BMC, hack, idrac, ipmi, qemu, security, system, virtual

BMCs under Qemu repo

And a new repo with various BMCs that I’ve tried to wrassle into submission (e.g. usability) under Qemu: https://github.com/zenfish/zbmc. Currently –

advantech-asmb787 Advantech ASMB-787 BMC (AMI MegaRAC SP-X 4.0 / AST2600, armv7l) — CONSOLE-green (sysadmin/superuser); ext net WIP (NC-SI responder)
idrac10 Dell iDRAC10 (NPCM845/aarch64) — Phase-5 RMCP+/RAKP (encrypted) via shm-shim interposes
idrac9 Dell iDRAC9 (NPCM750) — Phase-4 mesh + RAKP + Redfish
megarac-hpe HPE Cray XD670 BMC (AMI MegaRAC SP-X / AST2600, armv7l) — IPMI 2.0 RMCP+ + authed Redfish WORK (admin/superuser)
nvidia-obmc Nvidia GB200NVL BMC (OpenBMC/AST2600) — NVIDIA OEM IPMI 0x3C; ipmi-LAN works (cipher-17 only) + busctl
openbmc Vanilla upstream OpenBMC (Phosphor/AST2600) — clean baseline, NO OEM (Mfr 0); ipmi-LAN + Redfish + ssh all live
supermicro-x10 Supermicro X10 BMC (ASPEED AST2400, FW 3.93) — weak-cipher ORACLE: offers IPMI 2.0 suites 0-14 (RC4/MD5); ADMIN:ADMIN
supermicro-x14 Supermicro X14 BMC (Phosphor OpenBMC/AST2600-ROT, armv7l) — password auth (ADMIN:ADMIN); warm-restore snapshot

I’m sure there are better ways, but this is an attempt to document my own work and the troubles/travails/ease (hah) of getting things working.

C&C more than welcome, as well as any that you may have gotten to work.

There’s a `zbmc` command that lists the available ones and their state/current status. By itself it prints out some help text –

$ bmc
zbmc — virtual-BMC control
usage: zbmc [args]

boxes:
advantech-asmb787 Advantech ASMB-787 BMC (AMI MegaRAC SP-X 4.0 / AST2600, armv7l) — CONSOLE-green (sysadmin/superuser); ext net WIP (NC-SI responder)
idrac10 Dell iDRAC10 (NPCM845/aarch64) — Phase-5 RMCP+/RAKP (encrypted) via shm-shim interposes
idrac9 Dell iDRAC9 (NPCM750) — Phase-4 mesh + RAKP + Redfish
megarac-hpe HPE Cray XD670 BMC (AMI MegaRAC SP-X / AST2600, armv7l) — IPMI 2.0 RMCP+ + authed Redfish WORK (admin/superuser)
nvidia-obmc Nvidia GB200NVL BMC (OpenBMC/AST2600) — NVIDIA OEM IPMI 0x3C; ipmi-LAN works (cipher-17 only) + busctl
openbmc Vanilla upstream OpenBMC (Phosphor/AST2600) — clean baseline, NO OEM (Mfr 0); ipmi-LAN + Redfish + ssh all live
supermicro-x10 Supermicro X10 BMC (ASPEED AST2400, FW 3.93) — weak-cipher ORACLE: offers IPMI 2.0 suites 0-14 (RC4/MD5); ADMIN:ADMIN
supermicro-x14 Supermicro X14 BMC (Phosphor OpenBMC/AST2600-ROT, armv7l) — password auth (ADMIN:ADMIN); warm-restore snapshot

(use 'all' as the box to run a verb across every box: zbmc all status)
(just the names: zbmc list | zbmc -l)

verbs:
start [--build][--no-web] boot (detached); binds the real IP:{22,443,623}; web auto-starts
stop kill the QEMU process
restart stop then start
status [-f] qemu/ports/ssh/rakp/redfish health; -f follows until READY (default verb)
ssh [cmd] SSH into the box (dropbear; sysadmin/blank)
telnet telnet into the box (mini_telnetd; no auth; port 23)
ipmi authenticated zipmi (e.g. zbmc idrac9 ipmi mc info)
web bring up httpd + Redfish
console live console (box must be up): interactive serial login on
boxes with a console (megarac-hpe, nvidia-obmc); else tail -f the log
shell boot init=/bin/sh — unrestricted root, no net/IPMI (RE; megarac-hpe)
build rebuild the boot image
rename rename the box (dispatch name + host alias; qemu machine/image untouched)

And if you have actually built or

$ vbmc all
checking status on 8 inmates in the asylum -

===== advantech-asmb787 (1/8) =====
Build : ready (built)
QEMU : DOWN — zbmc advantech-asmb787 start

===== idrac10 (2/8) =====
Build : ready (warm snapshot)
QEMU : DOWN — zbmc idrac10 start

===== idrac9 (3/8) =====
Build : ready (P4 boot artifacts present)
QEMU : DOWN — zbmc idrac9 start

===== megarac-hpe (4/8) =====
Build : ready (warm snapshot)
QEMU : DOWN — zbmc megarac-hpe start

===== nvidia-obmc (5/8) =====
Build : ready (firmware present)
QEMU : DOWN — zbmc nvidia-obmc start

===== openbmc (6/8) =====
Build : ready (firmware present)
QEMU : DOWN — zbmc openbmc start

===== supermicro-x10 (7/8) =====
Build : ready (firmware present)
QEMU : UP (pid 94875, 01:45:31)
SSH : no (refused/booting)
IPMI : OK zipmi -H x10bmc -U ADMIN -P ADMIN
Redfish : OK curl -sk -u ADMIN:ADMIN https://x10bmc:443/redfish/v1/Managers
Console : OK zbmc supermicro-x10 console
NC-SI : n/a (ssh down)
Net (IP) : x10bmc = 10.0.8.10

===== supermicro-x14 (8/8) =====
Build : ready (warm snapshot)
QEMU : UP (pid 82188, 11:52:19)
SSH : no (refused/booting)
IPMI : OK zipmi -H x14bmc -U ADMIN -P ADMIN
Redfish : OK curl -sk -u ADMIN:ADMIN https://x14bmc:443/redfish/v1/Managers
Console : OK zbmc supermicro-x14 console
NC-SI : n/a (ssh down)
Net (IP) : x14bmc = 10.0.8.14

2/8 inmates currently alive

Leave a Reply