> The BMC (IPMI) is also a self sufficient ARM computer
ASPEED BMC SoCs (popular BMC SoCs also used in OpenPOWER systems) have a ColdFire (m68k) co-processor buried inside them. In OpenPOWER OpenBMC firmwares we use the ColdFire to bitbang a JTAG-ish protocol into the POWER chip
If it's anything like Cell, it's just a bunch of fairly boring configuration information. If you want to dig in more it's called the "Configuration Ring". It's an about 2kbit SPI ring that has stuff like memory timings, and all the stuff that might get fused off for binning. On the PS3 you could try and turn on the SPE that was disabled by playing with the config ring, and see if you got lucky and had a perfect chip.
ASPEED BMC SoCs (popular BMC SoCs also used in OpenPOWER systems) have a ColdFire (m68k) co-processor buried inside them. In OpenPOWER OpenBMC firmwares we use the ColdFire to bitbang a JTAG-ish protocol into the POWER chip