So I got froggy and decided to poke around a bit more. I figure the BMC will probably do something, even without a processor.
Lots of blinking lights, and the ethernet link comes up. That header labeled "BMC_DEBUG" seems interesting.
Measuring it, it's 5V, Gnd, 3.3V, 2.5V. Considering I can't imagine the BMC is a 5V part, I'd bet the 3.3V pin is serial TX, the 2.5V pin is serial RX (and it's just floating around. poor design that).
Sure looks like serial. Also, lots of stuff.
And it's 38500 baud? Oddball baudrate, that.
The RS232 decoder on my scope was pooping itself for some reason, but that's why raptor jesus invented logic analyzers
Oooh, we have a system boot. And it is indeed 38500 baud.
Code:
Time [s],Value,Parity Error,Framing Error
DRAM Init-DDR3
CBR0-135713570123456701234567
CBR13Done
U-Boot 1.1.6 (Jun 26 2014 - 17:00:57)
DRAM: 112 MB
Found SPI Chip Macronix MX25L25635E
Flash: 32 MB
Net: Protect off 20030000 ... 2003FFFF
Un-Protected 1 sectors
Erasing Flash...Erasing sector 3 ... ok.
Erased 1 sectors
Writing to Flash... done
Protected 1 sectors
ast_eth0
DRAM ECC disabled
Hit Esc key to stop autoboot: 3 '8''8''8' 2 '8''8''8' 1 '8''8''8' 0
Image to be booted is 1
conf @ /dev/mtdblock1 Address 20050000
conf @ /dev/mtdblock2 Address 200d0000
Found INITRD Image for Root File System @ /dev/mtdblock3 flash address 20150000
root @ /dev/mtdblock3 Address 20150000
Copying Module of size 0xe52040 From 0x20150000 to 0x41000000
INITRD Image moved to 0x41000000
www @ /dev/mtdblock4 Address 21190000
Un-Protect Flash Bank # 1
Booting from MODULE_PIMAGE ...
Bootargs = [root=/dev/ramdisk ro ip=none ramdisk_blocksize=4096 console=ttyS4COMMA38400 rootfstype=cramfs bigphysarea=6144 imagebooted=1]
## Booting image at 20fb0040 ...
Image Name: Linux-2.6.28.10-ami
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1887512 Bytes = 1.8 MB
Load Address: 40008000
Entry Point: 40008000
Verifying Checksum ... OK
OK
## Loading Ramdisk Image at 41000000 ...
Image Name:
Image Type: ARM Linux RAMDisk Image (uncompressed)
Data Size: 15015936 Bytes = 14.3 MB
Load Address: 00000000
Entry Point: 00000000
Verifying Checksum ... OK
Starting kernel ...
... Snip ...
calling dhcp6c....
Interface eth0 is up
DNS Registering IPT008CFACAF897.tooooobs 10.1.2.170 A 86400
; Communication with server failed: unexpected error
01-Jan-1970 00:00:58.183 dispatch 0x404e57f8: shutting down due to TCP receive error: 198.41.0.4#53: connection reset
; Communication with server failed: unexpected error
update failed: NOTIMP
sh: lo: unknown operand
sh: !=: argument expected
sh: lo: unknown operand
sh: !=: argument expected
sh: lo: unknown operand
sh: !=: argument expected
VLANID0 is not enabled...
Running ntpdate to synchronize clock :
Trying NTP Server pool.ntp.org :Success
starting iptables...
starting ip6tables...
Starting OpenSLP server: slpd.
\rINIT: Entering runlevel: 3\r
Starting DHCP monitor.
DHCP monitor: Renewing eth0 interface for IPv4
DHCP monitor: Renewing eth0 interface for IPv6
Renewing DNS for eth0 interface.
Secure Port is enabled for [ssh] with 22
sh: 0: unknown operand
/etc/rc3.d/S16tftpd: line 95: syntax error: PORT_VAL_BYTE &
2018.08.24 04:09:32 LOG7[3757:1073872512]: RAND_status claims sufficient entropy for the PRNG
2018.08.24 04:09:32 LOG7[3757:1073872512]: PRNG seeded successfully
2018.08.24 04:09:32 LOG4[3757:1073872512]: Wrong permissions on /usr/local/www/certs/privkey.pem
2018.08.24 04:09:32 LOG7[3757:1073872512]: Certificate: /usr/local/www/certs/server.pem
2018.08.24 04:09:32 LOG7[3757:1073872512]: Certificate loaded
2018.08.24 04:09:32 LOG7[3757:1073872512]: Key file: /usr/local/www/certs/privkey.pem
2018.08.24 04:09:32 LOG7[3757:1073872512]: Private key loaded
2018.08.24 04:09:32 LOG7[3757:1073872512]: SSL context initialized for service stunnel
inetd mode must define a remote host or an executable
[Failed: /etc/stunnel/stunnel.conf]. Check if pid= is specified in the file
Starting SNMP Daemons : snmpd.
sh: 0: unknown operand
Starting VM Application: vmapp
0
Stopping CD Redirection Server: cdserver.
Stopping FD Redirection Server: fdserver.
iquerySecName has not been configured - internal queries will fail
Stopping HD Redirection Server: hdserver.
dev 0 does not connect to host
NET-SNMP version 5.4.3
dev 1 does not connect to host
dev 2 does not connect to host
Helllooooooo U-Boot. And it pulled an IP (my home domain is `tooooobs`).
Apparently American Megatrends has a IPMI implementation named "MEGARAC". Googling about for default passwords doesn't get me anywhere, which is annoying (as in everything I found didn't work, not that I didn't find any).
The "Forgot Password?" link lets you probe for whether a username is valid (this is why you have to not deny or confirm on forget password dialogs, if you implement shit like that!). Some poking about, and apparently 'admin' is a existing user (All the documentation I found referred to using 'root', but that's apparently not present, here). The password turns out to be 'admin' as well. I wonder if these things were reset before sale, or if the BMC password was just never set at all.
The admin interface is quite interesting. I found the FRU metadata:
Apparently this isn't a Dell mobo, as @
wardtj suggested. It was manufactured by ZT Systems, with Chassis Part Number = SR-00739, Board Product Name = A9SD6F, Product Name = KAURI6T. I've not had any luck finding anything from any of those numbers, unfortunately.
That's all I've found so far. All the sensors seem to require the board to be on, which I can't do until the CPU shows up.
One interesting thing (if you can ignore the shitty photo-of-a-screen) is that it appears the BMC has access to the SFP+ interface.
It appears the BMC has access to the SFP+ port, because I can't think of another reason for the SFP+ interface to be powered up with the mobo off. You can see the SFP+ interface (big heatsink), the BMC (hot spot all the way to the right), and the GbE interface (hot spot in the middle).