search

neuschaefer / wpcm450

Nuvoton WPCM450 tools and documentation
26 stars 4 forks source link

that is very interesting! (Supermicro X8DTT-HF+) #1

Open ssbarnea opened 3 years ago

ssbarnea commented 3 years ago

Hi @neuschaefer and sorry for abusing the issue tracker for contacting you regarding the infamous Nuvoton WPCM450 BMC. I happen to have a 4-node supermicro server in my garage homelab, which I use mostly for testing, and I would really want to be able to replace the outdated BMC software that it has with somethign more open, like openbmc.

Please let me know if there is something I can do to help with testing in this area. As I do only use only one of the nodes, I am willing to risk breaking the firmware in the name of freedom.

neuschaefer commented 3 years ago

Hi, welcome to the project!

At the moment, my Linux port (based on recent mainline) is in a very early stage (basic SoC support just got merged into linux-next).

There are a few first things you can do and document somewhere for future reference:

For the medium future, my plan is to make a minimal userspace based on buildroot (perhaps similar to !BMC), that will include all the necessary tools for BMC functionality (power on/off, remote KVM, POST code tracing, BIOS update). OpenBMC might come at some point, but I'll first prototype something simpler.

neuschaefer commented 3 years ago

@ssbarnea I'm curious — what's the model name of your server?

ssbarnea commented 3 years ago

X8DTT-F are the boards but at boot time I get:

Supermicro X8DTT-H/X8DTT-H, BIOS 2.1c       04/22/2014

I think that the server model is SS6026TT-HTRF

neuschaefer commented 3 years ago

Ah, I've seen a few times with Supermicro, that there are different variants of the same PCB, which just have different components populated and unpopulated. I guess this is also the case with X8DTT-F vs. X8DTT-H, even to the point where they use the same BIOS.

ssbarnea commented 3 years ago

If I remember well the difference is if it has or not infiniband, mine do not have it. Should I try to grab some photos with front/back of the board?

slavonnet commented 3 years ago

https://github.com/openbmc/openbmc/issues/3786

neuschaefer commented 3 years ago

@ssbarnea X-ray photos of the board in the area of the BMC would be ideal, but regular photos are useful too. Meanwhile I got a X8DFF-HIBQF+ and will document what I know soon. I haven't found the UART TX signal though…

neuschaefer commented 3 years ago

@ssbarnea I made a few pictures of my board at https://github.com/neuschaefer/linux/wiki/Supermicro-X8DTT-family, but then I noticed that the -H variants and the variants without -H have a different layout around the BMC (most notably, the RAM is in a different position). Because of these layout differences, my note probably won't be very useful to you. I am curious to see close-up pictures of the area around the BMC on your board.

ssbarnea commented 3 years ago

My boards are X8DTT-HF+ and they indeed have the proprietary connector. Here is a photo taken around the BMC: supermicro-X8DTT-HF+-bmc

neuschaefer commented 3 years ago

Good. This means that you should be able to access the BMC's UART as I documented (with a 3.3V serial adapter), which is always useful for low-level debugging and testing.

I don't have a clear view of how the AMI firmware works, yet, but I'll notify you when I have something to test.

Meanwhile, if you want to play around with very very minimal Linux, the nuvoton-wpcm450-supermicro-x9sci-ln4f devicetree that was merged for Linux 5.13 should work without causing harm (as long as it doesn't know about GPIOs).

slavonnet commented 3 years ago

Have 2 x Intel S2600GZ (last kernel 5.12) 2 x Supermicro X9DRT-F (last kernel 5.12) 4 x Supermicro X9DRT-F/IBFF (win 2019) 1 x Supermicro X8DTN+-F (win 2016) with broken IPMI firmware (bios boot 10+ minx,. say ipmi load failed and continue.). After update to x10 series IPMI FW. Not found ideas or mans to recovery it remotely.

if need some tests for replace bios/ipmi fw... .you a wellcome

neuschaefer commented 3 years ago

Hi @slavonnet, thanks for the list.

I've created a wiki page to keep track of who can test on which board: List of mainboards

As far as I can tell, the Intel S2600GZ doesn't seem to have a WPCM450 but a different BMC. I'm not absolutely sure though, because I couldn't find good pictures of it.

slavonnet commented 3 years ago

Hi @slavonnet, thanks for the list.

I've created a wiki page to keep track of who can test on which board: List of mainboards

As far as I can tell, the Intel S2600GZ doesn't seem to have a WPCM450 but a different BMC. I'm not absolutely sure though, because I couldn't find good pictures of it.

We use Intel AXXRMM4R module. In intel only 4 modules for IPMI. Its full features (but can't update bios, unbrick bios or flash ipmi). Only Viewver and logs... :(

Here HW info from Intel Server s2600GZ4_dmidecode.txt s2600GZ4_lshw.txt s2600GZ4_lspci.txt

slavonnet commented 3 years ago

Here BMC FW for all Supermicro X9 Mainboards (and some X8,X10). Many GPIO and other BUIS can be grabbed from configs. Last version is 3.64 https://www.supermicro.com/wdl/GPL/SMT/SDK_SMT_X9_317.tar.gz

Here full SDK for WinBoard BMC https://www.supermicro.com/wdl/GPL/AMI/SMC_winbond_opensrc_10090602.tar.gz

Here all BMC and BIOS for SuperMicro https://www.supermicro.com/support/resources/bios_ipmi.php?type=BMC Try search X9 in search input

i REALY think what all X9 use COMMON FW (becouse different MB get one bin to updatye) and common configs can't be grabbed from BIN

slavonnet commented 3 years ago

image

neuschaefer commented 3 years ago

s2600GZ4_lspci.txt

The lspci has the following lines:

0b:00.0 VGA compatible controller: Matrox Electronics Systems Ltd. MGA G200e [Pilot] ServerEngines (SEP1) (rev 05) (prog-if 00 [VGA controller])
        DeviceName: ServerEngines Pilot III

Which show that the BMC is a ServerEngines Pilot BMC, which is a different chip family.

The Pilot series was at some point acquired by ASPEED: https://www.aspeedtech.com/server_pilot3/

neuschaefer commented 3 years ago

Here BMC FW for all Supermicro X9 Mainboards (and some X8,X10). Many GPIO and other BUIS can be grabbed from configs. Last version is 3.64 https://www.supermicro.com/wdl/GPL/SMT/SDK_SMT_X9_317.tar.gz

This is interesting, but I can't see the GPIO information in the platform_X****.xml files.

i REALY think what all X9 use COMMON FW (becouse different MB get one bin to updatye) and common configs can't be grabbed from BIN

For the ATEN-based firmware, I agree. AFAIK they run the same firmware image, and boards are distinguished by "board ID".

gissf1 commented 3 weeks ago

Hello, I have a few assorted homelab servers with the Nuvoton WPCM450 BMC, and I've been looking for ways to update the firmware to something more modern, and would love to eventually get OpenBMC on them.

I ran across an older reverse engineering attempt for this BMC that seems to have stalled, but I feel that some of their discoveries might be helpful in accelerating development here.

A link is https://blog.devicenull.org/2014/02/18/fixing-supermicro-ipmi-ntp-vulnerability.html and there is also more information in several preceding and follow-up posts. The blogger seems to have been able to disassemble the firmware binary, which contained a fixed bootloader, kernel, and 2 CramFS images. Most interestingly, he was able to determine the checksum calculations and modify the firmware to make custom changes and have the resulting blob accepted by the BMC.

It might be helpful to build mixed images by, for example, using the original bootloader and rootfs, but using your updated kernel, or other combinations to "safely" test firmware components independently.

The blogger also has links to his GitHub with possibly useful tools: https://github.com/devicenull/ipmi_firmware_tools

I hope this is helpful.