How to properly verify In-band BMC console from the host?

[comicsheep]

How to properly verify In-band BMC console from the host?
Runing doit probe is enough?

[~/cve-2019-6260-master]# ./doit probe [*] Probing AHB interfaces [*] Probes failed, cannot access BMC AHB

My server has a ast2500 BMC and AMD ROME SOC

[amboar]

Right, it's not clear why the bridges couldn't be used from that output. I should add proper log level control and some more debug statements so we can more easily understand what went wrong. Let me follow up with that.

In the mean time, do you have a shell on the BMC (though since you're asking about the in-band console I'm guessing no)? Does the BMC expose /dev/mem? If so you could try compiling the tool for the BMC and run it as root there. Alternatively if you have access to the physical BMC serial console you can try probing via the UART AHB bridge.

Finally, the in-band console thing is:

1. A bit of a stunt, and
2. Currently only works on POWER systems due to how the tool accesses the LPC bus.

However, there is a PCIe-to-LPC bridge exposed by the BMC, so for x86 systems we can go that route, it just needs to be implemented.

[comicsheep]

Thanks for detail reply~
I'm doing a security check for Bearmetal cloud service provider, and I only have In-band access.
Hoping this PCIe-to-LPC bridge feature coming asap

[comicsheep]

It works on intel C620 pch with Intel(R) Xeon(R) Silver 4110

[amboar]

Okay, it's probably just an unrecognised BMC SoC revision. The table of recognised SoC variants is here:

https://github.com/amboar/cve-2019-6260/blob/master/rev.c#L17

[amboar]

@comicsheep I've just pushed 5152215 to master which adds the --verbose option to doit. I've also pushed another change to improve the logging around SoC revision probing. This might help you understand why the probes failed in the first post.

Note that the options are positional so sub-command parsing works properly; you need to invoke it like ./doit --verbose probe (rather than ./doit probe --verbose)

[comicsheep]

nice work, any plan to add more supporting flash chip id and Soc rev?

[~/cve-2019-6260-master]# ./doit --verbose probe
[] Probing AHB interfaces
[] Probing P2A
[] Found revision 0xffffffff
[] Revision 0xffffffff is unsupported
[*] Probes failed, cannot access BMC AHB

[amboar]

@comicsheep I've pushed a few more changes, but particularly you may wish to test the x86-lpc branch; it adds experimental ioport support so you can access the iLPC2AHB bridge. It's untested as I don't have access to an x86-64 Aspeed-based machine, so the changes come with no promise that it won't set your machine on fire. But given you're using the tool at all I guess you're reasonably adventurous.

[amboar]

@comicsheep fwiw, if the changes on the x86-lpc branch work you should be able to configure the in-band console

[comicsheep]

@comicsheep fwiw, if the changes on the x86-lpc branch work you should be able to configure the in-band console

I need kindof tutorial for x86-lpc branch，especially "the in-band console"

otherwise only the following return
[root~/cve-2019-6260-x86-lpc]# ./doit ilpc read 0x00
ilpcb_init: Operation not supported

[amboar]

@comicsheep that's a correct invocation, it will read the first 4 bytes of the BMC flash.

Operation not supported is an interesting response. What compiler are you using? The architecture support is a bit of a hack, it's just based on the output of $(CC) -dumpmachine. I only tested with gcc, which turns out to provide a different answer to clang for x86_64:

$ gcc -dumpmachine
x86_64-linux-gnu
$ clang -dumpmachine
x86_64-pc-linux-gnu

I've pushed b44ea44 ("Makefile: Try a little harder with arch support") on the x86-lpc branch, can you fetch that down and post the output of make clean && make && ./doit -vv ilpc read 0?

[comicsheep]

@comicsheep that's a correct invocation, it will read the first 4 bytes of the BMC flash.

Operation not supported is an interesting response. What compiler are you using? The architecture support is a bit of a hack, it's just based on the output of $(CC) -dumpmachine. I only tested with gcc, which turns out to provide a different answer to clang for x86_64:

$ gcc -dumpmachine
x86_64-linux-gnu
$ clang -dumpmachine
x86_64-pc-linux-gnu

I've pushed b44ea44 ("Makefile: Try a little harder with arch support") on the x86-lpc branch, can you fetch that down and post the output of make clean && make && ./doit -vv ilpc read 0?

It works!

[root ~/cve-2019-6260-x86-lpc]# make clean && make && ./doit -vv ilpc read 0 rm -f doit uart/suart.o uart/mux.o uart/vuart.o prompt.o ast.o ahb.o p2a.o shell.o pci.o l2a.o sio.o ilpc.o doit.o clk.o wdt.o sfc.o flash.o mmio.o devmem.o log.o priv.o debug.o rev.o ts16.o tty.o arch/x86_64/lpc.o uart/suart.d uart/mux.d uart/vuart.d prompt.d ast.d ahb.d p2a.d shell.d pci.d l2a.d sio.d ilpc.d doit.d clk.d wdt.d sfc.d flash.d mmio.d devmem.d log.d priv.d debug.d rev.d ts16.d tty.d arch/x86_64/lpc.d echo Unknown > version gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c doit.c -o doit.o gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c uart/suart.c -o uart/suart.o gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c uart/mux.c -o uart/mux.o gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c uart/vuart.c -o uart/vuart.o gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c prompt.c -o prompt.o gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c ast.c -o ast.o gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c ahb.c -o ahb.o gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c p2a.c -o p2a.o gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c shell.c -o shell.o gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c pci.c -o pci.o gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c l2a.c -o l2a.o gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c sio.c -o sio.o gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c ilpc.c -o ilpc.o gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c clk.c -o clk.o gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c wdt.c -o wdt.o gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c sfc.c -o sfc.o gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c flash.c -o flash.o gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c mmio.c -o mmio.o gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c devmem.c -o devmem.o gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c log.c -o log.o gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c priv.c -o priv.o gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c debug.c -o debug.o gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c rev.c -o rev.o gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c ts16.c -o ts16.o gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c tty.c -o tty.o gcc -O2 -flto -Werror -Wall -std=gnu99 -DVERSION='"Unknown"' -DNDEBUG -I. -Iarch/x86_64 -DHAVE_LPC=1 -MMD -c arch/x86_64/lpc.c -o arch/x86_64/lpc.o gcc -o doit -flto doit.o uart/suart.o uart/mux.o uart/vuart.o prompt.o ast.o ahb.o p2a.o shell.o pci.o l2a.o sio.o ilpc.o clk.o wdt.o sfc.o flash.o mmio.o devmem.o log.o priv.o debug.o rev.o ts16.o tty.o arch/x86_64/lpc.o 0x00000000: 0xea000015 [root ~/cve-2019-6260-x86-lpc]#

[amboar]

Nice! Let me merge this onto master.

Now did you actually want the in-band console? I can walk you through it, but it's a bit of effort.

[comicsheep]

Nice! Let me merge this onto master.

Now did you actually want the in-band console? I can walk you through it, but it's a bit of effort.

Sure, an interactive console is so sweet, an powerful ending for this repo