Below are the formats for a few useful IPMI commands for the AMC13 as provided by Jes Tikalsky (jtikalsky@hep.wisc.edu) with the University of Wisconsin group.

For a more in depth look at the Status and Control Registers for the MMC FPGA SPI Interface, see the Wisconsin official MMC documentation

Contents
SPI Read
SPI Write
Read SPI Status
Write SPI Control
Get Non-Volatile Area Info
Read Non-Volatile Memory
How to issue these commands with ipmitool
EEPROM layout

SPI Read

Below are the relevant bytes for a raw IPMI SPI "read data" command

NetFN   0x32
CMD     0x34
Params  PortID (0-3)
        Address LS Byte
        Address MS byte
        Count (I recommend <20)

SPI Write

Below are the relevant bytes for a raw IPMI SPI "write data" command

NetFN   0x32
CMD     0x33
Params  PortID (0-3)
        Address LS Byte
        Address MS byte
        Count (I recommend <20)
        Byte 1
        ...
        Byte n

Read SPI Status

Below are the relevant bytes for raw IPMI SPI "read status register" command

NetFN   0x32
CMD     0x31
Params  1: Port ID (0-3)
Return  1: bit 7: HF1
           bit 6: HF2
           bit 5: CFGRDY
           bit 4: REQCFG
           bit 3-0: reserved

Write SPI Control

Below are the relevant bytes for a raw IPMI SPI "write control register" command. For the purposes of the AMC13, we really only care about the CFGRDY bit

NetFN   0x32
CMD     0x32
Params  1: Port ID (0-3)
        2: bit 7: select UHF for update
           bit 6: select LHF for update
           bit 5: select CFGRDY for update
           bit 4-2: 0
           bit 1: SET selected flags
           bit 0: CLEAR selected flags

Get Non-Volatile Area Info

Below are the relevant bytes for a raw IPMI SPI "read NV area info" command

Get Nonvolatile Area Info (Partial):
NetFN    0x32
CMD      0x40
Params   1: 0
Return   1: 0
         ...
         15: FPGA Config Area LS Byte
         16: FPGA Config Area MS Byte
         17: FPGA Config Area Size (32 byte units)

Read Non-Volatile Memory

Below are the relevant bytes for a raw IPMI SPI "read NV memory" command

Raw Nonvolatile Read:
NetFN    0x32
CMD      0x42
Params   1: Offset LS
         2: Offset MS
         3: Length (<=20)
Return   $Data

Using ipmitool

You can issue these command using the OS supplied ipmitool as follows.

To read:

   $ ipmitool -H 192.168.1.41 -U '' -P '' -T 0x82 -b 7 -t 0x76 raw 0x32 0x34 1 11 0 4

-t 0x76	0x76 is 0x70 + slot*2 (e.g. slot 3) or 0xa4 for special case of slot 13
0x32 0x34	0x32 means UWMMC special command 0x34 is configuration read
1 11 0 4	1 is device select (0=T1, 1=T2) 11 0 is address (lsb msb) 4 is byte count

To write:

  $ ipmitool -H 192.168.1.41 -U '' -P '' -T 0x82 -b 7 -t 0x76 raw 0x32 0x33 0 0 0 6 0x03 0xff 0xff 0xff 0x00 0xc0

0x32 x33	0x33 is configuration write
0 0 0 6	device select, address, count (=6 e.g.)
0x03 0xff ...	data to write

EEPROM layout extracted from nonvolatile.h in source code using this perl script: mmc_eeprom_print_defs.pl.

NONVOLATILE_FORMAT_VERSION     (0x0001) 1
HW_HEADER_BYTE_OFFSET          (0x0000) 0
HW_HEADER_SIZE                 (0x0020) 32
APP_DEV_ID_BYTE_OFFSET         (0x0020) 32
APP_DEV_ID_SIZE                (0x0010) 16
COMMON_HEADER_BYTE_OFFSET      (0x0030) 48
COMMON_HEADER_SIZE             (0x0008) 8
BOARD_INFO_AREA_BYTE_OFFSET    (0x0038) 56
BOARD_INFO_AREA_SIZE           (0x0040) 64
MULTIRECORD_AREA_BYTE_OFFSET   (0x0078) 120
MULTIRECORD_AREA_SIZE          (0x0050) 80
END_OF_FRU_AREA_OFFSET         (0x00c8) 200
FPGA_CONFIG_AREA_BYTE_OFFSET   (0x00c8) 200
FPGA_CONFIG_AREA_SIZE          (0x0100) 256
SDR_AREA_BYTE_OFFSET           (0x01e0) 480
SDR_AREA_SIZE                  (0x0800) 2048
PAYLDMGR_AREA_BYTE_OFFSET      (0x09e0) 2528
PAYLDMGR_AREA_SIZE             (0x0040) 64
ADC_SCALING_AREA_BYTE_OFFSET   (0x0a20) 2592
ADC_SCALING_AREA_SIZE          (0x00c0) 192
GP_PARAM_AREA_BYTE_OFFSET      (0x0ae0) 2784
GP_PARAM_AREA_SIZE             (0x0040) 64
FAULT_LOG_ENTRY_SIZE           (0x0008) 8
FAULT_LOG_ENTRY_CNT            (0x000f) 15
FAULT_LOG_HDR_BYTE_OFFSET      (0x0b20) 2848
FAULT_LOG_ENTRY_BYTE_OFFSET    (0x0b28) 2856
FAULT_LOG_SIZE                 (0x0080) 128
EEP_USED_AREA_SIZE             (0x0ba0) 2976

The script readNVmem.py will dump 40 bytes starting at FPGA_CONFIG_AREA_BYTE_OFFSET. This area is formatted as follows in MMCV2.1:

Overall Header
Offset	Description
0	Format flag (0 if initialized, 0xff if not)
1	Flags[1]
2	Offset 0 (0xff if uninitialized)
3	Offset 1 (0xff if uninitialized)
4	Offset 2 (0xff if uninitialized)
5	Header checksum

Notes:

1. Flag bits:
   1. bit 0 set if FPGA 0 image defined
   2. bit 1 set if FPGA 1 image defined
   3. bit 2 set if FPGA 2 image define
   4. bit 7 set to replace first byte with slot ID

Next come 0-3 FPGA configuration records, with a 5 byte header and variable size data area

FPGA Configuration Header
Offset	Description
0	Destination addr LSB
1	Destination addr MSB
2	Record length (not including header)
3	Record checksum
4	Header checksum

After the header is the actual configuration record data. Currently the length is 0x0b.

Offset	Description
0	Slot ID if bit 7 of flags set (NOTE: doesn't seem to work in v2.1)
1-4	Net mask (AMC13 ignores)
5-8	IP address
9-10	Boot vector (AMC13 ignores)

Here is the contents of the configuration data for a sample AMC13:

--FPGA 0 header
 00 address LSB
 00 address MSB
 0b length = 11
 59 checksum
 9c checksum
--FPGA 0 record
 00           Slot number
 ff ff ff 00  Net mask
 c0 a8 01 41  IP address
 00 00        Boot vector

--FPGA 1 header
 00  address LSB
 00  address MSB
 0b  length = 11
 58  checksum
 9d  checksum
--FPGA 1 record
 00             Slot number
 ff ff ff 00    Net mask
 c0 a8 01 42    IP address
 00 00          Boot vector

-- EricHazen - 02 May 2014