[IPMI] RMCP+ Support and Payload Commands

Activate Payload - NetFn = App (0x06h), CMD = 0x48h, Privilege Level = UAO, M/O = O
| Linux |
[IPMItool]

ipmitool -I lanplus -H ${bmc_ip} -U ${bmc_user} -P ${bmc_password} raw 0x06 0x48 D[1] Byte 1
Request Data Byte 1
[7:6] - reserved
[5:0] - payload type
IPMI Message payloads do not need to be explicitly activated.
A payload that is required to be launched over a different port than that used to establish the initial IPMI session is only required to support the IPMI commands needed by the particular payload type.
D[2] Byte 2
Payload Instance
[7:4] - reserved
[3:0] - payload instance. 1-based. 0h = reserved.
D[3:6] Byte [3:6]
Auxiliary Request Data
Additional payload-specific parameters to configure behavior of the payload when it becomes activated.
Ignored if no auxiliary data is specified for given payload type.
For Payload Type = SOL:
byte 1
  [7] - Encryption Activation
        1b: Activate payload with encryption.
        0b: Activate payload without encryption.
  [6] - Authentication Activation
        1b: Activate payload with authentication.
        0b: Activate payload without authentication.
  [5] - Test Mode (optional).
        1b = activate test mode.
        0b = deactivate test mode
  [4] - reserved
[3:2] - Shared Serial Alert Behavior
The following settings are determine what happens to serial alerts if IPMI over Serial and SOL are sharing the same baseboard serial controller.
        11b: Reserved
        10b: Serial/modem alerts succeed while SOL active.
        01b: Serial/modem alerts deferred while SOL active.
        00b: Serial/modem alerts fail while SOL active.
  [1] - SOL startup handshake
        0b: BMC asserts CTS and DCD/DSR to baseboard upon activation.
        1b: CTS and DCD/DSR remain deasserted after activation.
  [0] - reserved
        byte 2:4 reserved - write a 00h

[ipmiutil]

ipmiutil cmd 00 20 18 48 D[1] Byte 1
Request Data Byte 1
[7:6] - reserved
[5:0] - payload type
IPMI Message payloads do not need to be explicitly activated.
A payload that is required to be launched over a different port than that used to establish the initial IPMI session is only required to support the IPMI commands needed by the particular payload type.
D[2] Byte 2
Payload Instance
[7:4] - reserved
[3:0] - payload instance. 1-based. 0h = reserved.
D[3:6] Byte [3:6]
Auxiliary Request Data
Additional payload-specific parameters to configure behavior of the payload when it becomes activated.
Ignored if no auxiliary data is specified for given payload type.
For Payload Type = SOL:
byte 1
  [7] - Encryption Activation
        1b: Activate payload with encryption.
        0b: Activate payload without encryption.
  [6] - Authentication Activation
        1b: Activate payload with authentication.
        0b: Activate payload without authentication.
  [5] - Test Mode (optional).
        1b = activate test mode.
        0b = deactivate test mode
  [4] - reserved
[3:2] - Shared Serial Alert Behavior
The following settings are determine what happens to serial alerts if IPMI over Serial and SOL are sharing the same baseboard serial controller.
        11b: Reserved
        10b: Serial/modem alerts succeed while SOL active.
        01b: Serial/modem alerts deferred while SOL active.
        00b: Serial/modem alerts fail while SOL active.
  [1] - SOL startup handshake
        0b: BMC asserts CTS and DCD/DSR to baseboard upon activation.
        1b: CTS and DCD/DSR remain deasserted after activation.
  [0] - reserved
        byte 2:4 reserved - write a 00h
-F lan2 -N ${bmc_ip} -U ${bmc_user} -P ${bmc_password}
icmd 00 20 18 48 D[1] Byte 1
Request Data Byte 1
[7:6] - reserved
[5:0] - payload type
IPMI Message payloads do not need to be explicitly activated.
A payload that is required to be launched over a different port than that used to establish the initial IPMI session is only required to support the IPMI commands needed by the particular payload type.
D[2] Byte 2
Payload Instance
[7:4] - reserved
[3:0] - payload instance. 1-based. 0h = reserved.
D[3:6] Byte [3:6]
Auxiliary Request Data
Additional payload-specific parameters to configure behavior of the payload when it becomes activated.
Ignored if no auxiliary data is specified for given payload type.
For Payload Type = SOL:
byte 1
  [7] - Encryption Activation
        1b: Activate payload with encryption.
        0b: Activate payload without encryption.
  [6] - Authentication Activation
        1b: Activate payload with authentication.
        0b: Activate payload without authentication.
  [5] - Test Mode (optional).
        1b = activate test mode.
        0b = deactivate test mode
  [4] - reserved
[3:2] - Shared Serial Alert Behavior
The following settings are determine what happens to serial alerts if IPMI over Serial and SOL are sharing the same baseboard serial controller.
        11b: Reserved
        10b: Serial/modem alerts succeed while SOL active.
        01b: Serial/modem alerts deferred while SOL active.
        00b: Serial/modem alerts fail while SOL active.
  [1] - SOL startup handshake
        0b: BMC asserts CTS and DCD/DSR to baseboard upon activation.
        1b: CTS and DCD/DSR remain deasserted after activation.
  [0] - reserved
        byte 2:4 reserved - write a 00h
-F lan2 -N ${bmc_ip} -U ${bmc_user} -P ${bmc_password}

--Completion Code--

80h: Payload already active on another session (required).
81h: Payload type is disabled (optional).
82h: Payload activation limit reached.
83h: Cannot activate payload with encryption.
84h: Cannot activate payload without encryption.

For example   Hint: hover over Place your mouse over the highlighted area in below
for Response Data description
[IPMItool in Linux]

$ ipmitool -I lanplus -H ${bmc_ip} -U ${bmc_user} -P ${bmc_password} raw 0x06 0x48 0x01 0x01 0x00 0x00 0x00 0x00
 00 00 00 00 Byte [2:5]
Auxiliary Response Data
LS-byte first.
For Payload = SOL:
[31:1] - reserved. Return as 0s
   [0] - 0b = test mode not supported / enabled
         1b = test mode enabled
fc 00 Byte [6:7]
Inbound Payload Size
Maximum size of payload data field from remote console to BMC
Excludes size of confidentiality header and trailer fields, if any. 1-based.
fc 00 Byte [8:9]
Outbound Payload Size
Maximum size of payload data field from BMC to remote console
Excludes size of confidentiality header and trailer fields, if any. 1-based.
6f 02 Byte [10:11]
Payload UDP Port Number
UDP port number that payload can be transferred over.
If the port number is same as the port that was used to establish the IPMI session, then SOL payload transfers are now available under that IPMI session on that port.
Otherwise, the remote console will need to establish a separate IPMI Session to the specified Port Number using the same IP Address, username and password/key information that was used to establish the IPMI session.
SOL payload transfers will then be available over that session.
If the remote console already has an IPMI session established on that port for a different payload type, the SOL payload type will now also be available over that session - provided that the session was established at a privilege level that matches the privilege level and authentication required for SOL.
Otherwise, the remote console will need to close that session and reestablish it at the necessary privilege level.
ff ff Byte [12:13]
Payload VLAN Number
FFFFh if VLAN addressing is not used.

[ipmiutil in Linux]

$ icmd 00 20 18 48 01 01 00 00 00 00 -F lan2 -N ${bmc_ip} -U ${bmc_user} -P ${bmc_password}
ipmiutil cmd ver 3.10
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
Opening lanplus connection to node 192.168.1.5 ...
-- BMC version 1.7, IPMI version 2.0
respData[len=12]:  00 00 00 00 Byte [2:5]
Auxiliary Response Data
LS-byte first.
For Payload = SOL:
[31:1] - reserved. Return as 0s
   [0] - 0b = test mode not supported / enabled
         1b = test mode enabled
fc 00 Byte [6:7]
Inbound Payload Size
Maximum size of payload data field from remote console to BMC
Excludes size of confidentiality header and trailer fields, if any. 1-based.
fc 00 Byte [8:9]
Outbound Payload Size
Maximum size of payload data field from BMC to remote console
Excludes size of confidentiality header and trailer fields, if any. 1-based.
6f 02 Byte [10:11]
Payload UDP Port Number
UDP port number that payload can be transferred over.
If the port number is same as the port that was used to establish the IPMI session, then SOL payload transfers are now available under that IPMI session on that port.
Otherwise, the remote console will need to establish a separate IPMI Session to the specified Port Number using the same IP Address, username and password/key information that was used to establish the IPMI session.
SOL payload transfers will then be available over that session.
If the remote console already has an IPMI session established on that port for a different payload type, the SOL payload type will now also be available over that session - provided that the session was established at a privilege level that matches the privilege level and authentication required for SOL.
Otherwise, the remote console will need to close that session and reestablish it at the necessary privilege level.
ff ff Byte [12:13]
Payload VLAN Number
FFFFh if VLAN addressing is not used.

send_icmd ret = 0
ipmiutil cmd, completed successfully

Deactivate Payload - NetFn = App (0x06h), CMD = 0x49h, Privilege Level = UAO, M/O = O
| Linux |
[IPMItool]

ipmitool -I lanplus -H ${bmc_ip} -U ${bmc_user} -P ${bmc_password} raw 0x06 0x49 D[1] Byte 1
Request Data Byte 1
[7:6] - reserved
[5:0] - payload type
D[2] Byte 2
Payload Instance
[7:4] - reserved
[3:0] - payload instance. 1-based. 0h = reserved.
D[3] Byte 3
Payload Auxiliary Data
Additional parameters to configure behavior of the payload when it becomes deactivated.
Ignored if no auxiliary data is specified for given payload type.
For Payload Type = SOL: (no auxiliary data) write as 0000_0000h

[ipmiutil]

ipmiutil cmd 00 20 18 49 D[1] Byte 1
Request Data Byte 1
[7:6] - reserved
[5:0] - payload type
D[2] Byte 2
Payload Instance
[7:4] - reserved
[3:0] - payload instance. 1-based. 0h = reserved.
D[3] Byte 3
Payload Auxiliary Data
Additional parameters to configure behavior of the payload when it becomes deactivated.
Ignored if no auxiliary data is specified for given payload type.
For Payload Type = SOL: (no auxiliary data) write as 0000_0000h
-F lan2 -N ${bmc_ip} -U ${bmc_user} -P ${bmc_password}
icmd 00 20 18 49 D[1] Byte 1
Request Data Byte 1
[7:6] - reserved
[5:0] - payload type
D[2] Byte 2
Payload Instance
[7:4] - reserved
[3:0] - payload instance. 1-based. 0h = reserved.
D[3] Byte 3
Payload Auxiliary Data
Additional parameters to configure behavior of the payload when it becomes deactivated.
Ignored if no auxiliary data is specified for given payload type.
For Payload Type = SOL: (no auxiliary data) write as 0000_0000h
-F lan2 -N ${bmc_ip} -U ${bmc_user} -P ${bmc_password}

--Completion Code--

(An error completion code should be returned if the payload type in the request is set to "IPMI Message" (0h)).
80h: Payload already deactivated.
81h: Payload type is disabled (optional). Given payload type is not configured to be enabled for activation.

For example   Hint: hover over Place your mouse over the highlighted area in below
for Response Data description
[IPMItool in Linux]
Test Steps:
Step 1. SOL Activate

$ ipmitool -I lanplus -H ${bmc_ip} -U ${bmc_user} -P ${bmc_password} sol activate
[SOL Session operational. Use ~? for help]

Step 2. Deactivate Payload

$ ipmitool -I lanplus -H ${bmc_ip} -U ${bmc_user} -P ${bmc_password} raw 0x06 0x49 0x01 0x01 0x00 0x00 0x00 0x00

Step 3. Check SOL Will be Malfunction
[ipmiutil in Linux]
Test Steps:
Step 1. SOL Activate

$ isol -a -N ${bmc_ip} -U ${bmc_user} -P ${bmc_password}
ipmiutil sol ver 3.10
-- BMC version 1.07, IPMI version 2.0
Opening lanplus connection to node 192.168.1.5 ...
[SOL session is running, use '~.' to end, '~?' for help.]

Step 2. Deactivate Payload

$ icmd 00 20 18 49 01 01 00 00 00 00 -F lan 2 -N ${bmc_ip} -U ${bmc_user} -P ${bmc_password}
ipmiutil cmd ver 3.10
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
Opening lanplus connection to node 192.168.1.5 ...
-- BMC version 1.7, IPMI version 2.0
send_icmd ret = 0
ipmiutil cmd, completed successfully

Step 3. Check SOL Will be Malfunction


Suspend/Resume Payload Encryption - NetFn = App (0x06h), CMD = 0x55h, Privilege Level = User, M/O = O
| Linux |
[IPMItool]

ipmitool -I lanplus -H ${bmc_ip} -U ${bmc_user} -P ${bmc_password} raw 0x06 0x55 D[1] Byte 1
Request Data Byte 1
[7:6] - reserved
[5:0] - payload type
D[2] Byte 2
Payload Instance
[7:4] - reserved
[3:0] - payload instance. 1-based. 0h = reserved.
D[3] Byte 3
Request Data Byte 3
[7:2] - reserved
[4:0] - Operation
        2h = Regenerate initialization vector.
        1h = Resume/Start encryption on all transfers of specified payload data from the BMC.
        0h = Suspend encryption on all transfers of specified payload messages from the BMC.

[ipmiutil]

ipmiutil cmd 00 20 18 55 -F lan 2 -N ${bmc_ip} -U ${bmc_user} -P ${bmc_password} D[1] Byte 1
Request Data Byte 1
[7:6] - reserved
[5:0] - payload type
D[2] Byte 2
Payload Instance
[7:4] - reserved
[3:0] - payload instance. 1-based. 0h = reserved.
D[3] Byte 3
Request Data Byte 3
[7:2] - reserved
[4:0] - Operation
        2h = Regenerate initialization vector.
        1h = Resume/Start encryption on all transfers of specified payload data from the BMC.
        0h = Suspend encryption on all transfers of specified payload messages from the BMC.

icmd 00 20 18 55 -F lan 2 -N ${bmc_ip} -U ${bmc_user} -P ${bmc_password} D[1] Byte 1
Request Data Byte 1
[7:6] - reserved
[5:0] - payload type
D[2] Byte 2
Payload Instance
[7:4] - reserved
[3:0] - payload instance. 1-based. 0h = reserved.
D[3] Byte 3
Request Data Byte 3
[7:2] - reserved
[4:0] - Operation
        2h = Regenerate initialization vector.
        1h = Resume/Start encryption on all transfers of specified payload data from the BMC.
        0h = Suspend encryption on all transfers of specified payload messages from the BMC.

--Completion Code--

80h: Operation not supported for given payload type.
81h: Operation not allowed under present configuration for given payload type.
82h: Encryption is not available for session that payload type is active under.
83h: The payload instance is not presently active.

For example   Hint: hover over Place your mouse over the highlighted area in below
for Response Data description
[IPMItool in Linux]
Step 1. SOL Activate

$ ipmitool -I lanplus -H ${bmc_ip} -U ${bmc_user} -P ${bmc_password} sol activate
[SOL Session operational. Use ~? for help]

Step 2. Suspend Encryption on All Transfers of Specified Payload Messages from the BMC

$ ipmitool -I lanplus -H ${bmc_ip} -U ${bmc_user} -P ${bmc_password} raw 0x06 0x55 0x01 0x01 0x00

[ipmiutil in Linux]
Step 1. SOL Activate

$ isol -a -N ${bmc_ip} -U ${bmc_user} -P ${bmc_password}
ipmiutil sol ver 3.10
-- BMC version 1.07, IPMI version 2.0
Opening lanplus connection to node 192.168.1.5 ...
[SOL session is running, use '~.' to end, '~?' for help.]

Step 2. Suspend Encryption on All Transfers of Specified Payload Messages from the BMC

$ icmd 00 20 18 55 01 01 00 -N ${bmc_ip} -U ${bmc_user} -P ${bmc_password}
ipmiutil cmd ver 3.10
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
send_icmd ret = 0
ipmiutil cmd, completed successfully

Get Payload Activation Status - NetFn = App (0x06h), CMD = 0x4ah, Privilege Level = User, M/O = O
| Linux |
[IPMItool]

ipmitool raw 0x06 0x4a D[1] Byte 1
Payload Type Number
Type number of the standard payload type or OEM Payload Handle to retrieve status for.

[ipmiutil]

ipmiutil cmd 00 20 18 4a D[1] Byte 1
Payload Type Number
Type number of the standard payload type or OEM Payload Handle to retrieve status for.

icmd 00 20 18 4a D[1] Byte 1
Payload Type Number
Type number of the standard payload type or OEM Payload Handle to retrieve status for.

[FreeIPMI]

ipmi-raw 0x00 0x06 0x4a D[1] Byte 1
Payload Type Number
Type number of the standard payload type or OEM Payload Handle to retrieve status for.

| MS-DOS |
[ipmitool]

ipmitool 20 18 4a Data[1]

For example   Hint: hover over Place your mouse over the highlighted area in below
for Response Data description
[IPMItool in Linux]

$ ipmitool raw 0x06 0x4a 0x00
 0f Byte 2
Instance capacity
[7:4] - reserved.
[3:0] - Number of instances of given payload type that can be simultaneously activated on BMC. 1-based. 0h = reserved.
01 Byte 3
Response Data Byte 3
[7] - 1b = instance 8 is activated.
      0b = instance 8 is deactivated.
[6] - 1b = instance 7 is activated.
      0b = instance 7 is deactivated.
…
[0] - 1b = instance 1 is activated.
      0b = instance 1 is deactivated.
00 Byte 4
Response Data Byte 4
[7] - 1b = instance 16 is activated.
      0b = instance 16 is deactivated.
[6] - 1b = instance 15 is activated.
      0b = instance 15 is deactivated.
…
[0] - 1b = instance 9 is activated.
      0b = instance 9 is deactivated.

[ipmiutil in Linux]

$ icmd 00 20 18 4a 01
ipmiutil cmd ver 3.10
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
respData[len=3]: 0f Byte 2
Instance capacity
[7:4] - reserved.
[3:0] - Number of instances of given payload type that can be simultaneously activated on BMC. 1-based. 0h = reserved.
01 Byte 3
Response Data Byte 3
[7] - 1b = instance 8 is activated.
      0b = instance 8 is deactivated.
[6] - 1b = instance 7 is activated.
      0b = instance 7 is deactivated.
…
[0] - 1b = instance 1 is activated.
      0b = instance 1 is deactivated.
00 Byte 4
Response Data Byte 4
[7] - 1b = instance 16 is activated.
      0b = instance 16 is deactivated.
[6] - 1b = instance 15 is activated.
      0b = instance 15 is deactivated.
…
[0] - 1b = instance 9 is activated.
      0b = instance 9 is deactivated.

send_icmd ret = 0
ipmiutil cmd, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x4a 0x01
rcvd: 4A 00 Byte 1
Completion Code
00h = Command Completed Normally
0F Byte 2
Instance capacity
[7:4] - reserved.
[3:0] - Number of instances of given payload type that can be simultaneously activated on BMC. 1-based. 0h = reserved.
01 Byte 3
Response Data Byte 3
[7] - 1b = instance 8 is activated.
      0b = instance 8 is deactivated.
[6] - 1b = instance 7 is activated.
      0b = instance 7 is deactivated.
…
[0] - 1b = instance 1 is activated.
      0b = instance 1 is deactivated.
00 Byte 4
Response Data Byte 4
[7] - 1b = instance 16 is activated.
      0b = instance 16 is deactivated.
[6] - 1b = instance 15 is activated.
      0b = instance 15 is deactivated.
…
[0] - 1b = instance 9 is activated.
      0b = instance 9 is deactivated.

Get Payload Instance Info - NetFn = App (0x06h), CMD = 0x4bh, Privilege Level = User, M/O = O
| Linux |
[IPMItool]

ipmitool raw 0x06 0x4b D[1] Byte 1
Payload Type Number
Type number of the standard payload type or OEM Payload Handle to retrieve status for.
D[2] Byte 2
Payload Instance
1-based. 0h = reserved.

[ipmiutil]

ipmiutil cmd 00 20 18 4b D[1] Byte 1
Payload Type Number
Type number of the standard payload type or OEM Payload Handle to retrieve status for.
D[2] Byte 2
Payload Instance
1-based. 0h = reserved.

icmd 00 20 18 4b D[1] Byte 1
Payload Type Number
Type number of the standard payload type or OEM Payload Handle to retrieve status for.
D[2] Byte 2
Payload Instance
1-based. 0h = reserved.

[FreeIPMI]

ipmi-raw 0x00 0x06 0x4b D[1] Byte 1
Payload Type Number
Type number of the standard payload type or OEM Payload Handle to retrieve status for.
D[2] Byte 2
Payload Instance
1-based. 0h = reserved.

| MS-DOS |
[ipmitool]

ipmitool 20 18 4b Data[1:2]

For example   Hint: hover over Place your mouse over the highlighted area in below
for Response Data description
[IPMItool in Linux]

$ ipmitool raw 0x06 0x4b 0x01 0x01
 2a ec 6e 2d Byte [2:5]
Session ID
ID of session that instance is presently activated on.
(The Managed System Session ID that the BMC generated when the session was activated).
00_00_00_00h if given instance is not activated.
Remote software can use this information with the Get Session Info command to identify the remote console that presently is using a given payload type.
00 00 00 00 00 00 00 00 Byte [6:13]
Payload-specific information (8-bytes)
For Payload Type = SOL:
Byte 1: Port Number
A number representing the system serial port that is being redirected.
1-based. 0h = unspecified. Used when more than one port can be redirected on a system.
Byte 2:8 = reserved.

[ipmiutil in Linux]

$ icmd 00 20 18 4b 01 01
ipmiutil cmd ver 3.10
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
respData[len=12]: 2a ec 6e 2d Byte [2:5]
Session ID
ID of session that instance is presently activated on.
(The Managed System Session ID that the BMC generated when the session was activated).
00_00_00_00h if given instance is not activated.
Remote software can use this information with the Get Session Info command to identify the remote console that presently is using a given payload type.
00 00 00 00 00 00 00 00 Byte [6:13]
Payload-specific information (8-bytes)
For Payload Type = SOL:
Byte 1: Port Number
A number representing the system serial port that is being redirected.
1-based. 0h = unspecified. Used when more than one port can be redirected on a system.
Byte 2:8 = reserved.

send_icmd ret = 0
ipmiutil cmd, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x4b 0x01 0x01
rcvd: 4B 00 Byte 1
Completion Code
00h = Command Completed Normally
2A EC 6E 2D Byte [2:5]
Session ID
ID of session that instance is presently activated on.
(The Managed System Session ID that the BMC generated when the session was activated).
00_00_00_00h if given instance is not activated.
Remote software can use this information with the Get Session Info command to identify the remote console that presently is using a given payload type.
00 00 00 00 00 00 00 00 Byte [6:13]
Payload-specific information (8-bytes)
For Payload Type = SOL:
Byte 1: Port Number
A number representing the system serial port that is being redirected.
1-based. 0h = unspecified. Used when more than one port can be redirected on a system.
Byte 2:8 = reserved.

Set User Payload Access - NetFn = App (0x06h), CMD = 0x4ch, Privilege Level = Admin, M/O = O
| Linux |
[IPMItool]

ipmitool raw 0x06 0x4c D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - Channel Number
D[2] Byte 2
Request Data Byte 2
[7:6] - Operation
00b = ENABLE.
01b = DISABLE.
10b, 11b = reserved
[5:0] - User ID. 000000b = reserved.
D[3] Byte 3
Standard Payload enables 1
[7:2] - reserved for standard payloads 2-7 enable/disable bits
[1] - standard payload 1 (SOL) enable/disable
[0] - reserved.
Note: IPMI Messsaging is enabled/disabled for users via the Set User Access command.
D[4] Byte 4
Standard Payload Enables 2
reserved
D[5] Byte 5
OEM Payload Enables 1
[7] - OEM Payload 7 enable/disable
[6] - OEM Payload 6 enable/disable
[5] - OEM Payload 5 enable/disable
[4] - OEM Payload 4 enable/disable
[3] - OEM Payload 3 enable/disable
[2] - OEM Payload 2 enable/disable
[1] - OEM Payload 1 enable/disable
[0] - OEM Payload 0 enable/disable
D[6] Byte 6
OEM Payload Enables 2
reserved

[ipmiutil]

ipmiutil cmd 00 20 18 4c D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - Channel Number
D[2] Byte 2
Request Data Byte 2
[7:6] - Operation
00b = ENABLE.
01b = DISABLE.
10b, 11b = reserved
[5:0] - User ID. 000000b = reserved.
D[3] Byte 3
Standard Payload enables 1
[7:2] - reserved for standard payloads 2-7 enable/disable bits
[1] - standard payload 1 (SOL) enable/disable
[0] - reserved.
Note: IPMI Messsaging is enabled/disabled for users via the Set User Access command.
D[4] Byte 4
Standard Payload Enables 2
reserved
D[5] Byte 5
OEM Payload Enables 1
[7] - OEM Payload 7 enable/disable
[6] - OEM Payload 6 enable/disable
[5] - OEM Payload 5 enable/disable
[4] - OEM Payload 4 enable/disable
[3] - OEM Payload 3 enable/disable
[2] - OEM Payload 2 enable/disable
[1] - OEM Payload 1 enable/disable
[0] - OEM Payload 0 enable/disable
D[6] Byte 6
OEM Payload Enables 2
reserved

icmd 00 20 18 4c D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - Channel Number
D[2] Byte 2
Request Data Byte 2
[7:6] - Operation
00b = ENABLE.
01b = DISABLE.
10b, 11b = reserved
[5:0] - User ID. 000000b = reserved.
D[3] Byte 3
Standard Payload enables 1
[7:2] - reserved for standard payloads 2-7 enable/disable bits
[1] - standard payload 1 (SOL) enable/disable
[0] - reserved.
Note: IPMI Messsaging is enabled/disabled for users via the Set User Access command.
D[4] Byte 4
Standard Payload Enables 2
reserved
D[5] Byte 5
OEM Payload Enables 1
[7] - OEM Payload 7 enable/disable
[6] - OEM Payload 6 enable/disable
[5] - OEM Payload 5 enable/disable
[4] - OEM Payload 4 enable/disable
[3] - OEM Payload 3 enable/disable
[2] - OEM Payload 2 enable/disable
[1] - OEM Payload 1 enable/disable
[0] - OEM Payload 0 enable/disable
D[6] Byte 6
OEM Payload Enables 2
reserved

[FreeIPMI]

ipmi-raw 0x00 0x06 0x4c D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - Channel Number
D[2] Byte 2
Request Data Byte 2
[7:6] - Operation
00b = ENABLE.
01b = DISABLE.
10b, 11b = reserved
[5:0] - User ID. 000000b = reserved.
D[3] Byte 3
Standard Payload enables 1
[7:2] - reserved for standard payloads 2-7 enable/disable bits
[1] - standard payload 1 (SOL) enable/disable
[0] - reserved.
Note: IPMI Messsaging is enabled/disabled for users via the Set User Access command.
D[4] Byte 4
Standard Payload Enables 2
reserved
D[5] Byte 5
OEM Payload Enables 1
[7] - OEM Payload 7 enable/disable
[6] - OEM Payload 6 enable/disable
[5] - OEM Payload 5 enable/disable
[4] - OEM Payload 4 enable/disable
[3] - OEM Payload 3 enable/disable
[2] - OEM Payload 2 enable/disable
[1] - OEM Payload 1 enable/disable
[0] - OEM Payload 0 enable/disable
D[6] Byte 6
OEM Payload Enables 2
reserved

| MS-DOS |
[ipmitool]

ipmitool 20 18 4c Data[1:6]

For example   Hint: hover over Place your mouse over the highlighted area in below
for Response Data description
[IPMItool in Linux]

$ ipmitool raw 0x06 0x4c 0x01 0x01 0x02 0x00 0x00 0x00

[ipmiutil in Linux]

$ icmd 00 20 18 4c 01 01 02 00 00 00
ipmiutil cmd ver 3.10
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
send_icmd ret = 0
ipmiutil cmd, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x4c 0x01 0x01 0x02 0x00 0x00 0x00
rcvd: 4C 00 Byte 1
Completion Code
00h = Command Completed Normally

Get User Payload Access - NetFn = App (0x06h), CMD = 0x4dh, Privilege Level = Operator, M/O = O
| Linux |
[IPMItool]

ipmitool raw 0x06 0x4d D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - Channel Number
D[2] Byte 2
User ID
[7:6] - reserved
[5:0] - User ID. 000000b = reserved

[ipmiutil]

ipmiutil cmd 00 20 18 4d D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - Channel Number
D[2] Byte 2
User ID
[7:6] - reserved
[5:0] - User ID. 000000b = reserved

icmd 00 20 18 4d D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - Channel Number
D[2] Byte 2
User ID
[7:6] - reserved
[5:0] - User ID. 000000b = reserved

[FreeIPMI]

ipmi-raw 0x00 0x06 0x4d D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - Channel Number
D[2] Byte 2
User ID
[7:6] - reserved
[5:0] - User ID. 000000b = reserved

| MS-DOS |
[ipmitool]

ipmitool 20 18 4d Data[1:2]

For example   Hint: hover over Place your mouse over the highlighted area in below
for Response Data description
[IPMItool in Linux]

$ ipmitool raw 0x06 0x4d 0x01 0x01
 02 Byte 2
Standard Payload enables 1
[7:2] - reserved for standard payloads 2-7 enabled/disabled state
  [1] - 1b = standard payload 1 enabled (SOL)
        0b = standard payload 1 disabled
  [0] - reserved
00 Byte 3
Standard Payload Enables 2
reserved
00 Byte 4
OEM Payload Enables 1
For each bit:
1b = payload enabled
0b = payload disabled
[7] - OEM Payload 7 enabled/disabled
[6] - OEM Payload 6 enabled/disabled
[5] - OEM Payload 5 enabled/disabled
[4] - OEM Payload 4 enabled/disabled
[3] - OEM Payload 3 enabled/disabled
[2] - OEM Payload 2 enabled/disabled
[1] - OEM Payload 1 enabled/disabled
[0] - OEM Payload 0 enabled/disabled
00 Byte 5
OEM Payload Enables 2
reserved

[ipmiutil in Linux]

$ icmd 00 20 18 4d 01 01
ipmiutil cmd ver 3.10
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
respData[len=4]: 02 Byte 2
Standard Payload enables 1
[7:2] - reserved for standard payloads 2-7 enabled/disabled state
  [1] - 1b = standard payload 1 enabled (SOL)
        0b = standard payload 1 disabled
  [0] - reserved
00 Byte 3
Standard Payload Enables 2
reserved
00 Byte 4
OEM Payload Enables 1
For each bit:
1b = payload enabled
0b = payload disabled
[7] - OEM Payload 7 enabled/disabled
[6] - OEM Payload 6 enabled/disabled
[5] - OEM Payload 5 enabled/disabled
[4] - OEM Payload 4 enabled/disabled
[3] - OEM Payload 3 enabled/disabled
[2] - OEM Payload 2 enabled/disabled
[1] - OEM Payload 1 enabled/disabled
[0] - OEM Payload 0 enabled/disabled
00 Byte 5
OEM Payload Enables 2
reserved

send_icmd ret = 0
ipmiutil cmd, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x4d 0x01 0x01
rcvd: 4D 00 Byte 1
Completion Code
00h = Command Completed Normally
02 Byte 2
Standard Payload enables 1
[7:2] - reserved for standard payloads 2-7 enabled/disabled state
  [1] - 1b = standard payload 1 enabled (SOL)
        0b = standard payload 1 disabled
  [0] - reserved
00 Byte 3
Standard Payload Enables 2
reserved
00 Byte 4
OEM Payload Enables 1
For each bit:
1b = payload enabled
0b = payload disabled
[7] - OEM Payload 7 enabled/disabled
[6] - OEM Payload 6 enabled/disabled
[5] - OEM Payload 5 enabled/disabled
[4] - OEM Payload 4 enabled/disabled
[3] - OEM Payload 3 enabled/disabled
[2] - OEM Payload 2 enabled/disabled
[1] - OEM Payload 1 enabled/disabled
[0] - OEM Payload 0 enabled/disabled
00 Byte 5
OEM Payload Enables 2
reserved

Get Channel Payload Support - NetFn = App (0x06h), CMD = 0x4eh, Privilege Level = User, M/O = O
| Linux |
[IPMItool]

ipmitool raw 0x06 0x4e D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - Channel Number

[ipmiutil]

ipmiutil cmd 00 20 18 4e D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - Channel Number

icmd 00 20 18 4e D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - Channel Number

[FreeIPMI]

ipmi-raw 0x00 0x06 0x4e D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - Channel Number

| MS-DOS |
[ipmitool]

ipmitool 20 18 4e Data[1]

For example   Hint: hover over Place your mouse over the highlighted area in below
for Response Data description
[IPMItool in Linux]

$ ipmitool raw 0x06 0x4e 0x01
 03 Byte 2
Response Data Byte 2
[7] = Standard payload type #7 supported
…
[0] = Standard payload type #0 supported
00 Byte 3
Response Data Byte 3
[7] = Standard payload type #7 supported
…
[0] = Standard payload type #0 supported
3f Byte 4
Response Data Byte 4
[7] = Standard payload type #7 supported
…
[0] = Standard payload type #0 supported
00 Byte 5
Response Data Byte 5
[7] = Standard payload type #7 supported
…
[0] = Standard payload type #0 supported
00 Byte 6
Response Data Byte 6
[7] = Payload type 27h (OEM7) used
…
[0] = Payload type 20h (OEM0) used
00 Byte 7
Response Data Byte 7
[7] = Payload type 2Fh (OEM15) used
…
[0] = Payload type 28h (OEM8) used
00 00 Byte [8:9]
reserved
Return as 0000h

[ipmiutil in Linux]

$ icmd 00 20 18 4e 01
ipmiutil cmd ver 3.10
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
respData[len=8]: 03 Byte 2
Response Data Byte 2
[7] = Standard payload type #7 supported
…
[0] = Standard payload type #0 supported
00 Byte 3
Response Data Byte 3
[7] = Standard payload type #7 supported
…
[0] = Standard payload type #0 supported
3f Byte 4
Response Data Byte 4
[7] = Standard payload type #7 supported
…
[0] = Standard payload type #0 supported
00 Byte 5
Response Data Byte 5
[7] = Standard payload type #7 supported
…
[0] = Standard payload type #0 supported
00 Byte 6
Response Data Byte 6
[7] = Payload type 27h (OEM7) used
…
[0] = Payload type 20h (OEM0) used
00 Byte 7
Response Data Byte 7
[7] = Payload type 2Fh (OEM15) used
…
[0] = Payload type 28h (OEM8) used
00 00 Byte [8:9]
reserved
Return as 0000h

send_icmd ret = 0
ipmiutil cmd, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x4e 0x08
rcvd: 4E 00 Byte 1
Completion Code
00h = Command Completed Normally
03 Byte 2
Response Data Byte 2
[7] = Standard payload type #7 supported
…
[0] = Standard payload type #0 supported
00 Byte 3
Response Data Byte 3
[7] = Standard payload type #7 supported
…
[0] = Standard payload type #0 supported
3F Byte 4
Response Data Byte 4
[7] = Standard payload type #7 supported
…
[0] = Standard payload type #0 supported
00 Byte 5
Response Data Byte 5
[7] = Standard payload type #7 supported
…
[0] = Standard payload type #0 supported
00 Byte 6
Response Data Byte 6
[7] = Payload type 27h (OEM7) used
…
[0] = Payload type 20h (OEM0) used
00 Byte 7
Response Data Byte 7
[7] = Payload type 2Fh (OEM15) used
…
[0] = Payload type 28h (OEM8) used
00 00 Byte [8:9]
reserved
Return as 0000h

Get Channel Payload Version - NetFn = App (0x06h), CMD = 0x4fh, Privilege Level = User, M/O = O
| Linux |
[IPMItool]

ipmitool raw 0x06 0x4f D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - Channel Number
D[2] Byte 2
Payload Type Number / Payload Type Handle
number of the standard
payload type or OEM Payload Handle to retrieve status for.

[ipmiutil]

ipmiutil cmd 00 20 18 4f D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - Channel Number
D[2] Byte 2
Payload Type Number / Payload Type Handle
number of the standard
payload type or OEM Payload Handle to retrieve status for.

icmd 00 20 18 4f D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - Channel Number
D[2] Byte 2
Payload Type Number / Payload Type Handle
number of the standard
payload type or OEM Payload Handle to retrieve status for.

[FreeIPMI]

ipmi-raw 0x00 0x06 0x4f D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - Channel Number
D[2] Byte 2
Payload Type Number / Payload Type Handle
number of the standard
payload type or OEM Payload Handle to retrieve status for.

| MS-DOS |
[ipmitool]

ipmitool 20 18 4f Data[1:2]

--Completion Code--

80h - Payload type not available on given channel

For example   Hint: hover over Place your mouse over the highlighted area in below
for Response Data description
[IPMItool in Linux]

$ ipmitool raw 0x06 0x4f 0x01 0x00
 10 Byte 2
Format Version
[7:4] - Major Format Version. BCD encoded (0 to 9)
[3:0] - Minor Format Version. BCD encoded. (0 to 9)
The Format Version for the SOL payload implemented per this specification is 1.0 (10h).

[ipmiutil in Linux]

$ icmd 00 20 18 4f 08 00
ipmiutil cmd ver 3.10
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
respData[len=1]: 10 Byte 2
Format Version
[7:4] - Major Format Version. BCD encoded (0 to 9)
[3:0] - Minor Format Version. BCD encoded. (0 to 9)
The Format Version for the SOL payload implemented per this specification is 1.0 (10h).

send_icmd ret = 0
ipmiutil cmd, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x4f 0x08 0x00
rcvd: 4F 00 Byte 1
Completion Code
00h = Command Completed Normally
80h - Payload type not available on given channel
10 Byte 2
Format Version
[7:4] - Major Format Version. BCD encoded (0 to 9)
[3:0] - Minor Format Version. BCD encoded. (0 to 9)
The Format Version for the SOL payload implemented per this specification is 1.0 (10h).

Get Channel OEM Payload Info - NetFn = App (0x06h), CMD = 0x50h, Privilege Level = User, M/O = O
| Linux |
[IPMItool]

ipmitool raw 0x06 0x50 D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - Channel Number
D[2] Byte 2
Payload Type Number
Use "OEM Explicit" to look up information by OEM IANA/OEM Payload ID.
D[3:5] Byte [3:5]
OEM IANA
When Payload Type Number is 02h (OEM Explicit) this field holds the OEM IANA for the OEM payload type to look up information for.
Otherwise, this field is set to 00_00_00h.
D[6:7] Byte [6:7]
OEM Payload ID
When Payload Type Number is 02h (OEM Explicit) this field holds the OEM Payload ID for the OEM payload type to look up information for.
Otherwise, this field is set to 0000h.

[ipmiutil]

ipmiutil cmd 00 20 18 50 D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - Channel Number
D[2] Byte 2
Payload Type Number
Use "OEM Explicit" to look up information by OEM IANA/OEM Payload ID.
D[3:5] Byte [3:5]
OEM IANA
When Payload Type Number is 02h (OEM Explicit) this field holds the OEM IANA for the OEM payload type to look up information for.
Otherwise, this field is set to 00_00_00h.
D[6:7] Byte [6:7]
OEM Payload ID
When Payload Type Number is 02h (OEM Explicit) this field holds the OEM Payload ID for the OEM payload type to look up information for.
Otherwise, this field is set to 0000h.

icmd 00 20 18 50 D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - Channel Number
D[2] Byte 2
Payload Type Number
Use "OEM Explicit" to look up information by OEM IANA/OEM Payload ID.
D[3:5] Byte [3:5]
OEM IANA
When Payload Type Number is 02h (OEM Explicit) this field holds the OEM IANA for the OEM payload type to look up information for.
Otherwise, this field is set to 00_00_00h.
D[6:7] Byte [6:7]
OEM Payload ID
When Payload Type Number is 02h (OEM Explicit) this field holds the OEM Payload ID for the OEM payload type to look up information for.
Otherwise, this field is set to 0000h.

[FreeIPMI]

ipmi-raw 0x00 0x06 0x50 D[1] Byte 1
Channel Number
[7:4] - reserved
[3:0] - Channel Number
D[2] Byte 2
Payload Type Number
Use "OEM Explicit" to look up information by OEM IANA/OEM Payload ID.
D[3:5] Byte [3:5]
OEM IANA
When Payload Type Number is 02h (OEM Explicit) this field holds the OEM IANA for the OEM payload type to look up information for.
Otherwise, this field is set to 00_00_00h.
D[6:7] Byte [6:7]
OEM Payload ID
When Payload Type Number is 02h (OEM Explicit) this field holds the OEM Payload ID for the OEM payload type to look up information for.
Otherwise, this field is set to 0000h.

| MS-DOS |
[ipmitool]

ipmitool 20 18 50 Data[1:7]

--Completion Code--

80h = OEM Payload IANA and/or Payload ID not supported

For example   Hint: hover over Place your mouse over the highlighted area in below
for Response Data description
[IPMItool in Linux]

$ ipmitool raw 0x06 0x50 0x01 0x00 0x00 0x00 0x00 0x00 0x00
 00 Byte 2
Payload Type Number
This is always returned as the OEM Payload Type number (OEM0-OEM7).
"OEM Explicit" is not returned for this parameter.
00 00 00 Byte [3:5]
OEM IANA
IANA for the OEM that has defined the OEM payload type.
00 00 Byte [6:7]
OEM Payload ID
Payload ID value, specified by the OEM the defined the payload type.
10 Byte 8
Format Version
[7:4] - Major Format Version. BCD encoded (0 to 9)
[3:0] - Minor Format Version. BCD encoded. (0 to 9)
Software should present version data to the user in the format "major.minor" - e.g. 10h -> "1.0"

[ipmiutil in Linux]

$ icmd 00 20 18 50 08 00 00 00 00 00 00
ipmiutil cmd ver 3.10
This is a test tool to compose IPMI commands.
Do not use without knowledge of the IPMI specification.
-- BMC version 1.7, IPMI version 2.0
respData[len=7]: 00 Byte 2
Payload Type Number
This is always returned as the OEM Payload Type number (OEM0-OEM7).
"OEM Explicit" is not returned for this parameter.
00 00 00 Byte [3:5]
OEM IANA
IANA for the OEM that has defined the OEM payload type.
00 00 Byte [6:7]
OEM Payload ID
Payload ID value, specified by the OEM the defined the payload type.
10 Byte 8
Format Version
[7:4] - Major Format Version. BCD encoded (0 to 9)
[3:0] - Minor Format Version. BCD encoded. (0 to 9)
Software should present version data to the user in the format "major.minor" - e.g. 10h -> "1.0"

send_icmd ret = 0
ipmiutil cmd, completed successfully

[FreeIPMI in Linux]

$ ipmi-raw 0x00 0x06 0x50 0x01 0x00 0x00 0x00 0x00 0x00 0x00
rcvd: 50 00 Byte 1
Completion Code
00h = Command Completed Normally
80h = OEM Payload IANA and/or Payload ID not supported
00 Byte 2
Payload Type Number
This is always returned as the OEM Payload Type number (OEM0-OEM7).
"OEM Explicit" is not returned for this parameter.
00 00 00 Byte [3:5]
OEM IANA
IANA for the OEM that has defined the OEM payload type.
00 00 Byte [6:7]
OEM Payload ID
Payload ID value, specified by the OEM the defined the payload type.
10 Byte 8
Format Version
[7:4] - Major Format Version. BCD encoded (0 to 9)
[3:0] - Minor Format Version. BCD encoded. (0 to 9)
Software should present version data to the user in the format "major.minor" - e.g. 10h -> "1.0"

Reference
[1] "Intelligent Platform Management Interface Specification Second Generation v2.0 Document Revision 1.1"
https://www.intel.com/content/dam/www/public/us/en/documents/product-briefs/ipmi-second-gen-interface-spec-v2-rev1-1.pdf
[2] "IPMItool" http://sourceforge.net/projects/ipmitool/
[3] "IPMI Command Test Tool" http://www.intel.com/design/servers/ipmi/ipmi_tool.htm
[4] "IPMIUTIL USER GUIDE" http://ipmiutil.sourceforge.net/
[5] "FreeIPMI Documentation" http://www.gnu.org/software/freeipmi/index.html

Last Updated: Jun 6, 2018