionally, the platform chipset must have an NMcapableManagement Engine (ME). Emerald Ridge has two IOH components but only IOH #1has an active embedded Management Engine (ME).9.2 Command BridgingThe majority of BMC functionality to support the NM is handled by bridging commands andalerts. The ME participating in Node Management acts as a satellite controller on the BMC’ssecondary IPMB. The BMC does not own any platform event filters or traps for NM-relatedevents. These events should be configured in the NM by server management software.9.2.1 External Communications LinkThe BMC bridges commands between external software agents and the system’s ME usingstandard IPMI Send Message commands. If the user establishes a session using out of band,the minimum privilege level to bridge ME commands is Administrator. See the commandbridging section in the Intelligent Platform Management Interface Specification SecondGeneration v2.0 for more information.All NM-related IPMB transactions utilize the secondary IPMB. This is a private I 2 C bus 4 that isonly accessible by the BMC and ME.9.2.2 AlertingThe ME’s Node Manager may need to send alerts to external software agents. The NM usestwo different methods to send an alert. Each method is outlined below.9.2.2.1 Fault EventsAlerts that signify fault conditions and should be recorded in the system SEL will be sent to theBMC by the ME using the IPMI Platform Event Message command. The BMC deposits theseevents into the SEL. The external SW must configure the BMC’s PEF and alerting features tosend that event out as an IPMI LAN alert, directed to the SW application over the LAN link.9.2.2.2 Informational EventsAlerts that provide useful notification to the external SW for NPTM management but do notrepresent significant fault conditions and do not need to be entered in the SEL will be sent to theBMC using the IPMI Alert Immediate command. This requires that the external SW applicationprovide the NM on the ME with the alert destination and alert string information needed toproperly form and send the alert. The external SW must first properly configure the alert82Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSNode Management (NM)destination and string in the BMC LAN configuration using standard IPMI commands, thenprovide the associated selectors to the BMC using the Set Node Manager Alert DestinationOEM command.9.2.3 System Information Passed to ME and POST Complete NotificationBIOS will send the BMC the following information during POST. Number of supported P-statesNumber of supported T-statesPlatform Info (data from processor MSR 0CEh)TDP value per CPUWhen the BMC detects that POST has completed, the BMC passes on the BIOS-providedsystem information to the ME. As part of this command transaction to the ME, the BMC alsoprovides the total number of installed CPUs, the Icc_TDC value for each CPU (retrieved by theBMC via PECI), and a notification that POST has completed.At system startup the ME may query the BMC for the following information using IPMI OEMcommands: Inlet air temperature reading9.2.4 ACPI Mode NotificationThe BIOS notifies the BMC when the system enters and exits ACPI mode. The BMC, in turn,notifies the ME. The NM power-limiting functionality is only available when the system isoperating in ACPI mode (an ACPI-compliant OS is running).9.2.5 Persistence across BootsData passed to the ME will persist across boots, but will not persist across AC power loss.9.3 Management Engine (ME)9.3.1 OverviewIntel ® Server Platform Services (SPS) is a set of manageability services provided by thefirmware executing on an embedded ARC controller within the IOH. This management controlleris also commonly referred to as the Management Engine (ME). The functionality provided by theSPS firmware is different from Intel ® Active Management Technology (Intel ® AMT) provided bythe ME on client platforms.Server Platform Services are value-add platform management options that enhance the value ofIntel platforms and their component ingredients (CPUs, chipsets and I/O components). Eachservice is designed to function independently wherever possible, or grouped together with oneor more features in flexible combinations to allow OEMs to differentiate platforms.9.3.2 ME Firmware UpdateThe ME FW provides a set of IPMI OEM commands for performing the FW update. An updateutility running on the host uses IPMI bridging functionality to send these commands to the MEthrough the BMC over the BMC/IPMB link.Revision 1.1Intel ® Confidential 83

Node Management (NM)Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSOn Intel server platforms, the ME FW uses a single operational image with a recovery image. Inorder to upgrade an operational image a boot-to-recovery image must be performed. Therecovery image only provides the basic functionality that is required to perform the update;therefore other SPS features are not functional when the update is in progress.9.3.3 Management Engine InteractionThe ME is located on a private IPMB, at address 2Ch. See Table 6 for a list of I 2 C buses.9.3.3.1 POST InitializationDuring early POST, the BMC collects PECI data from the CPU (including I CC_TDC ). At the sametime, system BIOS gathers information about installed CPUs, including MSR readings,maximum power, minimum power, total P-states, and total T-states. Then BIOS must issue aSet Node Manager Platform Info IPMI command to the BMC. The BMC will take the information,add the additional CPU data, and issue a Set Host CPU Data IPMI command to the ME.Other ME-BMC interactions are listed below:BMC stores sensor data records for ME-owned sensorsBMC participates in ME firmware updateBMC initializes ME-owned sensors based on SDRsBMC receives platform event messages sent by the MEBMC notifies ME of POST completionBMC may be queried by the ME for inlet temperature readings84Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSIPMI Command Interface10. IPMI Command InterfaceThis chapter defines the requests (commands) that the BMC accepts, and the correspondingfunctionality and request / response data for these commands. These commands direct theBMC to perform actions. The commands are sent to the BMC from the IPMB, LPC, or LANinterfaces. For information on which interface supports which commands, see Table 67 throughTable 72.For the base specification and descriptions of BMC commands other than those specified in thischapter, see the Intelligent Platform Management Interface Specification.The BMC implements the event receiver, SEL, SDR, FRU, and sensor devices, as described inthe Intelligent Platform Management Interface Specification.10.1 Command QueuingThe BMC implements two command handlers:An interrupt-context handler for the SMM interface: The SMM interface command handleroperates in interrupt context to provide a fast command response time for commands issuedby the BIOS from within the BIOS SMI Handler. For SMM-supported commands that requiresignificant processing time, the SMM command handler returns a successful completioncode for the command so the SMI handler is not delayed, while passing the command to theregular queued command handler. The command is executed in thread context but noresponse is returned to the BIOS. Commands that can be executed within the interruptcontext of the SMM command handler can potentially execute in the middle of a commandexecution by the queued task-context handler.A queued task-context handler for all other interfaces: Commands placed in the queuedtask-context command handler are executed in a first-come, first-served, single-threadedfashion. Commands that may take extra time to execute, such as FRU access commands,delay other commands until they complete.10.2 Power On / Off Issues Related to CommandsAt the command interface level, the system power on / off status does not affect the validity ofcommands. The effectiveness of the command or the interpretation of its results sometimesmust be interpreted within the context of the server’s power state:A transition of server power from off to on is the equivalent of a system reset. Settings thatare not relevant with power-off are meaningless. For example, the global-enables settingcan be set with the power off. Global enable bits controlling actions that occur only when thepower is on are reset when the power is turned on. While it is possible to change these bitswhile the power is off, doing so has no effect. A similar example exists with most sensorthresholds and event enables, which are reset when system power is applied.Most sensors are not scanned when the system is powered off. While any sensor can beread, most of the values are from the last sensor reading before the server was powered off.Threshold or event message settings are lost when power is applied, but changing thesettings with the power off could result in event messages based on the frozen sensorRevision 1.1Intel ® Confidential 85

IPMI Command InterfaceIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSreading.When the system power is off, sensors that are enabled but not scanned have the sensorupdate in progress bit set in the response to Get Sensor Reading, Get Sensor Event Status, orGet Sensor Event Enable IPMI commands.10.3 BMC Command TablesThe tables on the following pages present the commands, requests, and responses that theBMC accepts from the IPMB, LPC, LAN, and Serial interfaces. Responses go out on theinterface on which the request was received.Table 34. BMC Intelligent Platform Management Interface (IPMI) CommandsNet Function = Application (06h), , LUN = 00CodeCommandRequest, Response DataDescription01h Get Device ID Per the Intelligent Platform-specific response fields:Platform Management• Byte 2 (device ID) – 21hInterface SpecificationSecond Generation • Byte 3 (device revision)v2.0• Byte 4 – Firmware revision 1Opcode firmware revision, major (binary) when Opcodefirmware is runningBoot firmware revision, major (binary) OR’ed with 0x80when Boot firmware is runningOpcode firmware revision, major (binary) OR’ed with0x80 when firmware transfer mode enteredfrom Opcode firmware.• Byte 5 – Firmware revision 2Opcode firmware revision, minor (BCD) when Opcodefirmware is running or when firmware transfermode is entered from Opcode firmwareBoot firmware revision, minor (BCD) when Bootfirmware is running.• Byte 6 (IPMI version) – 02h• Byte 7 (Additional device support)Bit 7 – Chassis deviceBit 6 – BridgeBit 5 – IPMB event generatorBit 4 – IPMB event receiverBit 3 – FRU inventory deviceBit 2 – SEL deviceBit 1 – SDR repository deviceBit 0 – Sensor device• Bytes 8:10 (manufacturer ID) – 343 (57h, 01h, 00h)• Bytes 11:12 (Emerald Ridge product ID, 40h,00h )• Bytes 13:16 (Op 109726tional auxiliary firmware revisioninformation)• Byte 13 – Boot firmware revision, major (binary)86Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSIPMI Command InterfaceCode01hCommandBroadcast GetDevice IDNet Function = Application (06h), , LUN = 00Request, Response DataDescription• Byte 14 – Boot firmware revision, minor (BCD)Per the IntelligentPlatform ManagementInterface SpecificationSecond Generationv2.002h Cold Reset Per the IntelligentPlatform ManagementInterface SpecificationSecond Generationv2.0• Byte 15 – PIA format revision, major• Byte 16 – PIA instance version, minor03h Warm Reset Not supported. Optional, not supported.04h05h06h07h08hGet Self TestResultsManufacturingTest OnSet ACPIPower StateGet ACPIPower StateGet DeviceGUIDPer the IntelligentPlatform ManagementInterface SpecificationSecond Generationv2.0Per the IntelligentPlatform ManagementInterface SpecificationSecond Generationv2.0Per the IntelligentPlatform ManagementInterface SpecificationSecond Generationv2.0Per the IntelligentPlatform ManagementInterface SpecificationSecond Generationv2.0Per the IntelligentPlatform ManagementInterface SpecificationSecond Generationv2.0See Section 3.32.Revision 1.1Intel ® Confidential 87

IPMI Command InterfaceIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSTable 35. BMC Watchdog Timer CommandsCode22h24h25hCommandResetWatchdogTimerSet WatchdogtimerGet WatchdogTimerNet Function = Application (06h), , LUN = 00Request, Response DataPer the Intelligent PlatformManagement InterfaceSpecification Second Generationv2.0Per the Intelligent PlatformManagement InterfaceSpecification Second Generationv2.0Per the Intelligent PlatformManagement InterfaceSpecification Second Generationv2.0DescriptionCode2Eh2Fh30h31h32hCommandSet BMCGlobal EnablesGet BMCGlobal EnablesClear MessageFlagsGet MessageFlagsEnableMessageChannelReceiveTable 36. BMC IPMI Messaging Support CommandsNet Function = Application (06h), , LUN = 00Request, Response DataDescriptionPer the Intelligent Platform OEM 2 enable bit is not supported.Management Interface OEM 1 enable bit is not supported.Specification SecondGeneration v2.0OEM 0 enable bit is not supported.Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.033h Get Message Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.034h Send Message Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.035hRead EventMessage BufferPer the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0The OEM enable bits are supported as in the Set BMCGlobal Enables command.The OEM 0 flag is not supported.The OEM 1 flag is used to indicate diagnostic interrupt(Front Panel NMI) button press.The OEM 2 flag is not supported.The OEM message flags are supported as in the ClearMessage Flags command.Message channels are always enabled.See Section 4.1See Section 4.188Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSIPMI Command InterfaceCode36h37h38h39h3Ah3BhCommandGet BTInterfaceCapabilitiesGet SystemGUIDGet ChannelAuthenticationCapabilitiesGet SessionChallengeActivateSessionSet SessionPrivilege LevelNet Function = Application (06h), , LUN = 00Request, Response DataNot implementedPer the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.03Ch Close Session Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.03DhGet SessionInfoPer the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.03Fh Get AuthCode Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.040h41h42h43hSet ChannelAccessGet ChannelAccessGet ChannelInfoSet UserAccessPer the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0DescriptionThe following authentication types are supported over theserial and LAN interfaces:• Straight password / key• MD5• NoneThis command is accepted over the LAN and Serial / PPPtransports.This command is accepted over the LAN and Serial / Basic,Serial / PPP transports.This command is accepted over the LAN and PPPtransports.This command is accepted over the host interface.Revision 1.1Intel ® Confidential 89

IPMI Command InterfaceIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSCode44h45h46h47h48h49h4Ah4Bh4Ch4Dh4Eh4Fh50h51hCommandGet UserAccessNet Function = Application (06h), , LUN = 00Request, Response DataPer the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Set User Name Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Get User Name Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Set UserPasswordActivatePayloadDeactivatePayloadGet PayloadActivationStatusGet PayloadInstance InfoSet UserPayloadAccessGet UserPayloadAccessGet ChannelPayloadSupportGet ChannelPayloadVersionGet ChannelOEM PayloadInfoUnassignedPer the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Description90Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSIPMI Command InterfaceCode52h54hCommandMaster Write-ReadGet ChannelCipher Suites55h Suspend /ResumePayloadEncryption56hSet ChannelSecurity KeysNet Function = Application (06h), , LUN = 00Request, Response DataDescriptionPer the Intelligent Platform The supported buses are public bus 0 (IPMB). See SectionManagement Interface 3.6 for private bus support information.Specification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Table 37. BMC Chassis CommandsCode00h01hCommandGet ChassisCapabilitiesGet ChassisStatusNet Function = Chassis (00h), , LUN = 00Request, Response DataPer the Intelligent Platform Management InterfaceSpecification Second Generation v2.0.Request: N/AResponse:Byte 1 – Completion codeByte 2 – Capabilities flags7:4 – Reserved3 – Provides Power Interlock status2 – Provides diagnostic interrupt (front panel NMI)control1 – Provides secure mode0 – Provides Intrusion statusByte 3 – Chassis FRU info IPMB addressByte 4 – Chassis SDR IPMB addressByte 5 – Chassis SEL IPMB addressByte 6 – Chassis SM IPMB addressByte 7 – Chassis bridge IPMB addressPer the Intelligent Platform Management InterfaceSpecification Second Generation v2.0DescriptionNote: Response byte 2 bit 3 (“powerfault”) is unsupported. Generalpower faults will be logged, but the“main power subsystem” asdescribed in the Intelligent PlatformManagement Interface SpecificationSecond Generation v2.0 documentcannot be differentiated from otherpower subsystems.Revision 1.1Intel ® Confidential 91

IPMI Command InterfaceIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSCode02h04h05h06h0Ah0Bh0FhCommandChassisControlChassisIdentifySet ChassisCapabilitiesSet PowerRestorePolicySet FrontPanel ButtonEnablesSet PowerCycleIntervalGet POHCounterNet Function = Chassis (00h), , LUN = 00Request, Response DataPer the Intelligent Platform Management InterfaceSpecification Second Generation v2.0Per the Intelligent Platform Management InterfaceSpecification Second Generation v2.0Per the Intelligent Platform Management InterfaceSpecification Second Generation v2.0Per the Intelligent Platform Management InterfaceSpecification Second Generation v2.0Per the Intelligent Platform Management InterfaceSpecification Second Generation v2.0Not supported.Per the Intelligent Platform Management InterfaceSpecification Second Generation v2.0DescriptionSupported control actions are:0h – Power down, forced S4 / S51h – Power up2h – Power cycle, forced /immediate3h – Hard reset, forced /immediate4h – Pulse diag int5h – Not supportedChassis Control command resultsare described in Table 37.The BMC implements the optionalduration parameter, as described inthe Intelligent Platform ManagementInterface Specification SecondGeneration v2.0.Also known as “Set Front PanelEnables”.Optional, not supported.Table 38. Chassis Control Command ResultsCommandPower DownPower UpPower CycleHard ResetPulseDiagnosticInterruptCurrent Power StateResultUpPowers down the serverDownNo change to system power stateUpNo change to system power stateDownPowers the server upUpServer powers down , then powers upDownNo change to system power stateUpBMC performs server resetDownNo actionUp The BMC performs the diagnostic interrupt operation (see Section 3.5.5.4)DownNo action92Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSIPMI Command InterfaceCode07h08h09hCommandGet System Restart CauseSet System Boot OptionsGet System Boot OptionsTable 39. Boot Control CommandsNet Function = Chassis (00h), , LUN = 00Request, Response DataPer the Intelligent Platform Management Interface Specification SecondGeneration v2.0. Includes support for the following restart sources: ChassisControl command, reset button, power button, watchdog timer, power stateretention (always restore), power state retention (restore previous state), andsoft reset.Per the Intelligent Platform Management Interface Specification SecondGeneration v2.0.Although the BMC may return a success completion code, functionality of anySystem Boot Options command depends on support in the system BIOS.Please see the appropriate system BIOS EPS for more information.Per the Intelligent Platform Management Interface Specification SecondGeneration v2.0.Although the BMC may return a success completion code, functionality of anySystem Boot Options command depends on support in the system BIOS.Please see the appropriate system BIOS EPS for more information.Table 40. Supported Boot Option ParametersParameter #(Dec)Set In Progress0Service Partition Selector1Service Partition Scan2BMC Boot Flag Clearing3Boot Info Acknowledge4Boot Flags5Boot Initiator Info6Boot Initiator Mailbox 7DescriptionPer the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Per the Intelligent PlatformManagement InterfaceSpecification SecondNoneNoneNoneNoneNoneNoneNoneSupport NotesMaximum of 5 blocks (80 bytes)supported. Will return 0xCC forrequests beyond 5 blocks.Revision 1.1Intel ® Confidential 93

IPMI Command InterfaceIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSParameter #(Dec)DescriptionGeneration v2.0Reserved for AMI use 96 Reserved ReservedOEM Parameter BlockSizeReserved for BIOSuse120121-127Please see definition inTable 41.Please see the appropriatesystem BIOS EPS for moreinormation on theseparameters.Read only.Reserved.Support NotesTable 41. OEM Parameter Block SizeOffsetNameLengthDescriptionHeader 00h Anchor String 4 BYTEs Signature string “_PB_” identifying OEM Parameter Block sizetable. The values for the four ASCII characters are 5F 50 42 5F.04h Checksum 1 BYTE Byte value to obtain zero checksum.05h Major Revision 1 BYTE The major revision number in BCD format. For this version ofthe specification the revision is 00h.06h Minor Revision 1 BYTE The minor revision in BCD format. For this version of thespecification the revision is 95h.07h Length 1 WORD Total length of the table in bytes; stored in little endian byteorder. The value is 16 for this revision table.09h Reserved 1 BYTE ReservedData 0Ah SystemInterface BlockSize1 BYTE Block size in bytes implemented over System interface(KCS/SMIC/BT) interface for access to Boot Option OEMparameters 121-127. Valid values are 16 to 128 bytes, othervalues are reserved. An even value recommended.0Bh Reserved 1 BYTE Reserved, must be zero0ChIPMB InterfaceBlock Size1 BYTE Block size in bytes implemented over the IPMB interface foraccess to Boot Option OEM parameters 121-127. Valid valuesare 16 to 20 bytes, other values are reserved. An even valuerecommended.0Dh Reserved 1 BYTE Reserved, must be zero0EhLAN InterfaceBlock Size1 BYTE Block size in bytes implemented over IPMI LAN (RMCP)interface for access to Boot Option OEM parameters 121-127.Valid values are 16 to 128 bytes, other values are reserved. Aneven value recommended.0Fh Reserved 1 BYTE Reserved, must be zeroTable 42. Boot Order Table DescriptionOffsetNameLengthDescriptionHeader 00h Anchor String 4 BYTES Signature string “_BO_” identifying Boot order table. Thevalues for the four ASCII characters are 5F 42 4F 5F.04h05hBOTChecksumBOT MajorRevisionBYTEBYTEByte value to obtain zero checksum.The revision in BCD number. For this version of thespecification the revision is 00h.94Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSIPMI Command InterfaceOffsetNameLengthDescription06hBOT MinorRevisionBYTEThe revision in BCD number. For this version of thespecification the revision is 95h.07h Length WORD Length of the Boot order table structure09h Reserved BYTE ReservedData 0Ah Update flag BYTE Flag to indicate Boot order has been updated.0BhBoot OrderinformationVariesBit 0 = 1 if BIOS has updatedBit 1 = 1 if Chassis manager have updated and requestednew boot order.Other bits are reserved.At all other times the BIOS retains the existing boot order.Boot order information has two parts – the Boot order datafollowed by the Boot device name and path data.Boot order data specifies the system boot order and thedevice order within a particular device type. Each boot orderdata starts with Order type and Order length and is followedby an ordered list of device numbers. Boot order data endswith End boot order type 0FFh and is followed by 00h orderlength.BootOrderData0Bh forfirstentry.VariesforfurtherentriesDevice name/data contains description names of devices anddevice specific hardware path to uniquely identify the bootdevices in a compute server.Order type BYTE This field specifies the type of order,00h = System Boot order. This type will specify the order inwhich each boot device type should attempt to boot. This is amandatory order when BOT is implemented.The order of devices within each device type is specified byfollowing the Order types. The order type definition includeslegacy and EFI boot devices. Legacy boot device orderswithin a particular device class are optional. When absent theBIOS will follow the default enumeration for that device class.Compute servers that support UEFI/EFI, must implement EFIboot order.01h = Floppy disk drive (FDD) order03h = CD/DVD drive order05h = USB removable media order06h = Network device order08h = Local Hard disk drive (HDD) order09h = External HDD order80h = BEV device order10h = EFI boot order that specify order of EFI boot targets0C0h to 0DFh = OEM device types that can be used for OEMspecific devices0FFh = End of boot order type, which marks the end of theboot order lists and must be followed by 00h to indicate zerolength orderOther boot order types are reserved.Revision 1.1Intel ® Confidential 95

IPMI Command InterfaceIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSOffsetNameLengthDescriptionVaries Order length BYTE The number of boot devices in a particular order list.VariesDevice orderlistOrderlengthThe ordered list of boot device types or boot devices.For System Boot order type, The Device list should containthe ordered list of device types. Each device type is a bytevalue and should be one of following device types: 01h =FDD; 08h = Local HDD; 03h = CD/DVD; 05h = USBremovable media; 06h = Network Device (PXE); 09h =external HDD; 80h = BEV; 10h = EFI Boot device.For legacy or OEM device order type, the Device list shallcontain ordered list of device numbers within particular devicetype. Each device number is a byte value and may have aname associated in Device name/path field.For EFI Boot order type, the Device list shall contain anordered list of EFI boot targets. Each boot target is a two bytenumber, as in an EFI BootOrder variable. The boot targetnumber associates the EFI boot device to Boot#### EFIvariable, where ‘####’ represent the boot target number. Eachboot target must have a device path in Device name/pathfield.Devicenameand Pathdata0Bh +SizeDeviceName/PathVariesThis field contains a device name (user readable description)and hardware path data for all devices in boot order data. Thename is optional for legacy and EFI boot devices, butmandatory for OEM devices. The device name/path datashould be used when boot devices are reported to the user.Each device name/path entry starts with a 3 byte device code.The first byte represents the order type that the device is partof, and the next 2 bytes represent the device number.For legacy devices and OEM devices, this field must use thefollowing format:Size in BytesType 1 Order typeNumber 2 Device numberName Varies Null terminated ASCIIstringFor EFI devices, this field also contains an EFI device path tothe boot target, which is mandatory. The device path mustcomply with the UEFI 2.0 specification. This field should havethe following format for EFI devices:Size in BytesType 1 Order type = 10hNumber 2 Device numberPath length 2 Size of the Devicepath in bytes.Name Varies Null terminatedUnicode string. Thestring is UTF-16encoding format asspecified in Unicode1.2 standard.96Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSIPMI Command InterfaceOffsetNameLengthDescriptionDevice path Path length EFI Device path ofparticular deviceThe total size of the device name/path field should be BOTsize less the rest of the data.Table 43. Slot Configuration TableOffsetNameLengthDescription00h Anchor String 4 BYTES Signature string “_SC_” identifying Slot Configuration Table(SCT). The values of the four ASCII characters are 5F 53 435F.04h SCT Checksum 1 BYTE Byte value to obtain zero checksum.05h06hSCT MajorRevisionSCT MinorRevision1 BYTE The revision in BCD number. For this version of thespecification, the revision is 00h.1 BYTE The minor revision in BCD number. For this version ofspecification revision is 90h.07h Length 1 WORD Length of the SCT table in bytes, which is 128 for this revisionof SCT. Stored in little endian byte order.09h Reserved 1 BYTE Reserved for OEM use.0Ah NIC IP 4 BYTES IP address that the blade’s NIC should use to establishconnection to the Chassis Manager.0Eh NIC Netmask 4 BYTES Netmask that the blade’s NIC should use to establishconnection to Chassis Manager.12h NIC Gateway 4 BYTES Gateway (if any) that the blade’s NIC should use to establishconnection to the Chassis Manager.16h Mgmt VLAN 1 WORD VLAN ID to use when communicating to Chassis Manager’sTFTP server. Stored in little endian byte order.18h Mgmt IP 4 BYTES IP address of the Chassis Manager to use when contactingChassis Manager’s TFTP server.1ChConfigurationScript Name48 BYTES Name with full path of slot startup script to be downloaded andexecuted. Zero padded.4Ch Chassis GUID 16 BYTES A unique identifier for the chassis in which the blade isinstalled.5ChConfigurationboot typeWORDBitmap of types of configuration boot valid.Bit 0 – Startup configurationBit 1 – Update bootBits 2-15 – reserved for future useStored in little endian byte order.5Eh TFTP port WORD Port number used by TFTP server in Chassis Manager. 0 ifChassis Manager does not support TFTP.Stored in little endian byte order.60h SFTP port WORD Port number used by secure FTP server in Chassis Manager.0 if Chassis Manager does not support secure FTP.Stored in little endian byte order.62h SCP port WORD Port number used by secure CP server in Chassis Manager. 0if Chassis Manager does not support secure CP.64h Reserved 28 BYTES Reserved field.Stored in little endian byte order.Revision 1.1Intel ® Confidential 97

IPMI Command InterfaceIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSTable 44. BMC Event Receiver Device CommandsNet Function = Sensor(04h) / Event, LUN = 00CodeCommandRequest, Response DataDescription00h Set Event Receiver Not implemented The BMC does not function as an IPMB eventgenerator.01h Get Event Receiver Per the Intelligent PlatformManagement InterfaceSpecification Second Generationv2.002h14h15hPlatform EventMessageSet Last ProcessedEvent IDGet Last ProcessedEvent IDPer the Intelligent PlatformManagement InterfaceSpecification Second Generationv2.0Per the Intelligent PlatformManagement InterfaceSpecification Second Generationv2.0Per the Intelligent PlatformManagement InterfaceSpecification Second Generationv2.016h Alert Immediate Per the Intelligent PlatformManagement InterfaceSpecification Second Generationv2.017h PET Acknowledge Per the Intelligent PlatformManagement InterfaceSpecification Second Generationv2.0Returns the BMC’s IPMB address (20h) andLUN (00h).Table 45. PEF CommandsNet Function = Sensor / Event, LUN = 00CodeCommandRequest, Response Data10h Get PEF Capabilities Per the IPMI 2.0 specification11h Arm PEF Postpone Timer Per the IPMI 2.0 specification12h Set PEF Configuration Parameters Per the IPMI 2.0 specification13h Get PEF Configuration Parameters Per the IPMI 2.0 specification14h Set Last Processed Event ID Per the IPMI 2.0 specification15h Get Last Processed Event ID Per the IPMI 2.0 specification16h Alert Immediate Per the IPMI 2.0 specification17h PET Acknowledge Per the IPMI 2.0 specification98Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSIPMI Command InterfaceTable 46. Supported PEF Configuration ParametersParameter Name Parameter #DescriptionSet in Progress 0 Per the IPMI 2.0 specificationPEF Control – non-volatile 1 Per the IPMI 2.0 specification. PEF startup delay disable (bit 2) isnot supported.PEF Action Global Control – nonvolatile2 Per the IPMI 2.0 specificationPEF Startup Delay – non-volatile 3 Per the IPMI 2.0 specificationPEF Alert Startup Delay – nonvolatile4 Per the IPMI 2.0 specificationNumber of Event Filters 5 Per the IPMI 2.0 specificationEvent Filter Table – non-volatile 6 Per the IPMI 2.0 specificationEvent Filter Table Data 1 –nonvolatile7 Per the IPMI 2.0 specificationNumber of Alert Policy Entries 8 Per the IPMI 2.0 specificationAlert Policy Table 9 Per the IPMI 2.0 specificationSystem GUID 10 Per the IPMI 2.0 specificationNumber of Alert Strings 11 Per the IPMI 2.0 specificationAlert String Keys 12 Per the IPMI 2.0 specificationAlert Strings 13 Per the IPMI 2.0 specificationCode20hCommandGet Device SDRInfo21h Get Device SDR Not implemented22h23h24h25h26hReserve DeviceSDR RepositoryGet SensorReading FactorsSet SensorHysteresisGet SensorHysteresisSet SensorThresholdTable 47. BMC Sensor Device CommandsNet Function = Sensor (04h) / Event, LUN = 00Request, Response DataNot implementedNot implementedPer the IntelligentPlatform ManagementInterface SpecificationSecond Generation v2.0Per the IntelligentPlatform ManagementInterface SpecificationSecond Generation v2.0Per the IntelligentPlatform ManagementInterface SpecificationSecond Generation v2.0Per the IntelligentPlatform ManagementInterface SpecificationSecond Generation v2.0DescriptionFor information on which sensors utilize hysteresis, see theTable 76.For information on which sensors utilize hysteresis, see theTable 76.For information on which sensors support thresholds, see theTable 76.Revision 1.1Intel ® Confidential 99

IPMI Command InterfaceIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSCode27h28h29hCommandGet SensorThresholdSet SensorEvent EnableGet SensorEvent EnableNet Function = Sensor (04h) / Event, LUN = 00Request, Response DataPer the IntelligentPlatform ManagementInterface SpecificationSecond Generation v2.0Per the IntelligentPlatform ManagementInterface SpecificationSecond Generation v2.0Per the IntelligentPlatform ManagementInterface SpecificationSecond Generation v2.0DescriptionFor information on which sensors support thresholds, see theTable 76.The readable threshold mask returned by the BMC for theGet Sensor Thresholds command only contains set bits forthresholds that have been given values. Only thosethresholds are actively processed by the BMC. Thresholdsthat are marked as Readable in the SDR but have not beenset for that sensor have no valid value.For information on which sensors generate events, see theTable 76.For information on which sensors generate events, see thesensor table section.. Most enabled, but not scanned,sensors indicate ”Sensor update in progress” when theserver power is off. See Section 10.2.2Ah2Bh2DhRe-arm SensorEventsGet SensorEvent StatusGet SensorReadingPer the IntelligentPlatform ManagementInterface SpecificationSecond Generation v2.0Not implementedPer the IntelligentPlatform ManagementInterface SpecificationSecond Generation v2.02Eh Set Sensor Type Not implemented2FhGet Sensor Type Not implementedFor information on which sensors return readings, see Table76 for core sensors and the platform-specific EPS foradditional sensors. Most sensors indicate “Sensor update inprogress” when the server power is off. See Section 10.2.Table 48. BMC FRU Inventory Device CommandsCode10h11h12hCommandGet FRU Inventory Area InfoRead FRU Inventory DataWrite FRU Inventory DataNet Function = Storage (0Ah), , LUN = 00Request, Response DataPer the Intelligent Platform Management Interface Specification SecondGeneration v2.0. The FRU device is accessed by bytes.Per the Intelligent Platform Management Interface Specification SecondGeneration v2.0. The FRU device is accessed by bytes.Per the Intelligent Platform Management Interface Specification SecondGeneration v2.0. The FRU device is accessed by bytes.Table 49. BMC SDR Repository Device CommandsNet Function = Storage (0Ah), , LUN = 00CodeCommandRequest, Response Data20h Get SDR Repository Info Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.021h Get SDR Repository Allocation Info Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0100Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSIPMI Command InterfaceNet Function = Storage (0Ah), , LUN = 00CodeCommandRequest, Response Data22h Reserve SDR Repository Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.023h Get SDR Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.024h Add SDR Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.025h Partial Add SDR Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.026h Delete SDR Not implemented27h Clear SDR Repository Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.028h Get SDR Repository Time Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.029h Set SDR Repository Time Not implemented2Ah Enter SDR Repository Update mode Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.02Bh Exit SDR Repository Mode Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.02Ch Run Initialization Agent Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0Table 50. BMC SEL Device CommandsNet Function = Storage (0Ah), , LUN = 00CodeCommandRequest, Response Data40h Get SEL Info Per the Intelligent Platform Management Interface Specification SecondGeneration v2.041h Get SEL Allocation Info Per the Intelligent Platform Management Interface Specification SecondGeneration v2.042h Reserve SEL Per the Intelligent Platform Management Interface Specification SecondGeneration v2.043h Get SEL Entry Per the Intelligent Platform Management Interface Specification SecondGeneration v2.044h Add SEL Entry Per the Intelligent Platform Management Interface Specification SecondGeneration v2.045h Partial Add SEL Entry Not implemented46h Delete SEL Entry Not implemented47h Clear SEL Per the Intelligent Platform Management Interface Specification SecondGeneration v2.048h Get SEL Time Per the Intelligent Platform Management Interface Specification SecondGeneration v2.049h Set SEL Time Per the Intelligent Platform Management Interface Specification SecondGeneration v2.05Ah Get Auxiliary Log Status Not implemented5Bh Set Auxiliary Log Status Not implementedRevision 1.1Intel ® Confidential 101

IPMI Command InterfaceIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSTable 51. LAN CommandsNet Function = Transport (0Ch), , LUN = 00CodeCommandRequest, Response Data01h Set LAN Configuration Per the Intelligent Platform Management Interface Specification SecondGeneration v2.0. Supports Errata E394, which allows the BMC to return a0x82 completion code for attempts to set a read-only parameter.02h Get LAN Configuration Per the Intelligent Platform Management Interface Specification SecondGeneration v2.003h Suspend BMC ARPs Per the Intelligent Platform Management Interface Specification SecondGeneration v2.004hGet IP / UDP / RMCP Statistics Not implementedTable 52. Supported LAN Configuration ParametersParameter NameParameterDescriptionNumberSet In Progress 0 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0.Authentication Type Support 1 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0.Authentication Type Enables 2 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0.IP Address 3 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0.Note: When DHCP is enabled, this parameter is treated as readonly.IP Address Source 4 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0. Address sources are supported asfollows:0h (unspecified) – Unsupported BMC will return a 0xCCcompletion code.1h (static address (manually configured)) – The BMC takes nospecial action2h (address obtained by BMC running DHCP) –The BMCimmediately starts the DHCP protocol.3h (address loaded by the BIOS or system software) –Unsupported BMC will return a 0xCC completion code.4h (address obtained by BMC running other address assignmentprotocol) – Not supported on any BMC NIC interface. The BMCreturns 0xCC response code if this value is set.MAC Address 5 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0.Subnet Mask 6 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0.Note: When DHCP is enabled, this parameter is treated as readonly.See Section 4.9.5.1.1 for more information.Ipv4 Header Parameters 7 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0.Primary RMCP Port Number(optional)Secondary RMCP Port Number(optional)8 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0.9 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0.102Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSIPMI Command InterfaceParameter NameParameterDescriptionNumberBMC-generated ARP control 10 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0.Gratuitous ARP Interval 11 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0.Default Gateway Address 12 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0.Note: When DHCP is enabled, this parameter is treated as readonly.See Section 4.9.5.1.1 for more information.Default Gateway MAC Address 13 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0Note: The MAC Address will be ignored when setting thisparameter, and invalid when reading. The BMC will use theAddress Resolution Protocol to obtain the target MAC address.Backup Gateway Address 14 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0Backup Gateway MAC Address 15 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0Note: The MAC Address will be ignored when setting thisparameter, and invalid when reading. The BMC will use theAddress Resolution Protocol to obtain the target MAC address.Community String 16 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0Number of Destinations (ReadOnly)17Destination Type 18 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0.Destination type OEM1 (110b) ismapped to SMTP Alerting if supported.Destination Addresses 19 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0Note: Data 8:13 (Alerting MAC Address) will be ignored whensetting this parameter, and invalid when reading. The BMC willuse the Address Resolution Protocol to obtain the target MACaddress.802.1q VLAN ID (12-bit) 20 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0 – not implemented802.1q VLAN Priority 21 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0 – not implementedRCMP+ Messaging Cipher SuiteEntry Support (Read Only)RMCP+ Messaging Cipher SuiteEntries (Read Only)RMCP+ Messaging Cipher SuitePrivilege Levels22 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.023 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.024 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0Destination Address VLAN TAGs 25 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0 – not implementedReserved 195 (OEM) ReservedReserved 197 (OEM) ReservedReserved 198 (OEM) ReservedRevision 1.1Intel ® Confidential 103

IPMI Command InterfaceIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSParameter NameParameterDescriptionNumberDHCP Host Name 199 (OEM) When used in Set LAN Configuration Parameters:Byte 1Block selector (01h – 04h), blocks are each 16 byteslong. This byte is only used in the case of Set LANConfiguration command. In the case of Get LANConfiguration, the set selector in the Get LANConfiguration command will be used and this byte willnot exist as part of the payload.Byte 2Set host-name in-progress indicator[7:1] - reserved[0] - in progress0h = Update in progress.1h = Update is completed with this requestBytes 3-18 (16 bytes)Printable ASCII character string. Total length is 63bytes followed by a null. The ASCII string is split into16 bytes blocks, with each block identified by the blockselector. If a null character is found, the followingcharacters after the null character will be ignored.Response DataByte 10x00 –Successful Completion Code0x80 – Parameter Not Supported (Non-printablehostname)0xCC –For Invalid data field0xC7 – For Invalid data lengthWhen used in Get LAN Configuration Parameters:Byte 1Set Selector always 0Byte 2Block Selector (1-4)Value 0 is ReservedResponse DataByte 10x00 –Successful Completion Code0xCC – For Invalid data field0xC7 – For Invalid data lengthIf Byte 1 is equal to 0 thenByte 3 -Byte 18 contain requested hostname block.104Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSIPMI Command InterfaceTable 53. Emergency Management Port CommandsNet Function = Transport (0Ch), , LUN = 00CodeCommandRequest, Response Data10h Set Serial Configuration Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.011h Get Serial Configuration Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.012h Set Serial MUX Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.01Ch Set Serial Routing MUX Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0The default parameter values are listed in the Intelligent Platform Management InterfaceSpecification Second Generation v2.0 if they are not shown in the table.Table 54. Supported Serial Configuration ParametersParameter NameParameterDescriptionNumberSet in Progress 0 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0Authentication Type Support 1Authentication Type Enables 2Connection Mode 3 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0. Terminal mode is supportedSession Inactivity Timeout 4Session Termination 6 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0IPMI Messaging Comm Setting 7 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0MUX switch Control 8 Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0Terminal Mode Configuration 29Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0. Defaults:• Line editing enabled• Delete control sequence + + • Echo enabled• Handshake enabledRevision 1.1Intel ® Confidential 105

IPMI Command InterfaceIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSTable 55. Terminal Mode CommandsCommandSYS PWDSYS TMODESYS SET BOOTSYS SET BOOTOPTSYS GET BOOTOPTSYS SET TCFGSYS RESETSYS POWER ONSYS POWER OFFRequest, Response DataAs defined by the Intelligent PlatformManagement Interface Specification SecondGeneration v2.0As defined by the Intelligent PlatformManagement Interface Specification SecondGeneration v2.0As defined by the Intelligent PlatformManagement Interface Specification SecondGeneration v2.0As defined by the Intelligent PlatformManagement Interface Specification SecondGeneration v2.0As defined by the Intelligent PlatformManagement Interface Specification SecondGeneration v2.0As defined by the Intelligent PlatformManagement Interface Specification SecondGeneration v2.0As defined by the Intelligent PlatformManagement Interface Specification SecondGeneration v2.0As defined by the Intelligent PlatformManagement Interface Specification SecondGeneration v2.0As defined by the Intelligent PlatformManagement Interface Specification SecondGeneration v2.0SYS HEALTH QUERY As defined by the Intelligent PlatformManagement Interface Specification SecondGeneration v2.0XX XX ... Hex ASCII encoded IPMI commands –Request / Response Data as defined in othercommand tables.PrivilegeCallbackCallbackAdminAdminOperatorAdminOperatorOperatorOperatorUserVariesDescriptionAll IPMI defined variations of thiscommand are supportedAll IPMI defined variations of thiscommand are supportedAll IPMI defined variations of thiscommand are supportedPrivilege as defined for encodedIPMI command106Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSIPMI Command InterfaceCode02hCommandRestoreConfigurationTable 56. Intel General Application CommandsNet Function = Intel General Application (0x30), LUN = 00Request, Response DataDescriptionRequest:Restores the private store to defaults. ResetsByte 1 – ‘C’ (43h)all configurable items to defaults, includingchannel configuration, by erasing the BMC’sByte 2 – ‘L’ (4Ch)private store region.Byte 3 – ‘R’ (52h)A BMC reset is required to put these defaultsByte 4 – Operationinto effect. The FWPIAUPD utility provides aAAh – Initiate restorecommand-line option (“-setdef”) that resets theBMC by sending the Enter and Exit Firmware00h – Get restore statusTransfer Mode commands after sending theResponse:Restore Configuration command.Byte 1 – Completion codeByte 2 – Restore progress00h – Restore in progress01h – Restore completedExecuting this command without immediatelyresetting the BMC may cause unexpectedbehavior if any of the modules have had timeto rewrite their runtime configuration to theprivate store.0Ah –0Fh14hReserved N/A N/AGet SM Signal Request:Byte 1 – Signal type00h – Power button01h – Reset button02h – Sleep button (Not supported)03h – Diagnostic interrupt (NMI) button04h – Intrusion switch05h – Power good (Not supported)06h – Power request (Not supported)07h – Sleep request (Not supported)08h – FRB timer halt (Not supported)09h – Force update (Not supported)0Ah – EMP ring indicate (Not supported)0Bh – EMP data carrier detect (Not supported)0Ch – Identify switch0Dh – Fan power drive (Reads PWM value)0Fh – Fan tachometer readingByte 2 – Signal instance, zero basedByte 3 – Action0 – Sample1 – Ignore2 – RevertResponse:Byte 1 – Completion codeByte 2 – Signal value for fan power/speedGeneric value for most requests:0 – De-asserted1 – AssertedFor fan power drive request (0Dh):0-64h – The actual % value of the PWM driveAllows the real-time state of certain inputsignals (e.g., buttons) to be polled withoutchanges in the signals to be acted on by theBMC. The command allows the input signalsto revert to their normal behavior. See Section1.1.Note: When using Signal Type of Fanpower/speed, the value returned in responsebyte 2 represents a percentage (from 0 to 64h)of how slow or fast a fan on a fan domain(PWM) is running. 0 represents that a fan on aPWM is off and 64h represents that the fan isrunning at the maximum speed.Note: For Signal Type 0Fh, if the fan presencesensor is unavailable, a fan tachometerreading of 0 pulses per minute isindistinguishable from fan not present and fanRPM equal 0 (e.g. when PWM drive is set to0%).Note: For Signal Type 0Dh and 0Fh thenumber of instances (PWMs or fantachometers) is system dependent, based onthe number of available domains.Note: For Signal Type 0Fh, the pulses perrevolution is fan model dependent.Usage Example:(1.) Sample a signal (i.e. – power button); notethe state(2.) Ignore this signal(3.) Press the button(4.) Re-sample and note the state. This stateshould be opposite the state in Step 1(5.) Complete a revertSignal type - 0Dh (Fan Power Drive) supportsRevision 1.1Intel ® Confidential 107

IPMI Command InterfaceIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSCode15h18hCommandSet SM Signal Request:Write LANChannel PortNet Function = Intel General Application (0x30), LUN = 00Request, Response DataDescriptionFor fan tachometer reading request (0Fh): only "Sample" action. BMC will return 0xC1Bit_0:complete code for all other values in Byte 03(action)0 – Fan presence sensor is unavailable1 – Fan presence sensor is availableBit_1: (valid only if Bit_0 is 1)0 – Fan is not present1 – Fan is presentByte 3 – Optional valueFor fan tachometer reading request (0Fh):Pulses per minute measured by the fantachometer. Contains the lower byte of the value.Byte 4 – Optional valueFor fan tachometer reading request (0Fh):Pulses per minute measured by the fantachometer. Contains the upper byte of thevalue.Byte 1 – Signal type00h – Power LED (Not supported)01h – System fault LED (Amber)02h – Cluster LED (Not supported)03h – HDD fault LED (Not supported)04h – Cooling fault LED (Not supported)05h – Fan power (Sets PWM value)06h – Power request (Not supported)07h – Sleep request (Not supported)08h – ACPI SCI (Not supported)09h – Speaker (Not supported)0Ah – Fan fail LED (Not supported)0Bh – CPU fail LED (Not supported)0Ch – DIMM fail LED (Not supported)0Dh – Identify LED0Eh – HDD activity LED (Not supported)0Fh – System ready LED (Green system statusLED)Byte 2 – Signal instance, zero-basedByte 3 – Action0 – Force de-asserted1 – Force asserted2 – RevertByte 4 – Optional value, used by multi-value signalsFor fan power/drive set request (05h), accepts0-64h – The actual % value of the PWM driveResponse:Byte 1 – Completion codeRequest:Byte 1 — Port numberAllows the real-time state of some outputsignals, like LEDs, to be set without losing theBMC internal state associated with the signals.The command allows the output signals torevert to their normal behavior. See Table 20.Certain signals take analog values or complexstates. The fourth byte of the request issupported for these types of signals. See fanpower in Table 20.Instance values for signal type 05h aredomain-based.Note: For Signal Type 05h, the number ofinstances (PWMs) is system-dependent.Allows the user to select which LAN channelBMC LAN traffic can communicate with. Thisport value will be saved in the bootloader108Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSIPMI Command InterfaceCodeCommandNet Function = Intel General Application (0x30), LUN = 00Request, Response DataDescriptionResponse:environment variables area of the BMC flash.Byte 1 — Completion codePort number corresponds to NIC number.Port1 = NIC1,Port 2 = NIC2,PORT3=NIC3 andPORT4=NIC419hRead LANChannel PortValueRequest: N/AResponse:Byte 1 — Completion codeByte 2 — Channel port valueRetrieves the current port value setting fromthe bootloader environment variables area ofthe BMC flash.Note: The default port is PORT 140h41h52h57hResolve IPAddressSet SystemGUIDCMOS ClearOptionsSet FaultIndicationRequest:Byte 1 – Channel IDBytes 2:5 – IP Address to resolveResponse:Byte 1 – Completion codeBytes 2-7 – MAC address associated with IPRequest:Bytes 1-16 – System GUIDResponse:Byte 1 – Completion codeNot implementedNote: Supported in both SMS & SMM ModesRequest:Byte 1 – Source ID.0 = Unspecified source1 = Hot-Swap Controller 02 = Hot-Swap Controller 13 = BIOSAll other values reservedByte 2 – Fault type. Supported fault types:0 = Fan1 = Temp2 = Power3 = Drive slot4 = Software5 = MemoryByte 3 – State to set. Supported states:0 = OK1 = Degraded2 = Non-critical3 = Critical4 = Non-recoverableOnly valid for LAN channels. The BMC sendsan ARP request out on the interfaceassociated with the channel. If an ARPresponse is received within three seconds, theBMC responds to this command with thereceived MAC address. The system may needto be reset after this action to provide networkaccess.Note that any IP address received during theARP transaction must be within the BMC’ssubnet, as defined by the subnet mask.Sets the system GUID obtained according tothe format of the IPMI 2.0 Get System GUIDcommand. This value is not storedpersistently, GUID is programmed by factoryonce and on every boot, BIOS pass this info toBMC.Not implementedSatellite controllers on the IPMB or softwarecan indicate to the BMC that they havedetected a fault assertion or deasssertionusing this command. The BMC generates acomposite fault state from this information andits own internal fault state, and uses this todrive front panel indicators.The fault indication state contributes to thesystem status state, as reported by the frontpanel system status LED:OK: OKDegraded: DegradedNon-critical: Non-fatalCritical: FatalNon-recoverable: FatalThis command also supports additionalparameters to control BMC-owned componentfault LEDs associated with the specified faultcondition.See DIMM Map in Table 22 and Table 23.Revision 1.1Intel ® Confidential 109

IPMI Command InterfaceIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSCode5AhCommandSet NodeManagerPlatform InfoNet Function = Intel General Application (0x30), LUN = 00Request, Response DataByte 4 – Component Fault LED Group IDSupported values are fault-type dependent andplatform dependent. Refer to platform appendix fordetails. Set to 0xFF if not used.Bytes 5 :8 -- LED state32-bit mask for set component LEDs for thespecified LED group ID. Byte ordering is LSBytefirst. Setting a bit to 1 will turn on the associatedLED. LED enumeration corresponds to bit-positionin the bit-mask.Response:Byte 1 – Completion codeRequest:Bytes 1 to 8 – TDP/TDC MSR ValueBytes 9 to 16 – Platform Info MSR ValueBytes 17 & 18 – Min PowerBytes 19 & 20 – Max PowerByte 21 – Total P-statesByte 22 – Total T-statesDescriptionThe BIOS uses this command to sendplatform information to the IBMC FW, which ispassed from the IBMC to ME to be used bythe Node Manager feature.All multi-byte fields are in LSByte orderResponse:66h71hGet BufferSizeGet AdvancedSupportConfigurationByte 1 – Completion codeRequest:NoneResponse:Byte 1 – Completion codeByte 2 – KCS Buffer Size (In multiples of four bytes)Byte 3 – IPMB Buffer Size (In multiples of four bytes)Request:Byte 1 – Flags7 – Get type0b = Get parameter1b = Get parameter revision only6:0 – ReservedByte 2 – Parameter selectorByte 3 – Set selectorSelects a given set of parameters under a givenparameter selector value. 00h if parameter doesn’tuse a set selector.Byte 4 – Block Selector00h if parameter does not require a block selectorResponse:Byte 1 – Completion codeByte 2 – Parameter revisionUsed to determine the maximum size ofbridgeable messages used between KCS andIPMB interfaces.Data bytes 2 and 3 are returned in wholemultiples of four bytes. For example, ‘8’returned for either data byte represents a 32-byte buffer.Note: The smaller of the two values returnedshows the maximum message size.Gets the configuration parameters for BMCadvanced feature support. See Table 58 forthe definition of the configuration parametersused with this command.This command is implemented in the bootcode as well as the operational code, but theboot code only supports parameter 1, Intel ®Remote Management Module 3 (Intel ® RMM3)Presence.110Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSIPMI Command InterfaceCodeCommandNet Function = Intel General Application (0x30), LUN = 00Request, Response DataFormat: MSN = present revision. LSN = oldestrevision parameter is backward compatible with.11h for parameters in this specification.Bytes 3-N – Parameter data (not returned when the‘get parameter revision only’ bit is 1b).Description80h Reserved Reserved for internal BMC use. Reserved for internal BMC use.81h Reserved Reserved for internal BMC use. Reserved for internal BMC use.85h Reserved Reserved for internal BMC use. Reserved for internal BMC use.89hSet FanControlConfigurationRequest:Byte 1 – Fan profile to enable0 = Fan profile 0 (default profile)1 = Fan profile 12 = Fan profile 23 = Fan profile 34 = Fan profile 4FFh = None specified (do not change currentsetting)All other values reservedByte 2 – Flags[7:3] – Reserved[2] – Memory temp sensor and memory throttlingconfiguration status0 = Not started or in-progress1 = Completed[1:0] – Memory Throttling Mode0 = None supported1 = Open-loop thermal throttling (OLTT) – thisoption is not supported for Emerald Ridge(reserved)2 = Close-loop thermal throttling (CLTT)3 = None specified (do not change currentsetting)Byte 3 – Memory Device Group ID0 = CPU #1 group1 = CPU #2 group2 = CPU #3 group3 = CPU #4 group0xFF=None specifiedAll other values reservedBytes 4 to 11 -- Memory device presence bit-map64-bit map for indicating the presence of a memorytemp sensor for devices in the specified group ID.Byte ordering is LSByte first. Setting a bit to 1indicates that the associated device is present andits temperature should be monitored. Deviceenumeration corresponds to bit-position in the bitmask.These bytes are only valid if the Memory DeviceGroup ID field is not set to FFh (unspecified).This command must be supported on boththe SMS and SMM mode Note2Provides a method for the BIOS to:Enable a supported fan control profile.Communicate the memory throttling modeto the BMC (CLTT).Provide an indication to the BMC that theBIOS has completed setup of memorythrottling and DIMM temp sensor state.Provide memory temp sensor availabilitydata to the BMC.On BMC reset or power-up:The default enabled fan profile for a givenfan control domain is the lowest numberedprofile that is supported in the loadedSDRs.If no profiles are fully supported across allconfigured fan domains, the BMC defaultsto profile 0.Only CLTT is supported for Emerald RidgeThe definition of the Memory Device PresenceBit-map (bytes 4 to 11) for Emerald Ridge is asfollows:Bits 31:0 are used for indicating thepresence of a DIMM temp device.( For DIMM Bit map, please refer Table 22and Table 23)Bits 39:32 are used for indicating thepresence of a memory buffer temp device(One DIMM group can have a maximum oftwo Risers – for ex, Group 0 would haveRiser 1 and Riser 2. If Riser 1 is presentthen bits 32&33 will be set. If Riser 2 ispresent, then bits 34& 35 will be set). Bits36 -39 are unused)Bits 63:40 are reservedRevision 1.1Intel ® Confidential 111

IPMI Command InterfaceIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSCodeCommandNet Function = Intel General Application (0x30), LUN = 00Request, Response DataDescriptionRequest data must be always 11 bytesResponse:otherwise, a completion code of C7h ( Invalidlength) will be returnedByte 1 – Completion codeAll Reserved bits should be always set aszeros.For Emerald Ridge, during POST, memoryhot-plug, and logical memory off-lining, BIOSwill need to send this command once for eachinstalled CPU.Note2 : In SMM modeByte 1 (Fan profile to enable) must be FFh =None specified (do not change current setting)Byte 2 - [1:0] Memory Throttling Mode mustbe3 = None specified (do not change currentsetting)Otherwise, a completion code of CCh (invaliddata field in request) will be returned.8AhGet FanControlConfigurationRequest:Byte 1 —Memory Device group IDFFh=None specifiedResponse:Byte 1 – Completion codeByte 2 – Fan Control Profile Support Bit/Mask[4] 1 = Fan profile 4 supported[3] 1 = Fan profile 3 supported[2] 1 = Fan profile 2 supported[1] 1 = Fan profile 1 supported[0] 1 = Fan profile 0 supportedByte 3 – Fan Control Profile EnableIndicates which fan control profile is enabled.0-7 = Fan profile that is enabledAll other values are reservedByte 4 -- Flags[7:3] – Reserved[2] – DIMM temp sensor and memory throttlingconfiguration status0 = Not started or in-progress1 = Completed[1:0] – Memory Throttling Mode0 = None supported1 = Open-loop thermal throttling (OLTT)( Notsupported)Retrieves information on fan profile supportand DIMM temp sensor availability. If noprofiles are supported, the BMC defaults toprofile 0.The definition of the Memory Device PresenceBit-map (bytes 5 to 12) for Emerald Ridge isas follows:Bits 31:0 are used for indicating thepresence of a DIMM temp device.( For DIMM Bit map, please refer Table 22and Table 23)Bits 39:32 are used for indicating thepresence of a memory buffer temp device(One DIMM group can have a maximum oftwo Risers – for ex, Group 0 would haveRiser 1 and Riser 2. If Riser 1 is presentthen bits 32&33 will be set. If Riser 2 ispresent, then bits 34& 35 will be set). Bits36 -39 are unused)Bits 63:40 are reserved112Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSIPMI Command InterfaceCode8Bh25hCommandGet ThermalProfile DataAcquireSystemResourceNet Function = Intel General Application (0x30), LUN = 00Request, Response Data2 = Close-loop thermal throttling (CLTT)3 = reservedBytes 5 :12 -- Memory device presence bit-map64-bit map for indicating the presence of a memorytemp sensor for devices in the specified group ID.Byte ordering is LSByte first. Setting a bit to 1indicates that the associated device is present andits temperature should be monitored. Deviceenumeration corresponds to bit-position in the bitmask.Request:Byte 1 – Flags[7:2] – Reserved[1:0] – Memory Throttling Mode0 = None supported1 = OLTT (Not supported)2 = CLTT3 = reservedByte 2 – Fan Profile (see Set Fan ControlConfiguration command definition)Response:Byte 1 – Completion codeByte 2 – Byte 0 of data ( Thermal Profile SDR Recordbyte 0. starting with Record ID ) Note1[...]Byte n+2 – Byte n of data ( Thermal Profile DataSDR Record last byte)Request:Byte 1 – System Resource00h – SMBusAll other values reservedByte 2 – InstanceByte 3 – Control[7:1] – reserved[0] – action0 = release semaphore1 = acquire semaphoreResponse:Byte 1 – Completion codeThis command will respond with a completion codeof “C0h = Node Busy” if the resource is currently inuse.DescriptionProvides a way for the BIOS to retrieve thethermal profile data for a specified thermalthrottling mode and fan profile.If the SDR body size would cause theresponse length to exceed the maximum sizesupported by the IPMI channel, then thecompletion code is 0xCA (Response DataTruncated) and no further data is returned.This will only affect the IPMB.Reserved bytes in the request will be ignored.Note1 - Please refer to Thermal Profile DataSDR Record Format given in Thermal ProfileData SDR Record section for Thermal ProfileData byte details.Allows software external to the BMC, such asBIOS, to gain exclusive access to a systemresource. Support for using this command forspecific system resources is system-specific.Initial ownership for a system resourcesemaphore after various system events (poweron, system reset, etc.) is configurable on asystem-specific basis.Definition for System Resource = 00h(SMBus).Note: BIOS is the owner of all CPUSMBus segments until POST completes.After POST completes, BMC is the defaultowner of all CPU SMBus segmentsunless BIOS has gained ownership viathis command.Instanc Definitione0 CPU #1 SPD SMBus segments1 CPU #2 SPD SMBus segments2 CPU #3 SPD SMBus segments3 CPU #4 SPD SMBus segmentsRevision 1.1Intel ® Confidential 113

IPMI Command InterfaceIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSCodeCommand0x26h Set BIOS ID Request:0x27hNet Function = Intel General Application (0x30), LUN = 00Request, Response DataByte 1 : length of BIOS string (No of bytes to write) –‘N’Response:Get Stack Info Request:Byte 2 to N : BIOS ID stringByte 1: Comp codeByte 2: No of bytes received – ‘M’ (this can be usedas a means to make sure all data bytes are receivedcorrectly )Byte 1: Embedded SW entity type0 = BIOS1 = Management Controllers2 = SDROther values reservedByte 2: No of bytes to read0xFF = Read entire record0 – 0xFE = Number of bytes to readByte 3: Start point of read offsetDescriptionAll other instances reservedSet command to be exclusively used byBIOS – This command should not be used byany external app.Set BIOS IDA single IPMI based OEM command can beused to retrieve the following BIOS & FWversions that are applicable to a given platform:BMC FW versionHSC FW versionME FW versionSDR VersionBIOS version (Entire BIOS ID string)(Please refer the Table 56 for more details.)Byte 2 – Byte 3 is needed only for BIOS SW entitytypeResponse:Byte 1Byte 2Byte 3 - N: Comp code: No of data bytes read: Version ID DataBIOS and SDR version ID is in the format of a nullterminatedcharacter string.Management Controller ID is in the following format:(Include sub-table here with management controllerdata. Provide 2 spaces for HSC in case there aredual backplanes.)93h94hE2hRead BaseBoard ProductIDRead BaseBoard Rev IDOEM GetReadingNOTE: A management controller version ID of 0.0 ora null string (for BIOS or SDR version) indicates thatthe entity cannot be accessed or is not present.Request: N/AResponse:Byte 1 — Completion codeByte 2 — 0x0BRequest: N/AResponse:Byte 1 — Completion codeByte 2 — Revid valueRequestByte 1 – Domain Id/Reading TypeRetrieve the current prodid value setting fromthe Uboot environment variables area of theBMC flash. If response byte two is 0 thenthe prodid value is invalid. Used by MonolithicFW.Retrieves the current revid value setting fromthe Uboot environment variables area of theBMC flash. If response byte two is 0 then therevid value is invalid. Used by Monolithic FW.Note - Only Reading type 01h – Inlet AirTemperature is supported. For Inlet AirTemperature, the Domain Id must be set to 0114Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSIPMI Command InterfaceCodeCommandNet Function = Intel General Application (0x30), LUN = 00Request, Response DataDescription[0:3] = Domain Id- For Inlet Air Temperature, the Domain Idmust be set to 0[4:7] = Reading Type=00h – Platform Power Consumption. Forplatform power consumption the Domain Id willbe set to 0. Values from 1 to 15 could be usedto address power rails. Per-rail readings areoptional and Firmware needs to bepreconfigured in the factory settings.=01h – Inlet Air Temperature. For Inlet AirTemperature the Domain Id will be set to 0.=02h – ICC_TDC reading from PECI. ForICC_TDC reading from PECI the Domain Idaddress the processor socket and the rangefrom 0 to number of installed CPUs/socket.Number of installed CPUs is set by the SetHost CPU data command byte 5.=03h...0Fh - reservedBytes 3:2 – reserved. Write as 0000hResponse:Byte 1 – completion code=00h – SuccessByte 2 – Domain Id / Reading Type[0:3] = Domain Id copied from request[4:7] = Reading Type=00h – Platform Power Consumptionin Watts. Values below 0 areignored and treated as a powerreading failure.=01h – Inlet Air Temperature in degrees centigrade.Values below -128 degrees centigrade and above+127 degrees centigrade will be ignored and treatedas a temperature reading failure.=02h – ICC_TDC reading from PECI. Values belowRevision 1.1Intel ® Confidential 115

IPMI Command InterfaceIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSCodeCommandNet Function = Intel General Application (0x30), LUN = 00Request, Response Data0 and above 255 will be ignored and treated as aPECI reading failure.=03h...FFh - reservedBytes 4:3 – Reading value 16-bit encoding 2scomplementsigned integerDescriptionB0h –B1hEBh –EchReserved Reserved ReservedReserved Not implemented Not implemented116Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSIPMI Command InterfaceCodeD6hCommandSet HostCPU dataTable 57. Intel General Application Commands for Management EngineRequestNet Function = Intel General Application (0x2E2E), LUN = 00Request, Response DataByte 1:3 = Intel manufacturers ID – 0x000157,LS byte firstByte 4 – Domain Id[0:3] = Domain Id (Identifies the set ofprocessors supported by the domain. Currently,FW supports only one domain, Domain 0.)[4:7] = Reserved. Write as 0000b.Byte 5 – Host CPU data.[7] – Set to 1 for End of POST notification[6:5] – Reserved. Write as 00b1[1][4] – Set to 1 if Host CPU discovery data isprovided with that command. This informationshould be passed to Node Manager on eachplatform boot.[3:0] – Reserved. Write as 000b.Note: The Bytes 25:6 are ignored if Byte 5 bit[4] is set to 0.If Byte 5 bit [4] is set to 1 Bytes 24:6 shoulddescribe the actual Host CPU data of theplatform. Additionally, Bytes 24:6 should be setto 0 if the CPU discovery data is passed to NMdirectly by the BIOS.Per processor discovery data will be providedonly for the lowest number processor that isinstalled. In the multiprocessor environment, allother installed processors should match thenumber of performance states, and eachprocessor performance state must haveidentical performance and power-consumptionparameters.Byte 6 – Number of P-States supported by thecurrent platform CPU configuration:= 0 – If P-states are disabled by the user.= 1 – If the CPU does not support P-states orsome of the installed processors don’t matchthe lowest number processor powerconsumptionparameters.= 2..255 – The actual number of supportedP-States by the lowest number processor.Note: other processors should match thenumber of performance states of the lowestnumber processor.Byte 7 – Number of T-States supported by theDescriptionThis command is optional and may beunavailable on certain implementations.Note: This command is mandatory ifNode Manager is a part of the SPSFirmware and if BIOS does notimplement HECI-1 communication toME. This information should be passedto the Node Manager on each platformboot and after each CPU insert/removal.Revision 1.1Intel ® Confidential 117

IPMI Command InterfaceIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSCodeCommandNet Function = Intel General Application (0x2E2E), LUN = 00Request, Response Datacurrent platform CPU configuration= 0 – If T-states are disabled by the user.= 1.255 – Actual number of supported T-Statesby the lowest number processor.Note: other processors should match thenumber of throttling states of lowest numberprocessor.DescriptionByte 8 – Number of installed CPUs/socket. Thisvalue is calculated as a number of allCPUs/sockets present on the board duringplatform boot.Bytes 9:16 - Processor Discovery Data for thelowest number processor in LSByte-first order.Turbo power current Limit MSR 1ACh for thelowest number processor passed by BIOS.Bytes 17:24 - Processor Discovery Data 2 forthe lowest number processor in LSByte-firstorder. Platform Info MSR 0CEh for the lowestnumber processor passed by BIOS.Byte 25 - ICC_TDC reading from PECI for thelowest number processor. In a multiprocessorenvironment all the processors should havecommon ICC_TDC. Set to 0 if ICC_TDC ofprocessors don’t match and set the number ofallowed P-States to 0 as well. Set to 0 if thePECI is attached to ICH9 or if the SPSFirmware should query ICC_TDC using ‘OEMGet Reading’ with type “ICC_TDC reading fromPECI”ResponseByte 1 – completion code=00h – Success (Remaining standardcompletion codes are shown in Section 2.12)=81h – Invalid Domain Id=8Ah – P-State or T-State out of rangeByte 2:4 = Intel manufacturers ID – 0x000157,LS byte first118Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSIPMI Command InterfaceTable 58. Advanced Support Configuration ParametersParameterParameterParameter Data (non-volatile unless otherwise noted)NumberSet in progress (volatile) 0 Data 1 – Indicates when any of the following parametersare being updated, and when the updates are completed.The bit alerts the software that the software or a utility ismaking changes to the data.Intel ® RMM3 Info (readonly)Advanced FeatureSupport(read-only)Intel ® RMM3 FirmwareVersion (read-only)[7:2] – Reserved[1:0]00b = Set complete. If a system reset or transition to apowered down state occurs while ‘set in progress isactive, the BMC goes to the ‘set complete’ state. Ifrollback is implemented, going to ‘set complete’ withoutfirst completing a ‘commit write’, any pending write datawill be discarded.01b = Set in progress. This flag indicates that a utility orother software program is presently doing writes toparameter data. It is a notification flag; it is not aresource lock. The BMC does not provide an interlockmechanism that prevents other software from writingparameter data.10b = Reserved11b = Reserved1 Data 1 – Intel ® Remote Management Module 3 (Intel ®RMM3) Information[7-1] = Reserved[0] = Intel ® RMM3 Presence.1 = Intel ® RMM3 is present0 = Intel ® RMM3 absent2 This provides an indication of which advanced featuresare supported.Data 1 – Feature support mask[7] – Media Redirection. 1 = Supported[6] – KVM. 1 = Supported[5] – BMC DHCP / ARP. 1 = Supported[4] – SMTP. 1 = Supported[3] – SNMP. 1 = Supported[2] – HTTPS. 1 = Supported[1] – HTTP. 1 = Supported[0] – Telnet. 1 = SupportedData 2 – Additional Feature support mask[7] – Reserved[6] – Reserved[5] – Reserved[4] – LDAP. 1 = Supported[3] – WS-MAN CIMOM. 1 = Supported[2] – Reserved[1] – Reserved[0] – SMASH-CLP Lite. 1 = Supported3 Data 1 – Intel ® RMM3 Firmware revision 1• Intel ® RMM3 firmware revision, major (binary) whenRevision 1.1Intel ® Confidential 119

IPMI Command InterfaceIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSParameterParameterNumberParameter Data (non-volatile unless otherwise noted)RMM3 is present.• FFh when Intel ® RMM3 is not present.Data 2 – Intel ® RMM3 Firmware revision 2• Intel ® RMM3 firmware revision, minor (BCD) whenIntel ® RMM3 is present.• FFh when Intel ® RMM3 is not present.Table 59. Managed Data CommandCode02hCommandBMC DataRegion UpdateEventMessageNet Function = Intel General Application (0x3E), LUN = 00Request, Response DataDescriptionRequest:The Platform Event Message is sent by theByte 1 – Assertion/DeassertionBMC to consumer(s) to indicate that thespecified data region has been successfully00h = Assertionupdated.01h = DeassertionAll other values are reserved.Byte 2 — Data Region01h = SMBIOS regionAll other values are reserved.Byte 3 – Update CountResponse:N/AThis command is only sent by the BMC.20hBMC RegionStatusRequest:Byte 1 — Data Region01h = SMBIOS regionAll other values are reserved.Response:Byte 1 – Completion codeC9h = Invalid Region Specified.Byte 2 – MDR VersionByte 3 – Data Region01h = SMBIOS region.All other values are reserved.Byte 4 – Valid Data00h = Invalid01h = ValidAll other values are reserved.Byte 5 – Update CountByte 6 – Lock Status00h = Unlocked01h = Strict Lock02h = Preemptable LockByte 7:8 – Maximum Region LengthByte 9:10 – Region Size UsedThis command is utilized by either the BIOSor an external application to retrieve thestatus of the specified data region.120Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSIPMI Command InterfaceCodeCommandNet Function = Intel General Application (0x3E), LUN = 00Request, Response DataByte 11 – Region ChecksumDescription21hBMC RegionUpdateCompleteRequest:Byte 1 — Session Lock HandleByte 2 – Data Region.01h = SMBIOS regionAll other values are reserved.Response:Byte 1 – Completion codeC9h = Invalid Region Specified.D5h = Region is not locked.81h = Region is in use by another user.This command is utilized by the BIOS toindicate that its update of the specified dataregion is complete. This command shouldnot be used by an external application.Session Lock Handle is returned by the “BMCRegion Lock” command.23hBMC RegionReadRequest:Byte 1 – Data Region.01h = SMBIOS regionAll other values are reserved.Byte 2 – Data Length to Read.Byte 3:4 – Offset to read.Response:Byte 1 – Completion code81h = Region is in use by another user.C4h = Request is larger than maximum allowedpayload size.C9h = Invalid Region Specified.C7h = Requested data extends beyond lengthof regionByte 2 – Read Length.Byte 3 – Update CountByte 4:N – Data.This command is utilized by externalapplications to retrieve the specified dataregion.24hBMC RegionWriteRequest:Byte 1 – Session Lock HandleByte 2 – Data Region.01h = SMBIOS regionAll other values are reserved.Byte 3 – Data LengthByte 4:5 – Data Offset.Byte 6:N – Data to be written.Response:Byte 1 – Completion code81h = Region is in use by another user.C9h = Invalid Region Specified.C7h = Requested data extends beyond lengthof regionD5h = Data region unlocked.Byte 2 – Data Region.This command is utilized by the BIOS to writethe specified data region. This commandshould not be used by an external application.Session Lock Handle is returned by the “BMCRegion Lock” command.Revision 1.1Intel ® Confidential 121

IPMI Command InterfaceIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSCode25hCommandBMC RegionLockNet Function = Intel General Application (0x3E), LUN = 00Request, Response Data01h = SMBIOS regionAll other values are reserved.Byte 4 – Valid Data00h = Invalid01h = ValidAll other values are reserved.Byte 5 – Lock Status00h = Unlocked01h = Strict Lock02h = Preemptable LockByte 6:7 – Max Region LengthByte 8:9 – Region Used (in bytes)Request:Byte 1 – Session Lock Handle00h = Not currently locked.Only valid if region is being unlocked.Byte 2 – Data Region.01h = SMBIOS regionAll other values are reserved.Byte 3 – Lock Type00h = Abort; unlock without completingoperation.01h = Strict Lock; only writes by user wholocked the region are allowed.02h = Preempt able lock; strict locks overridethis type of lock.Byte 4:5 – Timeout. Number of milliseconds allowedbefore lock is released.Response:Byte 1 – Completion code81h = Region is in use by another user.C9h = Invalid Region Specified.D5h = Data region locked.Byte 2 – Session Lock Handle; only valid if byte 1 is asuccessful code (00h).DescriptionThis command is sent by BIOS only to lockthe specified data region. This commandshould not be used by an external application.Session Lock Handle is returned by the “BMCRegion Lock” command.Table 60. Response Data bytes structure when we select Management Controller as optionBMC versionByte 0 – 1Primary HSC versionByte 2-3Secondary HSC version ME versionByte 4-5Major Minor Major Minor Major Minor Major Minor122Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSIPMI Command InterfaceCode00h01h02hCommandEnterFirmwareTransferModeFirmwareProgramFirmwareReadTable 61. BMC Firmware Transfer CommandsNet Function = Firmware (08h), LUN = 00Request, Response DataRequest:Byte 1:5 – I,N,T,E,LResponse:Byte 1 – Completion codeRequest:Byte 1 – Start address (LS byte)Byte 2 – Start address (MS byte)Byte 3:n – Data to programResponse:Byte 1 – Completion code81h = Address not in flashByte 2 – Address (LS byte)Byte 3 – Address (MS byte)Byte 4 – Number of bytesprogrammed0 = FailureRequest:Byte 1 – Start address (LS byte)Byte 2 – Start address (MS byte)Byte 3 – LengthResponse:Byte 1 – Completion code81h = Addr not in flashByte 2 – Start address (LS byte)Byte 3 – Start address (MS byte)Byte 4:n – DataDescriptionThis command directs the BMC to enter firmware transfer mode.The BMC has limited functionality in this mode. The onlycommands guaranteed to be accessible are the firmware transfercommands, the IPMI Get Device ID and Get Self Test Resultscommands, and the OEM command Get Advanced SupportConfiguration to indicate if an Intel ® Remote Management Module3 (Intel ® RMM3) add-in card is present or not.The ASCII characters I, N, T, E, L are used as a key to guardagainst unintentional entry into this mode.The Firmware Program command requests that given bytes bewritten to the BMC flash starting at the specified address. If thenumber of bytes to be transferred exceeds the end of writeableflash, the write will occur but the transfer will be truncated.The actual number of programmed bytes may be less than thenumber passed in the request if the requested transfer exceedsavailable internal buffer space, or if the requested transfer spansover the end of alterable flash space. The appropriate nonzerocompletion code is returned if a truncation occurs or if the transferis not performed.This command may take up to 20.9 seconds to complete,because the first write to a block in the flash silicon initiates a timeconsuming erase of that block. 20.9 seconds is the worst-casespec for main block erase. The typical timing is approximately 0.5seconds. The start address specifies the lower 16 bits of theprogram address. Use the ‘SetProgramSegment’ to set the upper16 bits of the address before issuing this command.The addresses are flash device relative. They range from zero tothe size of the flash device minus one. The flash size is systemdependent.The completion code 81h is returned if the address specified isnot in flash. One possible use for this is to attempt to program theIntel ® RMM3 flash address and if the Intel ® RMM3 is not present,this completion code is returned.The starting address from the request is returned in the responseto help match the response with the request. The actual numberof bytes returned may be less than the requested number, if therequested transfer size exceeds available internal buffer space orif the requested transfer spans over the end of alterable FLASHspace.Addresses do not wrap. For example, if the starting address plusthe length exceeds the last address for the ROM, the number ofdata bytes returned will be less than the number requested. Theaddress byte in the request is the lower 16 bits of the address ofinterest. Use the SetProgramSegment command to set the upper16 bits of the address.See the Firmware Program command for the definition of theaddress.Revision 1.1Intel ® Confidential 123

IPMI Command InterfaceIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSCode03h04h05h06h07hCommandGet FirmwareRangeChecksumExit FirmwareTransferModeSet ProgramSegmentReservedEnter BootRecoveryModeNet Function = Firmware (08h), LUN = 00Request, Response DataRequest:Byte 1 – Start address (LS byte)Byte 2 – Start address (MS byte)Byte 3 – End address (LS byte)Byte 4 – End address (MS byte)Response:Byte 1 – Completion codeByte 2 – Address (LS byte)Byte 3 – Address (MS byte)Byte 4 – Checksum (LS byte)Byte 5 – Checksum (MS byte)Request: N/AResponse:Byte 1 – Completion codeRequest:Byte 1 – Segment address (LSbyte)Byte 2Response:Byte 1 – Completion codeRequest:Byte 1:5 – I,N,T,E,LResponse:Byte 1 – Completion codeDescriptionThe Get Firmware Range Checksum command returns a 2’scomplement checksum for a specified area from the startingaddress through the ending address, inclusive. Valid starting andending addresses must be passed in this request. The resultingresponse cannot be guaranteed if the starting or endingaddresses are set to values that are past the end of FLASH, orthe ending address is less than the starting address. 16 bitchecksum start and end addresses are the lower 16 bits of the(actual 32 bit) address. Use the SetProgramSegment commandto set the upper 16 bits of the address.See the Firmware Program command for the definition of theaddress.When the Exit Firmware Transfer Mode command is received, theBMC returns a successful completion code and then resets itselfto return to normal operation. Because this command causes theBMC to reset itself, a Get Device ID command should berepeatedly sent until a valid response is received indicating thatthe BMC is now in normal operational mode.The supported segment values are system dependent.This command sets the upper 16 bits of the address used for theFirmware Read, Firmware Program, and Get Firmware RangeChecksum commands.This command directs the BMC to enter boot recovery mode. TheBMC will reset itself and stay in the Uboot boot loader rather thanbooting its Linux operational code.This command is for debugging purposes only. Applicationsshould use the Enter Firmware Transfer Mode command toupdate the BMC.Table 62. SOL 2.0 CommandsNet Function = Transport, LUN = 00CodeCommandRequest, Response Data20h SOL 2.0 Activating Not Supported.21h22hSet SOL 2.0 ConfigurationParametersGet SOL 2.0 ConfigurationParametersPer the Intelligent Platform Management Interface SpecificationSecond Generation v2.0Per the Intelligent Platform Management Interface SpecificationSecond Generation v2.0124Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSIPMI Command InterfaceTable 63. Supported SOL 2.0 ParametersParameterParameterParameter DataNumberSet In Progress (volatile) 0 Per the Intelligent Platform Management InterfaceSpecification Second Generation v2.0SOL Enable 1 Per the Intelligent Platform Management InterfaceSpecification Second Generation v2.0SOL Authentication 2 Per the Intelligent Platform Management InterfaceSpecification Second Generation v2.0Character Accumulate Interval and CharacterSend Threshold3 Per the Intelligent Platform Management InterfaceSpecification Second Generation v2.0SOL Retry 4 Per the Intelligent Platform Management InterfaceSpecification Second Generation v2.0SOL non-volatile bit rate 5 Per the Intelligent Platform Management InterfaceSpecification Second Generation v2.0SOL volatile bit rate 6 Per the Intelligent Platform Management InterfaceSpecification Second Generation v2.0Table 64. SMTP Configuration CommandsCode37h38hCommandSet SMTPConfigurationGet SMTPConfigurationNet Function = AMI OEM (32h), LUN = 00Request, Response DataDescriptionRequest:Allows the SMTP Email alerting feature to be configured. SeeByte 1 – Channel Number Table 65 for Configuration Parameter Data information.Byte 2 – Parameter SelectorByte 3 – Set Selector (Used toselect the alert destination entry).Byte 4 – Block Selector (Used toselect the block in parameter)Byte 5:N – ConfigurationParameter DataResponse:Byte 1 – Completion code (80h ifparameter is not supported, 82h ifattempt to write read-onlyparameter)Request:Byte 1 – Channel NumberByte 2 – Parameter SelectorByte 3 – Set Selector (Used toselect the alert destination entry)Byte 4 – Block Selector (Used toselect the block in parameter)Response:Byte 1 – Completion code (80h ifparameter is not supported, 82h ifattempt to write read-onlyparameter)Byte 2N: - ConfigurationParameter DataAllows reading of the SMTP feature configuration. See Table 65for Configuration Parameter Data information.Set Selector is used to specify the SMTP destination number, andis zero-based.Block selector is zero-based.Revision 1.1Intel ® Confidential 125

IPMI Command InterfaceIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSTable 65. Supported SMTP Configuration ParametersParameterParameterParameter DataNumberEnable/Disable SMTP* 0 Data 1 – Enable/Disable SMTP Support[7:1] – Reserved[0] – 1b = Enable SMTP, 0b = Disable SMTPSMTP Server Address* 1 Data 1:4 SMTP Server Address. MS-byte firstSMTP User Name * 2 User Name String in ASCII, 16 bytes max. Nameswith fewer than 16 bytes are terminated with a null(00h) character and 00h padded to the remainingbytes. When the User name is read back thosebytes shall be returned as 0. This field is used forAuthenticated SMTP.User Password *(Write only)Number of Destinations/SMTP Configurations*(Read Only)Email Address(Max number of blocks = 2)3 Password String in ASCII, 20 bytes max.Passwords with fewer than 16 bytes are terminatedwith a null (00h) character and 00h padded to theremaining bytes. This field is used forAuthenticated SMTP.4 Data 1: Number of Destinations supported for theSMTP .The Number must be at least one if theSMTP is supported.5 Sets the Email Address for the first Configurabledestination.Data 1:N : Email address String in ASCII ,64 bytesmax.Block size is 16 Bytes.We can set/get max of 16 bytes (i.e one block ) inEmail address at a time through Set/Get SMTPconfiguration.Email address with greater than 16 bytes needtwo-set/get SMTP configuration. First 16 bytes arestored in first block selector and remaining bytesare stored in next block.Email addresses with fewer than 16 bytes areterminated with a null (00h) character and 00h areimplicitly padded to the remaining bytes byfirmware and stored in first block. When the Emailaddress is read back those bytes shall be returnedas 0.Subject(Max number of blocks = 2)Message Content(Max number of blocks = 4)6 Get/Set the Subject of the mail.Data 1: N: E-mail subject string in ASCII, 32 bytesmax. Names with fewer than 32 bytes areterminated with a null (00h) character and 00hpadded to the remaining bytes. When the Username is read back those bytes shall be returned as0.Block size is 16 bytes.7 Configure/Get the mail content of the Configurabledestination.Data 1: N: Message Content String in ASCII,64 bytes max.Block size is 16 bytes.126Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSIPMI Command InterfaceSender Email Address *(Max no of Blocks = 4)SMTP Host name *(Max no of Blocks = 2)ParameterParameterParameter DataNumber8 Configure the sender e-mail addressData 1: N: E-mail address String in ASCII, 64 bytesmax.Block size is 16 Bytes.Address with greater than 16 bytes need more thanone set/get SMTP configuration.Names with fewer than 16 bytes are terminatedwith a null (00h) character and 00h padded to theremaining bytes. When the User name is read backthose bytes shall be returned as 0.9 Configure the SMTP host name.Data 1: N: E-mail address String in ASCII, 32 bytesmax.Block size is 16 bytesNames with fewer than 16 bytes are terminatedwith a null (00h) character and 00h padded to theremaining bytes. When the SMTP Host name isread back those padding bytes shall be returned as0.* Set selector is not applicable because these parameters are common for all Alert destinations.Both should be zero.Note: All SMTP alerts are sent to TCP port 25 on the destination machine.10.4 Completion CodesSome commands may implement other completion codes. These are defined in the IntelligentPlatform Management Interface Specification Second Generation v2.0, or if BMC specific, in thecommand tables above.Table 66. IPMI 2.0 Completion CodesCompletion Code00h08hC0hC1hC2hC3hC4hC5hC7hC8hC9hCAhCBhCChMeaningThe command was successfully completed.Used by RAS commands to indicate RAS sensor update is in progress.Node busy. The command could not be processed because command processing resources aretemporarily unavailable.Invalid command. Used to indicate an unrecognized or unsupported command.The command is invalid for the given LUN.Timeout while processing command. A response is not available.Out of space. The command could not be completed because of a lack of storage space requiredto execute the given command operation.The action was not performed due to a canceled or invalid reservation number.The command has the wrong number of data bytes.Too many data bytes for requested operation.One or more of the data bytes in a command is outside the range of valid values.Cannot return the number of requested data bytes.The request is for a nonexistent sensor in the BMCOne or more of the data bytes is an invalid value.Revision 1.1Intel ® Confidential 127

IPMI Command InterfaceIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSCompletion CodeCDhCEhD0hD1hD3hD4hFFhMeaningThe requested operation is not supported for the given sensor.Command not completed; a BMC peripheral did not respond.Command response could not be provided. SDR Repository in update mode.Command response could not be provided. Device in firmware update mode.Cannot deliver request to selected destination.Cannot execute command. Insufficient privilege level.Unspecified error.10.5 Command SupportThe information in Table 67 through Table 72 specifies the privilege level associated with eachcommand and whether the command is supported in operational and firmware transfer modes.The following restrictions apply to the commands:Only allowed over the system interfaceOnly available over local interface (system interface or IPMB)This section does not list the commands available on the SMM interface.Note: Per the Intelligent Platform Management Interface Specification Second Generation v2.0,unauthenticated, session-less interfaces, such as the system interface and IPMB, can supportany IPMI command unless otherwise specified.Table 67. Command Support Matrix, Network Function = Application – 06hCommand Name Cmd #Operational Mode PrivilegeGet Device ID 01h UserBroadcast Get Device ID 01h User 1Cold Reset 02h AdminGet Self Test Results 04h UserManufacturing Test On 05h AdminSet ACPI Power State 06h AdminGet ACPI Power State 07h UserReset Watchdog Timer 22h OperatorSet Watchdog Timer 24h OperatorGet Watchdog Timer 25h UserSet BMC Global Enables 2Eh Admin 2Get BMC Global Enables 2Fh UserClear Message Flags 30h Admin 2Get Message Flags 31h Admin 2Get Message 33h Admin 2Send Message 34h UserRead Event Message Buffer 35h Admin 2Get System GUID o 37h AnyGet Channel Authentication Capabilities 38h Any128Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSIPMI Command InterfaceCommand Name Cmd #Operational Mode PrivilegeGet Session Challenge 39h AnyActivate Session 3Ah AnySet Session Privilege Level 3Bh UserClose Session 3Ch AnyGet Session Info 3Dh UserGet AuthCode 3Fh OperatorSet Channel Access 40h AdminGet Channel Access 41h UserGet Channel Info 42h UserSet User Access 43h AdminGet User Access 44h OperatorSet User Name 45h AdminGet User Name 46h OperatorSet User Password 47h AdminActivate Payload 48h See Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Deactivate Payload 49h See Intelligent PlatformManagement InterfaceSpecification SecondGeneration v2.0Get Payload Activation Status 4Ah UserGet Payload Instance Info 4Bh UserSet User Payload Access 4Ch AdminGet User Payload Access 4Dh UserGet Channel Payload Support 4Eh UserGet Channel Payload Version 4Fh UserGet Channel OEM Payload Info 50h UserMaster Write-Read 52h OperatorGet Channel Cipher Suites 54h AnySuspend / Resume Payload Encryption 55h UserSet Channel Security Keys 56h AdminNotes:1. Only available via the IPMB interface.2. Only available via the system (SMS) interface.Revision 1.1Intel ® Confidential 129

IPMI Command InterfaceIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSTable 68. Command Support Matrix, Network Function = Chassis – 00hCommand Name Cmd #Operational Mode PrivilegeGet Chassis Capabilities 00h UserGet Chassis Status 01h UserChassis Control 02h Operator 1Set Chassis Capabilities 05h AdminSet Power Restore Policy 06h OperatorGet System Restart Cause 07h UserSet System Boot Options 08h OperatorGet System Boot Options 09h OperatorSet Front Panel Enables 0Ah AdminGet POH Counter 0Fh UserNote:1. The system can be powered up using the Chassis Control command at the user privilegelevel.Table 69. Command Support Matrix, Network Function = Sensor / Event – 04hCommand Name Cmd #Operational Mode PrivilegeGet Event Receiver 01h UserPlatform Event 02h OperatorSet Last Processed Event ID 14h AdminGet Last Processed Event ID 15h AdminAlert Immediate 16h AdminPET Acknowledge 17h AnyGet Sensor Reading Factors 23h UserSet Sensor Hysteresis 24h OperatorGet Sensor Hysteresis 25h UserSet Sensor Threshold 26h OperatorGet Sensor Threshold 27h UserSet Sensor Event Enable 28h OperatorGet Sensor Event Enable 29h UserRe-Arm Sensor Events 2Ah OperatorGet Sensor Event Status 2Bh UserGet Sensor Reading 2Dh UserSet Sensor Type 2Eh Not implemented.Set Sensor Reading and EventStatus30hOperatorTable 70. Command Support Matrix, Network Function = Storage – 0AhCommand Name Cmd #Operational Mode PrivilegeGet FRU Inventory Area Info 10h UserRead FRU Data 11h UserWrite FRU Data 12h OperatorGet SDR Repository Info 20h User130Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSIPMI Command InterfaceCommand Name Cmd #Operational Mode PrivilegeGet SDR Repository Allocation Info 21h UserReserve SDR Repository 22h UserGet SDR 23h UserPartial Add SDR 25h OperatorDelete SDR 26h OperatorClear SDR Repository 27h OperatorGet SDR Repository Time 28h UserRun Initialization Agent 2Ch OperatorGet SEL Info 40h UserGet SEL Allocation Info 41h UserReserve SEL 42h UserGet SEL Entry 43h UserAdd SEL Entry 44h OperatorPartial Add SEL Entry 45h OperatorDelete SEL Entry 46h OperatorClear SEL 47h OperatorGet SEL Time 48h UserSet SEL Time 49h OperatorTable 71. Command Support Matrix, Network Function = Transport – 0ChCommand Name Cmd #Operational Mode PrivilegeSet LAN Configuration 01h AdminGet LAN Configuration 02h OperatorGet IP / UDP / RMCP Statistics 04h UserSet Serial Configuration 10h AdminGet Serial Configuration 11h OperatorSet Serial MUX 12h OperatorSet Serial Routing MUX 1Ch OperatorSOL 2.0 Activating 20h Not Supported.Set SOL 2.0 Configuration Parameters 21h AdminGet SOL 2.0 Configuration Parameters 22h OperatorTable 72. Command Support Matrix, Network Function = Intel General Application – 30hCommand Name Cmd #Operational Mode PrivilegeGet SM Signal 14h UserSet SM Signal 15h OperatorSet Processor TControl 2Ch OperatorResolve IP Address 40h OperatorGet Advanced Support Configuration 71h AnyRevision 1.1Intel ® Confidential 131

IPMI Command InterfaceIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSTable 73. Command Support Matrix, Network Function = Immediate Firmware Update – 08hCommand NameCmdOperational Mode PrivilegeFirmware UpdateNumberEnter Firmware Transfer Mode 00h Admin XFirmware Program 01h – XFirmware Read 02h – XGet Firmware Range Checksum 03h – XExit Firmware Transfer Mode 04h – XSet Program Segment 05h – XEnter Boot Recovery Mode 07h Admin X132Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management ControllerRMCP+ Command Interface11. RMCP+Command InterfaceTable 74. BMC RMCP+ / RAKP Messages6-bitNumber10h11h12h13h14h15hCommandRMCP+ OpenSessionRequestRMCP+ OpenSessionResponseRAKPMessage 1RAKPMessage 2RAKPMessage 3RAKPMessage 4Session Setup Payload TypesRequest, Response DataDefined by the Intelligent PlatformManagement Interface SpecificationSecond Generation v2.0Defined by the Intelligent PlatformManagement Interface SpecificationSecond Generation v2.0Defined by the Intelligent PlatformManagement Interface SpecificationSecond Generation v2.0Defined by the Intelligent PlatformManagement Interface SpecificationSecond Generation v2.0Defined by the Intelligent PlatformManagement Interface SpecificationSecond Generation v2.0Defined by the Intelligent PlatformManagement Interface SpecificationSecond Generation v2.0DescriptionThe remote console sends this RMCP+ messageto the managed system to open a protectedsession.This command is sent from the BMC to theclient. It is not accepted by the BMC.A remote console sends this RAKP message tothe managed system to begin the sessionauthentication process.This command is sent from the BMC to theclient. It is not accepted by the BMC.A remote console sends this RAKP message toa managed system in response to the receipt ofan RAKP Message 2.This command is sent from the BMC to theclient. It is not accepted by the BMC.Revision 1.0Intel ® Confidential 133

SMM CommandsIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPS12. SMM CommandsThe BMC supports the following commands via the SMM interface.Table 75. SMM CommandsNetFnCommandDescriptionDetailNumberApp (06h) 01h Get Device ID Per the Intelligent PlatformManagement Interface SpecificationSecond Generation v2.0.App (06h) 06h Set ACPI Power State Per the Intelligent PlatformManagement Interface SpecificationSecond Generation v2.0.App (06h) 07h Get ACPI Power State Per the Intelligent PlatformManagement Interface SpecificationSecond Generation v2.0.App (06h) 2Eh Set BMC Global Enables Per the Intelligent PlatformManagement Interface SpecificationSecond Generation v2.0.App (06h) 2Fh Get BMC Global Enables Per the Intelligent PlatformManagement Interface SpecificationSecond Generation v2.0.App (06h) 30h Clear Message Flags Per the Intelligent PlatformManagement Interface SpecificationSecond Generation v2.0.App (06h) 31h Get Message Flags Per the Intelligent PlatformManagement Interface SpecificationSecond Generation v2.0.App (06h) 35h Read Event Message Buffer Per the Intelligent PlatformManagement Interface SpecificationSecond Generation v2.0.App (06h) 3Dh Get Session Info Per the Intelligent PlatformManagement Interface SpecificationSecond Generation v2.0.App (06h) 4Ah Get Payload ActivationStatusPer the Intelligent PlatformManagement Interface SpecificationSecond Generation v2.0.App (06h) 4Bh Get Payload Instance Info Per the Intelligent PlatformManagement Interface SpecificationSecond Generation v2.0.Sensor (04h) 02h Platform Event Per the Intelligent PlatformManagement Interface SpecificationSecond Generation v2.0.Storage (0Ah) 44h Add SEL Entry Per the Intelligent PlatformManagement Interface SpecificationSecond Generation v2.0.Storage (0Ah) 48h Get SEL Time Per the Intelligent PlatformManagement Interface SpecificationSecond Generation v2.0.Storage (0Ah) 49h Set SEL Time Per the Intelligent PlatformManagement Interface SpecificationSecond Generation v2.0.134Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSSMM CommandsNetFnTransport(0Ch)CommandNumber22hDescriptionGet SOL ConfigurationParametersOEM (30h) 57h Set Fault IndicationOEM ( 30h) 89h Set Fan controlConfigurationOEM ( 30h) 25h Acquire System ResourceDetailPer the Intelligent PlatformManagement Interface SpecificationSecond Generation v2.0.Revision 1.0Intel ® Confidential 135

SensorsIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPS13. SensorsSpecific server boards may only implement a sub-set of sensors and / or may include additionalsensors. The system-specific details of supported sensors and events are described in the EPSfor the specific server board or system. The actual sensor name associated with a sensornumber may vary between server boards or systems.13.1 Sensor Type CodesThe following tables list the sensor identification numbers and information regarding the sensortype, name, what thresholds are supported, assertion and deassertion information, and a briefdescription of what the sensor is used for. Refer to the Intelligent Platform ManagementInterface Specification, Version 2.0, for sensor and event / reading-type table information.Sensor Type- The sensor type references the values in the sensor type codes table in theIntelligent Platform Management Interface Specification Second Generation v2.0. Itprovides the context to interpret the sensor.Event / Reading Type- The event / reading type references values from the event / reading type coderanges and the generic event / reading type code tables in the Intelligent PlatformManagement Interface Specification Second Generation v2.0. Digital sensors are aspecific type of discrete sensors that only have two states.Event Thresholds / Triggers- The following event thresholds are supported for threshold type sensors.[u,l][nr,c,nc] upper non-recoverable, upper critical, upper non-critical, lower nonrecoverable,lower critical, lower non-criticaluc, lcupper critical, lower critical- Event triggers are supported event generating offsets for discrete type sensors. Theoffsets can be found in the generic event / reading type code or sensor type codetables in the Intelligent Platform Management Interface Specification SecondGeneration v2.0, depending on whether the sensor event / reading type is generic ora sensor specific response.Assertion/Deassertion- Assertion and deassertion indicators reveal the type of events this sensor generates:As: AssertionDe: DeassertionReadable Value / Offsets- Readable value indicates the type of value returned for threshold and other nondiscretetype sensors.- Readable offsets indicate the offsets for discrete sensors that are readable via theGet Sensor Reading command. Unless otherwise indicated, event triggers arereadable. Readable offsets consist of the reading type offsets that do not generateevents.136Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management t Controller EPSSensorsEvent Data- This is the data that is included in an event message generated by the associatedsensor.- For threshold-based sensors, these abbreviations are used:R: Reading valueT: Threshold valueRearm Sensors- The rearm is a request for the event status for a sensor to be rechecked and updatedupon a transition between good and bad states. Rearming the sensors can be donemanually or automatically. This column indicates the type supported by the sensor.These abbreviations are used in the comment column to describe a sensor:A: Auto-rearmM: Manual rearmI: Rearm by init agentDefault Hysteresis- The hysteresis setting applies to all thresholds of the sensor. This column providesthe count of hysteresis for the sensor, which can be 1 or 2 (positive or negativehysteresis).Criticality- Criticality is a classification of the severity and nature of the condition. It also controlsthe behavior of the front panel status LED.Standby- Some sensors operate on standby power. These sensors may be accessed and / orgenerate events when the main (system) power is off, but AC power is present.Revision 1.0Intel ® Confidential 137

Sensors Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSTable 76. Emerald Ridge Sensors SupportedFull Sensor Name(Sensor name in SDR)Power Unit Status(Pwr Unit Status)Power Unit Redundancy(Pwr Unit Redund)Sensor #01h02hSensor TypePower Unit09hPower Unit09hEvent t /Reading TypeSensorSpecific6FhGeneric0BhEvent OffsetTriggers00 - Power down04 - A/C lost05 - Soft powercontrol failure06 - Power unitfailure00 - FullyRedundant01 - Redundancylost02 - Redundancydegraded03 - Nonredundant:sufficientresources.Transition fromfull redundantstate.04 – Nonredundant:sufficientresources.Transition frominsufficient state.05 - Nonredundant:insufficientresourcesContrib. To SystemStatusOKFatalOKDegradedDegradedDegradedDegradedFatalAsandDeAsandDeReadableEventRearmValue /DataOffsetsAssert/ De-assertStand-by– Trig Offset A YES– Trig Offset AYES138Intel Confidential Revision 1.1

Intel® Server System "Emerald "Ridge” Integrated Baseboard Management Controller EPS SensorsFull Sensor Name(Sensor name in SDR)IPMI Watchdog(IPMI Watchdog)Physical Security(Physical Scrty)Sensor #03h04hSensor TypeWatchdog 223hPhysicalSecurity05hEvent t /Reading TypeSensorSpecific6FhSensorSpecific6FhEvent OffsetTriggers06 – Redundant:degradedfromfully redundantstate.07 – Redundant:Transition fromnon-redundantstate.00 - Timerexpired, statusonly01 - Hard reset02 - Power down03 - Power cycle08 - TimerinterruptContrib. To SystemStatusDegradedDegradedOK As –ReadableValue /OffsetsEventDataTrig OffsetRearmAAssert/ De-assertStand-by00 - Chassisintrusion OK AsYESand – Trig Offset A04 - LAN leashlostOKDeYESFP Interrupt(FP NMI Diag Int)SMI Timeout(SMI Timeout)System Event Log(System Event Log)System Event(System Event)05h06h07h08hCriticalInterrupt13hSMI TimeoutF3hEventLoggingDisabled10hSystemEvent12hSensorSpecific6FhDigitalDiscrete03hSensorSpecific6FhSensorSpecific6Fh00 - Front panelNMI / diagnosticinterrupt01 – Stateasserted02 - Log areareset / cleared04 – PEF actionOK As – Trig Offset A –FatalAsandDe– Trig Offset A –OK As – Trig Offset A YESOKAs - Trig Offset A,I YESRevision 1.0 Intel ® Confidential 139

Sensors Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSFull Sensor Name(Sensor name in SDR)BB +1.1V IOH(BB +1.1V IOH)BB +1.8V AUX(BB +1.8V AUX)BB +3.3V(BB +3.3V)BB +3.3V STBY(BB +3.3V STBY)BB +12.0V(BB +12.0V)BB +1.1V VIO Proc1/2(BB +1.1V VIO P12)BB +1.1V VIO Proc3/4(BB +1.1V VIO P34)BB +1.8V IOH(BB +1.8V IOH)Baseboard Temperature 1(Baseboard Temp1)Front Panel Temperature(Front Panel Temp)IOH 1 Thermal Margin(IOH1 Thrm Margin)IO Riser Temperature(IOR Temp)Sensor #10h15h16h17h1Bh1Dh1Eh1Fh20h21h22h25hSensor TypeVoltage02hVoltage02hVoltage02hVoltage02hVoltage02hVoltage02hVoltage02hVoltage02hTemperature01hTemperature01hTemperature01hTemperature01hEvent t /Reading TypeThreshold01hThreshold01hThreshold01hThreshold01hThreshold01hThreshold01hThreshold01hThreshold01hThreshold01hThreshold01hThreshold01hThreshold01hEvent OffsetTriggers[u,l] [c,nc][u,l] [c,nc][u,l] [c,nc][u,l] [c,nc][u,l] [c,nc][u,l] [c,nc][u,l] [c,nc][u,l] [c,nc][u,l] [c,nc][u,l] [c,nc][u] [c,nc][u] [c,nc]Contrib. To SystemStatusnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeReadableEventRearmValue /DataOffsetsAssert/ De-assertAsandDeStand-byAnalog R, T A –Analog R, T A YESAnalog R, T A –Analog R, T A YESAnalog R, T A –Analog R, T A –Analog R, T A –Analog R, T A –Analog R, T A YESAnalog R, T A YESAnalog R, T A –Analog R, T A –140Intel Confidential Revision 1.1

Intel® Server System "Emerald "Ridge” Integrated Baseboard Management Controller EPS SensorsFull Sensor Name(Sensor name in SDR)Baseboard Temperature 2(Baseboard Temp2)IOH 2 Thermal Margin(IOH2 Thrm Margin)Add In Card Temperature(Zone 2)(ADD IN Card Tmp2)BB +1.5V IOH(BB +1.5V IOH)BB +1.1V ME SB(BB +1.1V ME SB)BB +1.2V AUX BMC(BB +1.2V AUX BMC)BB +1.0V AUX NIC(BB +1.0V AUX NIC)BB +3V Vbat(BB +3V Vbat)System Fan 1(SYS Fan 1)System Fan 2(SYS Fan 2)System Fan 3(SYS Fan 3)System Fan 4(SYS Fan 4)Sensor #26h27h28h2Ah2Bh2Ch2Dh18h30h31h32h33hSensor TypeTemperature01hTemperature01hTemperature01hVoltage02hVoltage02hVoltage02hVoltage02hVoltage02hFan04hFan04hFan04hFan04hEvent t /Reading TypeThreshold01hThreshold01hThreshold01hThreshold01hThreshold01hThreshold01hThreshold01hThreshold01hThreshold01hThreshold01hThreshold01hThreshold01hEvent OffsetTriggers[u,l] [c,nc][u] [c,nc][u] [c,nc][u,l] [c,nc][u,l] [c,nc][u,l] [c,nc][u,l] [c,nc][u,l] [c,nc][l] [c,nc][l] [c,nc][l] [c,nc][l] [c,nc]Contrib. To SystemStatusnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatal 2nc = Degradedc = Non-fatal 2nc = Degradedc = Non-fatal 2nc = Degradedc = Non-fatal 2AsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeReadableEventRearmValue /DataOffsetsAssert/ De-assertAsandDeStand-byAnalog R, T A YESAnalog R, T A –Analog R, T A –Analog R, T A –Analog R, T A –Analog R, T A YESAnalog R, T A YESAnalog R, T A –Analog R, T M–Analog R, T M–Analog R, T M–Analog R, T M–Revision 1.0 Intel ® Confidential 141

Sensors Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSFull Sensor Name(Sensor name in SDR)System Fan 5(SYS Fan 5)System Fan 6(SYS Fan 6)System Fan 7(SYS Fan 7)System Fan 8(SYS Fan 8)Sensor #34h35h36h37hSensor TypeFan04hFan04hFan04hFan04hEvent t /Reading TypeThreshold01hThreshold01hThreshold01hThreshold01hEvent OffsetTriggers[l] [c,nc][l] [c,nc][l] [c,nc][l] [c,nc]Contrib. To SystemStatusnc = Degradedc = Non-fatal 2nc = Degradedc = Non-fatal 2nc = Degradedc = Non-fatal 2nc = Degradedc = Non-fatal 2AsandDeAsandDeAsandDeReadableValue /OffsetsEventDataRearmAnalog R, T MAnalog R, T MAnalog R, T MAnalog R, T MAssert/ De-assertAsandDeStand-by––––Fan 1 Present Sensor(Fan 1 Present)40hFan04hGeneric08h01 - DeviceinsertedOKAsandDe-TriggeredOffsetAuto–Fan 2 Present Sensor(Fan 2 Present)41hFan04hGeneric08h01 - DeviceinsertedOKAsandDe-TriggeredOffsetAuto–142Intel Confidential Revision 1.1

Intel® Server System "Emerald "Ridge” Integrated Baseboard Management Controller EPS SensorsFull Sensor Name(Sensor name in SDR)Sensor #Sensor TypeEvent t /Reading TypeEvent OffsetTriggersContrib. To SystemStatusReadableValue /OffsetsEventDataRearmAssert/ De-assertStand-byFan 3 Present Sensors(Fan 3 Present)42hFan04hGeneric08h01 - DeviceinsertedOKAsandDe-TriggeredOffsetAuto–Fan 4 Present Sensors(Fan 4 Present)43hFan04hGeneric08h01 - DeviceinsertedOKAsandDe-TriggeredOffsetAuto–Fan 5 Present Sensor(Fan 5 Present)44hFan04hGeneric08h01 - DeviceinsertedOKAsandDe-TriggeredOffsetAuto–Fan 6 Present Sensor(Fan 6 Present)45hFan04hGeneric08h01 - DeviceinsertedOKAsandDe-TriggeredOffsetAuto–Revision 1.0 Intel ® Confidential 143

Sensors Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSFull Sensor Name(Sensor name in SDR)Sensor #Sensor TypeEvent t /Reading TypeEvent OffsetTriggersContrib. To SystemStatusReadableValue /OffsetsEventDataRearmAssert/ De-assertStand-byFan Redundancy(Fan Redundancy)46hFan04hGeneric0Bh00 - FullyRedundant(formerly“RedundancyRegained”)OKAsandDe– Trig Offset A01 - RedundancylostDegraded03 - Nonredundant:SufficientResources fromRedundantDegraded04 - Nonredundant:SufficientResources fromInsufficientResourcesDegraded144Intel Confidential Revision 1.1

Intel® Server System "Emerald "Ridge” Integrated Baseboard Management Controller EPS SensorsFull Sensor Name(Sensor name in SDR)Sensor #Sensor TypeEvent t /Reading TypeEvent OffsetTriggers05 - Nonredundant:insufficientresources.Contrib. To SystemStatusReadableValue /OffsetsEventDataRearmAssert/ De-assertStand-byFatalFan 7 Present Sensors(Fan 7 Present)47hFan04hGeneric08h01 - DeviceinsertedOKAsandDe-TriggeredOffsetAuto–Revision 1.0 Intel ® Confidential 145

Sensors Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSFull Sensor Name(Sensor name in SDR)Sensor #Sensor TypeEvent t /Reading TypeEvent OffsetTriggersContrib. To SystemStatusReadableValue /OffsetsEventDataRearmAssert/ De-assertStand-byFan 8 Present Sensors(Fan 8 Present)48hFan04hGeneric08h01 - DeviceinsertedOKAsandDe-TriggeredOffsetAuto–00 – Presence OK01 - Failure DegradedPower Supply 1 Status(PS1 Status)Power Supply 2 Status(PS2 Status)Power Supply 1AC Power Input(PS1 Power In)Power Supply 2AC Power Input(PS2 Power In)Power Supply 1 +12V % ofMaximum Current Output(PS1 Curr Out %)50h51h52h53h54hPowerSupply08hPowerSupply08hOther Units0BhOther Units0BhCurrent03hSensorSpecific6FhSensorSpecific6FhThreshold01hThreshold01hThreshold01h02 – PredictiveFailureDegraded03 - A/C lost Degraded06 –ConfigurationerrorOK00 - Presence OK01 - Failure Degraded02 – PredictiveFailureDegraded03 - A/C lost Degraded06 –Configurationerror[u] [c,nc][u] [c,nc][u] [c,nc]OKnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalAsandDeAsandDeAsandDeAsandDeAsandDe– Trig Offset AYES– Trig Offset AYESAnalog R, T A YESAnalog R, T A YESAnalog R, T A YES146Intel Confidential Revision 1.1

Intel® Server System "Emerald "Ridge” Integrated Baseboard Management Controller EPS SensorsFull Sensor Name(Sensor name in SDR)Power Supply 2 +12V % ofMaximum Current Output(PS2 Curr Out %)Power Supply 1Temperature in ActiveMode(PS1 Temperature)Power Supply 2Temperature in ActiveMode(PS2 Temperature)Power Supply 3Temperature in ActiveMode(PS3 Temperature)Power Supply 4Temperature in ActiveMode(PS4 Temperature)Processor 1 Status(P1 Status)Processor 2 Status(P2 Status)Processor 1 ThermalMargin(P1 Therm Margin)Processor 2 ThermalMargin(P2 Therm Margin)Sensor #55h56h57h5Eh5Fh60h61h62h63hSensor TypeCurrent03hTemperature01hTemperature01hTemperature01hTemperature01hProcessor07hProcessor07hTemperature01hTemperature01hEvent t /Reading TypeThreshold01hThreshold01hThreshold01hThreshold01hThreshold01hSensorSpecific6FhSensorSpecific6FhThreshold01hThreshold01hEvent OffsetTriggers[u] [c,nc][u] [c,nc][u] [c,nc][u] [c,nc][u] [c,nc]01 - Thermal trip FatalContrib. To SystemStatusnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalAsandDeAsandDeAsandDeAsandDeAsandDeAsandDe07 - Presence OK As01- Thermal trip FatalAsandDe07 - Presence OK AsReadableValue /OffsetsEventDataRearmAssert/ De-assertStand-byAnalog R, T A YESAnalog R, T AAnalog R, T AAnalog R, T AAnalog R, T A– Trig Offset M– Trig Offset M– – – Analog – – –– – – Analog – – –YESYESRevision 1.0 Intel ® Confidential 147

Sensors Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSFull Sensor Name(Sensor name in SDR)Processor 1 ThermalControl %(P1 Therm Ctrl %)Processor 2 ThermalControl %(P2 Therm Ctrl %)Processor 1 VRD Temp(P1 VRD Hot)Processor 2 VRD Temp(P2 VRD Hot)Catastrophic Error(CATERR)CPU Missing(CPU Missing)IOH 1Thermal Trip(IOH1 Thrm Trip)IOH 2 Thermal Trip(IOH2 Thrm Trip)Processor 3 Status(P3 Status)Processor 4 Status(P4 Status)Sensor #64h65h66h67h68h69h6Ah6Bh6Ch6DhSensor TypeTemperature01hTemperature01hTemperature01hTemperature01hProcessor07hProcessor07hTemperature01hTemperature01hProcessor07hProcessor07hEvent t /Reading TypeThreshold01hThreshold01hDigitalDiscrete05hDigitalDiscrete05hDigitalDiscrete03hDigitalDiscrete03hDigitalDiscrete03hDigitalDiscrete03hSensorSpecific6FhSensorSpecific6FhEvent OffsetTriggers[u] [c,nc][u] [c,nc]01 - Limitexceeded01 - Limitexceeded01 – StateAsserted01 – StateAsserted01 – StateAsserted01 – StateAssertedContrib. To SystemStatusnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalFatalFatalNon-fatalFatalFatalFatal01 - Thermal trip FatalAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDe07 - Presence OK As01- Thermal trip FatalAsandDe07 - Presence OK AsReadableEventRearmValue /DataOffsetsAssert/ De-assertStand-byAnalog Trig Offset A –Analog Trig Offset A –– Trig Offset M –– Trig Offset M –– Trig Offset M –– Trig Offset M –– Trig Offset M –– Trig Offset M –– Trig Offset M YES– Trig Offset M YES148Intel Confidential Revision 1.1

Intel® Server System "Emerald "Ridge” Integrated Baseboard Management Controller EPS SensorsFull Sensor Name(Sensor name in SDR)Processor 3 ThermalMargin(P3 Therm Margin)Processor 4 ThermalMargin(P4 Therm Margin)Processor 3 ThermalControl %(P3 Therm Ctrl %)Processor 4 ThermalControl %(P4 Therm Ctrl %)Processor 3 VRD Temp(P3 VRD Hot)Processor 4 VRD Temp(P4 VRD Hot)Power Supply 3 Status(PS3 Status)Power Supply 4 Status(PS4 Status)Sensor #6Eh6Fh74h75h76h77h80h81hSensor TypeTemperature01hTemperature01hTemperature01hTemperature01hTemperature01hTemperature01hPowerSupply08hPowerSupply08hEvent t /Reading TypeThreshold01hThreshold01hThreshold01hThreshold01hDigitalDiscrete05hDigitalDiscrete05hSensorSpecific6FhSensorSpecific6FhEvent OffsetTriggersContrib. To SystemStatusReadableValue /OffsetsEventDataRearm– – – Analog – – –– – – Analog – – –[u] [c,nc][u] [c,nc]01 - Limitexceeded01 - Limitexceedednc = Degradedc = Non-fatalnc = Degradedc = Non-fatalFatalFatal00 – Presence OK01 - Failure Degraded02 – PredictiveFailureDegraded03 - A/C lost Degraded06 –ConfigurationerrorOK00 - Presence OK01 - Failure Degraded02 – PredictiveFailureDegraded03 - A/C lost Degraded06 –ConfigurationerrorOKAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAnalog Trig Offset A –Analog Trig Offset A –– Trig Offset M –– Trig Offset M –Assert/ De-assertStand-by– Trig Offset A YES– Trig Offset A YESRevision 1.0 Intel ® Confidential 149

Sensors Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSFull Sensor Name(Sensor name in SDR)Power Supply 3AC Power Input(PS3 Power In)Power Supply 4AC Power Input(PS4 Power In)Power Supply 3 +12V % ofMaximum Current Output(PS3 Curr Out %)Power Supply 4 +12V % ofMaximum Current Output(PS4 Curr Out %)Power Supply 1Temperature in StandbyMode(PS1_Temp_STBY)Power Supply 2Temperature in StandbyMode(PS2_Temp_STBY)Power Supply 3Temperature in StandbyMode(PS3_Temp_STBY)Power Supply 4Temperature in StandbyMode(PS4_Temp_STBY)Power Supply 1 Fan failurestatus 1-4(PS1 Fan X, X=1,2,3,4)Power Supply 2 Fan failurestatus 1-4(PS2 Fan X, X=1,2,3,4)Sensor #82h83h84h85h8Ah8Bh8Ch8Dh90h-93h94h-97hSensor TypeOther Units0BhOther Units0BhCurrent03hCurrent03hTemperature01hTemperature01hTemperature01hTemperature01hFan04hFan04hEvent t /Reading TypeThreshold01hThreshold01hThreshold01hThreshold01hThreshold01hThreshold01hThreshold01hThreshold01h“Digital”Discrete03h“Digital”Discrete03hEvent OffsetTriggers[u] [c,nc][u] [c,nc][u] [c,nc][u] [c,nc][u] [c,nc][u] [c,nc][u] [c,nc][u] [c,nc]01h –- Stateasserted01h –- StateassertedContrib. To SystemStatusnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalNon-FatalNon-FatalAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeReadableEventRearmValue /DataOffsetsAssert/ De-assertStand-byAnalog R, T A YESAnalog R, T A YESAnalog R, T A YESAnalog R, T A YESAnalog R, T A YES 1Analog R, T A YES 1Analog R, T A YES 1Analog R, T A YES 1– R, T M –– R, T M –150Intel Confidential Revision1.1

Intel® Server System "Emerald "Ridge” Integrated Baseboard Management Controller EPS SensorsFull Sensor Name(Sensor name in SDR)Power Supply 3 Fan failurestatus 1-4(PS3 Fan X, X=1,2,3,4)Power Supply 4 Fan failurestatus 1-4(PS4 Fan X, X=1,2,3,4)DIMM AggregateTemperature 1_2 ( DIMMAgg Tmp 1_2)DIMM AggregateTemperature 3_4( DIMMAgg Tmp 3_4)DIMM AggregateTemperature 5_6( DIMMAgg Tmp 5_6)DIMM AggregateTemperature 7_8( DIMMAgg Tmp 7_8)Memory Buffer AggregateTemperature 1_2 ( MemBuf Tmp 1_2 )Memory Buffer AggregateTemperature 3_4 ( MemBuf Tmp 3_4 )Memory Buffer AggregateTemperature 5_6 ( MemBuf Tmp 5_6 )Memory Buffer AggregateTemperature 7_8 ( MemBuf Tmp 7_8 )Memory Riser 1 PowerFailure (‘MemRsr 1PWRFAIL')Memory Riser 2 PowerFailure (‘MemRsr 2PWRFAIL')Sensor #98h-9Bh9Ch-9FhA0hA1hA2hA3hA4hA5hA6hA7hB0hB1hSensor TypeFan04hFan04hTemperature01hTemperature01hTemperature01hTemperature01hTemperature01hTemperature01hTemperature01hTemperature01hVoltage02hVoltage02hEvent t /Reading Type“Digital”Discrete03h“Digital”Discrete03hThreshold01hThreshold01hThreshold01hThreshold01hThreshold01hThreshold01hThreshold01hThreshold01hDigitalDiscrete 03hDigitalDiscrete 03hEvent OffsetTriggers01h –- Stateasserted01h –- Stateasserted[u, l] [c,nc][u, l] [c,nc][u, l] [c,nc][u, l] [c,nc][u, l] [c,nc][u, l] [c,nc][u, l] [c,nc][u, l] [c,nc]01 – Stateasserted01 – StateassertedContrib. To SystemStatusNon-FatalNon-Fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalFatalFatalAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAssert/ De-assertAsandDeReadableValue /OffsetsEventDataRearmStand-by– R, T M –– R, T M –Analog R, T A -Analog R, T A -Analog R, T A -Analog R, T A -Analog R, T A -Analog R, T A -Analog R, T A -Analog R, T A -- Trig Offset A YES- Trig Offset A YESRevision 1.0 Intel ® Confidential 151

Sensors Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSFull Sensor Name(Sensor name in SDR)Memory Riser 3 PowerFailure (‘MemRsr 3PWRFAIL')Memory Riser 4 PowerFailure (‘MemRsr 4PWRFAIL')Memory Riser 5 PowerFailure (‘MemRsr 5PWRFAIL')Memory Riser 6 PowerFailure (‘MemRsr 6PWRFAIL')Memory Riser 7 PowerFailure (‘MemRsr 7PWRFAIL')Memory Riser 8 PowerFailure (‘MemRsr 8PWRFAIL')PLD-Based Power ThrottleSensor (Power Throttled)BB VCORE CPU1(BB VCORE CPU1)BB VCORE CPU2(BB VCORE CPU2)BB VCACHE CPU1(BB VCACHE CPU1)BB VCACHE CPU2(BB VCACHE CPU2)BB +3.3V AUX(BB +3.3V AUX)Sensor #B2hB3hB4hB5hB6hB7hC0hD0hD1hD2hD3hD4hSensor TypeVoltage02hVoltage02hVoltage02hVoltage02hVoltage02hVoltage02hOEM SensorF3hVoltage02hVoltage02hVoltage02hVoltage02hVoltage02hEvent t /Reading TypeDigitalDiscrete 03hDigitalDiscrete 03hDigitalDiscrete 03hDigitalDiscrete 03hDigitalDiscrete 03hDigitalDiscrete 03hGeneric‘Digital”Discrete 03hThreshold01hThreshold01hThreshold01hThreshold01hThreshold01hEvent OffsetTriggers01 – Stateasserted01 – Stateasserted01 – Stateasserted01 – Stateasserted01 – Stateasserted01 – Stateasserted01h –- Stateasserted[u,l] [c,nc][u,l] [c,nc][u,l] [c,nc][u,l] [c,nc][u,l] [c,nc]Contrib. To SystemStatusFatalFatalFatalFatalFatalFatalFatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAsandDeAssert/ De-assertAsandDeReadableValue /OffsetsEventDataRearmStand-by- Trig Offset A YES- Trig Offset A YES- Trig Offset A YES- Trig Offset A YES- Trig Offset A YES- Trig Offset A YES– R, T M –Analog R, T A –Analog R, T A –Analog R, T A _Analog R, T A –Analog R, T A _152Intel Confidential Revision 1.1

Intel® Server System "Emerald "Ridge” Integrated Baseboard Management Controller EPS SensorsFull Sensor Name(Sensor name in SDR)BB VCORE CPU3(BB VCORE CPU3)BB VCORE CPU4(BB VCORE CPU4)BB VCACHE CPU3(BB VCACHE CPU3)BB VCACHE CPU4(BB VCACHE CPU4)Sensor #D5hD6hD7hD8hSensor TypeVoltage02hVoltage02hVoltage02hVoltage02hNote : This sensor only available in standby mode.Event t /Reading TypeThreshold01hThreshold01hThreshold01hThreshold01hEvent OffsetTriggers[u,l] [c,nc][u,l] [c,nc][u,l] [c,nc][u,l] [c,nc]Contrib. To SystemStatusnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalnc = Degradedc = Non-fatalAsandDeAsandDeAsandDeReadableEventRearmValue /DataOffsetsAnalog R, T A –Analog R, T A _Analog R, T A –Analog R, T A _Assert/ De-assertAsandDeStand-byRevision 1.0 Intel ® Confidential 153

錯 誤 ! 尚 未 定 義 樣 式 。EPS14. Chassis sis ManagementIntel® Server System "Emerald Ridge” Integrated Baseboard Management ControllerThis section provides a description of chassis management support for chassis used withServer Boards that use the Intel ® Chipset.14.1 BMC Chassis ManagementThese elements are common to the Server Chassis used for Server Boards that use the Intel ®Chipset:Power on / off button: Also serves as system shut-down to soft-power off mode (S5)request button under ACPI.System reset button.System identify button: Pressing this button toggles the state of the Chassis ID LED.Chassis ID LED: Provides a way to identify a system to be serviced, or that is in theprocess of being serviced. The LED state toggles when the system identification buttonhas been pressed. It can also be turned on and off by sending commands to the BMC.Diagnostic interrupt: Also known as the control panel NMI. It is a button with hiddenaccess.Power on LED: Also used to indicate system sleep state.System status LED: Indicates normal, degraded, non-critical, and critical conditionsdetected by the system management sub-system.Consolidated drive status LED: Located on the control panel, this LED serves twopurposes. It indicates drive activity and provides an indication when one or more fixeddrives or drives on the hot-swap backplane have a fault condition asserted.Fan Fault LED: Indicates a fan failure. It is associated with each fan. A fan fault LEDlights if the associated fan tach sensor has a lower critical threshold event statusasserted. Fan tach sensors are manual rearm sensors. Once the lower critical thresholdis crossed, the LED remains lit until the sensor is rearmed. These sensors are rearmedat system DC power-on and system reset.Global Fan Fault LED: Located on the control panel, it lights up when one or moresystem fan fault asserted.154Intel ConfidentialRevision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPS 錯 誤 ! 尚 未 定 義 樣 式 。14.1.1 Server Chassis Support for QSSC-S4RS4RThe following Server Chassis are used with Server Boards with the Intel ® Chipset.Table 77. Server Chassis SupportServer ChassisROW Entry SKUNon-RedundantCoolingROW EnterpriseSKURedundantCoolingChassis-specific specific Server Management Features Non-redundant cooling: Redundant cooling: Eight chassis fans whichare hot swappable, technically it is 7+1 fancooling solution in which we can tolerate onlyone fan failingChassis-dependent Sensors Managed by BMC Four fan tachometer sensors One front panel temperature sensor One power unit redundancy sensor Eight fan tachometer sensors One fan unit redundancy sensor One front panel temperature sensor One power unit redundancy sensorThe following Power redundancy combinations are supported for both the SKUs Redundant power: Two power supply modules which are manageable, 850W 1+1, 2+1, 2+2 and 3+1Configuration Non- redundant power: 850W 1+0, 2+0 and 3+0 Configuration supported, 4+0 are not supported.The same device may drive multiple PWM signals. The following table describes FAN domainsfor Emerald Ridge Server Chassis:Revision 1.0Intel ® Confidential 155

錯 誤 ! 尚 未 定 義 樣 式 。 Intel® Server System "Emerald Ridge” Integrated Baseboard Management ControllerEPSTable 78. Fan Mapping TableServer ChassisFanDomainMajor Components CooledTemperature SensorsFan0• Memory Riser 1 and 2• CPU1• IOH1• Add in Card Zone 1• DIMM Aggregate Temperature 1_2(Sensor #A0h),• Memory Buffer Aggregate Temperature1_2 (Sensor #A4h),• IOH1 thermal margin sensor (Sensor#22h),• Front Panel Temperature (Sensor #21h),• CPU 1 thermal margin (Sensor #62h),• IO riser temperature (Sensor #25h),• Baseboard Temperature 1(Sensor #20h)• ThddVR (Sensor #01, owned by 0xC0)System Fan 1 (Sensor #30h )System Fan 5 (Sensor #34h )1• DIMM Aggregate Temperature 3_4(Sensor #A1h),ROW EnterpriseLevel(Redundant Cooling)• Memory Riser 3 and 4• CPU2• IOH1• Add in Card Zone 1• Memory Buffer Aggregate Temperature3_4 ( (Sensor #A5h),• IOH1 thermal margin sensor (Sensor#22h),• Front Panel Temperature (Sensor #21h),• CPU 2 thermal margin (Sensor #62h),• IO riser temperature (Sensor #25h),• Baseboard Temperature 1(Sensor #20h)ThddVR (Sensor #01, owned by 0xC0)System Fan 2 (Sensor #31h)System Fan 6 (Sensor #35h)2• DIMM Aggregate Temperature 5_6(Sensor #A2h),• Memory Riser 5 and 6• CPU3• Memory Buffer Aggregate Temperature5_6 (Sensor #A6h),156Intel Confidential Revision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPS 錯 誤 ! 尚 未 定 義 樣 式 。Server ChassisFanDomainMajor Components Cooled• IOH2• Add in Card Zone 1Temperature Sensors• IOH2 thermal margin sensor (Sensor #27h),• Front Panel Temperature (Sensor #21h),• CPU 3 thermal margin (Sensor #6Eh),• Baseboard Temperature 2 (Sensor #26h),• ThddVR (Sensor #01, owned by 0xC0)FanSystem Fan 3 (Sensor #32h)System Fan 7 (Sensor #36h3• Memory Riser 7 and 8• CPU4• IOH2• Add in Card Zone 2• DIMM Aggregate Temperature 7_8(Sensor #A3h),• Memory Buffer Aggregate Temperature7_8 (Sensor #A7h),• IOH2 thermal margin sensor (Sensor#27h),• Front Panel Temperature (Sensor #21h),• CPU 4 thermal margin (Sensor #6Fh),• Baseboard Temperature 2 (Sensor #26h),• ThddVR (Sensor #01, owned by 0xC0)System Fan 4 (Sensor #33h) andSystem Fan 8 (Sensor #37h)4• HDD in HSBP/ Voltageregulators• Any sensors contributing for Domain 0 -3• HSBP Temp (Sensor #01)All PS Fan’s (PS Fan’s don’t have sensor number)0• Memory Riser 1 and 2• CPU1• IOH1• Add in Card Zone 1• DIMM Aggregate Temperature 1_2(Sensor #A0h),• Memory Buffer Aggregate Temperature1_2 (Sensor #A4h),• IOH1 thermal margin sensor (Sensor#22h),• Front Panel Temperature (Sensor #21h),• CPU 1 thermal margin (Sensor #62h),System Fan 1 (Sensor #30h)Revision 1.0 Intel ® Confidential 157

錯 誤 ! 尚 未 定 義 樣 式 。 Intel® Server System "Emerald Ridge” Integrated Baseboard Management ControllerEPSServer ChassisFanDomainMajor Components CooledTemperature Sensors• IO riser temperature (Sensor #25h),• Baseboard Temperature 1(Sensor #20h)• ThddVR (Sensor #01, owned by 0xC0)FanROW Entry Level(Non-RedundantCooling)1• Memory Riser 3 and 4,• CPU2• IOH1• Add in Card Zone 1• DIMM Aggregate Temperature 3_4(Sensor #A1h),• Memory Buffer Aggregate Temperature3_4 ( (Sensor #A5h),• IOH1 thermal margin sensor (Sensor#22h),• Front Panel Temperature (Sensor #21h),• CPU 2 thermal margin (Sensor #62h),• IO riser temperature (Sensor #25h),• Baseboard Temperature 1(Sensor #20h)ThddVR (Sensor #01, owned by 0xC0)System Fan 2 (Sensor #31h)2• Memory Riser 5 and 6,• CPU3,• IOH2,• Add in Card Zone 1• DIMM Aggregate Temperature 5_6(Sensor #A2h),• Memory Buffer Aggregate Temperature5_6 (Sensor #A6h),• IOH2 thermal margin sensor (Sensor#27h),• Front Panel Temperature (Sensor #21h),• CPU 3 thermal margin (Sensor #6Eh),• Baseboard Temperature 2 (Sensor #26h),• ThddVR (Sensor #01, owned by 0xC0)System Fan 3 (Sensor #32h)158Intel Confidential Revision 1.1

錯 誤 ! 尚 未 定 義 樣 式 。 EPS 錯 誤 ! 尚 未 定 義 樣 式 。Server ChassisFanDomainMajor Components CooledTemperature SensorsFan3• Memory Riser 7 and 8• CPU4• IOH2• Add in Card Zone 2• DIMM Aggregate Temperature 7_8(Sensor #A3h),• Memory Buffer Aggregate Temperature7_8 (Sensor #A7h),• IOH2 thermal margin sensor (Sensor#27h),• Front Panel Temperature (Sensor #21h),• CPU 4 thermal margin (Sensor #6Fh),• Baseboard Temperature 2 (Sensor #26h),ThddVR (Sensor #01, owned by 0xC0)System Fan 4 (Sensor #33h)4• HDD in HSBP/ Voltageregulators• Any sensors contributing for Domain 0 -3• HSBP Temp (Sensor #01)All PS Fan’s (PS Fan’s don’t have sensor number)Revision 1.0 Intel ® Confidential 159

Appendix A: OEM SDR RecordsIntel® Server System "Emerald Ridge” Integrated BaseboardManagement Controller EPSAppendix A: OEM SDR RecordsThis section describes the format for OEM SDR records supporting BMC features. OEM SDRrecords are used in cases where a platform needs to be configured depending on what typeof chassis or environment it is operating in.OEM SDR records are of type C0h. They contain a manufacturer ID and OEM data in therecord body. Intel OEM SDR records also have a sub-type field in them as the first byte ofthe OEM data that indicates the type of record following. The following table provides therecord sub-type number assignments.02h03h05h06h09h0Ah0BhValueTable 79. Intel OEM SDR Sub-typesPower unit mapFan speed controlFan redundancy mapSystem informationVoltage sensor scalingFan sensor scalingThermal profile dataDescription0Ch Tcontrol fan speed control SDR record, version 20Dh0Eh53h54h00h, 01h, 04h, 08h, 0Dh-52h, 55h-FFh ReservedNode Manager DiscoveryChassis ID and fan FRU LED mappingSDR version record (first letter of ‘SDR’)OEM SDR tag record160Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated BaseboardManagement Controller EPSAppendix A: OEM SDR RecordsPower Unit Map RecordA Power Unit Map SDR is an OEM SDR (type C0h) with the Intel manufacturer’s ID (343 =157h). The record contains a sub-type identifier (02h).A Power Unit Map contains information about the power supply sensor association andredundancy definition for the associated power unit sensor. The sensor numbers for thepower unit redundancy sensor and associated power supply sensors are provided.Table 80. Power Unit Map SDR Record FormatByteNameDescription0:2 OEM ID Intel manufacturers ID – 157h, little endian3 Record Subtype Value 02h. See Table 79.Power Unit Map Record4 Power Unit RedundancySensor Number5 Flags Bit [7:1] – Reserved6 Power SuppliesRequired7:N Power Supply SensorNumbersSensor number of the power unit redundancy sensor that this recordconfigures.Bit [0]1 = No supplies present that can be monitoredThe number of present and operational (not failed) power suppliesrequired for the power unit to be considered operational (n in n+m).Array of associated power supply sensor numbers.Table 81. Example Power Unit Map SDR Record for a 2+1 Power Sub-systemByteValue0:2 000157h Intel manufacturers ID – 157h3 02h Value 02h. See Table 79.DescriptionPower Unit Map Record4 41h Sensor number of the power unit redundancy sensor that this record configures.5 00h Bits [7:1]– ReservedBit [0]1 = No monitorable supplies present6 02h Two supplies required for operation7 3Dh Power supply 1 sensor number8 3Eh Power supply 2 sensor number9 3Fh Power supply 3 sensor numberRevision 1.0Intel ® Confidential 161

Appendix A: OEM SDR RecordsIntel® Server System "Emerald Ridge” Integrated BaseboardManagement Controller EPSFan Speed Control RecordAn OEM SDR (C0h) of sub-type 03h is a Fan Speed Control record. This record controls thedefault startup behavior of all system fans, before any intelligent control decisions are madeby the BMC.Table 82. Fan Speed Control Record FormatByteNameDescription0:2 OEM ID Intel manufacturers ID – 157h (Little Endian)3 RecordSubtypeFan SpeedControl RecordValue 03h (see Table 79)4 Normal Fan speed value to use while idle, as %, 00h-64h5 Sleep Fan speed value to use while in any sleep state, as %, 00h-64h6 Boost Fan speed value to use while boosted, as %, 00h-64h162Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated BaseboardManagement Controller EPSAppendix A: OEM SDR RecordsSystem Information RecordThis system information OEM SDR record provides upper-level software information anddoes not affect firmware operation.Table 83. System Information SDR Record FormatByteNameDescription0:2 OEM ID Intel manufacturers ID – 157h, little endian3 Record Subtype Value 06h (see Table 79)System InformationRecord4 Capabilities Provides capabilities of the system including platform / chassisBits 7:1 – ReservedBit 00b – System has no ID LED1b – System has ID LEDFan Redundancy Map RecordA fan redundancy map record contains information about the fan sensor association andredundancy definition for a fan redundancy sensor. The sensor number of the fanredundancy sensor is provided, as are all the sensor numbers for the associated fans. Therecord includes the number of required fans (N), the total number of fans (N+M) and the fanspeed event states that indicate a fault.Table 84. Fan Redundancy Map SDR Record FormatByteNameDescription0:2 OEM ID Intel manufacturers ID – 157h, little endian.3 Record Subtype Value 05h. See Table 79.Fan Redundancy Map Record4 Fan Redundancy SensorNumber5 Flags7:1 – Reserved0 – Persistently storedevent stateSensor number of the fan redundancy sensor that this recordconfigures.If bit 0 of the flags is set to a 1, the associated fan redundancy sensorstores its event assertion state persistently.6:7 Failed Event State Mask This mask defines the fan speed sensor event offsets that indicate thatthe associated fan has failed.8 Redundant Fan Count The number of fans (M) that can fail and the fan set still providesufficient cooling. The total number of fans in the set (N+M) isdetermined by the number of fan sub-records below and which ofthose fans are enabled.9:10Fan Speed Sensor #Fan Presence Sensor #This sub-record defines the sensors associated with one fan. If the fanis not a hot swap fan, the fan presence sensor field is set to 0. One ofthese sub-records should exist for each fan in the fan redundancy set.11:N Other fan sub-records One pair of sub-records for each fan in the set.Revision 1.0Intel ® Confidential 163

Appendix A: OEM SDR RecordsIntel® Server System "Emerald Ridge” Integrated BaseboardManagement Controller EPSVoltage Sensor Scaling SDR RecordThe scaling factor is to be used by the IBMC FW to convert 10-bit A/D converter values to avalue that fits inside the range of the normalized values in the 8-bit SDR table. The SDRtable needs to use 8-bit values to be compatible with IPMI specifications. The conversionworks by having FW multiply the 10-bit A/D reading by this value and then divide the resultby 10000. This would use 32-bit integer math supported by the ARM946ES core in the IBMC.Table 85. Voltage Sensor Scaling SDR FormatByteNameDescription0:2 OEM ID Intel manufacturers ID – 157h, little endian3 Record Subtype Value 09h. See Table 79.Voltage SensorScaling Record4 Number of scalingentries5:78:NVoltage sensor numberScale factor LSBScale factor MSBRemaining voltagesensor scaling groupsContains the number of scaling pair entries that followContains the hex byte for the voltage sensor numberScale factor least significant byteScale factor most significant byteContains the remaining three byte groupings for the voltage sensorscaling dataFan Sensor Scaling SDR RecordThis OEM record sub-type controls how the BMC reads and presents fan tachometer data toexternal interfaces.Table 86. Fan Sensor Scaling SDR FormatByteNameDescription0:2 OEM ID Intel manufacturers ID – 157h, little endian3 Record Subtype Value 0Ah. See Table 79.Fan Sensor Scaling Record4 Tachometer ReadingFormatBit field: Bit 0 = Fan 0 -> Bit 7 = Fan 70 = RPM, 1 = Raw Time Between Pulses5 Pulses Per Revolution Bit field: Bit 0 = Fan 0 -> Bit 7 = Fan 76:7 Fan 0 Max RPM 0000:FFFF8:9 Fan 1 Max RPM 0000:FFFF10:11 Fan 2 Max RPM 0000:FFFF12:13 Fan 3 Max RPM 0000:FFFF14:15 Fan 4 Max RPM 0000:FFFF16:17 Fan 5 Max RPM 0000:FFFF18:19 Fan 6 Max RPM 0000:FFFF20:21 Fan 7 Max RPM 0000:FFFF0 = 2 Pulses Per Revolution, 1 = 1Pulse Per Revolution164Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated BaseboardManagement Controller EPSAppendix A: OEM SDR RecordsThermal Profile Data SDR RecordThis record sub-type provides a customizable storage location for data describing thesystem’s thermal profile. The BIOS uses this information to configure system components aspart of the overall acoustics and thermals management scheme. These SDRs can becustomized per platform and per memory throttling mode. On platforms that support multipleprofiles, each Thermal Profile SDR can apply to one or more profiles for a given memorythrottling mode.Table 87. Thermal Profile Data SDR Record FormatByteNameDescription0:2 OEM ID Intel manufacturers ID – 157h, little endian3 Record Subtype Value 0BhThermal Profile Data Record4 Flags [7:2] – Reserved[1:0] – Memory throttling mode that this record is valid for0 = None supported1 = Open-loop thermal throttling (OLTT) - Not supported on EmeraldRidge2 = Close-loop thermal throttling (CLTT)3 = reserved5 Profile Support Bitmap This is a bitmask that indicates which fan control profiles that this recordis valid for. 0 means no profile is defined.[7][6][5][4][3][2][1][0]1 = Valid for profile 71 = Valid for profile 61 = Valid for profile 51 = Valid for profile 41 = Valid for profile 31 = Valid for profile 21 = Valid for profile 11 = Valid for profile 0Only Profiles 0-4 are supported on Emerald Ridge.6:N Thermal Profile Data Byte format defined by thermals team and / or the BIOS. May beformalized later. If the number of bytes in this field changes, the“Record Length” field and “_REC_LEN” tag above the SDR data mustbe adjusted to match.The maximum supported value of N is 63, for a maximum SDR bodysize of 64 bytes, with 58 bytes of thermal profile data. This constraint isimposed by the Intelligent Platform Management Interface SpecificationSecond Generation v2.0. A maximum-sized SDR can be retrieved overthe KCS-SMS interface, but it may be truncated over other interfaces.Please refer BIOS EPS for details on Thermal Profile Data bytes.Revision 1.0Intel ® Confidential 165

Appendix A: OEM SDR RecordsIntel® Server System "Emerald Ridge” Integrated BaseboardManagement Controller EPSFan Speed Control RecordThis record provides the following information to control the fans based on temperature:Control values to be used for normal, boost and sleep states for each fan control domain.Minimum fan control value to be applied to each fan domain.A mapping of the SDR to applicable fan profiles for a platform.Ramp-step and scan-rate at which a new contribution is added to the fan control domain.Temperature sensor owner, sensor number, and algorithm that contributes to the fandomain.A table that maps from raw sensor temperature readings to fan control PWM value inpercentages for stepwise linear type temperature sensor.PWM value in percentages and scan rate for a clamp-type temperature sensor.Table 89 shows the standard FSC SDR main record. An entire OEM SDR is limited to 64bytes, including a 5-byte header not shown here. This limits how many sub-records will fitinto one SDR.Table 88. Fan Sensor Scaling SDR FormatByteNameDescription0:2 OEM ID Intel manufacturer’s ID – 157h, little endian.3 Record Subtype Value 0Ch.Temperature Fan Control Record4 Record Version Version # of this specific SDR record subtype. Set to 01h for the formatdescribed in this document.5 Fan Control Domain Fan control domain number defined in the platform spec.6 Normal Control Value If no temperature sub-records present:The PWM value (% value – 0-100) to use when fans are commanded tobe at nominal speed.If only clamp type temperature sub-records present:The PWM value (% value – 0-100) base for contributions from theclamp type sub-records.In all cases:7 Boost Control Value If value is 0-100:Minimum PWM value (% value – 0-100) that the BMC must guaranteewill be in effect for the domain at all times.PWM value (%) to use when a fan has failed or a critical temperaturehas been detected.If value = 0xFF:Use Boost values from sub-record8 Ramp Step Max step up / down ramp (in %) when applying contribution.9 Scan Rate Number of scan cycles before applying the next ramp step.166Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated BaseboardManagement Controller EPSAppendix A: OEM SDR RecordsByte10NameFan Profile SupportTemperature Sensor Sub-recordsDescriptionFan Control Profile Support. This bitmask indicates which fan controlprofiles that this record is valid for.Bit[7] 1 = Valid for profile 7[6] 1 = Valid for profile 6[5] 1 = Valid for profile 5[4] 1 = Valid for profile 4[3] 1 = Valid for profile 3[2] 1 = Valid for profile 2[1] 1 = Valid for profile 1[0] 1 = Valid for profile 0Table 90 contains the stepwise linear FSC SDR sub-record format. The front panel thermalsensor and any board level thermal sensors will follow the stepwise linear control algorithmand all the parameters documented in the table below. Front panel and/or board temperaturesensors are intended to be used to thermally managed components without a temperaturesensor by setting minimum FSC.Table 91 shows the clamped algorithm FSC SDR sub-record. All component (CPU, chipset,memory, etc.) thermal sensors will follow the clamped algorithm and all the parametersdocumented in Table 91.Table 89. Temperature Fan Speed Control SDR Record Format, Version 2ByteNameDescription0:2 OEM ID Intel manufacturer’s ID – 157h, little endian.3 Record Subtype Value 0Ch.Temperature Fan Control Record4 Record Version Version # of this specific SDR record subtype. Set to 01h for the formatdescribed in this document.5 Fan Control Domain Fan control domain number defined in the platform spec.6 Normal Control Value If no temperature sub-records present:The PWM value (% value – 0-100) to use when fans are commanded tobe at nominal speed.If only clamp type temperature sub-records present:The PWM value (% value – 0-100) base for contributions from theclamp type sub-records.In all cases:7 Boost Control Value If value is 0-100:Minimum PWM value (% value – 0-100) that the BMC must guaranteewill be in effect for the domain at all times.PWM value (%) to use when a fan has failed or a critical temperaturehas been detected.If value = 0xFF:Use Boost values from sub-recordRevision 1.0Intel ® Confidential 167

Appendix A: OEM SDR RecordsIntel® Server System "Emerald Ridge” Integrated BaseboardManagement Controller EPSByteNameDescription8 Ramp Step Max step up / down ramp (in %) when applying contribution.9 Scan Rate Number of scan cycles before applying the next ramp step.10Fan Profile SupportTemperature Sensor Sub-recordsFan Control Profile Support. This bitmask indicates which fan controlprofiles that this record is valid for.Bit[7] 1 = Valid for profile 7[6] 1 = Valid for profile 6[5] 1 = Valid for profile 5[4] 1 = Valid for profile 4[3] 1 = Valid for profile 3[2] 1 = Valid for profile 2[1] 1 = Valid for profile 1[0] 1 = Valid for profile 0Additive type Temperature Sensor sub-recordTable 90. Stepwise Linear type Temperature Sensor sub-recordByteNameDescription0 Sensor Owner ID [7:1] – 7-bit I 2 C slave address or 7-bit system software ID1 Temperature SensorNumber2 Temp Sensor Failure ControlValue[0]0b = ID is IPMB slave address1b = ReservedSensor number of the temperature sensor associated with the fancontrol domain.This is the PWM value (% value – 0-100) to use if the giventemperature sensor is in update-in-progress state (indicating noupdate has occurred). If the sensor is in a disabled state, then thissub-record does not contribute to the fan speed control.4 Sleep Control Offset/Value Signed PWM offset (% value – 0-100) or value to use when thesystem is in S1 sleep state. This offset/value is applied as describedin the S1 sleep state support parameter description.5 Control Type and SleepState Support[7:6] S1 sleep state support0 = Ignore sub-record1 = Use sensor but apply sleep control offset to PWM output drivenfor this fan domain2 = Ignore sensor and apply sleep control offset to PWM outputdriven for this fan domain3 = Ignore sensor and use fixed sleep control PWM value as fandomain PWM contribution for this sub-record[5:3] - Reserved[2:0] - Control Type = 001 b (stepwise linear)168Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated BaseboardManagement Controller EPSAppendix A: OEM SDR RecordsByteName6 Temperature Info [7] – Reserved[6] – Domain MaximumDescriptionIf the domain maximum bit is set, then this sub-record provides themaximum nominal value that the fan control domain will be set to. Inthis case, multiple control pairs may be provided and are interpretedas a table of maximum PWM values for the associated temperature.[5:3] – Negative Hysteresis[2:0] – Positive HysteresisThis hysteresis is used only in the temperature fan control module.Behavior is unpredictable if multiple sub-records contributing to thesame fan control domain are configured as domain maximums.7 Control Pair Count (N) Count of temperature / control value pairs8 Temperature 1 The temperature at which a new contribution is required9 PWM % Value 1 PWM value (in %) to use for the fan control domain10-M Temp / PWM 2-N Up to N pairs of temperature / PWM values. These entries should bein order of increasing temperature, from low to high.M = Total number of bytes in this sub-record. Upper bound on thisvalue is 47; however this is constrained by the total number of bytesallowed for an OEM SDR record (64, including a 5 byte header).Temp/PWM pair’s minimal temperature resolution is 1° C. Integermultiplier of 1° C is allowed.When a multiple of 1C between two pairs are provided in SDR, FWlinearly interprets the PWM values at each 1° C inc rement. Forexample if the two pairs of SDR values are 25° C, 3 0% and 28° C,30%, FW interprets it into 25° C /30%, 26° C /30%, 27° C /30% and28° C /30%.The interpreted PWM values are rounded to the next higher integerPWM value if needed. For example, if an interpreted value is 53.3%,a 54% PWM will be usedTable 91. Clamp Type Temperature Sensor Sub-recordClamp type Temperature Sensor sub-recordByteNameDescription0 Sensor Owner ID [7:1] – 7-bit I 2 C slave address, or 7-bit system software ID[0]0b = ID is IPMB slave address1b = Reserved1 Temperature Sensor Number Sensor number of the temperature sensor associated with the fancontrol domain.2 Temp Sensor Failure ControlValueThis is the incremental PWM contribution (% value – 0-100) added tothe current PWM being driven for the applicable fan domain. Thisshould be used if the given temperature sensor is in update-inprogressstate (indicating no update has occurred). If the sensor is ina disabled state, then this sub-record does not contribute to the fanspeed control.3 Sleep Control Offset/Value Signed PWM offset (% value – 0-100) or value to use when thesystem is in S1 sleep state. This offset/value is applied as describedin the S1 sleep state support parameter description.Revision 1.0Intel ® Confidential 169

Appendix A: OEM SDR RecordsIntel® Server System "Emerald Ridge” Integrated BaseboardManagement Controller EPSByteName4 Control Type and Sleep StateSupport5 Temperature Info7 – Reserved6 – Reserved5:3 – Negative Hysteresis2:0 – Positive HysteresisDescription[7:6] S1 sleep state support0 = Ignore sub-record1 = Use sensor but apply sleep control offset to PWM output drivenfor this fan domain2 = Ignore sensor and apply sleep control offset to PWM outputdriven for this fan domain3 = Ignore sensor and use fixed sleep control PWM value as fandomain PWM contribution for this sub-record[5:3] Reserved[2:0] Control Type = 010b (clamp)[7:6] Reserved[5:3] Negative Hysteresis[2:0] Positive HysteresisThis hysteresis is used only in temperature fan controlmodule.6 Ramp Contribution (LSB) Least Signifigant Byte of Ramp Coefficent.7 Ramp Contribution (MSB) Most Signifigant Byte of Ramp Coefficent.8 Temperature The temperature at which clamp contribution required or temperatureoffset for TControl value.9 Clamp Flags[7:4] – CPU Number[3:1] – Reserved[0] – Temp Source1 = Use TControl0 = Use Fixed TempThis field configures the clamp temperature source.If fixed temp is selected, then the above temperature field is used asthe clamp value.If TControl is selected, then the value provided via the Set CPUTControl command for the indicated CPU is used. The actualtemperature control value is the TControl value plus the temperaturefield. Reserved bits should be set to 0.Table 92. Boost value Sub-recordByteBoost value sub recordName0 Sub-record type Value must be 0xFFDescription1 Fan failure boost value This is the PWM value (% value – 0-100) to use if a fan failure or fanremoval has occurred.2 Temperature threshold boostvalue3 Reserved 1 Value should be 04 Reserved 2 Value should be 0This is the PWM value (% value – 0-100) to use if critical temperatureor chassis top cover removal has been detected.Table 93 Sensor failure exclusion Sub-recordByteSensor failuresub recordName0 Sub-record type Value must be 0xFD1 Sensor count (N) Number of sensors to follow2-NSensor numberDescriptionThis sensor number will not contribute to system fan boost if a failureor threshold crossing occurs.170Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated BaseboardManagement Controller EPSAppendix A: OEM SDR RecordsOEM SDR Tag Record FormatAn OEM SDR tag record is an IPMI OEM SDR that includes one or more SDR tag strings.Table 94. OEM SDR Tag Record FormatByteNameDescription0:2 OEM ID Intel manufacturer ID – 157h, little endian.3 Record Subtype Value 54h. See Table 79.SDR Tag RecordSDR Tag 04 Type / Length Byte Encoding and length of tag string. IPMI standard format. See Section37.14 of the Intelligent Platform Management Interface SpecificationSecond Generation v2.0.5:N Tag string Up to 30 bytes of string data. NULL termination allowed but notrequired.SDR Tags 1 – MRevision 1.0Intel ® Confidential 171

Appendix A: OEM SDR RecordsIntel® Server System "Emerald Ridge” Integrated BaseboardManagement Controller EPSNode Manager Discovery Record FormatTable 95. Node Manager Discovery Record FormatByteNameDescription0:2 OEM ID Intel manufacturers ID – 157h3 Record Subtype 0Dh – Node Manager Discovery.NM Record4 Version number ofthis record subtype5 NM Device SlaveAddress6 Channel Number /Sensor Owner LUN7 Node ManagerHealth Event sensor8 NM Exception Eventsensor01h for the version specified in this document.[7:1] - 7-bit I 2 C Slave Address of the NM controller on the channel.[0] - Reserved.[7:4] - Channel number for the channel that the NM managementcontroller is on. Use 0h if the primary BMC is the NM controller.[3:2] - Reserved. Write as 00b.9 Reserved 0xFF - not supported10 Reserved 0xFF - not supported11 Reserved 0xFF - not supported[1:0] - Sensor owner LUN used for accessing all NM sensorsenumerated in this record.Sensor number for mandatory NM Health Event sensor.Sensor number for mandatory NM Exception Event (event-only) sensor.Chassis/FRU Fault LED Record FormatTable 96. Chassis/FRU Fault LED Record FormatByteNameDescription0:2 OEM ID Intel manufacturers ID – 157h, little endian3 Record Subtype Value 0Eh.4 Record Version Version # of this specific SDR record subtype. Set to 01h forthe format described in this document.Chassissupport/FRUFailure LEDmappingrecord5 Chassis ID numberLED mapping sub-records0 LED group Enumerated value.1 Mapping pair count(N)1 = Fan fault LEDAll other values reserved.Count of sensor # / FRU fault LED pairs2 Sensor 1 Sensor # for sensor 1.3 FRU fault LED 1 Number associated with specific FRU fault LED that is to bepaired with sensor 1.172Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated BaseboardManagement Controller EPSAppendix A: OEM SDR RecordsByteName4: M Sensor # / FRU faultLED #DescriptionUp to N pairs of sensor # / FRU fault LED values..M = Total number of bytes in this sub-record. Upper boundon this value is 49; however this is constrained by the totalnumber of bytes allowed for an OEM SDR record (64,including a 5 byte header).Revision 1.0Intel ® Confidential 173

Appendix B: FirmwareDevice Information Block FormatIntel® Server System "Emerald Ridge” Integrated BaseboardManagement Controller EPSAppendix B: : Firmware Device InformationBlockFormatThe BMC hex file contains Device Info Blocks (DIBs) that utilities may use to perform updaterelatedoperations. These device info blocks are formatted as shown in the following tables.Table 97: Operational Code Info Block Version 6FieldSize (bytes)DescriptionCookie 16 String “*OpCodeInfo*” stored in hex file that indicates whether or not thehex file is valid.Version of Info Block 1 Version of info block that the hex file is compatible with. Version is 6 for thisspecification.Structure Size 1 Size of this structure, including checksum.Reserved (1) 2Start of Op Code 4 Offset of start of operational code image in flash.End of Op Code 4 Offset of last byte of operational code.Op Code Run 4 Offset of first instruction to execute in operational code.Reserved (2) 2Major FW Version 2 Major operational code firmware version.Minor FW Version 2 Minor operational code firmware version.Build Date 12 Hex file build date – formatted as __DATE__Build Time 12 Hex file build time – formatted as __TIME__Reserved (3) 2Checksum 2 Info block checksum, starting from “Cookie” to “Reserved (3)”Table 98: Boot Code Info Block Version 6FieldSize (bytes)DescriptionCookie 16 String “*BootInfo*” stored in hex file that indicates whether or not thehex file is valid.Version of Info Block 1 Version of info block that the hex file is compatible with. Version is 6 forthis specification.Structure Size 1 Size of this structure, including checksum.Platform Name 16 Platform name such as “IMM_BootBlock”. This field is used by theutility to verify that the hex file is intended for the target system.Microcontroller Name 5 Microcontroller acronym name such as “BMC”, “HSC”, etc.Primary Address 1 IPMB slave address of microcontrollerSecondary Address 1 IPMB slave address of secondary identical controllers such as HSC2.Flash Type 1 Flash type of the microcontroller’s flash being updated.Reserved (1) 2Start of Boot Code 4 Offset of start of boot code image in flash.End of Boot Code 4 Offset of last byte of boot code.Reserved (2) 8Major FW Version 2 Major boot code firmware version.Minor FW Version 2 Minor boot code firmware version.Build Date 12 Hex file build date – formatted as __DATE__Build Time 12 Hex file build time – formatted as __TIME__174Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated IBaseboardManagement Controller EPSAppendix B FirmwareDevice Information Block FormatFieldReserved (3) 2Size (bytes)DescriptionChecksum 2 Info block checksum, starting from “Cookie” to “Reserved (3)”Table 99: PIA Info Block Version 3FieldSize (bytes)DescriptionDiscovery String 16 String “*PltfrmInfArea*” stored in hex file that indicates whether or not thehex file is valid.Format Version 1 Version of info block that the hex file is compatible with. Version 3 iscurrent for this specification.Header Length 1 Size of this structure, including checksum.Format Revision 1 Major PIA version.Instance Version 1 Minor PIA version.Creation Date 12 Hex build file date in __DATE__ formatCreator 3 Id of manufacturer creating this PIAreserved 1 ReservedPlatform Id 2 Platform type(s) within a group of platforms. It is possible that a firmwarebinary and PIA combination could be valid for more than one platform.Platform Group 2 Id of binary firmware image. Not a version. This identifies a firmwarebinary that runs on a set of platforms that includes the platform(s) this PIAis for.BIOS ID String 16 BIOS ID string of the platform the firmware is intended for. Padded withbinary zeros on the right if the string is less than 16 bytes.Start Address 4 Offset of first byte of PIA data.End Address 4 Offset of last byte of PIA data.Number of Areaspresent2 The total number of areas defined in this PIAPad 2 Get to even boundaryChecksum 2 Checksum of the all of the PIA except the headerHeader Checksum 2 Checksum of the PIA header (including PIA checksum)Table 100: EFS/Intel ® Remote Management Module 3 (Intel ® RMM3) Info Block Version 1FieldSize (bytes)DescriptionDiscovery String 16 String “*EFS_Image*” stored in hex file that indicates whether or not thehex file is valid.Format Version 1 Version of info block that the hex file is compatible with. Version is 1 forthis specification.Header Length 1 Size of this structure, including checksum.Acronym 5 Holds controller type e.g., "BMC"Primary Address 1 IPMB slave addressPlatform Name 16 Holds platform name e.g., "Hemlock"Content Version 32 EFS Content Version String (includes terminating NULL)Start Address 4 Offset of first byte of EFS data.End Address 4 Offset of last byte of EFS data.Major Version 2 Major EFS data version.Minor Version 2 Minor EFS data version.Start Address 4 Offset of first byte of PIA data.Revision 1.0Intel ® Confidential 175

Appendix B: FirmwareDevice Information Block FormatIntel® Server System "Emerald Ridge” Integrated BaseboardManagement Controller EPSFieldSize (bytes)DescriptionEnd Address 4 Offset of last byte of PIA data.Build Date 12 Hex file build date – formatted as __DATE__Build Time 12 Hex file build time – formatted as __TIME__Reserved 2Checksum 2 Info block checksum, starting from “Cookie” to “Reserved”176Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSGlossaryGlossaryTermACPIAESAMBAPICARPASFASICBISTBMCBridgeBSPCBCCLICLTTCMOSCSRD-cacheDHCPDIBDPCEEPROMEMPEPSFMLFNIFRBFRUFSBFTMGPIOHSBPHSCI-cacheI2CIAIBFICHIERRINITDefinitionAdvanced Configuration and Power InterfaceAdvanced Encryption StandardAdvanced Memory Buffer (there is an AMB on each FBDIMM)Advanced Programmable Interrupt ControllerAddress Resolution ProtocolAlert Standards ForumApplication specific integrated circuitBuilt-in self testBaseboard management controllerCircuitry connecting one computer bus to another, allowing an agent on one to access the other.Bootstrap processorChassis bridge controller. A microcontroller connected to one or more other CBCs. Together theybridge the IPMB buses of multiple chassis.Command-line interfaceClosed-loop thermal throttling (memory throttling mode)In terms of this specification, this describes the PC-AT compatible region of battery-backed 128 bytesof memory on the server board.Control and status registerData cache. Processor-local cache dedicated for memory locations explicitly loaded and stored byrunning code.Dynamic Host Configuration ProtocolDevice Information BlockDirect Platform ControlElectrically erasable programmable read-only memoryEmergency management portExternal Product SpecificationFast management linkFast management link network interfaceFault resilient bootingField replaceable unitFront side busFirmware transfer modeGeneral-purpose input/outputHot-swap backplaneHot-swap controllerInstruction cache. Processor-local cache dedicated for memory locations retrieved through instructionfetch operations.Inter-integrated circuit busIntel ® architectureInput bufferI/O controller hubInternal errorInitialization signalRevision 1.0Intel ® Confidential 177

GlossaryIntel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSTermIPMBIPMIITPKCSKTKVMLANLCDLPCLUNMACMD5MIBmsMUXNICNMIOBFOEMOLTTPCIPECIPEFPETPIAPLDPOSTPROMPSMIPWMRAMRASRC4RMCP+ROMRTCSCISDRSDRAMSELIntelligent Platform Management BusIntelligent Platform Management InterfaceIn-target probeKeyboard controller styleKeyboard textKeyboard, video, mouseLocal area networkLiquid crystal displayLow pin countLogical unit numberMedia Access ControlDefinitionMessage Digest 5. A hashing algorithm that provides higher security than MD2.Modular information block. A descriptive text translation of a PET event, contained in a MIB file foruse by an SNMP agent hen decoding SEL entries.MillisecondMultiplexerNetwork interface cardNon-maskable interruptOutput bufferOriginal equipment manufacturerOpen-loop thermal throttling (memory throttling mode)Peripheral Component InterconnectPlatform Environmental Control InterfacePlatform event filteringPlatform event trapPlatform information areaProgrammable logic devicePower-on self-testProgrammable read-only memoryPower Supply Management InterfacePulse Width Modulation. The mechanism used to control the speed of system fans.Random Access MemoryReliability, availability, and serviceabilityRivest Cipher 4. A stream cipher designed by Rivest for RSA data security, now RSA security. It is avariable key-size stream cipher with byte-oriented operations. The algorithm is based on a randompermutation.Remote Management Control ProtocolRead-only memoryReal-time clockSystem Control Interrupt. A system interrupt used by hardware to notify the operating system of ACPIevents.Sensor data recordSynchronous dynamic random access memorySystem event logSHA1 Secure Hash Algorithm 1178Intel ConfidentialRevision 1.1

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSGlossaryTermSIOSMBusSMISMMSMSSNMPSOLSPTSRAMTDPUARTUDPUHCIVLANDefinitionA two-wire interface based on the I 2 C protocol. The SMBus is a low-speed bus that provides positiveaddressing for devices and bus arbitration.Server management interrupt. SMI is the highest priority non-maskable interrupt.Server management modeServer management softwareSimple Network Management ProtocolSerial-over-LANStraight pass-throughStatic random access memoryTotal Dissipated PowerUniversal asynchronous receiver and transmitterUser Datagram ProtocolUniversal Host Controller InterfaceVirtual local area networkRevision 1.0Intel ® Confidential 179

Intel® Server System "Emerald Ridge” Integrated BaseboardManagement Controller EPSReference ence DocumentsReference e Documents Advanced Configuration and Power Interface Specification, Revision 3.0,http://www.acpi.info/.Design for Test R18. BIOS / Firmware. Intel Corporation. Fan Speed Control & Thermal Management Platform ArchitectureSpecification, Version 0.6, 2006, Intel Corporation. Product Requirements Document version 1.04, 5/25/2006, IntelCorporation. Goshen Component Specification Volume 2 of 3 (BMC) revision 1.96, January 2005.I 2 C Address Allocation, Revision 1.13. 1997. Intel Corporation. Intelligent Chassis Management Bus (ICMB) Specification, Version 1.0, Rev 1.20. 1999.Intel Corporation, Hewlett-Packard Company, NEC Corporation, Dell ComputerCorporation.Intelligent Platform Management Bus Communications Protocol Specification, Version1.0. 1998. Intel Corporation, Hewlett-Packard Company, NEC Corporation, DellComputer Corporation.Intelligent Platform Management Interface Specification, Version 2.0. 2004. IntelCorporation, Hewlett-Packard Company, NEC Corporation, Dell Computer Corporation. Legacy-Free Thermal Controller (PECI), ADT7490, Preliminary Data Sheet, Rev. PrB 24Jan 2006. Analog Devices.Platform Environmental Control Interface Specification, Intel Corporation. Platform Management FRU Information Storage Definition, Version 1.0, Revision 1.2.2002. Intel Corporation, Hewlett-Packard Company, NEC Corporation, Dell ComputerCorporation. http://developer.intel.com/design/servers/ipmi/spec.htm.The I 2 C Bus and How to Use It, January 1992. Phillips Semiconductors.Platform Support for Serial-over-LAN (SOL), TMode, and Terminal Mode ExternalArchitecture Specification version 1.1, 02/01/02, Intel Corporation.TCP/IP Pass-through External Architecture Specification, rev 0.85, 2005, IntelCorporation. Intel ® Remote Management Module External Architecture Specification, rev 0.997, 2006,Intel Corporation.Intel Remote Management Module User’s Guide, Intel Corporation.EPSD Add-In Discovery Commands External Architecture Specification, Intel Corporation. Alert Standard Format (ASF) Specification Version 2.0, 23 April 2003, ©2000-2003,Distributed Management Task Force, Inc. http://www.dmtf.org.Local Control Panel, Technical Specification, Revision 1.0, 2005, Intel Corporation.180Intel ConfidentialRevision 1.1