Intel® Server System Server System "Emerald Ridge ... - CTL

Intel® Server System "Emerald Ridge” Integrated Baseboard Management Controller EPSIPMI Command InterfaceCode00h01h02hCommandEnterFirmwareTransferModeFirmwareProgramFirmwareReadTable 61. BMC Firmware Transfer CommandsNet Function = Firmware (08h), LUN = 00Request, Response DataRequest:Byte 1:5 – I,N,T,E,LResponse:Byte 1 – Completion codeRequest:Byte 1 – Start address (LS byte)Byte 2 – Start address (MS byte)Byte 3:n – Data to programResponse:Byte 1 – Completion code81h = Address not in flashByte 2 – Address (LS byte)Byte 3 – Address (MS byte)Byte 4 – Number of bytesprogrammed0 = FailureRequest:Byte 1 – Start address (LS byte)Byte 2 – Start address (MS byte)Byte 3 – LengthResponse:Byte 1 – Completion code81h = Addr not in flashByte 2 – Start address (LS byte)Byte 3 – Start address (MS byte)Byte 4:n – DataDescriptionThis command directs the BMC to enter firmware transfer mode.The BMC has limited functionality in this mode. The onlycommands guaranteed to be accessible are the firmware transfercommands, the IPMI Get Device ID and Get Self Test Resultscommands, and the OEM command Get Advanced SupportConfiguration to indicate if an Intel ® Remote Management Module3 (Intel ® RMM3) add-in card is present or not.The ASCII characters I, N, T, E, L are used as a key to guardagainst unintentional entry into this mode.The Firmware Program command requests that given bytes bewritten to the BMC flash starting at the specified address. If thenumber of bytes to be transferred exceeds the end of writeableflash, the write will occur but the transfer will be truncated.The actual number of programmed bytes may be less than thenumber passed in the request if the requested transfer exceedsavailable internal buffer space, or if the requested transfer spansover the end of alterable flash space. The appropriate nonzerocompletion code is returned if a truncation occurs or if the transferis not performed.This command may take up to 20.9 seconds to complete,because the first write to a block in the flash silicon initiates a timeconsuming erase of that block. 20.9 seconds is the worst-casespec for main block erase. The typical timing is approximately 0.5seconds. The start address specifies the lower 16 bits of theprogram address. Use the ‘SetProgramSegment’ to set the upper16 bits of the address before issuing this command.The addresses are flash device relative. They range from zero tothe size of the flash device minus one. The flash size is systemdependent.The completion code 81h is returned if the address specified isnot in flash. One possible use for this is to attempt to program theIntel ® RMM3 flash address and if the Intel ® RMM3 is not present,this completion code is returned.The starting address from the request is returned in the responseto help match the response with the request. The actual numberof bytes returned may be less than the requested number, if therequested transfer size exceeds available internal buffer space orif the requested transfer spans over the end of alterable FLASHspace.Addresses do not wrap. For example, if the starting address plusthe length exceeds the last address for the ROM, the number ofdata bytes returned will be less than the number requested. Theaddress byte in the request is the lower 16 bits of the address ofinterest. Use the SetProgramSegment command to set the upper16 bits of the address.See the Firmware Program command for the definition of theaddress.Revision 1.1Intel ® Confidential 123