Assistance required - Looking for Supermicro IPMI dumps (X9/X10)

Notice: Page may contain affiliate links for which we may earn a small commission through services like Amazon Affiliates or Skimlinks.

Knogle

New Member
Jun 23, 2021
16
6
3
Hey friends, how are you doing.
Currently i have bricked my IPMI, and in order to reflash it i need some sort of "running" IPMI ROM by someone of you. You guys can simply use the dUpdate, or lUpdate tool from ATEN with the -d flag in order to dump the ROM.
So now a brief explanation. Using an external flasher i have already tried a bunch of times using the factory images, but unfortunately there is some magic going on the motherbaord which keeps breaking the IPMI ROM (Good to see on binwalk) again and again when using the factory ROM. So i am looking for some ROM file which is running on your systems if possible, in order to find out whats going on during the IPMI initialization process to fix my motherboard.

The chip itself is not bad.
I have ordered 4 more of them in order to check that out. Unfortunately the header section of the image is being corrupted after a normal boot. What is interesting, when I keep the system powered off, and insert the flashed chip, BMC heartbeat led starts flashing. When I turn on the system the flash is being overwritten by something and is dead.

In its sane condition, the IPMI ROM looks like that.

Code:
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
59700         0xE934          Copyright string: "Copyright (c) Winbond Limited 2001 - 2006. All rights reserved."
60835         0xEDA3          Copyright string: "Copyright 1995-1998 Mark Adler "
1572864       0x180000        CramFS filesystem, little endian, size: 7970816, version 2, sorted_dirs, CRC 0x8C6D86A4, edition 0, 4910 blocks, 1078 files
9961472       0x980000        Zip archive data, at least v2.0 to extract, compressed size: 1127148, uncompressed size: 2339464, name: kernel.bin
11088768      0xA93380        End of Zip archive, footer length: 22
12058624      0xB80000        CramFS filesystem, little endian, size: 2371584, version 2, sorted_dirs, CRC 0x9D53DC4C, edition 0, 1099 blocks, 218 files
But after the initialization process, the bootloader in the beginning is gone, and is replaced by JFFS2 fragments, rendering the IPMI dead.
So its not supposed to be flashed by an external flasher, and the recovery procudure using dUpdate or lUpdate doesnt work if the IPMI does not respond to calls at all.

Code:
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
262144        0x40000         JFFS2 filesystem, little endian
1245416       0x1300E8        JFFS2 filesystem, little endian
1245712       0x130210        JFFS2 filesystem, little endian
1246304       0x130460        JFFS2 filesystem, little endian
1247192       0x1307D8        JFFS2 filesystem, little endian
1247784       0x130A28        JFFS2 filesystem, little endian
1249264       0x130FF0        JFFS2 filesystem, little endian
1249856       0x131240        JFFS2 filesystem, little endian
1250152       0x131368        JFFS2 filesystem, little endian
1250892       0x13164C        JFFS2 filesystem, little endian
1252224       0x131B80        JFFS2 filesystem, little endian
1252816       0x131DD0        JFFS2 filesystem, little endian
1253852       0x1321DC        JFFS2 filesystem, little endian
1254296       0x132398        JFFS2 filesystem, little endian
1255036       0x13267C        JFFS2 filesystem, little endian
1255480       0x132838        JFFS2 filesystem, little endian
1256368       0x132BB0        JFFS2 filesystem, little endian
1258144       0x1332A0        JFFS2 filesystem, little endian
1258440       0x1333C8        JFFS2 filesystem, little endian
1259180       0x1336AC        JFFS2 filesystem, little endian
1259920       0x133990        JFFS2 filesystem, little endian
1261252       0x133EC4        JFFS2 filesystem, little endian
1261584       0x134010        JFFS2 filesystem, little endian
1261744       0x1340B0        JFFS2 filesystem, little endian
1263516       0x13479C        JFFS2 filesystem, little endian
1263660       0x13482C        JFFS2 filesystem, little endian
1264380       0x134AFC        JFFS2 filesystem, little endian
1264668       0x134C1C        JFFS2 filesystem, little endian
1265532       0x134F7C        JFFS2 filesystem, little endian
1265820       0x13509C        JFFS2 filesystem, little endian
1266972       0x13551C        JFFS2 filesystem, little endian
1267116       0x1355AC        JFFS2 filesystem, little endian
1267260       0x13563C        JFFS2 filesystem, little endian
1267404       0x1356CC        JFFS2 filesystem, little endian
1267548       0x13575C        JFFS2 filesystem, little endian
1267692       0x1357EC        JFFS2 filesystem, little endian
1267836       0x13587C        JFFS2 filesystem, little endian
1267980       0x13590C        JFFS2 filesystem, little endian
1268412       0x135ABC        JFFS2 filesystem, little endian
1268556       0x135B4C        JFFS2 filesystem, little endian
1268700       0x135BDC        JFFS2 filesystem, little endian
1269132       0x135D8C        JFFS2 filesystem, little endian
1269564       0x135F3C        JFFS2 filesystem, little endian
1269708       0x135FCC        JFFS2 filesystem, little endian
1269852       0x13605C        JFFS2 filesystem, little endian
1269996       0x1360EC        JFFS2 filesystem, little endian
1270284       0x13620C        JFFS2 filesystem, little endian
1270428       0x13629C        JFFS2 filesystem, little endian
1270572       0x13632C        JFFS2 filesystem, little endian
1271004       0x1364DC        JFFS2 filesystem, little endian
1271148       0x13656C        JFFS2 filesystem, little endian
1271724       0x1367AC        JFFS2 filesystem, little endian
1271868       0x13683C        JFFS2 filesystem, little endian
1272300       0x1369EC        JFFS2 filesystem, little endian
1272444       0x136A7C        JFFS2 filesystem, little endian
1272732       0x136B9C        JFFS2 filesystem, little endian
1273596       0x136EFC        JFFS2 filesystem, little endian
1273740       0x136F8C        JFFS2 filesystem, little endian
1273884       0x13701C        JFFS2 filesystem, little endian
1274604       0x1372EC        JFFS2 filesystem, little endian
1274892       0x13740C        JFFS2 filesystem, little endian
1275372       0x1375EC        Zlib compressed data, compressed
1275556       0x1376A4        JFFS2 filesystem, little endian
1280556       0x138A2C        JFFS2 filesystem, little endian
1572864       0x180000        CramFS filesystem, little endian, size: 7970816, version 2, sorted_dirs, CRC 0x8C6D86A4, edition 0, 4910 blocks, 1078 files
9961472       0x980000        Zip archive data, at least v2.0 to extract, compressed size: 1127148, uncompressed size: 2339464, name: kernel.bin
11088768      0xA93380        End of Zip archive, footer length: 22
12058624      0xB80000        CramFS filesystem, little endian, size: 2371584, version 2, sorted_dirs, CRC 0x9D53DC4C, edition 0, 1099 blocks, 218 files
So i am looking forward to find someone dumping their IPMI ROMs. Then i can compare them to the factory ones, and find out what is going on.

I am looking forward to hear from you guys. Thanks in advance. Maybe there is someone with some spare time to dump their IPMI ROMs :)
 
Last edited:

RolloZ170

Well-Known Member
Apr 24, 2016
5,158
1,549
113
Using an external flasher i have already tried a bunch of times using the factory images, but unfortunately there is some magic going on the motherbaord which keeps breaking the IPMI ROM
what type of flasher ? what type of chip ?
 

Knogle

New Member
Jun 23, 2021
16
6
3
Thanks for your reply.
It's an Spansion S25FL128P0XMFI003.
The IPMI flash chip on my board is socketed, so i didn't care first about backing it up, and i simply flashed it through my external flasher, an CH341A.
I have soldered a pin header to the spot where JBMC1 is written. I was expecting some kind of UART, but it's not, and i don't know it's function yet.
But now i know it's not supposed to be flashed this way, otherwise it's bricked.

verkleinertes-bild.jpg

verkleinertes-bild.jpg
 
Last edited:

Knogle

New Member
Jun 23, 2021
16
6
3
what, you just overwritten a chip without even looking what's inside? :oops: you sure like taking risks there
Yeah that was a huge mistake.
Before i have messed with ASRock Rack boards only, and it was no issue there. I could simply use the factory image, flash it, and it's done.
So i was assuming the same for the Supermicro one, but that was a huge mistake :oops:
 

RolloZ170

Well-Known Member
Apr 24, 2016
5,158
1,549
113
simply flashed it through my external flasher, an CH341A
the ch341a can not flash 256mbit and bigger chips. for that reason i asked for the type of flasher. but you have 128Mbit one.
the unmodified CH341A can brick the S25FL128P but i think thats not the case this time. the software for the CH341A is realy bad and there are so many different ones.
the ch341a uses 5 volts by default for signals to the chip, there is a howto on youtube to modify it to 3.3V
buy a dip to sop16 programming adapter. after many problems with the ch341a i bought a TL866II and i love it.
 

Knogle

New Member
Jun 23, 2021
16
6
3
the ch341a can not flash 256mbit and bigger chips. for that reason i asked for the type of flasher. but you have 128Mbit one.
the unmodified CH341A can brick the S25FL128P but i think thats not the case this time. the software for the CH341A is realy bad and there are so many different ones.
the ch341a uses 5 volts by default for signals to the chip, there is a howto on youtube to modify it to 3.3V
buy a dip to sop16 programming adapter. after many problems with the ch341a i bought a TL866II and i love it.
Yeah i think it's a different issue.
Using flashrom i was able to program the flash and also successfully verifying it, so it was matching the downloadable ROM file by Supermicro.
Also it has always worked for me for a vast amount of different flash roms during my 3 years of OpenBMC development/porting.
I have tried a FTDI based FT2232H programmer now, also same issue.
 
Last edited:

Knogle

New Member
Jun 23, 2021
16
6
3
Thanks a lot. I have tried that right now, but the BIOS is already up to date. So i have re-flashed it but same issue.
Currently i am unpacking the CramFS containers inside the image, seems like it's having an all-zero MAC address. Will be very difficult to modify the MAC and pack it again. But i'll try.

That's the factory.xml inside of the image. With the all-zero MAC address it won't be able to respond to any kind of traffic. So changing it might make it accessible again, because the BMC heartbeat works.

Code:
<?xml version="1.0" encoding="UTF-8"?>
<root>
  <IPMI>
    <UserModule>
      <User num="0" enable="01" Name="" Ep="1" Passwd="ed586ec65aea1449d8f89cf43535fa88" PasswdSize="0" ChannelAccess="00000000000000000000000000000000" PrivilegeChange="00">
        <IKVMInfo IKVMVideoEnable="01" IKVMKMEnable="01" IKVMKickEnable="01"/>
        <VUSBInfo VUSBEnable="01"/>
      </User>
      <User num="1" enable="01" Name="ADMIN" Ep="1" Passwd="dbd403e3beb26eded56c4b2de443e006" PasswdSize="0" ChannelAccess="00540054000000000000000000000000" PrivilegeChange="00">
        <IKVMInfo IKVMVideoEnable="01" IKVMKMEnable="01" IKVMKickEnable="01"/>
        <VUSBInfo VUSBEnable="01"/>
      </User>
      <User num="2" enable="00" Name="" Ep="0" Passwd="" PasswdSize="0" ChannelAccess="00000000000000000000000000000000" PrivilegeChange="00">
        <IKVMInfo IKVMVideoEnable="01" IKVMKMEnable="01" IKVMKickEnable="01"/>
        <VUSBInfo VUSBEnable="01"/>
      </User>
      <User num="3" enable="00" Name="" Ep="0" Passwd="" PasswdSize="0" ChannelAccess="00000000000000000000000000000000" PrivilegeChange="00">
        <IKVMInfo IKVMVideoEnable="01" IKVMKMEnable="01" IKVMKickEnable="01"/>
        <VUSBInfo VUSBEnable="01"/>
      </User>
      <User num="4" enable="00" Name="" Ep="0" Passwd="" PasswdSize="0" ChannelAccess="00000000000000000000000000000000" PrivilegeChange="00">
        <IKVMInfo IKVMVideoEnable="01" IKVMKMEnable="01" IKVMKickEnable="01"/>
        <VUSBInfo VUSBEnable="01"/>
      </User>
      <User num="5" enable="00" Name="" Ep="0" Passwd="" PasswdSize="0" ChannelAccess="00000000000000000000000000000000" PrivilegeChange="00">
        <IKVMInfo IKVMVideoEnable="01" IKVMKMEnable="01" IKVMKickEnable="01"/>
        <VUSBInfo VUSBEnable="01"/>
      </User>
      <User num="6" enable="00" Name="" Ep="0" Passwd="" PasswdSize="0" ChannelAccess="00000000000000000000000000000000" PrivilegeChange="00">
        <IKVMInfo IKVMVideoEnable="01" IKVMKMEnable="01" IKVMKickEnable="01"/>
        <VUSBInfo VUSBEnable="01"/>
      </User>
      <User num="7" enable="00" Name="" Ep="0" Passwd="" PasswdSize="0" ChannelAccess="00000000000000000000000000000000" PrivilegeChange="00">
        <IKVMInfo IKVMVideoEnable="01" IKVMKMEnable="01" IKVMKickEnable="01"/>
        <VUSBInfo VUSBEnable="01"/>
      </User>
      <User num="8" enable="00" Name="" Ep="0" Passwd="" PasswdSize="0" ChannelAccess="00000000000000000000000000000000" PrivilegeChange="00">
        <IKVMInfo IKVMVideoEnable="01" IKVMKMEnable="01" IKVMKickEnable="01"/>
        <VUSBInfo VUSBEnable="01"/>
      </User>
      <User num="9" enable="00" Name="" Ep="0" Passwd="" PasswdSize="0" ChannelAccess="00000000000000000000000000000000" PrivilegeChange="00">
        <IKVMInfo IKVMVideoEnable="01" IKVMKMEnable="01" IKVMKickEnable="01"/>
        <VUSBInfo VUSBEnable="01"/>
      </User>
    </UserModule>
    <LanModule>
      <Lan num="0" AuthTypeEnable="1616161616" IPAddr="c0a82a1b" IPAS="02" MACAddr="000000000000" SubNetMask="00000000" IPv4Header="000000" PriRMCPPort="6f02" SecRMCPPort="0000" WDT_ARP_CTL="00" ARP_CTL="00" ARP_INTVAL="00" DefaultGateWayAddr="00000000" DefaultGateWayMAC="000000000000" BAKDefaultGateWayAddr="00000000" BAKDefaultGateWayMAC="000000000000" CommunityString="" CS_PrivLevels="404400440440040000" Channel_SecurityKey="0000000000000000000000000000000000000000" KG_status="00" RemoteSession="00">
        <LanDestInfo num="0" DestType="00" AckRetryInterval="00" Retries="00" IPFormat="00" GateWaySel="00" AlertIP="00000000" AlertMAC="000000000000"/>
        <LanDestInfo num="1" DestType="00" AckRetryInterval="00" Retries="00" IPFormat="00" GateWaySel="00" AlertIP="00000000" AlertMAC="000000000000"/>
        <LanDestInfo num="2" DestType="00" AckRetryInterval="00" Retries="00" IPFormat="00" GateWaySel="00" AlertIP="00000000" AlertMAC="000000000000"/>
        <LanDestInfo num="3" DestType="00" AckRetryInterval="00" Retries="00" IPFormat="00" GateWaySel="00" AlertIP="00000000" AlertMAC="000000000000"/>
        <LanDestInfo num="4" DestType="00" AckRetryInterval="00" Retries="00" IPFormat="00" GateWaySel="00" AlertIP="00000000" AlertMAC="000000000000"/>
        <LanDestInfo num="5" DestType="00" AckRetryInterval="00" Retries="00" IPFormat="00" GateWaySel="00" AlertIP="00000000" AlertMAC="000000000000"/>
        <LanDestInfo num="6" DestType="00" AckRetryInterval="00" Retries="00" IPFormat="00" GateWaySel="00" AlertIP="00000000" AlertMAC="000000000000"/>
        <LanDestInfo num="7" DestType="00" AckRetryInterval="00" Retries="00" IPFormat="00" GateWaySel="00" AlertIP="00000000" AlertMAC="000000000000"/>
        <LanDestInfo num="8" DestType="00" AckRetryInterval="00" Retries="00" IPFormat="00" GateWaySel="00" AlertIP="00000000" AlertMAC="000000000000"/>
        <LanDestInfo num="9" DestType="00" AckRetryInterval="00" Retries="00" IPFormat="00" GateWaySel="00" AlertIP="00000000" AlertMAC="000000000000"/>
        <LanDestInfo num="a" DestType="00" AckRetryInterval="00" Retries="00" IPFormat="00" GateWaySel="00" AlertIP="00000000" AlertMAC="000000000000"/>
        <LanDestInfo num="b" DestType="00" AckRetryInterval="00" Retries="00" IPFormat="00" GateWaySel="00" AlertIP="00000000" AlertMAC="000000000000"/>
        <LanDestInfo num="c" DestType="00" AckRetryInterval="00" Retries="00" IPFormat="00" GateWaySel="00" AlertIP="00000000" AlertMAC="000000000000"/>
        <LanDestInfo num="d" DestType="00" AckRetryInterval="00" Retries="00" IPFormat="00" GateWaySel="00" AlertIP="00000000" AlertMAC="000000000000"/>
        <LanDestInfo num="e" DestType="00" AckRetryInterval="00" Retries="00" IPFormat="00" GateWaySel="00" AlertIP="00000000" AlertMAC="000000000000"/>
      </Lan>
    </LanModule>
    <PEFModule>
      <PEF PEFCtrl="00" PEF_AGC="00" PEF_SD="00" PEF_ASD="00" LastProcIDBySW="0000" LastProcIDByBMC="0000">
        <GUID Flag="00" Data="00000000000000000000000000000000"/>
        <PEFEntry>
          <PEFEntryInfo num="0" FC="00" EFA="00" APN="00" ES="00" GIDB1="00" GIDB2="00" ST="00" SN="00" ET="00" ED1EOM="0000" ED1AM="00" ED1C1="00" ED1C2="00" ED2AM="00" ED2C1="00" ED2C2="00" ED3AM="00" ED3C1="00" ED3C2="00"/>
          <PEFEntryInfo num="1" FC="00" EFA="00" APN="00" ES="00" GIDB1="00" GIDB2="00" ST="00" SN="00" ET="00" ED1EOM="0000" ED1AM="00" ED1C1="00" ED1C2="00" ED2AM="00" ED2C1="00" ED2C2="00" ED3AM="00" ED3C1="00" ED3C2="00"/>
          <PEFEntryInfo num="2" FC="00" EFA="00" APN="00" ES="00" GIDB1="00" GIDB2="00" ST="00" SN="00" ET="00" ED1EOM="0000" ED1AM="00" ED1C1="00" ED1C2="00" ED2AM="00" ED2C1="00" ED2C2="00" ED3AM="00" ED3C1="00" ED3C2="00"/>
          <PEFEntryInfo num="3" FC="00" EFA="00" APN="00" ES="00" GIDB1="00" GIDB2="00" ST="00" SN="00" ET="00" ED1EOM="0000" ED1AM="00" ED1C1="00" ED1C2="00" ED2AM="00" ED2C1="00" ED2C2="00" ED3AM="00" ED3C1="00" ED3C2="00"/>
          <PEFEntryInfo num="4" FC="00" EFA="00" APN="00" ES="00" GIDB1="00" GIDB2="00" ST="00" SN="00" ET="00" ED1EOM="0000" ED1AM="00" ED1C1="00" ED1C2="00" ED2AM="00" ED2C1="00" ED2C2="00" ED3AM="00" ED3C1="00" ED3C2="00"/>
          <PEFEntryInfo num="5" FC="00" EFA="00" APN="00" ES="00" GIDB1="00" GIDB2="00" ST="00" SN="00" ET="00" ED1EOM="0000" ED1AM="00" ED1C1="00" ED1C2="00" ED2AM="00" ED2C1="00" ED2C2="00" ED3AM="00" ED3C1="00" ED3C2="00"/>
          <PEFEntryInfo num="6" FC="00" EFA="00" APN="00" ES="00" GIDB1="00" GIDB2="00" ST="00" SN="00" ET="00" ED1EOM="0000" ED1AM="00" ED1C1="00" ED1C2="00" ED2AM="00" ED2C1="00" ED2C2="00" ED3AM="00" ED3C1="00" ED3C2="00"/>
          <PEFEntryInfo num="7" FC="00" EFA="00" APN="00" ES="00" GIDB1="00" GIDB2="00" ST="00" SN="00" ET="00" ED1EOM="0000" ED1AM="00" ED1C1="00" ED1C2="00" ED2AM="00" ED2C1="00" ED2C2="00" ED3AM="00" ED3C1="00" ED3C2="00"/>
          <PEFEntryInfo num="8" FC="00" EFA="00" APN="00" ES="00" GIDB1="00" GIDB2="00" ST="00" SN="00" ET="00" ED1EOM="0000" ED1AM="00" ED1C1="00" ED1C2="00" ED2AM="00" ED2C1="00" ED2C2="00" ED3AM="00" ED3C1="00" ED3C2="00"/>
          <PEFEntryInfo num="9" FC="00" EFA="00" APN="00" ES="00" GIDB1="00" GIDB2="00" ST="00" SN="00" ET="00" ED1EOM="0000" ED1AM="00" ED1C1="00" ED1C2="00" ED2AM="00" ED2C1="00" ED2C2="00" ED3AM="00" ED3C1="00" ED3C2="00"/>
          <PEFEntryInfo num="a" FC="00" EFA="00" APN="00" ES="00" GIDB1="00" GIDB2="00" ST="00" SN="00" ET="00" ED1EOM="0000" ED1AM="00" ED1C1="00" ED1C2="00" ED2AM="00" ED2C1="00" ED2C2="00" ED3AM="00" ED3C1="00" ED3C2="00"/>
          <PEFEntryInfo num="b" FC="00" EFA="00" APN="00" ES="00" GIDB1="00" GIDB2="00" ST="00" SN="00" ET="00" ED1EOM="0000" ED1AM="00" ED1C1="00" ED1C2="00" ED2AM="00" ED2C1="00" ED2C2="00" ED3AM="00" ED3C1="00" ED3C2="00"/>
          <PEFEntryInfo num="c" FC="00" EFA="00" APN="00" ES="00" GIDB1="00" GIDB2="00" ST="00" SN="00" ET="00" ED1EOM="0000" ED1AM="00" ED1C1="00" ED1C2="00" ED2AM="00" ED2C1="00" ED2C2="00" ED3AM="00" ED3C1="00" ED3C2="00"/>
          <PEFEntryInfo num="d" FC="00" EFA="00" APN="00" ES="00" GIDB1="00" GIDB2="00" ST="00" SN="00" ET="00" ED1EOM="0000" ED1AM="00" ED1C1="00" ED1C2="00" ED2AM="00" ED2C1="00" ED2C2="00" ED3AM="00" ED3C1="00" ED3C2="00"/>
          <PEFEntryInfo num="e" FC="00" EFA="00" APN="00" ES="00" GIDB1="00" GIDB2="00" ST="00" SN="00" ET="00" ED1EOM="0000" ED1AM="00" ED1C1="00" ED1C2="00" ED2AM="00" ED2C1="00" ED2C2="00" ED3AM="00" ED3C1="00" ED3C2="00"/>
          <PEFEntryInfo num="f" FC="00" EFA="00" APN="00" ES="00" GIDB1="00" GIDB2="00" ST="00" SN="00" ET="00" ED1EOM="0000" ED1AM="00" ED1C1="00" ED1C2="00" ED2AM="00" ED2C1="00" ED2C2="00" ED3AM="00" ED3C1="00" ED3C2="00"/>
        </PEFEntry>
        <APTEntry>
          <APTEntryInfo num="0" PNP="00" CNDS="00" ASK="00"/>
          <APTEntryInfo num="1" PNP="00" CNDS="00" ASK="00"/>
          <APTEntryInfo num="2" PNP="00" CNDS="00" ASK="00"/>
          <APTEntryInfo num="3" PNP="00" CNDS="00" ASK="00"/>
          <APTEntryInfo num="4" PNP="00" CNDS="00" ASK="00"/>
          <APTEntryInfo num="5" PNP="00" CNDS="00" ASK="00"/>
          <APTEntryInfo num="6" PNP="00" CNDS="00" ASK="00"/>
          <APTEntryInfo num="7" PNP="00" CNDS="00" ASK="00"/>
          <APTEntryInfo num="8" PNP="00" CNDS="00" ASK="00"/>
          <APTEntryInfo num="9" PNP="00" CNDS="00" ASK="00"/>
          <APTEntryInfo num="a" PNP="00" CNDS="00" ASK="00"/>
          <APTEntryInfo num="b" PNP="00" CNDS="00" ASK="00"/>
          <APTEntryInfo num="c" PNP="00" CNDS="00" ASK="00"/>
          <APTEntryInfo num="d" PNP="00" CNDS="00" ASK="00"/>
          <APTEntryInfo num="e" PNP="00" CNDS="00" ASK="00"/>
          <APTEntryInfo num="f" PNP="00" CNDS="00" ASK="00"/>
        </APTEntry>
        <ASEntry>
          <ASEntryInfo num="0" EFN="00" ASS="00" String0="" String1=""/>
          <ASEntryInfo num="1" EFN="00" ASS="00" String0="" String1=""/>
        </ASEntry>
      </PEF>
    </PEFModule>
    <ChnlAccessModule>
      <ChnlAccs num="0" ChnlAccess="00" PriLimit="00"/>
      <ChnlAccs num="1" ChnlAccess="02" PriLimit="04"/>
      <ChnlAccs num="2" ChnlAccess="00" PriLimit="00"/>
      <ChnlAccs num="3" ChnlAccess="02" PriLimit="04"/>
      <ChnlAccs num="4" ChnlAccess="00" PriLimit="00"/>
      <ChnlAccs num="5" ChnlAccess="00" PriLimit="00"/>
      <ChnlAccs num="6" ChnlAccess="00" PriLimit="00"/>
      <ChnlAccs num="7" ChnlAccess="00" PriLimit="00"/>
      <ChnlAccs num="8" ChnlAccess="00" PriLimit="00"/>
      <ChnlAccs num="9" ChnlAccess="00" PriLimit="00"/>
      <ChnlAccs num="a" ChnlAccess="00" PriLimit="00"/>
      <ChnlAccs num="b" ChnlAccess="00" PriLimit="00"/>
      <ChnlAccs num="c" ChnlAccess="00" PriLimit="00"/>
      <ChnlAccs num="d" ChnlAccess="00" PriLimit="00"/>
      <ChnlAccs num="e" ChnlAccess="00" PriLimit="00"/>
      <ChnlAccs num="f" ChnlAccess="00" PriLimit="00"/>
    </ChnlAccessModule>
    <SerialModule>
      <Ser num="0" ConnectMode="00" SessionTimeOut="00" DCDTermination="00" FlowCtrl="00" CommSetting="00" SessionTermination="00" SerialMode="00" SOLFlowCtrl="00">
        <AuthTypeEnable CallBackLevel="00" UserLevel="00" OperatorLevel="00" AdministratroLevel="00" OEMLevel="00"/>
        <SerTermModeConfig TermModeOption="00" NewLineSeq="00"/>
      </Ser>
      <Ser num="1" ConnectMode="04" SessionTimeOut="00" DCDTermination="00" FlowCtrl="00" CommSetting="07" SessionTermination="00" SerialMode="03" SOLFlowCtrl="00">
        <AuthTypeEnable CallBackLevel="17" UserLevel="17" OperatorLevel="17" AdministratroLevel="17" OEMLevel="17"/>
        <SerTermModeConfig TermModeOption="00" NewLineSeq="00"/>
      </Ser>
      <Ser num="2" ConnectMode="00" SessionTimeOut="00" DCDTermination="00" FlowCtrl="00" CommSetting="00" SessionTermination="00" SerialMode="00" SOLFlowCtrl="00">
        <AuthTypeEnable CallBackLevel="00" UserLevel="00" OperatorLevel="00" AdministratroLevel="00" OEMLevel="00"/>
        <SerTermModeConfig TermModeOption="00" NewLineSeq="00"/>
      </Ser>
    </SerialModule>
    <SOLModule>
      <SOL SOLActivating="00" SOLEnOrDisable="01" SOLAuthentication="00" SOLPrivilegeLevel="03" ChrAccumulate="00" ChrSendThreshold="00" RetryCount="00" RetryInterval="00" NonValBitRate="0a"/>
    </SOLModule>
    <BMCModule>
      <BMC BMCAddStatus="00" BMCAdd="00" DEVICEGUID="00000000000000000000000000000000" BMCRestorePolicy="00" IsPowerOn="00" PowerCycleInterval="00" SelReservedID="0000"/>
    </BMCModule>
    <LanExtModule>
      <LanExt num="0" Reserved="000000000000000000000000000000000000" DevIfMode="02" SOLTimeOutEn="00" VLANID="0000" VLANPRIORITY="00" DHCPv6Mode="00" RandomNumber_Key="0000000000000000000000000000000000000000"/>
    </LanExtModule>
    <UserPayloadAccess>
      <UserPayload num="0">
        <PayloadAccessPerLAN num="0" ChanNum="01" UserPayload="02000000"/>
      </UserPayload>
      <UserPayload num="1">
        <PayloadAccessPerLAN num="0" ChanNum="01" UserPayload="02000000"/>
      </UserPayload>
      <UserPayload num="2">
        <PayloadAccessPerLAN num="0" ChanNum="01" UserPayload="02000000"/>
      </UserPayload>
      <UserPayload num="3">
        <PayloadAccessPerLAN num="0" ChanNum="01" UserPayload="02000000"/>
      </UserPayload>
      <UserPayload num="4">
        <PayloadAccessPerLAN num="0" ChanNum="00" UserPayload="00000000"/>
      </UserPayload>
      <UserPayload num="5">
        <PayloadAccessPerLAN num="0" ChanNum="00" UserPayload="00000000"/>
      </UserPayload>
      <UserPayload num="6">
        <PayloadAccessPerLAN num="0" ChanNum="00" UserPayload="00000000"/>
      </UserPayload>
      <UserPayload num="7">
        <PayloadAccessPerLAN num="0" ChanNum="00" UserPayload="00000000"/>
      </UserPayload>
      <UserPayload num="8">
        <PayloadAccessPerLAN num="0" ChanNum="00" UserPayload="00000000"/>
      </UserPayload>
      <UserPayload num="9">
        <PayloadAccessPerLAN num="0" ChanNum="00" UserPayload="00000000"/>
      </UserPayload>
    </UserPayloadAccess>
    <LANService>
      <LanServ Auth_En="00" DNSAddr="00000000" SMTP_SERVER="" Account="" Password="" SMTP_SSL="00" Alert_En="00">
        <Mail_Receiver num="0" Receiver_En="00" SendMailAddr="" Message="" Subject="" Sender=""/>
        <Mail_Receiver num="1" Receiver_En="00" SendMailAddr="" Message="" Subject="" Sender=""/>
        <Mail_Receiver num="2" Receiver_En="00" SendMailAddr="" Message="" Subject="" Sender=""/>
        <Mail_Receiver num="3" Receiver_En="00" SendMailAddr="" Message="" Subject="" Sender=""/>
        <Mail_Receiver num="4" Receiver_En="00" SendMailAddr="" Message="" Subject="" Sender=""/>
        <Mail_Receiver num="5" Receiver_En="00" SendMailAddr="" Message="" Subject="" Sender=""/>
        <Mail_Receiver num="6" Receiver_En="00" SendMailAddr="" Message="" Subject="" Sender=""/>
        <Mail_Receiver num="7" Receiver_En="00" SendMailAddr="" Message="" Subject="" Sender=""/>
        <Mail_Receiver num="8" Receiver_En="00" SendMailAddr="" Message="" Subject="" Sender=""/>
        <Mail_Receiver num="9" Receiver_En="00" SendMailAddr="" Message="" Subject="" Sender=""/>
        <Mail_Receiver num="a" Receiver_En="00" SendMailAddr="" Message="" Subject="" Sender=""/>
        <Mail_Receiver num="b" Receiver_En="00" SendMailAddr="" Message="" Subject="" Sender=""/>
        <Mail_Receiver num="c" Receiver_En="00" SendMailAddr="" Message="" Subject="" Sender=""/>
        <Mail_Receiver num="d" Receiver_En="00" SendMailAddr="" Message="" Subject="" Sender=""/>
        <Mail_Receiver num="e" Receiver_En="00" SendMailAddr="" Message="" Subject="" Sender=""/>
        <Mail_Receiver num="f" Receiver_En="00" SendMailAddr="" Message="" Subject="" Sender=""/>
      </LanServ>
    </LANService>
    <LdapModule>
      <LDAP LdapEnable="00" Timeout="0000" Port="0000" ServerIP="00000000" BaseDN="" BindID="" BindPWD=""/>
    </LdapModule>
    <BoardModule>
      <Board BoardID="0000" WFruCap="00" HWMonitorChip="00" NumLan="00" DHCPTimeout="00000000" StaticIPAddr="00000000"/>
    </BoardModule>
    <LanServConfig>
      <LANServC Http_PortNum="0000" Https_PortNum="0000" Telnet_PortNum="0000" SSH_PortNum="0000" SNMP_PortNum="0000" IKVM_PortNum="0000" VUSB_PortNum="0000" SMTP_PortNum="0000" Reserved_PortNum="0000"/>
    </LanServConfig>
    <RadiusModule>
      <Radius RadiusEnable="00" ServerIP="00000000" Port="0000" Secret="0000000000000000000000000000000000000000000000000000000000000000" reserve="0000000000000000000000000000000000000000000000000000000000000000"/>
    </RadiusModule>
    <ActiveDirectoryModule>
      <ActiveDirectory ADEnable="00" Timeout="0000" ServerIP0="00000000" ServerIP1="00000000" ServerIP2="00000000">
        <RoleGroup num="0" Name="" Domain="" Privilege="00"/>
        <RoleGroup num="1" Name="" Domain="" Privilege="00"/>
        <RoleGroup num="2" Name="" Domain="" Privilege="00"/>
        <RoleGroup num="3" Name="" Domain="" Privilege="00"/>
        <RoleGroup num="4" Name="" Domain="" Privilege="00"/>
      </ActiveDirectory>
    </ActiveDirectoryModule>
  </IPMI>
</root
 

RageBone

Active Member
Jul 11, 2017
617
159
43
ehm,
where is that xml?
asking for a friend, lol.

i have a few boards that don't respond and that might have 0ed mac addresses.

I'm also a bit baffled by the issues you are having.
I'm not sure i ever did a full factory image write to flash on an SM X9 but i did for sure on X10 with Aspeed BMCs and there weren't any issues.
Like what you have described with the Asrack boards.

I am using a ch341A as well with flashrom, so i can confirm that That does work as it should.
Is the Writeprotect pin set correctly?
You could also rig that to protect the chip.

Only idea that i just had is, that on some boards, you actually have multiple EEPROMs with one for backups for example.
Not that i remember that from the x9s i had but maybe there is still a corrupted backup somewhere that the writes come from.

Sadly i don't have any working X9 boards anymore that i could dump from.
 

Knogle

New Member
Jun 23, 2021
16
6
3
Oh hey!
It's a bit nasty.
Do you know which pin acts as write protection in case of your boards?

The xml is located here:

In section

1572864 0x180000 CramFS filesystem, little endian, size: 7970816, version 2, sorted_dirs, CRC 0x8C6D86A4, edition 0, 4910 blocks, 1078 files


Code:
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
59700         0xE934          Copyright string: "Copyright (c) Winbond Limited 2001 - 2006. All rights reserved."
60835         0xEDA3          Copyright string: "Copyright 1995-1998 Mark Adler "
1572864       0x180000        CramFS filesystem, little endian, size: 7970816, version 2, sorted_dirs, CRC 0x8C6D86A4, edition 0, 4910 blocks, 1078 files
9961472       0x980000        Zip archive data, at least v2.0 to extract, compressed size: 1127148, uncompressed size: 2339464, name: kernel.bin
11088768      0xA93380        End of Zip archive, footer length: 22
12058624      0xB80000        CramFS filesystem, little endian, size: 2371584, version 2, sorted_dirs, CRC 0x9D53DC4C, edition 0, 1099 blocks, 218 files
You can simply dd it to a file and extract it using 7-Zip. It's a standard linux root partition so you can edit everything you want there, and pack it again.
It's only really difficult to get the proper tools to work with CramFS because it's very very old.
I am trying to make a new CramFS file after editing, but it's too large. 8M before editing, 16M after, so it doesn't fit the chip. Somehow they have used a different method for compression which is not supported by the mkfs.cramfs command on util-linux. So i am not able to get the filesystem small enough. I have to dig deeper, and maybe use different tools.
 
  • Like
Reactions: RageBone

Knogle

New Member
Jun 23, 2021
16
6
3
It's an X9DRi-LN4F+

These boards are supported by the ATEN IPMI firmware, so any dump of one of those would be fine!
Just found out, my router is running an X9SCL-F, maybe i'll try this one out first.

Simply use binwalk -e SMTxx.bin to extract it. The content looks like that.

Code:
_SMT_X9_348.bin.extracted]# ls
180000.cramfs  980000.zip  B80000.cramfs  cramfs-root  cramfs-root-0  kernel.bin


EDIT: It's impossible for me to pack it using old cramfs utils. So i'll pack them using squashfs and include u-boot and create a whole new image.

EDIT2:
Just flashed the AMI instead of the ATEN IPMI firmware from an X8 board, completely different structure, but now i got network access. Maybe its enough, lets see.

Code:
-rw-r--r-- 1 chairman chairman 17386 Jan 21 11:38 platform_H8DCL_LN4.xml
-rw-r--r-- 1 chairman chairman 17386 Jan 21 11:38 platform_H8DCL.xml
-rw-r--r-- 1 chairman chairman 17386 Jan 21 11:38 platform_H8DCT_IBQF.xml
-rw-r--r-- 1 chairman chairman 17386 Jan 21 11:38 platform_H8DCT.xml
-rw-r--r-- 1 chairman chairman 17386 Jan 21 11:38 platform_H8DG6.xml
-rw-r--r-- 1 chairman chairman 17386 Jan 21 11:38 platform_H8DGG.xml
-rw-r--r-- 1 chairman chairman 17395 Jan 21 11:38 platform_H8DGT_HF_AI034.xml
-rw-r--r-- 1 chairman chairman 17395 Jan 21 11:38 platform_H8DGT_HIBQF_AI034.xml
-rw-r--r-- 1 chairman chairman 17386 Jan 21 11:38 platform_H8DGT.xml
-rw-r--r-- 1 chairman chairman 17396 Jan 21 11:38 platform_H8DGU_LN4_AI034.xml
-rw-r--r-- 1 chairman chairman 17390 Jan 21 11:38 platform_H8DGU_LN4.xml
-rw-r--r-- 1 chairman chairman 17386 Jan 21 11:38 platform_H8DGU.xml
-rw-r--r-- 1 chairman chairman 17386 Jan 21 11:38 platform_H8QG6.xml
-rw-r--r-- 1 chairman chairman 17392 Jan 21 11:38 platform_H8QGI_AI034.xml
-rw-r--r-- 1 chairman chairman 17386 Jan 21 11:38 platform_H8SCM.xml
-rw-r--r-- 1 chairman chairman 17386 Jan 21 11:38 platform_H8SGL.xml
-rw-r--r-- 1 chairman chairman 17393 Jan 21 11:38 platform_X7Sb3.xml
-rw-r--r-- 1 chairman chairman 17407 Jan 21 11:38 platform_X7SPA.xml
-rw-r--r-- 1 chairman chairman 17407 Jan 21 11:38 platform_X7SPT.xml
-rw-r--r-- 1 chairman chairman 17391 Jan 21 11:38 platform_X8DTL_6F.xml
-rw-r--r-- 1 chairman chairman 17390 Jan 21 11:38 platform_X8DTL_iF.xml
-rw-r--r-- 1 chairman chairman 18184 Jan 21 11:38 platform_X8DTNplus.xml
-rw-r--r-- 1 chairman chairman 18180 Jan 21 11:38 platform_X8DTN.xml
-rw-r--r-- 1 chairman chairman 17387 Jan 21 11:38 platform_X8DTT.xml
-rw-r--r-- 1 chairman chairman 18182 Jan 21 11:38 platform_X8DTU_6TF.xml
-rw-r--r-- 1 chairman chairman 17389 Jan 21 11:38 platform_X8DTU-F.xml
-rw-r--r-- 1 chairman chairman 18182 Jan 21 11:38 platform_X8DTUplus.xml
-rw-r--r-- 1 chairman chairman 17387 Jan 21 11:38 platform_X8DTU.xml
-rw-r--r-- 1 chairman chairman 17390 Jan 21 11:38 platform_X8DTW_6F.xml
-rw-r--r-- 1 chairman chairman 17393 Jan 21 11:38 platform_X8SIA.xml
-rw-r--r-- 1 chairman chairman 17393 Jan 21 11:38 platform_X8SII.xml
-rw-r--r-- 1 chairman chairman 17393 Jan 21 11:38 platform_X8SIL_SIOM.xml
-rw-r--r-- 1 chairman chairman 17393 Jan 21 11:38 platform_X8SIL.xml
-rw-r--r-- 1 chairman chairman 17393 Jan 21 11:38 platform_X8SIT.xml
-rw-r--r-- 1 chairman chairman 17393 Jan 21 11:38 platform_X8SIU.xml
-rw-r--r-- 1 chairman chairman 17390 Jan 21 11:38 platform_X8STE.xml
-rw-r--r-- 1 chairman chairman 17393 Jan 21 11:38 platform_X8STI_3F.xml
-rw-r--r-- 1 chairman chairman 17397 Jan 21 11:38 platform_X9DA6.xml
-rw-r--r-- 1 chairman chairman 17397 Jan 21 11:38 platform_X9DAX.xml
-rw-r--r-- 1 chairman chairman 17413 Jan 21 11:38 platform_X9DB3_CPU_AI026.xml
-rw-r--r-- 1 chairman chairman 17403 Jan 21 11:38 platform_X9DB3.xml
-rw-r--r-- 1 chairman chairman 17397 Jan 21 11:38 platform_X9DBL.xml
-rw-r--r-- 1 chairman chairman 17403 Jan 21 11:38 platform_X9DBU.xml
-rw-r--r-- 1 chairman chairman 17408 Jan 21 11:38 platform_X9DR6_LN4_AI034.xml
-rw-r--r-- 1 chairman chairman 17406 Jan 21 11:38 platform_X9DR6_PLUS.xml
-rw-r--r-- 1 chairman chairman 17403 Jan 21 11:38 platform_X9DR6.xml
-rw-r--r-- 1 chairman chairman 17401 Jan 21 11:38 platform_X9DR7_LN4.xml
-rw-r--r-- 1 chairman chairman 17406 Jan 21 11:38 platform_X9DR7_TFPLUS.xml
-rw-r--r-- 1 chairman chairman 17407 Jan 21 11:38 platform_X9DRD_CT_PLUS.xml
-rw-r--r-- 1 chairman chairman 17402 Jan 21 11:38 platform_X9DRD_LN4.xml
-rw-r--r-- 1 chairman chairman 17398 Jan 21 11:38 platform_X9DRD.xml
-rw-r--r-- 1 chairman chairman 17402 Jan 21 11:38 platform_X9DRFF7GP.xml
-rw-r--r-- 1 chairman chairman 17401 Jan 21 11:38 platform_X9DRFF7P.xml
-rw-r--r-- 1 chairman chairman 17399 Jan 21 11:38 platform_X9DRFF.xml
-rw-r--r-- 1 chairman chairman 17398 Jan 21 11:38 platform_X9DRF.xml
-rw-r--r-- 1 chairman chairman 17413 Jan 21 11:38 platform_X9DRG_HTFPLUS_II.xml
-rw-r--r-- 1 chairman chairman 17402 Jan 21 11:38 platform_X9DRG_HTFPLUS.xml
-rw-r--r-- 1 chairman chairman 17405 Jan 21 11:38 platform_X9DRG_OF.xml
-rw-r--r-- 1 chairman chairman 17394 Jan 21 11:38 platform_X9DRG.xml
-rw-r--r-- 1 chairman chairman 17397 Jan 21 11:38 platform_X9DRH.xml
-rw-r--r-- 1 chairman chairman 17406 Jan 21 11:38 platform_X9DRL_7F.xml
-rw-r--r-- 1 chairman chairman 17403 Jan 21 11:38 platform_X9DRL.xml
-rw-r--r-- 1 chairman chairman 17399 Jan 21 11:38 platform_X9DRT_F.xml
-rw-r--r-- 1 chairman chairman 17406 Jan 21 11:38 platform_X9DRT_H_AI034.xml
-rw-r--r-- 1 chairman chairman 17404 Jan 21 11:38 platform_X9DRT_HFPLUS.xml
-rw-r--r-- 1 chairman chairman 17409 Jan 21 11:38 platform_X9DRT_HIBQ_AI034.xml
-rw-r--r-- 1 chairman chairman 17405 Jan 21 11:38 platform_X9DRT_P.xml
-rw-r--r-- 1 chairman chairman 17397 Jan 21 11:38 platform_X9DRT_SG.xml
-rw-r--r-- 1 chairman chairman 17397 Jan 21 11:38 platform_X9DRT.xml
-rw-r--r-- 1 chairman chairman 17408 Jan 21 11:38 platform_X9DRW_7TPF_PLUS.xml
-rw-r--r-- 1 chairman chairman 17406 Jan 21 11:38 platform_X9DRW_CF.xml
-rw-r--r-- 1 chairman chairman 17408 Jan 21 11:38 platform_X9DRW_LN4_AI034.xml
-rw-r--r-- 1 chairman chairman 17408 Jan 21 11:38 platform_X9DRW_PLUS.xml
-rw-r--r-- 1 chairman chairman 17397 Jan 21 11:38 platform_X9DRW.xml
-rw-r--r-- 1 chairman chairman 17397 Jan 21 11:38 platform_X9DRX.xml
-rw-r--r-- 1 chairman chairman 17401 Jan 21 11:38 platform_X9QR7_TF.xml
-rw-r--r-- 1 chairman chairman 17397 Jan 21 11:38 platform_X9QR7.xml
-rw-r--r-- 1 chairman chairman 17398 Jan 21 11:38 platform_X9SBAA.xml
-rw-r--r-- 1 chairman chairman 17397 Jan 21 11:38 platform_X9SCA.xml
-rw-r--r-- 1 chairman chairman 17397 Jan 21 11:38 platform_X9SCD.xml
-rw-r--r-- 1 chairman chairman 17397 Jan 21 11:38 platform_X9SCE.xml
-rw-r--r-- 1 chairman chairman 17390 Jan 21 11:38 platform_X9SCFF.xml
-rw-r--r-- 1 chairman chairman 17397 Jan 21 11:38 platform_X9SCL.xml
-rw-r--r-- 1 chairman chairman 17402 Jan 21 11:38 platform_X9SCM_II.xml
-rw-r--r-- 1 chairman chairman 17397 Jan 21 11:38 platform_X9SCM.xml
-rw-r--r-- 1 chairman chairman 17397 Jan 21 11:38 platform_X9SCV.xml
-rw-r--r-- 1 chairman chairman 17397 Jan 21 11:38 platform_X9SPU.xml
-rw-r--r-- 1 chairman chairman 17397 Jan 21 11:38 platform_X9SRA.xml
-rw-r--r-- 1 chairman chairman 17400 Jan 21 11:38 platform_X9SRD_CF.xml
-rw-r--r-- 1 chairman chairman 17397 Jan 21 11:38 platform_X9SRD.xml
-rw-r--r-- 1 chairman chairman 17403 Jan 21 11:38 platform_X9SRE_DS108.xml
-rw-r--r-- 1 chairman chairman 17398 Jan 21 11:38 platform_X9SRG.xml
-rw-r--r-- 1 chairman chairman 17398 Jan 21 11:38 platform_X9SRH7.xml
-rw-r--r-- 1 chairman chairman 17397 Jan 21 11:38 platform_X9SRI.xml
-rw-r--r-- 1 chairman chairman 17400 Jan 21 11:38 platform_X9SRL_CF.xml
-rw-r--r-- 1 chairman chairman 17397 Jan 21 11:38 platform_X9SRL.xml
-rw-r--r-- 1 chairman chairman 17397 Jan 21 11:38 platform_X9SRW.xml
 
Last edited:

Knogle

New Member
Jun 23, 2021
16
6
3
Success!!
I've got 2 ways in order to get it working. 1st, use the X9SCL-F dumped firmware i have uploaded.
Keep in mind! You have to change the MAC address in the rom file, simply use some hex editor and look for 00:25:90:7f:69:e8 and replace it by the IPMI MAC of your board.
It works fine.

That's where the MACs are stored.
Screenshot from 2022-01-21 16-48-40.png

2nd approach, build a new image using u-boot + kernel and squashfs containers. It's a far better solution, but updates will break it because Supermicro won't move to squashfs nor u-boot.
 

RageBone

Active Member
Jul 11, 2017
617
159
43
would you mind elaborating on the DIY way?
I'm kinda braindead right now so maybe it clicks without it in a moment but i'd really appreciate it.

Congratz on getting it working again.
 

Knogle

New Member
Jun 23, 2021
16
6
3
would you mind elaborating on the DIY way?
I'm kinda braindead right now so maybe it clicks without it in a moment but i'd really appreciate it.

Congratz on getting it working again.
Hey sure, no issue.
First of all i just wanted to get it working somehow.

There are 2 types of IPMI in the Supermicro X8/X9/X10 world.
One is using AMI firmware (On X8 only) and the other ones, X9 and X10 ATEN firmware.
Both use the same IPMI hardware, so you can flash the X8 firmware on X9 and it works more or less, but it boots.

What i have done is slightly different.
I have my OpenWrt router, running using an Supermicro X9SCM-L.
So its using the ATEN firmware, and the same IPMI hardware as my X9DRi-LN4F
The firmware is the same among these boards so i have dumped the IPMI ROM of the X9SCM-L and flashed it onto the X9DRi-LNF4.
Now the IPMI works on my broken board. But only one issue left.
You have to adjust the MAC address in order to fit the MAC of your broken board. Because while copying the flash of the working one, you also copy its MAC address. So you have to adjust this MAC address later on. Thats all. I can provide some support if you want to fix yours as well.

The overview is a little "borked" but at least the IPMI works now.


Bildschirmfoto vom 2022-01-21 23-28-42.png

Furthermore ill suggest a reset to factory defaults, and re-flash using the web interface after this procedure.

Bildschirmfoto vom 2022-01-21 23-43-53.png
 
Last edited:

baloo_

New Member
Feb 11, 2022
1
0
1
If you have an external programmer, you can SOIP16 clip the chip and just use flashrom to reprogram the IPMI SPI flash.

The layout is the same as the firmware you get from supermicro, the only thing that changes is that you get a partition that holds the configuration (that includes the MAC address) so doing so you will erase your config.

The firmware can be decrypted using this method: GitHub - c0d3z3r0/smcbmc: Tool for decrypting Supermicro BMC firmware images
(the binary and its key are in the same file, you just need to descramble the bytes)
 

j9111

New Member
Oct 31, 2022
1
0
1
Apologies for hijacking this thread. I have a supermicro H8SML-7iF which has corrupted firmware on the ipmi chip. The chip is a spansion FL128SAIF00 from what I can read off the chip.

I have a CH341A programmer and bought a 16 pin soic clip but using the Windows firmware it fails to detect the chip. I also have an EZP2019+ which is having the same problem of identifying the chip.

My chip is soldered to the board. I wanted to know if the chip needs to be removed or if it can be flashed insitu by removing the cmos battery and atx plug?

I wanted to know what programmer, soic clip and flash app you are using? Any help you can provide is appreciated.

p.s. I reached out to supermicro who said that I would need to flash the SMT bin file as is and then use the ipmicfg utility with -a switch to add the mac address if it is missing. Only then will it work.

It's an X9DRi-LN4F+

These boards are supported by the ATEN IPMI firmware, so any dump of one of those would be fine!
Just found out, my router is running an X9SCL-F, maybe i'll try this one out first.

Simply use binwalk -e SMTxx.bin to extract it. The content looks like that.

Code:
_SMT_X9_348.bin.extracted]# ls
180000.cramfs  980000.zip  B80000.cramfs  cramfs-root  cramfs-root-0  kernel.bin


EDIT: It's impossible for me to pack it using old cramfs utils. So i'll pack them using squashfs and include u-boot and create a whole new image.

EDIT2:
Just flashed the AMI instead of the ATEN IPMI firmware from an X8 board, completely different structure, but now i got network access. Maybe its enough, lets see.

Code:
-rw-r--r-- 1 chairman chairman 17386 Jan 21 11:38 platform_H8DCL_LN4.xml
-rw-r--r-- 1 chairman chairman 17386 Jan 21 11:38 platform_H8DCL.xml
-rw-r--r-- 1 chairman chairman 17392 Jan 21 11:38 platform_H8QGI_AI034.xml
-rw-r--r-- 1 chairman chairman 17386 Jan 21 11:38 platform_H8SCM.xml
-rw-r--r-- 1 chairman chairman 17386 Jan 21 11:38 platform_H8SGL.xml
-rw-r--r-- 1 chairman chairman 17393 Jan 21 11:38 platform_X7Sb3.xml
-rw-r--r-- 1 chairman chairman 17407 Jan 21 11:38 platform_X7SPA.xml
-rw-r--r-- 1 chairman chairman 17407 Jan 21 11:38 platform_X7SPT.xml
-rw-r--r-- 1 chairman chairman 17391 Jan 21 11:38 platform_X8DTL_6F.xml
-rw-r--r-- 1 chairman chairman 17397 Jan 21 11:38 platform_X9SRW.xml

I have previously flashed the IPMI firmware from H8SCM successfully from within the IPMI web interface. Would I be able to use the file you provided to repair mine as I see the xml file in the list above? Any guidance you can provide is appreciated.