[IPMI] Messaging Support Commands

Set BMC Global Enables - NetFn = App (0x06h), CMD = 0x2eh, Privilege Level = Local, M/O = M
| Linux |
[IPMItool]

ipmitool raw 0x06 0x2e D[1] Byte 1
Request Data 1
Set to xxxx_100xb on power-up and system resets.
If the implementation allows the receive message queue interrupt to be enabled/disabled, the default for bit 0 should be 0b
[7] - OEM 2 Enable
[6] - OEM 1 Enable
[5] - OEM 0 Enable
[4] - reserved
[3] - 1b = Enable System Event Logging
[2] - 1b = Enable Event Message Buffer
[1] - 1b = Enable Event Message Buffer Full Interrupt
[0] - 1b = Enable Receive Message Queue Interrupt

ipmitool mc setenables <argument> recv_msg_intr    : Receive Message Queue Interrupt
event_msg_intr   : Event Message Buffer Full Interrupt
event_msg        : Event Message Buffer
system_event_log : System Event Logging
oem0             : OEM 0
oem1             : OEM 1
oem2             : OEM 2
<option=on|off>

[ipmiutil]

ipmiutil cmd 00 20 18 2e D[1] Byte 1
Request Data 1
Set to xxxx_100xb on power-up and system resets.
If the implementation allows the receive message queue interrupt to be enabled/disabled, the default for bit 0 should be 0b
[7] - OEM 2 Enable
[6] - OEM 1 Enable
[5] - OEM 0 Enable
[4] - reserved
[3] - 1b = Enable System Event Logging
[2] - 1b = Enable Event Message Buffer
[1] - 1b = Enable Event Message Buffer Full Interrupt
[0] - 1b = Enable Receive Message Queue Interrupt

icmd 00 20 18 2e D[1] Byte 1
Request Data 1
Set to xxxx_100xb on power-up and system resets.
If the implementation allows the receive message queue interrupt to be enabled/disabled, the default for bit 0 should be 0b
[7] - OEM 2 Enable
[6] - OEM 1 Enable
[5] - OEM 0 Enable
[4] - reserved
[3] - 1b = Enable System Event Logging
[2] - 1b = Enable Event Message Buffer
[1] - 1b = Enable Event Message Buffer Full Interrupt
[0] - 1b = Enable Receive Message Queue Interrupt

[FreeIPMI]

ipmi-raw 0x00 0x06 0x2e D[1] Byte 1
Request Data 1
Set to xxxx_100xb on power-up and system resets.
If the implementation allows the receive message queue interrupt to be enabled/disabled, the default for bit 0 should be 0b
[7] - OEM 2 Enable
[6] - OEM 1 Enable
[5] - OEM 0 Enable
[4] - reserved
[3] - 1b = Enable System Event Logging
[2] - 1b = Enable Event Message Buffer
[1] - 1b = Enable Event Message Buffer Full Interrupt
[0] - 1b = Enable Receive Message Queue Interrupt

| MS-DOS |
[ipmitool]

ipmitool 20 18 2e D[1]

[ipmiutil]

ipmiutil 00 20 18 2e D[1]

For example
[IPMItool in Linux] Hint: hover over Place your mouse over the highlighted area in below
for Response Data description

$ ipmitool raw 0x06 0x2e 0x04 Byte 1
Request Data 1
Set to xxxx_100xb on power-up and system resets.
If the implementation allows the receive message queue interrupt to be enabled/disabled, the default for bit 0 should be 0b
[7] - OEM 2 Enable
[6] - OEM 1 Enable
[5] - OEM 0 Enable
[4] - reserved
[3] - 1b = Enable System Event Logging
[2] - 1b = Enable Event Message Buffer
[1] - 1b = Enable Event Message Buffer Full Interrupt
[0] - 1b = Enable Receive Message Queue Interrupt


$ ipmitool mc setenables event_msg recv_msg_intr    : Receive Message Queue Interrupt
event_msg_intr   : Event Message Buffer Full Interrupt
event_msg        : Event Message Buffer
system_event_log : System Event Logging
oem0             : OEM 0
oem1             : OEM 1
oem2             : OEM 2
on
Enabling Event Message Buffer

Nothing to change...
Receive Message Queue Interrupt          : disabled
Event Message Buffer Full Interrupt      : disabled
Event Message Buffer                     : enabled
System Event Logging                     : disabled
OEM 0                                    : disabled
OEM 1                                    : disabled
OEM 2                                    : disabled

[ipmiutil in Linux]

$ ipmiutil cmd 00 20 18 2e 0f Byte 1
Request Data 1
Set to xxxx_100xb on power-up and system resets.
If the implementation allows the receive message queue interrupt to be enabled/disabled, the default for bit 0 should be 0b
[7] - OEM 2 Enable
[6] - OEM 1 Enable
[5] - OEM 0 Enable
[4] - reserved
[3] - 1b = Enable System Event Logging
[2] - 1b = Enable Event Message Buffer
[1] - 1b = Enable Event Message Buffer Full Interrupt
[0] - 1b = Enable Receive Message Queue Interrupt

ipmiutil ver 3.08
icmd ver 3.08
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
send_icmd ret = 0
ipmiutil cmd, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x2e 0x0f Byte 1
Request Data 1
Set to xxxx_100xb on power-up and system resets.
If the implementation allows the receive message queue interrupt to be enabled/disabled, the default for bit 0 should be 0b
[7] - OEM 2 Enable
[6] - OEM 1 Enable
[5] - OEM 0 Enable
[4] - reserved
[3] - 1b = Enable System Event Logging
[2] - 1b = Enable Event Message Buffer
[1] - 1b = Enable Event Message Buffer Full Interrupt
[0] - 1b = Enable Receive Message Queue Interrupt

rcvd: 2E 00 Byte 1
Completion Code
00h = Command Completed Normally

[IPMI tool under DOS]

C:\>ipmitool 20 18 2e 04
1c 2e 00

Get BMC Global Enables - NetFn = App (0x06h), CMD = 0x2fh, Privilege Level = User, M/O = M
| Linux |
[IPMItool]

ipmitool raw 0x06 0x2f
ipmitool mc getenables

[ipmiutil]

ipmiutil cmd 00 20 18 2f
icmd 00 20 18 2f

[FreeIPMI]

ipmi-raw 0x00 0x06 0x2f

| MS-DOS |
[ipmitool]

ipmitool 20 18 2f

For example
[IPMItool in Linux] Hint: hover over Place your mouse over the highlighted area in below
for Response Data description

$ ipmitool raw 0x06 0x2f
 04 Byte 2
Response Data
[7] - 1b = OEM 2 Enabled
[6] - 1b = OEM 1 Enabled
[5] - 1b = OEM 0 Enabled
[4] - reserved
[3] - 1b = System Event Logging Enabled
[2] - 1b = Event Message Buffer Enabled
[1] - 1b = Event Message Buffer Full Interrupt Enabled
[0] - 1b = Receive Message Queue Interrupt Enabled

$ ipmitool mc getenables
Receive Message Queue Interrupt          : disabled
Event Message Buffer Full Interrupt      : disabled
Event Message Buffer                     : enabled
System Event Logging                     : disabled
OEM 0                                    : disabled
OEM 1                                    : disabled
OEM 2                                    : disabled

[ipmiutil in Linux]

$ icmd 00 20 18 2f
ipmiutil ver 3.08
icmd ver 3.08
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
respData[len=1]: 04 Byte 2
Response Data
[7] - 1b = OEM 2 Enabled
[6] - 1b = OEM 1 Enabled
[5] - 1b = OEM 0 Enabled
[4] - reserved
[3] - 1b = System Event Logging Enabled
[2] - 1b = Event Message Buffer Enabled
[1] - 1b = Event Message Buffer Full Interrupt Enabled
[0] - 1b = Receive Message Queue Interrupt Enabled

send_icmd ret = 0
ipmiutil cmd, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x2f
rcvd: 2F 00 Byte 1
Completion Code
00h = Command Completed Normally
04 Byte 2
Response Data
[7] - 1b = OEM 2 Enabled
[6] - 1b = OEM 1 Enabled
[5] - 1b = OEM 0 Enabled
[4] - reserved
[3] - 1b = System Event Logging Enabled
[2] - 1b = Event Message Buffer Enabled
[1] - 1b = Event Message Buffer Full Interrupt Enabled
[0] - 1b = Receive Message Queue Interrupt Enabled

Clear Message Flags - NetFn = App (0x06h), CMD = 0x30h, Privilege Level = Local, M/O = M
| Linux |
[IPMItool]

ipmitool raw 0x06 0x30 D[1] Byte 1
Request Data 1
[7] - 1b = Clear OEM 2
[6] - 1b = Clear OEM 1
[5] - 1b = Clear OEM 0
[4] - reserved
[3] - 1b = Clear watchdog pre-timeout interrupt flag
[2] - reserved
[1] - 1b = Clear Event Message Buffer
[0] - 1b = Clear Receive Message Queue

[ipmiutil]

ipmiutil cmd 00 20 18 30 D[1] Byte 1
Request Data 1
[7] - 1b = Clear OEM 2
[6] - 1b = Clear OEM 1
[5] - 1b = Clear OEM 0
[4] - reserved
[3] - 1b = Clear watchdog pre-timeout interrupt flag
[2] - reserved
[1] - 1b = Clear Event Message Buffer
[0] - 1b = Clear Receive Message Queue

icmd 00 20 18 30 D[1] Byte 1
Request Data 1
[7] - 1b = Clear OEM 2
[6] - 1b = Clear OEM 1
[5] - 1b = Clear OEM 0
[4] - reserved
[3] - 1b = Clear watchdog pre-timeout interrupt flag
[2] - reserved
[1] - 1b = Clear Event Message Buffer
[0] - 1b = Clear Receive Message Queue

[FreeIPMI]

ipmi-raw 0x00 0x20 0x06 0x30 D[1] Byte 1
Request Data 1
[7] - 1b = Clear OEM 2
[6] - 1b = Clear OEM 1
[5] - 1b = Clear OEM 0
[4] - reserved
[3] - 1b = Clear watchdog pre-timeout interrupt flag
[2] - reserved
[1] - 1b = Clear Event Message Buffer
[0] - 1b = Clear Receive Message Queue

| MS-DOS |
[ipmitool]

ipmitool 20 18 30 D[1]

For example
[IPMItool in Linux] Hint: hover over Place your mouse over the highlighted area in below
for Response Data description

$ ipmitool raw 0x06 0x30 0xeb Byte 1
Request Data 1
[7] - 1b = Clear OEM 2
[6] - 1b = Clear OEM 1
[5] - 1b = Clear OEM 0
[4] - reserved
[3] - 1b = Clear watchdog pre-timeout interrupt flag
[2] - reserved
[1] - 1b = Clear Event Message Buffer
[0] - 1b = Clear Receive Message Queue

[ipmiutil in Linux]

$ ipmiutil cmd 00 20 18 30 eb Byte 1
Request Data 1
[7] - 1b = Clear OEM 2
[6] - 1b = Clear OEM 1
[5] - 1b = Clear OEM 0
[4] - reserved
[3] - 1b = Clear watchdog pre-timeout interrupt flag
[2] - reserved
[1] - 1b = Clear Event Message Buffer
[0] - 1b = Clear Receive Message Queue

ipmiutil ver 3.08
icmd ver 3.08
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
send_icmd ret = 0
ipmiutil cmd, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x30 0xeb Byte 1
Request Data 1
[7] - 1b = Clear OEM 2
[6] - 1b = Clear OEM 1
[5] - 1b = Clear OEM 0
[4] - reserved
[3] - 1b = Clear watchdog pre-timeout interrupt flag
[2] - reserved
[1] - 1b = Clear Event Message Buffer
[0] - 1b = Clear Receive Message Queue

rcvd: 30 00 Byte 1
Completion Code
00h = Command Completed Normally

[IPMI tool under DOS]

C:\>ipmitool 20 18 30 e3
1c 30 00

Get Message Flags - NetFn = App (0x06h), CMD = 0x31h, Privilege Level = Local, M/O = M
| Linux |
[IPMItool]

ipmitool raw 0x06 0x31

[ipmiutil]

ipmiutil cmd 00 20 18 31
icmd 00 20 18 31

[FreeIPMI]

ipmi-raw 0x00 0x06 0x31

| MS-DOS |
[ipmitool]

ipmitool 20 18 31

For example
[IPMItool in Linux] Hint: hover over Place your mouse over the highlighted area in below
for Response Data description

$ ipmitool raw 0x06 0x31
 00 Byte 2
Flags
[7] - 1b = OEM 2 data available
[6] - 1b = OEM 1 data available
[5] - 1b = OEM 0 data available
[4] - reserved
[3] - 1b = Watchdog pre-timeout interrupt occurred
[2] - reserved
[1] - 1b = Event Message Buffer Full
[0] - 1b = Receive Message Available

[ipmiutil in Linux]

$ icmd 00 20 18 31
ipmiutil ver 3.08
icmd ver 3.08
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
respData[len=1]: 00 Byte 2
Flags
[7] - 1b = OEM 2 data available
[6] - 1b = OEM 1 data available
[5] - 1b = OEM 0 data available
[4] - reserved
[3] - 1b = Watchdog pre-timeout interrupt occurred
[2] - reserved
[1] - 1b = Event Message Buffer Full
[0] - 1b = Receive Message Available

send_icmd ret = 0
ipmiutil cmd, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x31
rcvd: 31 00 Byte 1
Completion Code
00h = Command Completed Normally
00 Byte 2
Flags
[7] - 1b = OEM 2 data available
[6] - 1b = OEM 1 data available
[5] - 1b = OEM 0 data available
[4] - reserved
[3] - 1b = Watchdog pre-timeout interrupt occurred
[2] - reserved
[1] - 1b = Event Message Buffer Full
[0] - 1b = Receive Message Available

[IPMI tool under DOS]

C:\>ipmitool 20 18 31
1c 31 00 00

Enable Message Channel Receive - NetFn = App (0x06h), CMD = 0x32h, Privilege Level = Local, M/O = O
| Linux |
[IPMItool]

ipmitool raw 0x06 0x32 D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - channel number
D[2] Byte 2
Channel State
[7:2] - reserved
[1:0] - 00b = disable channel
        01b = enable channel
        10b = get channel enable/disable state
        11b = reserved

[ipmiutil]

ipmiutil cmd 00 20 18 32 D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - channel number
D[2] Byte 2
Channel State
[7:2] - reserved
[1:0] - 00b = disable channel
        01b = enable channel
        10b = get channel enable/disable state
        11b = reserved

icmd 00 20 18 32 D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - channel number
D[2] Byte 2
Channel State
[7:2] - reserved
[1:0] - 00b = disable channel
        01b = enable channel
        10b = get channel enable/disable state
        11b = reserved

[FreeIPMI]

ipmi-raw 0x00 0x06 0x32 D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - channel number
D[2] Byte 2
Channel State
[7:2] - reserved
[1:0] - 00b = disable channel
        01b = enable channel
        10b = get channel enable/disable state
        11b = reserved

| MS-DOS |
[IPMItool]

ipmitool 20 18 32 Data[1:2]

For example
[IPMItool in Linux] Hint: hover over Place your mouse over the highlighted area in below
for Response Data description

$ ipmitool raw 0x06 0x32 0x01 Byte 1
Channel Number
[7:4] - reserved
[3:0] - channel number
0x01 Byte 2
Channel State
[7:2] - reserved
[1:0] - 00b = disable channel
        01b = enable channel
        10b = get channel enable/disable state
        11b = reserved

 01 Byte 2
Channel Number
[7:4] - reserved
[3:0] - channel number
01 Byte 3
Channel State
[7:1] - reserved
  [0] - 1b = channel enabled
        0b = channel disabled

[ipmiutil in Linux]

$ icmd 00 20 18 32 01 Byte 1
Channel Number
[7:4] - reserved
[3:0] - channel number
01 Byte 2
Channel State
[7:2] - reserved
[1:0] - 00b = disable channel
        01b = enable channel
        10b = get channel enable/disable state
        11b = reserved

ipmiutil ver 3.08
icmd ver 3.08
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
respData[len=2]: 01 Byte 2
Channel Number
[7:4] - reserved
[3:0] - channel number
01 Byte 3
Channel State
[7:1] - reserved
  [0] - 1b = channel enabled
        0b = channel disabled

send_icmd ret = 0
ipmiutil cmd, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x32 0x01 Byte 1
Channel Number
[7:4] - reserved
[3:0] - channel number
0x01 Byte 2
Channel State
[7:2] - reserved
[1:0] - 00b = disable channel
        01b = enable channel
        10b = get channel enable/disable state
        11b = reserved

rcvd: 32 00 Byte 1
Completion Code
00h = Command Completed Normally
01 Byte 2
Channel Number
[7:4] - reserved
[3:0] - channel number
01 Byte 3
Channel State
[7:1] - reserved
  [0] - 1b = channel enabled
        0b = channel disabled

[IPMI tool under DOS]

C:\>ipmitool 20 18 32 01 01
1c 32 00 01 01

Get Message - NetFn = App (0x06h), CMD = 0x33h, Privilege Level = Local, M/O = M

Send Message - NetFn = App (0x06h), CMD = 0x34h, Privilege Level = User, M/O = M

Read Event Message Buffer - NetFn = App (0x06h), CMD = 0x35h, Privilege Level = Local, M/O = O
| Linux |
[IPMItool]

ipmitool raw 0x06 0x35

[ipmiutil]

ipmiutil cmd 00 20 18 35
icmd 00 20 18 35

[FreeIPMI]

ipmi-raw 0x00 0x06 0x35

| MS-DOS|

ipmitool 20 18 35

--Completion Code--

80h = data not available (queue / buffer empty)

For example
[IPMItool in Linux] Hint: hover over Place your mouse over the highlighted area in below
for Response Data description

$ ipmitool raw 0x06 0x35
 80 Byte 1
Completion Code
80h = data not available (queue / buffer empty)

Test Procedure:
1. Enable Event Message reception into Event Message Buffer by "Set BMC Global Enables Command"

$ ipmitool raw 0x06 0x2e 0x04

2. Produce a SEL log

$ ipmitool event 1

3. Read Event Message Buffer

$ ipmitool raw 0x06 0x35
 32 4f 02 a6 b3 ff 4e 20 00 04 04 b0 01 50 00 010

4. Disable Event Message reception into Event Message Buffer

$ ipmitool raw 0x06 0x2e 0x04

5. Read Event Message Buffer, where response 80h = data not available (queue / buffer empty)

$ ipmitool raw 0x06 0x35
 80

Get System Interface Capabilities - NetFn = App (0x06h), CMD = 0x57h, Privilege Level = User, M/O = O
| Linux |
[IPMItool]

ipmitool raw 0x06 0x57 D[1] Byte 1
System Interface Type
[7:4] - reserved
[3:0] - System Interface Type
        0h = SSIF
        1h = KCS
        2h = SMIC
        all other = reserved

[ipmiutil]

ipmiutil cmd 00 20 18 57 D[1] Byte 1
System Interface Type
[7:4] - reserved
[3:0] - System Interface Type
        0h = SSIF
        1h = KCS
        2h = SMIC
        all other = reserved

icmd 00 20 18 57 D[1] Byte 1
System Interface Type
[7:4] - reserved
[3:0] - System Interface Type
        0h = SSIF
        1h = KCS
        2h = SMIC
        all other = reserved

[FreeIPMI]

ipmi-raw 0x00 0x06 0x57 D[1] Byte 1
System Interface Type
[7:4] - reserved
[3:0] - System Interface Type
        0h = SSIF
        1h = KCS
        2h = SMIC
        all other = reserved

| MS-DOS |
[ipmitool]

ipmitool 20 18 57 Data[1]

For example
[IPMItool in Linux] Hint: hover over Place your mouse over the highlighted area in below
for Response Data description

$ ipmitool raw 0x06 0x57 0x00 Byte 1
System Interface Type
[7:4] - reserved
[3:0] - System Interface Type
        0h = SSIF
        1h = KCS
        2h = SMIC
        all other = reserved

 00 Byte 2
Reserved
Returned as 00h
88 Byte 3
Response Byte 3
For System Interface Type = SSIF:
[7:6] - Transaction support
        00b = only single-part reads/writes supported
        01b = multi-part reads/writes supported. Start and End transactions only.
        10b = multi-part reads/writes supported. Start, Middle, and End transactions supported.
        11b = reserved
[5:4] - reserved
  [3] - PEC support
        1b = implements PEC
        0b = does not support PEC
[2:0] - SSIF Version
        000b = version 1
ff Byte 4
Input message size in bytes. (1 based.)
For System Interface Type = SSIF:
Number of bytes of IPMI message data that the BMC can accept
7d Byte 5
Output message size in bytes. (1 based.)
For System Interface Type = SSIF:
Maximum number of bytes of IPMI message data that can be read from the BMC

$ ipmitool raw 0x06 0x57 0x01 Byte 1
System Interface Type
[7:4] - reserved
[3:0] - System Interface Type
        0h = SSIF
        1h = KCS
        2h = SMIC
        all other = reserved

 00 Byte 2
Reserved
Returned as 00h
00 Byte 3
Response Byte 3
For System Interface Type = KCS or SMIC:
[7:3] - reserved
[2:0] - System Interface Version
        000b = version 1
ff Byte 4
Input maximum message size in bytes. (1 based.)
For System Interface Type = KCS or SMIC:
Largest number of bytes that can be transferred in a KCS
FFh means 255 or more

[ipmiutil in Linux]

$ icmd 00 20 18 57 0x01 Byte 1
System Interface Type
[7:4] - reserved
[3:0] - System Interface Type
        0h = SSIF
        1h = KCS
        2h = SMIC
        all other = reserved

ipmiutil ver 3.08
icmd ver 3.08
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
respData[len=3]: 00 Byte 2
Reserved
Returned as 00h
00 Byte 3
Response Byte 3
For System Interface Type = KCS or SMIC:
[7:3] - reserved
[2:0] - System Interface Version
        000b = version 1
ff Byte 4
Input maximum message size in bytes. (1 based.)
For System Interface Type = KCS or SMIC:
Largest number of bytes that can be transferred in a KCS
FFh means 255 or more

send_icmd ret = 0
ipmiutil cmd, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x57 0x01 Byte 1
System Interface Type
[7:4] - reserved
[3:0] - System Interface Type
        0h = SSIF
        1h = KCS
        2h = SMIC
        all other = reserved

rcvd: 57 00 Byte 1
Completion Code
00h = Command Completed Normally
00 Byte 2
Reserved
Returned as 00h
00 Byte 3
Response Byte 3
For System Interface Type = KCS or SMIC:
[7:3] - reserved
[2:0] - System Interface Version
        000b = version 1
FF Byte 4
Input maximum message size in bytes. (1 based.)
For System Interface Type = KCS or SMIC:
Largest number of bytes that can be transferred in a KCS
FFh means 255 or more

Get BT Interface Capabilities - NetFn = App (0x06h), CMD = 0x36h, Privilege Level = User, M/O = M
| Linux |
[IPMItool]

ipmitool raw 0x06 0x36

[ipmiutil]

ipmiutil cmd 00 20 18 36
icmd 00 20 18 36

[FreeIPMI]

ipmi-raw 0x00 0x06 0x36

| MS-DOS |
[ipmitool]

ipmitool 20 18 36

For example
[IPMItool in Linux] Hint: hover over Place your mouse over the highlighted area in below
for Response Data description

$ ipmitool raw 0x06 0x36
 01 Byte 2
Number of Outstanding Requests Supported
1 based. 0 illegal
3f Byte 3
Input (Request) Buffer Message Size In Bytes
1 based
3f Byte 4
Output (Response) Buffer Message Size In Bytes
1 based
0a Byte 5
BMC Request-to-Response Time
in seconds, 1 based
30 seconds, maximum
01 Byte 6
Recommended Retries
1 based

Master Write-Read - NetFn = App (0x06h), CMD = 0x52h, Privilege Level = Operator, M/O = M
| Linux |
[IPMItool]

ipmitool raw 0x06 0x52 D[1] Byte 1
Bus ID
[7:4] channel number (Ignored when bus type = 1b)
[3:1] bus ID, 0-based (always 000b for public bus [bus type = 0b])
  [0] bus type:
      0b = public
      1b = private bus
D[2] Byte 2
Request Data 2
[7:1] - Slave Address
  [0] - reserved. Write as 0
D[3] Byte 3
Read Count
Number of bytes to read, 1 based
0 = no bytes to read
The maximum read count should be at least 34 bytes
D[4:N] Byte 4:N
Data to Write
This command should support at least 35 bytes of write data

ipmitool i2c [bus= #] <i2caddr> <read bytes> [write data]

[ipmiutil]

ipmiutil cmd 00 20 18 52 D[1] Byte 1
Bus ID
[7:4] channel number (Ignored when bus type = 1b)
[3:1] bus ID, 0-based (always 000b for public bus [bus type = 0b])
  [0] bus type:
      0b = public
      1b = private bus
D[2] Byte 2
Request Data 2
[7:1] - Slave Address
  [0] - reserved. Write as 0
D[3] Byte 3
Read Count
Number of bytes to read, 1 based
0 = no bytes to read
The maximum read count should be at least 34 bytes
D[4:N] Byte 4:N
Data to Write
This command should support at least 35 bytes of write data

[FreeIPMI]

ipmi-raw 0x00 0x06 0x52 D[1] Byte 1
Bus ID
[7:4] channel number (Ignored when bus type = 1b)
[3:1] bus ID, 0-based (always 000b for public bus [bus type = 0b])
  [0] bus type:
      0b = public
      1b = private bus
D[2] Byte 2
Request Data 2
[7:1] - Slave Address
  [0] - reserved. Write as 0
D[3] Byte 3
Read Count
Number of bytes to read, 1 based
0 = no bytes to read
The maximum read count should be at least 34 bytes
D[4:N] Byte 4:N
Data to Write
This command should support at least 35 bytes of write data

| MS-DOS |
[ipmitool]

ipmitool 20 18 52 Data[1:N]

--Completion Code--

81h = Lost Arbitration
82h = Bus Error
83h = NAK on Write
84h = Truncated Read

For example Hint: hover over Place your mouse over the highlighted area in below
for Response Data description
Master Write
[IPMItool in Linux]

$ ipmitool raw 0x06 0x52 0x05 Byte 1
Bus ID
[7:4] channel number (Ignored when bus type = 1b)
[3:1] bus ID, 0-based (always 000b for public bus [bus type = 0b])
  [0] bus type:
      0b = public
      1b = private bus
0xa0 Byte 2
Request Data 2
[7:1] - Slave Address
  [0] - reserved. Write as 0
0x00 Byte 3
Read Count
Number of bytes to read, 1 based
0 = no bytes to read
The maximum read count should be at least 34 bytes
0x00 0x00 0x31 0x32 0x33 0x34 Byte 4:N
Data to Write
[Note] 0x00 0x00 are 2 bytes offset address data
This command should support at least 35 bytes of write data


$ ipmitool raw 0x06 0x52 0x03 Byte 1
Bus ID
[7:4] channel number (Ignored when bus type = 1b)
[3:1] bus ID, 0-based (always 000b for public bus [bus type = 0b])
  [0] bus type:
      0b = public
      1b = private bus
0xa4 Byte 2
Request Data 2
[7:1] - Slave Address
  [0] - reserved. Write as 0
0x00 Byte 3
Read Count
Number of bytes to read, 1 based
0 = no bytes to read
The maximum read count should be at least 34 bytes
0x00 0x00 0x01 0x20 0x00 0x01 0x00 0x10 0x00 0xce Byte 4:N
Data to Write
[Note] 0x00 0x00 are 2 bytes offset address data
This command should support at least 35 bytes of write data


$ ipmitool i2c bus=2 [bus= #]
Bus ID
0xa0 <i2caddr>
Slave Address
0x00 <read bytes>
Read Count
0x00 0x00 0x31 0x32 0x33 0x34 [write data]
Data to Write
[Note] 0x00 0x00 are 2 bytes offset address data

Wrote 6 bytes to I2C device A0h

[ipmiutil in Linux]

$ icmd 00 20 18 52 05 Byte 1
Bus ID
[7:4] channel number (Ignored when bus type = 1b)
[3:1] bus ID, 0-based (always 000b for public bus [bus type = 0b])
  [0] bus type:
      0b = public
      1b = private bus
a0 Byte 2
Request Data 2
[7:1] - Slave Address
  [0] - reserved. Write as 0
00 Byte 3
Read Count
Number of bytes to read, 1 based
0 = no bytes to read
The maximum read count should be at least 34 bytes
00 00 31 32 33 34 Byte 4:N
Data to Write
[Note] 0x00 0x00 are 2 bytes offset address data
This command should support at least 35 bytes of write data

ipmiutil ver 3.08
icmd ver 3.08
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
send_icmd ret = 0
ipmiutil cmd, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x52 0x05 Byte 1
Bus ID
[7:4] channel number (Ignored when bus type = 1b)
[3:1] bus ID, 0-based (always 000b for public bus [bus type = 0b])
  [0] bus type:
      0b = public
      1b = private bus
0xa0 Byte 2
Request Data 2
[7:1] - Slave Address
  [0] - reserved. Write as 0
0x00 Byte 3
Read Count
Number of bytes to read, 1 based
0 = no bytes to read
The maximum read count should be at least 34 bytes
0x00 0x00 0x31 0x32 0x33 0x34 Byte 4:N
Data to Write
[Note] 0x00 0x00 are 2 bytes offset address data
This command should support at least 35 bytes of write data

rcvd: 52 00 Byte 1
Completion Code
A management controller shall return an error Completion Code if an attempt is made to access an unsupported bus
  81h = Lost Arbitration
  82h = Bus Error
  83h = NAK on Write
  84h = Truncated Read

[IPMI tool under DOS]

C:\>ipmitool 20 18 52 03 a4 00 00 00 01 20 00 01 00 10 00 ce
20 1c 52 00

Master Read
[IPMItool in Linux]

$ ipmitool raw 0x06 0x52 0x03 Byte 1
Bus ID
[7:4] channel number (Ignored when bus type = 1b)
[3:1] bus ID, 0-based (always 000b for public bus [bus type = 0b])
  [0] bus type:
      0b = public
      1b = private bus
0xa4 Byte 2
Request Data 2
[7:1] - Slave Address
  [0] - reserved. Write as 0
0x08 Byte 3
Read Count
Number of bytes to read, 1 based
0 = no bytes to read
The maximum read count should be at least 34 bytes
0x00 0x00 Byte 4:N
Data to Write
[Note] 0x00 0x00 are 2 bytes offset address data

 01 20 00 01 00 10 00 ce (Byte 2:M)
Bytes Read From Specified Slave Address
This field will be absent if the read count is 0

$ ipmitool raw 0x06 0x52 0x05 0xa0 0x04 0x00 0x00
 31 32 33 34
$ ipmitool i2c bus=2 0xa0 0x04 0x00 0x00
 31 32 33 34
00110001 00110010 00110011 00110100
$ ipmitool raw 0x06 0x52 0x0d 0x90 0x02
 23 80
$ ipmitool i2c bus=6 0x90 0x02
Read 2 bytes from I2C device 90h
 23 80
00100011 10000000
$ ipmitool raw 0x06 0x52 0x05 0xa4 0x04
Unable to send RAW command (channel=0x0 netfn=0x6 lun=0x0 cmd=0x52 rsp= 0x83 Byte 1
Completion Code
A management controller shall return an error Completion Code if an attempt is made to access an unsupported bus
  81h = Lost Arbitration
  82h = Bus Error
  83h = NAK on Write
  84h = Truncated Read
): Unknown (0x83 Byte 1
Completion Code
A management controller shall return an error Completion Code if an attempt is made to access an unsupported bus
  81h = Lost Arbitration
  82h = Bus Error
  83h = NAK on Write
  84h = Truncated Read
)
$ ipmitool i2c bus=2 0xa4 0x04
I2C Master Write-Read command failed: NAK on Write
Unable to perform I2C Master Write-Read

[ipmiutil in Linux]

$ icmd 00 20 18 52 05 Byte 1
Bus ID
[7:4] channel number (Ignored when bus type = 1b)
[3:1] bus ID, 0-based (always 000b for public bus [bus type = 0b])
  [0] bus type:
      0b = public
      1b = private bus
a0 Byte 2
Request Data 2
[7:1] - Slave Address
  [0] - reserved. Write as 0
04 Byte 3
Read Count
Number of bytes to read, 1 based
0 = no bytes to read
The maximum read count should be at least 34 bytes
00 00 Byte 4:N
Data to Write
[Note] 00 00 are 2 bytes offset address data

ipmiutil ver 3.08
icmd ver 3.08
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
respData[len=4]: 31 32 33 34 (Byte 2:M)
Bytes Read From Specified Slave Address
This field will be absent if the read count is 0

send_icmd ret = 0
ipmiutil cmd, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x52 0x05 Byte 1
Bus ID
[7:4] channel number (Ignored when bus type = 1b)
[3:1] bus ID, 0-based (always 000b for public bus [bus type = 0b])
  [0] bus type:
      0b = public
      1b = private bus
0xa0 Byte 2
Request Data 2
[7:1] - Slave Address
  [0] - reserved. Write as 0
0x04 Byte 3
Read Count
Number of bytes to read, 1 based
0 = no bytes to read
The maximum read count should be at least 34 bytes
0x00 0x00 Byte 4:N
Data to Write
[Note] 0x00 0x00 are 2 bytes offset address data

rcvd: 52 00 Byte 1
Completion Code
A management controller shall return an error Completion Code if an attempt is made to access an unsupported bus
  81h = Lost Arbitration
  82h = Bus Error
  83h = NAK on Write
  84h = Truncated Read
31 32 33 34 (Byte 2:M)
Bytes Read From Specified Slave Address
This field will be absent if the read count is 0

[IPMI tool under DOS]

C:\>ipmitool 20 18 52 03 a4 08 00 00
20 1c 52 00 01 20 00 01 00 10 00 ce

Get Channel Authentication Capabilities - NetFn = App (0x06h), CMD = 0x38h, Privilege Level = Any, M/O = O
| Linux |
[IPMItool]

ipmitool raw 0x06 0x38 D[1] Byte 1
Channel Number
  [7] - 1b = get IPMI v2.0+ extended data
        0b = Backward compatible with IPMI v1.5
[6:4] - reserved
[3:0] - channel number
        0h-Bh, Fh = channel numbers
        Eh = retrieve information for channel this request was issued on. D[2] Byte 2
Requested Maximum Privilege Level
[7:4] - reserved
[3:0] - requested privilege level
        0h = reserved
        1h = Callback level
        2h = User level
        3h = Operator level
        4h = Administrator level
        5h = OEM Proprietary level

ipmitool channel authcap <channel number> <max privilege> Max Privilege
Privilege Level
Possible privilege levels are:
   1   Callback level
   2   User level
   3   Operator level
   4   Administrator level
   5   OEM Proprietary level
  15   No access

[ipmiutil]

ipmiutil cmd 00 20 18 38 D[1] Byte 1
Channel Number
  [7] - 1b = get IPMI v2.0+ extended data
        0b = Backward compatible with IPMI v1.5
[6:4] - reserved
[3:0] - channel number
        0h-Bh, Fh = channel numbers
        Eh = retrieve information for channel this request was issued on. D[2] Byte 2
Requested Maximum Privilege Level
[7:4] - reserved
[3:0] - requested privilege level
        0h = reserved
        1h = Callback level
        2h = User level
        3h = Operator level
        4h = Administrator level
        5h = OEM Proprietary level

icmd 00 20 18 38 D[1] Byte 1
Channel Number
  [7] - 1b = get IPMI v2.0+ extended data
        0b = Backward compatible with IPMI v1.5
[6:4] - reserved
[3:0] - channel number
        0h-Bh, Fh = channel numbers
        Eh = retrieve information for channel this request was issued on. D[2] Byte 2
Requested Maximum Privilege Level
[7:4] - reserved
[3:0] - requested privilege level
        0h = reserved
        1h = Callback level
        2h = User level
        3h = Operator level
        4h = Administrator level
        5h = OEM Proprietary level

[FreeIPMI]

ipmi-raw 0x00 0x06 0x38 D[1] Byte 1
Channel Number
  [7] - 1b = get IPMI v2.0+ extended data
        0b = Backward compatible with IPMI v1.5
[6:4] - reserved
[3:0] - channel number
        0h-Bh, Fh = channel numbers
        Eh = retrieve information for channel this request was issued on. D[2] Byte 2
Requested Maximum Privilege Level
[7:4] - reserved
[3:0] - requested privilege level
        0h = reserved
        1h = Callback level
        2h = User level
        3h = Operator level
        4h = Administrator level
        5h = OEM Proprietary level

| MS-DOS |
[ipmitool]

ipmitool 00 20 18 38 Data[1:2]

For example
Channel Number = 0x01 & Requested Privilege Level = Administrator
[IPMItool in Linux] Hint: hover over Place your mouse over the highlighted area in below
for Response Data description

$ ipmitool raw 0x06 0x38 0x81 Byte 1
Channel Number
  [7] - 1b = get IPMI v2.0+ extended data
        0b = Backward compatible with IPMI v1.5
[6:4] - reserved
[3:0] - channel number
        0h-Bh, Fh = channel numbers
        Eh = retrieve information for channel this request was issued on. 0x04 Byte 2
Requested Maximum Privilege Level
[7:4] - reserved
[3:0] - requested privilege level
        0h = reserved
        1h = Callback level
        2h = User level
        3h = Operator level
        4h = Administrator level
        5h = OEM Proprietary level

 01 Byte 2
Channel Number
Channel number that the Authentication Capabilities is being returned for
b7 Byte 3
Authentication Type Support
  [7] - 1b = IPMI v2.0+ extended capabilities available
        0b = IPMI v1.5 support only
  [6] - reserved
[5:0] -IPMI v1.5 Authentication type(s) enabled for given Requested Maximum Privilege Level
        All bits: 1b = supported
        0b = authentication type not available for use
  [5] - OEM proprietary (per OEM identified by the IANA OEM ID in the RMCP Ping Response)
  [4] - straight password / key
  [3] - reserved
  [2] - MD5
  [1] - MD2
  [0] - none
04 Byte 4
Response Byte 4
[7:6] - reserved
  [5] - KG status (two-key login status)
        0b = KG is set to default (all 0's)
        1b = KG is set to non-zero value
  [4] - Per-message Authentication status
        0b = Per-message Authentication is enabled
        1b = Per-message Authentication is disabled
  [3] - User Level Authentication status
        0b = User Level Authentication is enabled
        1b = User Level Authentication is disabled
[2:0] - Anonymous Login status
        [2] - 1b = Non-null usernames enabled
        [1] - 1b = Null usernames enabled
        [0] - 1b = Anonymous Login enabled
03 Byte 5
Response Byte 5
For IPMI v1.5: - reserved
For IPMI v2.0+: - Extended Capabilities
[7:2] - reserved
  [1] - 1b = channel supports IPMI v2.0 connections
  [0] - 1b = channel supports IPMI v1.5 connections
00 00 00 Byte [6:8]
OEM ID
IANA Enterprise Number for OEM/Organization that specified the particular OEM Authentication Type for RMCP
Least significant byte first
Return 00h, 00h, 00h if no OEM authentication type available
00 Byte 9
OEM Auxiliary Data
Additional OEM-specific information for the OEM Authentication Type for RMCP
Return 00h if no OEM authentication type available

$ ipmitool channel authcap 1 Channel Number

4 Max Privilege
Privilege Level
Possible privilege levels are:
   1   Callback level
   2   User level
   3   Operator level
   4   Administrator level
   5   OEM Proprietary level
  15   No access

Channel number             : 1
IPMI v1.5  auth types      : NONE MD2 MD5 PASSWORD OEM
KG status                  : default (all zeroes)
Per message authentication : enabled
User level authentication  : enabled
Non-null user names exist  : yes
Null user names exist      : no
Anonymous login enabled    : no
Channel supports IPMI v1.5 : yes
Channel supports IPMI v2.0 : yes
IANA Number for OEM        : 0
OEM Auxiliary Data         : 0x0

[ipmiutil in Linux]

$ icmd 00 20 18 38 81 Byte 1
Channel Number
  [7] - 1b = get IPMI v2.0+ extended data
        0b = Backward compatible with IPMI v1.5
[6:4] - reserved
[3:0] - channel number
        0h-Bh, Fh = channel numbers
        Eh = retrieve information for channel this request was issued on. 04 Byte 2
Requested Maximum Privilege Level
[7:4] - reserved
[3:0] - requested privilege level
        0h = reserved
        1h = Callback level
        2h = User level
        3h = Operator level
        4h = Administrator level
        5h = OEM Proprietary level

ipmiutil ver 3.08
icmd ver 3.08
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
respData[len=8]: 01 Byte 2
Channel Number
Channel number that the Authentication Capabilities is being returned for
b7 Byte 3
Authentication Type Support
  [7] - 1b = IPMI v2.0+ extended capabilities available
        0b = IPMI v1.5 support only
  [6] - reserved
[5:0] -IPMI v1.5 Authentication type(s) enabled for given Requested Maximum Privilege Level
        All bits: 1b = supported
        0b = authentication type not available for use
  [5] - OEM proprietary (per OEM identified by the IANA OEM ID in the RMCP Ping Response)
  [4] - straight password / key
  [3] - reserved
  [2] - MD5
  [1] - MD2
  [0] - none
04 Byte 4
Response Byte 4
[7:6] - reserved
  [5] - KG status (two-key login status)
        0b = KG is set to default (all 0's)
        1b = KG is set to non-zero value
  [4] - Per-message Authentication status
        0b = Per-message Authentication is enabled
        1b = Per-message Authentication is disabled
  [3] - User Level Authentication status
        0b = User Level Authentication is enabled
        1b = User Level Authentication is disabled
[2:0] - Anonymous Login status
        [2] - 1b = Non-null usernames enabled
        [1] - 1b = Null usernames enabled
        [0] - 1b = Anonymous Login enabled
03 Byte 5
Response Byte 5
For IPMI v1.5: - reserved
For IPMI v2.0+: - Extended Capabilities
[7:2] - reserved
  [1] - 1b = channel supports IPMI v2.0 connections
  [0] - 1b = channel supports IPMI v1.5 connections
00 00 00 Byte [6:8]
OEM ID
IANA Enterprise Number for OEM/Organization that specified the particular OEM Authentication Type for RMCP
Least significant byte first
Return 00h, 00h, 00h if no OEM authentication type available
00 Byte 9
OEM Auxiliary Data
Additional OEM-specific information for the OEM Authentication Type for RMCP
Return 00h if no OEM authentication type available

send_icmd ret = 0
ipmiutil cmd, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x38 0x81 Byte 1
Channel Number
  [7] - 1b = get IPMI v2.0+ extended data
        0b = Backward compatible with IPMI v1.5
[6:4] - reserved
[3:0] - channel number
        0h-Bh, Fh = channel numbers
        Eh = retrieve information for channel this request was issued on. 0x04 Byte 2
Requested Maximum Privilege Level
[7:4] - reserved
[3:0] - requested privilege level
        0h = reserved
        1h = Callback level
        2h = User level
        3h = Operator level
        4h = Administrator level
        5h = OEM Proprietary level

rcvd: 38 00 Byte 1
Completion Code
00h = Command Completed Normally
01 Byte 2
Channel Number
Channel number that the Authentication Capabilities is being returned for
B7 Byte 3
Authentication Type Support
  [7] - 1b = IPMI v2.0+ extended capabilities available
        0b = IPMI v1.5 support only
  [6] - reserved
[5:0] -IPMI v1.5 Authentication type(s) enabled for given Requested Maximum Privilege Level
        All bits: 1b = supported
        0b = authentication type not available for use
  [5] - OEM proprietary (per OEM identified by the IANA OEM ID in the RMCP Ping Response)
  [4] - straight password / key
  [3] - reserved
  [2] - MD5
  [1] - MD2
  [0] - none
04 Byte 4
Response Byte 4
[7:6] - reserved
  [5] - KG status (two-key login status)
        0b = KG is set to default (all 0's)
        1b = KG is set to non-zero value
  [4] - Per-message Authentication status
        0b = Per-message Authentication is enabled
        1b = Per-message Authentication is disabled
  [3] - User Level Authentication status
        0b = User Level Authentication is enabled
        1b = User Level Authentication is disabled
[2:0] - Anonymous Login status
        [2] - 1b = Non-null usernames enabled
        [1] - 1b = Null usernames enabled
        [0] - 1b = Anonymous Login enabled
03 Byte 5
Response Byte 5
For IPMI v1.5: - reserved
For IPMI v2.0+: - Extended Capabilities
[7:2] - reserved
  [1] - 1b = channel supports IPMI v2.0 connections
  [0] - 1b = channel supports IPMI v1.5 connections
00 00 00 Byte [6:8]
OEM ID
IANA Enterprise Number for OEM/Organization that specified the particular OEM Authentication Type for RMCP
Least significant byte first
Return 00h, 00h, 00h if no OEM authentication type available
00 Byte 9
OEM Auxiliary Data
Additional OEM-specific information for the OEM Authentication Type for RMCP
Return 00h if no OEM authentication type available

Get System GUID - NetFn = App (0x06h), CMD = 0x37h, Privilege Level = Any, M/O = O
| Linux |
[IPMItool]

ipmitool raw 0x06 0x37
ipmitool mc guid
ipmitool bmc guid

[ipmiutil]

ipmiutil cmd 00 20 18 37
ipmiutil health -g
ihealth -g
ipmiutil fru
ifru

[FreeIPMI]

ipmi-raw 0x00 0x06 0x37
bmc-info
bmc-info --get-system-guid

| MS-DOS |
[ipmitool]

ipmitool 20 18 37

For example
[IPMItool in Linux] Hint: hover over Place your mouse over the highlighted area in below
for Response Data description

$ ipmitool raw 0x06 0x37
 d8 cb 8a f7 c6 b6 9f 03 00 10 de bf ae 90 40 6c Byte [2:17]
GUID bytes 1 through 16

$ ipmitool mc guid
System GUID  : f78acbd8-b6c6-039f-0010-debfae90406c
Timestamp    : 08/10/2101 06:08:24

[ipmiutil in Linux]

$ icmd 00 20 18 37
ipmiutil ver 3.08
icmd ver 3.08
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
respData[len=16]: d8 cb 8a f7 c6 b6 9f 03 00 10 de bf ae 90 40 6c Byte [2:17]
GUID bytes 1 through 16

send_icmd ret = 0
ipmiutil cmd, completed successfully
$ ihealth -g | grep GUID
System GUID       = d8cb8af7-c6b6-9f03-0010-debfae90406c
$ ifru | grep GUID
[Baseboard,20,00] System GUID         : d8cb8af7-c6b6-9f03-0010-debfae90406c

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x37
rcvd: 37 00 Byte 1
Completion Code
00h = Command Completed Normally
D8 CB 8A F7 C6 B6 9F 03 00 10 DE BF AE 90 40 6C Byte [2:17]
GUID bytes 1 through 16

$ bmc-info | grep GUID
Device GUID : 6c40e108-bfde-1000-039f-b6c6f78acbd8
System GUID : 6c4090ae-bfde-1000-039f-b6c6f78acbd8
$ bmc-info --get-system-guid
6c4090ae-bfde-1000-039f-b6c6f78acbd8

Set System Info Parameters - NetFn = App (0x06h), CMD = 0x58h, Privilege Level = Admin, M/O = O

Get System Info Parameters - NetFn = App (0x06h), CMD = 0x59h, Privilege Level = User, M/O = O
| Linux |
[IPMItool]

ipmitool raw 0x06 0x59 D[1] Byte 1
Request Byte 1
  [7] - 0b = get parameter
        1b = get parameter revision only
[6:0] - reserved
D[2] Byte 2
Parameter selector
Table 22-16c, System Info Parameters
        0 - Set In Progress
        1 - System Firmware version
        2 - System name
        3 - Primary Operating System Name
        4 - Operating System Name
        5 - Present OS Version number
        6 - BMC URL
        7 - Base OS/Hypervisor URL For Manageability
192 : 255 - OEM
D[3] Byte 3
Set Selector
Selects a given set of parameters under a given Parameter selector value
00h if parameter doesn't use a Set Selector
D[4] Byte 4
Block Selector
00h if parameter does not require a block number

[ipmiutil]

ipmiutil cmd 00 20 18 59 D[1] Byte 1
Request Byte 1
  [7] - 0b = get parameter
        1b = get parameter revision only
[6:0] - reserved
D[2] Byte 2
Parameter selector
Table 22-16c, System Info Parameters
        0 - Set In Progress
        1 - System Firmware version
        2 - System name
        3 - Primary Operating System Name
        4 - Operating System Name
        5 - Present OS Version number
        6 - BMC URL
        7 - Base OS/Hypervisor URL For Manageability
192 : 255 - OEM
D[3] Byte 3
Set Selector
Selects a given set of parameters under a given Parameter selector value
00h if parameter doesn't use a Set Selector
D[4] Byte 4
Block Selector
00h if parameter does not require a block number

icmd 00 20 18 59 D[1] Byte 1
Request Byte 1
  [7] - 0b = get parameter
        1b = get parameter revision only
[6:0] - reserved
D[2] Byte 2
Parameter selector
Table 22-16c, System Info Parameters
        0 - Set In Progress
        1 - System Firmware version
        2 - System name
        3 - Primary Operating System Name
        4 - Operating System Name
        5 - Present OS Version number
        6 - BMC URL
        7 - Base OS/Hypervisor URL For Manageability
192 : 255 - OEM
D[3] Byte 3
Set Selector
Selects a given set of parameters under a given Parameter selector value
00h if parameter doesn't use a Set Selector
D[4] Byte 4
Block Selector
00h if parameter does not require a block number

[FreeIPMI]

ipmi-raw 0x00 0x06 0x59 D[1] Byte 1
Request Byte 1
  [7] - 0b = get parameter
        1b = get parameter revision only
[6:0] - reserved
D[2] Byte 2
Parameter selector
Table 22-16c, System Info Parameters
        0 - Set In Progress
        1 - System Firmware version
        2 - System name
        3 - Primary Operating System Name
        4 - Operating System Name
        5 - Present OS Version number
        6 - BMC URL
        7 - Base OS/Hypervisor URL For Manageability
192 : 255 - OEM
D[3] Byte 3
Set Selector
Selects a given set of parameters under a given Parameter selector value
00h if parameter doesn't use a Set Selector
D[4] Byte 4
Block Selector
00h if parameter does not require a block number

| MS-DOS |
[ipmitool]

ipmitool 20 18 59 Data[1:4]

--Completion Code--

80h = parameter not supported

For example
[IPMItool in Linux] Hint: hover over Place your mouse over the highlighted area in below
for Response Data description

$ ipmitool raw 0x06 0x59 0x00 Byte 1
Request Byte 1
  [7] - 0b = get parameter
        1b = get parameter revision only
[6:0] - reserved
0x00 Byte 2
Parameter selector
Table 22-16c, System Info Parameters
        0 - Set In Progress
        1 - System Firmware version
        2 - System name
        3 - Primary Operating System Name
        4 - Operating System Name
        5 - Present OS Version number
        6 - BMC URL
        7 - Base OS/Hypervisor URL For Manageability
192 : 255 - OEM
0x00 Byte 3
Set Selector
Selects a given set of parameters under a given Parameter selector value
00h if parameter doesn't use a Set Selector
0x00 Byte 4
Block Selector
00h if parameter does not require a block number

 11 Byte 2
Response Byte 2
[7:0] - Parameter revision. Format:
        MSN = present revision
        LSN = oldest revision parameter is backward compatible with
        11h for parameters in this specification
00 Byte 3
Response Byte 3
Table 22-16c, System Info Parameters
Parameter # 0: Set In Progress
Data 1
This parameter is used to indicate when any of the following parameters are being updated, and when the updates are completed
[7:2] - reserved
[1:0] - 00b = set complete
        01b = set in progress
        10b = commit write (optional)
        11b = reserved

$ ipmitool raw 0x06 0x59 0x00 Byte 1
Request Byte 1
  [7] - 0b = get parameter
        1b = get parameter revision only
[6:0] - reserved
0x01 Byte 2
Parameter selector
Table 22-16c, System Info Parameters
        0 - Set In Progress
        1 - System Firmware version
        2 - System name
        3 - Primary Operating System Name
        4 - Operating System Name
        5 - Present OS Version number
        6 - BMC URL
        7 - Base OS/Hypervisor URL For Manageability
192 : 255 - OEM
0x00 Byte 3
Set Selector
Selects a given set of parameters under a given Parameter selector value
00h if parameter doesn't use a Set Selector
0x00 Byte 4
Block Selector
00h if parameter does not require a block number

 11 Byte 2
Response Byte 2
[7:0] - Parameter revision. Format:
        MSN = present revision
        LSN = oldest revision parameter is backward compatible with
        11h for parameters in this specification
00 Byte 3
System Firmware Version string in text
Table 22-16c, System Info Parameters
Parameter # 1: System Firmware version
System Firmware Version string in text
data 1 - set selector = 16-byte data block number to access, 0 based
00 0a 56 65 72 73 69 6f 6e 31 2e 30 00 00
 00 00 Byte [4:19]
System Firmware Version string in text
Table 22-16c, System Info Parameters
Parameter # 1: System Firmware version
System Firmware Version string in text
data [2:17] - 16-byte block for system firmware name string data
  string data byte 1:
      [7:4] - reserved
      [3:0] - encoding
              0h = ASCII+Latin1
              1h = UTF-8
              2h = UNICODE
              all other = reserved
  string data byte 2:
      [7:0] - string length (in bytes, 1-based)

$ ipmitool raw 0x06 0x59 0x00 Byte 1
Request Byte 1
  [7] - 0b = get parameter
        1b = get parameter revision only
[6:0] - reserved
0x02 Byte 2
Parameter selector
Table 22-16c, System Info Parameters
        0 - Set In Progress
        1 - System Firmware version
        2 - System name
        3 - Primary Operating System Name
        4 - Operating System Name
        5 - Present OS Version number
        6 - BMC URL
        7 - Base OS/Hypervisor URL For Manageability
192 : 255 - OEM
0x00 Byte 3
Set Selector
Selects a given set of parameters under a given Parameter selector value
00h if parameter doesn't use a Set Selector
0x00 Byte 4
Block Selector
00h if parameter does not require a block number

 11 Byte 2
Response Byte 2
[7:0] - Parameter revision. Format:
        MSN = present revision
        LSN = oldest revision parameter is backward compatible with
        11h for parameters in this specification
00 Byte 3
System Name
Table 22-16c, System Info Parameters
Parameter # 2: System name
A name for the overall system to be associated with the BMC
data 1 - set selector = 16-byte data block number to access, 0 based
00 09 52 4d 4d 61 6e 61 67 65 72 00 00 00
 00 00 Byte [4:19]
System Name
Table 22-16c, System Info Parameters
Parameter # 2: System name
A name for the overall system to be associated with the BMC
data [2:17] - 16-byte block for system name string data
  string data byte 1:
      [7:4] - reserved
      [3:0] - encoding
              0h = ASCII+Latin1
              1h = UTF-8
              2h = UNICODE
              all other = reserved
  string data byte 2:
      [7:0] - string length (in bytes, 1-based)

$ ipmitool raw 0x06 0x59 0x00 Byte 1
Request Byte 1
  [7] - 0b = get parameter
        1b = get parameter revision only
[6:0] - reserved
0x03 Byte 2
Parameter selector
Table 22-16c, System Info Parameters
        0 - Set In Progress
        1 - System Firmware version
        2 - System name
        3 - Primary Operating System Name
        4 - Operating System Name
        5 - Present OS Version number
        6 - BMC URL
        7 - Base OS/Hypervisor URL For Manageability
192 : 255 - OEM
0x00 Byte 3
Set Selector
Selects a given set of parameters under a given Parameter selector value
00h if parameter doesn't use a Set Selector
0x00 Byte 4
Block Selector
00h if parameter does not require a block number

 11 Byte 2
Response Byte 2
[7:0] - Parameter revision. Format:
        MSN = present revision
        LSN = oldest revision parameter is backward compatible with
        11h for parameters in this specification
00 Byte 3
Primary Operating system name
Table 22-16c, System Info Parameters
Parameter # 3: Primary Operating System Name
The OS that the system boots to for this BMC according to the default configuration of its system firmware
data 1 - set selector = 16-byte data block number to access, 0 based
00 0d 53 55 53 45 53 65 72 76 65 72 31 2e
 30 00 Byte [4:19]
Primary Operating system name
Table 22-16c, System Info Parameters
Parameter # 3: Primary Operating System Name
The OS that the system boots to for this BMC according to the default configuration of its system firmware
data [2:17] - 16-byte block for system name string data
  string data byte 1:
      [7:4] - reserved
      [3:0] - encoding
              0h = ASCII+Latin1
              1h = UTF-8
              2h = UNICODE
              all other = reserved
  string data byte 2:
      [7:0] - string length (in bytes, 1-based)

$ ipmitool raw 0x06 0x59 0x00 0x04 0x00 0x00
 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00
$ ipmitool raw 0x06 0x59 0x00 0x05 0x00 0x00
 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00

[ipmiutil in Linux]

$ icmd 00 20 18 59 00 Byte 1
Request Byte 1
  [7] - 0b = get parameter
        1b = get parameter revision only
[6:0] - reserved
00 Byte 2
Parameter selector
Table 22-16c, System Info Parameters
        0 - Set In Progress
        1 - System Firmware version
        2 - System name
        3 - Primary Operating System Name
        4 - Operating System Name
        5 - Present OS Version number
        6 - BMC URL
        7 - Base OS/Hypervisor URL For Manageability
192 : 255 - OEM
00 Byte 3
Set Selector
Selects a given set of parameters under a given Parameter selector value
00h if parameter doesn't use a Set Selector
00 Byte 4
Block Selector
00h if parameter does not require a block number

ipmiutil ver 3.08
icmd ver 3.08
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
respData[len=2]: 11 Byte 2
Response Byte 2
[7:0] - Parameter revision. Format:
        MSN = present revision
        LSN = oldest revision parameter is backward compatible with
        11h for parameters in this specification
00 Byte 3
Response Byte 3
Table 22-16c, System Info Parameters
Parameter # 0: Set In Progress
Data 1
This parameter is used to indicate when any of the following parameters are being updated, and when the updates are completed
[7:2] - reserved
[1:0] - 00b = set complete
        01b = set in progress
        10b = commit write (optional)
        11b = reserved

send_icmd ret = 0
ipmiutil cmd, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x59 0x00 Byte 1
Request Byte 1
  [7] - 0b = get parameter
        1b = get parameter revision only
[6:0] - reserved
0x00 Byte 2
Parameter selector
Table 22-16c, System Info Parameters
        0 - Set In Progress
        1 - System Firmware version
        2 - System name
        3 - Primary Operating System Name
        4 - Operating System Name
        5 - Present OS Version number
        6 - BMC URL
        7 - Base OS/Hypervisor URL For Manageability
192 : 255 - OEM
0x00 Byte 3
Set Selector
Selects a given set of parameters under a given Parameter selector value
00h if parameter doesn't use a Set Selector
0x00 Byte 4
Block Selector
00h if parameter does not require a block number

rcvd: 59 00 Byte 1
Completion Code
00h = Command Completed Normally
80h = parameter not supported
11 Byte 2
Response Byte 2
[7:0] - Parameter revision. Format:
        MSN = present revision
        LSN = oldest revision parameter is backward compatible with
        11h for parameters in this specification
00 Byte 3
Response Byte 3
Table 22-16c, System Info Parameters
Parameter # 0: Set In Progress
Data 1
This parameter is used to indicate when any of the following parameters are being updated, and when the updates are completed
[7:2] - reserved
[1:0] - 00b = set complete
        01b = set in progress
        10b = commit write (optional)
        11b = reserved

Get Channel Cipher Suites - NetFn = App (0x06h), CMD = 0x54h, Privilege Level = Any, M/O = O
| Linux |
[IPMItool]

ipmitool raw 0x06 0x54 D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - channel number
        0h-Bh, Fh = channel numbers
        Eh = retrieve information for channel this request was issued on
D[2] Byte 2
Payload Type
[7:6] - reserved
[5:0] - Payload Type number
Typically 00h (IPMI)
D[3] Byte 3
List Index
  [7] - 1b = list algorithms by Cipher Suite
        0b = list supported algorithms[1]
  [6] - reserved
[5:0] - List index (00h-3Fh)
        0h selects the first set of 16
        1h selects the next set of 16, and so on
00h = Get first set of algorithm numbers

ipmitool channel getciphers <ipmi | sol> [channel]

[ipmiutil]

ipmiutil cmd 00 20 18 54 D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - channel number
        0h-Bh, Fh = channel numbers
        Eh = retrieve information for channel this request was issued on
D[2] Byte 2
Payload Type
[7:6] - reserved
[5:0] - Payload Type number
Typically 00h (IPMI)
D[3] Byte 3
List Index
  [7] - 1b = list algorithms by Cipher Suite
        0b = list supported algorithms[1]
  [6] - reserved
[5:0] - List index (00h-3Fh)
        0h selects the first set of 16
        1h selects the next set of 16, and so on
00h = Get first set of algorithm numbers

icmd 00 20 18 54 D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - channel number
        0h-Bh, Fh = channel numbers
        Eh = retrieve information for channel this request was issued on
D[2] Byte 2
Payload Type
[7:6] - reserved
[5:0] - Payload Type number
Typically 00h (IPMI)
D[3] Byte 3
List Index
  [7] - 1b = list algorithms by Cipher Suite
        0b = list supported algorithms[1]
  [6] - reserved
[5:0] - List index (00h-3Fh)
        0h selects the first set of 16
        1h selects the next set of 16, and so on
00h = Get first set of algorithm numbers

[FreeIPMI]

ipmi-raw 0x00 0x06 0x54 D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - channel number
        0h-Bh, Fh = channel numbers
        Eh = retrieve information for channel this request was issued on
D[2] Byte 2
Payload Type
[7:6] - reserved
[5:0] - Payload Type number
Typically 00h (IPMI)
D[3] Byte 3
List Index
  [7] - 1b = list algorithms by Cipher Suite
        0b = list supported algorithms[1]
  [6] - reserved
[5:0] - List index (00h-3Fh)
        0h selects the first set of 16
        1h selects the next set of 16, and so on
00h = Get first set of algorithm numbers

| MS-DOS |
[ipmitool]

ipmitool 20 18 54 Data[1:3]

For example
[IPMItool in Linux] Hint: hover over Place your mouse over the highlighted area in below
for Response Data description

$ ipmitool raw 0x06 0x54 0x01 Byte 1
Channel Number
[7:4] - reserved
[3:0] - channel number
        0h-Bh, Fh = channel numbers
        Eh = retrieve information for channel this request was issued on
0x00 Byte 2
Payload Type
[7:6] - reserved
[5:0] - Payload Type number
Typically 00h (IPMI)
0x00 Byte 3
List Index
  [7] - 1b = list algorithms by Cipher Suite
        0b = list supported algorithms[1]
  [6] - reserved
[5:0] - List index (00h-3Fh)
        0h selects the first set of 16
        1h selects the next set of 16, and so on
00h = Get first set of algorithm numbers

 01 Byte 2
Channel Number
Channel number that the Authentication Algorithms are being returned for
00 01 02 03 40 41 42 43 44 80 81 Byte (3:18)
Cipher Suite Record Data Bytes
per Table 22-19, Cipher Suite Record Format

$ ipmitool channel getciphers ipmi 1
ID   IANA    Auth Alg        Integrity Alg   Confidentiality Alg
0    N/A     none            none            none
1    N/A     hmac_sha1       none            none
2    N/A     hmac_sha1       hmac_sha1_96    none
3    N/A     hmac_sha1       hmac_sha1_96    aes_cbc_128
6    N/A     hmac_md5        none            none
7    N/A     hmac_md5        hmac_md5_128    none
8    N/A     hmac_md5        hmac_md5_128    aes_cbc_128
11   N/A     hmac_md5        md5_128         none
12   N/A     hmac_md5        md5_128         aes_cbc_128
15   N/A     Unknown (0x03)  none            none
16   N/A     Unknown (0x03)  Unknown (0x03)  none
17   N/A     Unknown (0x03)  Unknown (0x03)  aes_cbc_128

[ipmiutil in Linux]

$ icmd 00 20 18 54 01 Byte 1
Channel Number
[7:4] - reserved
[3:0] - channel number
        0h-Bh, Fh = channel numbers
        Eh = retrieve information for channel this request was issued on
00 Byte 2
Payload Type
[7:6] - reserved
[5:0] - Payload Type number
Typically 00h (IPMI)
00 Byte 3
List Index
  [7] - 1b = list algorithms by Cipher Suite
        0b = list supported algorithms[1]
  [6] - reserved
[5:0] - List index (00h-3Fh)
        0h selects the first set of 16
        1h selects the next set of 16, and so on
00h = Get first set of algorithm numbers

ipmiutil ver 3.08
icmd ver 3.08
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
respData[len=12]: 01 Byte 2
Channel Number
Channel number that the Authentication Algorithms are being returned for
00 01 02 03 40 41 42 43 44 80 81 Byte (3:18)
Cipher Suite Record Data Bytes
per Table 22-19, Cipher Suite Record Format

send_icmd ret = 0
ipmiutil cmd, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x54 0x01 Byte 1
Channel Number
[7:4] - reserved
[3:0] - channel number
        0h-Bh, Fh = channel numbers
        Eh = retrieve information for channel this request was issued on
0x00 Byte 2
Payload Type
[7:6] - reserved
[5:0] - Payload Type number
Typically 00h (IPMI)
0x00 Byte 3
List Index
  [7] - 1b = list algorithms by Cipher Suite
        0b = list supported algorithms[1]
  [6] - reserved
[5:0] - List index (00h-3Fh)
        0h selects the first set of 16
        1h selects the next set of 16, and so on
00h = Get first set of algorithm numbers

rcvd: 54 00 Byte 1
Completion Code
00h = Command Completed Normally
01 Byte 2
Channel Number
Channel number that the Authentication Algorithms are being returned for
00 01 02 03 40 41 42 43 44 80 81 Byte (3:18)
Cipher Suite Record Data Bytes
per Table 22-19, Cipher Suite Record Format

[IPMI tool under DOS]

C:\>ipmitool 20 18 54 01 00 00
1c 54 00 01 00 01 02 03 40 41 42 43 44 80 81

Get Session Challenge - NetFn = App (0x06h), CMD = 0x39h, Privilege Level = Any, M/O = O

Activate Session - NetFn = App (0x06h), CMD = 0x3ah, Privilege Level = Any, M/O = O

Set Session Privilege Level - NetFn = App (0x06h), CMD = 0x3bh, Privilege Level = User, M/O = O
| Linux |
[IPMItool]

ipmitool -H ${bmc_ip} -U ${bmc_user} -P ${bmc_password} raw 0x06 0x3b D[1] Byte 1
Requested Privilege Level
[7:4] - reserved
[3:0] - Privilege Level
        0h - no change, just return present privilege level
        1h - reserved
        2h - change to USER level
        3h - change to OPERATOR level
        4h - change to ADMINISTRATOR level
        5h - change to OEM Proprietary level
        all other = reserved

[ipmiutil]

ipmiutil cmd 00 20 18 3b D[1] Byte 1
Requested Privilege Level
[7:4] - reserved
[3:0] - Privilege Level
        0h - no change, just return present privilege level
        1h - reserved
        2h - change to USER level
        3h - change to OPERATOR level
        4h - change to ADMINISTRATOR level
        5h - change to OEM Proprietary level
        all other = reserved
-N ${bmc_ip} -U ${bmc_user} -P ${bmc_password}
icmd 00 20 18 3b D[1] Byte 1
Requested Privilege Level
[7:4] - reserved
[3:0] - Privilege Level
        0h - no change, just return present privilege level
        1h - reserved
        2h - change to USER level
        3h - change to OPERATOR level
        4h - change to ADMINISTRATOR level
        5h - change to OEM Proprietary level
        all other = reserved
-N ${bmc_ip} -U ${bmc_user} -P ${bmc_password}

[FreeIPMI]

ipmi-raw -h ${bmc_ip} -u ${bmc_user} -p ${bmc_password} 0x00 0x06 0x3b D[1] Byte 1
Requested Privilege Level
[7:4] - reserved
[3:0] - Privilege Level
        0h - no change, just return present privilege level
        1h - reserved
        2h - change to USER level
        3h - change to OPERATOR level
        4h - change to ADMINISTRATOR level
        5h - change to OEM Proprietary level
        all other = reserved

| MS-DOS |
[ipmitool]

ipmitool 20 18 3b Data[1]

--Completion Code--

80h = Requested level not available for this user
81h = Requested level exceeds Channel and/or User Privilege Limit
82h = Cannot disable User Level authentication

For example
[IPMItool in Linux] Hint: hover over Place your mouse over the highlighted area in below
for Response Data description

$ ipmitool -H ${bmc_ip} -U ${bmc_user} -P ${bmc_password} raw 0x06 0x3b 0x04 Byte 1
Requested Privilege Level
[7:4] - reserved
[3:0] - Privilege Level
        0h - no change, just return present privilege level
        1h - reserved
        2h - change to USER level
        3h - change to OPERATOR level
        4h - change to ADMINISTRATOR level
        5h - change to OEM Proprietary level
        all other = reserved

 04 Byte 2
New Privilege Level

$ ipmitool raw 0x06 0x3b 0x04 Byte 1
Requested Privilege Level
[7:4] - reserved
[3:0] - Privilege Level
        0h - no change, just return present privilege level
        1h - reserved
        2h - change to USER level
        3h - change to OPERATOR level
        4h - change to ADMINISTRATOR level
        5h - change to OEM Proprietary level
        all other = reserved

Unable to send RAW command (channel=0x0 netfn=0x6 lun=0x0 cmd=0x3b rsp= 0x82 Byte 1
Completion Code
80h = Requested level not available for this user
81h = Requested level exceeds Channel and/or User Privilege Limit
82h = Cannot disable User Level authentication
): Unknown (0x82 Byte 1
Completion Code
80h = Requested level not available for this user
81h = Requested level exceeds Channel and/or User Privilege Limit
82h = Cannot disable User Level authentication
)

[ipmiutil in Linux]

$ icmd 00 20 18 3b 04 Byte 1
Requested Privilege Level
[7:4] - reserved
[3:0] - Privilege Level
        0h - no change, just return present privilege level
        1h - reserved
        2h - change to USER level
        3h - change to OPERATOR level
        4h - change to ADMINISTRATOR level
        5h - change to OEM Proprietary level
        all other = reserved
-N ${bmc_ip} -U ${bmc_user} -P ${bmc_password}
ipmiutil ver 3.08
icmd ver 3.08
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
respData[len=1]: 04 Byte 2
New Privilege Level

send_icmd ret = 0
ipmiutil cmd, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw -h ${bmc_ip} -u ${bmc_user} -p ${bmc_password} 0x00 0x06 0x3b 0x04 Byte 1
Requested Privilege Level
[7:4] - reserved
[3:0] - Privilege Level
        0h - no change, just return present privilege level
        1h - reserved
        2h - change to USER level
        3h - change to OPERATOR level
        4h - change to ADMINISTRATOR level
        5h - change to OEM Proprietary level
        all other = reserved

rcvd: 3B 00 Byte 1
Completion Code
00h = Command Completed Normally
80h = Requested level not available for this user
81h = Requested level exceeds Channel and/or User Privilege Limit
82h = Cannot disable User Level authentication
04 Byte 2
New Privilege Level

Close Session - NetFn = App (0x06h), CMD = 0x3ch, Privilege Level = Callback, M/O = O

Get Session Info - NetFn = App (0x06h), CMD = 0x3dh, Privilege Level = User, M/O = O
| Linux |
[IPMItool]

ipmitool raw 0x06 0x3d D[1] Byte 1
Session Index
This value is used to select entries in a logical 'sessions' table maintained by the management controller
  00h = Return info for active session associated with session this command was received over
    N = get info for Nth active session
  FEh = Look up session info according to Session Handle passed in this request
  FFh = Look up session info according to Session ID passed in this request

ipmitool -H ${bmc_ip} -U ${bmc_user} -P ${bmc_password} raw 0x06 0x3d D[1] Byte 1
Session Index
This value is used to select entries in a logical 'sessions' table maintained by the management controller
  00h = Return info for active session associated with session this command was received over
    N = get info for Nth active session
  FEh = Look up session info according to Session Handle passed in this request
  FFh = Look up session info according to Session ID passed in this request

[ipmiutil]

ipmiutil cmd 00 20 18 3d D[1] Byte 1
Session Index
This value is used to select entries in a logical 'sessions' table maintained by the management controller
  00h = Return info for active session associated with session this command was received over
    N = get info for Nth active session
  FEh = Look up session info according to Session Handle passed in this request
  FFh = Look up session info according to Session ID passed in this request

ipmiutil cmd 00 20 18 3d D[1] Byte 1
Session Index
This value is used to select entries in a logical 'sessions' table maintained by the management controller
  00h = Return info for active session associated with session this command was received over
    N = get info for Nth active session
  FEh = Look up session info according to Session Handle passed in this request
  FFh = Look up session info according to Session ID passed in this request
-N ${bmc_ip} -U ${bmc_user} -P ${bmc_password}
icmd 00 20 18 3d D[1] Byte 1
Session Index
This value is used to select entries in a logical 'sessions' table maintained by the management controller
  00h = Return info for active session associated with session this command was received over
    N = get info for Nth active session
  FEh = Look up session info according to Session Handle passed in this request
  FFh = Look up session info according to Session ID passed in this request

icmd 00 20 18 3d D[1] Byte 1
Session Index
This value is used to select entries in a logical 'sessions' table maintained by the management controller
  00h = Return info for active session associated with session this command was received over
    N = get info for Nth active session
  FEh = Look up session info according to Session Handle passed in this request
  FFh = Look up session info according to Session ID passed in this request
-N ${bmc_ip} -U ${bmc_user} -P ${bmc_password}

[FreeIPMI]

ipmi-raw 0x00 0x06 0x3d D[1] Byte 1
Session Index
This value is used to select entries in a logical 'sessions' table maintained by the management controller
  00h = Return info for active session associated with session this command was received over
    N = get info for Nth active session
  FEh = Look up session info according to Session Handle passed in this request
  FFh = Look up session info according to Session ID passed in this request

ipmi-raw -h ${bmc_ip} -u ${bmc_user} -p ${bmc_password} 0x00 0x06 0x3d D[1] Byte 1
Session Index
This value is used to select entries in a logical 'sessions' table maintained by the management controller
  00h = Return info for active session associated with session this command was received over
    N = get info for Nth active session
  FEh = Look up session info according to Session Handle passed in this request
  FFh = Look up session info according to Session ID passed in this request

| MS-DOS |
[ipmitool]

ipmitool 20 18 3d Data[1]

For example
[IPMItool in Linux] Hint: hover over Place your mouse over the highlighted area in below
for Response Data description

$ ipmitool raw 0x06 0x3d 0x00 Byte 1
Session Index
This value is used to select entries in a logical 'sessions' table maintained by the management controller
  00h = Return info for active session associated with session this command was received over
    N = get info for Nth active session
  FEh = Look up session info according to Session Handle passed in this request
  FFh = Look up session info according to Session ID passed in this request

 36 Byte 2
Session Handle Presently Assigned to Active Session
FFh = reserved
00h if no active session associated with given session index
24 Byte 3
Number of Possible Active Sessions
[7:6] - reserved
[5:0] - session slot count. 1-based
00 Byte 4
Number of Currently Active Sessions on All Channels on this Controller
[7:6] - reserved
[5:0] - active session count. 1-based
0 = no currently active sessions

$ ipmitool -H ${bmc_ip} -U ${bmc_user} -P ${bmc_password} raw 0x06 0x3d 0x00 Byte 1
Session Index
This value is used to select entries in a logical 'sessions' table maintained by the management controller
  00h = Return info for active session associated with session this command was received over
    N = get info for Nth active session
  FEh = Look up session info according to Session Handle passed in this request
  FFh = Look up session info according to Session ID passed in this request

 37 Byte 2
Session Handle Presently Assigned to Active Session
FFh = reserved
00h if no active session associated with given session index
24 Byte 3
Number of Possible Active Sessions
[7:6] - reserved
[5:0] - session slot count. 1-based
01 Byte 4
Number of Currently Active Sessions on All Channels on this Controller
[7:6] - reserved
[5:0] - active session count. 1-based
0 = no currently active sessions
02 Byte 5
User ID for Selected Active Session
If there is an active session corresponding to the given session index
[7:6] - reserved
[5:0] - User ID
000000b = reserved
04 Byte 6
Operating Privilege Level
If there is an active session corresponding to the given session index
[7:4] - reserved
[3:0] - present privilege level that user is operating at
01 Byte 7
Response Byte 7
If there is an active session corresponding to the given session index
[7:4] - Session protocol auxiliary data
        For Channel Type = 802.3 LAN:
        0h = IPMI v1.5
        1h = IPMI v2.0/RMCP+
Channel that session was activated over
[3:0] - channel number
ac 10 62 63 Byte [8:11]
IP Address of Remote Console (MS-byte first)
If Channel Type = 802.3 LAN
d8 cb 8a f7 c6 90 Byte [12:17]
MAC Address (MS-byte first)
If Channel Type = 802.3 LAN

 e9 3d Byte [18:19]
Port Number of Remote Console (LS-byte first)
If Channel Type = 802.3 LAN

[ipmiutil in Linux]

$ icmd 00 20 18 3d 00 Byte 1
Session Index
This value is used to select entries in a logical 'sessions' table maintained by the management controller
  00h = Return info for active session associated with session this command was received over
    N = get info for Nth active session
  FEh = Look up session info according to Session Handle passed in this request
  FFh = Look up session info according to Session ID passed in this request
-N ${bmc_ip} -U ${bmc_user} -P ${bmc_password}
ipmiutil ver 3.08
icmd ver 3.08
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
respData[len=18]: 38 Byte 2
Session Handle Presently Assigned to Active Session
FFh = reserved
00h if no active session associated with given session index
24 Byte 3
Number of Possible Active Sessions
[7:6] - reserved
[5:0] - session slot count. 1-based
01 Byte 4
Number of Currently Active Sessions on All Channels on this Controller
[7:6] - reserved
[5:0] - active session count. 1-based
0 = no currently active sessions
02 Byte 5
User ID for Selected Active Session
If there is an active session corresponding to the given session index
[7:6] - reserved
[5:0] - User ID
000000b = reserved
04 Byte 6
Operating Privilege Level
If there is an active session corresponding to the given session index
[7:4] - reserved
[3:0] - present privilege level that user is operating at
01 Byte 7
Response Byte 7
If there is an active session corresponding to the given session index
[7:4] - Session protocol auxiliary data
        For Channel Type = 802.3 LAN:
        0h = IPMI v1.5
        1h = IPMI v2.0/RMCP+
Channel that session was activated over
[3:0] - channel number
ac 10 62 63 Byte [8:11]
IP Address of Remote Console (MS-byte first)
If Channel Type = 802.3 LAN
d8 cb 8a f7 c6 90 Byte [12:17]
MAC Address (MS-byte first)
If Channel Type = 802.3 LAN
db ab Byte [18:19]
Port Number of Remote Console (LS-byte first)
If Channel Type = 802.3 LAN

send_icmd ret = 0
ipmiutil cmd, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw -h ${bmc_ip} -u ${bmc_user} -p ${bmc_password} 0x00 0x06 0x3d 0x00 Byte 1
Session Index
This value is used to select entries in a logical 'sessions' table maintained by the management controller
  00h = Return info for active session associated with session this command was received over
    N = get info for Nth active session
  FEh = Look up session info according to Session Handle passed in this request
  FFh = Look up session info according to Session ID passed in this request

rcvd: 3D 00 Byte 1
Completion Code
00h = Command Completed Normally
44 Byte 2
Session Handle Presently Assigned to Active Session
FFh = reserved
00h if no active session associated with given session index
24 Byte 3
Number of Possible Active Sessions
[7:6] - reserved
[5:0] - session slot count. 1-based
01 Byte 4
Number of Currently Active Sessions on All Channels on this Controller
[7:6] - reserved
[5:0] - active session count. 1-based
0 = no currently active sessions
02 Byte 5
User ID for Selected Active Session
If there is an active session corresponding to the given session index
[7:6] - reserved
[5:0] - User ID
000000b = reserved
04 Byte 6
Operating Privilege Level
If there is an active session corresponding to the given session index
[7:4] - reserved
[3:0] - present privilege level that user is operating at
01 Byte 7
Response Byte 7
If there is an active session corresponding to the given session index
[7:4] - Session protocol auxiliary data
        For Channel Type = 802.3 LAN:
        0h = IPMI v1.5
        1h = IPMI v2.0/RMCP+
Channel that session was activated over
[3:0] - channel number
AC 10 62 63 Byte [8:11]
IP Address of Remote Console (MS-byte first)
If Channel Type = 802.3 LAN
D8 CB 8A F7 C6 90 Byte [12:17]
MAC Address (MS-byte first)
If Channel Type = 802.3 LAN
AF 89 Byte [18:19]
Port Number of Remote Console (LS-byte first)
If Channel Type = 802.3 LAN

Get AuthCode - NetFn = App (0x06h), CMD = 0x3fh, Privilege Level = Operator, M/O = O

Set Channel Access - NetFn = App (0x06h), CMD = 0x40h, Privilege Level = Admin, M/O = O
| Linux |
[IPMItool]

ipmitool raw 0x06 0x40 D[1] Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - Channel number
D[2] Byte 2
Request Data Byte 2
[7:6] - 00b = don't set or change Channel Access
        01b = set non-volatile Channel Access according to bits [5:0]
        10b = set volatile (active) setting of Channel Access according to bits [5:0]
        11b = reserved
  [5] - PEF Alerting Enable/Disable
        0b = enable PEF Alerting
        1b = disable PEF Alerting on this channel
  [4] - Per-message Authentication Enable/Disable
        0b = enable Per-message Authentication
        1b = disable Per-message Authentication
  [3] - User Level Authentication Enable/Disable
        0b = enable User Level Authentication
        1b = disable User Level Authentication
[2:0] - Access Mode for IPMI messaging
        000b = disabled
        001b = pre-boot only
        010b = always available
        011b = shared
D[3] Byte 3
Channel Privilege Level Limit
This value sets the maximum privilege level that can be accepted on the specified channel
[7:6] - 00b = don't set or change channel Privilege Level Limit
        01b = set non-volatile Privilege Level Limit according to bits [3:0]
        10b = set volatile setting of Privilege Level Limit according to bits [3:0]
        11b = reserved
[5:4] - reserved
[3:0] - Channel Privilege Level Limit
        0h = reserved
        1h = CALLBACK level
        2h = USER level
        3h = OPERATOR level
        4h = ADMINISTRATOR level
        5h = OEM Proprietary level

ipmitool channel setaccess <channel number> <user id> [callin=on|off] [ipmi=on|off] [link=on|off] [privilege=level]

[ipmiutil]

ipmiutil cmd 00 20 18 40 D[1] Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - Channel number
D[2] Byte 2
Request Data Byte 2
[7:6] - 00b = don't set or change Channel Access
        01b = set non-volatile Channel Access according to bits [5:0]
        10b = set volatile (active) setting of Channel Access according to bits [5:0]
        11b = reserved
  [5] - PEF Alerting Enable/Disable
        0b = enable PEF Alerting
        1b = disable PEF Alerting on this channel
  [4] - Per-message Authentication Enable/Disable
        0b = enable Per-message Authentication
        1b = disable Per-message Authentication
  [3] - User Level Authentication Enable/Disable
        0b = enable User Level Authentication
        1b = disable User Level Authentication
[2:0] - Access Mode for IPMI messaging
        000b = disabled
        001b = pre-boot only
        010b = always available
        011b = shared
D[3] Byte 3
Channel Privilege Level Limit
This value sets the maximum privilege level that can be accepted on the specified channel
[7:6] - 00b = don't set or change channel Privilege Level Limit
        01b = set non-volatile Privilege Level Limit according to bits [3:0]
        10b = set volatile setting of Privilege Level Limit according to bits [3:0]
        11b = reserved
[5:4] - reserved
[3:0] - Channel Privilege Level Limit
        0h = reserved
        1h = CALLBACK level
        2h = USER level
        3h = OPERATOR level
        4h = ADMINISTRATOR level
        5h = OEM Proprietary level

icmd 00 20 18 40 D[1] Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - Channel number
D[2] Byte 2
Request Data Byte 2
[7:6] - 00b = don't set or change Channel Access
        01b = set non-volatile Channel Access according to bits [5:0]
        10b = set volatile (active) setting of Channel Access according to bits [5:0]
        11b = reserved
  [5] - PEF Alerting Enable/Disable
        0b = enable PEF Alerting
        1b = disable PEF Alerting on this channel
  [4] - Per-message Authentication Enable/Disable
        0b = enable Per-message Authentication
        1b = disable Per-message Authentication
  [3] - User Level Authentication Enable/Disable
        0b = enable User Level Authentication
        1b = disable User Level Authentication
[2:0] - Access Mode for IPMI messaging
        000b = disabled
        001b = pre-boot only
        010b = always available
        011b = shared
D[3] Byte 3
Channel Privilege Level Limit
This value sets the maximum privilege level that can be accepted on the specified channel
[7:6] - 00b = don't set or change channel Privilege Level Limit
        01b = set non-volatile Privilege Level Limit according to bits [3:0]
        10b = set volatile setting of Privilege Level Limit according to bits [3:0]
        11b = reserved
[5:4] - reserved
[3:0] - Channel Privilege Level Limit
        0h = reserved
        1h = CALLBACK level
        2h = USER level
        3h = OPERATOR level
        4h = ADMINISTRATOR level
        5h = OEM Proprietary level

[FreeIPMI]

ipmi-raw 0x00 0x06 0x40 D[1] Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - Channel number
D[2] Byte 2
Request Data Byte 2
[7:6] - 00b = don't set or change Channel Access
        01b = set non-volatile Channel Access according to bits [5:0]
        10b = set volatile (active) setting of Channel Access according to bits [5:0]
        11b = reserved
  [5] - PEF Alerting Enable/Disable
        0b = enable PEF Alerting
        1b = disable PEF Alerting on this channel
  [4] - Per-message Authentication Enable/Disable
        0b = enable Per-message Authentication
        1b = disable Per-message Authentication
  [3] - User Level Authentication Enable/Disable
        0b = enable User Level Authentication
        1b = disable User Level Authentication
[2:0] - Access Mode for IPMI messaging
        000b = disabled
        001b = pre-boot only
        010b = always available
        011b = shared
D[3] Byte 3
Channel Privilege Level Limit
This value sets the maximum privilege level that can be accepted on the specified channel
[7:6] - 00b = don't set or change channel Privilege Level Limit
        01b = set non-volatile Privilege Level Limit according to bits [3:0]
        10b = set volatile setting of Privilege Level Limit according to bits [3:0]
        11b = reserved
[5:4] - reserved
[3:0] - Channel Privilege Level Limit
        0h = reserved
        1h = CALLBACK level
        2h = USER level
        3h = OPERATOR level
        4h = ADMINISTRATOR level
        5h = OEM Proprietary level

| MS-DOS |
[ipmitool]

ipmitool 20 18 40 Data[1:3]

--Completion Code--

82h = set not supported on selected channel (e.g. channel is sessionless.)
83h = access mode not supported

For example
[IPMItool in Linux] Hint: hover over Place your mouse over the highlighted area in below
for Response Data description

$ ipmitool raw 0x06 0x40 0x01 Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - Channel number
0x00 Byte 2
Request Data Byte 2
[7:6] - 00b = don't set or change Channel Access
        01b = set non-volatile Channel Access according to bits [5:0]
        10b = set volatile (active) setting of Channel Access according to bits [5:0]
        11b = reserved
  [5] - PEF Alerting Enable/Disable
        0b = enable PEF Alerting
        1b = disable PEF Alerting on this channel
  [4] - Per-message Authentication Enable/Disable
        0b = enable Per-message Authentication
        1b = disable Per-message Authentication
  [3] - User Level Authentication Enable/Disable
        0b = enable User Level Authentication
        1b = disable User Level Authentication
[2:0] - Access Mode for IPMI messaging
        000b = disabled
        001b = pre-boot only
        010b = always available
        011b = shared
0x04 Byte 3
Channel Privilege Level Limit
This value sets the maximum privilege level that can be accepted on the specified channel
[7:6] - 00b = don't set or change channel Privilege Level Limit
        01b = set non-volatile Privilege Level Limit according to bits [3:0]
        10b = set volatile setting of Privilege Level Limit according to bits [3:0]
        11b = reserved
[5:4] - reserved
[3:0] - Channel Privilege Level Limit
        0h = reserved
        1h = CALLBACK level
        2h = USER level
        3h = OPERATOR level
        4h = ADMINISTRATOR level
        5h = OEM Proprietary level

$ ipmitool channel setaccess 1 1 callin=on ipmi=on link=on privilege=4
Set User Access (channel 1 id 1) successful.

[ipmiutil in Linux]

$ icmd 00 20 18 40 01 Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - Channel number
00 Byte 2
Request Data Byte 2
[7:6] - 00b = don't set or change Channel Access
        01b = set non-volatile Channel Access according to bits [5:0]
        10b = set volatile (active) setting of Channel Access according to bits [5:0]
        11b = reserved
  [5] - PEF Alerting Enable/Disable
        0b = enable PEF Alerting
        1b = disable PEF Alerting on this channel
  [4] - Per-message Authentication Enable/Disable
        0b = enable Per-message Authentication
        1b = disable Per-message Authentication
  [3] - User Level Authentication Enable/Disable
        0b = enable User Level Authentication
        1b = disable User Level Authentication
[2:0] - Access Mode for IPMI messaging
        000b = disabled
        001b = pre-boot only
        010b = always available
        011b = shared
04 Byte 3
Channel Privilege Level Limit
This value sets the maximum privilege level that can be accepted on the specified channel
[7:6] - 00b = don't set or change channel Privilege Level Limit
        01b = set non-volatile Privilege Level Limit according to bits [3:0]
        10b = set volatile setting of Privilege Level Limit according to bits [3:0]
        11b = reserved
[5:4] - reserved
[3:0] - Channel Privilege Level Limit
        0h = reserved
        1h = CALLBACK level
        2h = USER level
        3h = OPERATOR level
        4h = ADMINISTRATOR level
        5h = OEM Proprietary level

ipmiutil ver 3.08
icmd ver 3.08
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
send_icmd ret = 0
ipmiutil cmd, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x40 0x01 Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - Channel number
0x00 Byte 2
Request Data Byte 2
[7:6] - 00b = don't set or change Channel Access
        01b = set non-volatile Channel Access according to bits [5:0]
        10b = set volatile (active) setting of Channel Access according to bits [5:0]
        11b = reserved
  [5] - PEF Alerting Enable/Disable
        0b = enable PEF Alerting
        1b = disable PEF Alerting on this channel
  [4] - Per-message Authentication Enable/Disable
        0b = enable Per-message Authentication
        1b = disable Per-message Authentication
  [3] - User Level Authentication Enable/Disable
        0b = enable User Level Authentication
        1b = disable User Level Authentication
[2:0] - Access Mode for IPMI messaging
        000b = disabled
        001b = pre-boot only
        010b = always available
        011b = shared
0x04 Byte 3
Channel Privilege Level Limit
This value sets the maximum privilege level that can be accepted on the specified channel
[7:6] - 00b = don't set or change channel Privilege Level Limit
        01b = set non-volatile Privilege Level Limit according to bits [3:0]
        10b = set volatile setting of Privilege Level Limit according to bits [3:0]
        11b = reserved
[5:4] - reserved
[3:0] - Channel Privilege Level Limit
        0h = reserved
        1h = CALLBACK level
        2h = USER level
        3h = OPERATOR level
        4h = ADMINISTRATOR level
        5h = OEM Proprietary level

rcvd: 40 00 Byte 1
Completion Code
00h = Command Completed Normally
82h = set not supported on selected channel (e.g. channel is sessionless.)
83h = access mode not supported

Get Channel Access - NetFn = App (0x06h), CMD = 0x41h, Privilege Level = User, M/O = O
| Linux |
[IPMItool]

ipmitool raw 0x06 0x41 D[1] Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - Channel number
D[2] Byte 2
Request Data Byte 2
[7:6] - 00b = reserved
        01b = get non-volatile Channel Access
        10b = get present volatile (active) setting of Channel Access
        11b = reserved
[5:0] - reserved

ipmitool channel getaccess <channel number> [user id]

[ipmiutil]

ipmiutil cmd 00 20 18 41 D[1] Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - Channel number
D[2] Byte 2
Request Data Byte 2
[7:6] - 00b = reserved
        01b = get non-volatile Channel Access
        10b = get present volatile (active) setting of Channel Access
        11b = reserved
[5:0] - reserved

icmd 00 20 18 41 D[1] Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - Channel number
D[2] Byte 2
Request Data Byte 2
[7:6] - 00b = reserved
        01b = get non-volatile Channel Access
        10b = get present volatile (active) setting of Channel Access
        11b = reserved
[5:0] - reserved

[FreeIPMI]

ipmi-raw 0x00 0x06 0x41 D[1] Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - Channel number
D[2] Byte 2
Request Data Byte 2
[7:6] - 00b = reserved
        01b = get non-volatile Channel Access
        10b = get present volatile (active) setting of Channel Access
        11b = reserved
[5:0] - reserved

| MS-DOS |
[ipmitool]

ipmitool 20 18 41 Data[1:2]

--Completion Code--

82h = Command not supported for selected channel (e.g. channel is session-less.)

For example
[IPMItool in Linux] Hint: hover over Place your mouse over the highlighted area in below
for Response Data description

$ ipmitool raw 0x06 0x41 0x01 Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - Channel number
0x80 Byte 2
Request Data Byte 2
[7:6] - 00b = reserved
        01b = get non-volatile Channel Access
        10b = get present volatile (active) setting of Channel Access
        11b = reserved
[5:0] - reserved

02 Byte 2
Completion Code
[7:6] - reserved
  [5] - 0b = Alerting enabled
        1b = Alerting disabled
  [4] - Per-message Authentication Enable/Disable
        0b = per message authentication enabled
        1b = per message authentication disabled
  [3] - User Level Authentication Enable
        0b = User Level Authentication enabled
        1b = User Level Authentication disabled
[2:0] - Access Mode
        0h = disabled
        1h = pre-boot only
        2h = always available
        3h = shared
04 Byte 3
Channel Privilege Level Limit
[7:4] - reserved
[3:0] - Channel Privilege Level Limit
        0h = reserved
        1h = CALLBACK level
        2h = USER level
        3h = OPERATOR level
        4h = ADMINISTRATOR level
        5h = OEM Proprietary level

$ ipmitool channel getaccess 1 1
Maximum User IDs     : 10
Enabled User IDs     : 1

User ID              : 1
User Name            :
Fixed Name           : Yes
Access Available     : call-in / callback
Link Authentication  : enabled
IPMI Messaging       : enabled
Privilege Level      : ADMINISTRATOR

[ipmiutil in Linux]

$ icmd 00 20 18 41 01 Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - Channel number
80 Byte 2
Request Data Byte 2
[7:6] - 00b = reserved
        01b = get non-volatile Channel Access
        10b = get present volatile (active) setting of Channel Access
        11b = reserved
[5:0] - reserved

ipmiutil ver 3.08
icmd ver 3.08
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
respData[len=2]: 02 Byte 2
Completion Code
[7:6] - reserved
  [5] - 0b = Alerting enabled
        1b = Alerting disabled
  [4] - Per-message Authentication Enable/Disable
        0b = per message authentication enabled
        1b = per message authentication disabled
  [3] - User Level Authentication Enable
        0b = User Level Authentication enabled
        1b = User Level Authentication disabled
[2:0] - Access Mode
        0h = disabled
        1h = pre-boot only
        2h = always available
        3h = shared
04 Byte 3
Channel Privilege Level Limit
[7:4] - reserved
[3:0] - Channel Privilege Level Limit
        0h = reserved
        1h = CALLBACK level
        2h = USER level
        3h = OPERATOR level
        4h = ADMINISTRATOR level
        5h = OEM Proprietary level

send_icmd ret = 0
ipmiutil cmd, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x41 0x01 Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - Channel number
0x80 Byte 2
Request Data Byte 2
[7:6] - 00b = reserved
        01b = get non-volatile Channel Access
        10b = get present volatile (active) setting of Channel Access
        11b = reserved
[5:0] - reserved

rcvd: 41 00 Byte 1
Completion Code
00h = Command Completed Normally
82h = Command not supported for selected channel (e.g. channel is session-less.)
02 Byte 2
Completion Code
[7:6] - reserved
  [5] - 0b = Alerting enabled
        1b = Alerting disabled
  [4] - Per-message Authentication Enable/Disable
        0b = per message authentication enabled
        1b = per message authentication disabled
  [3] - User Level Authentication Enable
        0b = User Level Authentication enabled
        1b = User Level Authentication disabled
[2:0] - Access Mode
        0h = disabled
        1h = pre-boot only
        2h = always available
        3h = shared
04 Byte 3
Channel Privilege Level Limit
[7:4] - reserved
[3:0] - Channel Privilege Level Limit
        0h = reserved
        1h = CALLBACK level
        2h = USER level
        3h = OPERATOR level
        4h = ADMINISTRATOR level
        5h = OEM Proprietary level

Get Channel Info - NetFn = App (0x06h), CMD = 0x42h, Privilege Level = User, M/O = O
| Linux |
[IPMItool]

ipmitool raw 0x06 0x42 D[1] Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - channel number
Use Eh to get information about the channel this command is being executed from

ipmitool channel info [channel number]

[ipmiutil]

ipmiutil cmd 00 20 18 42 D[1] Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - channel number
Use Eh to get information about the channel this command is being executed from

icmd 00 20 18 42 D[1] Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - channel number
Use Eh to get information about the channel this command is being executed from

[FreeIPMI]

ipmi-raw 0x00 0x06 0x42 D[1] Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - channel number
Use Eh to get information about the channel this command is being executed from

| MS-DOS |
[ipmitool]

ipmitool 20 18 42 Data[1]

For example
[IPMItool in Linux] Hint: hover over Place your mouse over the highlighted area in below
for Response Data description

$ ipmitool raw 0x06 0x42 0x0f Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - channel number
Use Eh to get information about the channel this command is being executed from

 0f Byte 2
Response Data Byte 2
[7:4] - reserved
[3:0] - actual channel number
0c Byte 3
Response Data Byte 3
  [7] - reserved
[6:0] - 7-bit Channel Medium type
05 Byte 4
Channel Protocol Type
[7:5] - reserved
[4:0] - 5-bit Channel IPMI Messaging Protocol Type
00 Byte 5
Session Support
[7:6] - 00b = channel is session-less
        01b = channel is single-session
        10b = channel is multi-session
        11b = channel is session-based
[5:0] - active session count. 1-based
00_0000b = no sessions have been activated on this channel
f2 1b 00 Byte [6:8]
Vendor ID
The IPMI Enterprise Number is: 7154 (decimal)
ff ff Byte [9:10]
Auxiliary Channel Info
For Channel = Fh (System Interface):
  byte 1: SMS Interrupt Type
    00h-0Fh = IRQ 0 through 15, respectively
    10h-13h = PCI A-D, respectively
    14h = SMI
    15h = SCI
    20h-5Fh = system interrupt 0 through 63, respectively
    60h = assigned by ACPI / Plug ‘n Play BIOS
    FFh = no interrupt / unspecified
    all other = reserved
  byte 2: Event Message Buffer Interrupt Type
    see values for byte 1

For OEM channel types:
  byte 1:2 = OEM specified per OEM identified by Vendor ID field

All other channel types:
  byte 1:2 = reserved

$ ipmitool channel info
Channel 0xf info:
  Channel Medium Type   : System Interface
  Channel Protocol Type : KCS
  Session Support       : session-less
  Active Session Count  : 0
  Protocol Vendor ID    : 7154
$ ipmitool raw 0x06 0x42 0x01 Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - channel number
Use Eh to get information about the channel this command is being executed from

 01 Byte 2
Response Data Byte 2
[7:4] - reserved
[3:0] - actual channel number
04 Byte 3
Response Data Byte 3
  [7] - reserved
[6:0] - 7-bit Channel Medium type
01 Byte 4
Channel Protocol Type
[7:5] - reserved
[4:0] - 5-bit Channel IPMI Messaging Protocol Type
80 Byte 5
Session Support
[7:6] - 00b = channel is session-less
        01b = channel is single-session
        10b = channel is multi-session
        11b = channel is session-based
[5:0] - active session count. 1-based
00_0000b = no sessions have been activated on this channel
f2 1b 00 Byte [6:8]
Vendor ID
The IPMI Enterprise Number is: 7154 (decimal)
00 00 Byte [9:10]
Auxiliary Channel Info
For Channel = Fh (System Interface):
  byte 1: SMS Interrupt Type
    00h-0Fh = IRQ 0 through 15, respectively
    10h-13h = PCI A-D, respectively
    14h = SMI
    15h = SCI
    20h-5Fh = system interrupt 0 through 63, respectively
    60h = assigned by ACPI / Plug ‘n Play BIOS
    FFh = no interrupt / unspecified
    all other = reserved
  byte 2: Event Message Buffer Interrupt Type
    see values for byte 1

For OEM channel types:
  byte 1:2 = OEM specified per OEM identified by Vendor ID field

All other channel types:
  byte 1:2 = reserved

$ ipmitool channel info 0x01
Channel 0x1 info:
  Channel Medium Type   : 802.3 LAN
  Channel Protocol Type : IPMB-1.0
  Session Support       : multi-session
  Active Session Count  : 0
  Protocol Vendor ID    : 7154
  Volatile(active) Settings
    Alerting            : enabled
    Per-message Auth    : enabled
    User Level Auth     : enabled
    Access Mode         : always available
  Non-Volatile Settings
    Alerting            : enabled
    Per-message Auth    : enabled
    User Level Auth     : enabled
    Access Mode         : always available

[ipmiutil in Linux]

$ icmd 00 20 18 42 01 Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - channel number
Use Eh to get information about the channel this command is being executed from

ipmiutil ver 3.08
icmd ver 3.08
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
respData[len=9]: 01 Byte 2
Response Data Byte 2
[7:4] - reserved
[3:0] - actual channel number
04 Byte 3
Response Data Byte 3
  [7] - reserved
[6:0] - 7-bit Channel Medium type
01 Byte 4
Channel Protocol Type
[7:5] - reserved
[4:0] - 5-bit Channel IPMI Messaging Protocol Type
80 Byte 5
Session Support
[7:6] - 00b = channel is session-less
        01b = channel is single-session
        10b = channel is multi-session
        11b = channel is session-based
[5:0] - active session count. 1-based
00_0000b = no sessions have been activated on this channel
f2 1b 00 Byte [6:8]
Vendor ID
The IPMI Enterprise Number is: 7154 (decimal)
00 00 Byte [9:10]
Auxiliary Channel Info
For Channel = Fh (System Interface):
  byte 1: SMS Interrupt Type
    00h-0Fh = IRQ 0 through 15, respectively
    10h-13h = PCI A-D, respectively
    14h = SMI
    15h = SCI
    20h-5Fh = system interrupt 0 through 63, respectively
    60h = assigned by ACPI / Plug ‘n Play BIOS
    FFh = no interrupt / unspecified
    all other = reserved
  byte 2: Event Message Buffer Interrupt Type
    see values for byte 1

For OEM channel types:
  byte 1:2 = OEM specified per OEM identified by Vendor ID field

All other channel types:
  byte 1:2 = reserved

send_icmd ret = 0
ipmiutil cmd, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x42 0x01 Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - channel number
Use Eh to get information about the channel this command is being executed from

rcvd: 42 00 Byte 1
Completion Code
00h = Command Completed Normally
01 Byte 2
Response Data Byte 2
[7:4] - reserved
[3:0] - actual channel number
04 Byte 3
Response Data Byte 3
  [7] - reserved
[6:0] - 7-bit Channel Medium type
01 Byte 4
Channel Protocol Type
[7:5] - reserved
[4:0] - 5-bit Channel IPMI Messaging Protocol Type
80 Byte 5
Session Support
[7:6] - 00b = channel is session-less
        01b = channel is single-session
        10b = channel is multi-session
        11b = channel is session-based
[5:0] - active session count. 1-based
00_0000b = no sessions have been activated on this channel
F2 1B 00 Byte [6:8]
Vendor ID
The IPMI Enterprise Number is: 7154 (decimal)
00 00 Byte [9:10]
Auxiliary Channel Info
For Channel = Fh (System Interface):
  byte 1: SMS Interrupt Type
    00h-0Fh = IRQ 0 through 15, respectively
    10h-13h = PCI A-D, respectively
    14h = SMI
    15h = SCI
    20h-5Fh = system interrupt 0 through 63, respectively
    60h = assigned by ACPI / Plug ‘n Play BIOS
    FFh = no interrupt / unspecified
    all other = reserved
  byte 2: Event Message Buffer Interrupt Type
    see values for byte 1

For OEM channel types:
  byte 1:2 = OEM specified per OEM identified by Vendor ID field

All other channel types:
  byte 1:2 = reserved

Set Channel Security Keys - NetFn = App (0x06h), CMD = 0x56h, Privilege Level = Admin, M/O = O

Set User Access - NetFn = App (0x06h), CMD = 0x43h, Privilege Level = Admin, M/O = O
| Linux |
[IPMItool]

ipmitool raw 0x06 0x43 D[1] Byte 1
Request Data Byte 1
  [7] - 0b = do not change any of the following bits in this byte
        1b = enable changing the following bits in this byte
  [6] - User Restricted to Callback
        0b = for both callback and non-callback connections
        1b = for callback connections, but is restricted to Callback level for non-callback connections
  [5] - User Link authentication enable/disable for the given channel
        0b = disable user for link authentication
        1b = enable user for link authentication
  [4] - User IPMI Messaging enable/disable
        0b = disable user for IPMI Messaging
        1b = enable user for IPMI Messaging
[3:0] - Channel Number
D[2] Byte 2
User ID
[7:6] - reserved
[5:0] - User ID
000000b = reserved
D[3] Byte 3
User Limits
[7:4] - reserved
[3:0] - User Privilege Limit
        0h = reserved
        1h = Callback
        2h = User
        3h = Operator
        4h = Administrator
        5h = OEM Proprietary
        Fh = NO ACCESS
(D[4]) Byte 4
User Session Limit
(Optional) Sets how many simultaneous sessions can be activated with the username associated with this user
[7:4] - reserved
[3:0] - User simultaneous session limit. 1-based
        0h = only limited by the implementations overall support for simultaneous sessions

ipmitool user enable <user id>
ipmitool user disable <user id>
ipmitool user priv <user id> <privilege level> [<channel number>]

[ipmiutil]

ipmiutil cmd 00 20 18 43 D[1] Byte 1
Request Data Byte 1
  [7] - 0b = do not change any of the following bits in this byte
        1b = enable changing the following bits in this byte
  [6] - User Restricted to Callback
        0b = for both callback and non-callback connections
        1b = for callback connections, but is restricted to Callback level for non-callback connections
  [5] - User Link authentication enable/disable for the given channel
        0b = disable user for link authentication
        1b = enable user for link authentication
  [4] - User IPMI Messaging enable/disable
        0b = disable user for IPMI Messaging
        1b = enable user for IPMI Messaging
[3:0] - Channel Number
D[2] Byte 2
User ID
[7:6] - reserved
[5:0] - User ID
000000b = reserved
D[3] Byte 3
User Limits
[7:4] - reserved
[3:0] - User Privilege Limit
        0h = reserved
        1h = Callback
        2h = User
        3h = Operator
        4h = Administrator
        5h = OEM Proprietary
        Fh = NO ACCESS
(D[4]) Byte 4
User Session Limit
(Optional) Sets how many simultaneous sessions can be activated with the username associated with this user
[7:4] - reserved
[3:0] - User simultaneous session limit. 1-based
        0h = only limited by the implementations overall support for simultaneous sessions

icmd 00 20 18 43 D[1] Byte 1
Request Data Byte 1
  [7] - 0b = do not change any of the following bits in this byte
        1b = enable changing the following bits in this byte
  [6] - User Restricted to Callback
        0b = for both callback and non-callback connections
        1b = for callback connections, but is restricted to Callback level for non-callback connections
  [5] - User Link authentication enable/disable for the given channel
        0b = disable user for link authentication
        1b = enable user for link authentication
  [4] - User IPMI Messaging enable/disable
        0b = disable user for IPMI Messaging
        1b = enable user for IPMI Messaging
[3:0] - Channel Number
D[2] Byte 2
User ID
[7:6] - reserved
[5:0] - User ID
000000b = reserved
D[3] Byte 3
User Limits
[7:4] - reserved
[3:0] - User Privilege Limit
        0h = reserved
        1h = Callback
        2h = User
        3h = Operator
        4h = Administrator
        5h = OEM Proprietary
        Fh = NO ACCESS
(D[4]) Byte 4
User Session Limit
(Optional) Sets how many simultaneous sessions can be activated with the username associated with this user
[7:4] - reserved
[3:0] - User simultaneous session limit. 1-based
        0h = only limited by the implementations overall support for simultaneous sessions

ipmiutil user enable <user_num> [channel]
ipmiutil user disable <user_num>
ipmiutil user set <user_num> priv <priv_level> priv_level
Privilege Level
where priv_level:
4 = Admin
3 = Operator
2 = User
[channel]
iuser enable <user_num> [channel]
iuser disable <user_num>
iuser set <user_num> priv <priv_level> priv_level
Privilege Level
where priv_level:
4 = Admin
3 = Operator
2 = User
[channel]

[FreeIPMI]

ipmi-raw 0x00 0x06 0x43 D[1] Byte 1
Request Data Byte 1
  [7] - 0b = do not change any of the following bits in this byte
        1b = enable changing the following bits in this byte
  [6] - User Restricted to Callback
        0b = for both callback and non-callback connections
        1b = for callback connections, but is restricted to Callback level for non-callback connections
  [5] - User Link authentication enable/disable for the given channel
        0b = disable user for link authentication
        1b = enable user for link authentication
  [4] - User IPMI Messaging enable/disable
        0b = disable user for IPMI Messaging
        1b = enable user for IPMI Messaging
[3:0] - Channel Number
D[2] Byte 2
User ID
[7:6] - reserved
[5:0] - User ID
000000b = reserved
D[3] Byte 3
User Limits
[7:4] - reserved
[3:0] - User Privilege Limit
        0h = reserved
        1h = Callback
        2h = User
        3h = Operator
        4h = Administrator
        5h = OEM Proprietary
        Fh = NO ACCESS
(D[4]) Byte 4
User Session Limit
(Optional) Sets how many simultaneous sessions can be activated with the username associated with this user
[7:4] - reserved
[3:0] - User simultaneous session limit. 1-based
        0h = only limited by the implementations overall support for simultaneous sessions

| MS-DOS |
[ipmitool]

ipmitool 20 18 43 Data[1:3] (Data[4])

For example
[IPMItool in Linux] Hint: hover over Place your mouse over the highlighted area in below
for Response Data description

$ ipmitool raw 0x06 0x43 0x01 Byte 1
Request Data Byte 1
  [7] - 0b = do not change any of the following bits in this byte
        1b = enable changing the following bits in this byte
  [6] - User Restricted to Callback
        0b = for both callback and non-callback connections
        1b = for callback connections, but is restricted to Callback level for non-callback connections
  [5] - User Link authentication enable/disable for the given channel
        0b = disable user for link authentication
        1b = enable user for link authentication
  [4] - User IPMI Messaging enable/disable
        0b = disable user for IPMI Messaging
        1b = enable user for IPMI Messaging
[3:0] - Channel Number
0x01 Byte 2
User ID
[7:6] - reserved
[5:0] - User ID
000000b = reserved
0x02 Byte 3
User Limits
[7:4] - reserved
[3:0] - User Privilege Limit
        0h = reserved
        1h = Callback
        2h = User
        3h = Operator
        4h = Administrator
        5h = OEM Proprietary
        Fh = NO ACCESS
0x00 Byte 4
User Session Limit
(Optional) Sets how many simultaneous sessions can be activated with the username associated with this user
[7:4] - reserved
[3:0] - User simultaneous session limit. 1-based
        0h = only limited by the implementations overall support for simultaneous sessions


$ ipmitool user priv 0x01 0x02 0x01
Set Privilege Level command successful (user 1)
$ ipmitool user enable 0x03
$ ipmitool user disable 0x01

[ipmiutil in Linux]

$ icmd 00 20 18 43 01 Byte 1
Request Data Byte 1
  [7] - 0b = do not change any of the following bits in this byte
        1b = enable changing the following bits in this byte
  [6] - User Restricted to Callback
        0b = for both callback and non-callback connections
        1b = for callback connections, but is restricted to Callback level for non-callback connections
  [5] - User Link authentication enable/disable for the given channel
        0b = disable user for link authentication
        1b = enable user for link authentication
  [4] - User IPMI Messaging enable/disable
        0b = disable user for IPMI Messaging
        1b = enable user for IPMI Messaging
[3:0] - Channel Number
01 Byte 2
User ID
[7:6] - reserved
[5:0] - User ID
000000b = reserved
02 Byte 3
User Limits
[7:4] - reserved
[3:0] - User Privilege Limit
        0h = reserved
        1h = Callback
        2h = User
        3h = Operator
        4h = Administrator
        5h = OEM Proprietary
        Fh = NO ACCESS
00 Byte 4
User Session Limit
(Optional) Sets how many simultaneous sessions can be activated with the username associated with this user
[7:4] - reserved
[3:0] - User simultaneous session limit. 1-based
        0h = only limited by the implementations overall support for simultaneous sessions

ipmiutil ver 3.08
icmd ver 3.08
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
send_icmd ret = 0
ipmiutil cmd, completed successfully
$ iuser set 2 priv 2 1
ipmiutil ver 3.08
iuser ver 3.08
GET_USERNAME: 61 64 6d, status = 0, ccode=0
SETUSERENAB - inputData 2 1 64, status = 0, ccode=0
SETUSER_ACCESS - inputData 91 2 2, status = 0 ccode=0
ipmiutil user, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x43 0x01 Byte 1
Request Data Byte 1
  [7] - 0b = do not change any of the following bits in this byte
        1b = enable changing the following bits in this byte
  [6] - User Restricted to Callback
        0b = for both callback and non-callback connections
        1b = for callback connections, but is restricted to Callback level for non-callback connections
  [5] - User Link authentication enable/disable for the given channel
        0b = disable user for link authentication
        1b = enable user for link authentication
  [4] - User IPMI Messaging enable/disable
        0b = disable user for IPMI Messaging
        1b = enable user for IPMI Messaging
[3:0] - Channel Number
0x01 Byte 2
User ID
[7:6] - reserved
[5:0] - User ID
000000b = reserved
0x02 Byte 3
User Limits
[7:4] - reserved
[3:0] - User Privilege Limit
        0h = reserved
        1h = Callback
        2h = User
        3h = Operator
        4h = Administrator
        5h = OEM Proprietary
        Fh = NO ACCESS
0x00 Byte 4
User Session Limit
(Optional) Sets how many simultaneous sessions can be activated with the username associated with this user
[7:4] - reserved
[3:0] - User simultaneous session limit. 1-based
        0h = only limited by the implementations overall support for simultaneous sessions

rcvd: 43 00 Byte 1
Completion Code
00h = Command Completed Normally

Get User Access - NetFn = App (0x06h), CMD = 0x44h, Privilege Level = Operator, M/O = O
| Linux |
[IPMItool]

ipmitool raw 0x06 0x44 D[1] Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - Channel Number
D[2] Byte 2
Request Data Byte 2
[7:6] - reserved
[5:0] - User ID
000000b = reserved

ipmitool user summary [<channel number>]
ipmitool user list [<channel number>]

[ipmiutil]

ipmiutil cmd 00 20 18 44 D[1] Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - Channel Number
D[2] Byte 2
Request Data Byte 2
[7:6] - reserved
[5:0] - User ID
000000b = reserved

icmd 00 20 18 44 D[1] Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - Channel Number
D[2] Byte 2
Request Data Byte 2
[7:6] - reserved
[5:0] - User ID
000000b = reserved

ipmiutil user list [channel]
iuser list [channel]

[FreeIPMI]

ipmi-raw 0x00 0x06 0x44 D[1] Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - Channel Number
D[2] Byte 2
Request Data Byte 2
[7:6] - reserved
[5:0] - User ID
000000b = reserved

| MS-DOS |
[ipmitool]

ipmitool 20 18 44 Data[1:2]

For example
[IPMItool in Linux] Hint: hover over Place your mouse over the highlighted area in below
for Response Data description

$ ipmitool raw 0x06 0x44 0x01 Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - Channel Number
0x02 Byte 2
Request Data Byte 2
[7:6] - reserved
[5:0] - User ID
000000b = reserved

 0a Byte 2
Maximum Number of User IDs (1-based)
[7:6] - reserved
[5:0] - maximum number of user IDs on this channel
42 Byte 3
Count of Currently Enabled User IDs (1-based)
[7:6] - User ID Enable status
        00b = User ID enable status unspecified
        01b = User ID enabled via Set User Password command
        10b = User ID disabled via Set User Password command
        11b = reserved
[5:0] - count of currently enabled user IDs on this channel
02 Byte 4
Count of User IDs with Fixed Names
[7:6] - reserved
[5:0] - count of user IDs with fixed names on this channel
54 Byte 5
Channel Access
  [7] - reserved
  [6] - 0b = user access available during call-in or callback direct connection
        1b = user access available only during callback connection
  [5] - 0b = user disabled for link authentication
        1b = user enabled for link authentication
  [4] - 0b = user disabled for IPMI Messaging
        1b = user enabled for IPMI Messaging
[3:0] - User Privilege Limit for given Channel
        0h = reserved
        1h = Callback
        2h = User
        3h = Operator
        4h = Administrator
        5h = OEM Proprietary
        Fh = NO ACCESS

$ ipmitool user summary 0x01
Maximum IDs         : 10
Enabled User Count  : 2
Fixed Name Count    : 2
$ ipmitool user list 0x01
ID  Name             Callin  Link Auth  IPMI Msg   Channel Priv Limit
1                    true    true       true       USER
2   admin            false   false      true       ADMINISTRATOR
3                    true    false      false      NO ACCESS
4                    true    false      false      NO ACCESS
5                    true    false      false      NO ACCESS
6                    true    false      false      NO ACCESS
7                    true    false      false      NO ACCESS
8                    true    false      false      NO ACCESS
9                    true    false      false      NO ACCESS
10                   true    false      false      NO ACCESS

[ipmiutil in Linux]

$ icmd 00 20 18 44 01 Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - Channel Number
02 Byte 2
Request Data Byte 2
[7:6] - reserved
[5:0] - User ID
000000b = reserved

ipmiutil ver 3.08
icmd ver 3.08
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
respData[len=4]: 0a Byte 2
Maximum Number of User IDs (1-based)
[7:6] - reserved
[5:0] - maximum number of user IDs on this channel
43 Byte 3
Count of Currently Enabled User IDs (1-based)
[7:6] - User ID Enable status
        00b = User ID enable status unspecified
        01b = User ID enabled via Set User Password command
        10b = User ID disabled via Set User Password command
        11b = reserved
[5:0] - count of currently enabled user IDs on this channel
02 Byte 4
Count of User IDs with Fixed Names
[7:6] - reserved
[5:0] - count of user IDs with fixed names on this channel
12 Byte 5
Channel Access
  [7] - reserved
  [6] - 0b = user access available during call-in or callback direct connection
        1b = user access available only during callback connection
  [5] - 0b = user disabled for link authentication
        1b = user enabled for link authentication
  [4] - 0b = user disabled for IPMI Messaging
        1b = user enabled for IPMI Messaging
[3:0] - User Privilege Limit for given Channel
        0h = reserved
        1h = Callback
        2h = User
        3h = Operator
        4h = Administrator
        5h = OEM Proprietary
        Fh = NO ACCESS

send_icmd ret = 0
ipmiutil cmd, completed successfully
$ iuser list 1
ipmiutil ver 3.08
iuser ver 3.08
User  1: chan=1          enabled          User
User  2: chan=1          enabled          User          admin
User  3: chan=1          enabled        No access
User  4: chan=1         disabled        No access
User  5: chan=1         disabled        No access
User  6: chan=1         disabled        No access
User  7: chan=1         disabled        No access
User  8: chan=1         disabled        No access
User  9: chan=1         disabled        No access
User 10: chan=1         disabled        No access
ipmiutil user, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x44 0x01 Byte 1
Request Data Byte 1
[7:4] - reserved
[3:0] - Channel Number
0x02 Byte 2
Request Data Byte 2
[7:6] - reserved
[5:0] - User ID
000000b = reserved

rcvd: 44 00 Byte 1
Completion Code
00h = Command Completed Normally
0A Byte 2
Maximum Number of User IDs (1-based)
[7:6] - reserved
[5:0] - maximum number of user IDs on this channel
43 Byte 3
Count of Currently Enabled User IDs (1-based)
[7:6] - User ID Enable status
        00b = User ID enable status unspecified
        01b = User ID enabled via Set User Password command
        10b = User ID disabled via Set User Password command
        11b = reserved
[5:0] - count of currently enabled user IDs on this channel
02 Byte 4
Count of User IDs with Fixed Names
[7:6] - reserved
[5:0] - count of user IDs with fixed names on this channel
12 Byte 5
Channel Access
  [7] - reserved
  [6] - 0b = user access available during call-in or callback direct connection
        1b = user access available only during callback connection
  [5] - 0b = user disabled for link authentication
        1b = user enabled for link authentication
  [4] - 0b = user disabled for IPMI Messaging
        1b = user enabled for IPMI Messaging
[3:0] - User Privilege Limit for given Channel
        0h = reserved
        1h = Callback
        2h = User
        3h = Operator
        4h = Administrator
        5h = OEM Proprietary
        Fh = NO ACCESS

Set User Name - NetFn = App(0x06), CMD= 0x45h, Privilege Level = Admin, M/O = O
| Linux |
[IPMItool]

ipmitool raw 0x06 0x45 D[1] Byte 1
User ID
[7:6] - reserved
[5:0] - User ID
000000b = reserved
(User ID 1 is permanently associated with User 1, the null user name)
D[2:17] Byte [2:17]
User Name String in ASCII, 16 bytes, max
Strings with fewer than 16 characters are terminated with a null (00h) character and 00h padded to 16 bytes

ipmitool user set name <user id> <username>

[ipmiutil]

ipmiutil cmd 00 20 18 45 D[1] Byte 1
User ID
[7:6] - reserved
[5:0] - User ID
000000b = reserved
(User ID 1 is permanently associated with User 1, the null user name)
D[2:17] Byte [2:17]
User Name String in ASCII, 16 bytes, max
Strings with fewer than 16 characters are terminated with a null (00h) character and 00h padded to 16 bytes

icmd 00 20 18 45 D[1] Byte 1
User ID
[7:6] - reserved
[5:0] - User ID
000000b = reserved
(User ID 1 is permanently associated with User 1, the null user name)
D[2:17] Byte [2:17]
User Name String in ASCII, 16 bytes, max
Strings with fewer than 16 characters are terminated with a null (00h) character and 00h padded to 16 bytes

ipmiutil user set <user_num> name <username>
iuser set <user_num> name <username>

[FreeIPMI]

ipmi-raw 0x00 0x06 0x45 D[1] Byte 1
User ID
[7:6] - reserved
[5:0] - User ID
000000b = reserved
(User ID 1 is permanently associated with User 1, the null user name)
D[2:17] Byte [2:17]
User Name String in ASCII, 16 bytes, max
Strings with fewer than 16 characters are terminated with a null (00h) character and 00h padded to 16 bytes

| MS-DOS |
[ipmitool]

ipmitool 20 18 45 Data[1:6]

For example
[IPMItool in Linux] Hint: hover over Place your mouse over the highlighted area in below
for Response Data description

$ ipmitool raw 0x06 0x45 0x03 Byte 1
User ID
[7:6] - reserved
[5:0] - User ID
000000b = reserved
(User ID 1 is permanently associated with User 1, the null user name)
0x74 0x65 0x73 0x74 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 Byte [2:17]
User Name String in ASCII, 16 bytes, max
Strings with fewer than 16 characters are terminated with a null (00h) character and 00h padded to 16 bytes


$ ipmitool user set name 0x03 test

[ipmiutil in Linux]

$ icmd 00 20 18 45 03 Byte 1
User ID
[7:6] - reserved
[5:0] - User ID
000000b = reserved
(User ID 1 is permanently associated with User 1, the null user name)
74 65 73 74 0 0 0 0 0 0 0 0 0 0 0 0 Byte [2:17]
User Name String in ASCII, 16 bytes, max
Strings with fewer than 16 characters are terminated with a null (00h) character and 00h padded to 16 bytes

ipmiutil ver 3.08
icmd ver 3.08
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
send_icmd ret = 0
ipmiutil cmd, completed successfully
$ iuser set 3 name test
ipmiutil ver 3.08
iuser ver 3.08
GET_USERNAME: 74 65 73, status = 0, ccode=0
SETUSERNAME - 3 74 65 status = 0, ccode=0
SETUSERENAB - inputData 3 1 65, status = 0, ccode=0
SETUSER_ACCESS - inputData 91 3 f, status = 0 ccode=0
ipmiutil user, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x45 0x03 Byte 1
User ID
[7:6] - reserved
[5:0] - User ID
000000b = reserved
(User ID 1 is permanently associated with User 1, the null user name)
0x74 0x65 0x73 0x74 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 Byte [2:17]
User Name String in ASCII, 16 bytes, max
Strings with fewer than 16 characters are terminated with a null (00h) character and 00h padded to 16 bytes

rcvd: 45 00 Byte 1
Completion Code
00h = Command Completed Normally

Get User Name - NetFn = App(0x06), CMD= 0x46h, Privilege Level = Operator, M/O = O
| Linux |
[IPMItool]

ipmitool raw 0x06 0x46 D[1] Byte 1
User ID
[7:6] - reserved
[5:0] - User ID to return name for
000000b = reserved

ipmitoo user list [<channel number>]

[ipmiutil]

ipmiutil cmd 00 20 18 46 D[1] Byte 1
User ID
[7:6] - reserved
[5:0] - User ID to return name for
000000b = reserved

icmd 00 20 18 46 D[1] Byte 1
User ID
[7:6] - reserved
[5:0] - User ID to return name for
000000b = reserved

ipmiutil user list [channel]
iuser list [channel]

[FreeIPMI]

ipmi-raw 0x00 0x06 0x46 D[1] Byte 1
User ID
[7:6] - reserved
[5:0] - User ID to return name for
000000b = reserved

| MS-DOS |
[ipmitool]

ipmitool 20 18 46 Data[1]

For example
[IPMItool in Linux] Hint: hover over Place your mouse over the highlighted area in below
for Response Data description

$ ipmitool raw 0x06 0x46 0x03 Byte 1
User ID
[7:6] - reserved
[5:0] - User ID to return name for
000000b = reserved

 74 65 73 74 00 00 00 00 00 00 00 00 00 00 00 00 Byte [2:17]
User Name String in ASCII, 16 bytes, max
Strings of fewer than 16 characters are returned with null (00h) characters filling in the remaining bytes

$ ipmitool user list 0x01
ID  Name             Callin  Link Auth  IPMI Msg   Channel Priv Limit
1                    true    false      true       USER
2   admin            true    false      true       USER
3   test             true    false      true       NO ACCESS
4                    true    false      false      NO ACCESS
5                    true    false      false      NO ACCESS
6                    true    false      false      NO ACCESS
7                    true    false      false      NO ACCESS
8                    true    false      false      NO ACCESS
9                    true    false      false      NO ACCESS
10                   true    false      false      NO ACCESS

[ipmiutil in Linux]

$ icmd 00 20 18 46 03 03 Byte 1
User ID
[7:6] - reserved
[5:0] - User ID to return name for
000000b = reserved

ipmiutil ver 3.08
icmd ver 3.08
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
respData[len=16]: 74 65 73 74 00 00 00 00 00 00 00 00 00 00 00 00 Byte [2:17]
User Name String in ASCII, 16 bytes, max
Strings of fewer than 16 characters are returned with null (00h) characters filling in the remaining bytes

send_icmd ret = 0
ipmiutil cmd, completed successfully
$ iuser list 1
ipmiutil ver 3.08
iuser ver 3.08
User  1: chan=1          enabled          User
User  2: chan=1          enabled          User          admin
User  3: chan=1          enabled        No access       test
User  4: chan=1         disabled        No access
User  5: chan=1         disabled        No access
User  6: chan=1         disabled        No access
User  7: chan=1         disabled        No access
User  8: chan=1         disabled        No access
User  9: chan=1         disabled        No access
User 10: chan=1         disabled        No access
ipmiutil user, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x46 0x03 Byte 1
User ID
[7:6] - reserved
[5:0] - User ID to return name for
000000b = reserved

rcvd: 46 00 Byte 1
Completion Code
00h = Command Completed Normally
74 65 73 74 00 00 00 00 00 00 00 00 00 00 00 00 Byte [2:17]
User Name String in ASCII, 16 bytes, max
Strings of fewer than 16 characters are returned with null (00h) characters filling in the remaining bytes

Set User Password - NetFn = App(0x06), CMD= 0x47h, Privilege Level = Admin, M/O = O
| Linux |
[IPMItool]
For password size = 16 bytes:

ipmitool raw 0x06 0x47 D[1] Byte 1
User ID
  [7] - password size
        1b = set 20-byte user password/key
        0b = set 16-byte user password/key (IPMI v1.5 backward compatible)
  [6] - reserved
[5:0] - User ID
000000b = reserved
(User ID 1 is permanently associated with User 1, the null user name)
D[2] Byte 2
Request Data Byte 2
[7:2] - reserved
[1:0] - operation
        00b = disable user
        01b = enable user
        10b = set password
        11b = test password
D[3:18] Byte [3:18]
Password Data
If the password is entered as an ASCII string, it must be null (00h) terminated and 00h padded if the string is shorter than 16 bytes

For password size = 20 bytes:

ipmitool raw 0x06 0x47 D[1] Byte 1
User ID
  [7] - password size
        1b = set 20-byte user password/key
        0b = set 16-byte user password/key (IPMI v1.5 backward compatible)
  [6] - reserved
[5:0] - User ID
000000b = reserved
(User ID 1 is permanently associated with User 1, the null user name)
D[2] Byte 2
Request Data Byte 2
[7:2] - reserved
[1:0] - operation
        00b = disable user
        01b = enable user
        10b = set password
        11b = test password
D[3:22] Byte [3:22]
20-byte Password Data
If the password is entered as an ASCII string, it must be null (00h) terminated and 00h padded if the string is shorter than 20 bytes

ipmitool user set password <user id> [<password> <16|20>]

[ipmiutil]
For password size = 16 bytes:

ipmiutil cmd 00 20 18 47 D[1] Byte 1
User ID
  [7] - password size
        1b = set 20-byte user password/key
        0b = set 16-byte user password/key (IPMI v1.5 backward compatible)
  [6] - reserved
[5:0] - User ID
000000b = reserved
(User ID 1 is permanently associated with User 1, the null user name)
D[2] Byte 2
Request Data Byte 2
[7:2] - reserved
[1:0] - operation
        00b = disable user
        01b = enable user
        10b = set password
        11b = test password
D[3:18] Byte [3:18]
Password Data
If the password is entered as an ASCII string, it must be null (00h) terminated and 00h padded if the string is shorter than 16 bytes

icmd 00 20 18 47 D[1] Byte 1
User ID
  [7] - password size
        1b = set 20-byte user password/key
        0b = set 16-byte user password/key (IPMI v1.5 backward compatible)
  [6] - reserved
[5:0] - User ID
000000b = reserved
(User ID 1 is permanently associated with User 1, the null user name)
D[2] Byte 2
Request Data Byte 2
[7:2] - reserved
[1:0] - operation
        00b = disable user
        01b = enable user
        10b = set password
        11b = test password
D[3:18] Byte [3:18]
Password Data
If the password is entered as an ASCII string, it must be null (00h) terminated and 00h padded if the string is shorter than 16 bytes

For password size = 20 bytes:

ipmiutil cmd 00 20 18 47 D[1] Byte 1
User ID
  [7] - password size
        1b = set 20-byte user password/key
        0b = set 16-byte user password/key (IPMI v1.5 backward compatible)
  [6] - reserved
[5:0] - User ID
000000b = reserved
(User ID 1 is permanently associated with User 1, the null user name)
D[2] Byte 2
Request Data Byte 2
[7:2] - reserved
[1:0] - operation
        00b = disable user
        01b = enable user
        10b = set password
        11b = test password
D[3:22] Byte [3:22]
20-byte Password Data
If the password is entered as an ASCII string, it must be null (00h) terminated and 00h padded if the string is shorter than 20 bytes

icmd 00 20 18 47 D[1] Byte 1
User ID
  [7] - password size
        1b = set 20-byte user password/key
        0b = set 16-byte user password/key (IPMI v1.5 backward compatible)
  [6] - reserved
[5:0] - User ID
000000b = reserved
(User ID 1 is permanently associated with User 1, the null user name)
D[2] Byte 2
Request Data Byte 2
[7:2] - reserved
[1:0] - operation
        00b = disable user
        01b = enable user
        10b = set password
        11b = test password
D[3:22] Byte [3:22]
20-byte Password Data
If the password is entered as an ASCII string, it must be null (00h) terminated and 00h padded if the string is shorter than 20 bytes

ipmiutil user set <user_num> password <password>
iuser set <user_num> password <password>

[FreeIPMI]
For password size = 16 bytes:

ipmi-raw 0x00 0x06 0x47 D[1] Byte 1
User ID
  [7] - password size
        1b = set 20-byte user password/key
        0b = set 16-byte user password/key (IPMI v1.5 backward compatible)
  [6] - reserved
[5:0] - User ID
000000b = reserved
(User ID 1 is permanently associated with User 1, the null user name)
D[2] Byte 2
Request Data Byte 2
[7:2] - reserved
[1:0] - operation
        00b = disable user
        01b = enable user
        10b = set password
        11b = test password
D[3:18] Byte [3:18]
Password Data
If the password is entered as an ASCII string, it must be null (00h) terminated and 00h padded if the string is shorter than 16 bytes

For password size = 20 bytes:

ipmi-raw 0x00 0x06 0x47 D[1] Byte 1
User ID
  [7] - password size
        1b = set 20-byte user password/key
        0b = set 16-byte user password/key (IPMI v1.5 backward compatible)
  [6] - reserved
[5:0] - User ID
000000b = reserved
(User ID 1 is permanently associated with User 1, the null user name)
D[2] Byte 2
Request Data Byte 2
[7:2] - reserved
[1:0] - operation
        00b = disable user
        01b = enable user
        10b = set password
        11b = test password
D[3:22] Byte [3:22]
20-byte Password Data
If the password is entered as an ASCII string, it must be null (00h) terminated and 00h padded if the string is shorter than 20 bytes

| MS-DOS |
[ipmitool]
For password size = 16 bytes:

ipmitool 20 18 41 Data[1:18]

For password size = 20 bytes:

ipmitool 20 18 41 Data[1:22]

--Completion Code--

80h = (mandatory) password test failed. Password size correct, but password data does not match stored value.
81h = (mandatory) password test failed. Wrong password size was used.

For example
Set 16 bytes Password=test to User ID=3
[IPMItool in Linux] Hint: hover over Place your mouse over the highlighted area in below
for Response Data description

$ ipmitool raw 0x06 0x47 0x03 Byte 1
User ID
  [7] - password size
        1b = set 20-byte user password/key
        0b = set 16-byte user password/key (IPMI v1.5 backward compatible)
  [6] - reserved
[5:0] - User ID
000000b = reserved
(User ID 1 is permanently associated with User 1, the null user name)
0x02 Byte 2
Request Data Byte 2
[7:2] - reserved
[1:0] - operation
        00b = disable user
        01b = enable user
        10b = set password
        11b = test password
0x74 0x65 0x73 0x74 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 Byte [3:18]
Password Data
If the password is entered as an ASCII string, it must be null (00h) terminated and 00h padded if the string is shorter than 16 bytes

$ ipmitool user set password 0x03 test
Set User Password command successful (user 3)

Test Password
Compares the password data given in the request with the presently stored password and returns an OK completion code if there is a match.
Otherwise, an error completion code is returned.

$ ipmitool raw 0x06 0x47 0x03 0x03 0x74 0x65 0x73 0x74 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0

$ ipmitool raw 0x06 0x47 0x03 0x03 0x74 0x65 0x73 0x75 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0
Unable to send RAW command (channel=0x0 netfn=0x6 lun=0x0 cmd=0x47 rsp=0x80 Byte 1
Completion Code
00h = Command Completed Normally
80h = Password size correct, but password data does not match stored value
81h = Wrong password size was used
): Unknown (0x80 Byte 1
Completion Code
00h = Command Completed Normally
80h = Password size correct, but password data does not match stored value
81h = Wrong password size was used
)

[ipmiutil in Linux]

$ icmd 00 20 18 47 03 Byte 1
User ID
  [7] - password size
        1b = set 20-byte user password/key
        0b = set 16-byte user password/key (IPMI v1.5 backward compatible)
  [6] - reserved
[5:0] - User ID
000000b = reserved
(User ID 1 is permanently associated with User 1, the null user name)
02 Byte 2
Request Data Byte 2
[7:2] - reserved
[1:0] - operation
        00b = disable user
        01b = enable user
        10b = set password
        11b = test password
74 65 73 74 0 0 0 0 0 0 0 0 0 0 0 0 Byte [3:18]
Password Data
If the password is entered as an ASCII string, it must be null (00h) terminated and 00h padded if the string is shorter than 16 bytes

ipmiutil ver 3.08
icmd ver 3.08
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
send_icmd ret = 0
ipmiutil cmd, completed successfully
$ iuser set 3 password test
ipmiutil ver 3.08
iuser ver 3.08
GET_USERNAME: 74 65 73, status = 0, ccode=0
SETUSERNAME - 3 74 65 status = 0, ccode=0
SETUSERENAB - inputData 3 1 65, status = 0, ccode=0
SETUSERPSW - inputData 3 2 74, status = 0, ccode=0
TESTUSERPSW - inputData 3 3 74, status = 0, ccode=0
SETUSER_ACCESS - inputData 91 3 1f, status = 0 ccode=cc
ipmiutil user, Invalid data field in request

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x47 0x03 Byte 1
User ID
  [7] - password size
        1b = set 20-byte user password/key
        0b = set 16-byte user password/key (IPMI v1.5 backward compatible)
  [6] - reserved
[5:0] - User ID
000000b = reserved
(User ID 1 is permanently associated with User 1, the null user name)
0x02 Byte 2
Request Data Byte 2
[7:2] - reserved
[1:0] - operation
        00b = disable user
        01b = enable user
        10b = set password
        11b = test password
0x74 0x65 0x73 0x74 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 Byte [3:18]
Password Data
If the password is entered as an ASCII string, it must be null (00h) terminated and 00h padded if the string is shorter than 16 bytes

rcvd: 47 00 Byte 1
Completion Code
00h = Command Completed Normally
80h = Password size correct, but password data does not match stored value
81h = Wrong password size was used

Reference
[1] "Intelligent Platform Management Interface Specification Second Generation v2.0 Document Revision 1.1"
https://www.intel.com/content/dam/www/public/us/en/documents/product-briefs/ipmi-second-gen-interface-spec-v2-rev1-1.pdf
[2] "IPMItool" http://sourceforge.net/projects/ipmitool/
[3] "IPMI Command Test Tool" http://www.intel.com/design/servers/ipmi/ipmi_tool.htm
[4] "IPMIUTIL USER GUIDE" http://ipmiutil.sourceforge.net/
[5] "FreeIPMI Documentation" http://www.gnu.org/software/freeipmi/index.html

Last Updated: May 10, 2018