Update supermicro server’s firmware BIOS under linux with the SUM cli

The newer Supermicro motherboards have the ability to update the system BIOS from IPMI Web management or with a Supermicro tool called

“Supermicro Update Manager (SUM)”

This tool consists of a linux cli and it works on most of the X9/X10/X11 Supermicro systems. If you have one of these motherboards you probably could update your BIOS under linux console and throwing away your freedos cd prehistoric update process (probably coming soon). If you’ve used Supermicro with for ages you probably are aware of the problem with the updating the BIOS, their tool is an old DOS flash utility, which could be used under MS Windows and with linux servers we got a problem! But not any more! Recent motherboards with built-in IPMI modules have “BIOS Update” option in the web interface (under Maintenance menu), but you need a license (which by the way is not expensive).

main menu
BIOS Update

So if you happen to have such server you could give a try to SUM linux cli (yes they made a linux cli and even a freebsd one!). With the SUM cli you could do more than just update the BIOS (which is pretty important) here are the functions you can do Key Management, System Checks, BIOS Management, BMC Management, System Event Log, CMM Management, Storage Management, Applications (through the network) and for some of them you still need a license, but for BIOS update you do not need if you do it as Supermicro says

In-Band

which basically means from the server you want to update (or in general use it). KEEP IN MIND this method will reset your BIOS options to DEFAULTS!!! In fact you need a license to use preserve settings you can see the output of the SUM help for the command UpdateBios. So save your changes to recover them after the update!
And here we present a BIOS update with SUM on one of our Supermicro servers with motherboard X11SSV-M4F
So the BIOS version was 1.0 reported by lshw:

[srv@local ~]# lshw|head -n 25
srv@local
    description: System
    product: Super Server (To be filled by O.E.M.)
    vendor: Supermicro
    version: 0123456789
    serial: 0123456789
    width: 64 bits
    capabilities: smbios-3.0 dmi-3.0 smp vsyscall32
    configuration: boot=normal chassis=server family=To be filled by O.E.M. sku=To be filled by O.E.M. uuid=00000000-0000-0000-0000-111111111111
  *-core
       description: Motherboard
       product: X11SSV-M4F
       vendor: Supermicro
       physical id: 0
       version: 1.02
       serial: 112233000044
       slot: To be filled by O.E.M.
     *-firmware
          description: BIOS
          vendor: American Megatrends Inc.
          physical id: 0
          version: 1.0
          date: 10/18/2016
          size: 64KiB
          capacity: 15MiB

And here are the steps to do:

STEP 1) Download the SUM cli – Supermicro Update Manager and unpack it in your server

You could download freely the SUM version 2 from here: https://www.supermicro.com/solutions/SMS_SUM.cfm (this link explains what the tool is used for) at the bottom of the page there is a link to download the SUM – https://www.supermicro.com/SwDownload/UserInfo.aspx?sw=0&cat=SUM Here you should fill the form with your name, company and email address and then you will be redirected to the download page, which at present is like the screenshot below:

main menu
Supermicro Update Manager (SUM)

When downloaded the linux version you would have the following files in the archive file:

[srv@local ~]# cd
[srv@local ~]# tar xzvf sum_2.0.0_Linux_x86_64_20171108.tar.gz
sum_2.0.0_Linux_x86_64/
sum_2.0.0_Linux_x86_64/ReleaseNote.txt
sum_2.0.0_Linux_x86_64/sum
sum_2.0.0_Linux_x86_64/ExternalData/
sum_2.0.0_Linux_x86_64/ExternalData/VENID.txt
sum_2.0.0_Linux_x86_64/ExternalData/SMCIPID.txt
sum_2.0.0_Linux_x86_64/driver/
sum_2.0.0_Linux_x86_64/driver/RHL4_x86_64/
sum_2.0.0_Linux_x86_64/driver/RHL4_x86_64/sum_bios.ko
sum_2.0.0_Linux_x86_64/driver/RHL6_x86_64/
sum_2.0.0_Linux_x86_64/driver/RHL6_x86_64/sum_bios.ko
sum_2.0.0_Linux_x86_64/driver/RHL5_x86_64/
sum_2.0.0_Linux_x86_64/driver/RHL5_x86_64/sum_bios.ko
sum_2.0.0_Linux_x86_64/driver/RHL7_x86_64/
sum_2.0.0_Linux_x86_64/driver/RHL7_x86_64/sum_bios.ko
sum_2.0.0_Linux_x86_64/SUM_UserGuide.pdf

The “sum” file binary is the tool you need.

STEP 2) Download the new motherboard BIOS firmware

, which for our board (X11SSV-M4F – https://www.supermicro.com/products/motherboard/Xeon/C236_C232/X11SSV-M4F.cfm) it was version 1.1 with filename “X11SVMF8_308.zip”, unpack the file under X11SVMF8_308

[srv@local ~]# cd
[srv@local ~]# unzip X11SVMF8_308.zip
Archive:  X11SVMF8_308.zip
   creating: X11SVMF8.308/
  inflating: X11SVMF8.308/AFUDOSU.SMC  
  inflating: X11SVMF8.308/CHOICE.SMC  
  inflating: X11SVMF8.308/FDT.smc    
  inflating: X11SVMF8.308/FLASH.BAT  
  inflating: X11SVMF8.308/Readme for UP X11 AMI  BIOS.txt  
  inflating: X11SVMF8.308/X11SVMF8.308

The file “X11SVMF8.308” is the BIOS firmware of the motherboard. As you can see the prehistoric DOS executable flash utility is still distributed and is supported method of updating.

STEP 3) Update the BIOS

[srv@local ~]# cd /root/sum_2.0.0_Linux_x86_64
[srv@local ~]# ./sum -c UpdateBios --file ../X11SVMF8.308/X11SVMF8.308 
Supermicro Update Manager (for UEFI BIOS) 2.0.0 (2017/11/08) (x86_64)
Copyright©2017 Super Micro Computer, Inc. All rights reserved
Reading BIOS flash ..................... (100%)
Checking BIOS ID ...
Checking ME Firmware ...
Comparing FDT for ROM file and flash.... (100%)

***************************<<<<<CRITICAL WARNING>>>>>***************************

ExitCode                = 254
Description             = Manual steps are required
Program Error Code      = 119.18
Error message:
    FDT is different. Please use system reboot(do not shutdown 
    or poweroff system) command to force ME enter manufacturing mode 
    and run UpdateBIOS command again to update BIOS and ME region.

********************************************************************************
[srv@local ~]# reboot

As you can see we got critical warning! You may not have the critical, but if you do you need to run the command second time to really flash the new BIOS firmware. So here it is, AFTER rebooting your server login again and execute the command again:

[srv@local ~]# cd /root/sum_2.0.0_Linux_x86_64
[srv@local ~]# ./sum -c UpdateBios --file ../X11SVMF8.308/X11SVMF8.308 
Supermicro Update Manager (for UEFI BIOS) 2.0.0 (2017/11/08) (x86_64)
Copyright©2017 Super Micro Computer, Inc. All rights reserved
Reading BIOS flash ..................... (100%)
Checking BIOS ID ...
Programming BIOS and ME (including FDT)
Writing BIOS flash ..................... (100%)
Verifying BIOS flash ................... (100%)
Checking ME Firmware ...
Putting ME data to BIOS ................ (100%)
Writing ME region in BIOS flash ...
 - Update success for FDR
 - Updated Recovery Loader to OPRx
 - Updated FPT, MFSB, FTPR and MFS
 - ME Entire Image done
WARNING:Must power cycle or restart the system for the changes to take effect!
[srv@local ~]# reboot

And there you have it you updated the BIOS of your server successfully. KEEP IN MIND the BIOS settings are reset to Defaults! When you restart the server the second time (if you get the critical warning or the first time if you do not) you should load the optimized defaults and change your settings according your needs. Go to BIOS and load the optimized defaults and change the settings according your needs (or your backup).

[srv@local ~]# lshw|head -n 25
srv@local
    description: System
    product: Super Server (To be filled by O.E.M.)
    vendor: Supermicro
    version: 0123456789
    serial: 0123456789
    width: 64 bits
    capabilities: smbios-3.0 dmi-3.0 smp vsyscall32
    configuration: boot=normal chassis=server family=To be filled by O.E.M. sku=To be filled by O.E.M. uuid=00000000-0000-0000-0000-111111111111
  *-core
       description: Motherboard
       product: X11SSV-M4F
       vendor: Supermicro
       physical id: 0
       version: 1.02
       serial: 112233000044
       slot: To be filled by O.E.M.
     *-firmware
          description: BIOS
          vendor: American Megatrends Inc.
          physical id: 0
          version: 1.1
          date: 03/08/2018
          size: 64KiB
          capacity: 15MiB

* SUM cli – UpdateBios help output

[srv@local ~]# ./sum -h -c UpdateBios
Supermicro Update Manager (for UEFI BIOS) 2.0.0 (2017/11/08) (x86_64)
Copyright©2017 Super Micro Computer, Inc. All rights reserved
Description
    Updates BIOS with the given image file.
Required Arguments
    --file    <file name>
Optional Arguments
    --reboot
          Forces the managed system to reboot or power up after operation.
    --flash_smbios
          Overwrites the SMBIOS data
    --preserve_nv
          Preserves the NVRAM region
    --preserve_mer
          Preserves the ME firmware region
    --preserve_setting
          Preserves setting configurations
Usage Modes
    [OOB] [In-Band] [Multiple systems OOB] 
Node Product Key Required
     No for [In-Band]
    Yes for [OOB]
Examples
OOB
  # ./sum -i 192.168.34.56 -u ADMIN -p ADMIN -c UpdateBios --file BIOS.rom 
    --reboot
In-Band
  # ./sum -c UpdateBios --file BIOS.rom --reboot
Multiple systems OOB
  # ./sum -l IP_ADDR_RANGE.txt -u ADMIN -p ADMIN -c UpdateBios --file BIOS.rom 
    --reboot
Notice
    1. For [OOB] and [Multiple systems OOB] usage modes, before executing this 
    command, it is recommended to shutdown the managed system first.
    2. --preserve_setting option is only supported in Purley and the platforms 
    of later versions. Note that --preserve_setting option for in-band usage 
    requires "SFT-OOB-LIC" product key. The preserved setting configurations 
    will be listed in preserved_settings.log.

* SUM cli generic help output


[srv@local ~]# ./sum 
Supermicro Update Manager (for UEFI BIOS) 2.0.0 (2017/11/08) (x86_64)
Copyright©2017 Super Micro Computer, Inc. All rights reserved

NAME
  sum (Supermicro Update Manager)

SYNOPSIS
  sum [OPTIONs] [COMMAND] [COMMAND ARGUMENTS]

OPTIONS
  -h  Shows help information.
  -v  Displays the verbose output.
  -i  <BMC/CMM IP address or BMC/CMM host name>
  -l  <BMC/CMM system list file name. Refer to the user's guide for formatting>
  -u  <BMC/CMM user ID>
  -p  <BMC/CMM user password>
  -c  <command name> (case insensitive)

USAGE MODES
○  Single System Out-Of-Band (OOB) Management [operates on single BMC/CMM]: 
    Must use -i,-u, -p options
○  Single System In-Band Management [operates on local OS]: Do not use -i, -u 
    and -p options
○  Concurrent Systems OOB Management [operates on multiple system BMCs/CMMs]: 
    Replace -i option with -l option

COMMANDS
Function Group             Command Names

Key Management             ActivateProductKey, QueryProductKey, ClearProductKey
System Checks              CheckOOBSupport, CheckAssetInfo, 
                           CheckSystemUtilization, CheckSensorData
BIOS Management            GetBIOSInfo, UpdateBios, GetDefaultBiosCfg, 
                           GetCurrentBiosCfg, ChangeBiosCfg, 
                           LoadDefaultBiosCfg, GetDmiInfo, ChangeDmiInfo, 
                           EditDmiInfo, SetBiosAction
BMC Management             GetBmcInfo, UpdateBmc, GetBmcCfg, ChangeBmcCfg
System Event Log           GetEventLog, ClearEventLog
CMM Management             GetCmmInfo, UpdateCmm, GetCmmCfg, ChangeCmmCfg
Storage Management         GetRaidControllerInfo, UpdateRaidController, 
                           GetRaidCfg, ChangeRaidCfg, GetSataInfo, GetNvmeInfo
Applications               TpmProvision, MountIsoImage, UnmountIsoImage

COMMAND USAGE
  See help message for each command
  Syntax:"  # ./sum -h -c <command name>"
  Notes: 1)Command support is platform dependent. Please refer to Appendix C in 
         the user's guide for platform dependency hints.
         2)If BMC/CMM user ID or password includes special characters, it has 
         to be quoted.

EXAMPLES
OOB
  # ./sum -i 192.168.34.56 -u ADMIN -p ADMIN -c ChangeBmcCfg --file BmcCfg.txt
  # ./sum -i 192.168.34.56 -u ADMIN -p "&123456" -c ChangeBmcCfg --file 
  BmcCfg.txt
Multiple systems OOB
  # ./sum -l IP_ADDR_RANGE.txt -u ADMIN -p ADMIN -c GetBIOSInfo --file BIOS.rom
  # ./sum -l IP_ADDR_RANGE.txt -u ADMIN -p "&123456" -c GetBIOSInfo --file 
  BIOS.rom
In-Band
  # ./sum -c UpdateBios --file BIOS.rom
Help Message
  # ./sum -h -c UpdateBios

SUPERMICRO IPMI/KVM module tips – reset the unit and the admin password

After the previous howto “SUPERMICRO IPMI to use one of the one interfaces or dedicated LAN port” (in the howto is showed how to install the needed tool for managing the IPMI/KVM unit under console) of setting the network configuration there are a couple of interesting and important tips when working with the IPMI/KVM module. Here are they are:

  1. Reset IPMI/KVM module – sometimes it happen the keyboard or mouse not to work when the Console Redirection is loaded, it is easy to reset the unit from the web interface, but there are case when the web interface is not working – so ssh to your server and try one of the following commands:
    * warm reset – it’s like a reboot, inform the IPMI/KVM to reboot itself.

    ipmitool -I open bmc reset warm
    

    It does not work in all situations! So try a cold reset
    * cold reset – resets the IPMI/KVM, it’s like unplug and plug the power to the unit.

    ipmitool -I open bmc reset cold
    
  2. Reset the configuration of an IPMI/KVM module to factory defaults. It is useful when something goes wrong when upgrading the firmware of the unit and the old configuration is not supported or it says it is, but at the end the unit does not work properly. In rare cases it might help when the KVM (Keyboard, Video, Monitor part aka Console redirection does not work)
    Here is the command for resetting to factory defaults:

    ipmitool -I open raw 0x3c 0x40
    
  3. Reset admin password – reset the password for the administrator login of the IPMI/KVM unit. It’s trivial losing the password so with the help of the local console to the server you can reset the password to a simple one and then change it from the web interface.
    ipmitool -I open user set password 2 ADMIN
    

    The number “2” is the ID of the user, check it with:

    [root@srv0 ~]# ipmitool -I open user list
    ID  Name             Callin  Link Auth  IPMI Msg   Channel Priv Limit
    1                    true    false      false      Unknown (0x00)
    2   ADMIN            true    false      false      Unknown (0x00)
    3                    true    false      false      Unknown (0x00)
    4                    true    false      false      Unknown (0x00)
    5                    true    false      false      Unknown (0x00)
    6                    true    false      false      Unknown (0x00)
    7                    true    false      false      Unknown (0x00)
    8                    true    false      false      Unknown (0x00)
    9                    true    false      false      Unknown (0x00)
    10                   true    false      false      Unknown (0x00)
    

    Sometimes if a hacker got to your IPMI/KVM you could see the user table with the above command. There was a serious bug aka backdoor in some of these units, the ID of the ADMIN user or even the username could be changed, so you should use the list command to list the current user table.
    Use set name to set the username of the user.

    ipmitool -I open user set name 2 ADMIN
    
  4. Set a new network configuration. It’s worth mentioning again the howto for this purpose – “SUPERMICRO IPMI to use one of the one interfaces or dedicated LAN port

All commands using the network option of the ipmitool

ipmitool -I lanplus -H 192.168.7.150 -U ADMIN -P ADMIN bmc reset warm
ipmitool -I lanplus -H 192.168.7.150 -U ADMIN -P ADMIN bmc reset cold
ipmitool -I lanplus -H 192.168.7.150 -U ADMIN -P ADMIN raw 0x3c 0x40
ipmitool -I lanplus -H 192.168.7.150 -U ADMIN -P ADMIN user set password 2 ADMIN
ipmitool -I lanplus -H 192.168.7.150 -U ADMIN -P ADMIN user list

The IP 192.168.7.150 is the IP of your IPMI/KVM module, which you want to change with the above commands.

Tunneling the IPMI/KVM ports over ssh (supermicro ipmi ports)

The best security for the remote management unit in your server such as IPMI/KVM is to have local IP. All IPMI/KVM IP should be switched to a separated switch and a local sub-network used for the LAN Settings. So to be able to connect to the IPMI/KVM module you need a VPN connection to gain access to the local sub-network used for your servers’ management modules. However, sometimes the VPN cannot be used or it just happened the server is down, or you are at a place restricting unknown ports (or ports above 1024), which your VPN uses (that’s why the VPN server should use only one port from the most popular – 80, 443, but that’s a thing for another howto…) and so on. So you end with no ability to connect to the VPN server or you think you do not need at all a VPN server, because you always could use

openssh

to do the trick of tunneling ports from your computer to the IPMI/KVM module of your server through a server, which has an access to the local sub-network of the IPMI/KVM modules.

So here is what you need to get to the remote management of your server just using ssh for tunneling:

STEP 1) A server, which has access to the IP network of the IPMI/KVM modules.

Let’s say you set to all your servers’ IPMI/KVM modules IPs from network 192.168.7.0/24, so your server must have an IP from 192.168.7.0/24, for example 192.168.7.1, add it as an alias or to a dedicated LAN connected to the switch, in which of all your IPMI/KVM modules are plugged in. This server will be used as a transfer point to a selected IPMI/KVM IP.

STEP 2) Tunnel local selected ports using ssh to the server from STEP 1)

Use this command:

ssh -N -L 127.0.0.1:80:[IPMI-IP]:80 -L 127.0.0.1:443:[IPMI-IP]:443 -L 127.0.0.1:5900:[IPMI-IP]:5900 -L 127.0.0.1:623:[IPMI-IP]:623 root@[SERVER-IP]

For example using 192.168.7.150 for an IPMI/KVM IP:

[root@srv0 ~]# ssh -N -L 127.0.0.1:80:192.168.7.150:80 -L 127.0.0.1:443:192.168.7.150:443 -L 127.0.0.1:5900:192.168.7.150:5900 -L 127.0.0.1:623:192.168.7.150:623 root@example-server.com

With the above command you can use the web interface (https://127.0.0.1/, you could replace 127.0.0.1 with a local IP or a local IP alias of your machine), the java web start “Console Redirection” (the KVM – Keyboard, Video and Mouse) and you can mount Virtual Media from your computer to your server’s virtual CD/DVD device. Unfortunately to use properly the Virtual CD/DVD you must tunnel the UDP on port 623 (not only TCP 623), which is a little bit tricky. To tunnel the UDP packets

socat – Multipurpose relay (SOcket CAT)

program must be used.

STEP 3) Tunnel local selected ports using ssh to the server from STEP 1) and UDP port using socat

[root@srv0 ~]# socat -T15 udp4-recvfrom:623,reuseaddr,fork tcp:localhost:8000
[root@srv0 ~]# ssh -L8000:localhost:8000 -L 127.0.0.1:80:192.168.7.150:80 -L 127.0.0.1:443:192.168.7.150:443 -L 127.0.0.1:5900:192.168.7.150:5900 -L 127.0.0.1:623:192.168.7.150:623 root@example-server.com socat tcp4-listen:8000,reuseaddr,fork UDP:192.168.7.150:623

This will start a UDP listening socket on localhost port 8000. Every packet will be relayed using TCP to localhost 8000, which will be tunneled using ssh command to the remote server, where there is a started another socat listening TCP socket on port 8000, which will relay every packet to the UDP port 623 of IP 192.168.7.150. Replace the IP 192.168.7.150 with your IPMI/KVM IP.

* Here are the required ports for SUPERMICRO IPMI functionality in X9 and X10 motherboards

  • X9-motherboards, the ports are

    TCP Ports
    HTTP: 80
    HTTPS: 443
    SSH: 22
    WSMAN: 5985
    Video: 5901
    KVM: 5900
    CD/USB: 5120
    Floppy: 5123
    Virtual Media: 623
    SNMP: 161

    UDP ports:
    IPMI: 623

  • For X10-motherboards, the ports are

    TCP Ports
    HTTP: 80
    HTTPS: 443
    SSH: 22
    WSMAN: 5985
    Video: 5901
    KVM: 5900 , 3520
    CD/USB: 5120
    Floppy: 5123
    Virtual Media: 623
    SNMP: 161

    UDP ports:
    IPMI: 623

You could add the required port to the ssh command above if you need it!

Virtual Device mounted successfully

Successful mount in Console Redirection with Virtual Media:

main menu
Virtual Storage

if you are logged in the server and mount an ISO with the Virtual Device you’ll probably have this in “dmesg”:

[46683751.661063] usb 2-1.3.2: new high-speed USB device number 8 using ehci-pci
[46683751.795048] usb 2-1.3.2: New USB device found, idVendor=0ea0, idProduct=1111
[46683751.795051] usb 2-1.3.2: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[46683751.795365] usb-storage 2-1.3.2:1.0: USB Mass Storage device detected
[46683751.795553] scsi6 : usb-storage 2-1.3.2:1.0
[46683752.795730] scsi 6:0:0:0: CD-ROM            ATEN     Virtual CDROM    YS0J PQ: 0 ANSI: 0 CCS
[46683752.806839] sr0: scsi3-mmc drive: 40x/40x cd/rw xa/form2 cdda tray
[46683752.806842] cdrom: Uniform CD-ROM driver Revision: 3.20
[46683752.806933] sr 6:0:0:0: Attached scsi CD-ROM sr0
[46683752.806971] sr 6:0:0:0: Attached scsi generic sg1 type 5

SUPERMICRO IPMI to use one of the LAN interfaces or dedicated LAN port

If you happen to have a Supermicro server and you want to change the default behavior of the IPMI LAN interface, which is

Failover – on boot check whether the dedicated LAN port is connected if so use the it, otherwise use the shared LAN1

So if change it there are some magic commands to change this default behavior:

  • Always use dedicated LAN:
    within the server under console:

    ipmitool -I open raw 0x30 0x70 0x0c 1 0
    

    from remote using the network:

    ipmitool -I lanplus -H 192.168.7.150 -U ADMIN -P ADMIN raw 0x30 0x70 0x0c 1 0
    

    Sometimes the output of the last command (that using the lanplus) will output:

    Unable to send RAW command (channel=0x0 netfn=0x30 lun=0x0 cmd=0x70)
    

    But it sets the value despite the error output “Unable to send”. You could check it with the read command (the last example).

  • Always use shared LAN1:
    within the server under console:

    ipmitool -I open raw 0x30 0x70 0xc 1 1 
    

    from remote using the network:

    ipmitool -I lanplus -H 192.168.7.150 -U ADMIN -P ADMIN raw 0x30 0x70 0x0c 1 1
    

    Sometimes the output of the last command (that using the lanplus) will output:

    Unable to send RAW command (channel=0x0 netfn=0x30 lun=0x0 cmd=0x70)
    

    But it sets the value despite the error output “Unable to send”. You could check it with the read command (the last example).

  • Always use failover (factory default):
    within the server under console:

    ipmitool -I open raw 0x30 0x70 0xc 1 2
    

    from remote using the network:

    ipmitool -I lanplus -H 192.168.7.150 -U ADMIN -P ADMIN raw 0x30 0x70 0x0c 1 2
    
  • Sometimes the output of the last command (that using the lanplus) will output:

    Unable to send RAW command (channel=0x0 netfn=0x30 lun=0x0 cmd=0x70)
    

    But it sets the value despite the error output “Unable to send”. You could check it with the read command (the last example).

Get the current value with:

[root@srv0 ~]# ipmitool -I open raw 0x30 0x70 0x0c 0
 02
[root@srv0 ~]#

Default (failover): you will see 02
Onboard LAN: you will see 01
Dedicated LAN: you will see 00

The 192.168.7.157 is the IP of the IPMI KVM module and the -U ADMIN and -P ADMIN are username and the password login details to the module (ADMIN/ADMIN are just default settings for the Supermicro IPMI/KVM)

* Here you can set the LAN IP configuration – “Set IP to the IPMI/KVM server module with ipmitool