{"id":1348,"date":"2025-02-03T22:36:51","date_gmt":"2025-02-03T22:36:51","guid":{"rendered":"https:\/\/trouble.org\/?p=1348"},"modified":"2025-02-03T22:37:16","modified_gmt":"2025-02-03T22:37:16","slug":"python-shim-over-qemu-to-startup-bmc","status":"publish","type":"post","link":"https:\/\/trouble.org\/?p=1348","title":{"rendered":"Python shim over QEMU to startup BMC"},"content":{"rendered":"

In case anyone wants to run a\/some Supermicro firmware image under QEMU… here’s a short script that sets some network features (thanks to binarly<\/a> for figuring out the hard stuff!)<\/p>\n

It still crashes and burns because I didn’t use the gdb trick they mention in the URL, but you can now talk to the BMC as if it were almost a real boy (you must run as root if doing ports < 1024, blah blah.)\n\nHere how it looks like to me when starting QEMU with an unzip'd version from of the firmware<\/a> –<\/p>\n

python3 qemu-bmc.py REDFISH_X10_323.bin
\n
\nExecuting QEMU... while<\/span> starting, control-C should stop it.
\nAfter it's booted, QEMU'<\/span>s control-a followed by an 'x'<\/span> should kill<\/span> it.
\n
\nqemu-system-arm
\n    -m<\/span> 128<\/span>
\n    -M<\/span> supermicrox11-bmc
\n    -nographic<\/span>
\n    -drive<\/span> file<\/span>=REDFISH_X10_323.bin,format<\/span>=raw,if<\/span>=mtd
\n    -net<\/span> nic
\n    -net<\/span> user,hostfwd<\/span>=:127.0.0.1:22<\/span>-:22<\/span>,hostfwd<\/span>=:127.0.0.1:443<\/span>-:443<\/span>,hostfwd<\/span>=udp::623<\/span>-:623<\/span>,hostfwd<\/span>=:127.0.0.1:23<\/span>-:23<\/span>,hostname<\/span>=qemu
\n
\nqemu-system-arm: warning: nic ftgmac100.1 has no peer
\n
\n
\nU-Boot 2009.01<\/span> (<\/span>Nov 12<\/span> 2014<\/span> - 11<\/span>:37<\/span>:48<\/span>)<\/span> ASPEED (<\/span>v.0.21)<\/span>
\n
\nI2C:   ready
\nDRAM:  128<\/span> MB
\nFlash: 32<\/span> MB
\n***<\/span> Warning - bad CRC, using default environment
\n
\nIn:    serial
\nOut:   serial
\nErr:   serial
\nH\/<\/span>W:   AST2400 series chip
\nCOM:   port1 and port2
\nPWM:   port[<\/span>ABCDH]<\/span>
\nHit any key to stop autoboot:  0<\/span>
\n## Booting kernel from Legacy Image at 21400000 ...<\/span>
\n
\n[<\/span>....]<\/span><\/div><\/div>\n

Here’s the program –<\/p>\n

#!\/usr\/bin\/env python3<\/span>
\n
\n#<\/span>
\n# start qemu with BMC firmware under python's expect<\/span>
\n#<\/span>
\n#   Usage: $0 firmware.img<\/span>
\n#<\/span>
\n# Requires root because it forwards 3 ports to localhost -<\/span>
\n#<\/span>
\n#   TCP - 22 and 443<\/span>
\n#   UDP - 623<\/span>
\n#<\/span>
\n# (This could be changed by using ports > 1024, presumably, but I wanted standard<\/span>
\n# tools - e.g. ipmitool and the like - to work w\/o muss, simply by pointing to<\/span>
\n# localhost)<\/span>
\n#<\/span>
\n
\nimport<\/span> os<\/span>
\nimport<\/span> pexpect
\nimport<\/span> sys<\/span>
\n
\nif<\/span> len<\/span>(<\/span>sys<\/span>.argv<\/span>)<\/span> !=<\/span> 2<\/span>:
\n    print<\/span>(<\/span>"Usage: %s firmware.img"<\/span> % sys<\/span>.argv<\/span>[<\/span>0<\/span>]<\/span>)<\/span>
\n    sys<\/span>.exit<\/span>(<\/span>1<\/span>)<\/span>
\nelse<\/span>:
\n    # FW   = "BMC_X11AST2400-3101MS_20230214_1.66_STDsp.bin"<\/span>
\n    FW =<\/span> sys<\/span>.argv<\/span>[<\/span>1<\/span>]<\/span>
\n
\n# what's the uid - well, effective uid<\/span>
\neid =<\/span> os<\/span>.geteuid<\/span>(<\/span>)<\/span>
\n
\nif<\/span> eid:
\n    sys<\/span>.stdout<\/span>.write<\/span>(<\/span>"Error - must be run as root, not UID %d"<\/span> % eid)<\/span>
\n    sys<\/span>.exit<\/span>(<\/span>2<\/span>)<\/span>
\n
\n#<\/span>
\n# emulate a supermicro BMC with QEMU<\/span>
\n#<\/span>
\n# Ports forwarded:<\/span>
\n#   TCP: 443 => localhost:443<\/span>
\n#   TCP:  22 => localhost:22<\/span>
\n#   UDP: 623 => (udp) localhost:623<\/span>
\n#<\/span>
\n
\nQEMU=<\/span>"""qemu-system-arm
\n    -m 128
\n    -M supermicrox11-bmc
\n    -nographic
\n    -drive file=%s,format=raw,if=mtd
\n    -net nic
\n    -net user,hostfwd=:127.0.0.1:22-:22,hostfwd=:127.0.0.1:443-:443,hostfwd=udp::623-:623,hostfwd=:127.0.0.1:23-:23,hostname=qemu
\n"""<\/span> % FW
\n
\nprint<\/span>(<\/span>"""
\nExecuting QEMU... while starting, control-C should stop it.
\nAfter it's booted, QEMU's control-a followed by an 'x' should kill it.
\n"""<\/span>)<\/span>
\n
\nprint<\/span>(<\/span>QEMU)<\/span>
\n
\nqemu =<\/span> pexpect.spawn<\/span>(<\/span>QEMU)<\/span>
\n
\n# don't<\/span>
\nqemu.timeout<\/span> =<\/span> 999999<\/span>
\n# echo output<\/span>
\nqemu.logfile<\/span> =<\/span> sys<\/span>.stdout<\/span>.buffer<\/span>
\n
\n# start the fireworks<\/span>
\n
\nqemu.expect<\/span>(<\/span>"Please press Enter to activate this console."<\/span>)<\/span>
\nqemu.sendline<\/span>(<\/span>""<\/span>)<\/span>
\nqemu.expect<\/span>(<\/span>"\/ #"<\/span>)<\/span>
\n
\nqemu.sendline<\/span>(<\/span>"id"<\/span>)<\/span>
\nqemu.expect<\/span>(<\/span>"\/ #"<\/span>)<\/span>
\n
\n# make networking a bit more sane<\/span>
\nqemu.sendline<\/span>(<\/span>"ip link set eth0 addr 4A:0A:AB:7C:96:2F"<\/span>)<\/span>
\nqemu.expect<\/span>(<\/span>"\/ #"<\/span>)<\/span>
\nqemu.sendline<\/span>(<\/span>"ifconfig eth0 10.0.2.15"<\/span>)<\/span>
\nqemu.expect<\/span>(<\/span>"\/ #"<\/span>)<\/span>
\nqemu.sendline<\/span>(<\/span>"ifconfig eth0 netmask 255.255.255.0"<\/span>)<\/span>
\nqemu.expect<\/span>(<\/span>"\/ #"<\/span>)<\/span>
\nqemu.sendline<\/span>(<\/span>"ifconfig eth0 broadcast 10.0.2.255"<\/span>)<\/span>
\nqemu.expect<\/span>(<\/span>"\/ #"<\/span>)<\/span>
\nqemu.sendline<\/span>(<\/span>"ifconfig eth0 up"<\/span>)<\/span>
\nqemu.expect<\/span>(<\/span>"\/ #"<\/span>)<\/span>
\nqemu.sendline<\/span>(<\/span>"ip route add 0.0.0.0\/0.0.0.0 via 10.0.2.2"<\/span>)<\/span>
\nqemu.expect<\/span>(<\/span>"\/ #"<\/span>)<\/span>
\n
\nprint<\/span>(<\/span>"Ok... ready to rumble?"<\/span>)<\/span>
\n
\nqemu.logfile<\/span> =<\/span> None<\/span>
\nqemu.interact<\/span>(<\/span>)<\/span>
\nqemu.kill<\/span>(<\/span>1<\/span>)<\/span><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"

In case anyone wants to run a\/some Supermicro firmware image under QEMU… here’s a short script that sets some network features (thanks to binarly for figuring out the hard stuff!) It still crashes and burns because I didn’t use the gdb trick they mention in the URL, but you can now talk to the BMC […]<\/p>\n","protected":false},"author":44,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1348","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/posts\/1348","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/users\/44"}],"replies":[{"embeddable":true,"href":"https:\/\/trouble.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1348"}],"version-history":[{"count":8,"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/posts\/1348\/revisions"}],"predecessor-version":[{"id":1358,"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/posts\/1348\/revisions\/1358"}],"wp:attachment":[{"href":"https:\/\/trouble.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1348"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/trouble.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1348"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/trouble.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1348"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}