docs(arch): Add ARCHITECTURE.md and CLAUDE.md, init repo

Bring the Blanton Tera Term TTL test suite under version control and document how the pieces fit together. - ARCHITECTURE.md: A/B/C script roles, host-to-DUT-to-FPGA data path, config/settings/profile data models, PCIe AER + EDAC topology table, 10 key constraints, and 6 development phases derived from the Status_20260814 spreadsheet's On-Going items - CLAUDE.md: stack, smoke-test commands, conventions, and the hardware footguns (per-unit BDF, VSPI vs VI2C timing, repeated START, STORE_USER_ALL, ARB_LOST false positives) - secret/: gitignored credential store with README + .example template, so the DUT login stops living in 1_Blanton_Script_A.ttl - .gitignore: secret/*, For_AI/, *.log, publish/, *.DSN Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014RetWKFZFG1ZHcitQAyhwM
2026-08-17 08:52:11 +08:00
commit 24c704c667
60 changed files with 8637 additions and 0 deletions
@@ -0,0 +1,24 @@
+# secret/ 全部忽略，但保留 README 與範本
+secret/*
+!secret/README.md
+!secret/*.example
+!secret/.gitkeep
+
+# AI 協作素材不入 git
+For_AI/
+
+# 測試 log（含 DUT 序號 / MAC / 韌體版本，保留目錄結構即可）
+*.log
+!**/logs/.gitkeep
+!**/Logs/.gitkeep
+
+# 打包輸出
+publish/*
+!publish/.gitkeep
+
+# Office 暫存檔
+~$*
+
+# 客戶板 schematic 原始檔（機密，勿入 repo）
+*.DSN
+*.dsn
@@ -0,0 +1,548 @@
+# ARCHITECTURE — Blanton TTL Script
+
+## Overview
+
+**Blanton_TTL_Script** 是 Blanton（Project Helios）交換器平台的**系統層可靠性測試自動化腳本組**。
+測試工程師在 Windows 端用 **Tera Term (TTL macro)** 透過 COM port 連上 DUT 的 SONiC console，
+由 A / B / C 三支腳本依序驅動一整輪 stress + margin + error-counter 測試，全程自動存 log。
+
+三支腳本的分工就是一輪測試的三個階段：
+
+| Script | 階段 | 做什麼 |
+|--------|------|--------|
+| `1_Blanton_Script_A.ttl` | **Pre-test / Baseline** | 登入、對時、載入 shell 工具、清 PCIe AER、抓 PCIe tree / margin / PMON / dmesg 基線 |
+| `2_Blanton_Script_B.ttl` | **Stress / Soak** | 開 CPU / DDR / SSD / USB / PCIe / I2C 壓力程序，之後進無限迴圈每輪抓 fan / temp / margin |
+| `3_Blanton_Script_C.ttl` | **Post-test / Verdict** | 殺掉壓力程序、再抓一次 PMON / dmesg / PCIe AER，比對 stress log 判定 |
+
+DUT 端的實際取數能力則來自一組 **bash 工具庫**（`Blanton_Script/`），這一層才是真正碰硬體的地方：
+CB FPGA 的 PCIe BAR（`pcimem`）→ FPGA 內建 I2C / VI2C master → 板上 VRM、溫度感測器、
+LTC2980 margin 控制器。TTL 只負責「按順序 `sendln` 並把畫面收進 log」，硬體語意全在 bash 這層。
+
+**使用者**：硬體 / 系統驗證工程師（ETWen、KC、Alan）。
+**核心價值**：把一輪要跑數小時、跨 PCIe / DDR / I2C / 電源多個子系統的 reliability run，
+壓縮成「開 Tera Term → 跑 A → 跑 B 泡著 → 跑 C 收工」三個動作，且每一筆數據都有 log 可回溯。
+
+---
+
+## Tech Stack
+
+| Layer | Technology |
+|-------|-----------|
+| 測試控制端（Host） | Tera Term 5.x **TTL macro**（`.ttl`），Windows |
+| Host ↔ DUT 通道 | RS-232 / USB-Serial COM port（SONiC console） |
+| DUT OS | SONiC（Debian-based network OS），bash + busybox/mawk |
+| DUT 端工具語言 | Bash Shell Script |
+| 暫存器存取後端 | `pcimem`（mmap PCI sysfs `resource0` + BAR 相對 offset） |
+| I2C / PMBus 路徑 | CB FPGA F3 OpenCores I2C master、CB FPGA F3 VI2C proxy、CPU 原生 bus（`i2cset`/`i2cget`） |
+| 電源 margin | LTC2980（= 2 × LTC2977）over PMBus，LINEAR16 編碼 |
+| 錯誤計數來源 | Linux PCIe AER sysfs（`aer_dev_*`）、EDAC sysfs（`dimm_ce/ue_count`） |
+| 平台監控 | SONiC `show platform *`（pmon container） |
+| 壓力測試 | `mlucas-avx2`（AMD CPU）、`~/hammer/tools/stress_*.py`（DDR / SSD / USB / PCIe / I2C） |
+| 版本控制 | Git（NAS + Gitea 私有 remote；**不推 GitHub，含客戶 NDA 資料**） |
+
+> ⚠️ **無編譯步驟。** TTL 與 bash 都是直譯執行，「build」等同「把 `src/Script_ABC_Blanton/` 複製到
+> Tera Term 工作目錄，並把 `Blanton_Script/` scp 到 DUT 的 `~/`」。
+
+---
+
+## Architecture Diagram
+
+```
+┌──────────────────────────────────────────────────────────────┐
+│  Windows Host — Tera Term 5.x                                │
+│                                                              │
+│   1_Blanton_Script_A.ttl ──┐                                 │
+│   2_Blanton_Script_B.ttl ──┼─→ include "config.ttl"          │
+│   3_Blanton_Script_C.ttl ──┘   (prompt / EN_* 旗標)          │
+│            │                                                 │
+│            └─→ include "utils/*.ttl"  (可重用取數片段)        │
+│                                                              │
+│   logopen → Logs/Blanton_Margin_<ts>.log  (整段 console 存檔) │
+└───────────────────────┬──────────────────────────────────────┘
+                        │ COM port：sendln "<cmd>" / wait "<prompt>"
+                        ▼
+┌──────────────────────────────────────────────────────────────┐
+│  DUT — SONiC console (root@sonic:~#)                         │
+│                                                              │
+│  ~/Blanton_Script/  (source 進 shell 後成為一組函數)          │
+│   ├ blanton_fpga_pcimem.sh   cb_fpga / pmc_fpga / swb0_fpga  │
+│   ├ blanton_cb_i2c.sh        cb_i2c_* / cb_pmbus_*           │
+│   ├ blanton_icb_vi2c.sh      vi2c_* (ICB/PDB proxy)          │
+│   ├ blanton_temp_sensor.sh   temp_cb / temp_icb / temp_all   │
+│   ├ blanton_pwr_data.sh      pwr_data / pwr_data_pdb         │
+│   └ LTC2980_Margin_Script/   margin_init / margin_status ... │
+│                                                              │
+│  ~/hammer/tools/     壓力程序（mlucas-avx2, stress_*.py）     │
+│  SONiC CLI           show platform fan/temperature/...       │
+│  Linux sysfs         aer_dev_* / edac mc0/rank*              │
+└───────────────────────┬──────────────────────────────────────┘
+                        │ pcimem /sys/bus/pci/devices/0000:03:00.<fn>/resource0
+                        ▼
+┌──────────────────────────────────────────────────────────────┐
+│  CB FPGA (PCIe EP，4 個 Function)                             │
+│   F0  local regs：RST_CAUSE_REG 0xD90 / SWB 0xD94,0xD98      │
+│   F3  I2C master  Ch0..Ch17  (base 0x300, stride 0x20)       │
+│   F3  VI2C→ICB    Ch0..Ch4   (base 0x780, stride 0x20)       │
+│   F2  VSPI 橋接 PMC/ICB/SWB（慢，~18ms/reg，本專案不走）      │
+└───────────────────────┬──────────────────────────────────────┘
+                        │ I2C / PMBus
+                        ▼
+   TCA9546/9543 mux · MP29816/MP2985B VRM · TMP75/TMP432 溫感
+   MAX31790 風扇 · LTC2980 margin (CONN13~16 × CB/SWB0/SWB1)
+   PDB：Hotswap / Power brick / EFUSE（走 VI2C ch3/ch4）
+```
+
+---
+
+## Project Structure
+
+```
+Blanton_TTL_Script/
+│
+├── CLAUDE.md                          # 專案記憶 & 給 Claude 的指令
+├── ARCHITECTURE.md                    # 本架構文件
+├── .gitignore                         # secret/ + For_AI/ + logs 規則
+│
+├── docs/                              # 規格與狀態文件（客戶提供 / 專案產出）
+│   ├── Blantons_FPGA_Registers.md         # FPGA 暫存器規格（markdown 正本，查 offset 用）
+│   ├── Blantons_FPGA_Registers_draft.docx # 同上，客戶原始 docx
+│   ├── Blantons_FPGA_Registers_Map_draft.xlsx
+│   ├── Blantons_PCIe_AER_and_DDR_EDAC_checks.pdf  # AER / EDAC 檢查點依據
+│   └── TTL_Script_Blanton_Status_20260814.xlsx    # ⭐ 三支腳本逐項 Status（OK / On-Going + Owner）
+│
+├── tools/                             # Host 端輔助腳本（log 解析、報表產生）
+│
+├── secret/                            # 🚫 gitignored — DUT 密碼、per-unit BDF、COM 設定
+│   ├── README.md                      # ✅ committed — 用途索引
+│   ├── config_secret.ttl.example      # ✅ committed — 帳密範本（__CHANGE_ME__）
+│   └── config_secret.ttl              # 🚫 實際帳密，由 config.ttl include
+│
+├── For_AI/                            # 🚫 gitignored — AI 協作素材（波形截圖、草稿）
+│
+├── publish/                           # 可交付的打包輸出（Blanton_Script_ABC_v<ver>_<date>/ + zip）
+│
+└── src/
+    └── Script_ABC_Blanton/            # ← Tera Term 的工作目錄（整包給測試員）
+        │
+        ├── config.ttl                 # 全域設定：testcase 名、EN_Margin / EN_log、三個 prompt 字串
+        ├── 1_Blanton_Script_A.ttl     # Pre-test：登入 → 對時 → source 工具 → 清 AER → 抓基線
+        ├── 2_Blanton_Script_B.ttl     # Stress：開壓力程序 → while 1 每輪抓 fan/temp/margin
+        ├── 3_Blanton_Script_C.ttl     # Post-test：kill → 再抓一次 → 比對 stress log
+        │
+        ├── utils/                     # 可 include 的取數片段（TTL，無狀態、只 wait+sendln）
+        │   ├── pcie_bus.ttl               # lspci -tvvv / -vv
+        │   ├── setup_pmon.ttl             # show platform summary/fan/temperature/psu/voltage/current/ssd
+        │   ├── show_dmesg.ttl             # date + dmesg grep error/fail/warning
+        │   ├── show_margin_status.ttl     # source margin_status_all.sh（掃 9 顆 LTC2980）
+        │   ├── kill_all_process.ttl       # kill $(jobs -p)
+        │   ├── show_pcie_error_reg.ttl        # 舊的合併版（已被下列 per-device 版取代）
+        │   ├── show_pcie_error_reg_TH6_SWB0.ttl   # EP 01:00.0 + RP 00:01.1
+        │   ├── show_pcie_error_reg_TH6_SWB1.ttl   # EP 02:00.0 + RP 00:01.2
+        │   ├── show_pcie_error_reg_FPGA.ttl       # RP 00:01.5（共用上游）
+        │   ├── show_pcie_error_reg_BMC.ttl        # EP 03:00.0 + RP 00:01.4
+        │   ├── show_pcie_error_reg_I210.ttl       # EP 07:00.0 + RP 00:02.4
+        │   ├── show_pcie_error_reg_SSD.ttl        # EP 06:00.0 + RP 00:02.1
+        │   └── show_pcie_error_reg_DDR.ttl        # EDAC mc0 rank0~3 CE/UE
+        │
+        ├── logs/                      # Tera Term logopen 輸出（*.log gitignored）
+        │
+        └── Blanton_Script/            # ← scp 到 DUT ~/ 的單位（bash 工具庫）
+            ├── blanton_fpga_pcimem.sh     # pcimem 後端：cb_fpga/pmc_fpga/icb_fpga/swb0_fpga/swb1_fpga
+            ├── blanton_cb_i2c.sh          # CB FPGA F3 I2C master（Ch0~Ch17）+ PMBus helper
+            ├── blanton_icb_vi2c.sh        # CB F3 VI2C proxy → ICB/PDB（Ch0~Ch4）
+            ├── blanton_temp_sensor.sh     # TMP75 / TMP432 讀溫（CB Ch10 mux + ICB VI2C Ch2）
+            ├── blanton_pwr_data.sh        # SWB VRM + PDB brick 的 Vin/Vout/Iout/Temp 表
+            └── LTC2980_Margin_Script/     # 電壓 margin 子專案（另有獨立 repo）
+                ├── margin.sh              # margin_init/status/set/apply_profile/save
+                ├── settings/*.conf        # 一個 .conf = 一顆 LTC2980（CB + SWB0/1 × CONN13~16）
+                ├── profiles/*.conf        # 16-ch 批次組合（comboA/B、high3/5、low3/5、normal、off）
+                ├── script/*_all.sh        # 跨 9 顆 LTC2980 的批次 status / apply / save
+                └── logs/                  # margin 操作 log
+```
+
+---
+
+## Data Models
+
+本專案沒有資料庫，「資料模型」是**設定檔格式**與**暫存器 / sysfs 語意**。
+
+### 1. `config.ttl` — 全域測試參數（TTL 變數）
+
+```ini
+strTestcase   = "Margin"        ; 測項名，進 log 檔名
+project_name  = "Blanton"       ; 專案名，進 log 檔名
+EN_Margin     = 1               ; 1=跑 margin 掃描, 0=跳過
+EN_log        = 1               ; 1=logopen 存檔, 0=不存
+prompt_login      = "sonic login:"
+prompt_sonic      = "admin@sonic:~$"
+prompt_sonic_root = "root@sonic:~#"
+```
+
+Log 檔名規則：`<mdir>\Logs\<project_name>_<strTestcase>_<YYYYmmdd-HHMMSS>.log`
+
+### 2. `settings/<board>.conf` — 一顆 LTC2980（16 channel）
+
+| 欄位 | 型別 | 說明 |
+|------|------|------|
+| `TRANSPORT` | string | `""`/`"i2c"` = CPU 原生 bus（`i2cset`）；`"swb"` = 走 CB FPGA F3 I2C |
+| `CB_I2C_CH` | int | `TRANSPORT="swb"` 時的 FPGA I2C 通道（6/7/8/9） |
+| `CHIPS[]` | string[2] | `"bus:addr"`，index 0 → CH0~7、index 1 → CH8~15 |
+| `CHIP_PRE_CMD[]` / `CHIP_POST_CMD[]` | string[1] | mux 切換等前後置指令，`;` 分隔多筆 |
+| `CH<n>_VNOM` | string | 標稱電壓（`"-"` = 未使用 / NC） |
+| `CH<n>_NET` | string | 電路 net name（對照 schematic） |
+
+Channel 定址：`ch / 8` → `CHIPS[]` index，`ch % 8` → LTC2977 PMBus PAGE（0x00~0x07）。
+
+### 3. `profiles/*.conf` — 16-ch 批次 margin 組合
+
+```bash
+PROFILE_CHANNELS=( "0:high:8" "1:low:8" ... )   # "channel:operation:change_percent"
+```
+
+| operation | PMBus `OPERATION`(0x01) | 說明 |
+|-----------|------------------------|------|
+| `high` | `0xA8` | Margin high |
+| `low` | `0x98` | Margin low |
+| `nominal` | `0x80` | 回標稱值（跟隨 VOUT_COMMAND） |
+| `off` | `0x00` | 關閉輸出 |
+
+### 4. FPGA / I2C 暫存器語意（工具庫依賴）
+
+| 區塊 | 位置 | 關鍵欄位 |
+|------|------|----------|
+| CB F0 local | `cb_fpga 0 0xD90` | `RST_CAUSE_REG`；`0xD94`/`0xD98` = SWB0/SWB1 |
+| CB F3 I2C（每 ch 0x20 stride，base 0x300） | `+00/04` PRSCL, `+08` CTRL(b7 MOD_EN), `+0C` TX/RX, `+10` CMD/STAT, `+14` MUX_SEL, `+18` RST, `+1C` SEM |
+| CB F3 VI2C（base 0x780，ICB/PDB） | 同上，但 **`+1C` 無 SEM** |
+| I2C CMD | `STA=0x80 STO=0x40 RD=0x20 WR=0x10 NACK=0x08 IACK=0x01` |
+| I2C STAT | `RX_ACK=0x80(1=NACK) BUSY=0x40 ARB_LOST=0x20 TIP=0x02 INT=0x01` |
+| Prescale @75MHz | `0x88` = 100 kHz、`0x24` = 400 kHz |
+
+### 5. 錯誤計數 sysfs（判定依據）
+
+| 類別 | 路徑 | 判定 |
+|------|------|------|
+| PCIe AER（EP + 上游 RP 都要看） | `/sys/bus/pci/devices/<BDF>/aer_dev_{correctable,nonfatal,fatal}` | test 前後差值 > 0 即 fail（correctable 需依 spec 設門檻） |
+| DDR EDAC | `/sys/devices/system/edac/mc/mc0/rank<0-3>/dimm_{ce,ue}_count` | UE > 0 直接 fail；CE 依門檻 |
+
+**Blanton PCIe 拓樸對照**（`show_pcie_error_reg_*.ttl` 的來源）：
+
+| 裝置 | Endpoint BDF | Upstream Root Port |
+|------|--------------|--------------------|
+| TH6 SWB0 | `0000:01:00.0` | `0000:00:01.1` |
+| TH6 SWB1 | `0000:02:00.0` | `0000:00:01.2` |
+| CB FPGA | （F0~F3 @ `0000:03:00.x`） | `0000:00:01.5` |
+| BMC | `0000:03:00.0` | `0000:00:01.4` |
+| I210 1G NIC | `0000:07:00.0` | `0000:00:02.4` |
+| NVMe SSD | `0000:06:00.0` | `0000:00:02.1` |
+
+> ⚠️ **BDF 是 per-unit 的**。`blanton_fpga_pcimem.sh` 的 `FUNCT0..3_RES` 已經改過三次
+> （04:00.x → 03:00.x → 05:00.x → 03:00.x）。換 DUT 一定要先 `lspci -Dnn | grep -i fpga` 重新確認，
+> 同理 `show_pcie_error_reg_*.ttl` 裡的 BDF 也要跟著校。
+
+---
+
+## Key Features
+
+| 模組 | 進入點 | 功能 |
+|------|--------|------|
+| **Script A（Pre-test）** | `1_Blanton_Script_A.ttl` | root 登入 → `mkdir ./logs` → `date -s` 對時 → source 五個 bash 工具 → 清/讀 7 組 PCIe AER → `lspci -tvvv/-vv` → margin 全掃 → PMON 七項 → dmesg 三 grep → `messagebox` 提示接 Script B |
+| **Script B（Stress）** | `2_Blanton_Script_B.ttl` | `mlucas-avx2 -cpu 0:15` + 5 份 `stress_mem.py` + `stress_hhmd/ssd/pcie/usb.py` 全部背景執行 → `jobs` 確認 → `while 1` 每輪 `show platform fan` / `temperature` / margin |
+| **Script C（Post-test）** | `3_Blanton_Script_C.ttl` | `kill $(jobs -p)` → PMON + dmesg 再抓一次 → 7 組 AER 再抓一次 → `cat` mlucas / stress_ssd log → 完成 messagebox |
+| **FPGA 暫存器存取** | `cb_fpga <fn> <addr> [data]` | pcimem 打 `resource0` + BAR 相對 offset，32-bit word；`pmc/icb/swb0/swb1_fpga` 走 VSPI 窗口 |
+| **CB I2C / PMBus** | `cb_i2c_init/scan/read/write`、`cb_pmbus_read/write/linear16` | FPGA F3 OpenCores master，**讀用 Repeated START**（SMBus/PMBus 裝置必需） |
+| **ICB / PDB 存取** | `vi2c_init/scan/read/write`、`vi2c_scan_all` | CB F3 VI2C proxy，~3.3 ms/reg，取代 VSPI 的 ~18 ms/reg（後者會踩 SMBus 25–35 ms timeout） |
+| **溫度** | `temp_cb` / `temp_icb` / `temp_all` | TMP75（12-bit 左靠齊 ×0.0625）、TMP432（含 RANGE bit 的 −64 偏移、remote1/2） |
+| **電源資料** | `pwr_data` / `pwr_data_pdb` / `pwr_pdb_id` | SWB VRM 全軌 Vin/Vout/Iout/Temp 對齊表；MP29816 解析度**執行期從 `MFR_VOUT_SCALE_LOOP` 讀**，不寫死 |
+| **電壓 Margin** | `margin_init/status/set/apply_profile/save` + `*_all.sh` | 9 顆 LTC2980（CB CONN13、SWB0/1 CONN13~16）批次 high/low margin 與狀態掃描 |
+
+---
+
+## Data Flow
+
+### 一輪完整測試（端到端）
+
+```
+[測試員] 開 Tera Term，連 COM<n>，Control → Macro → 1_Blanton_Script_A.ttl
+    │
+    ▼
+Script A ── logopen Logs/Blanton_Margin_<ts>.log ──┐  (之後所有畫面都進這個檔)
+    │                                              │
+    ├─ 登入 admin → sudo -i → root@sonic:~#         │
+    ├─ date -s "<host 時間>"   ← 讓 DUT 時戳可對照   │
+    ├─ source 5 個 bash 工具（函數進 shell）         │
+    ├─ AER 基線：7 組 EP+RP 的 correctable/nonfatal/fatal
+    ├─ lspci -tvvv / -vv       ← 拓樸 + link speed/width
+    ├─ margin_status_all       ← 9 顆 LTC2980 × 16ch 的 Vout 與偏差%
+    ├─ show platform × 7       ← fan/temp/psu/voltage/current/ssdhealth
+    └─ dmesg | grep error/fail/warning
+    ▼
+[messagebox "Start Script B"] ← 人工確認後手動跑 B
+    │
+    ▼
+Script B ── 同一個 log 檔續寫（logwrite 分隔線）
+    ├─ 背景程序：mlucas-avx2(CPU) ×1, stress_mem ×5,
+    │             stress_hhmd(I2C/LSB/PCIe), stress_ssd, stress_pcie, stress_usb
+    ├─ jobs                     ← 確認全部起來了
+    └─ while 1: fan → temperature → margin_status_all   （soak 期間持續取樣）
+    ▼
+[測試員 Ctrl-C / 停止 macro，接著跑 C]
+    │
+    ▼
+Script C
+    ├─ kill $(jobs -p)          ← 收掉所有背景壓力
+    ├─ show platform × 7 + dmesg  ← 收工快照
+    ├─ AER 再抓一次              ← 與 Script A 基線相減 = 本輪新增錯誤
+    └─ cat mlucas_amm_log / log.stress_ssd  ← 壓力程式自身的 pass/fail
+    ▼
+[messagebox "GOOD JOB! Test Case DONE"] → 人工檢查 log
+```
+
+### 硬體讀值路徑（以「讀一顆 SWB VRM 的 Vout」為例）
+
+```
+pwr_data
+  └→ cb_pmbus_read <ch> <slave7> 0x8B 2        (blanton_cb_i2c.sh)
+       └→ _cbi2c_xfer_read：STA+WR(slave|W) → WR(reg) → Sr + STA+WR(slave|R)
+                            → RD(ACK) → RD(NACK)+STO             ← Repeated START
+            └→ cb_fpga 3 <0x300 + ch*0x20 + reg>                  (blanton_fpga_pcimem.sh)
+                 └→ pcimem /sys/bus/pci/devices/0000:03:00.3/resource0 <off> w [data]
+                      └→ CB FPGA BAR0 → F3 I2C master → SCL/SDA → MP29816/MP2985B
+  └→ 解碼：MP2985B = 1 mV/LSB；MP29816 = 由 MFR_VOUT_SCALE_LOOP(0x29) bit[12:10] 決定
+           Vin 一律 31.25 mV/LSB（÷32）
+```
+
+---
+
+## Key Constraints & Business Rules
+
+1. **A → B → C 必須依序跑，且 B 之後才能跑 C。** Script B 的背景 job 只存在於那個 shell session，
+   Script C 的 `kill $(jobs -p)` 依賴同一個 session；中途斷線就得手動收程序。
+2. **A / B / C 共用同一個 log 檔**：只有 Script A `logopen`，B / C 用 `logwrite` 續寫分隔線。
+   跑 B/C 前若關掉了 Tera Term，log 就斷了。
+3. **PCIe AER 的判定是「差值」不是「絕對值」**：Script A 抓基線、Script C 抓結果，
+   兩者相減才是本輪產生的錯誤。EP 與上游 Root Port **兩邊都要看**（錯誤可能只記在 RP）。
+4. **BDF 是 per-unit 的**，換 DUT 必須重新確認並改 `blanton_fpga_pcimem.sh` 的 `FUNCT0..3_RES`
+   與 `utils/show_pcie_error_reg_*.ttl`（見 Data Models §5 註）。
+5. **ICB / PDB 一律走 VI2C，不走 VSPI**：VSPI ~18 ms/reg 會讓 I2C byte 相之間拉到 ~50 ms，
+   踩中 SMBus 25–35 ms timeout，裝置會 NACK register pointer。實測全 5 通道掃描 9.4 s vs 34.0 s。
+6. **I2C 讀一律用 Repeated START**（不是 STOP + START）：PMBus / SMBus 裝置（VRM、EFUSE）
+   只吃 Sr；只有純暫存器裝置兩種都行。
+7. **`margin_save`（`STORE_USER_ALL`）會永久寫進 NVM**，斷電保留。測試流程中**絕不執行**，
+   以免覆蓋客戶出廠 config。`margin.sh` 的 auto-enable 只改 RAM（`ON_OFF_CONFIG`），斷電復原。
+8. **操作硬體電壓有損壞 DUT 的風險**：套 profile 前先確認該軌 OV/UV limit 與 servo DAC 注入電阻
+   有 populate（本板部分 margin 電阻標 PROTO，沒 populate 的軌電壓不會動）。
+9. **`ARB_LOST` 不等於裝置存在**：`vi2c_scan` 只看 `RX_ACK`，仲裁失敗會被誤報成「有裝置」。
+   `blanton_pwr_data.sh` 因此加了 ARB_LOST-aware retry 與 plausibility window
+   （`0xFFFF` 或超出範圍一律回 `NA`）——**寧可 NA 也不要印出一個看起來像數據的錯值**。
+10. **DUT 密碼不得進 git**：`1_Blanton_Script_A.ttl` 目前的 `sendln "YourPaSsWoRd"` 是 placeholder，
+    實際帳密必須放 `secret/config_secret.ttl`（gitignored）並由 `config.ttl` include。
+11. **客戶 NDA**：`docs/` 內含客戶 FPGA 規格與 schematic 衍生資訊，**本 repo 只推 NAS + Gitea，
+    絕不推 GitHub**。
+
+---
+
+## Security Considerations
+
+| 項目 | 做法 |
+|------|------|
+| **DUT console 帳密** | 集中在 `secret/config_secret.ttl`（gitignored），`config.ttl` 以 `include` 載入。repo 內只留 `secret/config_secret.ttl.example`，敏感欄位一律 `__CHANGE_ME__` |
+| **`secret/` 資料夾** | 本機 / 現場敏感資料集中地：DUT 帳密、per-unit BDF 覆寫、COM port 設定、客戶提供的未公開附件。`.gitignore` 用 `secret/*` + `!secret/README.md` + `!secret/*.example` + `!secret/.gitkeep`，**除 README 與 `.example` 外全部忽略** |
+| **客戶機密文件** | `docs/` 內 FPGA 規格（docx/xlsx/md）屬客戶 NDA 範圍；schematic 原始檔（`*.DSN`）一律 gitignore，不進 repo |
+| **Remote 限制** | 只推私有 remote：`nas`（`git.et-wen.com:51222`）+ `gitea`（`etgit.et-wen.com`）。**不設 GitHub `origin`** |
+| **測試 log** | `logs/*.log` 含 DUT 序號、MAC、韌體版本等可識別資訊 → gitignore，只保留目錄結構（`.gitkeep`） |
+| **破壞性硬體指令** | `margin_save` / `STORE_USER_ALL` 為永久 NVM 寫入，工具預設不呼叫；批次腳本 `margin_save_all.sh` 在 README 與腳本頂端都有警語 |
+| **root 權限** | 全流程在 `root@sonic:~#` 下執行（pcimem / i2c 需要）；腳本不留任何 `chmod 777` 或放寬權限的動作 |
+| **For_AI/** | AI 協作素材（截圖、草稿筆記）整個資料夾 gitignore，避免不小心把客戶圖面帶進 repo |
+
+---
+
+## Build & Setup Steps
+
+無編譯。從零到能跑一輪測試：
+
+```bash
+# ── 0. 取得專案（開發機 / 測試 NB）────────────────────────────
+git clone ssh://ETHouseNAS@git.et-wen.com:51222/volume1/git/Blanton_TTL_Script.git
+cd Blanton_TTL_Script
+
+# ── 1. 準備帳密（不進 git）──────────────────────────────────
+cp secret/config_secret.ttl.example secret/config_secret.ttl
+#   編輯 secret/config_secret.ttl，填入實際 DUT 帳密（取代 __CHANGE_ME__）
+
+# ── 2. DUT 端：部署 bash 工具庫 ─────────────────────────────
+scp -r src/Script_ABC_Blanton/Blanton_Script admin@<DUT_IP>:~/
+ssh admin@<DUT_IP> 'sudo -i'
+#   （現場無網路時改用 USB 隨身碟複製到 ~/Blanton_Script）
+
+# ── 3. DUT 端：確認 FPGA BDF（每台不同！）────────────────────
+lspci -Dnn | grep -i fpga           # 例：0000:03:00.0
+ls -d /sys/bus/pci/devices/0000:*:00.3
+#   若不是 0000:03:00.x，改 ~/Blanton_Script/blanton_fpga_pcimem.sh 的 FUNCT0..3_RES
+#   以及 src/Script_ABC_Blanton/utils/show_pcie_error_reg_*.ttl 內的 BDF
+
+# ── 4. DUT 端：煙霧測試（跑 Script A 之前先手動確認）──────────
+source ~/Blanton_Script/blanton_fpga_pcimem.sh
+cb_fpga 0 0xD90                     # RST_CAUSE_REG，讀得到值 = BAR 通了
+source ~/Blanton_Script/blanton_cb_i2c.sh
+cb_i2c_init 11 && cb_i2c_scan 11    # Ch11 風扇控制器，應看到 0x20
+source ~/Blanton_Script/LTC2980_Margin_Script/margin.sh
+margin_init Blanton_CB_CONN13 && margin_status
+```
+
+**Host（Windows）端：**
+
+```
+1. 安裝 Tera Term 5.x
+2. 把 src\Script_ABC_Blanton\ 整包複製到本機（路徑不要有空白與非 ASCII）
+3. 在該資料夾下建立 Logs\ 目錄（Script A 的 logopen 需要）
+4. Tera Term 連上 DUT COM port（預設 115200-8-N-1）
+5. Control → Macro → 選 1_Blanton_Script_A.ttl
+6. A 跑完出現 messagebox → 手動跑 2_Blanton_Script_B.ttl（soak）
+7. Soak 時間到 → 停止 B 的 macro → 跑 3_Blanton_Script_C.ttl
+8. 檢查 Logs\Blanton_Margin_<ts>.log
+```
+
+> 註：本專案非 .NET / Blazor / EC2 架構，`aws-ec2-deploy` 與 `vbox-run-deploy` 兩份部署指南不適用，已跳過。
+
+---
+
+## Development Phases
+
+現況基準：`docs/TTL_Script_Blanton_Status_20260814.xlsx` 已逐項標記 OK / On-Going，
+以下 Phase 直接把該表的 On-Going 項目排進來，並補上工程化（版控、密碼外移、打包）的缺口。
+
+### Phase 1 — 版控化 + 密碼外移（工作量：S）
+
+**目標：** 專案進 git（NAS + Gitea），帳密不再躺在腳本裡，任何人 clone 下來照文件就能跑。
+
+**包含：**
+- [ ] `git init` + `.gitignore`（`secret/*`、`For_AI/`、`logs/*.log`、`~$*`、`*.DSN`）
+- [ ] 建 `secret/README.md` + `secret/config_secret.ttl.example`（`__CHANGE_ME__` placeholder）
+- [ ] `config.ttl` 改為 `include "..\..\secret\config_secret.ttl"`（或現場放同層），
+      把 `1_Blanton_Script_A.ttl` 的 `sendln "YourPaSsWoRd"` 換成 `sendln dut_password`
+- [ ] `src/Script_ABC_Blanton/logs/.gitkeep`，既有 `Blanton_Margin_20260814-164122.log` 移出 repo
+- [ ] `CLAUDE.md` + `ARCHITECTURE.md` 進 repo，push `nas` + `gitea`（**不推 GitHub**）
+
+**驗收條件：** 在另一台機器 `git clone` → 填 `secret/config_secret.ttl` → Script A 能完整登入並產生 log；
+`git log -p` 中搜不到任何實際密碼。
+
+---
+
+### Phase 2 — Script A 補完：Check History + Margin 驗收（工作量：M）
+
+**目標：** Script A 的基線資料補齊到「開機原因 + 全部電壓軌」都有紀錄，Status 表的兩個 On-Going 轉 OK。
+
+**包含：**
+- [ ] 新增 `utils/show_reset_cause.ttl`：`cb_fpga 0 0xD90`（RST_CAUSE_REG）、
+      `cb_fpga 0 0xD94`（SWB0）、`cb_fpga 0 0xD98`（SWB1），並在註解貼上 bit 定義
+      （來源 `docs/Blantons_FPGA_Registers.md` §5 RST_CAUSE_REG）
+- [ ] Script A 的 `; ========== Check History ==========` 區塊改 include 上面這支
+- [ ] `utils/show_margin_status.ttl`：清掉已註解的 per-conf 舊寫法，只留
+      `margin_status_all.sh`；確認 9 顆 LTC2980 都能掃到（含 SWB 的 `TRANSPORT="swb"` 路徑）
+- [ ] 新增 `utils/show_pwr_data.ttl`（`pwr_data` + `pwr_data_pdb`）與
+      `utils/show_temp_sensor.ttl`（`temp_all`），把 `blanton_pwr_data.sh` /
+      `blanton_temp_sensor.sh` 真正接進流程（目前 Script A 只 source 沒用）
+- [ ] Script A 開頭加 BDF 自檢：`lspci -Dnn | grep -i fpga`，log 裡看得到本台的實際 BDF
+
+**驗收條件：** 跑一次 Script A，log 內同時含 reset cause 三個暫存器值、9 顆 LTC2980 × 16ch 的
+margin status、全部 VRM 軌的 Vin/Vout/Iout/Temp、CB + ICB 溫感讀值，且無 `ERR` / `NA` 以外的異常。
+
+---
+
+### Phase 3 — Script B 壓力層穩固化（工作量：M）
+
+**目標：** 壓力程序起得來、起不來看得出來，soak 迴圈有時戳、可控週期。
+
+**包含：**
+- [ ] 部署 `~/hammer/tools/` 前置檢查：新增 `utils/check_hammer_tools.ttl`
+      （`ls -l ~/hammer/tools/` + `ls ~/hammer/tools/amd/mlucas-avx2`），缺檔就別往下跑
+- [ ] 壓力程序 log 加時戳，避免多輪覆蓋：
+      `mlucas_amm_log` → `~/logs/mlucas_amm_log_$(date +%Y%m%d-%H%M%S).log`（Status 表 ScriptB #2 的既定寫法）
+- [ ] `jobs` 之後加驗證：期望 10 個背景 job（1 mlucas + 5 mem + hhmd/ssd/pcie/usb），
+      數量不符時 `messagebox` 提示
+- [ ] soak 迴圈改為「每輪先 `date`、跑完 `pause <間隔>`」，
+      把 `EN_LoopInterval`（預設 600 秒 = 10 min）放進 `config.ttl`，兌現 Status 表的「Get data every 10mins」
+- [ ] soak 每輪補 `show platform psustatus` / `voltage` / `current`（目前只有 fan + temperature）
+- [ ] 補 `; ========== CLEAR EVENT ==========`（Status 表 ScriptB #1，Owner: Alan）
+
+**驗收條件：** Script B 啟動後 `jobs` 顯示 10 個 job；連續跑 3 輪，log 內三段各自帶正確時戳且間隔 ≈10 min；
+故意把 `~/hammer` 改名，Script B 會在前置檢查就停下並提示。
+
+---
+
+### Phase 4 — Traffic 與 SONiC 介面資料（工作量：M）
+
+**目標：** 補齊 Status 表中 Owner=Alan 的三個 traffic 項目，讓測試涵蓋交換晶片的資料面。
+
+**包含：**
+- [ ] `utils/traffic_setup.ttl`：Blanton/SONiC 版的 port 起始設定與 counter 清零
+      （對照 Carlsbad 的 `clear int stat global`，改用 SONiC `sonic-clear counters`）
+- [ ] `utils/show_traffic_counters.ttl`：`show interface counters`、
+      `show interface counters errors`、`show interface status`
+- [ ] `utils/show_interface_detail.ttl`：`show interface transceiver eeprom/dom`、
+      `show interface link-training`（對照 Carlsbad `sho int transceiver detail`）
+- [ ] `utils/show_tech.ttl`：`show techsupport`（Script C 收工快照，Status 表 ScriptC #4）
+- [ ] Script A 的 TRAFFIC-SETUP-STAGE 與 Script C 的 CHECK Traffic counters 接上這些片段
+- [ ] `config.ttl` 加 `EN_Traffic` 旗標，未接線的站點可整段跳過
+
+**驗收條件：** `EN_Traffic=1` 時，Script A log 有清零後的 counter 基線、Script C log 有結束時的
+counter 與 error-counter，兩者可直接相減；`EN_Traffic=0` 時整段不執行且不報錯。
+
+---
+
+### Phase 5 — Log 解析與自動判定（工作量：L）
+
+**目標：** 不用人眼掃幾 MB 的 console log，跑完自動吐一張 PASS/FAIL 摘要。
+
+**包含：**
+- [ ] `tools/parse_blanton_log.py`：吃 `Logs/*.log`，切出 ScriptA / ScriptB / ScriptC 三段
+      （靠 `logwrite` 的 `#####` 分隔線）
+- [ ] AER / EDAC 差值計算：抽出 A 與 C 兩次的 `aer_dev_*` 與 `dimm_{ce,ue}_count`，輸出增量表，
+      UE > 0 或 fatal/nonfatal > 0 直接標 FAIL
+- [ ] Margin 表解析：把 9 顆 × 16ch 的 Vout / 偏差% 收成 CSV，標出超出 ±(profile 設定值 + 容差) 的軌
+- [ ] 溫度 / 風扇 / 電源趨勢：soak 期間逐輪取樣 → CSV（可直接畫圖）
+- [ ] Stress 判定：`mlucas_amm_log` 與 `log.stress_ssd` 的錯誤關鍵字掃描
+- [ ] 產出 `Logs/<run>_summary.md`：一頁 PASS/FAIL + 每個子系統一行結論
+
+**驗收條件：** 拿一份既有 log（如 `Blanton_Margin_20260814-164122.log`）跑解析器，
+產出 summary 與 CSV；人工植入一筆假的 `dimm_ue_count=1` 後，summary 正確翻成 FAIL。
+
+---
+
+### Phase 6 — 打包、Runbook 與交付（工作量：S）
+
+**目標：** 產出可直接交給現場測試員（或客戶）的一包，含操作手冊，不需要看原始碼。
+
+**包含：**
+- [ ] `tools/publish.sh`：把 `src/Script_ABC_Blanton/` + 空 `Logs/` + `secret/*.example`
+      打包成 `publish/Blanton_Script_ABC_v<ver>_<YYYYMMDD>/` 與同名 zip（比照
+      既有的 `Blanton_Script_ABC_v1.0_20251229` 命名）
+- [ ] `README.md`（現場用）：Tera Term 設定、A→B→C 操作順序、常見錯誤（BDF 不符、
+      margin 掃不到、hammer 工具缺檔）與對應處理
+- [ ] `CHANGELOG.md`：延續三支腳本頂端的 Version History，集中成一份
+- [ ] 三支腳本的 header 版號與 `CHANGELOG.md` 對齊，`config.ttl` 加 `script_version` 並寫進 log 開頭
+- [ ] `docs/TTL_Script_Blanton_Status_*.xlsx` 更新為全 OK，或把剩餘項目移進 Future Extensions
+- [ ] 打 git tag `v1.1.0`，push `nas` + `gitea`
+
+**驗收條件：** 從 zip 解壓到一台乾淨的測試 NB，照 README 操作，不看原始碼就能完成一輪 A→B→C
+並產出 summary；`publish/` 內容與 git tag 一致。
+
+---
+
+## Future Extensions
+
+- **Script B 的 eye measurement**：Status 表 ScriptB「Take one round of eye measurement on uplink ports」
+  目前是空區塊，待 TH6 SDK 的 eye scan 指令確認後補上。
+- **PDB 電源轉換值驗證**：`blanton_pwr_data.sh` 的 PDB 段落在第一台 DUT（COM39）因 ch4 仲裁問題無法驗證，
+  COM36 才拿到部分結果；`READ_VIN` 已知不是真的輸入電壓（跟隨 `READ_VOUT`）。待拿到 brick 的
+  `MFR_ID`/`MFR_MODEL` 後對照 datasheet 定案。
+- **`show_pcie_error_reg.ttl` 淘汰**：舊的合併版已被 7 支 per-device 版取代，確認無人引用後刪除。
+- **BDF 自動偵測**：把 `blanton_fpga_pcimem.sh` 註解中的 auto-detect 片段轉正，
+  用 `lspci -Dnn | grep -i fpga` 動態填 `FUNCT0..3_RES`，讓換 DUT 不用改檔。
+- **SSH / 網路模式**：目前全走 COM console。若 DUT 管理網路可用，可改用 `plink`/`ssh` 執行同一組
+  bash 工具，速度與可靠度都比 serial 好，TTL 只保留開機階段。
+- **多 DUT 併行**：多台 DUT 同時 soak 時，Tera Term 每台開一個 macro window；
+  可考慮改成 Python（`pyserial`）統一排程與集中收 log。
+- **與 `LTC2980_Margin_Script` 獨立 repo 的同步機制**：目前 `Blanton_Script/LTC2980_Margin_Script/`
+  是該 repo 的複本（少了 `ARCHITECTURE.md`/`CLAUDE.md`/`Reference/`，多了兩支 `blanton_*` 後端）。
+  待評估改用 git submodule 或明確的 vendored 同步腳本。
@@ -0,0 +1,110 @@
+# CLAUDE.md — Blanton TTL Script
+
+## 專案簡介
+
+Blanton（Project Helios）交換器平台的系統層可靠性測試自動化腳本組。
+Windows 端用 **Tera Term TTL macro** 透過 COM console 驅動 DUT 的 SONiC，
+A / B / C 三支腳本分別跑「基線 → 壓力 soak → 收工判定」，全程存 log。
+DUT 端的取數能力由一組 **bash 工具庫** 提供（CB FPGA `pcimem` → FPGA I2C/VI2C → VRM / 溫感 / LTC2980）。
+
+完整架構見 [ARCHITECTURE.md](ARCHITECTURE.md)。
+
+## 技術棧
+
+- **Host**：Tera Term 5.x TTL macro（`.ttl`），Windows
+- **DUT**：SONiC（Debian-based），bash + busybox/mawk，`root@sonic:~#`
+- **暫存器存取**：`pcimem`（mmap PCI sysfs `resource0` + BAR 相對 offset，一律 32-bit word）
+- **I2C/PMBus**：CB FPGA F3 I2C master（Ch0~Ch17，base 0x300 stride 0x20）、
+  CB F3 VI2C proxy → ICB/PDB（Ch0~Ch4，base 0x780）、CPU 原生 bus（`i2cset`/`i2cget`）
+- **Margin**：LTC2980（= 2 × LTC2977）over PMBus，LINEAR16
+- **判定資料源**：PCIe AER sysfs（`aer_dev_*`）、EDAC sysfs（`dimm_{ce,ue}_count`）、SONiC `show platform *`
+- **無編譯步驟**：TTL 與 bash 都直譯執行
+
+## 常用指令
+
+```bash
+# ── 部署 bash 工具庫到 DUT ──────────────────────────
+scp -r src/Script_ABC_Blanton/Blanton_Script admin@<DUT_IP>:~/
+
+# ── DUT 上先確認 FPGA BDF（每台不同！）───────────────
+lspci -Dnn | grep -i fpga
+ls -d /sys/bus/pci/devices/0000:*:00.3
+
+# ── DUT 上載入工具（Script A 也是做這五件事）─────────
+source ~/Blanton_Script/blanton_fpga_pcimem.sh
+source ~/Blanton_Script/blanton_cb_i2c.sh
+source ~/Blanton_Script/blanton_icb_vi2c.sh
+source ~/Blanton_Script/blanton_pwr_data.sh
+source ~/Blanton_Script/LTC2980_Margin_Script/margin.sh
+
+# ── 煙霧測試 ────────────────────────────────────────
+cb_fpga 0 0xD90                    # RST_CAUSE_REG，讀得到 = BAR 通了
+cb_i2c_init 11 && cb_i2c_scan 11   # Ch11 風扇控制器，應看到 0x20
+vi2c_scan_all                      # ICB/PDB 五個通道
+temp_all                           # CB + ICB 溫感
+pwr_data                           # SWB VRM 全軌
+margin_init Blanton_CB_CONN13 && margin_status
+
+# ── 各工具的 help ───────────────────────────────────
+blanton_fpga_help ; blanton_cb_i2c_help ; vi2c_help
+temp_sensor_help ; pwr_data_help
+```
+
+**Host 端跑一輪測試：**
+
+```
+Tera Term 連 COM port (115200-8-N-1)
+→ Control → Macro → 1_Blanton_Script_A.ttl   (基線，跑完出 messagebox)
+→ 手動跑 2_Blanton_Script_B.ttl              (壓力 soak，while 1 迴圈，泡到時間到停掉)
+→ 手動跑 3_Blanton_Script_C.ttl              (kill + 收工快照 + 判定)
+→ 檢查 Logs\Blanton_Margin_<ts>.log
+```
+
+## 開發慣例
+
+- **執行單位**：`src/Script_ABC_Blanton/` 整包給測試員（Tera Term 工作目錄）；
+  其中 `Blanton_Script/` 是 scp 到 DUT `~/` 的單位
+- **TTL 分層**：`config.ttl` 放設定 → 三支主腳本編排流程 → `utils/*.ttl` 是可 include 的無狀態片段
+  （只做 `wait prompt_sonic_root` + `sendln`，不設變數、不 logopen）
+- **新增取數項目** = 新增一支 `utils/show_xxx.ttl`，再在主腳本 `include`，不要往主腳本塞指令
+- **bash 命名**：公開函數 `cb_i2c_* / vi2c_* / temp_* / pwr_* / margin_*`，內部 helper 一律底線開頭
+  （`_cbi2c_* / _vr / _ts_* / _pwr_*`）
+- **版本紀錄**：每支 `.ttl` 與 `.sh` 檔頭都有 `Version History` 區塊，改動時**在檔頭補一行**
+  （`V1.0.2  YYYY-MM-DD  <做了什麼>`），不要只改版號
+- **Commit**：Conventional Commits，**英文**。scope 用 `ttl` / `fpga` / `i2c` / `vi2c` /
+  `margin` / `pwr` / `temp` / `docs`
+- **Status 表**：`docs/TTL_Script_Blanton_Status_*.xlsx` 是逐項進度的正本（OK / On-Going + Owner），
+  完成一項就同步更新，別讓文件跟腳本脫節
+
+## 注意事項
+
+- 🔒 **NDA：本 repo 只推 `nas` + `gitea`，絕不推 GitHub。** `docs/` 內含客戶 FPGA 規格。
+- 🔒 **DUT 帳密不進 git**。`1_Blanton_Script_A.ttl` 的 `sendln "YourPaSsWoRd"` 是 placeholder，
+  實際值放 `secret/config_secret.ttl`（gitignored）。**任何 commit 前先 grep 一次確認沒帶到真密碼。**
+- ⚠️ **PCIe BDF 是 per-unit 的**。`blanton_fpga_pcimem.sh` 的 `FUNCT0..3_RES` 已經改過三次
+  （04:00.x → 03:00.x → 05:00.x → 03:00.x）。換 DUT 一定先 `lspci -Dnn | grep -i fpga`，
+  `utils/show_pcie_error_reg_*.ttl` 內的 BDF 也要一起校。
+- ⚠️ **AER 判定看差值不看絕對值**：Script A 抓基線、Script C 抓結果，相減才是本輪錯誤。
+  **Endpoint 與上游 Root Port 兩邊都要讀**，錯誤可能只記在 RP。
+- ⚠️ **ICB/PDB 一律走 VI2C（`blanton_icb_vi2c.sh`），不要走 VSPI**：VSPI ~18 ms/reg 會讓 I2C
+  byte 相間隔拉到 ~50 ms，踩中 SMBus 25–35 ms timeout，裝置直接 NACK。實測全掃 9.4 s vs 34.0 s。
+- ⚠️ **I2C 讀一律 Repeated START**（不是 STOP + START），否則 PMBus/SMBus 裝置（VRM、EFUSE）不理。
+- ⚠️ **`margin_save` / `STORE_USER_ALL` 會永久寫 NVM**，斷電保留 → **測試流程中絕不執行**，
+  以免覆蓋客戶出廠 config。`margin.sh` 的 auto-enable（`ON_OFF_CONFIG=0x1a`）只改 RAM，斷電復原。
+- ⚠️ **改電壓會弄壞 DUT**：套 profile 前確認該軌 OV/UV limit，且 servo DAC 注入電阻有 populate
+  （本板部分 margin 電阻標 PROTO，沒 populate 的軌電壓不會動，不是腳本壞掉）。
+- ⚠️ **`ARB_LOST` ≠ 有裝置**：`vi2c_scan` 只看 `RX_ACK`，仲裁失敗會被誤報成裝置存在。
+  `blanton_pwr_data.sh` 已加 retry + plausibility window，**寧可印 `NA` 也不要印看起來像數據的錯值**。
+- ⚠️ **A → B → C 必須同一個 Tera Term session**：B 的背景 job 與 C 的 `kill $(jobs -p)` 綁在同一個
+  shell；log 也只有 A 會 `logopen`，B/C 是續寫。中途關掉 window 就得手動收程序、log 也斷了。
+- ⚠️ **MP29816 的 Vout 解析度不是固定值**，由 `MFR_VOUT_SCALE_LOOP(0x29)` bit[12:10] 決定，
+  `blanton_pwr_data.sh` 執行期從晶片讀；xlsx 上寫的 `/5mV` 與 MP2985B 的 `+49` offset **都是錯的**。
+
+## 資料夾說明
+
+- `src/Script_ABC_Blanton/` — 可執行內容（Tera Term 工作目錄；內含要 scp 到 DUT 的 `Blanton_Script/`）
+- `docs/` — 客戶 FPGA 規格、AER/EDAC 檢查依據、逐項 Status 表
+- `tools/` — Host 端輔助腳本（log 解析、報表產生、打包）
+- `publish/` — 交付用打包輸出（`Blanton_Script_ABC_v<ver>_<date>/` + zip）
+- `secret/` — 🚫 gitignored（除 `README.md` 與 `*.example`）：DUT 帳密、per-unit BDF 覆寫、COM 設定
+- `For_AI/` — 🚫 gitignored：AI 協作素材（波形截圖、草稿筆記）
@@ -0,0 +1,35 @@
+# secret/ — 本機 / 現場敏感資料
+
+這個資料夾集中放**不能進 git** 的東西：DUT console 帳密、per-unit 的 PCIe BDF 覆寫、
+COM port 設定、客戶提供但未公開的附件。
+
+## Committed vs Ignored
+
+`.gitignore` 規則是 `secret/*` 搭配 `!secret/README.md` / `!secret/*.example` / `!secret/.gitkeep`。
+
+| 檔案 | 狀態 | 說明 |
+|------|------|------|
+| `README.md` | ✅ committed | 本說明 |
+| `config_secret.ttl.example` | ✅ committed | 帳密範本，敏感欄位一律 `__CHANGE_ME__` |
+| `config_secret.ttl` | 🚫 ignored | **實際** DUT 帳密，由 `config.ttl` include |
+| `dut_bdf.ttl` / `*.local.*` | 🚫 ignored | per-unit 的 PCIe BDF / COM port 覆寫 |
+| `*.pem` / `*.key` / `*.env` | 🚫 ignored | 憑證、金鑰 |
+| 客戶未公開附件 | 🚫 ignored | schematic、內部 spec 草稿等 |
+
+## 第一次使用
+
+```bash
+cp secret/config_secret.ttl.example secret/config_secret.ttl
+#   編輯 secret/config_secret.ttl，把 __CHANGE_ME__ 換成實際帳密
+```
+
+Tera Term 端把整包 `src/Script_ABC_Blanton/` 複製到工作目錄時，**一併把
+`secret/config_secret.ttl` 放到 `src/Script_ABC_Blanton/` 同層**（`config.ttl` 以相對路徑 include）。
+現場機器上的那份不要再複製回 repo。
+
+## 鐵則
+
+- 🔒 **commit 前先 grep 一次**：`git grep -nE 'password|passwd|PaSsWoRd' -- . ':!secret'`
+  應該只找得到變數名與 placeholder，不該出現真值。
+- 🔒 `.example` 檔內敏感欄位一律寫 `__CHANGE_ME__`，不留 `your_password` 這種半吊子 placeholder。
+- 🔒 本 repo 含客戶 NDA 資料，**只推 `nas` + `gitea`，絕不推 GitHub**。
@@ -0,0 +1,24 @@
+; =============================================================================
+; config_secret.ttl.example  --  DUT credentials (NOT in git)
+; =============================================================================
+; Usage:
+;   1. cp secret/config_secret.ttl.example secret/config_secret.ttl
+;   2. Replace every __CHANGE_ME__ below with the real value.
+;   3. Put config_secret.ttl next to config.ttl in the Tera Term working dir.
+;
+; config.ttl includes this file; 1_Blanton_Script_A.ttl must use the variables
+; below instead of a literal password:
+;
+;       sendln dut_user
+;       wait "Password:"
+;       sendln dut_password
+;
+; NEVER commit the filled-in config_secret.ttl.
+; =============================================================================
+
+; --- SONiC console login ---
+dut_user     = "__CHANGE_ME__"
+dut_password = "__CHANGE_ME__"
+
+; --- Optional: root password, if 'sudo -i' prompts on this unit ---
+dut_root_password = "__CHANGE_ME__"
@@ -0,0 +1,95 @@
+; =============================================================================
+; Script A for Blanton
+; Version : V1.0.1
+; Date    : 2026-08-14
+; Author  : ETWen
+; =============================================================================
+; Version History:
+;   V1.0.0  2026-08-13  Initial Version
+;   V1.0.1  2026-08-14  Add CLEAR PCIE Error
+; =============================================================================
+include "config.ttl"
+
+flushrecv
+;================================================================
+; Log File Creation
+;================================================================
+gettime str_starttime "%Y%m%d-%H%M%S"
+getdir mdir
+
+if EN_log = 1 then
+    sprintf2 filename '%s\Logs\%s_%s_%s.log' mdir project_name strTestcase str_starttime
+    logopen filename 0 1 1 1
+endif
+
+; ========== Root Login ==========
+wait prompt_login
+sendln "admin"
+wait "Password:"
+sendln "YourPaSsWoRd"
+wait prompt_sonic
+sendln "sudo -i"
+
+; ========== Pre Setting ==========
+; Make log directory
+wait prompt_sonic_root
+sendln "mkdir ./logs"
+
+; Setting System Time
+getdate datestr
+gettime timestr
+sprintf2 cmd 'sudo date -s "%s %s"' datestr timestr
+sendln cmd
+
+; ========== Load Shell Script ==========
+wait prompt_sonic_root
+sendln "source ~/Blanton_Script/blanton_fpga_pcimem.sh"
+wait prompt_sonic_root
+sendln "source ~/Blanton_Script/blanton_cb_i2c.sh"
+wait prompt_sonic_root
+sendln "source ~/Blanton_Script/blanton_icb_vi2c.sh"
+wait prompt_sonic_root
+sendln "source ~/Blanton_Script/blanton_pwr_data.sh"
+wait prompt_sonic_root
+sendln "source ~/Blanton_Script/LTC2980_Margin_Script/margin.sh"
+
+; ========== CLEAR PCIE Error ==========
+include "utils/show_pcie_error_reg_TH6_SWB0.ttl"
+include "utils/show_pcie_error_reg_TH6_SWB1.ttl"
+include "utils/show_pcie_error_reg_FPGA.ttl"
+include "utils/show_pcie_error_reg_BMC.ttl"
+include "utils/show_pcie_error_reg_DDR.ttl"
+include "utils/show_pcie_error_reg_I210.ttl"
+include "utils/show_pcie_error_reg_SSD.ttl"
+
+
+; ========== Check PCIE tree + PCIE link status + GET PCIE bandwidth Test ==========
+include "utils/pcie_bus.ttl"
+
+; ========== Check History ==========
+    ;wait prompt_sonic_root
+    ;sendln "command"
+
+; ========== Check Margin ==========
+if EN_Margin = 1 then
+    include "utils/show_margin_status.ttl"
+endif
+
+; ========== Set and Read PMON Settings ==========
+include "utils/setup_pmon.ttl"
+
+; ========== TAKE DATA ==========
+include "utils/show_dmesg.ttl"
+wait prompt_sonic_root
+
+;include "utils/xxx.ttl"
+;wait prompt_sonic_root
+;flushrecv
+
+; ========== TRAFFIC-SETUP-STAGE ==========
+    ;sendln "command"
+
+
+sendln ""
+wait prompt_sonic_root
+messagebox 'Start Script B' 'Script A DONE'
@@ -0,0 +1,74 @@
+; =============================================================================
+; Script B for Blanton
+; Version : V1.0.1
+; Date    : 2026-08-14
+; Author  : ETWen
+; =============================================================================
+; Version History:
+;   V1.0.0  2026-08-13  Initial Version
+;   V1.0.1  2026-08-14  Add AMD CPU STRESS TEST
+; =============================================================================
+include "config.ttl"
+
+flushrecv
+logwrite ''#13#10
+logwrite '#####################################'#13#10
+logwrite 'ScriptB START'#13#10
+logwrite '#####################################'#13#10
+pause 1
+
+; ========== CLEAR EVENT ==========
+    ;wait prompt_sonic_root
+    ;sendln "command"
+    
+; ========== AMD CPU STRESS TEST ==========
+wait prompt_sonic_root
+sendln 'chmod +x ~/hammer/tools/amd/mlucas-avx2'
+wait prompt_sonic_root
+sendln "~/hammer/tools/amd/mlucas-avx2 -s l -cpu 0:15 > ~/hammer/tools/amd/mlucas_amm_log 2>&1 &"
+
+; ========== DDR MEMORY STRESS TEST ==========
+wait prompt_sonic_root
+sendln "python ~/hammer/tools/stress_mem.py &"
+wait prompt_sonic_root
+sendln "python ~/hammer/tools/stress_mem.py &"
+wait prompt_sonic_root
+sendln "python ~/hammer/tools/stress_mem.py &"
+wait prompt_sonic_root
+sendln "python ~/hammer/tools/stress_mem.py &"
+wait prompt_sonic_root
+sendln "python ~/hammer/tools/stress_mem.py &"
+
+; ========== I2C, LSB and PCIE read with unlimited loop ==========
+wait prompt_sonic_root
+sendln "python ~/hammer/tools/stress_hhmd.py &"
+
+; ========== SSD read/write ==========
+wait prompt_sonic_root
+sendln "python ~/hammer/tools/stress_ssd.py &"
+
+; ========== PCIe CPU <- PCIe -> ASIC by dumping portStatus ==========
+wait prompt_sonic_root
+sendln "python ~/hammer/tools/stress_pcie.py &"
+
+; ========== USB read/write ==========
+wait prompt_sonic_root
+sendln "python ~/hammer/tools/stress_usb.py &"
+
+; ========== SHOW Background job ==========
+wait prompt_sonic_root
+sendln "jobs"
+
+; ========== Take one round of eye measurement on uplink ports ==========
+
+; ========== Get data every 10mins ==========
+while 1
+    wait prompt_sonic_root
+    sendln "show platform fan"
+    wait prompt_sonic_root
+    sendln "show platform temperature"
+    ; ========== Check Margin ==========
+    if EN_Margin = 1 then
+        include "utils/show_margin_status.ttl"
+    endif
+endwhile
@@ -0,0 +1,46 @@
+; =============================================================================
+; Script B for Blanton
+; Version : V1.0.1
+; Date    : 2026-08-14
+; Author  : ETWen
+; =============================================================================
+; Version History:
+;   V1.0.0  2026-08-13  Initial Version
+;   V1.0.1  2026-08-14  Add Check PCIE error counters,CHECK Stress results
+; =============================================================================
+include "config.ttl"
+
+flushrecv
+logwrite ''#13#10
+logwrite '#####################################'#13#10
+logwrite 'ScriptC START'#13#10
+logwrite '#####################################'#13#10
+pause 1
+
+; ========== Kill Process ==========
+include "utils/kill_all_process.ttl"
+; ========== TAKE DATA ==========
+include "utils/setup_pmon.ttl"
+include "utils/show_dmesg.ttl"
+
+; ========== Check PCIE error counters ==========
+include "utils/show_pcie_error_reg_TH6_SWB0.ttl"
+include "utils/show_pcie_error_reg_TH6_SWB1.ttl"
+include "utils/show_pcie_error_reg_FPGA.ttl"
+include "utils/show_pcie_error_reg_BMC.ttl"
+include "utils/show_pcie_error_reg_DDR.ttl"
+include "utils/show_pcie_error_reg_I210.ttl"
+include "utils/show_pcie_error_reg_SSD.ttl"
+
+; ========== CHECK Stress results ==========
+wait prompt_sonic_root
+sendln "cat ~/hammer/tools/amd/mlucas_amm_log"
+wait prompt_sonic_root
+sendln "cat ~/hammer/tools/log.stress_ssd"
+
+; ========== CHECK Traffic counters ==========
+    ;wait prompt_sonic_root
+    ;sendln "command"
+
+
+messagebox 'GOOD JOB! Test Case DONE' 'teraterm'
@@ -0,0 +1,184 @@
+# LTC2980 Margin Script
+
+透過 PMBus (`i2cset` / `i2cget`) 控制 LTC2980 多通道電壓 Margin 測試工具。
+**一個 `.conf` = 一顆 LTC2980**（= 2 × LTC2977，每 address 8 channel，共 CH0~CH15）。
+
+## Key Features
+
+| 函數 | 說明 |
+|------|------|
+| `margin_init <NAME>` | source `settings/<NAME>.conf` 載入該顆 LTC2980 的設定 |
+| `margin_status [ch]` | 讀取 CH0~CH15 全部或指定 channel 的 Vout + 偏差% |
+| `margin_set <ch> <op> <change>` | 三合一：寫值 + 切 operation + 讀回驗證 |
+| `margin_set_value <ch> <vnom> <change>` | 只寫 HIGH/LOW/OV/UV 暫存器 |
+| `margin_operation <ch> <op>` | 只切 OPERATION register |
+| `margin_apply_profile <file>` | 批次套用 profile（套用在當前載入的 LTC2980） |
+| `margin_save` | 寫入 NVM（當前 LTC2980 的兩個 LTC2977 都寫） |
+| `margin_debug [on\|off]` | 開關 debug 模式（不帶參數則 toggle） |
+| `margin_log [on\|off]` | 開關 log 記錄（不帶參數則 toggle，預設開啟） |
+
+## Setup Steps
+
+```bash
+# 1. 將此資料夾 scp 到目標 Linux 環境
+scp -r LTC2980_Margin_Script user@target:/path/to/
+
+# 2. SSH 進入目標機器
+ssh user@target
+
+# 3. 載入工具
+cd ./LTC2980_Margin_Script
+source margin.sh
+
+# 4. 初始化（指定要操作的 LTC2980）
+margin_init Blanton_CB_CONN13
+```
+
+## 可用 settings
+
+| .conf 名稱 | 對應板/接頭 |
+|------------|-------------|
+| `Blanton_CB_CONN13` | CB 板 CONN13 |
+| `Blanton_SWB0_CONN13` | SWB0 板 CONN13 |
+| `Blanton_SWB0_CONN14` | SWB0 板 CONN14 |
+| `Blanton_SWB0_CONN15` | SWB0 板 CONN15 |
+| `Blanton_SWB0_CONN16` | SWB0 板 CONN16 |
+| `Blanton_SWB1_CONN13` | SWB1 板 CONN13 |
+| `Blanton_SWB1_CONN14` | SWB1 板 CONN14 |
+| `Blanton_SWB1_CONN15` | SWB1 板 CONN15 |
+| `Blanton_SWB1_CONN16` | SWB1 板 CONN16 |
+
+## 使用範例
+
+```bash
+# 載入某顆 LTC2980
+margin_init Blanton_SWB0_CONN14
+
+# 查看所有 channel 狀態（0~15）
+margin_status
+
+# 查看單一 channel
+margin_status 3
+
+# 設定 margin（寫值 + 切 operation + 讀回驗證）
+margin_set 0 high 8        # ch0 margin high 8%
+margin_set 5 low 5         # ch5 margin low 5%
+margin_set 3 nominal 8     # ch3 回標稱值
+
+# 只切 operation（不改 margin 值）
+margin_operation 0 high
+margin_operation 0 nominal
+
+# 批次套用 profile（套在當前載入的 LTC2980）
+margin_apply_profile profiles/comboA.conf
+margin_apply_profile profiles/comboB.conf
+margin_apply_profile profiles/all_off.conf
+
+# 切換到另一顆 LTC2980
+margin_init Blanton_SWB1_CONN16
+margin_apply_profile profiles/comboA.conf
+
+# 儲存到 NVM（斷電後保留）
+margin_save
+```
+
+## 一次掃所有 LTC2980
+
+`script/margin_status_all.sh` 依序對多顆 LTC2980 跑 `margin_init` + `margin_status`，
+讀完一顆切下一顆。
+
+```bash
+source script/margin_status_all.sh
+```
+
+要改掃描範圍，編 script 頂端的 `BOARDS` 陣列即可：
+
+```bash
+BOARDS=(
+    "Blanton_CB_CONN13"
+    "Blanton_SWB0_CONN13"
+    # ... 註解掉或刪掉不想跑的那行
+)
+```
+
+## 一次套 profile 到所有 LTC2980
+
+`script/margin_apply_profile_all.sh` 對多顆 LTC2980 依 `BOARDS[i]` 配對
+`PROFILES[i]` 套用 profile（預設全部 `comboA`）。
+
+```bash
+source script/margin_apply_profile_all.sh
+```
+
+編 script 頂端兩個陣列換不同 profile 給不同板：
+
+```bash
+BOARDS=(
+    "Blanton_CB_CONN13"
+    "Blanton_SWB0_CONN13"
+    ...
+)
+
+PROFILES=(
+    "comboA"    # Blanton_CB_CONN13
+    "comboB"    # Blanton_SWB0_CONN13   ← 改成 comboB
+    ...
+)
+```
+
+`PROFILES` 寫名字即可（不含路徑跟 `.conf`），script 會自動展開成
+`profiles/<name>.conf`。兩個陣列長度不一致會直接報錯。
+
+## 一次把所有 LTC2980 寫入 NVM
+
+`script/margin_save_all.sh` 對 `BOARDS` 列出的每顆 LTC2980 跑 `margin_save`。
+
+> ⚠️  `margin_save` 會把當前 margin / OV / UV 設定**永久寫入 NVM**，
+> 斷電後保留。執行前先用 `margin_status_all.sh` 確認狀態正確。
+
+```bash
+source script/margin_save_all.sh
+```
+
+要改寫哪幾顆，編 script 頂端的 `BOARDS` 陣列即可（同前述）。
+
+## Operation 對應
+
+| 參數 | PMBus 0x01 值 | 說明 |
+|------|---------------|------|
+| `high` | 0xA8 | Margin high |
+| `low` | 0x98 | Margin low |
+| `nominal` | 0x80 | 回到標稱值 |
+| `off` | 0x00 | 關閉輸出 |
+
+## Channel 編號規則
+
+每個 .conf 內 channel 編號 0~15（per LTC2980 本地化）：
+
+- `ch / 8` → CHIPS 陣列索引（0=低位 LTC2977 address，1=高位 LTC2977 address）
+- `ch % 8` → LTC2977 page（0x00~0x07）
+
+## 設定檔
+
+- `settings/*.conf` — 一顆 LTC2980 的 channel 定義（Vnom、Net、I2C address × 2、PRE/POST cmd）
+- `profiles/*.conf` — 通用 16-ch 批次操作組合
+- `script/*.sh` — 多顆 LTC2980 批次操作（如 `margin_status_all.sh`）
+- `logs/` — 操作 log，`source margin.sh` 時自動建立：主 log（摘要）+ detail log（完整輸出）。主 log 帶 `(detail Line:N)` 可跳轉
+- `margin_debug on` / `margin_debug off` / `margin_debug`（toggle）— 開關 debug 模式，印出所有 i2c 指令
+- `margin_log on` / `margin_log off` / `margin_log`（toggle）— 開關 log 記錄（預設開啟）
+- `margin_init` 支援 TAB 補全，自動列出 `settings/` 中可用的 .conf 名稱
+
+## PRE/POST 執行時機
+
+`CHIP_PRE_CMD[0]` / `CHIP_POST_CMD[0]`（mux 切換等指令）由 `_pre_enter_own` /
+`_pre_exit` 在**每個 public 函數的最外層**各跑一次：
+
+```
+margin_status:               margin_apply_profile:
+  [PRE] (一次)                  [PRE] (一次)
+  CH0~CH15 i2c ops             margin_set CH0, CH1, ... (各自不再 PRE)
+  [POST] (一次)                 [POST] (一次)
+```
+
+巢狀呼叫（`margin_apply_profile → margin_set → margin_set_value/operation/read_vout`）
+透過全域旗標 `_PRE_SCOPE` 判斷是否已在 scope 內，內層直接跳過 PRE/POST。
@@ -0,0 +1,444 @@
+#!/usr/bin/env bash
+# =============================================================================
+# blanton_cb_i2c.sh  --  CB FPGA (F3) I2C / PMBus over the OpenCores I2C master
+# =============================================================================
+# Version History:
+#   V0.1.0  2026-06-16  CB sibling of blanton_icb_i2c.sh. Same OpenCores I2C
+#                       handshake, but the I2C block lives in CB FPGA *Function 3*
+#                       register space (base 0x300, stride 0x20, Ch0..Ch17), and
+#                       is reached via cb_fpga 3 <off> (direct PCIe BAR -> .3/resource0).
+# =============================================================================
+#
+# IMPORTANT (vs the hand-written cb_fpga.md pcimem commands):
+#   * The CB I2C channels are on PCI **Function 3**, so the sysfs file is
+#     .../0000:02:00.3/resource0  (NOT .0). cb_fpga 3 uses FUNCT3_RES for this.
+#   * This tool uses **Repeated START** for reads (write reg pointer with WR only,
+#     no STOP, then Sr + slave|R) so it works for the SMBus/PMBus parts (VRM,
+#     EFUSE) as well as plain register parts. STOP+START only works for the latter.
+#   * Slave addresses are 7-bit here. The spec lists 8-bit pairs (e.g. MAX31790
+#     "0x40/0x41" -> 7-bit 0x20; TCA9546 "0xE8/0xE9" -> 7-bit 0x74). Divide by 2.
+#
+# CB FPGA F3 I2C channels (base 0x300, stride 0x20) -- 7-bit addrs in (...):
+#   Ch0  0x300  SWB_0: TCA9546 mux (0x74), M0.C0 temp sensor, ...
+#   Ch1  0x320  SWB_1: TCA9546 mux (0x74), ...
+#   Ch2  0x340  SWB_0: SWB_FPGA (0x40), IO Exp PCA9555 (0x24), ...
+#   Ch3  0x360  SWB_1: SWB_FPGA (0x40), PCA9555 (0x24), ...
+#   Ch4  0x380  SWB_0: M1 TCA9546 mux (0x74), Clk Gen SI5..., ...
+#   Ch5  0x3A0  SWB_1: M1 TCA9546 mux (0x74), ...
+#   Ch6  0x3C0  SWB_0: VRM M29816 (0x20), VRM M2985B (0x21), ...   [PMBus]
+#   Ch7  0x3E0  SWB_1: VRM M29816 (0x20), VRM M2985B (0x21), ...   [PMBus]
+#   Ch8  0x400  SWB_0: VRM M2985B (0x25), M2985B (0x26), ...       [PMBus]
+#   Ch9  0x420  SWB_1: VRM M2985B (0x25), M2985B (0x26), ...       [PMBus]
+#   Ch10 0x440  M0 TCA9543 mux (0x70), M0.C0 Clk Buf 9DBL0452, ...
+#   Ch11 0x460  Fan Ctrl MAX31790 (0x20)
+#   Ch12 0x480  ADC leakage ADC128D818 (0x1F)
+#   Ch13 0x4A0  NFC SM-MFAD4-C02 (0x28)
+#   Ch14 0x4C0  M1 TCA9543 mux (0x70), M1.C0 QSFP28.P1 xcvr, ...
+#   Ch15 0x4E0  Fan1/2 EFUSE STEF48H28 (0x10/0x11), ...           [PMBus-ish]
+#   Ch16 0x500  1G PHY I210 Ethernet ctrlr (0x49)
+#   Ch17 0x520  Chassis EEPROM (0x28..0x29), Diag EEPROM (0x2B), ...
+#   (slave 7-bit addrs derived from the 8-bit pairs in the register map; verify
+#    against the device datasheet / your board before driving writes.)
+#
+# Per-channel register layout (offset from channel base):
+#   +0x00 I2C_PRSCL_LO  +0x04 I2C_PRSCL_HI  +0x08 I2C_CTRL (bit7 MOD_EN)
+#   +0x0C I2C_TX(W)/I2C_RX(R)               +0x10 I2C_CMD(W)/I2C_STAT(R)
+#   +0x14 I2C_MUX_SEL   +0x18 I2C_RST (0xD) +0x1C SEM
+# CMD : STA=0x80 STO=0x40 RD=0x20 WR=0x10 ACK=0x08(1=NACK) IACK=0x01
+# STAT: RX_ACK=0x80(1=NACK) BUSY=0x40 ARB_LOST=0x20 TIP=0x02 INT_FLAG=0x01
+# Prescale = (in_clk/(5*scl))-1 @75MHz: 0x88=100kHz, 0x24=400kHz
+#
+# Usage:
+#   source blanton_fpga_pcimem.sh      # provides cb_fpga / fpga_debug
+#   source blanton_cb_i2c.sh
+#   cb_i2c_init 11                     # Ch11 (Fan Ctrl) @100kHz
+#   cb_i2c_scan 11
+#   cb_i2c_read  11 0x20 0x01 1        # MAX31790 (7-bit 0x20) reg 0x01
+#   cb_pmbus_read 6 0x20 0x8B 2        # Ch6 VRM READ_VOUT
+# =============================================================================
+
+# --- Pull in the register-access backend (cb_fpga) if not present -----------
+if ! declare -F cb_fpga >/dev/null 2>&1; then
+    _CBI2C_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
+    if [ -n "$_CBI2C_DIR" ] && [ -f "$_CBI2C_DIR/blanton_fpga_pcimem.sh" ]; then
+        # shellcheck source=/dev/null
+        source "$_CBI2C_DIR/blanton_fpga_pcimem.sh"
+    else
+        echo -e "[\033[33mWARN\033[0m] blanton_cb_i2c.sh: cb_fpga() not found." >&2
+        echo    "       source blanton_fpga_pcimem.sh first (provides cb_fpga)." >&2
+    fi
+fi
+
+# === CB I2C geometry =========================================================
+CBI2C_FN=3                 # CB PCI Function hosting the I2C block
+CBI2C_BASE=0x300           # channel 0 base offset (relative to F3 resource0)
+CBI2C_CH_STRIDE=0x20
+CBI2C_CH_MAX=17
+
+# Per-channel register offsets
+_CBI2C_PRSCL_LO=0x00
+_CBI2C_PRSCL_HI=0x04
+_CBI2C_CTRL=0x08
+_CBI2C_TX=0x0C
+_CBI2C_RX=0x0C
+_CBI2C_CMD=0x10
+_CBI2C_STAT=0x10
+_CBI2C_MUX_SEL=0x14
+_CBI2C_RST=0x18
+_CBI2C_SEM=0x1C
+
+# I2C_CTRL_REG / CMD / STAT bits
+_CBI2C_EN=0x80
+_CBI2C_STA=0x80
+_CBI2C_STO=0x40
+_CBI2C_RD=0x20
+_CBI2C_WR=0x10
+_CBI2C_NACK=0x08
+_CBI2C_RXACK=0x80
+_CBI2C_TIP=0x02
+_CBI2C_RST_VAL=0xD
+
+# Defaults
+CB_I2C_PRESCALE_LO="${CB_I2C_PRESCALE_LO:-0x88}"   # 100 kHz @ 75 MHz
+CB_I2C_PRESCALE_HI="${CB_I2C_PRESCALE_HI:-0x00}"
+CB_I2C_AUTO_INIT="${CB_I2C_AUTO_INIT:-1}"
+CB_I2C_TIP_POLL_MAX="${CB_I2C_TIP_POLL_MAX:-100}"
+
+# --- External I2C-mux RESET control (verified on COM34, 2026-06-16) ----------
+# The TCA9543 muxes on CH10 (M0) and CH14 (M1) have an FPGA-driven, active-low
+# RESET line. On power-up / FPGA reload the FPGA holds them in reset, so 0x70
+# does NOT ACK on the root bus and all downstream legs are unreachable.
+#
+# The control is a GLOBAL register in CB FPGA *Function 0*, offset 0x7D4
+# (I2C_MUX_RST_REG) -- NOT the per-channel I2C_MUX_SEL_REG (+0x14) which is a
+# device-select and does nothing to the RESET pin. Per bit: 1 = release,
+# 0 = hold-in-reset. Observed default 0xDD (bit1=CH10 mux, bit5=CH14 mux held).
+# Writing 0xFF releases all external muxes (normal operating state). This value
+# is volatile and is lost on the next power cycle / FPGA reload.
+CBI2C_MUX_RST_FN="${CBI2C_MUX_RST_FN:-0}"
+CBI2C_MUX_RST_OFF="${CBI2C_MUX_RST_OFF:-0x7D4}"
+
+# Channels whose root bus carries an external mux that hangs off the RESET reg.
+# CH10/CH14 = TCA9543; CH0/1/4/5 = TCA9546 (SWB/M1) per the channel map above.
+CBI2C_MUX_CHANNELS="${CBI2C_MUX_CHANNELS:-0 1 4 5 10 14}"
+
+# Auto-release external mux RESET before scanning / mux-writing a mux channel.
+CB_I2C_AUTO_MUX_RST="${CB_I2C_AUTO_MUX_RST:-1}"
+
+# --- Single FPGA register read/write via cb_fpga <fn> <off> [data] ----------
+# _cbi2c_reg <abs_offset> [data]   data present = write, absent = read (echo hex)
+_cbi2c_reg() {
+    local off="$1" data="${2:-}"
+    if [ -n "$data" ]; then cb_fpga "$CBI2C_FN" "$off" "$data"; else cb_fpga "$CBI2C_FN" "$off"; fi
+}
+
+# Channel base absolute offset
+_cbi2c_chan_base() {
+    local ch="$1"
+    if (( ch < 0 || ch > CBI2C_CH_MAX )); then
+        echo "blanton_cb_i2c: ch must be 0..$CBI2C_CH_MAX" >&2; return 1
+    fi
+    printf '0x%X' $(( CBI2C_BASE + ch * CBI2C_CH_STRIDE ))
+}
+
+# Normalize a register read-back to a number string ("0x...." -> 0x....)
+_cbi2c_num() { local v="$1"; [[ "$v" =~ (0[xX][0-9a-fA-F]+) ]] && echo "${BASH_REMATCH[1]}" || echo "0"; }
+
+# Write CMD then poll STAT (same offset) until TIP clears; echo final status hex
+_cbi2c_cmd_wait() {
+    local cmd_off="$1" cmd_val="$2" i status
+    _cbi2c_reg "$cmd_off" "$cmd_val" >/dev/null
+    for (( i=0; i<CB_I2C_TIP_POLL_MAX; i++ )); do
+        status=$(_cbi2c_num "$(_cbi2c_reg "$cmd_off")")
+        if (( (status & _CBI2C_TIP) == 0 )); then
+            printf '0x%X' "$status"; return 0
+        fi
+    done
+    echo -e "[\033[31mERR\033[0m] CB I2C TIP timeout (status=$status)" >&2
+    printf '0x%X' "${status:-0}"; return 1
+}
+
+# Check RX_ACK in status (bit7). 0 = ACK, 1 = NACK -> return 1
+_cbi2c_check_ack() {
+    local status; status=$(_cbi2c_num "$1")
+    (( (status & _CBI2C_RXACK) != 0 )) && return 1 || return 0
+}
+
+# === Public: init / reset / semaphore / mux-sel =============================
+
+# cb_i2c_init <ch> [prescale_lo] [prescale_hi]
+cb_i2c_init() {
+    [[ $# -lt 1 ]] && { echo "Usage: cb_i2c_init <ch> [prescale_lo] [prescale_hi]"; return 1; }
+    local ch="$1" lo="${2:-$CB_I2C_PRESCALE_LO}" hi="${3:-$CB_I2C_PRESCALE_HI}" base
+    base=$(_cbi2c_chan_base "$ch") || return 1
+    _cbi2c_reg "$(printf '0x%X' $((base + _CBI2C_CTRL)))"     0x00  >/dev/null  # disable
+    _cbi2c_reg "$(printf '0x%X' $((base + _CBI2C_PRSCL_LO)))" "$lo" >/dev/null
+    _cbi2c_reg "$(printf '0x%X' $((base + _CBI2C_PRSCL_HI)))" "$hi" >/dev/null
+    _cbi2c_reg "$(printf '0x%X' $((base + _CBI2C_CTRL)))"     "$_CBI2C_EN" >/dev/null # enable
+    return 0
+}
+
+# cb_i2c_reset <ch>
+cb_i2c_reset() {
+    [[ $# -lt 1 ]] && { echo "Usage: cb_i2c_reset <ch>"; return 1; }
+    local ch="$1" base; base=$(_cbi2c_chan_base "$ch") || return 1
+    _cbi2c_reg "$(printf '0x%X' $((base + _CBI2C_RST)))" "$_CBI2C_RST_VAL" >/dev/null
+    echo "  [RST] ch=$ch local I2C controller reset (0xD)"
+}
+
+# cb_i2c_sem <ch> [status|acquire [val]|release]
+cb_i2c_sem() {
+    [[ $# -lt 1 ]] && { echo "Usage: cb_i2c_sem <ch> [status|acquire [val]|release]"; return 1; }
+    local ch="$1" act="${2:-status}" base off cur
+    base=$(_cbi2c_chan_base "$ch") || return 1
+    off=$(printf '0x%X' $((base + _CBI2C_SEM)))
+    case "$act" in
+        status)
+            cur=$(_cbi2c_num "$(_cbi2c_reg "$off")")
+            (( (cur & 0xFF) == 0 )) && echo "  [SEM] ch=$ch free (0x00)" \
+                                    || printf '  [SEM] ch=%s held (0x%02X)\n' "$ch" $((cur & 0xFF)) ;;
+        acquire)
+            local val="${3:-0x01}"
+            cur=$(_cbi2c_num "$(_cbi2c_reg "$off")")
+            if (( (cur & 0xFF) != 0 )); then
+                printf '  [SEM] ch=%s already held (0x%02X) -- not acquired\n' "$ch" $((cur & 0xFF)); return 1
+            fi
+            _cbi2c_reg "$off" "$val" >/dev/null
+            cur=$(_cbi2c_num "$(_cbi2c_reg "$off")")
+            (( (cur & 0xFF) != 0 )) && printf '  [SEM] ch=%s acquired (0x%02X)\n' "$ch" $((cur & 0xFF)) \
+                                    || { echo "  [SEM] ch=$ch acquire failed"; return 1; } ;;
+        release)
+            _cbi2c_reg "$off" 0x00 >/dev/null; echo "  [SEM] ch=$ch released (0x00)" ;;
+        *) echo "Usage: cb_i2c_sem <ch> [status|acquire [val]|release]"; return 1 ;;
+    esac
+}
+
+# cb_i2c_muxsel <ch> <dev_sel>  -- write I2C_MUX_SEL_REG (FPGA drives ext mux pins)
+cb_i2c_muxsel() {
+    [[ $# -lt 2 ]] && { echo "Usage: cb_i2c_muxsel <ch> <dev_sel>"; return 1; }
+    local ch="$1" sel="$2" base; base=$(_cbi2c_chan_base "$ch") || return 1
+    _cbi2c_reg "$(printf '0x%X' $((base + _CBI2C_MUX_SEL)))" "$sel" >/dev/null
+    printf '  [MUXSEL] ch=%s DEV_SEL <= 0x%02X\n' "$ch" $((sel & 0xFF))
+}
+
+# cb_i2c_mux_reset_release  -- de-assert ALL external mux RESET lines (F0 0x7D4 <= 0xFF)
+# Global, not per-channel. Volatile: lost on power cycle / FPGA reload.
+cb_i2c_mux_reset_release() {
+    cb_fpga "$CBI2C_MUX_RST_FN" "$CBI2C_MUX_RST_OFF" 0xFF >/dev/null
+    local rb; rb=$(_cbi2c_num "$(cb_fpga "$CBI2C_MUX_RST_FN" "$CBI2C_MUX_RST_OFF")")
+    printf '  [MUX-RST] I2C_MUX_RST_REG (F%s %s) <= 0xFF (all external muxes released, readback %s)\n' \
+        "$CBI2C_MUX_RST_FN" "$CBI2C_MUX_RST_OFF" "$rb"
+}
+
+# _cbi2c_is_mux_channel <ch>  -- 0 (true) if ch is in CBI2C_MUX_CHANNELS
+_cbi2c_is_mux_channel() {
+    local ch="$1" c
+    for c in $CBI2C_MUX_CHANNELS; do [[ "$c" == "$ch" ]] && return 0; done
+    return 1
+}
+
+# _cbi2c_auto_mux_rst <ch>  -- release external mux RESET if ch is a mux channel
+_cbi2c_auto_mux_rst() {
+    [[ "$CB_I2C_AUTO_MUX_RST" == "1" ]] || return 0
+    _cbi2c_is_mux_channel "$1" || return 0
+    cb_i2c_mux_reset_release
+}
+
+# === Core transfers (Repeated START, SMBus/PMBus compatible) =================
+
+# _cbi2c_xfer_read <ch> <slave7> <reg> <nbytes>   echoes space-separated hex bytes
+_cbi2c_xfer_read() {
+    local ch="$1" slave="$2" reg="$3" n="$4" base tx cmd rx status i last cmdv val out=""
+    base=$(_cbi2c_chan_base "$ch") || return 1
+    tx=$(printf '0x%X' $((base + _CBI2C_TX)))
+    cmd=$(printf '0x%X' $((base + _CBI2C_CMD)))
+    rx=$(printf '0x%X' $((base + _CBI2C_RX)))
+    [[ "$CB_I2C_AUTO_INIT" == "1" ]] && cb_i2c_init "$ch" >/dev/null
+
+    _cbi2c_reg "$tx" "$(printf '0x%X' $(( (slave << 1) & 0xFF )))" >/dev/null
+    status=$(_cbi2c_cmd_wait "$cmd" "$(printf '0x%X' $((_CBI2C_STA | _CBI2C_WR)))")
+    _cbi2c_check_ack "$status" || { echo "ERR: NACK on slave addr (W) 0x$(printf %02X "$slave")" >&2; return 1; }
+
+    _cbi2c_reg "$tx" "$(printf '0x%X' $((reg & 0xFF)))" >/dev/null
+    status=$(_cbi2c_cmd_wait "$cmd" "$(printf '0x%X' $((_CBI2C_WR)))")    # WR only, no STOP
+    _cbi2c_check_ack "$status" || { echo "ERR: NACK on reg 0x$(printf %02X "$reg")" >&2; return 1; }
+
+    _cbi2c_reg "$tx" "$(printf '0x%X' $(( ((slave << 1) | 1) & 0xFF )))" >/dev/null
+    status=$(_cbi2c_cmd_wait "$cmd" "$(printf '0x%X' $((_CBI2C_STA | _CBI2C_WR)))")   # Repeated START
+    _cbi2c_check_ack "$status" || { echo "ERR: NACK on slave addr (R) 0x$(printf %02X "$slave")" >&2; return 1; }
+
+    for (( i=0; i<n; i++ )); do
+        last=$(( i == n-1 ))
+        if (( last )); then cmdv=$(( _CBI2C_RD | _CBI2C_NACK | _CBI2C_STO )); else cmdv=$(( _CBI2C_RD )); fi
+        _cbi2c_cmd_wait "$cmd" "$(printf '0x%X' "$cmdv")" >/dev/null
+        val=$(_cbi2c_num "$(_cbi2c_reg "$rx")")
+        out+="$(printf '0x%02X ' $((val & 0xFF)))"
+    done
+    echo "${out% }"
+}
+
+# _cbi2c_xfer_write <ch> <slave7> <reg> <byte> [byte...]
+_cbi2c_xfer_write() {
+    local ch="$1" slave="$2" reg="$3"; shift 3
+    local base tx cmd status b last cmdv n=$# idx=0
+    [[ $n -lt 1 ]] && { echo "ERR: no data bytes" >&2; return 1; }
+    base=$(_cbi2c_chan_base "$ch") || return 1
+    tx=$(printf '0x%X' $((base + _CBI2C_TX)))
+    cmd=$(printf '0x%X' $((base + _CBI2C_CMD)))
+    [[ "$CB_I2C_AUTO_INIT" == "1" ]] && cb_i2c_init "$ch" >/dev/null
+
+    _cbi2c_reg "$tx" "$(printf '0x%X' $(( (slave << 1) & 0xFF )))" >/dev/null
+    status=$(_cbi2c_cmd_wait "$cmd" "$(printf '0x%X' $((_CBI2C_STA | _CBI2C_WR)))")
+    _cbi2c_check_ack "$status" || { echo "ERR: NACK on slave addr (W) 0x$(printf %02X "$slave")" >&2; return 1; }
+
+    _cbi2c_reg "$tx" "$(printf '0x%X' $((reg & 0xFF)))" >/dev/null
+    status=$(_cbi2c_cmd_wait "$cmd" "$(printf '0x%X' $((_CBI2C_WR)))")
+    _cbi2c_check_ack "$status" || { echo "ERR: NACK on reg 0x$(printf %02X "$reg")" >&2; return 1; }
+
+    for b in "$@"; do
+        idx=$((idx+1)); last=$(( idx == n ))
+        _cbi2c_reg "$tx" "$(printf '0x%X' $(( $((b)) & 0xFF )))" >/dev/null
+        if (( last )); then cmdv=$(( _CBI2C_WR | _CBI2C_STO )); else cmdv=$(( _CBI2C_WR )); fi
+        status=$(_cbi2c_cmd_wait "$cmd" "$(printf '0x%X' "$cmdv")")
+        _cbi2c_check_ack "$status" || { echo "ERR: NACK on data byte #$idx" >&2; return 1; }
+    done
+    return 0
+}
+
+# _cbi2c_xfer_cmd_only <ch> <slave7> <cmd>  -- START+W, cmd byte, STOP (no data)
+_cbi2c_xfer_cmd_only() {
+    local ch="$1" slave="$2" cc="$3" base tx cmd status
+    base=$(_cbi2c_chan_base "$ch") || return 1
+    tx=$(printf '0x%X' $((base + _CBI2C_TX)))
+    cmd=$(printf '0x%X' $((base + _CBI2C_CMD)))
+    [[ "$CB_I2C_AUTO_INIT" == "1" ]] && cb_i2c_init "$ch" >/dev/null
+    _cbi2c_reg "$tx" "$(printf '0x%X' $(( (slave << 1) & 0xFF )))" >/dev/null
+    status=$(_cbi2c_cmd_wait "$cmd" "$(printf '0x%X' $((_CBI2C_STA | _CBI2C_WR)))")
+    _cbi2c_check_ack "$status" || { echo "ERR: NACK on slave addr (W) 0x$(printf %02X "$slave")" >&2; return 1; }
+    _cbi2c_reg "$tx" "$(printf '0x%X' $((cc & 0xFF)))" >/dev/null
+    status=$(_cbi2c_cmd_wait "$cmd" "$(printf '0x%X' $((_CBI2C_WR | _CBI2C_STO)))")
+    _cbi2c_check_ack "$status" || { echo "ERR: NACK on cmd 0x$(printf %02X "$cc")" >&2; return 1; }
+    return 0
+}
+
+# === Public: generic I2C =====================================================
+
+# cb_i2c_read <ch> <slave> <reg> [nbytes]
+cb_i2c_read() {
+    [[ $# -lt 3 ]] && { echo "Usage: cb_i2c_read <ch> <slave> <reg> [nbytes]"; return 1; }
+    local ch="$1" slave=$(( $2 )) reg=$(( $3 )) n="${4:-1}" bytes
+    bytes=$(_cbi2c_xfer_read "$ch" "$slave" "$reg" "$n") || return 1
+    printf '  [I2C-R] ch=%s slave=0x%02X reg=0x%02X => [%s]\n' "$ch" "$slave" "$reg" "$bytes"
+}
+
+# cb_i2c_write <ch> <slave> <reg> <byte> [byte...]
+cb_i2c_write() {
+    [[ $# -lt 4 ]] && { echo "Usage: cb_i2c_write <ch> <slave> <reg> <byte> [byte...]"; return 1; }
+    local ch="$1" slave=$(( $2 )) reg=$(( $3 )); shift 3
+    _cbi2c_xfer_write "$ch" "$slave" "$reg" "$@" || return 1
+    printf '  [I2C-W] ch=%s slave=0x%02X reg=0x%02X <= [%s]\n' "$ch" "$slave" "$reg" "$*"
+}
+
+# cb_i2c_muxwrite <ch> <mux_slave> <ctrl_byte>  -- raw 1-byte write, no reg (TCA954x)
+cb_i2c_muxwrite() {
+    [[ $# -lt 3 ]] && { echo "Usage: cb_i2c_muxwrite <ch> <mux_slave> <ctrl_byte>"; return 1; }
+    local ch="$1" slave=$(( $2 )) val=$(( $3 )) base tx cmd status
+    base=$(_cbi2c_chan_base "$ch") || return 1
+    tx=$(printf '0x%X' $((base + _CBI2C_TX)))
+    cmd=$(printf '0x%X' $((base + _CBI2C_CMD)))
+    [[ "$CB_I2C_AUTO_INIT" == "1" ]] && cb_i2c_init "$ch" >/dev/null
+    _cbi2c_auto_mux_rst "$ch"
+    _cbi2c_reg "$tx" "$(printf '0x%X' $(( (slave << 1) & 0xFF )))" >/dev/null
+    status=$(_cbi2c_cmd_wait "$cmd" "$(printf '0x%X' $((_CBI2C_STA | _CBI2C_WR)))")
+    _cbi2c_check_ack "$status" || { echo "ERR: NACK on mux addr 0x$(printf %02X "$slave")" >&2; return 1; }
+    _cbi2c_reg "$tx" "$(printf '0x%X' $((val & 0xFF)))" >/dev/null
+    status=$(_cbi2c_cmd_wait "$cmd" "$(printf '0x%X' $((_CBI2C_WR | _CBI2C_STO)))")
+    _cbi2c_check_ack "$status" || { echo "ERR: NACK on mux ctrl byte" >&2; return 1; }
+    printf '  [MUX-W] ch=%s mux=0x%02X <= 0x%02X\n' "$ch" "$slave" "$val"
+}
+
+# cb_i2c_scan <ch>  -- probe 0x08..0x77, report slaves that ACK
+cb_i2c_scan() {
+    [[ $# -lt 1 ]] && { echo "Usage: cb_i2c_scan <ch>"; return 1; }
+    local ch="$1" base tx cmd a status found=""
+    base=$(_cbi2c_chan_base "$ch") || return 1
+    tx=$(printf '0x%X' $((base + _CBI2C_TX)))
+    cmd=$(printf '0x%X' $((base + _CBI2C_CMD)))
+    cb_i2c_init "$ch" >/dev/null
+    _cbi2c_auto_mux_rst "$ch"
+    for (( a=0x08; a<=0x77; a++ )); do
+        _cbi2c_reg "$tx" "$(printf '0x%X' $(( (a << 1) & 0xFF )))" >/dev/null
+        status=$(_cbi2c_cmd_wait "$cmd" "$(printf '0x%X' $((_CBI2C_STA | _CBI2C_WR | _CBI2C_STO)))")
+        _cbi2c_check_ack "$status" && found+="$(printf '0x%02X ' "$a")"
+    done
+    [[ -n "$found" ]] && echo "  [SCAN] ch=$ch found: ${found% }" || echo "  [SCAN] ch=$ch no devices"
+}
+
+# === Public: PMBus (== SMBus; command code + Repeated START read) ============
+
+# cb_pmbus_read <ch> <slave> <cmd> [nbytes]   (default 2 bytes, LSB first)
+cb_pmbus_read() {
+    [[ $# -lt 3 ]] && { echo "Usage: cb_pmbus_read <ch> <slave> <cmd> [nbytes]"; return 1; }
+    local ch="$1" slave=$(( $2 )) cc=$(( $3 )) n="${4:-2}" bytes
+    bytes=$(_cbi2c_xfer_read "$ch" "$slave" "$cc" "$n") || return 1
+    if [[ "$n" == "2" ]]; then
+        local b0 b1 word; b0=$(( $(echo "$bytes" | awk '{print $1}') )); b1=$(( $(echo "$bytes" | awk '{print $2}') ))
+        word=$(( b0 | (b1 << 8) ))
+        printf '  [PMB-R] ch=%s slave=0x%02X cmd=0x%02X => 0x%04X  raw=[%s]  linear16=%s\n' \
+            "$ch" "$slave" "$cc" "$word" "$bytes" "$(cb_pmbus_linear16 "$word")"
+    else
+        printf '  [PMB-R] ch=%s slave=0x%02X cmd=0x%02X => [%s]\n' "$ch" "$slave" "$cc" "$bytes"
+    fi
+}
+
+# cb_pmbus_write <ch> <slave> <cmd> [data byte...]   (no byte = send-byte)
+cb_pmbus_write() {
+    [[ $# -lt 3 ]] && { echo "Usage: cb_pmbus_write <ch> <slave> <cmd> [data byte...]"; return 1; }
+    local ch="$1" slave=$(( $2 )) cc=$(( $3 )); shift 3
+    if [[ $# -eq 0 ]]; then
+        _cbi2c_xfer_cmd_only "$ch" "$slave" "$cc" || return 1
+        printf '  [PMB-W] ch=%s slave=0x%02X cmd=0x%02X <= (send-byte)\n' "$ch" "$slave" "$cc"; return 0
+    fi
+    _cbi2c_xfer_write "$ch" "$slave" "$cc" "$@" || return 1
+    printf '  [PMB-W] ch=%s slave=0x%02X cmd=0x%02X <= [%s]\n' "$ch" "$slave" "$cc" "$*"
+}
+
+# cb_pmbus_linear16 <word>
+cb_pmbus_linear16() {
+    local word=$(( $1 & 0xFFFF ))
+    awk -v w="$word" 'BEGIN{
+        e=int(w/2048)%32; if(e>15)e-=32;
+        m=w%2048;        if(m>1023)m-=2048;
+        printf "%.4f", m * (2.0 ^ e);
+    }'
+}
+
+# === Help ====================================================================
+blanton_cb_i2c_help() {
+    echo -e "\033[1mblanton_cb_i2c.sh - CB FPGA (F3) I2C / PMBus over OpenCores I2C master\033[0m"
+    echo ""
+    echo -e "  Backend: \033[36mcb_fpga $CBI2C_FN\033[0m (direct PCIe BAR -> .3/resource0), base 0x300, Ch0..$CBI2C_CH_MAX"
+    echo ""
+    echo -e "\033[1mSetup\033[0m"
+    echo -e "  \033[33mcb_i2c_init\033[0m   <ch> [pre_lo] [pre_hi]   prescale + enable (def 0x88/0x00 = 100kHz)"
+    echo -e "  \033[33mcb_i2c_reset\033[0m  <ch>                     LCL_RST=0xD"
+    echo -e "  \033[33mcb_i2c_sem\033[0m    <ch> [status|acquire [v]|release]"
+    echo -e "  \033[33mcb_i2c_muxsel\033[0m <ch> <dev_sel>           write I2C_MUX_SEL_REG"
+    echo -e "  \033[33mcb_i2c_mux_reset_release\033[0m              de-assert ALL ext mux RESET (F0 0x7D4<=0xFF)"
+    echo ""
+    echo -e "\033[1mGeneric I2C\033[0m"
+    echo -e "  \033[33mcb_i2c_scan\033[0m   <ch>"
+    echo -e "  \033[33mcb_i2c_read\033[0m   <ch> <slave> <reg> [nbytes]"
+    echo -e "  \033[33mcb_i2c_write\033[0m  <ch> <slave> <reg> <byte> [byte...]"
+    echo -e "  \033[33mcb_i2c_muxwrite\033[0m <ch> <mux_slave> <ctrl_byte>  raw 1-byte (TCA954x)"
+    echo ""
+    echo -e "\033[1mPMBus / SMBus\033[0m"
+    echo -e "  \033[33mcb_pmbus_read\033[0m  <ch> <slave> <cmd> [nbytes]     (def 2, LE word + linear16)"
+    echo -e "  \033[33mcb_pmbus_write\033[0m <ch> <slave> <cmd> [byte...]"
+    echo -e "  \033[33mcb_pmbus_linear16\033[0m <word>"
+    echo ""
+    echo -e "  Slave = 7-bit (tool shifts). Spec lists 8-bit pairs -> divide by 2."
+    echo -e "  \033[33mfpga_debug on\033[0m to see every underlying pcimem command."
+}
+
+blanton_cb_i2c_help
@@ -0,0 +1,270 @@
+#!/usr/bin/env bash
+# =============================================================================
+# blanton_fpga_pcimem.sh  --  pcimem backend, sysfs resource file + relative offset
+# =============================================================================
+# Version History:
+#   V1.3.0  2026-06-12  pcimem variant (SONiC hardware). memtool variant: blanton_fpga_memtool.sh
+#                       Version number kept in sync with blanton_fpga_memtool.sh
+#   V1.4.0  2026-06-15  Fix: VSPI window bases pointed at the VSPI-Flash block
+#                            (0x340/0x380/0x3C0/0x400, config-flash channel) so register
+#                            reads returned 0; corrected to the VSPI register block
+#                            (PMC 0x640 / ICB 0x680 / SWB0 0x6C0 / SWB1 0x700)
+#                       Add: _vspi_fnwarn guard - warns when PMC/ICB/SWB are called with
+#                            cb_fpga-style "<fn> <addr>" (a read turning into a write)
+#                       Change: suppress pcimem write stdout noise (mmap/Written lines)
+#                       Docs: comments/help translated to English (ASCII-only for SONiC console)
+#   V1.4.1  2026-06-23  Fix: BDF in example auto-detect was wrong (02:00 vs 04:00); corrected to match the lspci example.
+# =============================================================================
+#
+# SONiC hardware has no memtool / devmem, but it has pcimem. pcimem mmaps the PCI
+# sysfs resource file directly and takes "resource file + offset relative to BAR
+# start", not an absolute physical address.
+#
+#   pcimem { sysfile } { offset } [ type*count [ data ] ]
+#     sysfile : sysfs file for the pci resource (e.g. .../resource0)
+#     offset  : offset into pci memory region
+#     type    : [b]yte, [h]alfword, [w]ord, [d]ouble-word
+#     *count  : number of items (w*100 dump 100 words)
+#     data    : data to be written
+#
+# This tool always accesses as word (w, 32-bit).
+#
+# After sourcing this file the following functions are available:
+#   cb_fpga   <fn:0-3> <addr> [data]
+#   pmc_fpga  <addr> [data]
+#   icb_fpga  <addr> [data]
+#   swb0_fpga <addr> [data]
+#   swb1_fpga <addr> [data]
+#
+# data present = write, absent = read.
+# Usage: source blanton_fpga_pcimem.sh
+
+# === CB FPGA PCIe resource file (sysfs) ===
+# Use lspci -D to find the BDF (domain:bus:dev.fn); resource0 is the sysfs mapping of BAR0.
+# e.g. lspci -Dnn | grep -i fpga   ->  0000:02:00.0 ...
+# memtool variant fills in the BAR value; pcimem variant fills in the resource file
+# path instead (offset becomes relative to BAR).
+FUNCT0_RES=/sys/bus/pci/devices/0000:04:00.0/resource0
+FUNCT1_RES=/sys/bus/pci/devices/0000:04:00.1/resource0
+FUNCT2_RES=/sys/bus/pci/devices/0000:04:00.2/resource0
+FUNCT3_RES=/sys/bus/pci/devices/0000:04:00.3/resource0
+
+# Auto-detect example (uncomment to use; needs the FPGA's BDF prefix):
+# _BDF=0000:02:00
+# FUNCT0_RES=/sys/bus/pci/devices/${_BDF}.0/resource0
+# FUNCT1_RES=/sys/bus/pci/devices/${_BDF}.1/resource0
+# FUNCT2_RES=/sys/bus/pci/devices/${_BDF}.2/resource0
+# FUNCT3_RES=/sys/bus/pci/devices/${_BDF}.3/resource0
+
+# === VSPI window base offset (relative to CB Function 2 resource0 start) ===
+# NOTE: CB.F2 has TWO near-identical VSPI register blocks (see spec register map):
+#   - VSPI-Flash-* @ 0x340/0x380/0x3C0/0x400 -> accesses the remote FPGA's CONFIG FLASH
+#   - VSPI-*       @ 0x640/0x680/0x6C0/0x700 -> accesses the remote FPGA's REGISTERS
+# This tool reads/writes remote registers, so it uses the VSPI-* block (0x640+).
+# The VSPI-Flash bases are kept below (commented) in case flash access is needed later.
+VSPI_PMC_BASE=0x640
+VSPI_ICB_BASE=0x680
+VSPI_SWB0_BASE=0x6C0
+VSPI_SWB1_BASE=0x700
+
+# VSPI-Flash window bases (config-flash access, not register access):
+# VSPI_FLASH_PMC_BASE=0x340
+# VSPI_FLASH_ICB_BASE=0x380
+# VSPI_FLASH_SWB0_BASE=0x3C0
+# VSPI_FLASH_SWB1_BASE=0x400
+
+# === VSPI protocol constants ===
+_VSPI_CMD_STAT=0x00
+_VSPI_ADDR=0x04
+_VSPI_WR_DATA=0x08
+_VSPI_RD_DATA=0x0C
+_VSPI_NEW_CMD=0x01
+_VSPI_READ_W=0x02
+_VSPI_WRITE_W=0x04
+_VSPI_READY_MASK=0x100
+_VSPI_POLL_MAX=200
+
+# === pcimem command ===
+PCIMEM_CMD="${PCIMEM_CMD:-pcimem}"
+
+# === Debug mode (1=print commands AND execute, 0=execute only) ===
+DEBUG_MODE=${DEBUG_MODE:-0}
+
+fpga_debug() {
+    if [ "${1:-}" = "on" ]; then DEBUG_MODE=1
+    elif [ "${1:-}" = "off" ]; then DEBUG_MODE=0
+    else [ "$DEBUG_MODE" = "0" ] && DEBUG_MODE=1 || DEBUG_MODE=0; fi
+    echo -e "[\033[34mINFO\033[0m] DEBUG_MODE=$DEBUG_MODE"
+}
+
+# Wrapper: debug mode prints command (to stderr) AND executes, normal mode executes only.
+# On read, returns the parsed hex value (stripping pcimem's mmap noise).
+# Usage: _pcimem <sysfile> <offset> [data]   (data present = write, absent = read)
+_pcimem() {
+    local sysfile="$1" offset="$2" data="${3:-}"
+    if [[ -n "$data" ]]; then
+        [ "$DEBUG_MODE" = "1" ] && \
+            echo -e "\033[90m[DEBG] $PCIMEM_CMD $sysfile $offset w $data\033[0m" >&2
+        # Write output (opened / Target offset / mmap / Written...readback) is never
+        # parsed -> drop stdout noise; keep stderr so real errors still surface.
+        $PCIMEM_CMD "$sysfile" "$offset" w "$data" >/dev/null
+    else
+        [ "$DEBUG_MODE" = "1" ] && \
+            echo -e "\033[90m[DEBG] $PCIMEM_CMD $sysfile $offset w\033[0m" >&2
+        # pcimem read prints mmap info + "Value at offset ...: 0xXXXX";
+        # take the last 0x... token as the actual read-back value.
+        $PCIMEM_CMD "$sysfile" "$offset" w | grep -oiE '0x[0-9a-f]+' | tail -1
+    fi
+}
+
+# --- Internal VSPI helpers (all hang off CB Function 2's resource0) ---
+
+_vspi_read() {
+    local win_off="$1" remote_offset="$2"
+    local cmd_off add_off rd_off addr_val status i
+
+    cmd_off=$(printf '0x%X' $(( win_off + _VSPI_CMD_STAT )))
+    add_off=$(printf '0x%X' $(( win_off + _VSPI_ADDR )))
+    rd_off=$(printf '0x%X' $(( win_off + _VSPI_RD_DATA )))
+    addr_val=$(printf '0x%08X' $(( (0x0 << 20) | (remote_offset & 0xFFFFF) )))
+
+    _pcimem "$FUNCT2_RES" "$add_off" "$addr_val"
+    _pcimem "$FUNCT2_RES" "$cmd_off" $(printf '0x%X' $(( _VSPI_NEW_CMD | _VSPI_READ_W )))
+
+    for (( i=0; i<_VSPI_POLL_MAX; i++ )); do
+        status=$(_pcimem "$FUNCT2_RES" "$cmd_off")
+        if (( ( ${status:-0} & _VSPI_READY_MASK) != 0 )); then
+            _pcimem "$FUNCT2_RES" "$rd_off"
+            return 0
+        fi
+    done
+    echo "ERROR: VSPI read timeout @ offset $remote_offset" >&2
+    return 1
+}
+
+_vspi_write() {
+    local win_off="$1" remote_offset="$2" data="$3"
+    local cmd_off add_off wr_off addr_val status i
+
+    cmd_off=$(printf '0x%X' $(( win_off + _VSPI_CMD_STAT )))
+    add_off=$(printf '0x%X' $(( win_off + _VSPI_ADDR )))
+    wr_off=$(printf '0x%X' $(( win_off + _VSPI_WR_DATA )))
+    addr_val=$(printf '0x%08X' $(( (0x0 << 20) | (remote_offset & 0xFFFFF) )))
+
+    _pcimem "$FUNCT2_RES" "$wr_off" "$data"
+    _pcimem "$FUNCT2_RES" "$add_off" "$addr_val"
+    _pcimem "$FUNCT2_RES" "$cmd_off" $(printf '0x%X' $(( _VSPI_NEW_CMD | _VSPI_WRITE_W )))
+
+    for (( i=0; i<_VSPI_POLL_MAX; i++ )); do
+        status=$(_pcimem "$FUNCT2_RES" "$cmd_off")
+        if (( ( ${status:-0} & _VSPI_READY_MASK) != 0 )); then
+            return 0
+        fi
+    done
+    echo "ERROR: VSPI write timeout @ offset $remote_offset" >&2
+    return 1
+}
+
+# Guard: PMC/ICB/SWB are single-function; signature is <addr> [data], NO fn arg.
+# Common pitfall: using cb_fpga's "<fn> <addr>" form -> 2nd arg becomes data, a read
+# turns into a write. If addr is 0~3 (looks like fn) AND data is given, warn and
+# confirm; on a non-tty (script) just warn, don't block.
+# Usage: _vspi_fnwarn <name> <addr> <data>   non-zero return = cancel
+_vspi_fnwarn() {
+    local name="$1" addr="$2" data="$3"
+    [[ -z "$data" ]] && return 0                       # read, nothing to warn
+    case "$addr" in
+        0|1|2|3|0x0|0x1|0x2|0x3|0x00|0x01|0x02|0x03) ;; # looks like fn, warn below
+        *) return 0 ;;                                  # normal offset, allow
+    esac
+    echo -e "[\033[33mWARN\033[0m] $name has no fn arg; signature is <addr> [data] (NOT cb_fpga's <fn> <addr>)." >&2
+    echo -e "       This will WRITE $data to PMC/ICB/SWB offset $addr." >&2
+    echo -e "       To READ offset $addr, pass a single arg: $name $addr" >&2
+    if [ -t 0 ]; then
+        local ans
+        read -r -p "       Proceed with write anyway? [y/N] " ans
+        case "$ans" in
+            y|Y|yes|YES) return 0 ;;
+            *) echo "       Cancelled." >&2; return 1 ;;
+        esac
+    fi
+    return 0
+}
+
+# === Public functions ===
+
+cb_fpga() {
+    if [[ $# -lt 2 ]]; then
+        echo "Usage: cb_fpga <fn:0-3> <addr> [data]"; return 1
+    fi
+    local fn="$1" addr="$2" data="${3:-}" res
+    case "$fn" in
+        0) res=$FUNCT0_RES ;; 1) res=$FUNCT1_RES ;;
+        2) res=$FUNCT2_RES ;; 3) res=$FUNCT3_RES ;;
+        *) echo "cb_fpga: fn must be 0-3" >&2; return 1 ;;
+    esac
+    # pcimem offset is relative to BAR start; do not add BAR.
+    if [[ -z "$data" ]]; then
+        _pcimem "$res" "$addr"
+    else
+        _pcimem "$res" "$addr" "$data"
+    fi
+}
+
+pmc_fpga() {
+    if [[ $# -lt 1 ]]; then
+        echo "Usage: pmc_fpga <addr> [data]"; return 1
+    fi
+    local addr="$1" data="${2:-}"
+    _vspi_fnwarn pmc_fpga "$addr" "$data" || return 1
+    if [[ -z "$data" ]]; then _vspi_read "$VSPI_PMC_BASE" "$addr"
+    else _vspi_write "$VSPI_PMC_BASE" "$addr" "$data"; fi
+}
+
+icb_fpga() {
+    if [[ $# -lt 1 ]]; then
+        echo "Usage: icb_fpga <addr> [data]"; return 1
+    fi
+    local addr="$1" data="${2:-}"
+    _vspi_fnwarn icb_fpga "$addr" "$data" || return 1
+    if [[ -z "$data" ]]; then _vspi_read "$VSPI_ICB_BASE" "$addr"
+    else _vspi_write "$VSPI_ICB_BASE" "$addr" "$data"; fi
+}
+
+swb0_fpga() {
+    if [[ $# -lt 1 ]]; then
+        echo "Usage: swb0_fpga <addr> [data]"; return 1
+    fi
+    local addr="$1" data="${2:-}"
+    _vspi_fnwarn swb0_fpga "$addr" "$data" || return 1
+    if [[ -z "$data" ]]; then _vspi_read "$VSPI_SWB0_BASE" "$addr"
+    else _vspi_write "$VSPI_SWB0_BASE" "$addr" "$data"; fi
+}
+
+swb1_fpga() {
+    if [[ $# -lt 1 ]]; then
+        echo "Usage: swb1_fpga <addr> [data]"; return 1
+    fi
+    local addr="$1" data="${2:-}"
+    _vspi_fnwarn swb1_fpga "$addr" "$data" || return 1
+    if [[ -z "$data" ]]; then _vspi_read "$VSPI_SWB1_BASE" "$addr"
+    else _vspi_write "$VSPI_SWB1_BASE" "$addr" "$data"; fi
+}
+
+blanton_fpga_help() {
+    echo -e "\033[1mblanton_fpga (pcimem) - FPGA Register Access Tool\033[0m"
+    echo ""
+    echo -e "\033[1mUsage:\033[0m"
+    echo -e "  \033[33mcb_fpga\033[0m    <fn:0-3> <addr> [data]  CB FPGA direct (sysfs resource0)"
+    echo -e "  \033[33mpmc_fpga\033[0m   <addr> [data]           PMC FPGA via VSPI"
+    echo -e "  \033[33micb_fpga\033[0m   <addr> [data]           ICB FPGA via VSPI"
+    echo -e "  \033[33mswb0_fpga\033[0m  <addr> [data]           SWB0 FPGA via VSPI"
+    echo -e "  \033[33mswb1_fpga\033[0m  <addr> [data]           SWB1 FPGA via VSPI"
+    echo -e "  \033[33mfpga_debug\033[0m on|off                  Toggle debug mode (print commands and execute)"
+    echo ""
+    echo -e "  Omit [data] to \033[32mread\033[0m, provide [data] to \033[31mwrite\033[0m."
+    echo -e "  Backend: \033[36mpcimem\033[0m (sysfs resource file + relative offset)."
+    echo -e "  Run \033[33mblanton_fpga_help\033[0m to show this message again."
+}
+
+blanton_fpga_help
@@ -0,0 +1,493 @@
+#!/bin/bash
+# Blanton Margin Tool - Shell version (CB: i2cset/i2cget | SWB: cb_pmbus_* via FPGA)
+# Usage: source margin.sh; margin_init; margin_status
+#
+# =============================================================================
+# Version Control
+# -----------------------------------------------------------------------------
+# v2.5.0  SWB margin support via a per-conf TRANSPORT layer. The SWB margin
+#         boards are ALSO LTC2980 (2x LTC2977) -- same chip as CB -- just reached
+#         through the CB FPGA F3 I2C master instead of a native bus. So the whole
+#         stack above the wire (PAGE, LINEAR16 x8192, VNOM margin) is identical;
+#         only the wire op changes. A .conf sets:
+#            TRANSPORT="swb"   CB_I2C_CH=<6|7|8|9>
+#         and i2cset/i2cget are swapped for cb_pmbus_write/cb_pmbus_read (from the
+#         bundled blanton_cb_i2c.sh + blanton_fpga_pcimem.sh) on that FPGA channel.
+#         The LTC2977 addresses stay in CHIPS; the bus field is unused for swb.
+#         TRANSPORT unset -> "i2c", so existing CB confs are unchanged.
+# v2.4.0  Auto-enable channel before margining: clear ON_OFF_CONFIG use_control
+#         (0x02=0x1a) so OPERATION can turn the channel on and soft-connect the
+#         servo DAC. Fixes "STATUS_WORD OFF=1, Vout won't move" on rails the
+#         LTC2980 does not sequence (externally enabled, e.g. MPQ8625 always-on).
+#         margin_set does NOT block for servo settle — confirm final voltages
+#         with margin_status afterwards. RAM-only; reverts on power cycle.
+# v2.3.1  Fix: LINEAR16 hex->dec parsing (SONiC busybox/mawk ignores "0x")
+# v2.3.0  Logging system, TAB completion, colored output
+# v2.2.0  margin_debug toggle + colored log output
+# v2.1.0  Batch scripts for status / apply_profile / save across boards
+# v2.0.0  Per-LTC2980 .conf, Script Channel mapping, scoped PRE/POST (breaking)
+# v1.2.0  Per-chip PRE/POST command hooks
+# v1.1.0  Replace i2cexec with i2cset/i2cget, rename to LTC2980
+# v1.0.0  Initial release - LTC2977 PMBus margin test tool
+# =============================================================================
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SETTINGS_DIR="$SCRIPT_DIR/settings"
+PROFILES_DIR="$SCRIPT_DIR/profiles"
+LOGS_DIR="$SCRIPT_DIR/logs"
+
+# --- Ensure logs directory exists ---
+mkdir -p "$LOGS_DIR"
+
+# --- Global state ---
+PART_NUMBER=""
+CHIPS=()
+DEBUG_MODE=0
+LOG_MODE=1
+
+# Transport backend, selected per-conf (a .conf sets TRANSPORT):
+#   "i2c" (default) - LTC2980 on the CPU I2C bus via i2cset/i2cget
+#   "swb"           - the SAME LTC2980 margin board, but reached through the CB
+#                     FPGA F3 I2C master via cb_pmbus_read/cb_pmbus_write. The
+#                     LTC2977 addresses stay in CHIPS; CB_I2C_CH picks the FPGA
+#                     I2C channel (6/7/8/9). Everything above the wire (PAGE,
+#                     LINEAR16 x8192, VNOM margin) is identical to the i2c path.
+TRANSPORT="i2c"
+CB_I2C_CH=""
+
+# Channel enable for margining. Rails the LTC2980 does not sequence (externally
+# enabled, e.g. an always-on MPQ8625 buck) sit with STATUS_WORD OFF=1 and won't
+# margin, because the servo DAC never soft-connects. Writing ON_OFF_CONFIG (0x02)
+# to clear use_control lets a following OPERATION command turn the channel on so
+# the DAC connects and servos to the margin target. Change is RAM-only and reverts
+# on power cycle (never STORE_USER_ALL during a test). Set MARGIN_AUTO_ENABLE=0 to
+# keep the stored ON_OFF_CONFIG untouched.
+MARGIN_AUTO_ENABLE=1
+ONOFF_ENABLE_VALUE="0x1a"   # controlled_on=1, use_pmbus=1, use_control=0, b1=1
+# Short pause after OPERATION so the write registers; NOT a full servo settle.
+# margin_set returns immediately (does not block per channel) — the DAC soft-connect
+# + servo ramp takes a few seconds, so confirm final voltages yourself with
+# margin_status after all channels are set. Bump this if you want margin_set's own
+# read-back to reflect the settled value.
+MARGIN_SETTLE="0.3"
+_BUS=""
+_ADDR=""
+_PRE_SCOPE=""   # set while inside a PRE/POST wrapped operation; prevents nested re-entry
+_LOG_FILE=""
+_LOG_DETAIL_FILE=""
+_LOG_DETAIL_LINE=0
+
+# --- Logging helper ---
+_ts() {
+    date "+%Y-%m-%d %H:%M:%S.%3N"
+}
+
+_log() {
+    [ "$LOG_MODE" = "0" ] && return
+    [ -z "$_LOG_FILE" ] && return
+    echo -e "[$(_ts)] $*" >> "$_LOG_FILE"
+}
+
+_log_detail() {
+    [ "$LOG_MODE" = "0" ] && return
+    [ -z "$_LOG_DETAIL_FILE" ] && return
+    (( _LOG_DETAIL_LINE++ ))
+    echo "[$(_ts)] $*" >> "$_LOG_DETAIL_FILE"
+}
+
+_log_label() {
+    [ "$LOG_MODE" = "0" ] && return
+    local label=$1
+    (( _LOG_DETAIL_LINE++ ))
+    echo "[$(_ts)] --- $label ---" >> "$_LOG_DETAIL_FILE"
+    _log "$label \033[90m(detail Line:${_LOG_DETAIL_LINE})\033[0m"
+}
+
+_log_start_session() {
+    _log "--- margin_init: $PART_NUMBER ---"
+}
+
+# --- Toggle log mode ---
+margin_log() {
+    if [ "${1:-}" = "on" ]; then
+        LOG_MODE=1
+    elif [ "${1:-}" = "off" ]; then
+        LOG_MODE=0
+    else
+        [ "$LOG_MODE" = "0" ] && LOG_MODE=1 || LOG_MODE=0
+    fi
+    echo -e "[\033[34mINFO\033[0m] LOG_MODE=$LOG_MODE"
+}
+
+# --- Toggle debug mode ---
+margin_debug() {
+    if [ "${1:-}" = "on" ]; then
+        DEBUG_MODE=1
+    elif [ "${1:-}" = "off" ]; then
+        DEBUG_MODE=0
+    else
+        [ "$DEBUG_MODE" = "0" ] && DEBUG_MODE=1 || DEBUG_MODE=0
+    fi
+    echo -e "[\033[34mINFO\033[0m] DEBUG_MODE=$DEBUG_MODE"
+}
+
+# --- Init: load setting by name ---
+margin_init() {
+    if [ -z "$1" ]; then
+        echo -e "[\033[31mERRO\033[0m] Usage: margin_init <PART_NUMBER>"
+        return 1
+    fi
+    PART_NUMBER="$1"
+    echo "Part Number: $PART_NUMBER"
+
+    local setting_file="$SETTINGS_DIR/${PART_NUMBER}.conf"
+    if [ ! -f "$setting_file" ]; then
+        echo -e "[\033[31mERRO\033[0m] Setting file not found: $setting_file"
+        return 1
+    fi
+    TRANSPORT="i2c"; CB_I2C_CH=""   # reset before sourcing; swb confs override
+    source "$setting_file"
+    TRANSPORT="${TRANSPORT:-i2c}"    # a blank TRANSPORT="" in a .conf means i2c
+    echo -e "[\033[34mINFO\033[0m] Loaded setting: $setting_file (transport=$TRANSPORT)"
+
+    # SWB rails need the cb_pmbus_* backend; source it on demand.
+    if [ "$TRANSPORT" = "swb" ] && ! declare -F cb_pmbus_read >/dev/null 2>&1; then
+        if [ -f "$SCRIPT_DIR/blanton_cb_i2c.sh" ]; then
+            # shellcheck source=/dev/null
+            source "$SCRIPT_DIR/blanton_cb_i2c.sh"
+        else
+            echo -e "[\033[31mERRO\033[0m] TRANSPORT=swb but blanton_cb_i2c.sh not found in $SCRIPT_DIR"
+            return 1
+        fi
+    fi
+    _log_start_session
+}
+
+# --- Tab completion for margin_init ---
+_margin_init_completions() {
+    [ "$COMP_CWORD" -ne 1 ] && return
+    local cur="${COMP_WORDS[COMP_CWORD]}"
+    local names=$(ls "$SETTINGS_DIR"/*.conf 2>/dev/null | xargs -n1 basename | sed 's/\.conf$//')
+    COMPREPLY=($(compgen -W "$names" -- "$cur"))
+}
+complete -F _margin_init_completions margin_init
+
+# --- PRE/POST scope helpers ---
+# PRE/POST run once at the outermost public-function entry/exit.
+# Nested calls (e.g. margin_apply_profile -> margin_set -> margin_read_vout)
+# see _PRE_SCOPE already set and skip, so the mux only switches once.
+_run_cmds() {
+    local cmds=$1 label=$2
+    [ -z "$cmds" ] && return
+    IFS=';' read -ra _cmds <<< "$cmds"
+    for _cmd in "${_cmds[@]}"; do
+        _cmd=$(echo "$_cmd" | xargs)
+        [ -z "$_cmd" ] && continue
+        [ "$DEBUG_MODE" = "1" ] && echo -e "\033[36m$label $_cmd\033[0m"
+        eval "$_cmd" >/dev/null 2>&1
+    done
+}
+
+# Returns 0 (true) if caller owns the scope and must call _pre_exit on the way out.
+_pre_enter_own() {
+    if [ -z "$_PRE_SCOPE" ]; then
+        _PRE_SCOPE=1
+        _run_cmds "${CHIP_PRE_CMD[0]}" "[PRE]"
+        return 0
+    fi
+    return 1
+}
+
+_pre_exit() {
+    _run_cmds "${CHIP_POST_CMD[0]}" "[POST]"
+    _PRE_SCOPE=""
+}
+
+# --- Helper: set _BUS and _ADDR from channel number ---
+# Both transports use CHIPS (LTC2977 addresses). For swb the bus field is unused
+# (the FPGA I2C channel comes from CB_I2C_CH); _ADDR is the PMBus slave.
+_get_chip() {
+    local chip_idx=$(( $1 / 8 ))
+    IFS=':' read -r _BUS _ADDR <<< "${CHIPS[$chip_idx]}"
+}
+
+# --- Helper: get page (channel within LTC2977, 0x00~0x07) ---
+_get_page() {
+    printf "0x%02x" $(( $1 % 8 ))
+}
+
+# --- I2C low-level helpers (use _BUS/_ADDR set by _get_chip) ---
+# TRANSPORT=swb swaps the i2cset/i2cget wire op for cb_pmbus_* on CB_I2C_CH.
+# PAGE is written the same way on both (PMBus command 0x00).
+_open_page() {
+    if [ "$TRANSPORT" = "swb" ]; then
+        [ "$DEBUG_MODE" = "1" ] && echo -e "\033[90m[DEBG] cb_pmbus_write $CB_I2C_CH $_ADDR 0x00 $1\033[0m"
+        cb_pmbus_write "$CB_I2C_CH" "$_ADDR" 0x00 "$1" >/dev/null 2>&1
+        return
+    fi
+    [ "$DEBUG_MODE" = "1" ] && echo -e "\033[90m[DEBG] i2cset -y $_BUS $_ADDR 0x00 $1 b\033[0m"
+    i2cset -y "$_BUS" "$_ADDR" 0x00 "$1" b >/dev/null 2>&1
+}
+
+# Write a 16-bit word (LINEAR16, little-endian: lo byte first).
+_i2c_write_word() {
+    local reg=$1 lo=$2 hi=$3
+    if [ "$TRANSPORT" = "swb" ]; then
+        [ "$DEBUG_MODE" = "1" ] && echo -e "\033[90m[DEBG] cb_pmbus_write $CB_I2C_CH $_ADDR $reg $lo $hi\033[0m"
+        cb_pmbus_write "$CB_I2C_CH" "$_ADDR" "$reg" "$lo" "$hi" >/dev/null 2>&1
+        return
+    fi
+    local word=$(( (hi << 8) | lo ))
+    local word_hex=$(printf "0x%04x" "$word")
+    [ "$DEBUG_MODE" = "1" ] && echo -e "\033[90m[DEBG] i2cset -y $_BUS $_ADDR $reg $word_hex w\033[0m"
+    i2cset -y "$_BUS" "$_ADDR" "$reg" "$word" w >/dev/null 2>&1
+}
+
+_i2c_write_byte() {
+    if [ "$TRANSPORT" = "swb" ]; then
+        [ "$DEBUG_MODE" = "1" ] && echo -e "\033[90m[DEBG] cb_pmbus_write $CB_I2C_CH $_ADDR $1 $2\033[0m"
+        cb_pmbus_write "$CB_I2C_CH" "$_ADDR" "$1" "$2" >/dev/null 2>&1
+        return
+    fi
+    [ "$DEBUG_MODE" = "1" ] && echo -e "\033[90m[DEBG] i2cset -y $_BUS $_ADDR $1 $2 b\033[0m"
+    i2cset -y "$_BUS" "$_ADDR" "$1" "$2" b >/dev/null 2>&1
+}
+
+# Read a 16-bit word; echoes "0xXXXX". For swb, parse cb_pmbus_read's "=> 0xXXXX".
+_i2c_read_word() {
+    if [ "$TRANSPORT" = "swb" ]; then
+        [ "$DEBUG_MODE" = "1" ] && echo -e "\033[90m[DEBG] cb_pmbus_read $CB_I2C_CH $_ADDR $1 2\033[0m" >&2
+        local out word
+        out=$(cb_pmbus_read "$CB_I2C_CH" "$_ADDR" "$1" 2 2>/dev/null)
+        # cb_pmbus_read prints "... => 0xXXXX  raw=[...] ..."; take the word after "=>".
+        word=$(printf '%s' "$out" | awk -F'=> ' 'NF>1{print $2}' | awk '{print $1}')
+        [[ "$word" =~ ^0[xX][0-9a-fA-F]+$ ]] || word="0x0000"
+        echo "$word"
+        return
+    fi
+    [ "$DEBUG_MODE" = "1" ] && echo -e "\033[90m[DEBG] i2cget -y $_BUS $_ADDR $1 w\033[0m" >&2
+    local result
+    result=$(i2cget -y "$_BUS" "$_ADDR" "$1" w 2>/dev/null)
+    if [ -z "$result" ]; then
+        echo "0x0000"
+    else
+        echo "$result"
+    fi
+}
+
+# --- Enable current channel for margining (clear ON_OFF_CONFIG use_control) ---
+# Assumes _get_chip + _open_page already ran (uses current _BUS/_ADDR/page).
+# Lets a subsequent OPERATION command turn the channel on so the servo DAC
+# soft-connects; without this, rails the LTC2980 doesn't sequence stay OFF and
+# margining has no effect. RAM-only; a power cycle restores the stored value.
+_enable_channel() {
+    _i2c_write_byte 0x02 "$ONOFF_ENABLE_VALUE"
+}
+
+# --- Helper: decimal to LINEAR16 (returns "lo hi" hex strings) ---
+_dec_to_lin16() {
+    local value=$1
+    if [ "$value" = "0" ]; then
+        echo "0x00 0x00"
+        return
+    fi
+    local raw=$(awk "BEGIN { printf \"%04X\", int($value * 8192) }")
+    local hi=${raw:0:2}
+    local lo=${raw:2:2}
+    echo "0x${lo} 0x${hi}"
+}
+
+# --- Helper: LINEAR16 word to decimal voltage ---
+# i2cget returns a hex string like "0x9fc2". SONiC's awk (busybox/mawk) does NOT
+# parse a "0x" prefix in arithmetic and treats it as 0, so convert hex -> decimal
+# with bash arithmetic $(( )) first, then feed the decimal to awk.
+_lin16_to_dec() {
+    local raw_word=$(( ${1:-0} ))
+    awk "BEGIN { printf \"%.4f\", $raw_word / 8192.0 }"
+}
+
+# --- Read Vout for a channel ---
+margin_read_vout() {
+    local ch=$1
+    local vnom_var="CH${ch}_VNOM"
+    local net_var="CH${ch}_NET"
+    local vnom=${!vnom_var}
+    local net=${!net_var}
+
+    if [ "$vnom" = "-" ] || [ -z "$vnom" ]; then
+        printf "CH %2d: Channel not used\n" "$ch"
+        LAST_VOUT="0"
+        return
+    fi
+
+    local _own=0
+    _pre_enter_own && _own=1
+
+    _get_chip "$ch"
+    _open_page "$(_get_page "$ch")"
+    local raw
+    raw=$(_i2c_read_word 0x8b)
+    local vout=$(_lin16_to_dec "$raw")
+
+    local pct
+    pct=$(awk "BEGIN { printf \"%+.3f\", ($vout - $vnom) / $vnom * 100 }")
+    local _line
+    printf -v _line "CH %2d: Vnom = %.3f, Vout = %s (%s%%). Net - %s" "$ch" "$vnom" "$vout" "$pct" "$net"
+    echo "$_line"
+    _log_detail "$_line"
+    LAST_VOUT="$vout"
+
+    [ "$_own" = "1" ] && _pre_exit
+}
+
+# --- Status: read all or specific channel ---
+margin_status() {
+    local ch_in=${1:-all}
+    echo "-------------"
+    echo "[$PART_NUMBER] Channel status"
+    echo "-------------"
+    _log_label "margin_status [$PART_NUMBER] ch=$ch_in"
+
+    local _own=0
+    _pre_enter_own && _own=1
+
+    if [ "$ch_in" = "all" ]; then
+        for i in $(seq 0 15); do
+            local vnom_var="CH${i}_VNOM"
+            [ -n "${!vnom_var}" ] && margin_read_vout "$i"
+        done
+    else
+        margin_read_vout "$ch_in"
+    fi
+
+    [ "$_own" = "1" ] && _pre_exit
+}
+
+# --- Set margin value (write high/low + OV/UV) ---
+margin_set_value() {
+    local ch=$1 vnom=$2 change=$3 ovuv=${4:-2}
+
+    local high_val low_val ov_val uv_val
+    high_val=$(_dec_to_lin16 "$(awk "BEGIN { print $vnom * (1 + $change/100) }")")
+    low_val=$(_dec_to_lin16 "$(awk "BEGIN { print $vnom * (1 - $change/100) }")")
+    ov_val=$(_dec_to_lin16 "$(awk "BEGIN { print $vnom * (1 + ($change+$ovuv)/100) }")")
+    uv_val=$(_dec_to_lin16 "$(awk "BEGIN { print $vnom * (1 - ($change+$ovuv)/100) }")")
+
+    local _own=0
+    _pre_enter_own && _own=1
+
+    _get_chip "$ch"
+    _open_page "$(_get_page "$ch")"
+
+    local hi lo
+    read lo hi <<< $high_val
+    _i2c_write_word 0x25 "$lo" "$hi"
+    read lo hi <<< $low_val
+    _i2c_write_word 0x26 "$lo" "$hi"
+    read lo hi <<< $ov_val
+    _i2c_write_word 0x40 "$lo" "$hi"
+    read lo hi <<< $uv_val
+    _i2c_write_word 0x44 "$lo" "$hi"
+
+    [ "$_own" = "1" ] && _pre_exit
+}
+
+# --- Set operation register ---
+margin_operation() {
+    local ch=$1 op=$2
+
+    local op_val
+    case "$op" in
+        high)    op_val=0xa8 ;;
+        low)     op_val=0x98 ;;
+        nominal) op_val=0x80 ;;
+        off)     op_val=0x00 ;;
+        *)       echo -e "[\033[31mERRO\033[0m] invalid operation '$op'"; return 1 ;;
+    esac
+
+    local _own=0
+    _pre_enter_own && _own=1
+
+    _get_chip "$ch"
+    _open_page "$(_get_page "$ch")"
+    # Let OPERATION turn the channel on (soft-connect DAC) even on rails the
+    # LTC2980 does not sequence; skip when turning the channel off.
+    [ "$MARGIN_AUTO_ENABLE" = "1" ] && [ "$op" != "off" ] && _enable_channel
+    _i2c_write_byte 0x01 "$op_val"
+    sleep "$MARGIN_SETTLE"
+
+    [ "$_own" = "1" ] && _pre_exit
+}
+
+# --- Set: combined set_value + operation + verify ---
+margin_set() {
+    local ch=$1 op=$2 change=$3
+    local vnom_var="CH${ch}_VNOM"
+    local vnom=${!vnom_var}
+
+    if [ "$vnom" = "-" ] || [ -z "$vnom" ]; then
+        printf "CH %2d: Channel not used\n" "$ch"
+        return
+    fi
+
+    local _own=0
+    _pre_enter_own && _own=1
+
+    margin_set_value "$ch" "$vnom" "$change"
+    margin_operation "$ch" "$op"
+    margin_read_vout "$ch"
+    local _line
+    printf -v _line "CH %2d: Set %s %s%% done (Vout=%s)" "$ch" "$op" "$change" "$LAST_VOUT"
+    echo "$_line"
+    _log_detail "$_line"
+    _log "$(printf 'margin_set CH%2d %-7s %3s%% Vout=%-8s' $ch $op $change $LAST_VOUT)\033[90m(detail Line:${_LOG_DETAIL_LINE})\033[0m"
+
+    [ "$_own" = "1" ] && _pre_exit
+}
+
+# --- Apply a margin profile file ---
+margin_apply_profile() {
+    local profile=${1:-"$PROFILES_DIR/${PART_NUMBER}_default.conf"}
+    if [ ! -f "$profile" ]; then
+        echo -e "[\033[31mERRO\033[0m] Profile not found: $profile"
+        return 1
+    fi
+    echo "Applying profile: $profile"
+    _log_label "margin_apply_profile [$PART_NUMBER] $profile"
+    source "$profile"
+
+    local _own=0
+    _pre_enter_own && _own=1
+
+    for entry in "${PROFILE_CHANNELS[@]}"; do
+        local ch op change
+        IFS=':' read -r ch op change <<< "$entry"
+        margin_set "$ch" "$op" "$change"
+    done
+
+    [ "$_own" = "1" ] && _pre_exit
+}
+
+# --- Save to NVM ---
+margin_save() {
+    local _own=0
+    _pre_enter_own && _own=1
+
+    for chip in "${CHIPS[@]}"; do
+        IFS=':' read -r _BUS _ADDR <<< "$chip"
+        _i2c_write_byte 0x15 0x00
+    done
+    echo "Change Saved (${#CHIPS[@]} chips)"
+    _log_label "margin_save $PART_NUMBER (${#CHIPS[@]} chips)"
+
+    [ "$_own" = "1" ] && _pre_exit
+}
+
+if [ -z "$_LOG_FILE" ]; then
+    _LOG_FILE="$LOGS_DIR/margin_$(date '+%Y%m%d_%H%M%S').log"
+    _LOG_DETAIL_FILE="${_LOG_FILE%.log}_detail.log"
+    _log "=== Session start ==="
+    _log "Detail log: $_LOG_DETAIL_FILE"
+fi
+
+echo -e "[\033[34mINFO\033[0m] LTC2980 Margin Tool loaded. Run 'margin_init' to start."
@@ -0,0 +1,22 @@
+# Profile: all_off - 全部回 nominal
+# Applied to whichever LTC2980 is currently loaded via margin_init
+# Format: "channel:operation:change_percent"
+
+PROFILE_CHANNELS=(
+    "0:nominal:8"
+    "1:nominal:8"
+    "2:nominal:8"
+    "3:nominal:8"
+    "4:nominal:8"
+    "5:nominal:8"
+    "6:nominal:8"
+    "7:nominal:8"
+    "8:nominal:8"
+    "9:nominal:8"
+    "10:nominal:8"
+    "11:nominal:8"
+    "12:nominal:8"
+    "13:nominal:8"
+    "14:nominal:8"
+    "15:nominal:8"
+)
@@ -0,0 +1,22 @@
+# Profile: comboA - alternating high/low (even=high, odd=low)
+# Applied to whichever LTC2980 is currently loaded via margin_init
+# Format: "channel:operation:change_percent"
+
+PROFILE_CHANNELS=(
+    "0:high:8"
+    "1:low:8"
+    "2:high:8"
+    "3:low:8"
+    "4:high:8"
+    "5:low:8"
+    "6:high:8"
+    "7:low:8"
+    "8:high:8"
+    "9:low:8"
+    "10:high:8"
+    "11:low:8"
+    "12:high:8"
+    "13:low:8"
+    "14:high:8"
+    "15:low:8"
+)
@@ -0,0 +1,22 @@
+# Profile: comboB - inverse of comboA (even=low, odd=high)
+# Applied to whichever LTC2980 is currently loaded via margin_init
+# Format: "channel:operation:change_percent"
+
+PROFILE_CHANNELS=(
+    "0:low:8"
+    "1:high:8"
+    "2:low:8"
+    "3:high:8"
+    "4:low:8"
+    "5:high:8"
+    "6:low:8"
+    "7:high:8"
+    "8:low:8"
+    "9:high:8"
+    "10:low:8"
+    "11:high:8"
+    "12:low:8"
+    "13:high:8"
+    "14:low:8"
+    "15:high:8"
+)
@@ -0,0 +1,22 @@
+# Profile: combo_high3 - 全部 channel margin high +3%
+# Applied to whichever LTC2980 is currently loaded via margin_init
+# Format: "channel:operation:change_percent"
+
+PROFILE_CHANNELS=(
+    "0:high:3"
+    "1:high:3"
+    "2:high:3"
+    "3:high:3"
+    "4:high:3"
+    "5:high:3"
+    "6:high:3"
+    "7:high:3"
+    "8:high:3"
+    "9:high:3"
+    "10:high:3"
+    "11:high:3"
+    "12:high:3"
+    "13:high:3"
+    "14:high:3"
+    "15:high:3"
+)
@@ -0,0 +1,22 @@
+# Profile: combo_high - 全部 channel margin high +5%
+# Applied to whichever LTC2980 is currently loaded via margin_init
+# Format: "channel:operation:change_percent"
+
+PROFILE_CHANNELS=(
+    "0:high:5"
+    "1:high:5"
+    "2:high:5"
+    "3:high:5"
+    "4:high:5"
+    "5:high:5"
+    "6:high:5"
+    "7:high:5"
+    "8:high:5"
+    "9:high:5"
+    "10:high:5"
+    "11:high:5"
+    "12:high:5"
+    "13:high:5"
+    "14:high:5"
+    "15:high:5"
+)
@@ -0,0 +1,22 @@
+# Profile: combo_low3 - 全部 channel margin low -3%
+# Applied to whichever LTC2980 is currently loaded via margin_init
+# Format: "channel:operation:change_percent"
+
+PROFILE_CHANNELS=(
+    "0:low:3"
+    "1:low:3"
+    "2:low:3"
+    "3:low:3"
+    "4:low:3"
+    "5:low:3"
+    "6:low:3"
+    "7:low:3"
+    "8:low:3"
+    "9:low:3"
+    "10:low:3"
+    "11:low:3"
+    "12:low:3"
+    "13:low:3"
+    "14:low:3"
+    "15:low:3"
+)
@@ -0,0 +1,22 @@
+# Profile: combo_low - 全部 channel margin low -5%
+# Applied to whichever LTC2980 is currently loaded via margin_init
+# Format: "channel:operation:change_percent"
+
+PROFILE_CHANNELS=(
+    "0:low:5"
+    "1:low:5"
+    "2:low:5"
+    "3:low:5"
+    "4:low:5"
+    "5:low:5"
+    "6:low:5"
+    "7:low:5"
+    "8:low:5"
+    "9:low:5"
+    "10:low:5"
+    "11:low:5"
+    "12:low:5"
+    "13:low:5"
+    "14:low:5"
+    "15:low:5"
+)
@@ -0,0 +1,23 @@
+# Profile: combo_normal - 全部 channel 回 nominal（標稱值）
+# Applied to whichever LTC2980 is currently loaded via margin_init
+# Format: "channel:operation:change_percent"
+# nominal 時 operation=0x80，輸出跟隨 VOUT_COMMAND；change_percent 不影響輸出
+
+PROFILE_CHANNELS=(
+    "0:nominal:5"
+    "1:nominal:5"
+    "2:nominal:5"
+    "3:nominal:5"
+    "4:nominal:5"
+    "5:nominal:5"
+    "6:nominal:5"
+    "7:nominal:5"
+    "8:nominal:5"
+    "9:nominal:5"
+    "10:nominal:5"
+    "11:nominal:5"
+    "12:nominal:5"
+    "13:nominal:5"
+    "14:nominal:5"
+    "15:nominal:5"
+)
@@ -0,0 +1,50 @@
+#!/bin/bash
+# Apply a margin profile to every LTC2980 in BOARDS.
+# BOARDS[i] 對應 PROFILES[i]，兩個陣列長度必須一樣。
+# Usage:
+#   source script/margin_apply_profile_all.sh
+
+# --- Edit this list ---
+BOARDS=(
+    "Blanton_CB_CONN13"
+    "Blanton_SWB0_CONN13"
+    "Blanton_SWB0_CONN14"
+    "Blanton_SWB0_CONN15"
+    "Blanton_SWB0_CONN16"
+    "Blanton_SWB1_CONN13"
+    "Blanton_SWB1_CONN14"
+    "Blanton_SWB1_CONN15"
+    "Blanton_SWB1_CONN16"
+)
+
+# 對應的 profile 名稱（不含路徑與 .conf 副檔名），預設全部 comboA
+PROFILES=(
+    "comboA"    # Blanton_CB_CONN13
+    "comboA"    # Blanton_SWB0_CONN13
+    "comboA"    # Blanton_SWB0_CONN14
+    "comboA"    # Blanton_SWB0_CONN15
+    "comboA"    # Blanton_SWB0_CONN16
+    "comboA"    # Blanton_SWB1_CONN13
+    "comboA"    # Blanton_SWB1_CONN14
+    "comboA"    # Blanton_SWB1_CONN15
+    "comboA"    # Blanton_SWB1_CONN16
+)
+
+# --- Source margin.sh if not already loaded ---
+_SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+[ -z "$(type -t margin_init)" ] && source "$_SCRIPT_DIR/../margin.sh"
+
+# --- Sanity check ---
+if [ ${#BOARDS[@]} -ne ${#PROFILES[@]} ]; then
+    echo "ERROR: BOARDS (${#BOARDS[@]}) and PROFILES (${#PROFILES[@]}) length mismatch"
+    return 1 2>/dev/null || exit 1
+fi
+
+# --- Iterate ---
+for i in "${!BOARDS[@]}"; do
+    board="${BOARDS[$i]}"
+    profile="${PROFILES[$i]}"
+    margin_init "$board" || continue
+    margin_apply_profile "$PROFILES_DIR/${profile}.conf"
+    echo ""
+done
@@ -0,0 +1,32 @@
+#!/bin/bash
+# Run margin_save on every LTC2980 in BOARDS.
+#
+# ⚠️  margin_save 會把目前的 margin / OV / UV 設定**永久寫入 NVM**，
+#     斷電後仍保留。執行前請務必先 margin_status 確認各 channel 狀態正確。
+#
+# Usage:
+#   source script/margin_save_all.sh
+
+# --- Edit this list ---
+BOARDS=(
+    "Blanton_CB_CONN13"
+    "Blanton_SWB0_CONN13"
+    "Blanton_SWB0_CONN14"
+    "Blanton_SWB0_CONN15"
+    "Blanton_SWB0_CONN16"
+    "Blanton_SWB1_CONN13"
+    "Blanton_SWB1_CONN14"
+    "Blanton_SWB1_CONN15"
+    "Blanton_SWB1_CONN16"
+)
+
+# --- Source margin.sh if not already loaded ---
+_SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+[ -z "$(type -t margin_init)" ] && source "$_SCRIPT_DIR/../margin.sh"
+
+# --- Iterate ---
+for board in "${BOARDS[@]}"; do
+    margin_init "$board" || continue
+    margin_save
+    echo ""
+done
@@ -0,0 +1,29 @@
+#!/bin/bash
+# Run margin_status across every Blanton LTC2980 listed in BOARDS.
+# Edit BOARDS to include / exclude / reorder which .conf files to iterate.
+# Usage:
+#   source script/margin_status_all.sh
+
+# --- Edit this list ---
+BOARDS=(
+    "Blanton_CB_CONN13"
+    "Blanton_SWB0_CONN13"
+    "Blanton_SWB0_CONN14"
+    "Blanton_SWB0_CONN15"
+    "Blanton_SWB0_CONN16"
+    "Blanton_SWB1_CONN13"
+    "Blanton_SWB1_CONN14"
+    "Blanton_SWB1_CONN15"
+    "Blanton_SWB1_CONN16"
+)
+
+# --- Source margin.sh if not already loaded ---
+_SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+[ -z "$(type -t margin_init)" ] && source "$_SCRIPT_DIR/../margin.sh"
+
+# --- Iterate ---
+for board in "${BOARDS[@]}"; do
+    margin_init "$board" || continue
+    margin_status
+    echo ""
+done
@@ -0,0 +1,52 @@
+# Blanton Channel Settings
+# Format: CH<n>_VNOM=voltage  CH<n>_NET=net_name
+#
+# Channel numbering (Script Channel, per Blanton_Margin_List):
+#   ch_global / 8 -> CHIPS index (0~17)
+#   ch_global % 8 -> page within LTC2977 (0~7)
+# One LTC2980 = two LTC2977 (8ch each), controlled via 2 I2C addresses.
+
+# --- Transport (blank = i2c): CB's LTC2980 is on the native I2C bus, driven by
+#     i2cset/i2cget. Only SWB boards set TRANSPORT="swb" + CB_I2C_CH=<6|7|8|9>. ---
+TRANSPORT=""
+CB_I2C_CH=
+
+# --- I2C Configuration ---
+
+# Format: "bus:address"  (8 channels per entry / per LTC2977)
+CHIPS=(
+    # chip1: CB (CONN13)
+    "4:0x5C"    # CH0   ~ CH7
+    "4:0x5E"    # CH8   ~ CH15
+)
+
+# Pre-commands to run before accessing each chip (empty = none)
+# Multiple commands separated by ;
+CHIP_PRE_CMD=(
+    ""    # CB     CONN13 (lo)
+)
+
+# Post-commands to run after accessing each chip (optional, empty = none)
+CHIP_POST_CMD=(
+    ""    # CB     CONN13 (lo)
+)
+
+# ============================================================
+# chip1: CB (CONN13)
+# ============================================================
+CH0_VNOM="5.0";     CH0_NET="V5P0_ALW"
+CH1_VNOM="3.3";     CH1_NET="V3P3_ALW"
+CH2_VNOM="0.75";    CH2_NET="PWR_VDD_MISC_ALW"
+CH3_VNOM="1.8";     CH3_NET="V1P8_ALW"
+CH4_VNOM="1.1";     CH4_NET="PWR_APU_VDDIO_SUS"
+CH5_VNOM="0.75";    CH5_NET="PWR_VDD_MISC_RUN"
+CH6_VNOM="0.78";    CH6_NET="PWR_APU_VDD_MEM_RUN"
+CH7_VNOM="0.8";     CH7_NET="V0P8_PHY2_DVDD"
+CH8_VNOM="0.8";     CH8_NET="V0P8_AVDD"
+CH9_VNOM="0.8";     CH9_NET="V0P8_PHY"
+CH10_VNOM="1.8";    CH10_NET="V1P8_FPGA"
+CH11_VNOM="2.5";    CH11_NET="V2P5_FPGA"
+CH12_VNOM="1.1";    CH12_NET="V1P1_FPGA"
+CH13_VNOM="5.0";    CH13_NET="P5V_STBY"
+CH14_VNOM="3.3";    CH14_NET="P3V3_STBY"
+CH15_VNOM="0.8";    CH15_NET="V0P8_PHY2_AVDD"
@@ -0,0 +1,52 @@
+# Blanton Channel Settings
+# Format: CH<n>_VNOM=voltage  CH<n>_NET=net_name
+#
+# Channel numbering (Script Channel, per Blanton_Margin_List):
+#   ch_global / 8 -> CHIPS index (0~17)
+#   ch_global % 8 -> page within LTC2977 (0~7)
+# One LTC2980 = two LTC2977 (8ch each), controlled via 2 I2C addresses.
+
+# --- SWB transport (added): this LTC2980 sits behind the CB FPGA F3 I2C; reach
+#     it with cb_pmbus, not i2cset. CB_I2C_CH = FPGA I2C channel for this CONN. ---
+TRANSPORT="swb"
+CB_I2C_CH=6
+
+# --- I2C Configuration ---
+
+# Format: "bus:address"  (8 channels per entry / per LTC2977)
+CHIPS=(
+    # chip1: SWB0 (CONN13)
+    "0:0x5C"    # CH0   ~ CH7
+    "0:0x5E"    # CH8   ~ CH15
+)
+
+# Pre-commands to run before accessing each chip (empty = none)
+# Multiple commands separated by ;
+CHIP_PRE_CMD=(
+    ""    # SWB0   CONN13 (lo)
+)
+
+# Post-commands to run after accessing each chip (optional, empty = none)
+CHIP_POST_CMD=(
+    ""    # SWB0   CONN13 (lo)
+)
+
+# ============================================================
+# chip1: SWB0 (CONN13)
+# ============================================================
+CH0_VNOM="0.75";    CH0_NET="P0V75_DVDD_47"
+CH1_VNOM="0.75";    CH1_NET="P0V75_AVDD_47"
+CH2_VNOM="1.5";     CH2_NET="P1V5_AVDD_47"
+CH3_VNOM="0.9";     CH3_NET="P0V9_AVDD_47"
+CH4_VNOM="1.8";     CH4_NET="P1V8_1"
+CH5_VNOM="3.3";     CH5_NET="PVDD3_3V_SYNTH_LDO_A3"
+CH6_VNOM="3.3";     CH6_NET="PVDD3_3V_SYNTH_LDO_B1"
+CH7_VNOM="1.8";     CH7_NET="P1V8_3"
+CH8_VNOM="1.8";     CH8_NET="P1V8_DVDDIO_3"
+CH9_VNOM="0.75";    CH9_NET="P0V75_DVDD_39"
+CH10_VNOM="0.75";   CH10_NET="P0V75_AVDD_39"
+CH11_VNOM="1.5";    CH11_NET="P1V5_AVDD_39"
+CH12_VNOM="0.9";    CH12_NET="P0V9_AVDD_39"
+CH13_VNOM="1.5";    CH13_NET="PVDD1V5_2"
+CH14_VNOM="1.8";    CH14_NET="PVDD1V8_DUT"
+CH15_VNOM="1.2";    CH15_NET="PVDD_MDIO"
@@ -0,0 +1,52 @@
+# Blanton Channel Settings
+# Format: CH<n>_VNOM=voltage  CH<n>_NET=net_name
+#
+# Channel numbering (Script Channel, per Blanton_Margin_List):
+#   ch_global / 8 -> CHIPS index (0~17)
+#   ch_global % 8 -> page within LTC2977 (0~7)
+# One LTC2980 = two LTC2977 (8ch each), controlled via 2 I2C addresses.
+
+# --- SWB transport (added): this LTC2980 sits behind the CB FPGA F3 I2C; reach
+#     it with cb_pmbus, not i2cset. CB_I2C_CH = FPGA I2C channel for this CONN. ---
+TRANSPORT="swb"
+CB_I2C_CH=8
+
+# --- I2C Configuration ---
+
+# Format: "bus:address"  (8 channels per entry / per LTC2977)
+CHIPS=(
+    # chip1: SWB0 (CONN14)
+    "0:0x5E"    # CH0   ~ CH7
+    "0:0x5F"    # CH8   ~ CH15
+)
+
+# Pre-commands to run before accessing each chip (empty = none)
+# Multiple commands separated by ;
+CHIP_PRE_CMD=(
+    ""    # SWB0   CONN14 (lo)
+)
+
+# Post-commands to run after accessing each chip (optional, empty = none)
+CHIP_POST_CMD=(
+    ""    # SWB0   CONN14 (lo)
+)
+
+# ============================================================
+# chip1: SWB0 (CONN14)
+# ============================================================
+CH0_VNOM="0.75";    CH0_NET="P0V75_AVDD_7"
+CH1_VNOM="1.5";     CH1_NET="P1V5_AVDD_7"
+CH2_VNOM="0.9";     CH2_NET="P0V9_AVDD_7"
+CH3_VNOM="1.8";     CH3_NET="P1V8_5"
+CH4_VNOM="1.8";     CH4_NET="P1V8_2"
+CH5_VNOM="3.3";     CH5_NET="PVDD3_3V_SYNTH_LDO_B2"
+CH6_VNOM="3.3";     CH6_NET="PVDD3_3V_SYNTH_LDO_A2"
+CH7_VNOM="3.3";     CH7_NET="PVDD3_3V_SYNTH_LDO_A1"
+CH8_VNOM="1.5";     CH8_NET="PVDD1V5_TSC"
+CH9_VNOM="1.5";     CH9_NET="PVDD1V5_ANLG"
+CH10_VNOM="-";      CH10_NET="NC"
+CH11_VNOM="-";      CH11_NET="NC"
+CH12_VNOM="1.5";    CH12_NET="PVDD1V5_1"
+CH13_VNOM="-";      CH13_NET="NC"
+CH14_VNOM="1.8";    CH14_NET="P1V8_DVDDIO_1"
+CH15_VNOM="0.75";   CH15_NET="P0V75_DVDD_7"
@@ -0,0 +1,52 @@
+# Blanton Channel Settings
+# Format: CH<n>_VNOM=voltage  CH<n>_NET=net_name
+#
+# Channel numbering (Script Channel, per Blanton_Margin_List):
+#   ch_global / 8 -> CHIPS index (0~17)
+#   ch_global % 8 -> page within LTC2977 (0~7)
+# One LTC2980 = two LTC2977 (8ch each), controlled via 2 I2C addresses.
+
+# --- SWB transport (added): this LTC2980 sits behind the CB FPGA F3 I2C; reach
+#     it with cb_pmbus, not i2cset. CB_I2C_CH = FPGA I2C channel for this CONN. ---
+TRANSPORT="swb"
+CB_I2C_CH=6
+
+# --- I2C Configuration ---
+
+# Format: "bus:address"  (8 channels per entry / per LTC2977)
+CHIPS=(
+    # chip1: SWB0 (CONN15)
+    "0:0x62"    # CH0   ~ CH7
+    "0:0x63"    # CH8   ~ CH15
+)
+
+# Pre-commands to run before accessing each chip (empty = none)
+# Multiple commands separated by ;
+CHIP_PRE_CMD=(
+    ""    # SWB0   CONN15 (lo)
+)
+
+# Post-commands to run after accessing each chip (optional, empty = none)
+CHIP_POST_CMD=(
+    ""    # SWB0   CONN15 (lo)
+)
+
+# ============================================================
+# chip1: SWB0 (CONN15)
+# ============================================================
+CH0_VNOM="1.5";     CH0_NET="P1V5_AVDD_55"
+CH1_VNOM="0.9";     CH1_NET="P0V9_AVDD_55"
+CH2_VNOM="0.75";    CH2_NET="P0V75_DVDD_63"
+CH3_VNOM="0.75";    CH3_NET="P0V75_AVDD_63"
+CH4_VNOM="1.5";     CH4_NET="P1V5_AVDD_63"
+CH5_VNOM="0.9";     CH5_NET="P0V9_AVDD_63"
+CH6_VNOM="3.3";     CH6_NET="PVDD3_3V_SYNTH_LDO_B3"
+CH7_VNOM="1.5";     CH7_NET="PVDD1V5_3"
+CH8_VNOM="0.85";    CH8_NET="P0V85_STBY"
+CH9_VNOM="1.8";     CH9_NET="P1V8_STBY"
+CH10_VNOM="-";      CH10_NET="NC"
+CH11_VNOM="3.3";    CH11_NET="P3V3_STBY"
+CH12_VNOM="0.9";    CH12_NET="PVDD0V9_2"
+CH13_VNOM="0.75";   CH13_NET="P0V75_DVDD_55"
+CH14_VNOM="0.75";   CH14_NET="P0V75_AVDD_55"
+CH15_VNOM="1.8";    CH15_NET="P1V8_DVDDIO_4"
@@ -0,0 +1,52 @@
+# Blanton Channel Settings
+# Format: CH<n>_VNOM=voltage  CH<n>_NET=net_name
+#
+# Channel numbering (Script Channel, per Blanton_Margin_List):
+#   ch_global / 8 -> CHIPS index (0~17)
+#   ch_global % 8 -> page within LTC2977 (0~7)
+# One LTC2980 = two LTC2977 (8ch each), controlled via 2 I2C addresses.
+
+# --- SWB transport (added): this LTC2980 sits behind the CB FPGA F3 I2C; reach
+#     it with cb_pmbus, not i2cset. CB_I2C_CH = FPGA I2C channel for this CONN. ---
+TRANSPORT="swb"
+CB_I2C_CH=8
+
+# --- I2C Configuration ---
+
+# Format: "bus:address"  (8 channels per entry / per LTC2977)
+CHIPS=(
+    # chip1: SWB0 (CONN16)
+    "0:0x64"    # CH0   ~ CH7
+    "0:0x65"    # CH8   ~ CH15
+)
+
+# Pre-commands to run before accessing each chip (empty = none)
+# Multiple commands separated by ;
+CHIP_PRE_CMD=(
+    ""    # SWB0   CONN16 (lo)
+)
+
+# Post-commands to run after accessing each chip (optional, empty = none)
+CHIP_POST_CMD=(
+    ""    # SWB0   CONN16 (lo)
+)
+
+# ============================================================
+# chip1: SWB0 (CONN16)
+# ============================================================
+CH0_VNOM="1.5";     CH0_NET="PVDD1V5_0"
+CH1_VNOM="1.8";     CH1_NET="P1V8_4"
+CH2_VNOM="3.3";     CH2_NET="PVDD3_3V_SYNTH_LDO_B5"
+CH3_VNOM="3.3";     CH3_NET="PVDD3_3V_SYNTH_LDO_A5"
+CH4_VNOM="3.3";     CH4_NET="PVDD3_3V_SYNTH_LDO_B4"
+CH5_VNOM="3.3";     CH5_NET="PVDD3_3V_SYNTH_LDO_A4"
+CH6_VNOM="3.3";     CH6_NET="P3V3"
+CH7_VNOM="0.8";     CH7_NET="PVDD0_8V_T3"
+CH8_VNOM="0.75";    CH8_NET="P0V75_DVDD_1"
+CH9_VNOM="0.75";    CH9_NET="P0V75_AVDD_1"
+CH10_VNOM="1.5";    CH10_NET="P1V5_AVDD_1"
+CH11_VNOM="0.9";    CH11_NET="P0V9_AVDD_1"
+CH12_VNOM="0.9";    CH12_NET="PVDD0V9_0"
+CH13_VNOM="0.9";    CH13_NET="PVDD0V9_1"
+CH14_VNOM="0.9";    CH14_NET="PVDD0V9_3"
+CH15_VNOM="1.2";    CH15_NET="PVDD1V2_T3"
@@ -0,0 +1,52 @@
+# Blanton Channel Settings
+# Format: CH<n>_VNOM=voltage  CH<n>_NET=net_name
+#
+# Channel numbering (Script Channel, per Blanton_Margin_List):
+#   ch_global / 8 -> CHIPS index (0~17)
+#   ch_global % 8 -> page within LTC2977 (0~7)
+# One LTC2980 = two LTC2977 (8ch each), controlled via 2 I2C addresses.
+
+# --- SWB transport (added): this LTC2980 sits behind the CB FPGA F3 I2C; reach
+#     it with cb_pmbus, not i2cset. CB_I2C_CH = FPGA I2C channel for this CONN. ---
+TRANSPORT="swb"
+CB_I2C_CH=7
+
+# --- I2C Configuration ---
+
+# Format: "bus:address"  (8 channels per entry / per LTC2977)
+CHIPS=(
+    # chip1: SWB1 (CONN13)
+    "1:0x5C"    # CH0   ~ CH7
+    "1:0x5D"    # CH8   ~ CH15
+)
+
+# Pre-commands to run before accessing each chip (empty = none)
+# Multiple commands separated by ;
+CHIP_PRE_CMD=(
+    ""    # SWB1   CONN13 (lo)
+)
+
+# Post-commands to run after accessing each chip (optional, empty = none)
+CHIP_POST_CMD=(
+    ""    # SWB1   CONN13 (lo)
+)
+
+# ============================================================
+# chip1: SWB1 (CONN13)
+# ============================================================
+CH0_VNOM="0.75";    CH0_NET="P0V75_DVDD_47"
+CH1_VNOM="0.75";    CH1_NET="P0V75_AVDD_47"
+CH2_VNOM="1.5";     CH2_NET="P1V5_AVDD_47"
+CH3_VNOM="0.9";     CH3_NET="P0V9_AVDD_47"
+CH4_VNOM="1.8";     CH4_NET="P1V8_1"
+CH5_VNOM="3.3";     CH5_NET="PVDD3_3V_SYNTH_LDO_A3"
+CH6_VNOM="3.3";     CH6_NET="PVDD3_3V_SYNTH_LDO_B1"
+CH7_VNOM="1.8";     CH7_NET="P1V8_3"
+CH8_VNOM="1.8";     CH8_NET="P1V8_DVDDIO_3"
+CH9_VNOM="0.75";    CH9_NET="P0V75_DVDD_39"
+CH10_VNOM="0.75";   CH10_NET="P0V75_AVDD_39"
+CH11_VNOM="1.5";    CH11_NET="P1V5_AVDD_39"
+CH12_VNOM="0.9";    CH12_NET="P0V9_AVDD_39"
+CH13_VNOM="1.5";    CH13_NET="PVDD1V5_2"
+CH14_VNOM="1.8";    CH14_NET="PVDD1V8_DUT"
+CH15_VNOM="1.2";    CH15_NET="PVDD_MDIO"
@@ -0,0 +1,52 @@
+# Blanton Channel Settings
+# Format: CH<n>_VNOM=voltage  CH<n>_NET=net_name
+#
+# Channel numbering (Script Channel, per Blanton_Margin_List):
+#   ch_global / 8 -> CHIPS index (0~17)
+#   ch_global % 8 -> page within LTC2977 (0~7)
+# One LTC2980 = two LTC2977 (8ch each), controlled via 2 I2C addresses.
+
+# --- SWB transport (added): this LTC2980 sits behind the CB FPGA F3 I2C; reach
+#     it with cb_pmbus, not i2cset. CB_I2C_CH = FPGA I2C channel for this CONN. ---
+TRANSPORT="swb"
+CB_I2C_CH=9
+
+# --- I2C Configuration ---
+
+# Format: "bus:address"  (8 channels per entry / per LTC2977)
+CHIPS=(
+    # chip1: SWB1 (CONN14)
+    "1:0x5E"    # CH0   ~ CH7
+    "1:0x5F"    # CH8   ~ CH15
+)
+
+# Pre-commands to run before accessing each chip (empty = none)
+# Multiple commands separated by ;
+CHIP_PRE_CMD=(
+    ""    # SWB1   CONN14 (lo)
+)
+
+# Post-commands to run after accessing each chip (optional, empty = none)
+CHIP_POST_CMD=(
+    ""    # SWB1   CONN14 (lo)
+)
+
+# ============================================================
+# chip1: SWB1 (CONN14)
+# ============================================================
+CH0_VNOM="0.75";    CH0_NET="P0V75_AVDD_7"
+CH1_VNOM="1.5";     CH1_NET="P1V5_AVDD_7"
+CH2_VNOM="0.9";     CH2_NET="P0V9_AVDD_7"
+CH3_VNOM="1.8";     CH3_NET="P1V8_5"
+CH4_VNOM="1.8";     CH4_NET="P1V8_2"
+CH5_VNOM="3.3";     CH5_NET="PVDD3_3V_SYNTH_LDO_B2"
+CH6_VNOM="3.3";     CH6_NET="PVDD3_3V_SYNTH_LDO_A2"
+CH7_VNOM="3.3";     CH7_NET="PVDD3_3V_SYNTH_LDO_A1"
+CH8_VNOM="1.5";     CH8_NET="PVDD1V5_TSC"
+CH9_VNOM="1.5";     CH9_NET="PVDD1V5_ANLG"
+CH10_VNOM="-";      CH10_NET="NC"
+CH11_VNOM="-";      CH11_NET="NC"
+CH12_VNOM="1.5";    CH12_NET="PVDD1V5_1"
+CH13_VNOM="-";      CH13_NET="NC"
+CH14_VNOM="1.8";    CH14_NET="P1V8_DVDDIO_1"
+CH15_VNOM="0.75";   CH15_NET="P0V75_DVDD_7"
@@ -0,0 +1,52 @@
+# Blanton Channel Settings
+# Format: CH<n>_VNOM=voltage  CH<n>_NET=net_name
+#
+# Channel numbering (Script Channel, per Blanton_Margin_List):
+#   ch_global / 8 -> CHIPS index (0~17)
+#   ch_global % 8 -> page within LTC2977 (0~7)
+# One LTC2980 = two LTC2977 (8ch each), controlled via 2 I2C addresses.
+
+# --- SWB transport (added): this LTC2980 sits behind the CB FPGA F3 I2C; reach
+#     it with cb_pmbus, not i2cset. CB_I2C_CH = FPGA I2C channel for this CONN. ---
+TRANSPORT="swb"
+CB_I2C_CH=7
+
+# --- I2C Configuration ---
+
+# Format: "bus:address"  (8 channels per entry / per LTC2977)
+CHIPS=(
+    # chip1: SWB1 (CONN15)
+    "1:0x62"    # CH0   ~ CH7
+    "1:0x63"    # CH8   ~ CH15
+)
+
+# Pre-commands to run before accessing each chip (empty = none)
+# Multiple commands separated by ;
+CHIP_PRE_CMD=(
+    ""    # SWB1   CONN15 (lo)
+)
+
+# Post-commands to run after accessing each chip (optional, empty = none)
+CHIP_POST_CMD=(
+    ""    # SWB1   CONN15 (lo)
+)
+
+# ============================================================
+# chip1: SWB1 (CONN15)
+# ============================================================
+CH0_VNOM="1.5";     CH0_NET="P1V5_AVDD_55"
+CH1_VNOM="0.9";     CH1_NET="P0V9_AVDD_55"
+CH2_VNOM="0.75";    CH2_NET="P0V75_DVDD_63"
+CH3_VNOM="0.75";    CH3_NET="P0V75_AVDD_63"
+CH4_VNOM="1.5";     CH4_NET="P1V5_AVDD_63"
+CH5_VNOM="0.9";     CH5_NET="P0V9_AVDD_63"
+CH6_VNOM="3.3";     CH6_NET="PVDD3_3V_SYNTH_LDO_B3"
+CH7_VNOM="1.5";     CH7_NET="PVDD1V5_3"
+CH8_VNOM="0.85";    CH8_NET="P0V85_STBY"
+CH9_VNOM="1.8";     CH9_NET="P1V8_STBY"
+CH10_VNOM="-";      CH10_NET="NC"
+CH11_VNOM="3.3";    CH11_NET="P3V3_STBY"
+CH12_VNOM="0.9";    CH12_NET="PVDD0V9_2"
+CH13_VNOM="0.75";   CH13_NET="P0V75_DVDD_55"
+CH14_VNOM="0.75";   CH14_NET="P0V75_AVDD_55"
+CH15_VNOM="1.8";    CH15_NET="P1V8_DVDDIO_4"
@@ -0,0 +1,52 @@
+# Blanton Channel Settings
+# Format: CH<n>_VNOM=voltage  CH<n>_NET=net_name
+#
+# Channel numbering (Script Channel, per Blanton_Margin_List):
+#   ch_global / 8 -> CHIPS index (0~17)
+#   ch_global % 8 -> page within LTC2977 (0~7)
+# One LTC2980 = two LTC2977 (8ch each), controlled via 2 I2C addresses.
+
+# --- SWB transport (added): this LTC2980 sits behind the CB FPGA F3 I2C; reach
+#     it with cb_pmbus, not i2cset. CB_I2C_CH = FPGA I2C channel for this CONN. ---
+TRANSPORT="swb"
+CB_I2C_CH=9
+
+# --- I2C Configuration ---
+
+# Format: "bus:address"  (8 channels per entry / per LTC2977)
+CHIPS=(
+    # chip1: SWB1 (CONN16)
+    "1:0x64"    # CH0   ~ CH7
+    "1:0x65"    # CH8   ~ CH15
+)
+
+# Pre-commands to run before accessing each chip (empty = none)
+# Multiple commands separated by ;
+CHIP_PRE_CMD=(
+    ""    # SWB1   CONN16 (lo)
+)
+
+# Post-commands to run after accessing each chip (optional, empty = none)
+CHIP_POST_CMD=(
+    ""    # SWB1   CONN16 (lo)
+)
+
+# ============================================================
+# chip1: SWB1 (CONN16)
+# ============================================================
+CH0_VNOM="1.5";     CH0_NET="PVDD1V5_0"
+CH1_VNOM="1.8";     CH1_NET="P1V8_4"
+CH2_VNOM="3.3";     CH2_NET="PVDD3_3V_SYNTH_LDO_B5"
+CH3_VNOM="3.3";     CH3_NET="PVDD3_3V_SYNTH_LDO_A5"
+CH4_VNOM="3.3";     CH4_NET="PVDD3_3V_SYNTH_LDO_B4"
+CH5_VNOM="3.3";     CH5_NET="PVDD3_3V_SYNTH_LDO_A4"
+CH6_VNOM="3.3";     CH6_NET="P3V3"
+CH7_VNOM="0.8";     CH7_NET="PVDD0_8V_T3"
+CH8_VNOM="0.75";    CH8_NET="P0V75_DVDD_1"
+CH9_VNOM="0.75";    CH9_NET="P0V75_AVDD_1"
+CH10_VNOM="1.5";    CH10_NET="P1V5_AVDD_1"
+CH11_VNOM="0.9";    CH11_NET="P0V9_AVDD_1"
+CH12_VNOM="0.9";    CH12_NET="PVDD0V9_0"
+CH13_VNOM="0.9";    CH13_NET="PVDD0V9_1"
+CH14_VNOM="0.9";    CH14_NET="PVDD0V9_3"
+CH15_VNOM="1.2";    CH15_NET="PVDD1V2_T3"
@@ -0,0 +1,444 @@
+#!/usr/bin/env bash
+# =============================================================================
+# blanton_cb_i2c.sh  --  CB FPGA (F3) I2C / PMBus over the OpenCores I2C master
+# =============================================================================
+# Version History:
+#   V0.1.0  2026-06-16  CB sibling of blanton_icb_i2c.sh. Same OpenCores I2C
+#                       handshake, but the I2C block lives in CB FPGA *Function 3*
+#                       register space (base 0x300, stride 0x20, Ch0..Ch17), and
+#                       is reached via cb_fpga 3 <off> (direct PCIe BAR -> .3/resource0).
+# =============================================================================
+#
+# IMPORTANT (vs the hand-written cb_fpga.md pcimem commands):
+#   * The CB I2C channels are on PCI **Function 3**, so the sysfs file is
+#     .../0000:02:00.3/resource0  (NOT .0). cb_fpga 3 uses FUNCT3_RES for this.
+#   * This tool uses **Repeated START** for reads (write reg pointer with WR only,
+#     no STOP, then Sr + slave|R) so it works for the SMBus/PMBus parts (VRM,
+#     EFUSE) as well as plain register parts. STOP+START only works for the latter.
+#   * Slave addresses are 7-bit here. The spec lists 8-bit pairs (e.g. MAX31790
+#     "0x40/0x41" -> 7-bit 0x20; TCA9546 "0xE8/0xE9" -> 7-bit 0x74). Divide by 2.
+#
+# CB FPGA F3 I2C channels (base 0x300, stride 0x20) -- 7-bit addrs in (...):
+#   Ch0  0x300  SWB_0: TCA9546 mux (0x74), M0.C0 temp sensor, ...
+#   Ch1  0x320  SWB_1: TCA9546 mux (0x74), ...
+#   Ch2  0x340  SWB_0: SWB_FPGA (0x40), IO Exp PCA9555 (0x24), ...
+#   Ch3  0x360  SWB_1: SWB_FPGA (0x40), PCA9555 (0x24), ...
+#   Ch4  0x380  SWB_0: M1 TCA9546 mux (0x74), Clk Gen SI5..., ...
+#   Ch5  0x3A0  SWB_1: M1 TCA9546 mux (0x74), ...
+#   Ch6  0x3C0  SWB_0: VRM M29816 (0x20), VRM M2985B (0x21), ...   [PMBus]
+#   Ch7  0x3E0  SWB_1: VRM M29816 (0x20), VRM M2985B (0x21), ...   [PMBus]
+#   Ch8  0x400  SWB_0: VRM M2985B (0x25), M2985B (0x26), ...       [PMBus]
+#   Ch9  0x420  SWB_1: VRM M2985B (0x25), M2985B (0x26), ...       [PMBus]
+#   Ch10 0x440  M0 TCA9543 mux (0x70), M0.C0 Clk Buf 9DBL0452, ...
+#   Ch11 0x460  Fan Ctrl MAX31790 (0x20)
+#   Ch12 0x480  ADC leakage ADC128D818 (0x1F)
+#   Ch13 0x4A0  NFC SM-MFAD4-C02 (0x28)
+#   Ch14 0x4C0  M1 TCA9543 mux (0x70), M1.C0 QSFP28.P1 xcvr, ...
+#   Ch15 0x4E0  Fan1/2 EFUSE STEF48H28 (0x10/0x11), ...           [PMBus-ish]
+#   Ch16 0x500  1G PHY I210 Ethernet ctrlr (0x49)
+#   Ch17 0x520  Chassis EEPROM (0x28..0x29), Diag EEPROM (0x2B), ...
+#   (slave 7-bit addrs derived from the 8-bit pairs in the register map; verify
+#    against the device datasheet / your board before driving writes.)
+#
+# Per-channel register layout (offset from channel base):
+#   +0x00 I2C_PRSCL_LO  +0x04 I2C_PRSCL_HI  +0x08 I2C_CTRL (bit7 MOD_EN)
+#   +0x0C I2C_TX(W)/I2C_RX(R)               +0x10 I2C_CMD(W)/I2C_STAT(R)
+#   +0x14 I2C_MUX_SEL   +0x18 I2C_RST (0xD) +0x1C SEM
+# CMD : STA=0x80 STO=0x40 RD=0x20 WR=0x10 ACK=0x08(1=NACK) IACK=0x01
+# STAT: RX_ACK=0x80(1=NACK) BUSY=0x40 ARB_LOST=0x20 TIP=0x02 INT_FLAG=0x01
+# Prescale = (in_clk/(5*scl))-1 @75MHz: 0x88=100kHz, 0x24=400kHz
+#
+# Usage:
+#   source blanton_fpga_pcimem.sh      # provides cb_fpga / fpga_debug
+#   source blanton_cb_i2c.sh
+#   cb_i2c_init 11                     # Ch11 (Fan Ctrl) @100kHz
+#   cb_i2c_scan 11
+#   cb_i2c_read  11 0x20 0x01 1        # MAX31790 (7-bit 0x20) reg 0x01
+#   cb_pmbus_read 6 0x20 0x8B 2        # Ch6 VRM READ_VOUT
+# =============================================================================
+
+# --- Pull in the register-access backend (cb_fpga) if not present -----------
+if ! declare -F cb_fpga >/dev/null 2>&1; then
+    _CBI2C_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
+    if [ -n "$_CBI2C_DIR" ] && [ -f "$_CBI2C_DIR/blanton_fpga_pcimem.sh" ]; then
+        # shellcheck source=/dev/null
+        source "$_CBI2C_DIR/blanton_fpga_pcimem.sh"
+    else
+        echo -e "[\033[33mWARN\033[0m] blanton_cb_i2c.sh: cb_fpga() not found." >&2
+        echo    "       source blanton_fpga_pcimem.sh first (provides cb_fpga)." >&2
+    fi
+fi
+
+# === CB I2C geometry =========================================================
+CBI2C_FN=3                 # CB PCI Function hosting the I2C block
+CBI2C_BASE=0x300           # channel 0 base offset (relative to F3 resource0)
+CBI2C_CH_STRIDE=0x20
+CBI2C_CH_MAX=17
+
+# Per-channel register offsets
+_CBI2C_PRSCL_LO=0x00
+_CBI2C_PRSCL_HI=0x04
+_CBI2C_CTRL=0x08
+_CBI2C_TX=0x0C
+_CBI2C_RX=0x0C
+_CBI2C_CMD=0x10
+_CBI2C_STAT=0x10
+_CBI2C_MUX_SEL=0x14
+_CBI2C_RST=0x18
+_CBI2C_SEM=0x1C
+
+# I2C_CTRL_REG / CMD / STAT bits
+_CBI2C_EN=0x80
+_CBI2C_STA=0x80
+_CBI2C_STO=0x40
+_CBI2C_RD=0x20
+_CBI2C_WR=0x10
+_CBI2C_NACK=0x08
+_CBI2C_RXACK=0x80
+_CBI2C_TIP=0x02
+_CBI2C_RST_VAL=0xD
+
+# Defaults
+CB_I2C_PRESCALE_LO="${CB_I2C_PRESCALE_LO:-0x88}"   # 100 kHz @ 75 MHz
+CB_I2C_PRESCALE_HI="${CB_I2C_PRESCALE_HI:-0x00}"
+CB_I2C_AUTO_INIT="${CB_I2C_AUTO_INIT:-1}"
+CB_I2C_TIP_POLL_MAX="${CB_I2C_TIP_POLL_MAX:-100}"
+
+# --- External I2C-mux RESET control (verified on COM34, 2026-06-16) ----------
+# The TCA9543 muxes on CH10 (M0) and CH14 (M1) have an FPGA-driven, active-low
+# RESET line. On power-up / FPGA reload the FPGA holds them in reset, so 0x70
+# does NOT ACK on the root bus and all downstream legs are unreachable.
+#
+# The control is a GLOBAL register in CB FPGA *Function 0*, offset 0x7D4
+# (I2C_MUX_RST_REG) -- NOT the per-channel I2C_MUX_SEL_REG (+0x14) which is a
+# device-select and does nothing to the RESET pin. Per bit: 1 = release,
+# 0 = hold-in-reset. Observed default 0xDD (bit1=CH10 mux, bit5=CH14 mux held).
+# Writing 0xFF releases all external muxes (normal operating state). This value
+# is volatile and is lost on the next power cycle / FPGA reload.
+CBI2C_MUX_RST_FN="${CBI2C_MUX_RST_FN:-0}"
+CBI2C_MUX_RST_OFF="${CBI2C_MUX_RST_OFF:-0x7D4}"
+
+# Channels whose root bus carries an external mux that hangs off the RESET reg.
+# CH10/CH14 = TCA9543; CH0/1/4/5 = TCA9546 (SWB/M1) per the channel map above.
+CBI2C_MUX_CHANNELS="${CBI2C_MUX_CHANNELS:-0 1 4 5 10 14}"
+
+# Auto-release external mux RESET before scanning / mux-writing a mux channel.
+CB_I2C_AUTO_MUX_RST="${CB_I2C_AUTO_MUX_RST:-1}"
+
+# --- Single FPGA register read/write via cb_fpga <fn> <off> [data] ----------
+# _cbi2c_reg <abs_offset> [data]   data present = write, absent = read (echo hex)
+_cbi2c_reg() {
+    local off="$1" data="${2:-}"
+    if [ -n "$data" ]; then cb_fpga "$CBI2C_FN" "$off" "$data"; else cb_fpga "$CBI2C_FN" "$off"; fi
+}
+
+# Channel base absolute offset
+_cbi2c_chan_base() {
+    local ch="$1"
+    if (( ch < 0 || ch > CBI2C_CH_MAX )); then
+        echo "blanton_cb_i2c: ch must be 0..$CBI2C_CH_MAX" >&2; return 1
+    fi
+    printf '0x%X' $(( CBI2C_BASE + ch * CBI2C_CH_STRIDE ))
+}
+
+# Normalize a register read-back to a number string ("0x...." -> 0x....)
+_cbi2c_num() { local v="$1"; [[ "$v" =~ (0[xX][0-9a-fA-F]+) ]] && echo "${BASH_REMATCH[1]}" || echo "0"; }
+
+# Write CMD then poll STAT (same offset) until TIP clears; echo final status hex
+_cbi2c_cmd_wait() {
+    local cmd_off="$1" cmd_val="$2" i status
+    _cbi2c_reg "$cmd_off" "$cmd_val" >/dev/null
+    for (( i=0; i<CB_I2C_TIP_POLL_MAX; i++ )); do
+        status=$(_cbi2c_num "$(_cbi2c_reg "$cmd_off")")
+        if (( (status & _CBI2C_TIP) == 0 )); then
+            printf '0x%X' "$status"; return 0
+        fi
+    done
+    echo -e "[\033[31mERR\033[0m] CB I2C TIP timeout (status=$status)" >&2
+    printf '0x%X' "${status:-0}"; return 1
+}
+
+# Check RX_ACK in status (bit7). 0 = ACK, 1 = NACK -> return 1
+_cbi2c_check_ack() {
+    local status; status=$(_cbi2c_num "$1")
+    (( (status & _CBI2C_RXACK) != 0 )) && return 1 || return 0
+}
+
+# === Public: init / reset / semaphore / mux-sel =============================
+
+# cb_i2c_init <ch> [prescale_lo] [prescale_hi]
+cb_i2c_init() {
+    [[ $# -lt 1 ]] && { echo "Usage: cb_i2c_init <ch> [prescale_lo] [prescale_hi]"; return 1; }
+    local ch="$1" lo="${2:-$CB_I2C_PRESCALE_LO}" hi="${3:-$CB_I2C_PRESCALE_HI}" base
+    base=$(_cbi2c_chan_base "$ch") || return 1
+    _cbi2c_reg "$(printf '0x%X' $((base + _CBI2C_CTRL)))"     0x00  >/dev/null  # disable
+    _cbi2c_reg "$(printf '0x%X' $((base + _CBI2C_PRSCL_LO)))" "$lo" >/dev/null
+    _cbi2c_reg "$(printf '0x%X' $((base + _CBI2C_PRSCL_HI)))" "$hi" >/dev/null
+    _cbi2c_reg "$(printf '0x%X' $((base + _CBI2C_CTRL)))"     "$_CBI2C_EN" >/dev/null # enable
+    return 0
+}
+
+# cb_i2c_reset <ch>
+cb_i2c_reset() {
+    [[ $# -lt 1 ]] && { echo "Usage: cb_i2c_reset <ch>"; return 1; }
+    local ch="$1" base; base=$(_cbi2c_chan_base "$ch") || return 1
+    _cbi2c_reg "$(printf '0x%X' $((base + _CBI2C_RST)))" "$_CBI2C_RST_VAL" >/dev/null
+    echo "  [RST] ch=$ch local I2C controller reset (0xD)"
+}
+
+# cb_i2c_sem <ch> [status|acquire [val]|release]
+cb_i2c_sem() {
+    [[ $# -lt 1 ]] && { echo "Usage: cb_i2c_sem <ch> [status|acquire [val]|release]"; return 1; }
+    local ch="$1" act="${2:-status}" base off cur
+    base=$(_cbi2c_chan_base "$ch") || return 1
+    off=$(printf '0x%X' $((base + _CBI2C_SEM)))
+    case "$act" in
+        status)
+            cur=$(_cbi2c_num "$(_cbi2c_reg "$off")")
+            (( (cur & 0xFF) == 0 )) && echo "  [SEM] ch=$ch free (0x00)" \
+                                    || printf '  [SEM] ch=%s held (0x%02X)\n' "$ch" $((cur & 0xFF)) ;;
+        acquire)
+            local val="${3:-0x01}"
+            cur=$(_cbi2c_num "$(_cbi2c_reg "$off")")
+            if (( (cur & 0xFF) != 0 )); then
+                printf '  [SEM] ch=%s already held (0x%02X) -- not acquired\n' "$ch" $((cur & 0xFF)); return 1
+            fi
+            _cbi2c_reg "$off" "$val" >/dev/null
+            cur=$(_cbi2c_num "$(_cbi2c_reg "$off")")
+            (( (cur & 0xFF) != 0 )) && printf '  [SEM] ch=%s acquired (0x%02X)\n' "$ch" $((cur & 0xFF)) \
+                                    || { echo "  [SEM] ch=$ch acquire failed"; return 1; } ;;
+        release)
+            _cbi2c_reg "$off" 0x00 >/dev/null; echo "  [SEM] ch=$ch released (0x00)" ;;
+        *) echo "Usage: cb_i2c_sem <ch> [status|acquire [val]|release]"; return 1 ;;
+    esac
+}
+
+# cb_i2c_muxsel <ch> <dev_sel>  -- write I2C_MUX_SEL_REG (FPGA drives ext mux pins)
+cb_i2c_muxsel() {
+    [[ $# -lt 2 ]] && { echo "Usage: cb_i2c_muxsel <ch> <dev_sel>"; return 1; }
+    local ch="$1" sel="$2" base; base=$(_cbi2c_chan_base "$ch") || return 1
+    _cbi2c_reg "$(printf '0x%X' $((base + _CBI2C_MUX_SEL)))" "$sel" >/dev/null
+    printf '  [MUXSEL] ch=%s DEV_SEL <= 0x%02X\n' "$ch" $((sel & 0xFF))
+}
+
+# cb_i2c_mux_reset_release  -- de-assert ALL external mux RESET lines (F0 0x7D4 <= 0xFF)
+# Global, not per-channel. Volatile: lost on power cycle / FPGA reload.
+cb_i2c_mux_reset_release() {
+    cb_fpga "$CBI2C_MUX_RST_FN" "$CBI2C_MUX_RST_OFF" 0xFF >/dev/null
+    local rb; rb=$(_cbi2c_num "$(cb_fpga "$CBI2C_MUX_RST_FN" "$CBI2C_MUX_RST_OFF")")
+    printf '  [MUX-RST] I2C_MUX_RST_REG (F%s %s) <= 0xFF (all external muxes released, readback %s)\n' \
+        "$CBI2C_MUX_RST_FN" "$CBI2C_MUX_RST_OFF" "$rb"
+}
+
+# _cbi2c_is_mux_channel <ch>  -- 0 (true) if ch is in CBI2C_MUX_CHANNELS
+_cbi2c_is_mux_channel() {
+    local ch="$1" c
+    for c in $CBI2C_MUX_CHANNELS; do [[ "$c" == "$ch" ]] && return 0; done
+    return 1
+}
+
+# _cbi2c_auto_mux_rst <ch>  -- release external mux RESET if ch is a mux channel
+_cbi2c_auto_mux_rst() {
+    [[ "$CB_I2C_AUTO_MUX_RST" == "1" ]] || return 0
+    _cbi2c_is_mux_channel "$1" || return 0
+    cb_i2c_mux_reset_release
+}
+
+# === Core transfers (Repeated START, SMBus/PMBus compatible) =================
+
+# _cbi2c_xfer_read <ch> <slave7> <reg> <nbytes>   echoes space-separated hex bytes
+_cbi2c_xfer_read() {
+    local ch="$1" slave="$2" reg="$3" n="$4" base tx cmd rx status i last cmdv val out=""
+    base=$(_cbi2c_chan_base "$ch") || return 1
+    tx=$(printf '0x%X' $((base + _CBI2C_TX)))
+    cmd=$(printf '0x%X' $((base + _CBI2C_CMD)))
+    rx=$(printf '0x%X' $((base + _CBI2C_RX)))
+    [[ "$CB_I2C_AUTO_INIT" == "1" ]] && cb_i2c_init "$ch" >/dev/null
+
+    _cbi2c_reg "$tx" "$(printf '0x%X' $(( (slave << 1) & 0xFF )))" >/dev/null
+    status=$(_cbi2c_cmd_wait "$cmd" "$(printf '0x%X' $((_CBI2C_STA | _CBI2C_WR)))")
+    _cbi2c_check_ack "$status" || { echo "ERR: NACK on slave addr (W) 0x$(printf %02X "$slave")" >&2; return 1; }
+
+    _cbi2c_reg "$tx" "$(printf '0x%X' $((reg & 0xFF)))" >/dev/null
+    status=$(_cbi2c_cmd_wait "$cmd" "$(printf '0x%X' $((_CBI2C_WR)))")    # WR only, no STOP
+    _cbi2c_check_ack "$status" || { echo "ERR: NACK on reg 0x$(printf %02X "$reg")" >&2; return 1; }
+
+    _cbi2c_reg "$tx" "$(printf '0x%X' $(( ((slave << 1) | 1) & 0xFF )))" >/dev/null
+    status=$(_cbi2c_cmd_wait "$cmd" "$(printf '0x%X' $((_CBI2C_STA | _CBI2C_WR)))")   # Repeated START
+    _cbi2c_check_ack "$status" || { echo "ERR: NACK on slave addr (R) 0x$(printf %02X "$slave")" >&2; return 1; }
+
+    for (( i=0; i<n; i++ )); do
+        last=$(( i == n-1 ))
+        if (( last )); then cmdv=$(( _CBI2C_RD | _CBI2C_NACK | _CBI2C_STO )); else cmdv=$(( _CBI2C_RD )); fi
+        _cbi2c_cmd_wait "$cmd" "$(printf '0x%X' "$cmdv")" >/dev/null
+        val=$(_cbi2c_num "$(_cbi2c_reg "$rx")")
+        out+="$(printf '0x%02X ' $((val & 0xFF)))"
+    done
+    echo "${out% }"
+}
+
+# _cbi2c_xfer_write <ch> <slave7> <reg> <byte> [byte...]
+_cbi2c_xfer_write() {
+    local ch="$1" slave="$2" reg="$3"; shift 3
+    local base tx cmd status b last cmdv n=$# idx=0
+    [[ $n -lt 1 ]] && { echo "ERR: no data bytes" >&2; return 1; }
+    base=$(_cbi2c_chan_base "$ch") || return 1
+    tx=$(printf '0x%X' $((base + _CBI2C_TX)))
+    cmd=$(printf '0x%X' $((base + _CBI2C_CMD)))
+    [[ "$CB_I2C_AUTO_INIT" == "1" ]] && cb_i2c_init "$ch" >/dev/null
+
+    _cbi2c_reg "$tx" "$(printf '0x%X' $(( (slave << 1) & 0xFF )))" >/dev/null
+    status=$(_cbi2c_cmd_wait "$cmd" "$(printf '0x%X' $((_CBI2C_STA | _CBI2C_WR)))")
+    _cbi2c_check_ack "$status" || { echo "ERR: NACK on slave addr (W) 0x$(printf %02X "$slave")" >&2; return 1; }
+
+    _cbi2c_reg "$tx" "$(printf '0x%X' $((reg & 0xFF)))" >/dev/null
+    status=$(_cbi2c_cmd_wait "$cmd" "$(printf '0x%X' $((_CBI2C_WR)))")
+    _cbi2c_check_ack "$status" || { echo "ERR: NACK on reg 0x$(printf %02X "$reg")" >&2; return 1; }
+
+    for b in "$@"; do
+        idx=$((idx+1)); last=$(( idx == n ))
+        _cbi2c_reg "$tx" "$(printf '0x%X' $(( $((b)) & 0xFF )))" >/dev/null
+        if (( last )); then cmdv=$(( _CBI2C_WR | _CBI2C_STO )); else cmdv=$(( _CBI2C_WR )); fi
+        status=$(_cbi2c_cmd_wait "$cmd" "$(printf '0x%X' "$cmdv")")
+        _cbi2c_check_ack "$status" || { echo "ERR: NACK on data byte #$idx" >&2; return 1; }
+    done
+    return 0
+}
+
+# _cbi2c_xfer_cmd_only <ch> <slave7> <cmd>  -- START+W, cmd byte, STOP (no data)
+_cbi2c_xfer_cmd_only() {
+    local ch="$1" slave="$2" cc="$3" base tx cmd status
+    base=$(_cbi2c_chan_base "$ch") || return 1
+    tx=$(printf '0x%X' $((base + _CBI2C_TX)))
+    cmd=$(printf '0x%X' $((base + _CBI2C_CMD)))
+    [[ "$CB_I2C_AUTO_INIT" == "1" ]] && cb_i2c_init "$ch" >/dev/null
+    _cbi2c_reg "$tx" "$(printf '0x%X' $(( (slave << 1) & 0xFF )))" >/dev/null
+    status=$(_cbi2c_cmd_wait "$cmd" "$(printf '0x%X' $((_CBI2C_STA | _CBI2C_WR)))")
+    _cbi2c_check_ack "$status" || { echo "ERR: NACK on slave addr (W) 0x$(printf %02X "$slave")" >&2; return 1; }
+    _cbi2c_reg "$tx" "$(printf '0x%X' $((cc & 0xFF)))" >/dev/null
+    status=$(_cbi2c_cmd_wait "$cmd" "$(printf '0x%X' $((_CBI2C_WR | _CBI2C_STO)))")
+    _cbi2c_check_ack "$status" || { echo "ERR: NACK on cmd 0x$(printf %02X "$cc")" >&2; return 1; }
+    return 0
+}
+
+# === Public: generic I2C =====================================================
+
+# cb_i2c_read <ch> <slave> <reg> [nbytes]
+cb_i2c_read() {
+    [[ $# -lt 3 ]] && { echo "Usage: cb_i2c_read <ch> <slave> <reg> [nbytes]"; return 1; }
+    local ch="$1" slave=$(( $2 )) reg=$(( $3 )) n="${4:-1}" bytes
+    bytes=$(_cbi2c_xfer_read "$ch" "$slave" "$reg" "$n") || return 1
+    printf '  [I2C-R] ch=%s slave=0x%02X reg=0x%02X => [%s]\n' "$ch" "$slave" "$reg" "$bytes"
+}
+
+# cb_i2c_write <ch> <slave> <reg> <byte> [byte...]
+cb_i2c_write() {
+    [[ $# -lt 4 ]] && { echo "Usage: cb_i2c_write <ch> <slave> <reg> <byte> [byte...]"; return 1; }
+    local ch="$1" slave=$(( $2 )) reg=$(( $3 )); shift 3
+    _cbi2c_xfer_write "$ch" "$slave" "$reg" "$@" || return 1
+    printf '  [I2C-W] ch=%s slave=0x%02X reg=0x%02X <= [%s]\n' "$ch" "$slave" "$reg" "$*"
+}
+
+# cb_i2c_muxwrite <ch> <mux_slave> <ctrl_byte>  -- raw 1-byte write, no reg (TCA954x)
+cb_i2c_muxwrite() {
+    [[ $# -lt 3 ]] && { echo "Usage: cb_i2c_muxwrite <ch> <mux_slave> <ctrl_byte>"; return 1; }
+    local ch="$1" slave=$(( $2 )) val=$(( $3 )) base tx cmd status
+    base=$(_cbi2c_chan_base "$ch") || return 1
+    tx=$(printf '0x%X' $((base + _CBI2C_TX)))
+    cmd=$(printf '0x%X' $((base + _CBI2C_CMD)))
+    [[ "$CB_I2C_AUTO_INIT" == "1" ]] && cb_i2c_init "$ch" >/dev/null
+    _cbi2c_auto_mux_rst "$ch"
+    _cbi2c_reg "$tx" "$(printf '0x%X' $(( (slave << 1) & 0xFF )))" >/dev/null
+    status=$(_cbi2c_cmd_wait "$cmd" "$(printf '0x%X' $((_CBI2C_STA | _CBI2C_WR)))")
+    _cbi2c_check_ack "$status" || { echo "ERR: NACK on mux addr 0x$(printf %02X "$slave")" >&2; return 1; }
+    _cbi2c_reg "$tx" "$(printf '0x%X' $((val & 0xFF)))" >/dev/null
+    status=$(_cbi2c_cmd_wait "$cmd" "$(printf '0x%X' $((_CBI2C_WR | _CBI2C_STO)))")
+    _cbi2c_check_ack "$status" || { echo "ERR: NACK on mux ctrl byte" >&2; return 1; }
+    printf '  [MUX-W] ch=%s mux=0x%02X <= 0x%02X\n' "$ch" "$slave" "$val"
+}
+
+# cb_i2c_scan <ch>  -- probe 0x08..0x77, report slaves that ACK
+cb_i2c_scan() {
+    [[ $# -lt 1 ]] && { echo "Usage: cb_i2c_scan <ch>"; return 1; }
+    local ch="$1" base tx cmd a status found=""
+    base=$(_cbi2c_chan_base "$ch") || return 1
+    tx=$(printf '0x%X' $((base + _CBI2C_TX)))
+    cmd=$(printf '0x%X' $((base + _CBI2C_CMD)))
+    cb_i2c_init "$ch" >/dev/null
+    _cbi2c_auto_mux_rst "$ch"
+    for (( a=0x08; a<=0x77; a++ )); do
+        _cbi2c_reg "$tx" "$(printf '0x%X' $(( (a << 1) & 0xFF )))" >/dev/null
+        status=$(_cbi2c_cmd_wait "$cmd" "$(printf '0x%X' $((_CBI2C_STA | _CBI2C_WR | _CBI2C_STO)))")
+        _cbi2c_check_ack "$status" && found+="$(printf '0x%02X ' "$a")"
+    done
+    [[ -n "$found" ]] && echo "  [SCAN] ch=$ch found: ${found% }" || echo "  [SCAN] ch=$ch no devices"
+}
+
+# === Public: PMBus (== SMBus; command code + Repeated START read) ============
+
+# cb_pmbus_read <ch> <slave> <cmd> [nbytes]   (default 2 bytes, LSB first)
+cb_pmbus_read() {
+    [[ $# -lt 3 ]] && { echo "Usage: cb_pmbus_read <ch> <slave> <cmd> [nbytes]"; return 1; }
+    local ch="$1" slave=$(( $2 )) cc=$(( $3 )) n="${4:-2}" bytes
+    bytes=$(_cbi2c_xfer_read "$ch" "$slave" "$cc" "$n") || return 1
+    if [[ "$n" == "2" ]]; then
+        local b0 b1 word; b0=$(( $(echo "$bytes" | awk '{print $1}') )); b1=$(( $(echo "$bytes" | awk '{print $2}') ))
+        word=$(( b0 | (b1 << 8) ))
+        printf '  [PMB-R] ch=%s slave=0x%02X cmd=0x%02X => 0x%04X  raw=[%s]  linear16=%s\n' \
+            "$ch" "$slave" "$cc" "$word" "$bytes" "$(cb_pmbus_linear16 "$word")"
+    else
+        printf '  [PMB-R] ch=%s slave=0x%02X cmd=0x%02X => [%s]\n' "$ch" "$slave" "$cc" "$bytes"
+    fi
+}
+
+# cb_pmbus_write <ch> <slave> <cmd> [data byte...]   (no byte = send-byte)
+cb_pmbus_write() {
+    [[ $# -lt 3 ]] && { echo "Usage: cb_pmbus_write <ch> <slave> <cmd> [data byte...]"; return 1; }
+    local ch="$1" slave=$(( $2 )) cc=$(( $3 )); shift 3
+    if [[ $# -eq 0 ]]; then
+        _cbi2c_xfer_cmd_only "$ch" "$slave" "$cc" || return 1
+        printf '  [PMB-W] ch=%s slave=0x%02X cmd=0x%02X <= (send-byte)\n' "$ch" "$slave" "$cc"; return 0
+    fi
+    _cbi2c_xfer_write "$ch" "$slave" "$cc" "$@" || return 1
+    printf '  [PMB-W] ch=%s slave=0x%02X cmd=0x%02X <= [%s]\n' "$ch" "$slave" "$cc" "$*"
+}
+
+# cb_pmbus_linear16 <word>
+cb_pmbus_linear16() {
+    local word=$(( $1 & 0xFFFF ))
+    awk -v w="$word" 'BEGIN{
+        e=int(w/2048)%32; if(e>15)e-=32;
+        m=w%2048;        if(m>1023)m-=2048;
+        printf "%.4f", m * (2.0 ^ e);
+    }'
+}
+
+# === Help ====================================================================
+blanton_cb_i2c_help() {
+    echo -e "\033[1mblanton_cb_i2c.sh - CB FPGA (F3) I2C / PMBus over OpenCores I2C master\033[0m"
+    echo ""
+    echo -e "  Backend: \033[36mcb_fpga $CBI2C_FN\033[0m (direct PCIe BAR -> .3/resource0), base 0x300, Ch0..$CBI2C_CH_MAX"
+    echo ""
+    echo -e "\033[1mSetup\033[0m"
+    echo -e "  \033[33mcb_i2c_init\033[0m   <ch> [pre_lo] [pre_hi]   prescale + enable (def 0x88/0x00 = 100kHz)"
+    echo -e "  \033[33mcb_i2c_reset\033[0m  <ch>                     LCL_RST=0xD"
+    echo -e "  \033[33mcb_i2c_sem\033[0m    <ch> [status|acquire [v]|release]"
+    echo -e "  \033[33mcb_i2c_muxsel\033[0m <ch> <dev_sel>           write I2C_MUX_SEL_REG"
+    echo -e "  \033[33mcb_i2c_mux_reset_release\033[0m              de-assert ALL ext mux RESET (F0 0x7D4<=0xFF)"
+    echo ""
+    echo -e "\033[1mGeneric I2C\033[0m"
+    echo -e "  \033[33mcb_i2c_scan\033[0m   <ch>"
+    echo -e "  \033[33mcb_i2c_read\033[0m   <ch> <slave> <reg> [nbytes]"
+    echo -e "  \033[33mcb_i2c_write\033[0m  <ch> <slave> <reg> <byte> [byte...]"
+    echo -e "  \033[33mcb_i2c_muxwrite\033[0m <ch> <mux_slave> <ctrl_byte>  raw 1-byte (TCA954x)"
+    echo ""
+    echo -e "\033[1mPMBus / SMBus\033[0m"
+    echo -e "  \033[33mcb_pmbus_read\033[0m  <ch> <slave> <cmd> [nbytes]     (def 2, LE word + linear16)"
+    echo -e "  \033[33mcb_pmbus_write\033[0m <ch> <slave> <cmd> [byte...]"
+    echo -e "  \033[33mcb_pmbus_linear16\033[0m <word>"
+    echo ""
+    echo -e "  Slave = 7-bit (tool shifts). Spec lists 8-bit pairs -> divide by 2."
+    echo -e "  \033[33mfpga_debug on\033[0m to see every underlying pcimem command."
+}
+
+blanton_cb_i2c_help
@@ -0,0 +1,277 @@
+#!/usr/bin/env bash
+# =============================================================================
+# blanton_fpga_pcimem.sh  --  pcimem backend, sysfs resource file + relative offset
+# =============================================================================
+# Version History:
+#   V1.3.0  2026-06-12  pcimem variant (SONiC hardware). memtool variant: blanton_fpga_memtool.sh
+#                       Version number kept in sync with blanton_fpga_memtool.sh
+#   V1.4.0  2026-06-15  Fix: VSPI window bases pointed at the VSPI-Flash block
+#                            (0x340/0x380/0x3C0/0x400, config-flash channel) so register
+#                            reads returned 0; corrected to the VSPI register block
+#                            (PMC 0x640 / ICB 0x680 / SWB0 0x6C0 / SWB1 0x700)
+#                       Add: _vspi_fnwarn guard - warns when PMC/ICB/SWB are called with
+#                            cb_fpga-style "<fn> <addr>" (a read turning into a write)
+#                       Change: suppress pcimem write stdout noise (mmap/Written lines)
+#                       Docs: comments/help translated to English (ASCII-only for SONiC console)
+#   V1.4.1  2026-06-23  Fix: BDF in example auto-detect was wrong (02:00 vs 04:00); corrected to match the lspci example.
+#   V1.4.2  2026-08-10  Change: FUNCT0..3_RES BDF updated 0000:04:00.x -> 0000:03:00.x (current unit's enumeration).
+#   V1.4.3  2026-08-12  Change: FUNCT0..3_RES BDF updated 0000:03:00.x -> 0000:05:00.x (current unit's enumeration).
+#   V1.4.4  2026-08-12  Change: FUNCT0..3_RES BDF back to 0000:03:00.x for the DUT on COM36.
+#                       NOTE: this BDF is per-unit. Check with
+#                             lspci -Dnn | grep -i fpga     or
+#                             ls -d /sys/bus/pci/devices/0000:*:00.3
+#                       and edit the four lines below if it differs.
+# =============================================================================
+#
+# SONiC hardware has no memtool / devmem, but it has pcimem. pcimem mmaps the PCI
+# sysfs resource file directly and takes "resource file + offset relative to BAR
+# start", not an absolute physical address.
+#
+#   pcimem { sysfile } { offset } [ type*count [ data ] ]
+#     sysfile : sysfs file for the pci resource (e.g. .../resource0)
+#     offset  : offset into pci memory region
+#     type    : [b]yte, [h]alfword, [w]ord, [d]ouble-word
+#     *count  : number of items (w*100 dump 100 words)
+#     data    : data to be written
+#
+# This tool always accesses as word (w, 32-bit).
+#
+# After sourcing this file the following functions are available:
+#   cb_fpga   <fn:0-3> <addr> [data]
+#   pmc_fpga  <addr> [data]
+#   icb_fpga  <addr> [data]
+#   swb0_fpga <addr> [data]
+#   swb1_fpga <addr> [data]
+#
+# data present = write, absent = read.
+# Usage: source blanton_fpga_pcimem.sh
+
+# === CB FPGA PCIe resource file (sysfs) ===
+# Use lspci -D to find the BDF (domain:bus:dev.fn); resource0 is the sysfs mapping of BAR0.
+# e.g. lspci -Dnn | grep -i fpga   ->  0000:02:00.0 ...
+# memtool variant fills in the BAR value; pcimem variant fills in the resource file
+# path instead (offset becomes relative to BAR).
+FUNCT0_RES=/sys/bus/pci/devices/0000:03:00.0/resource0
+FUNCT1_RES=/sys/bus/pci/devices/0000:03:00.1/resource0
+FUNCT2_RES=/sys/bus/pci/devices/0000:03:00.2/resource0
+FUNCT3_RES=/sys/bus/pci/devices/0000:03:00.3/resource0
+
+# Auto-detect example (uncomment to use; needs the FPGA's BDF prefix):
+# _BDF=0000:02:00
+# FUNCT0_RES=/sys/bus/pci/devices/${_BDF}.0/resource0
+# FUNCT1_RES=/sys/bus/pci/devices/${_BDF}.1/resource0
+# FUNCT2_RES=/sys/bus/pci/devices/${_BDF}.2/resource0
+# FUNCT3_RES=/sys/bus/pci/devices/${_BDF}.3/resource0
+
+# === VSPI window base offset (relative to CB Function 2 resource0 start) ===
+# NOTE: CB.F2 has TWO near-identical VSPI register blocks (see spec register map):
+#   - VSPI-Flash-* @ 0x340/0x380/0x3C0/0x400 -> accesses the remote FPGA's CONFIG FLASH
+#   - VSPI-*       @ 0x640/0x680/0x6C0/0x700 -> accesses the remote FPGA's REGISTERS
+# This tool reads/writes remote registers, so it uses the VSPI-* block (0x640+).
+# The VSPI-Flash bases are kept below (commented) in case flash access is needed later.
+VSPI_PMC_BASE=0x640
+VSPI_ICB_BASE=0x680
+VSPI_SWB0_BASE=0x6C0
+VSPI_SWB1_BASE=0x700
+
+# VSPI-Flash window bases (config-flash access, not register access):
+# VSPI_FLASH_PMC_BASE=0x340
+# VSPI_FLASH_ICB_BASE=0x380
+# VSPI_FLASH_SWB0_BASE=0x3C0
+# VSPI_FLASH_SWB1_BASE=0x400
+
+# === VSPI protocol constants ===
+_VSPI_CMD_STAT=0x00
+_VSPI_ADDR=0x04
+_VSPI_WR_DATA=0x08
+_VSPI_RD_DATA=0x0C
+_VSPI_NEW_CMD=0x01
+_VSPI_READ_W=0x02
+_VSPI_WRITE_W=0x04
+_VSPI_READY_MASK=0x100
+_VSPI_POLL_MAX=200
+
+# === pcimem command ===
+PCIMEM_CMD="${PCIMEM_CMD:-pcimem}"
+
+# === Debug mode (1=print commands AND execute, 0=execute only) ===
+DEBUG_MODE=${DEBUG_MODE:-0}
+
+fpga_debug() {
+    if [ "${1:-}" = "on" ]; then DEBUG_MODE=1
+    elif [ "${1:-}" = "off" ]; then DEBUG_MODE=0
+    else [ "$DEBUG_MODE" = "0" ] && DEBUG_MODE=1 || DEBUG_MODE=0; fi
+    echo -e "[\033[34mINFO\033[0m] DEBUG_MODE=$DEBUG_MODE"
+}
+
+# Wrapper: debug mode prints command (to stderr) AND executes, normal mode executes only.
+# On read, returns the parsed hex value (stripping pcimem's mmap noise).
+# Usage: _pcimem <sysfile> <offset> [data]   (data present = write, absent = read)
+_pcimem() {
+    local sysfile="$1" offset="$2" data="${3:-}"
+    if [[ -n "$data" ]]; then
+        [ "$DEBUG_MODE" = "1" ] && \
+            echo -e "\033[90m[DEBG] $PCIMEM_CMD $sysfile $offset w $data\033[0m" >&2
+        # Write output (opened / Target offset / mmap / Written...readback) is never
+        # parsed -> drop stdout noise; keep stderr so real errors still surface.
+        $PCIMEM_CMD "$sysfile" "$offset" w "$data" >/dev/null
+    else
+        [ "$DEBUG_MODE" = "1" ] && \
+            echo -e "\033[90m[DEBG] $PCIMEM_CMD $sysfile $offset w\033[0m" >&2
+        # pcimem read prints mmap info + "Value at offset ...: 0xXXXX";
+        # take the last 0x... token as the actual read-back value.
+        $PCIMEM_CMD "$sysfile" "$offset" w | grep -oiE '0x[0-9a-f]+' | tail -1
+    fi
+}
+
+# --- Internal VSPI helpers (all hang off CB Function 2's resource0) ---
+
+_vspi_read() {
+    local win_off="$1" remote_offset="$2"
+    local cmd_off add_off rd_off addr_val status i
+
+    cmd_off=$(printf '0x%X' $(( win_off + _VSPI_CMD_STAT )))
+    add_off=$(printf '0x%X' $(( win_off + _VSPI_ADDR )))
+    rd_off=$(printf '0x%X' $(( win_off + _VSPI_RD_DATA )))
+    addr_val=$(printf '0x%08X' $(( (0x0 << 20) | (remote_offset & 0xFFFFF) )))
+
+    _pcimem "$FUNCT2_RES" "$add_off" "$addr_val"
+    _pcimem "$FUNCT2_RES" "$cmd_off" $(printf '0x%X' $(( _VSPI_NEW_CMD | _VSPI_READ_W )))
+
+    for (( i=0; i<_VSPI_POLL_MAX; i++ )); do
+        status=$(_pcimem "$FUNCT2_RES" "$cmd_off")
+        if (( ( ${status:-0} & _VSPI_READY_MASK) != 0 )); then
+            _pcimem "$FUNCT2_RES" "$rd_off"
+            return 0
+        fi
+    done
+    echo "ERROR: VSPI read timeout @ offset $remote_offset" >&2
+    return 1
+}
+
+_vspi_write() {
+    local win_off="$1" remote_offset="$2" data="$3"
+    local cmd_off add_off wr_off addr_val status i
+
+    cmd_off=$(printf '0x%X' $(( win_off + _VSPI_CMD_STAT )))
+    add_off=$(printf '0x%X' $(( win_off + _VSPI_ADDR )))
+    wr_off=$(printf '0x%X' $(( win_off + _VSPI_WR_DATA )))
+    addr_val=$(printf '0x%08X' $(( (0x0 << 20) | (remote_offset & 0xFFFFF) )))
+
+    _pcimem "$FUNCT2_RES" "$wr_off" "$data"
+    _pcimem "$FUNCT2_RES" "$add_off" "$addr_val"
+    _pcimem "$FUNCT2_RES" "$cmd_off" $(printf '0x%X' $(( _VSPI_NEW_CMD | _VSPI_WRITE_W )))
+
+    for (( i=0; i<_VSPI_POLL_MAX; i++ )); do
+        status=$(_pcimem "$FUNCT2_RES" "$cmd_off")
+        if (( ( ${status:-0} & _VSPI_READY_MASK) != 0 )); then
+            return 0
+        fi
+    done
+    echo "ERROR: VSPI write timeout @ offset $remote_offset" >&2
+    return 1
+}
+
+# Guard: PMC/ICB/SWB are single-function; signature is <addr> [data], NO fn arg.
+# Common pitfall: using cb_fpga's "<fn> <addr>" form -> 2nd arg becomes data, a read
+# turns into a write. If addr is 0~3 (looks like fn) AND data is given, warn and
+# confirm; on a non-tty (script) just warn, don't block.
+# Usage: _vspi_fnwarn <name> <addr> <data>   non-zero return = cancel
+_vspi_fnwarn() {
+    local name="$1" addr="$2" data="$3"
+    [[ -z "$data" ]] && return 0                       # read, nothing to warn
+    case "$addr" in
+        0|1|2|3|0x0|0x1|0x2|0x3|0x00|0x01|0x02|0x03) ;; # looks like fn, warn below
+        *) return 0 ;;                                  # normal offset, allow
+    esac
+    echo -e "[\033[33mWARN\033[0m] $name has no fn arg; signature is <addr> [data] (NOT cb_fpga's <fn> <addr>)." >&2
+    echo -e "       This will WRITE $data to PMC/ICB/SWB offset $addr." >&2
+    echo -e "       To READ offset $addr, pass a single arg: $name $addr" >&2
+    if [ -t 0 ]; then
+        local ans
+        read -r -p "       Proceed with write anyway? [y/N] " ans
+        case "$ans" in
+            y|Y|yes|YES) return 0 ;;
+            *) echo "       Cancelled." >&2; return 1 ;;
+        esac
+    fi
+    return 0
+}
+
+# === Public functions ===
+
+cb_fpga() {
+    if [[ $# -lt 2 ]]; then
+        echo "Usage: cb_fpga <fn:0-3> <addr> [data]"; return 1
+    fi
+    local fn="$1" addr="$2" data="${3:-}" res
+    case "$fn" in
+        0) res=$FUNCT0_RES ;; 1) res=$FUNCT1_RES ;;
+        2) res=$FUNCT2_RES ;; 3) res=$FUNCT3_RES ;;
+        *) echo "cb_fpga: fn must be 0-3" >&2; return 1 ;;
+    esac
+    # pcimem offset is relative to BAR start; do not add BAR.
+    if [[ -z "$data" ]]; then
+        _pcimem "$res" "$addr"
+    else
+        _pcimem "$res" "$addr" "$data"
+    fi
+}
+
+pmc_fpga() {
+    if [[ $# -lt 1 ]]; then
+        echo "Usage: pmc_fpga <addr> [data]"; return 1
+    fi
+    local addr="$1" data="${2:-}"
+    _vspi_fnwarn pmc_fpga "$addr" "$data" || return 1
+    if [[ -z "$data" ]]; then _vspi_read "$VSPI_PMC_BASE" "$addr"
+    else _vspi_write "$VSPI_PMC_BASE" "$addr" "$data"; fi
+}
+
+icb_fpga() {
+    if [[ $# -lt 1 ]]; then
+        echo "Usage: icb_fpga <addr> [data]"; return 1
+    fi
+    local addr="$1" data="${2:-}"
+    _vspi_fnwarn icb_fpga "$addr" "$data" || return 1
+    if [[ -z "$data" ]]; then _vspi_read "$VSPI_ICB_BASE" "$addr"
+    else _vspi_write "$VSPI_ICB_BASE" "$addr" "$data"; fi
+}
+
+swb0_fpga() {
+    if [[ $# -lt 1 ]]; then
+        echo "Usage: swb0_fpga <addr> [data]"; return 1
+    fi
+    local addr="$1" data="${2:-}"
+    _vspi_fnwarn swb0_fpga "$addr" "$data" || return 1
+    if [[ -z "$data" ]]; then _vspi_read "$VSPI_SWB0_BASE" "$addr"
+    else _vspi_write "$VSPI_SWB0_BASE" "$addr" "$data"; fi
+}
+
+swb1_fpga() {
+    if [[ $# -lt 1 ]]; then
+        echo "Usage: swb1_fpga <addr> [data]"; return 1
+    fi
+    local addr="$1" data="${2:-}"
+    _vspi_fnwarn swb1_fpga "$addr" "$data" || return 1
+    if [[ -z "$data" ]]; then _vspi_read "$VSPI_SWB1_BASE" "$addr"
+    else _vspi_write "$VSPI_SWB1_BASE" "$addr" "$data"; fi
+}
+
+blanton_fpga_help() {
+    echo -e "\033[1mblanton_fpga (pcimem) - FPGA Register Access Tool\033[0m"
+    echo ""
+    echo -e "\033[1mUsage:\033[0m"
+    echo -e "  \033[33mcb_fpga\033[0m    <fn:0-3> <addr> [data]  CB FPGA direct (sysfs resource0)"
+    echo -e "  \033[33mpmc_fpga\033[0m   <addr> [data]           PMC FPGA via VSPI"
+    echo -e "  \033[33micb_fpga\033[0m   <addr> [data]           ICB FPGA via VSPI"
+    echo -e "  \033[33mswb0_fpga\033[0m  <addr> [data]           SWB0 FPGA via VSPI"
+    echo -e "  \033[33mswb1_fpga\033[0m  <addr> [data]           SWB1 FPGA via VSPI"
+    echo -e "  \033[33mfpga_debug\033[0m on|off                  Toggle debug mode (print commands and execute)"
+    echo ""
+    echo -e "  Omit [data] to \033[32mread\033[0m, provide [data] to \033[31mwrite\033[0m."
+    echo -e "  Backend: \033[36mpcimem\033[0m (sysfs resource file + relative offset)."
+    echo -e "  Run \033[33mblanton_fpga_help\033[0m to show this message again."
+}
+
+blanton_fpga_help
@@ -0,0 +1,167 @@
+#!/usr/bin/env bash
+# =====================================================================
+# blanton_icb_vi2c.sh  V0.1.0  2026-08-10
+# ICB (PDB) I2C through the CB FPGA **VI2C** proxy blocks in CB PCI
+# Function 3.  Direct BAR access (cb_fpga 3 <off>) - NO VSPI bridge, so
+# this is ~1 pcimem call per register instead of 3+, i.e. much faster
+# than blanton_icb_i2c.sh which walks CB F2's VSPI-ICB window.
+#
+# CB F3 VI2C-ICB channels (stride 0x20), per the FPGA register map:
+#   Ch0 0x780  VI2C_DEV_ID 0x21  PDB Fan Controller
+#   Ch1 0x7A0  VI2C_DEV_ID 0x23  PDB EEPROM (FRU)
+#   Ch2 0x7C0  VI2C_DEV_ID 0x25  PDB external temp sensors
+#   Ch3 0x7E0  VI2C_DEV_ID 0x27  Hotswap controller        [PMBus]
+#   Ch4 0x800  VI2C_DEV_ID 0x29  Power bricks + EFUSE      [PMBus]
+# These are the SAME physical buses as ICB I2C Ch0..Ch4 (ICB 0xE00+),
+# so a scan here must match blanton_icb_i2c.sh's scan.
+#
+# Why use this instead of blanton_icb_i2c.sh for data access (DUT 2026-08-10):
+#   VSPI access is ~18 ms/register -> ~50 ms between I2C byte phases, which
+#   trips the SMBus 25-35 ms timeout on the Ch2/Ch3/Ch4 devices (they NACK
+#   the register pointer). CB F3 VI2C is ~3.3 ms/register and stays inside
+#   the timeout, so all 5 channels are fully usable here.
+#   Measured: full 5-channel scan 9.4 s here vs 34.0 s over VSPI.
+#
+# Per-ch: +00 PRSCL_LO +04 PRSCL_HI +08 CTRL(b7 MOD_EN)
+#         +0C TX/RX  +10 CMD/STAT  +14 MUX_SEL  +18 RST(0xD)
+#         +1C RSVD  <-- VI2C has NO SEM_REG (unlike the native I2C blocks)
+# CMD : STA=0x80 STO=0x40 RD=0x20 WR=0x10 ACK=0x08(1=NACK) INT_ACK=0x01
+# STAT: RX_ACK=0x80(1=NACK) BUSY=0x40 ARB_LOST=0x20 TIP=0x02 INT_FLAG=0x01
+# Slave addrs are 7-bit (spec quotes 8-bit pairs -> divide by 2).
+# Usage: source blanton_fpga_pcimem.sh ; source blanton_icb_vi2c.sh
+#        vi2c_scan_all
+# =====================================================================
+if ! declare -F cb_fpga >/dev/null 2>&1; then
+  _VD="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
+  [ -f "$_VD/blanton_fpga_pcimem.sh" ] && . "$_VD/blanton_fpga_pcimem.sh"
+fi
+VI2C_FN=3; VI2C_BASE=0x780; VI2C_STRIDE=0x20; VI2C_CH_MAX=4
+V_EN=0x80; V_STA=0x80; V_STO=0x40; V_RD=0x20; V_WR=0x10; V_NAK=0x08
+V_RXACK=0x80; V_TIP=0x02
+VI2C_PRE_LO=${VI2C_PRE_LO:-0x88}; VI2C_PRE_HI=${VI2C_PRE_HI:-0x00}
+VI2C_POLL=${VI2C_POLL:-50}
+VI2C_SCAN_FROM=${VI2C_SCAN_FROM:-0x08}; VI2C_SCAN_TO=${VI2C_SCAN_TO:-0x77}
+VI2C_CH_DESC=("Fan Controller" "EEPROM/FRU" "Temp sensors" \
+              "Hotswap ctrlr" "Power bricks+EFUSE")
+VI2C_DEV_ID=(0x21 0x23 0x25 0x27 0x29)
+
+# --- low level (direct CB F3 BAR access) ----------------------------
+_vr(){ if [ -n "${2:-}" ]; then cb_fpga $VI2C_FN "$1" "$2"; else cb_fpga $VI2C_FN "$1"; fi; }
+_vnum(){ [[ "$1" =~ (0[xX][0-9a-fA-F]+) ]] && echo "${BASH_REMATCH[1]}" || echo 0; }
+_vbase(){ local c=$1
+  if (( c<0 || c>VI2C_CH_MAX )); then echo "ch must be 0..$VI2C_CH_MAX" >&2; return 1; fi
+  printf '0x%X' $(( VI2C_BASE + c*VI2C_STRIDE )); }
+_vwait(){ local o=$1 v=$2 i s
+  _vr "$o" "$v" >/dev/null
+  for ((i=0;i<VI2C_POLL;i++)); do s=$(_vnum "$(_vr "$o")")
+    if (( (s & V_TIP)==0 )); then printf '0x%X' "$s"; return 0; fi
+  done
+  echo "[ERR] TIP timeout (stat=$s)" >&2; printf '0x%X' "${s:-0}"; return 1; }
+_vack(){ local s; s=$(_vnum "$1"); (( (s & V_RXACK)!=0 )) && return 1 || return 0; }
+
+vi2c_init(){ local c=$1 b
+  b=$(_vbase "$c") || return 1
+  _vr $(printf '0x%X' $((b+0x08))) 0x00 >/dev/null
+  _vr $(printf '0x%X' $((b+0x00))) "${2:-$VI2C_PRE_LO}" >/dev/null
+  _vr $(printf '0x%X' $((b+0x04))) "${3:-$VI2C_PRE_HI}" >/dev/null
+  _vr $(printf '0x%X' $((b+0x08))) $V_EN >/dev/null; }
+vi2c_reset(){ local c=$1 b; b=$(_vbase "$c") || return 1
+  _vr $(printf '0x%X' $((b+0x18))) 0xD >/dev/null; echo "  [RST] vi2c ch$c LCL_RST=0xD"; }
+vi2c_muxsel(){ local c=$1 b; b=$(_vbase "$c") || return 1
+  _vr $(printf '0x%X' $((b+0x14))) "$2" >/dev/null
+  printf '  [MUXSEL] vi2c ch%s DEV_SEL <= %s\n' "$c" "$2"; }
+vi2c_dump(){ [ $# -lt 1 ] && { echo "Usage: vi2c_dump <ch>"; return 1; }
+  local c=$1 b o nm i
+  b=$(_vbase "$c") || return 1
+  nm=(PRSCL_LO PRSCL_HI CTRL RX STAT MUX_SEL RST RSVD); i=0
+  printf '  [REGS] vi2c ch%s base=%s (CB F%s)\n' "$c" "$b" "$VI2C_FN"
+  for o in 0x00 0x04 0x08 0x0C 0x10 0x14 0x18 0x1C; do
+    printf '    +%s %-9s = %s\n' "$o" "${nm[$i]}" "$(_vnum "$(_vr $(printf '0x%X' $((b+o))))")"
+    i=$((i+1))
+  done; }
+
+# --- transfers (Repeated START, SMBus/PMBus safe) -------------------
+_vrd(){ local c=$1 s=$2 r=$3 n=$4 b tx cm i st v out=""
+  b=$(_vbase "$c") || return 1
+  tx=$(printf '0x%X' $((b+0x0C))); cm=$(printf '0x%X' $((b+0x10)))
+  vi2c_init "$c"
+  _vr $tx $(printf '0x%X' $(( (s<<1) & 0xFF ))) >/dev/null
+  st=$(_vwait $cm $(printf '0x%X' $((V_STA|V_WR)))); _vack "$st" || { echo "NACK slave-W 0x$(printf %02X $s)" >&2; return 1; }
+  _vr $tx $(printf '0x%X' $((r & 0xFF))) >/dev/null
+  st=$(_vwait $cm $(printf '0x%X' $((V_WR)))); _vack "$st" || { echo "NACK reg 0x$(printf %02X $r)" >&2; return 1; }
+  _vr $tx $(printf '0x%X' $(( ((s<<1)|1) & 0xFF ))) >/dev/null
+  st=$(_vwait $cm $(printf '0x%X' $((V_STA|V_WR)))); _vack "$st" || { echo "NACK slave-R 0x$(printf %02X $s)" >&2; return 1; }
+  for ((i=0;i<n;i++)); do
+    if (( i==n-1 )); then _vwait $cm $(printf '0x%X' $((V_RD|V_NAK|V_STO))) >/dev/null
+    else _vwait $cm $(printf '0x%X' $((V_RD))) >/dev/null; fi
+    v=$(_vnum "$(_vr $tx)"); out+="$(printf '0x%02X ' $((v & 0xFF)))"
+  done
+  echo "${out% }"; }
+_vwr(){ local c=$1 s=$2 r=$3; shift 3
+  local b tx cm st x n=$# k=0 cv
+  (( n<1 )) && { echo "no data bytes" >&2; return 1; }
+  b=$(_vbase "$c") || return 1
+  tx=$(printf '0x%X' $((b+0x0C))); cm=$(printf '0x%X' $((b+0x10)))
+  vi2c_init "$c"
+  _vr $tx $(printf '0x%X' $(( (s<<1) & 0xFF ))) >/dev/null
+  st=$(_vwait $cm $(printf '0x%X' $((V_STA|V_WR)))); _vack "$st" || { echo "NACK slave-W" >&2; return 1; }
+  _vr $tx $(printf '0x%X' $((r & 0xFF))) >/dev/null
+  st=$(_vwait $cm $(printf '0x%X' $((V_WR)))); _vack "$st" || { echo "NACK reg" >&2; return 1; }
+  for x in "$@"; do k=$((k+1))
+    _vr $tx $(printf '0x%X' $(( $((x)) & 0xFF ))) >/dev/null
+    if (( k==n )); then cv=$((V_WR|V_STO)); else cv=$((V_WR)); fi
+    st=$(_vwait $cm $(printf '0x%X' $cv)); _vack "$st" || { echo "NACK data#$k" >&2; return 1; }
+  done; }
+
+# --- public ---------------------------------------------------------
+vi2c_read(){ [ $# -lt 3 ] && { echo "Usage: vi2c_read <ch> <slave7> <reg> [n]"; return 1; }
+  local o; o=$(_vrd "$1" $(( $2 )) $(( $3 )) "${4:-1}") || return 1
+  printf '  [VI2C-R] ch%s slave=0x%02X reg=0x%02X => [%s]\n' "$1" $(( $2 )) $(( $3 )) "$o"; }
+vi2c_write(){ [ $# -lt 4 ] && { echo "Usage: vi2c_write <ch> <slave7> <reg> <byte>..."; return 1; }
+  local c=$1 s=$(( $2 )) r=$(( $3 )); shift 3
+  _vwr "$c" "$s" "$r" "$@" || return 1
+  printf '  [VI2C-W] ch%s slave=0x%02X reg=0x%02X <= [%s]\n' "$c" "$s" "$r" "$*"; }
+vi2c_pmbus_read(){ [ $# -lt 3 ] && { echo "Usage: vi2c_pmbus_read <ch> <slave7> <cmd> [n]"; return 1; }
+  local o n=${4:-2}; o=$(_vrd "$1" $(( $2 )) $(( $3 )) "$n") || return 1
+  if [ "$n" = 2 ]; then local b0 b1 w
+    b0=$(( $(echo "$o" | awk '{print $1}') )); b1=$(( $(echo "$o" | awk '{print $2}') ))
+    w=$(( b0 | (b1<<8) ))
+    printf '  [VPMB-R] ch%s slave=0x%02X cmd=0x%02X => 0x%04X raw=[%s] lin16=%s\n' \
+      "$1" $(( $2 )) $(( $3 )) "$w" "$o" "$(vi2c_lin16 $w)"
+  else printf '  [VPMB-R] ch%s slave=0x%02X cmd=0x%02X => [%s]\n' "$1" $(( $2 )) $(( $3 )) "$o"; fi; }
+vi2c_lin16(){ awk -v w=$(( $1 & 0xFFFF )) 'BEGIN{e=int(w/2048)%32;if(e>15)e-=32;m=w%2048;if(m>1023)m-=2048;printf "%.4f",m*(2.0^e)}'; }
+
+# --- scan -----------------------------------------------------------
+vi2c_scan(){ [ $# -lt 1 ] && { echo "Usage: vi2c_scan <ch>"; return 1; }
+  local c=$1 b tx cm a st f=""
+  b=$(_vbase "$c") || return 1
+  tx=$(printf '0x%X' $((b+0x0C))); cm=$(printf '0x%X' $((b+0x10)))
+  vi2c_init "$c"
+  for (( a=$((VI2C_SCAN_FROM)); a<=$((VI2C_SCAN_TO)); a++ )); do
+    _vr $tx $(printf '0x%X' $(( (a<<1) & 0xFF ))) >/dev/null
+    st=$(_vwait $cm $(printf '0x%X' $((V_STA|V_WR|V_STO)))) || continue
+    _vack "$st" && f+="$(printf '0x%02X ' $a)"
+  done
+  printf '  Ch%-2s %-20s : %s\n' "$c" "${VI2C_CH_DESC[$c]}" "${f:-(none)}"; }
+vi2c_scan_all(){ local c list="$*"
+  [ -z "$list" ] && list="0 1 2 3 4"
+  echo "=== ICB VI2C scan via CB F$VI2C_FN direct BAR, base $VI2C_BASE ==="
+  printf '    range 0x%02X..0x%02X (7-bit), prescale %s/%s\n' \
+    $((VI2C_SCAN_FROM)) $((VI2C_SCAN_TO)) "$VI2C_PRE_LO" "$VI2C_PRE_HI"
+  for c in $list; do vi2c_scan "$c"; done; }
+vi2c_help(){
+  echo "blanton_icb_vi2c.sh - ICB(PDB) I2C via CB F$VI2C_FN VI2C proxy (direct BAR, no VSPI)"
+  local i
+  for i in 0 1 2 3 4; do
+    printf '  Ch%-2s 0x%X  DEV_ID %s  %s\n' $i $((VI2C_BASE+i*VI2C_STRIDE)) "${VI2C_DEV_ID[$i]}" "${VI2C_CH_DESC[$i]}"
+  done
+  echo "  vi2c_scan_all [ch...]                scan all VI2C-ICB channels"
+  echo "  vi2c_scan <ch>                       vi2c_dump <ch>"
+  echo "  vi2c_init <ch> [pre_lo] [pre_hi]     vi2c_reset <ch>"
+  echo "  vi2c_read  <ch> <slave7> <reg> [n]"
+  echo "  vi2c_write <ch> <slave7> <reg> <byte>..."
+  echo "  vi2c_pmbus_read <ch> <slave7> <cmd> [n]   vi2c_lin16 <word>"
+  echo "  vi2c_muxsel <ch> <sel>               (VI2C has no SEM_REG)"
+  echo "  env: VI2C_SCAN_FROM VI2C_SCAN_TO VI2C_PRE_LO VI2C_PRE_HI VI2C_POLL"
+  echo "  Same buses as blanton_icb_i2c.sh Ch0..Ch4 - scans should match."; }
+vi2c_help
@@ -0,0 +1,653 @@
+#!/usr/bin/env bash
+# =============================================================================
+# blanton_pwr_data.sh  --  SWB VRM rail monitor (Vin / Vout / Iout / Temp)
+# =============================================================================
+# Version History:
+#   V1.0.0  2026-08-12  Initial. Reads every SWB VRM rail over the CB FPGA F3
+#                       I2C master (blanton_cb_i2c.sh) and prints an aligned
+#                       table. Rail map + conversions from PWR_Data.xlsx.
+#
+#                       Two xlsx conversions were CORRECTED after measuring the
+#                       real parts on COM39 (see _pwr_vout_* below):
+#                         * MP2985B Vout: xlsx said "(data + 49) / 1mV". The
+#                           "+49" offset is wrong -- it is plain 1mV/LSB. Proof:
+#                           PVDD_0V75_ANLG_0 read 750 (0.750V) and PVDD1V5_CNDR0
+#                           read 1501 (1.501V), which match their net names
+#                           exactly with no offset (+49 would give 0.799/1.550).
+#                         * MP29816 Vout: xlsx said "/5mV". The LSB is not fixed
+#                           -- it is selected by MFR_VOUT_SCALE_LOOP (0x29)
+#                           bits[12:10]. This unit reads 0x0820 -> code 2 ->
+#                           2.5mV/LSB, so READ_VOUT 314 = 0.785V (VOUT_COMMAND
+#                           320 = 0.800V nominal). 5mV would give 1.57V. The
+#                           resolution is now read from the chip at runtime.
+#                         * xlsx Vin "divide by 32,33,34...49" is an Excel
+#                           autofill artifact; the divisor is 32 (31.25mV/LSB)
+#                           for every part.
+#   V1.1.0  2026-08-12  Add: "pwr_data pdb" - PDB power bricks + EFUSE, reached
+#                       over ICB VI2C ch4 behind the 0x72 mux, channel 0
+#                       (blanton_icb_vi2c.sh backend, CB F3 direct BAR).
+#                       Add: ARB_LOST-aware retry on the VI2C path. On the first
+#                       DUT (COM39) ICB ch4 lost arbitration on every other
+#                       transaction for any 7-bit addr >= 0x40, and vi2c_scan
+#                       reported those failures as devices because it only tests
+#                       RX_ACK and ignores ARB_LOST (STAT bit5). A true-ACK scan
+#                       showed ch4 really had only 0x1A and 0x26 - the 0x72 mux
+#                       never ACKed, so 0x60..0x63 were unreachable. Suspected
+#                       board issue, so the PDB table here is written to spec and
+#                       is NOT yet verified against working bricks.
+#                       Change: missing-value placeholder is now "NA" everywhere.
+#                       Add: PDB values are rejected as NA when the word reads
+#                       0xFFFF (floating bus, not data) or falls outside a
+#                       plausibility window. Without this the broken ch4 bus
+#                       printed Vin=12124160 V and Vout=65.5350 V, which look
+#                       like readings; a wrong number is worse than NA. Limits
+#                       are PDB_VIN_MAX / PDB_VOUT_MAX / PDB_IOUT_ABS_MAX /
+#                       PDB_TEMP_MIN / PDB_TEMP_MAX, and PDB_REJECT_FFFF=0
+#                       disables the all-ones check.
+#   !! PDB CONVERSIONS ARE UNVERIFIED !!  PWR_Data.xlsx has no PDB sheet and no
+#      brick responded on the first DUT, so the PDB rows use generic PMBus
+#      decoding (SLINEAR11 for Vin/Iout/Temp, LINEAR16 with the exponent taken
+#      from VOUT_MODE for Vout, direct format falls back to 1mV/LSB). Once a
+#      brick answers, run "pwr_pdb_id" to get MFR_ID/MFR_MODEL and check the
+#      numbers against the datasheet before trusting them.
+#   V1.2.0  2026-08-12  Verified against working bricks on the COM36 DUT, where the
+#                       0x72 mux DOES respond and 0x60..0x63 answer. Findings:
+#                         * VOUT_MODE = 0x40 (direct) -> Vout is 1 mV/LSB, giving
+#                           1.212..1.220 V, consistent with the "I2C_PDB_VRM" net
+#                           name on that mux leg. Vout is now trusted.
+#                         * READ_VIN (0x88) is NOT a real input reading: it tracks
+#                           READ_VOUT within 1 LSB per device (0x60 1217/1218,
+#                           0x61 1219/1220, 0x62 1212/1212, 0x63 1217/1217) and does
+#                           not read alike across bricks sharing one input rail.
+#                           Reported NA unless PDB_TRUST_VIN=1.
+#                         * READ_TEMPERATURE_1 (0x8D), 0x8E and STATUS_BYTE (0x78)
+#                           all return 0xFFFF and STATUS_WORD (0x79) = 0x0002 = CML
+#                           fault, i.e. a partial command set. Temp is NA.
+#                         * MFR_ID/MFR_MODEL return one byte then float (0x4D 'M',
+#                           0x59 'Y'), so they are not block reads here.
+#                       Fix: presence is now a true-ACK probe and every value is read
+#                       independently. Previously a failed Vin read aborted the whole
+#                       row, so one unsupported register blanked Vout and Iout too.
+# =============================================================================
+#
+# Usage:
+#   source blanton_pwr_data.sh
+#   pwr_data            # SWB0 (default)
+#   pwr_data swb1       # SWB1  (same map, I2C channel +1)
+#   pwr_data pdb        # PDB power bricks + EFUSE (ICB VI2C ch4, mux 0x72 ch0)
+#   pwr_data all        # all three
+#   pwr_pdb_id          # read MFR_ID / MFR_MODEL of whatever answers on the PDB
+#   pwr_data_help
+#
+# Requires blanton_cb_i2c.sh + blanton_fpga_pcimem.sh in the same directory
+# (auto-sourced below). "pwr_data pdb" additionally needs blanton_icb_vi2c.sh,
+# which is sourced on demand.
+#
+# Register / conversion summary (PMBus, page written to 0x00 first):
+#   Vin  0x88  bits[9:0] * 31.25mV          (page 0 -- Vin is the shared input)
+#   Vout 0x8B  MP29816 : bits[11:0] * MFR_VOUT_SCALE_LOOP resolution
+#              MP2985B : bits[11:0] * 1mV
+#   Iout 0x8C  SLINEAR11  (MP29816 lands on 2A/LSB, MP2985B on 0.0625A/LSB)
+#   Temp 0x8D  MP29816 : SLINEAR11 ; MP2985B : bits[10:0] two's complement degC
+# =============================================================================
+
+# --- Pull in the I2C/PMBus backend if not already present --------------------
+_PWR_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
+if ! declare -F cb_pmbus_read >/dev/null 2>&1; then
+    if [ -n "$_PWR_DIR" ] && [ -f "$_PWR_DIR/blanton_cb_i2c.sh" ]; then
+        # shellcheck source=/dev/null
+        source "$_PWR_DIR/blanton_cb_i2c.sh" >/dev/null
+    else
+        echo -e "[\033[33mWARN\033[0m] blanton_pwr_data.sh: cb_pmbus_read() not found." >&2
+        echo    "       source blanton_cb_i2c.sh first." >&2
+    fi
+fi
+
+# === PMBus command codes =====================================================
+_PWR_PAGE=0x00
+_PWR_VIN=0x88
+_PWR_VOUT=0x8B
+_PWR_IOUT=0x8C
+_PWR_TEMP=0x8D
+_PWR_MFR_VOUT_SCALE_LOOP=0x29     # MP29816 only: bits[12:10] = Vout LSB select
+
+# === Rail map (from PWR_Data.xlsx) ===========================================
+# One entry per rail: "location:vrm:ch:slave:page:netname"
+#   ch    = "I2C CH SWB0" column. SWB1 is the same map with ch+1 (7/9).
+#   page  = value written to PMBus PAGE (0x00) before Vout/Iout/Temp.
+#           Vin is always read from page 0 (shared input rail).
+PWR_RAILS=(
+    "PU2:MP29816:6:0x20:0x00:PVDD_CORE"
+    "PU105:MP2985B:6:0x21:0x00:PVDD_PHYTILE_P2"
+    "PU105:MP2985B:6:0x21:0x01:PVDD_PHYTILE_P3"
+    "PU102:MP2985B:6:0x22:0x00:PVDD_PHYTILE_P0"
+    "PU102:MP2985B:6:0x22:0x01:PVDD_PHYTILE_P1"
+    "PU114:MP2985B:6:0x25:0x00:PVDD_0V9_ANLG_0"
+    "PU114:MP2985B:6:0x25:0x01:PVDD_0V75_ANLG_0"
+    "PU122:MP2985B:6:0x27:0x00:PVDDA_PHYT0_P0"
+    "PU122:MP2985B:6:0x27:0x01:PVDDA_PHYT1_P1"
+    "PU142:MP2985B:6:0x29:0x00:PVDD1V5_CNDR0"
+    "PU142:MP2985B:6:0x29:0x01:PVDD1V5_CNDR1"
+    "PU108:MP2985B:8:0x23:0x00:PVDD_PHYTILE_P4"
+    "PU108:MP2985B:8:0x23:0x01:PVDD_PHYTILE_P5"
+    "PU111:MP2985B:8:0x24:0x00:PVDD_PHYTILE_P6"
+    "PU111:MP2985B:8:0x24:0x01:PVDD_PHYTILE_P7"
+    "PU118:MP2985B:8:0x26:0x00:PVDD_0V9_ANLG_1"
+    "PU118:MP2985B:8:0x26:0x01:PVDD_0V75_ANLG_1"
+    "PU127:MP2985B:8:0x28:0x00:PVDDA_PHYT2_P2"
+    "PU127:MP2985B:8:0x28:0x01:PVDDA_PHYT3_P3"
+)
+
+# I2C channel offset per board: SWB0 uses the map as-is, SWB1 is +1.
+_pwr_board_offset() {
+    case "$(echo "${1:-swb0}" | tr 'A-Z' 'a-z')" in
+        swb0|0) echo 0 ;;
+        swb1|1) echo 1 ;;
+        *) return 1 ;;
+    esac
+}
+
+# === Missing-value placeholder ================================================
+PWR_NA="${PWR_NA:-NA}"
+
+# === PDB: power bricks + EFUSE ===============================================
+# Path: CB F3 VI2C ch4 (== ICB I2C ch4, "Power bricks + EFUSE") -> external
+# TCA954x mux at 7-bit 0x72 -> mux channel 0 -> the bricks.
+# The VI2C path is used rather than the VSPI path (blanton_icb_i2c.sh) because
+# VSPI costs ~18 ms per register, which puts ~50 ms between I2C byte phases and
+# trips the 25-35 ms SMBus timeout on these PMBus parts. VI2C is ~3.3 ms.
+PDB_VI2C_CH="${PDB_VI2C_CH:-4}"
+PDB_MUX_ADDR="${PDB_MUX_ADDR:-0x72}"
+PDB_MUX_SEL="${PDB_MUX_SEL:-0x01}"     # TCA954x control byte: bit0 = channel 0
+PDB_RETRY="${PDB_RETRY:-3}"            # retries per transfer (ARB_LOST recovery)
+
+# A floating I2C bus reads back all ones, so a 0xFFFF word is treated as "no
+# data" instead of being decoded - otherwise it prints as a perfectly
+# reasonable-looking 65.535 V / -0.5 A. Set 0 to decode it anyway.
+PDB_REJECT_FFFF="${PDB_REJECT_FFFF:-1}"
+
+# The bricks alias READ_VIN (0x88) to the READ_VOUT measurement, so Vin is
+# reported as NA by default rather than printing a wrong number. See the note in
+# _pwr_read_pdb_rail for the measurement that shows this. Set to 1 to decode it.
+PDB_TRUST_VIN="${PDB_TRUST_VIN:-0}"
+
+# Plausibility window; anything outside prints NA. Measured need: on the first
+# DUT the contended ch4 bus produced words that decoded to 12124160 V, and a
+# wrong number is worse than no number on a bring-up tool.
+PDB_VIN_MAX="${PDB_VIN_MAX:-100}"
+PDB_VOUT_MAX="${PDB_VOUT_MAX:-60}"
+PDB_IOUT_ABS_MAX="${PDB_IOUT_ABS_MAX:-500}"
+PDB_TEMP_MIN="${PDB_TEMP_MIN:--55}"
+PDB_TEMP_MAX="${PDB_TEMP_MAX:-150}"
+
+# One entry per device: "location:model:slave:page:netname"
+#   page "-" = do not write PMBus PAGE (these are single-output parts)
+PDB_RAILS=(
+    "PDB:BRICK:0x60:-:PDB_BRICK_0"
+    "PDB:BRICK:0x61:-:PDB_BRICK_1"
+    "PDB:BRICK:0x62:-:PDB_BRICK_2"
+    "PDB:BRICK:0x63:-:PDB_BRICK_3"
+    "PDB:EFUSE:0x26:-:PDB_EFUSE"
+)
+
+_PWR_VI2C_ARBLOST=0x20                 # VI2C STAT bit5
+
+# === Debug ===================================================================
+PWR_DEBUG=${PWR_DEBUG:-0}
+pwr_debug() {
+    if [ "${1:-}" = "on" ]; then PWR_DEBUG=1
+    elif [ "${1:-}" = "off" ]; then PWR_DEBUG=0
+    else [ "$PWR_DEBUG" = "0" ] && PWR_DEBUG=1 || PWR_DEBUG=0; fi
+    echo -e "[\033[34mINFO\033[0m] PWR_DEBUG=$PWR_DEBUG"
+}
+
+# === Low-level: read one 16-bit PMBus word, echo it as a decimal =============
+# _pwr_rd16 <ch> <slave> <reg>   -> decimal word on stdout, non-zero on NACK
+_pwr_rd16() {
+    local ch="$1" slave=$(( $2 )) reg="$3" bytes lo hi
+    bytes=$(_cbi2c_xfer_read "$ch" "$slave" "$(( $reg ))" 2 2>/dev/null) || return 1
+    lo=$(printf '%s' "$bytes" | awk '{print $1}')
+    hi=$(printf '%s' "$bytes" | awk '{print $2}')
+    [ -z "$lo" ] || [ -z "$hi" ] && return 1
+    local w=$(( ( $(( hi )) << 8 ) | $(( lo )) ))
+    [ "$PWR_DEBUG" = "1" ] && printf '\033[90m[DEBG] ch=%s slave=0x%02X reg=%s -> 0x%04X\033[0m\n' \
+        "$ch" "$slave" "$reg" "$w" >&2
+    echo "$w"
+}
+
+# _pwr_set_page <ch> <slave> <page>
+_pwr_set_page() {
+    cb_pmbus_write "$1" "$2" "$_PWR_PAGE" "$3" >/dev/null 2>&1
+}
+
+# === Format decoders =========================================================
+
+# SLINEAR11: bits[15:11] = signed exponent, bits[10:0] = signed mantissa
+_pwr_l11() {
+    local w=$(( $1 & 0xFFFF ))
+    local e=$(( (w >> 11) & 0x1F ))
+    local m=$(( w & 0x7FF ))
+    (( e > 15 )) && e=$(( e - 32 ))
+    (( m > 1023 )) && m=$(( m - 2048 ))
+    awk -v m="$m" -v e="$e" 'BEGIN { printf "%.3f", m * (2.0 ^ e) }'
+}
+
+# Signed 11-bit two's complement (bits[10:0]) -> integer
+_pwr_s11() {
+    local m=$(( $1 & 0x7FF ))
+    (( m > 1023 )) && m=$(( m - 2048 ))
+    echo "$m"
+}
+
+# Vin: bits[9:0] * 31.25mV  (identical to xlsx "/32" and to "Linear11 *31.25mV")
+_pwr_vin() {
+    awk -v c="$(( $1 & 0x3FF ))" 'BEGIN { printf "%.3f", c * 0.03125 }'
+}
+
+# MP29816 Vout LSB (volts) from MFR_VOUT_SCALE_LOOP bits[12:10].
+# Cached per ch:slave so the table costs one extra read per MP29816, not per row.
+declare -A _PWR_RES_CACHE 2>/dev/null
+_pwr_mp29816_res() {
+    local ch="$1" slave="$2" key="$ch:$slave" w code
+    if [ -n "${_PWR_RES_CACHE[$key]}" ]; then echo "${_PWR_RES_CACHE[$key]}"; return 0; fi
+    w=$(_pwr_rd16 "$ch" "$slave" "$_PWR_MFR_VOUT_SCALE_LOOP") || return 1
+    code=$(( (w >> 10) & 0x7 ))
+    local res
+    case "$code" in
+        0) res=0.00625 ;;      # 6.25   mV/LSB
+        1) res=0.005 ;;        # 5      mV/LSB
+        2) res=0.0025 ;;       # 2.5    mV/LSB
+        3) res=0.002 ;;        # 2      mV/LSB
+        4) res=0.001 ;;        # 1      mV/LSB
+        5) res=0.00390625 ;;   # 3.90625mV/LSB
+        6) res=0.001953125 ;;  # 1.953125 mV/LSB
+        7) res=0.0009765625 ;; # 0.9765625 mV/LSB
+        *) return 1 ;;
+    esac
+    _PWR_RES_CACHE[$key]="$res"
+    echo "$res"
+}
+
+# === Per-rail read ===========================================================
+# Fills _PWR_VIN_V / _PWR_VOUT_V / _PWR_IOUT_A / _PWR_TEMP_C ("n/a" on failure)
+_pwr_read_rail() {
+    local vrm="$1" ch="$2" slave="$3" page="$4" w res
+    _PWR_VIN_V="$PWR_NA"; _PWR_VOUT_V="$PWR_NA"; _PWR_IOUT_A="$PWR_NA"; _PWR_TEMP_C="$PWR_NA"
+
+    # --- Vin: always page 0 (shared input rail) ---
+    _pwr_set_page "$ch" "$slave" 0x00
+    if w=$(_pwr_rd16 "$ch" "$slave" "$_PWR_VIN"); then
+        _PWR_VIN_V=$(_pwr_vin "$w")
+    else
+        return 1        # slave did not ACK at all -> leave the whole row n/a
+    fi
+
+    # --- Vout / Iout / Temp: on the rail's own page ---
+    _pwr_set_page "$ch" "$slave" "$page"
+
+    if w=$(_pwr_rd16 "$ch" "$slave" "$_PWR_VOUT"); then
+        if [ "$vrm" = "MP29816" ]; then
+            res=$(_pwr_mp29816_res "$ch" "$slave") || res=0.0025
+            _PWR_VOUT_V=$(awk -v c="$(( w & 0xFFF ))" -v r="$res" 'BEGIN { printf "%.4f", c * r }')
+        else
+            # MP2985B: direct, 1mV/LSB (no offset -- see header note)
+            _PWR_VOUT_V=$(awk -v c="$(( w & 0xFFF ))" 'BEGIN { printf "%.4f", c / 1000.0 }')
+        fi
+    fi
+
+    w=$(_pwr_rd16 "$ch" "$slave" "$_PWR_IOUT") && _PWR_IOUT_A=$(_pwr_l11 "$w")
+
+    if w=$(_pwr_rd16 "$ch" "$slave" "$_PWR_TEMP"); then
+        if [ "$vrm" = "MP29816" ]; then
+            _PWR_TEMP_C=$(printf '%.1f' "$(_pwr_l11 "$w")")
+        else
+            _PWR_TEMP_C=$(printf '%.1f' "$(_pwr_s11 "$w")")
+        fi
+    fi
+    return 0
+}
+
+# === PDB backend: ICB VI2C ch4, ARB_LOST-aware ================================
+# blanton_icb_vi2c.sh supplies _vbase/_vr/_vwait/_vnum/_vrd/_vwr/vi2c_init and
+# the V_* bit constants. Sourced on demand so plain SWB use does not need it.
+_pwr_vi2c_ready() {
+    declare -F vi2c_init >/dev/null 2>&1 && return 0
+    if [ -n "$_PWR_DIR" ] && [ -f "$_PWR_DIR/blanton_icb_vi2c.sh" ]; then
+        # shellcheck source=/dev/null
+        source "$_PWR_DIR/blanton_icb_vi2c.sh" >/dev/null
+    fi
+    declare -F vi2c_init >/dev/null 2>&1 && return 0
+    echo -e "[\033[31mERRO\033[0m] blanton_icb_vi2c.sh not found in ${_PWR_DIR:-.} - needed for 'pwr_data pdb'" >&2
+    return 1
+}
+
+# ARB_LOST on this bus hits roughly every other transaction, and it makes the
+# address-phase RX_ACK meaningless, so every transfer is retried.
+# _pwr_pdb_rd16 <slave> <reg> -> decimal word
+_pwr_pdb_rd16() {
+    local slave="$1" reg="$2" try bytes lo hi w
+    for (( try=0; try<PDB_RETRY; try++ )); do
+        bytes=$(_vrd "$PDB_VI2C_CH" "$(( slave ))" "$(( reg ))" 2 2>/dev/null) || continue
+        lo=$(printf '%s' "$bytes" | awk '{print $1}')
+        hi=$(printf '%s' "$bytes" | awk '{print $2}')
+        if [ -n "$lo" ] && [ -n "$hi" ]; then
+            w=$(( ( $(( hi )) << 8 ) | $(( lo )) ))
+            [ "$PWR_DEBUG" = "1" ] && printf '\033[90m[DEBG] pdb slave=0x%02X reg=0x%02X -> 0x%04X\033[0m\n' \
+                "$(( slave ))" "$(( reg ))" "$w" >&2
+            # All ones = nothing drove SDA; not real data.
+            if [ "$PDB_REJECT_FFFF" = "1" ] && (( w == 0xFFFF )); then continue; fi
+            echo "$w"; return 0
+        fi
+    done
+    return 1
+}
+
+# _pwr_pdb_rd8 <slave> <reg> -> decimal byte
+_pwr_pdb_rd8() {
+    local slave="$1" reg="$2" try bytes b0
+    for (( try=0; try<PDB_RETRY; try++ )); do
+        bytes=$(_vrd "$PDB_VI2C_CH" "$(( slave ))" "$(( reg ))" 1 2>/dev/null) || continue
+        b0=$(printf '%s' "$bytes" | awk '{print $1}')
+        if [ -n "$b0" ]; then
+            local v=$(( $(( b0 )) & 0xFF ))
+            if [ "$PDB_REJECT_FFFF" = "1" ] && (( v == 0xFF )); then continue; fi
+            echo "$v"; return 0
+        fi
+    done
+    return 1
+}
+
+# Raw 1-byte read of the mux control register (a TCA954x takes no register
+# pointer). Echoes the control byte as a decimal.
+_pwr_pdb_mux_read() {
+    local ch="$PDB_VI2C_CH" s=$(( PDB_MUX_ADDR )) b tx cm st v
+    b=$(_vbase "$ch") || return 1
+    tx=$(printf '0x%X' $(( b + 0x0C )))
+    cm=$(printf '0x%X' $(( b + 0x10 )))
+    _vr "$tx" "$(printf '0x%X' $(( ((s << 1) | 1) & 0xFF )))" >/dev/null
+    st=$(_vwait "$cm" "$(printf '0x%X' $(( V_STA | V_WR )))")
+    (( ( $(( st )) & (_PWR_VI2C_ARBLOST | V_RXACK) ) != 0 )) && return 1
+    _vwait "$cm" "$(printf '0x%X' $(( V_RD | V_NAK | V_STO )))" >/dev/null
+    v=$(_vnum "$(_vr "$tx")")
+    echo $(( v & 0xFF ))
+}
+
+# Point the mux at channel 0 and confirm by reading the control byte back.
+# A TCA954x accepts exactly ONE byte and NACKs anything after it, which is why
+# vi2c_write (register pointer + data = 2 bytes) cannot be used here.
+_pwr_pdb_mux_open() {
+    local ch="$PDB_VI2C_CH" s=$(( PDB_MUX_ADDR )) v=$(( PDB_MUX_SEL ))
+    local b tx cm st try rb
+    b=$(_vbase "$ch") || return 1
+    tx=$(printf '0x%X' $(( b + 0x0C )))
+    cm=$(printf '0x%X' $(( b + 0x10 )))
+    for (( try=0; try<PDB_RETRY; try++ )); do
+        vi2c_init "$ch"
+        _vr "$tx" "$(printf '0x%X' $(( (s << 1) & 0xFF )))" >/dev/null
+        st=$(_vwait "$cm" "$(printf '0x%X' $(( V_STA | V_WR )))")
+        _vr "$tx" "$(printf '0x%X' $(( v & 0xFF )))" >/dev/null
+        st=$(_vwait "$cm" "$(printf '0x%X' $(( V_WR | V_STO )))")
+        (( ( $(( st )) & (_PWR_VI2C_ARBLOST | V_RXACK) ) != 0 )) && continue
+        rb=$(_pwr_pdb_mux_read) || continue
+        if (( rb == (v & 0xFF) )); then
+            [ "$PWR_DEBUG" = "1" ] && printf '\033[90m[DEBG] mux 0x%02X <= 0x%02X (readback 0x%02X)\033[0m\n' \
+                "$s" $(( v & 0xFF )) "$rb" >&2
+            return 0
+        fi
+    done
+    return 1
+}
+
+# VOUT_MODE (0x20): bits[7:5] = mode, bits[4:0] = parameter.
+#   000 LINEAR -> exponent is bits[4:0], signed 5-bit  (Vout = raw * 2^exp)
+#   010 DIRECT -> needs the COEFFICIENTS command; falls back to 1 mV/LSB
+# Cached per slave. Echoes "linear <exp>" or "direct".
+declare -A _PWR_VMODE_CACHE 2>/dev/null
+_pwr_pdb_vout_mode() {
+    local slave="$1" key="$slave" w mode exp r
+    if [ -n "${_PWR_VMODE_CACHE[$key]}" ]; then echo "${_PWR_VMODE_CACHE[$key]}"; return 0; fi
+    w=$(_pwr_pdb_rd8 "$slave" 0x20) || return 1
+    mode=$(( (w >> 5) & 0x7 ))
+    exp=$(( w & 0x1F )); (( exp > 15 )) && exp=$(( exp - 32 ))
+    case "$mode" in
+        0) r="linear $exp" ;;
+        2) r="direct" ;;
+        *) r="direct" ;;
+    esac
+    _PWR_VMODE_CACHE[$key]="$r"
+    echo "$r"
+}
+
+# True-ACK presence probe. vi2c_scan only tests RX_ACK and mistakes ARB_LOST for
+# a device, so presence is checked here with STA|WR|STO and ARB_LOST rejected.
+_pwr_pdb_present() {
+    local slave=$(( $1 )) ch="$PDB_VI2C_CH" b tx cm st s try
+    b=$(_vbase "$ch") || return 1
+    tx=$(printf '0x%X' $(( b + 0x0C )))
+    cm=$(printf '0x%X' $(( b + 0x10 )))
+    for (( try=0; try<PDB_RETRY; try++ )); do
+        _vr "$tx" "$(printf '0x%X' $(( (slave << 1) & 0xFF )))" >/dev/null
+        st=$(_vwait "$cm" "$(printf '0x%X' $(( V_STA | V_WR | V_STO )))")
+        s=$(( st ))
+        (( (s & _PWR_VI2C_ARBLOST) == 0 )) && break
+    done
+    (( (s & _PWR_VI2C_ARBLOST) == 0 && (s & V_RXACK) == 0 ))
+}
+
+# Echo the value if it falls inside [min,max], otherwise fail.
+_pwr_sane() {
+    awk -v v="$1" -v lo="$2" -v hi="$3" \
+        'BEGIN { if (v+0 >= lo+0 && v+0 <= hi+0) { print v; exit 0 } exit 1 }'
+}
+
+# Fills _PWR_* for one PDB device. Generic PMBus decoding - see header warning.
+# Every value is read independently: these parts implement a partial command set
+# (READ_TEMPERATURE_1 answers 0xFFFF and STATUS_WORD reports a CML fault), so one
+# unsupported register must not blank the whole row.
+_pwr_read_pdb_rail() {
+    local model="$1" slave="$2" page="$3" w mode exp v
+    _PWR_VIN_V="$PWR_NA"; _PWR_VOUT_V="$PWR_NA"; _PWR_IOUT_A="$PWR_NA"; _PWR_TEMP_C="$PWR_NA"
+
+    _pwr_pdb_present "$slave" || return 1
+
+    [ "$page" != "-" ] && _vwr "$PDB_VI2C_CH" "$(( slave ))" 0x00 "$page" >/dev/null 2>&1
+
+    # Vin is deliberately NOT reported for the bricks. Measured on COM36:
+    # READ_VIN (0x88) tracks READ_VOUT (0x8B) to within 1 LSB on each device
+    # (0x60 1217/1218, 0x61 1219/1220, 0x62 1212/1212, 0x63 1217/1217) and does
+    # not behave like the shared input rail it would have to be, so 0x88 is
+    # aliased to the Vout measurement rather than a real input reading.
+    # Set PDB_TRUST_VIN=1 to decode it anyway.
+    if [ "$PDB_TRUST_VIN" = "1" ] && w=$(_pwr_pdb_rd16 "$slave" "$_PWR_VIN"); then
+        v=$(_pwr_l11 "$w") && _PWR_VIN_V=$(_pwr_sane "$v" 0 "$PDB_VIN_MAX") || _PWR_VIN_V="$PWR_NA"
+    fi
+
+    if w=$(_pwr_pdb_rd16 "$slave" "$_PWR_VOUT"); then
+        mode=$(_pwr_pdb_vout_mode "$slave") || mode="direct"
+        case "$mode" in
+            linear*)
+                exp="${mode#linear }"
+                v=$(awk -v c="$(( w & 0xFFFF ))" -v e="$exp" 'BEGIN { printf "%.4f", c * (2.0 ^ e) }') ;;
+            *)  v=$(awk -v c="$(( w & 0xFFFF ))" 'BEGIN { printf "%.4f", c / 1000.0 }') ;;
+        esac
+        _PWR_VOUT_V=$(_pwr_sane "$v" 0 "$PDB_VOUT_MAX") || _PWR_VOUT_V="$PWR_NA"
+    fi
+
+    if w=$(_pwr_pdb_rd16 "$slave" "$_PWR_IOUT"); then
+        v=$(_pwr_l11 "$w")
+        _PWR_IOUT_A=$(_pwr_sane "$v" "-$PDB_IOUT_ABS_MAX" "$PDB_IOUT_ABS_MAX") || _PWR_IOUT_A="$PWR_NA"
+    fi
+
+    if w=$(_pwr_pdb_rd16 "$slave" "$_PWR_TEMP"); then
+        v=$(_pwr_l11 "$w")
+        if v=$(_pwr_sane "$v" "$PDB_TEMP_MIN" "$PDB_TEMP_MAX"); then
+            _PWR_TEMP_C=$(printf '%.1f' "$v")
+        else
+            _PWR_TEMP_C="$PWR_NA"
+        fi
+    fi
+    return 0
+}
+
+# === Shared table chrome =====================================================
+_pwr_table_header() {
+    echo "==== $1 ===="
+    printf "%-4s %-9s %-8s %-7s %-3s %-17s %9s %9s %9s %8s\n" \
+        "No." "Location" "VRM" "SlaveID" "Pg" "Netname" "Vin(V)" "Vout(V)" "Iout(A)" "Temp(C)"
+    printf '%s\n' "-------------------------------------------------------------------------------------------------"
+}
+
+# === Public: pwr_data pdb ====================================================
+pwr_data_pdb() {
+    _pwr_vi2c_ready || return 1
+    local muxok=0
+    _pwr_pdb_mux_open && muxok=1
+
+    _pwr_table_header "PDB"
+    local n=0 entry loc model slave page net pgshow
+    for entry in "${PDB_RAILS[@]}"; do
+        IFS=':' read -r loc model slave page net <<< "$entry"
+        n=$(( n + 1 ))
+        if [ "$page" = "-" ]; then pgshow="-"; else pgshow="$(( page ))"; fi
+        _pwr_read_pdb_rail "$model" "$slave" "$page"
+        printf "%-4s %-9s %-8s %-7s %-3s %-17s %9s %9s %9s %8s\n" \
+            "$n" "$loc" "$model" "$slave" "$pgshow" "$net" \
+            "$_PWR_VIN_V" "$_PWR_VOUT_V" "$_PWR_IOUT_A" "$_PWR_TEMP_C"
+    done
+
+    if [ "$muxok" != "1" ]; then
+        echo -e "[\033[33mWARN\033[0m] mux $PDB_MUX_ADDR on ICB ch$PDB_VI2C_CH did not answer, so the brick"
+        echo    "       leg was never opened and 0x60..0x63 read as $PWR_NA."
+        echo    "       Run 'pwr_pdb_bus' to tell 'absent' from 'bus losing arbitration'."
+    fi
+    return 0
+}
+
+# True-ACK scan of the PDB bus. vi2c_scan / icb_i2c_scan only test RX_ACK and
+# ignore ARB_LOST (STAT bit5), so on a contended bus they report arbitration
+# failures as devices. This retries on ARB_LOST and lists the two cases apart.
+pwr_pdb_bus() {
+    _pwr_vi2c_ready || return 1
+    local ch="$PDB_VI2C_CH" b tx cm a st s try found="" arb="" rb
+    b=$(_vbase "$ch") || return 1
+    tx=$(printf '0x%X' $(( b + 0x0C )))
+    cm=$(printf '0x%X' $(( b + 0x10 )))
+    vi2c_init "$ch"
+    for (( a=0x08; a<=0x77; a++ )); do
+        for (( try=0; try<PDB_RETRY; try++ )); do
+            _vr "$tx" "$(printf '0x%X' $(( (a << 1) & 0xFF )))" >/dev/null
+            st=$(_vwait "$cm" "$(printf '0x%X' $(( V_STA | V_WR | V_STO )))")
+            s=$(( st ))
+            (( (s & _PWR_VI2C_ARBLOST) == 0 )) && break
+        done
+        if (( (s & _PWR_VI2C_ARBLOST) != 0 )); then
+            arb+="$(printf '0x%02X ' "$a")"
+        elif (( (s & V_RXACK) == 0 )); then
+            found+="$(printf '0x%02X ' "$a")"
+        fi
+    done
+    echo "  [PDB-BUS] ICB ch$ch true ACK       : ${found:-(none)}"
+    [ -n "$arb" ] && echo "  [PDB-BUS] persistent ARB_LOST     : ${arb% }"
+    if rb=$(_pwr_pdb_mux_read); then
+        printf '  [PDB-BUS] mux %s ctrl          : 0x%02X\n' "$PDB_MUX_ADDR" "$rb"
+    else
+        echo "  [PDB-BUS] mux $PDB_MUX_ADDR ctrl          : no response"
+    fi
+}
+
+# Identify whatever answers on the PDB bus: MFR_ID (0x99) / MFR_MODEL (0x9A) are
+# PMBus block reads (first byte = length), VOUT_MODE (0x20) is a single byte.
+# Needed to pin down the real conversions, which are generic guesses until then.
+pwr_pdb_id() {
+    _pwr_vi2c_ready || return 1
+    _pwr_pdb_mux_open >/dev/null 2>&1
+    local entry loc model slave page net r bytes x v asc
+    for entry in "${PDB_RAILS[@]}"; do
+        IFS=':' read -r loc model slave page net <<< "$entry"
+        printf '  %-16s %s\n' "$net" "$slave"
+        for r in 0x99 0x9A; do
+            bytes=$(_vrd "$PDB_VI2C_CH" "$(( slave ))" "$(( r ))" 12 2>/dev/null) \
+                || bytes=$(_vrd "$PDB_VI2C_CH" "$(( slave ))" "$(( r ))" 12 2>/dev/null)
+            if [ -n "$bytes" ]; then
+                asc=""
+                for x in $bytes; do
+                    v=$(( x ))
+                    if (( v >= 0x20 && v < 0x7F )); then asc+=$(printf '%b' "\\x$(printf '%02x' "$v")"); else asc+="."; fi
+                done
+                printf '    %s raw=[%s]\n' "$r" "$bytes"
+                printf '    %s asc="%s"\n' "$r" "$asc"
+            else
+                printf '    %s : no response\n' "$r"
+            fi
+        done
+        if v=$(_pwr_pdb_rd8 "$slave" 0x20); then
+            printf '    0x20 VOUT_MODE=0x%02X -> %s\n' "$v" "$(_pwr_pdb_vout_mode "$slave")"
+        else
+            echo "    0x20 VOUT_MODE : no response"
+        fi
+    done
+}
+
+# === Public: pwr_data [swb0|swb1|pdb|all] ====================================
+pwr_data() {
+    local board
+    board="$(echo "${1:-swb0}" | tr 'A-Z' 'a-z')"
+    case "$board" in
+        all) pwr_data swb0; echo ""; pwr_data swb1; echo ""; pwr_data pdb; return ;;
+        pdb) pwr_data_pdb; return ;;
+    esac
+
+    local off
+    off=$(_pwr_board_offset "$board") || {
+        echo -e "[\033[31mERRO\033[0m] Usage: pwr_data [swb0|swb1|pdb|all]"; return 1; }
+    local tag="SWB${off}"
+
+    if ! declare -F cb_pmbus_read >/dev/null 2>&1; then
+        echo -e "[\033[31mERRO\033[0m] cb_pmbus_read() missing - source blanton_cb_i2c.sh"; return 1
+    fi
+
+    # Init each I2C channel once and disable per-transfer auto-init: the table is
+    # ~80 PMBus transactions and every init costs 4 more pcimem calls.
+    local _save_auto="$CB_I2C_AUTO_INIT" chans="" c seen
+    for entry in "${PWR_RAILS[@]}"; do
+        IFS=':' read -r _ _ c _ _ _ <<< "$entry"
+        c=$(( c + off ))
+        seen=0; for x in $chans; do [ "$x" = "$c" ] && seen=1; done
+        [ "$seen" = "0" ] && chans="$chans $c"
+    done
+    for c in $chans; do cb_i2c_init "$c" >/dev/null; done
+    CB_I2C_AUTO_INIT=0
+
+    _pwr_table_header "$tag"
+
+    local n=0 loc vrm ch slave page net
+    for entry in "${PWR_RAILS[@]}"; do
+        IFS=':' read -r loc vrm ch slave page net <<< "$entry"
+        ch=$(( ch + off ))
+        n=$(( n + 1 ))
+        _pwr_read_rail "$vrm" "$ch" "$slave" "$page"
+        printf "%-4s %-9s %-8s %-7s %-3s %-17s %9s %9s %9s %8s\n" \
+            "$n" "$loc" "$vrm" "$slave" "$(( page ))" "$net" \
+            "$_PWR_VIN_V" "$_PWR_VOUT_V" "$_PWR_IOUT_A" "$_PWR_TEMP_C"
+    done
+
+    CB_I2C_AUTO_INIT="${_save_auto:-1}"
+    return 0
+}
+
+# === Help ====================================================================
+pwr_data_help() {
+    echo -e "\033[1mblanton_pwr_data.sh - SWB / PDB power rail monitor\033[0m"
+    echo ""
+    echo -e "  \033[33mpwr_data\033[0m [swb0|swb1|pdb|all]  read Vin/Vout/Iout/Temp for every rail"
+    echo -e "  \033[33mpwr_pdb_bus\033[0m                   true-ACK scan of the PDB bus (rejects ARB_LOST)"
+    echo -e "  \033[33mpwr_pdb_id\033[0m                    MFR_ID / MFR_MODEL / VOUT_MODE of the PDB parts"
+    echo -e "  \033[33mpwr_debug\033[0m on|off              show each PMBus word read"
+    echo ""
+    echo -e "  SWB: \033[36mcb_pmbus_*\033[0m on CB F3 I2C. SWB0 = ch 6/8, SWB1 = ch 7/9."
+    echo -e "  PDB: \033[36mVI2C\033[0m ICB ch$PDB_VI2C_CH -> mux $PDB_MUX_ADDR ch0 -> bricks 0x60..0x63 + EFUSE 0x26."
+    echo -e "  Anything that does not answer prints \033[90m$PWR_NA\033[0m."
+    echo -e "  \033[33mPDB conversions are generic PMBus and NOT yet verified\033[0m - see the file header."
+}
+
+pwr_data_help
@@ -0,0 +1,225 @@
+#!/usr/bin/env bash
+# =============================================================================
+# blanton_temp_sensor.sh  --  Blanton CB + ICB(PDB) temperature sensor reader
+# =============================================================================
+# V0.1.0  2026-08-11  Reads every board temp sensor through the existing I2C
+#                     helpers and converts the raw registers to degC.
+#
+# Topology (verified on DUT COM37, 2026-08-11):
+#
+#   CB  : CB FPGA F3 I2C **Ch10** -> TCA9543 mux @0x70 (FPGA drives its RESET,
+#         released by cb_i2c_mux_reset_release / F0 0x7D4 <= 0xFF).
+#         mux ctrl 0x01 = leg0 = TEMP bus   : TMP75 0x48, TMP75 0x49, TMP432 0x4C
+#         mux ctrl 0x02 = leg1 = DEBUG bus  : PCIe fanout buf 0x6B/0x6D + hdr
+#         NOTE: CB_tree.png draws DEBUG on the upper leg and TEMP on the lower
+#         one; on real HW the TEMP devices answer with ctrl=0x01 (leg0).
+#         Backend: blanton_cb_i2c.sh (cb_i2c_read / cb_i2c_muxwrite)
+#
+#   ICB : ICB(PDB) I2C **Ch2**, no mux : TMP75 U8 0x48, TMP75 U33 0x49,
+#         TMP432 U29 0x4C
+#         Backend: blanton_icb_vi2c.sh (CB F3 VI2C proxy, vi2c_read).
+#         Do NOT use blanton_icb_i2c.sh here: VSPI is ~18 ms/register, which
+#         trips the SMBus 25-35 ms timeout and the sensors NACK the pointer.
+#
+# Conversion (datasheets in this folder):
+#   TMP75  (SBOS288J) : reg 0x00, 2 bytes, 12-bit left-justified two's
+#                       complement -> T = (raw16 >> 4) * 0.0625
+#   TMP432 (SBOS441I) : local  hi 0x00 / lo 0x29  (2-byte read from 0x00)
+#                       remote1 hi 0x01 / lo 0x10
+#                       remote2 hi 0x23 / lo 0x24
+#                       T = (raw16 >> 4) * 0.0625, minus 64 when CONFIG1(0x03)
+#                       bit2 RANGE = 1 (extended -64..191C mode)
+#                       ID: 0xFD = 0x32 (device), 0xFE = 0x55 (TI)
+#                       open-diode status: 0x1B bit1 R2OPEN / bit0 R1OPEN
+#
+# Usage:
+#   ./blanton_temp_sensor.sh              # CB + ICB, one pass
+#   ./blanton_temp_sensor.sh -r           # also show TMP432 remote1/remote2
+#   ./blanton_temp_sensor.sh -c | -i      # CB only / ICB only
+#   ./blanton_temp_sensor.sh -n 10 -t 5   # 10 passes, 5 s apart (-n 0 = forever)
+#   source blanton_temp_sensor.sh ; temp_all ; temp_cb ; temp_icb
+# =============================================================================
+
+# --- pull in the I2C backends ------------------------------------------------
+_TS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
+_ts_need() {
+    local fn="$1" file="$2"
+    declare -F "$fn" >/dev/null 2>&1 && return 0
+    if [ -f "$_TS_DIR/$file" ]; then
+        # shellcheck source=/dev/null
+        source "$_TS_DIR/$file" >/dev/null 2>&1
+    fi
+    declare -F "$fn" >/dev/null 2>&1 && return 0
+    echo "[ERR] blanton_temp_sensor.sh: $fn() missing (need $file)" >&2
+    return 1
+}
+_ts_need cb_fpga            blanton_fpga_pcimem.sh || true
+_ts_need _cbi2c_xfer_read   blanton_cb_i2c.sh      || true
+_ts_need _vrd               blanton_icb_vi2c.sh    || true
+
+# --- geometry / device tables ------------------------------------------------
+TS_CB_CH="${TS_CB_CH:-10}"          # CB FPGA F3 I2C channel with the temp bus
+TS_CB_MUX="${TS_CB_MUX:-0x70}"      # TCA9543 on that channel
+TS_CB_MUX_TEMP="${TS_CB_MUX_TEMP:-0x01}"   # leg0 = temp sensors
+TS_ICB_CH="${TS_ICB_CH:-2}"         # ICB VI2C channel with the temp bus
+
+# "<7-bit addr>:<type>" in the order they are printed
+TS_CB_LIST="${TS_CB_LIST:-0x48:TMP75 0x49:TMP75 0x4C:TMP432}"
+TS_ICB_LIST="${TS_ICB_LIST:-0x48:TMP75 0x49:TMP75 0x4C:TMP432}"
+
+# TMP432 register pointers
+_TS432_LOCAL=0x00
+_TS432_REM1=0x01
+_TS432_REM2=0x23
+_TS432_CFG1=0x03
+_TS432_OPEN=0x1B
+
+# =============================================================================
+# conversion helpers
+# =============================================================================
+# _ts_word <hi> <lo>            -> decimal 16-bit word
+_ts_word() { echo $(( ( $(($1)) & 0xFF ) << 8 | ( $(($2)) & 0xFF ) )); }
+
+# _ts_c12 <word16> <mode>       mode: signed | offset64
+#   signed   : 12-bit two's complement (TMP75, TMP432 std range >=0)
+#   offset64 : TMP432 extended range, value - 64
+_ts_c12() {
+    awk -v w="$1" -v m="$2" 'BEGIN{
+        r = int(w/16);
+        if (m == "offset64") { printf "%.1f", r*0.0625 - 64.0; }
+        else { if (r >= 2048) r -= 4096; printf "%.1f", r*0.0625; }
+    }'
+}
+
+# _ts_fmt <addr> <label> <word> <mode>
+_ts_fmt() {
+    printf 'TMP(0x%02X) = %sC (0x%04X)\n' "$(($1))" "$(_ts_c12 "$3" "$4")" "$3"
+}
+_ts_fmt_sub() {   # indented extra channel line: <name> <word> <mode>
+    printf '            %-8s = %sC (0x%04X)\n' "$1" "$(_ts_c12 "$2" "$3")" "$2"
+}
+_ts_err() { printf 'TMP(0x%02X) = ERR (%s)\n' "$(($1))" "$2"; }
+
+# =============================================================================
+# raw bus access wrappers  (echo "0xHH 0xHH", empty on failure)
+# =============================================================================
+_ts_cb_rd()  { _cbi2c_xfer_read "$TS_CB_CH"  "$(($1))" "$(($2))" "$3" 2>/dev/null; }
+_ts_icb_rd() { _vrd             "$TS_ICB_CH" "$(($1))" "$(($2))" "$3" 2>/dev/null; }
+
+# _ts_read_one <rd_fn> <addr> <type> <show_remote>
+_ts_read_one() {
+    local rd="$1" addr="$2" type="$3" rem="$4" b hi lo w cfg mode open
+    case "$type" in
+      TMP75)
+        b=$($rd "$addr" 0x00 2) || { _ts_err "$addr" "no response"; return 1; }
+        [ -z "$b" ] && { _ts_err "$addr" "no response"; return 1; }
+        hi=$(echo "$b" | awk '{print $1}'); lo=$(echo "$b" | awk '{print $2}')
+        w=$(_ts_word "$hi" "$lo")
+        _ts_fmt "$addr" TMP75 "$w" signed
+        ;;
+      TMP432)
+        cfg=$($rd "$addr" $_TS432_CFG1 1) || { _ts_err "$addr" "no response"; return 1; }
+        [ -z "$cfg" ] && { _ts_err "$addr" "no response"; return 1; }
+        if (( ( $(($(echo "$cfg" | awk '{print $1}'))) & 0x04 ) != 0 )); then
+            mode=offset64; else mode=signed; fi
+        b=$($rd "$addr" $_TS432_LOCAL 2)
+        [ -z "$b" ] && { _ts_err "$addr" "local read fail"; return 1; }
+        w=$(_ts_word "$(echo "$b" | awk '{print $1}')" "$(echo "$b" | awk '{print $2}')")
+        _ts_fmt "$addr" TMP432 "$w" "$mode"
+        [ "$rem" = "1" ] || return 0
+        open=$($rd "$addr" $_TS432_OPEN 1)
+        open=$(echo "$open" | awk '{print $1}'); open=$(( ${open:-0} ))
+        b=$($rd "$addr" $_TS432_REM1 2)
+        if (( (open & 0x01) != 0 )); then printf '            %-8s = OPEN\n' Remote1
+        elif [ -n "$b" ]; then
+            _ts_fmt_sub Remote1 "$(_ts_word "$(echo "$b" | awk '{print $1}')" "$(echo "$b" | awk '{print $2}')")" "$mode"
+        fi
+        b=$($rd "$addr" $_TS432_REM2 2)
+        if (( (open & 0x02) != 0 )); then printf '            %-8s = OPEN\n' Remote2
+        elif [ -n "$b" ]; then
+            _ts_fmt_sub Remote2 "$(_ts_word "$(echo "$b" | awk '{print $1}')" "$(echo "$b" | awk '{print $2}')")" "$mode"
+        fi
+        ;;
+      *) _ts_err "$addr" "unknown type $type"; return 1 ;;
+    esac
+}
+
+# =============================================================================
+# public: per-board readers
+# =============================================================================
+# temp_cb [-r]
+temp_cb() {
+    local rem=0 e a t
+    [ "$1" = "-r" ] && rem=1
+    echo "=== CB ==="
+    declare -F cb_i2c_muxwrite >/dev/null 2>&1 || { echo "TMP: ERR (blanton_cb_i2c.sh not loaded)"; return 1; }
+    # release the FPGA-driven mux RESET and steer the TCA9543 to the temp leg
+    cb_i2c_muxwrite "$TS_CB_CH" "$TS_CB_MUX" "$TS_CB_MUX_TEMP" >/dev/null 2>&1 \
+        || { echo "TMP: ERR (mux 0x70 no ACK on ch$TS_CB_CH)"; return 1; }
+    for e in $TS_CB_LIST; do
+        a="${e%%:*}"; t="${e##*:}"
+        _ts_read_one _ts_cb_rd "$a" "$t" "$rem"
+    done
+}
+
+# temp_icb [-r]
+temp_icb() {
+    local rem=0 e a t
+    [ "$1" = "-r" ] && rem=1
+    echo "=== ICB ==="
+    declare -F vi2c_init >/dev/null 2>&1 || { echo "TMP: ERR (blanton_icb_vi2c.sh not loaded)"; return 1; }
+    vi2c_init "$TS_ICB_CH" >/dev/null 2>&1
+    for e in $TS_ICB_LIST; do
+        a="${e%%:*}"; t="${e##*:}"
+        _ts_read_one _ts_icb_rd "$a" "$t" "$rem"
+    done
+}
+
+# temp_all [-r]
+temp_all() {
+    temp_cb "$1"
+    echo ""
+    temp_icb "$1"
+}
+
+temp_sensor_help() {
+    echo "blanton_temp_sensor.sh - Blanton CB(Ch$TS_CB_CH, mux $TS_CB_MUX leg $TS_CB_MUX_TEMP) + ICB(Ch$TS_ICB_CH) temp sensors"
+    echo "  temp_all  [-r]      CB + ICB   (-r also prints TMP432 remote1/remote2)"
+    echo "  temp_cb   [-r]      CB  : TMP75 0x48, TMP75 0x49, TMP432 0x4C"
+    echo "  temp_icb  [-r]      ICB : TMP75 U8 0x48, TMP75 U33 0x49, TMP432 U29 0x4C"
+    echo "  CLI: ./blanton_temp_sensor.sh [-r] [-c|-i] [-n count] [-t sec]"
+}
+
+# =============================================================================
+# CLI entry point (only when executed, not when sourced)
+# =============================================================================
+_ts_main() {
+    local rem="" what=all n=1 iv=2 k=0
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            -r|--remote) rem="-r" ;;
+            -c|--cb)     what=cb ;;
+            -i|--icb)    what=icb ;;
+            -n)          shift; n="$1" ;;
+            -t)          shift; iv="$1" ;;
+            -h|--help)   temp_sensor_help; return 0 ;;
+            *) echo "unknown option: $1"; temp_sensor_help; return 1 ;;
+        esac
+        shift
+    done
+    while :; do
+        k=$((k+1))
+        [ "$n" != "1" ] && echo "---- pass $k  $(date '+%F %T') ----"
+        case "$what" in
+            cb)  temp_cb  "$rem" ;;
+            icb) temp_icb "$rem" ;;
+            *)   temp_all "$rem" ;;
+        esac
+        [ "$n" != "0" ] && [ "$k" -ge "$n" ] && break
+        sleep "$iv"
+    done
+}
+
+if [ "${BASH_SOURCE[0]}" = "$0" ]; then
+    _ts_main "$@"
+fi
@@ -0,0 +1,15 @@
+;================================================================
+; User Configuration
+;================================================================
+strTestcase="Margin"
+project_name = "Blanton"
+
+EN_Margin         = 1  ; 1: Enable Margin Test, 0: Disable Margin Test
+
+EN_log            = 1  ; 1: Enable log, 0: Disable log
+;================================================================
+; Prompt Definitions
+;================================================================
+prompt_login = "sonic login:"
+prompt_sonic = "admin@sonic:~$"
+prompt_sonic_root = "root@sonic:~#"
@@ -0,0 +1,2 @@
+wait prompt_sonic_root
+sendln "kill $(jobs -p)"
@@ -0,0 +1,4 @@
+wait prompt_sonic_root
+sendln "lspci -tvvv"
+wait prompt_sonic_root
+sendln "lspci -vv"
@@ -0,0 +1,14 @@
+wait prompt_sonic_root
+sendln "show platform summary"
+wait prompt_sonic_root
+sendln "show platform fan"
+wait prompt_sonic_root
+sendln "show platform temperature"
+wait prompt_sonic_root
+sendln "show platform psustatus"
+wait prompt_sonic_root
+sendln "show platform voltage"
+wait prompt_sonic_root
+sendln "show platform current"
+wait prompt_sonic_root
+sendln "show platform ssdhealth"
@@ -0,0 +1,8 @@
+wait prompt_sonic_root
+sendln "date"
+wait prompt_sonic_root
+sendln "dmesg | grep -i error"
+wait prompt_sonic_root
+sendln "dmesg | grep -i fail"
+wait prompt_sonic_root
+sendln "dmesg | grep -i warning"
@@ -0,0 +1,46 @@
+wait prompt_sonic_root
+sendln "source ~/Blanton_Script/LTC2980_Margin_Script/script/margin_status_all.sh"
+
+/*
+wait prompt_sonic_root
+sendln "margin_init Blanton_CB_CONN13.conf"
+
+wait prompt_sonic_root
+sendln "margin_init Blanton_CB_CONN13.conf"
+wait prompt_sonic_root
+sendln "margin_status"
+
+wait prompt_sonic_root
+sendln "margin_init Blanton_SWB0_CONN13.conf"
+wait prompt_sonic_root
+sendln "margin_status"
+wait prompt_sonic_root
+sendln "margin_init Blanton_SWB0_CONN14.conf"
+wait prompt_sonic_root
+sendln "margin_status"
+wait prompt_sonic_root
+sendln "margin_init Blanton_SWB0_CONN15.conf"
+wait prompt_sonic_root
+sendln "margin_status"
+wait prompt_sonic_root
+sendln "margin_init Blanton_SWB0_CONN16.conf"
+wait prompt_sonic_root
+sendln "margin_status"
+
+wait prompt_sonic_root
+sendln "margin_init Blanton_SWB1_CONN13.conf"
+wait prompt_sonic_root
+sendln "margin_status"
+wait prompt_sonic_root
+sendln "margin_init Blanton_SWB1_CONN14.conf"
+wait prompt_sonic_root
+sendln "margin_status"
+wait prompt_sonic_root
+sendln "margin_init Blanton_SWB1_CONN15.conf"
+wait prompt_sonic_root
+sendln "margin_status"
+wait prompt_sonic_root
+sendln "margin_init Blanton_SWB1_CONN16.conf"
+wait prompt_sonic_root
+sendln "margin_status"
+*/
@@ -0,0 +1,10 @@
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000\:00\:01.2/aer_dev_correctable"
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000\:00\:01.2/aer_dev_fatal"
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000\:00\:01.2/aer_dev_nonfatal"
+wait prompt_sonic_root
+sendln "cat /sys/devices/system/edac/mc/mc0/rank0/dimm_ce_count"
+wait prompt_sonic_root
+sendln "cat /sys/devices/system/edac/mc/mc0/rank0/dimm_ue_count"
@@ -0,0 +1,15 @@
+;Endpoint AER
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:03:00.0/aer_dev_correctable"
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:03:00.0/aer_dev_nonfatal"
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:03:00.0/aer_dev_fatal"
+
+;Upstream root-port AER
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:00:01.4/aer_dev_correctable"
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:00:01.4/aer_dev_nonfatal"
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:00:01.4/aer_dev_fatal"
@@ -0,0 +1,23 @@
+;EDAC channel 0 (sysfs rank0)
+wait prompt_sonic_root
+sendln "cat /sys/devices/system/edac/mc/mc0/rank0/dimm_ce_count"
+wait prompt_sonic_root
+sendln "cat /sys/devices/system/edac/mc/mc0/rank0/dimm_ue_count"
+
+;EDAC channel 1 (sysfs rank1)
+wait prompt_sonic_root
+sendln "cat /sys/devices/system/edac/mc/mc0/rank1/dimm_ce_count"
+wait prompt_sonic_root
+sendln "cat /sys/devices/system/edac/mc/mc0/rank1/dimm_ue_count"
+
+;EDAC channel 2 (sysfs rank2)
+wait prompt_sonic_root
+sendln "cat /sys/devices/system/edac/mc/mc0/rank2/dimm_ce_count"
+wait prompt_sonic_root
+sendln "cat /sys/devices/system/edac/mc/mc0/rank2/dimm_ue_count"
+
+;EDAC channel 3 (sysfs rank3)
+wait prompt_sonic_root
+sendln "cat /sys/devices/system/edac/mc/mc0/rank3/dimm_ce_count"
+wait prompt_sonic_root
+sendln "cat /sys/devices/system/edac/mc/mc0/rank3/dimm_ue_count"
@@ -0,0 +1,7 @@
+;Shared upstream root-port AER
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:00:01.5/aer_dev_correctable"
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:00:01.5/aer_dev_nonfatal"
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:00:01.5/aer_dev_fatal"
@@ -0,0 +1,15 @@
+;Endpoint AER
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:07:00.0/aer_dev_correctable"
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:07:00.0/aer_dev_nonfatal"
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:07:00.0/aer_dev_fatal"
+
+;Upstream root-port AER
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:00:02.4/aer_dev_correctable"
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:00:02.4/aer_dev_nonfatal"
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:00:02.4/aer_dev_fatal"
@@ -0,0 +1,15 @@
+;Endpoint AER
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:06:00.0/aer_dev_correctable"
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:06:00.0/aer_dev_nonfatal"
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:06:00.0/aer_dev_fatal"
+
+;Upstream root-port AER
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:00:02.1/aer_dev_correctable"
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:00:02.1/aer_dev_nonfatal"
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:00:02.1/aer_dev_fatal"
@@ -0,0 +1,15 @@
+;Endpoint AER
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:01:00.0/aer_dev_correctable"
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:01:00.0/aer_dev_nonfatal"
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:01:00.0/aer_dev_fatal"
+
+;Upstream root-port AER
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:00:01.1/aer_dev_correctable"
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:00:01.1/aer_dev_nonfatal"
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:00:01.1/aer_dev_fatal"
@@ -0,0 +1,15 @@
+;Endpoint AER
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:02:00.0/aer_dev_correctable"
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:02:00.0/aer_dev_nonfatal"
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:02:00.0/aer_dev_fatal"
+
+;Upstream root-port AER
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:00:01.2/aer_dev_correctable"
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:00:01.2/aer_dev_nonfatal"
+wait prompt_sonic_root
+sendln "cat /sys/bus/pci/devices/0000:00:01.2/aer_dev_fatal"