Invalid Supermicro IPMI / BIOS version?

[autumnwalker]

I eBay'd a X9DRH-ITF and decided to look at the firmware versions. Accoding to IPMI the firmware revision is 08.48 which doesn't seem to line up with any IPMI version from Supermicro for this board. It also doesn't show me BIOS, Redfish, CPLD revisions (screenshot below).



I have no idea what this firmware or BIOS is ... and I'm not sure how I should proceed with updating to a known good version from the Supermicro website.

Any thoughts?

 

[RolloZ170]

Any thoughts?

very old Firmware ?
after 2 comes 3
even in the manual you see IPMI Firmware revision 1.65

 

[BlueFox]

That board is too old for Redfish support, so, you're not going to see all of that. Generally unless you have a compelling reason to upgrade, Supermicro recommends that you don't.

 

[autumnwalker]

very old Firmware ?
after 2 comes 3
even in the manual you see IPMI Firmware revision 1.65

I don't follow. Am I reading 08.48 incorrectly? I thought it was version "eight", are you suggesting version "08" is less than version one?

 

[RolloZ170]

I don't follow. Am I reading 08.48 incorrectly?

oh sorry my fault. have overseen the 8...
this is different path of firmware, they changed vendor.

 

[autumnwalker]

That board is too old for Redfish support, so, you're not going to see all of that. Generally unless you have a compelling reason to upgrade, Supermicro recommends that you don't.

Understood re: recommended not to upgrade. I have a CVE I'm trying to deal with and I think the latest firmware addresses it.

 

[autumnwalker]

oh sorry my fault. have overseen the 8...
this is different path of firmware, they changed vendor.

Am I able to just update to the latest version listed on their website for this board then indicated as 3.62 or do I have to do something on that old path?

 

[luckylinux]

Understood re: recommended not to upgrade. I have a CVE I'm trying to deal with and I think the latest firmware addresses it.

Isn't it easier to just do that via Microcode Update in Linux Initramfs (or generally as soon as Linux Kernel Loads) ?

 

[autumnwalker]

Isn't it easier to just do that via Microcode Update in Linux Initramfs (or generally as soon as Linux Kernel Loads) ?

It's the IPMI firmware that I am interested in - I am hoping an update gets me around 'NULL' usernames and default credentils, CVE-2018-1668 and CVE-2019-4169.

 

[RolloZ170]

Am I able to just update to the latest version listed on their website for this board then indicated as 3.62 or do I have to do something on that old path?

first is that mobo an OEM one with special Firmware ? they use sometimes diff. BMC FW.
but i have seen similar with higher versions(but older date) than actual and some could update, some not.

 

[autumnwalker]

first is that mobo an OEM one with special Firmware ? they use sometimes diff. BMC FW.
but i have seen similar with higher versions(but older date) than actual and some could update, some not.

No idea what the history of the board is. Picked it up a couple of years ago on eBay. Is there any way to determine if it is an OEM board? Branding is Supermicro from what I can see in the IPMI GUI.

 

[luckylinux]

It's the IPMI firmware that I am interested in - I am hoping an update gets me around 'NULL' usernames and default credentils, CVE-2018-1668 and CVE-2019-4169.

I must have misunderstood then, sorry about that.

I also have some X9DRi-LN4F+ boards and similar and yeah, they are stuck on this old IPMI Firmware.

OpenBMC Project only supports a handful of Supermicro Motherboards and this is not amongst them.

You can try Google and see if you have better Success than me:

How to build for ASPEED 2400/2500 · Issue #47 · openbmc/docs

After a lot of testing, I am feeling a bit lost here. We have ASPEED AST2400/2500 BMCs, and I just want to upload a firmware to it - so that I can test stock functionality. (Eventually, I want to c...

github.com

Otherwise my Tip would be:
- VLAN Segregation (if you aren't already doing that)
- Go through a Firewall/L3 Router such as e.g. OPNSense

 

[RolloZ170]

You can try Google and see if you have better Success than me:

How to build for ASPEED 2400/2500 · Issue #47 · openbmc/docs

After a lot of testing, I am feeling a bit lost here. We have ASPEED AST2400/2500 BMCs, and I just want to upload a firmware to it - so that I can test stock functionality. (Eventually, I want to c...

github.com

but this X9 use Nuvoton / ATEN not ASPEED

 

[RolloZ170]

Is there any way to determine if it is an OEM board?

is printed on it
e.g. NI for Nutanix

 

[autumnwalker]

is printed on it
e.g. NI for Nutanix

I'll have to pull it out of the rack and inspect on my next scheduled maintenance window. Homelab / prodlab

 

[autumnwalker]

Ok - so I finally got around to scheduling some downtime.

I do not see any markings on the board that would indicated anything like Nutanix, etc. I just see "SUPERO" (something like that - the Supermicro logo, but truncated) and then stickers for MAC, etc.

I ran dmidecode and I see a number of spaces for OEM info that say "to be filled by OEM", but no actual OEM info that I see.

 

[luckylinux]

but this X9 use Nuvoton / ATEN not ASPEED

Alright I guess I'm used to the Fact that Today all Boards I cross used ASPEED BMC/IPMI.

The X9 Series is using the Nuvoton WPCM450 BMC.

Apparently there might be something for it

Nuvoton WPCM450 BMC (target request. have all data private/defines to compile) · Issue #3786 · openbmc/openbmc

in kerknel add support for https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/log/?h=next-20210430&qt=grep&q=WPCM450 Many Supermicrro MB target X8, X9, X10 use this BMC Also i have...

github.com

Does Nuvoton WPCM450 BMC use OpenBMC · Issue #3438 · openbmc/openbmc

I do have a supermicro 6026tt with 4 nodes which do have the Nuvoton WPCM450 BMC. The hardware is now out of support and Supermicro has no plans to update its messy KVM-over-LAN which is java based...

github.com

Otherwise you could use binwalk --extract SMT_X9_361.bin and extract the Firmware, then see if you can dig deeper into it to patch it:


Yet another Workaround is to disconnect the RJ45 Cable to the Management System and use something like a DIY PiKVM instead with all the latest Kernel, Patches, etc.

 

[RolloZ170]

I do not see any markings on the board that would indicated anything like Nutanix, etc. I just see "SUPERO" (something like that - the Supermicro logo, but truncated) and then stickers for MAC, etc.

found a date matching firmware SMT_X9_350 (06.2016)
i guess you have a OEM Firmware with 8.xx instead of 3.xx to prevent flash SM oroginal Firmware.

 

[autumnwalker]

found a date matching firmware SMT_X9_350 (06.2016)
i guess you have a OEM Firmware with 8.xx instead of 3.xx to prevent flash SM oroginal Firmware.

Prevent prevent? Or is there some way to force it to flash back to Supermicro firmware?

 

[luckylinux]

is printed on it
e.g. NI for Nutanix

Possibly also dmidecode.

Thosy ASRock Rack AMD Ryzen Boards for instance had Hetzner in the Output of dmidecode ...

Not exactly the same Thing, but maybe there is is a mention of the Manufacturer/OEM there as well.

 

[RolloZ170]

Prevent prevent? Or is there some way to force it to flash back to Supermicro firmware?

with hardware SPI programmer. you need both BMC and BIOS FW supermicro.

 

[autumnwalker]

with hardware SPI programmer. you need both BMC and BIOS FW supermicro.

Thanks! I don't think the juice is worth the squeeze here.