that is very interesting! (Supermicro X8DTT-HF+)

[ssbarnea]

Hi @neuschaefer and sorry for abusing the issue tracker for contacting you regarding the infamous Nuvoton WPCM450 BMC. I happen to have a 4-node supermicro server in my garage homelab, which I use mostly for testing, and I would really want to be able to replace the outdated BMC software that it has with somethign more open, like openbmc.

Please let me know if there is something I can do to help with testing in this area. As I do only use only one of the nodes, I am willing to risk breaking the firmware in the name of freedom.

[neuschaefer]

Hi, welcome to the project!

At the moment, my Linux port (based on recent mainline) is in a very early stage (basic SoC support just got merged into linux-next).

There are a few first things you can do and document somewhere for future reference:

• Find the BMC's debug serial port, and connect a TTL serial adapter. My approach for that is to probe around very carefully on the mainboard, with an oscilloscope that can tell me when I've found a 3.3V signal that looks like 115200 baud serial output
• Log the output during/after power-on
• Find out what the board ID of your server is (e.g. X9SCi-LN4F has board ID 1585) The firmware on this board probably doesn't have a board ID, because that's an ATEN thing as far as I understand it, and this firmware is based on AMI

For the medium future, my plan is to make a minimal userspace based on buildroot (perhaps similar to !BMC), that will include all the necessary tools for BMC functionality (power on/off, remote KVM, POST code tracing, BIOS update). OpenBMC might come at some point, but I'll first prototype something simpler.

[neuschaefer]

@ssbarnea I'm curious — what's the model name of your server?

[ssbarnea]

X8DTT-F are the boards but at boot time I get:

Supermicro X8DTT-H/X8DTT-H, BIOS 2.1c       04/22/2014

I think that the server model is SS6026TT-HTRF

[neuschaefer]

Ah, I've seen a few times with Supermicro, that there are different variants of the same PCB, which just have different components populated and unpopulated. I guess this is also the case with X8DTT-F vs. X8DTT-H, even to the point where they use the same BIOS.

[ssbarnea]

If I remember well the difference is if it has or not infiniband, mine do not have it. Should I try to grab some photos with front/back of the board?

[slavonnet]

openbmc/openbmc#3786

[neuschaefer]

@ssbarnea X-ray photos of the board in the area of the BMC would be ideal, but regular photos are useful too.
Meanwhile I got a X8DFF-HIBQF+ and will document what I know soon. I haven't found the UART TX signal though…

[neuschaefer]

@ssbarnea I made a few pictures of my board at https://github.com/neuschaefer/linux/wiki/Supermicro-X8DTT-family, but then I noticed that the -H variants and the variants without -H have a different layout around the BMC (most notably, the RAM is in a different position). Because of these layout differences, my note probably won't be very useful to you. I am curious to see close-up pictures of the area around the BMC on your board.

[ssbarnea]

My boards are X8DTT-HF+ and they indeed have the proprietary connector. Here is a photo taken around the BMC:
supermicro-X8DTT-HF+-bmc

[neuschaefer]

Good. This means that you should be able to access the BMC's UART as I documented (with a 3.3V serial adapter), which is always useful for low-level debugging and testing.

I don't have a clear view of how the AMI firmware works, yet, but I'll notify you when I have something to test.

Meanwhile, if you want to play around with very very minimal Linux, the nuvoton-wpcm450-supermicro-x9sci-ln4f devicetree that was merged for Linux 5.13 should work without causing harm (as long as it doesn't know about GPIOs).

[slavonnet]

Have
2 x Intel S2600GZ (last kernel 5.12)
2 x Supermicro X9DRT-F (last kernel 5.12)
4 x Supermicro X9DRT-F/IBFF (win 2019)
1 x Supermicro X8DTN+-F (win 2016) with broken IPMI firmware (bios boot 10+ minx,. say ipmi load failed and continue.). After update to x10 series IPMI FW. Not found ideas or mans to recovery it remotely.

if need some tests for replace bios/ipmi fw... .you a wellcome

[neuschaefer]

Hi @slavonnet, thanks for the list.

I've created a wiki page to keep track of who can test on which board: List of mainboards

As far as I can tell, the Intel S2600GZ doesn't seem to have a WPCM450 but a different BMC. I'm not absolutely sure though, because I couldn't find good pictures of it.

[slavonnet]

Hi @slavonnet, thanks for the list.

I've created a wiki page to keep track of who can test on which board: List of mainboards

As far as I can tell, the Intel S2600GZ doesn't seem to have a WPCM450 but a different BMC. I'm not absolutely sure though, because I couldn't find good pictures of it.

We use Intel AXXRMM4R module. In intel only 4 modules for IPMI. Its full features (but can't update bios, unbrick bios or flash ipmi). Only Viewver and logs... :(

Here HW info from Intel Server
s2600GZ4_dmidecode.txt
s2600GZ4_lshw.txt
s2600GZ4_lspci.txt

[slavonnet]

Here BMC FW for all Supermicro X9 Mainboards (and some X8,X10). Many GPIO and other BUIS can be grabbed from configs. Last version is 3.64
https://www.supermicro.com/wdl/GPL/SMT/SDK_SMT_X9_317.tar.gz

Here full SDK for WinBoard BMC
https://www.supermicro.com/wdl/GPL/AMI/SMC_winbond_opensrc_10090602.tar.gz

Here all BMC and BIOS for SuperMicro
https://www.supermicro.com/support/resources/bios_ipmi.php?type=BMC
Try search X9 in search input

i REALY think what all X9 use COMMON FW (becouse different MB get one bin to updatye) and common configs can't be grabbed from BIN

[slavonnet]

[neuschaefer]

[s2600GZ4_lspci.txt](https://github.com/neuschaefer/wpcm450/files/6441449/s2600GZ4_lspci.txt)

The lspci has the following lines: ``` 0b:00.0 VGA compatible controller: Matrox Electronics Systems Ltd. MGA G200e [Pilot] ServerEngines (SEP1) (rev 05) (prog-if 00 [VGA controller]) DeviceName: ServerEngines Pilot III ``` Which show that the BMC is a ServerEngines Pilot BMC, which is a different chip family. The Pilot series was at some point acquired by ASPEED: https://www.aspeedtech.com/server_pilot3/

[neuschaefer]

Here BMC FW for all Supermicro X9 Mainboards (and some X8,X10). Many GPIO and other BUIS can be grabbed from configs. Last version is 3.64 https://www.supermicro.com/wdl/GPL/SMT/SDK_SMT_X9_317.tar.gz

This is interesting, but I can't see the GPIO information in the platform_X****.xml files.

i REALY think what all X9 use COMMON FW (becouse different MB get one bin to updatye) and common configs can't be grabbed from BIN

For the ATEN-based firmware, I agree. AFAIK they run the same firmware image, and boards are distinguished by "board ID".

[gissf1]

Hello, I have a few assorted homelab servers with the Nuvoton WPCM450 BMC, and I've been looking for ways to update the firmware to something more modern, and would love to eventually get OpenBMC on them.

I ran across an older reverse engineering attempt for this BMC that seems to have stalled, but I feel that some of their discoveries might be helpful in accelerating development here.

A link is https://blog.devicenull.org/2014/02/18/fixing-supermicro-ipmi-ntp-vulnerability.html and there is also more information in several preceding and follow-up posts. The blogger seems to have been able to disassemble the firmware binary, which contained a fixed bootloader, kernel, and 2 CramFS images. Most interestingly, he was able to determine the checksum calculations and modify the firmware to make custom changes and have the resulting blob accepted by the BMC.

It might be helpful to build mixed images by, for example, using the original bootloader and rootfs, but using your updated kernel, or other combinations to "safely" test firmware components independently.

The blogger also has links to his GitHub with possibly useful tools: https://github.com/devicenull/ipmi_firmware_tools

I hope this is helpful.