CMIS lower page register map

The lower 128 bytes of a CMIS module (QSFP-DD, OSFP, QSFP112, SFP-DD with CMIS…) are always visible and carry the module-level runtime interface: identifier and CMIS version, module state, flags and masks, module monitors, global controls, CDB status, media type, the first eight application descriptors, password entry and the bank/page selectors. This page lists them byte by byte and bit by bit, compiled against CMIS 5.x with 4.x differences noted. Narrative: CMIS; upper pages in CMIS upper pages map; per-lane pages in CMIS lane pages map.

Legend: rsvd = reserved · custom = vendor specific · flags are latched, cleared on read; a mask bit = 1 suppresses the flag's contribution to IntL.

Identification and state — bytes 0–7

Byte	Field	Bits / values
0	Identifier	SFF-8024 Table 4-1: 18h QSFP-DD · 19h OSFP · 1Eh QSFP+/28/56 with CMIS · 1Fh SFP-DD with CMIS · 20h SFP+ with CMIS (SFP112) · 21h OSFP-XD
1	CMIS revision	7–4 major · 3–0 minor: 30h = 3.0 · 40h = 4.0 · 41h = 4.1 · 50h = 5.0 · 51h–53h = 5.1–5.3
2	Memory characteristics	7 MemoryModel (1 = flat, no paging) · 6 SteppedConfigOnly (1 = data-path config must be applied lane by lane) · 5–4 rsvd · 3–2 MciMaxSpeed: 00 = 400 kHz · 01 = 1 MHz · 1–0 rsvd
3	Module state	7–4 rsvd · 3–1 ModuleState: 001 ModuleLowPwr · 010 ModulePwrUp · 011 ModuleReady · 100 ModulePwrDn · 101 ModuleFault · 0 InterruptDeasserted (1 = no interrupt pending)
4	Bank 0 flag summary	one bit per flag group present in bank 0 lane pages (data-path state changed, Tx/Rx flags, alarms) — read to know which bank to inspect
5	Bank 1 flag summary	as byte 4 for lanes 9–16
6	Bank 2 flag summary	lanes 17–24
7	Bank 3 flag summary	lanes 25–32

Module flags — bytes 8–11

Byte	Field	Bits
8	Module-level flags	7–5 rsvd · 4 CdbCmdComplete2 · 3 CdbCmdComplete1 · 2 DataPathFirmwareFault · 1 ModuleFirmwareFault · 0 ModuleStateChanged
9	Temperature / Vcc flags	7 Vcc low warning · 6 Vcc high warning · 5 Vcc low alarm · 4 Vcc high alarm · 3 temp low warning · 2 temp high warning · 1 temp low alarm · 0 temp high alarm
10	Aux1 / Aux2 flags	7 Aux2 low warning · 6 Aux2 high warning · 5 Aux2 low alarm · 4 Aux2 high alarm · 3 Aux1 low warning · 2 Aux1 high warning · 1 Aux1 low alarm · 0 Aux1 high alarm
11	Aux3 / custom flags	7–4 custom monitor low warning / high warning / low alarm / high alarm · 3 Aux3 low warning · 2 Aux3 high warning · 1 Aux3 low alarm · 0 Aux3 high alarm
12–13	rsvd	—

Module monitors — bytes 14–25

Bytes	Monitor	Format
14–15	Temperature	signed 16-bit, 1/256 °C
16–17	Vcc	unsigned 16-bit, 100 µV
18–19	Aux1	TEC current (signed, % of max ×100/32767) or laser temperature (1/256 °C) — type advertised in page 01h
20–21	Aux2	laser temperature or TEC current
22–23	Aux3	laser temperature or additional supply voltage (100 µV)
24–25	Custom monitor	vendor defined

Global controls and masks — bytes 26–36

Byte	Field	Bits
26	Module global controls	CMIS 5.x: 7 rsvd · 6 LowPwrAllowRequestHW (1 = the LPMode pin may request low power) · 5 SquelchMethodSelect (0 = OMA squelch, 1 = Pave) · 4 LowPwrRequestSW (1 = request low power) · 3 SoftwareReset · 2–0 rsvd · 4.x: 6 = LowPwr (software low-power request) · 4 = ForceLowPwr · 5 and 3 as above
27	Module flag masks	masks for byte 8 (same bit positions)
28	Temperature / Vcc masks	masks for byte 9
29	Aux1 / Aux2 masks	masks for byte 10
30	Aux3 / custom masks	masks for byte 11
31–36	rsvd	—

CDB status and firmware — bytes 37–41

Byte	Field	Bits / values
37	CdbStatus1 (command block 1)	7 CdbIsBusy · 6 CdbHasFailed · 5–0 CdbCommandResult: while busy — 01h capturing command, 02h checking, 03h executing; on success — 01h success, 02h no response? ; on failure — 01h unknown command, 02h parameter out of range, 03h length error, 04h checksum error, 05h password error, 06h not enabled, 07h abort? … (see CMIS Table 8-20)
38	CdbStatus2 (command block 2)	same layout
39	Module active firmware — major	running image version
40	Module active firmware — minor	—
41	ModuleFaultCause	00h no fault · 01h TEC runaway · 02h data memory corrupted · 03h program memory corrupted · 04h–1Fh rsvd · 20h–FFh custom
42–63	rsvd	—
64–84	rsvd / custom	per revision

Media type and applications — bytes 85–117

Byte	Field	Contents
85	MediaType	00h undefined · 01h MMF (SFF-8024 Table 4-6) · 02h SMF (4-7) · 03h passive copper (4-8) · 04h active cable (4-9) · 05h BASE-T (4-10) · 06h–3Fh rsvd · 40h–8Fh custom
86–89	Application descriptor 1	byte 86 HostInterfaceID (SFF-8024 Table 4-5) · 87 MediaInterfaceID (table per byte 85) · 88 bits 7–4 HostLaneCount, 3–0 MediaLaneCount · 89 HostLaneAssignmentOptions — bit n = 1: lane n+1 may be the first lane of this application's data path
90–93	Application descriptor 2	same layout
94–97	Application descriptor 3	—
98–101	Application descriptor 4	—
102–105	Application descriptor 5	—
106–109	Application descriptor 6	—
110–113	Application descriptor 7	—
114–117	Application descriptor 8	—

An FFh in a descriptor's first byte terminates the list. Descriptors 9–15 continue on page 01h bytes 223–250; their media-lane assignment options are on page 01h 176–190. Example: 12 1C 84 01 = 400GAUI-8 C2M ↔ 400GBASE-DR4, 8 host lanes / 4 media lanes, starting on host lane 1; 0E 14 21 55 = 100GAUI-2 ↔ 100GBASE-DR, 2/1 lanes, may start on lanes 1, 3, 5, 7 (4 × 100G breakout).

Passwords and selectors — bytes 118–127

Byte	Field	Contents
118–121	Password change entry	vendor defined
122–125	Password entry	vendor defined — Write-protection types
126	BankSelect	00h bank 0 (lanes 1–8) · 01h bank 1 (9–16) · 02h bank 2 · 03h bank 3; applies to banked pages 10h–3Fh
127	PageSelect	00h identity · 01h advertising · 02h thresholds · 04h laser capabilities · 10h lane control · 11h lane status · 12h tunable control · 13h–14h diagnostics · 20h–2Fh VDM · 9Fh CDB · A0h–AFh CDB EPL · 80h–8Fh… custom

Reading a QSFP-DD lower page in practice

Byte 0 = 18h, byte 1 = 50h → QSFP-DD, CMIS 5.0; byte 2 bit 7 = 0 → paged memory.
Byte 3 = 03h → ModuleLowPwr (001 in bits 3–1, interrupt deasserted) — normal right after insertion; 07h → ModuleReady.
Byte 85 = 02h → SMF media table; bytes 86–89 → the first application (e.g. DR4).
Bytes 8–11 → any module flag set? Read twice to clear history.
Bytes 14–17 → temperature and Vcc.
To leave low power in 5.x: clear byte 26 bit 4 (LowPwrRequestSW) and ensure the LPMode pin is low or bit 6 is 0; then wait for byte 3 to reach 07h.

CMIS upper pages map — page 00h identity, 01h advertising, 02h thresholds.
CMIS lane pages map — pages 10h/11h, VDM, CDB.
SFF-8636 lower page map — the QSFP28 equivalent.