how to get bmc console from SOL?

[pzh2386034]

Hi, all. the default console is /dev/ttyVUART0, which we can get host console from it.
i want to swich to bmc console, so i want to use /dev/ttyS3 as input. And uart route uart5 to uart4.
but run obmc-console-server --config /etc/obmc-console.conf ttyS3 , and run obmc-console-client as client, no message come out, when i input something, uart4 and uart5 will generate interrupts.

does any one konw how to slove?
Thanks!

[amboar]

Okay, there's a lot going on here. Let's try to unpack it.

i want to swich to bmc console, so i want to use /dev/ttyS3 as input. And uart route uart5 to uart4.

First, generally it's not obvious what /dev/ttyS3 maps to just from the name (the device node to device mapping isn't reliable unless you set aliases in the devicetree). It would be helpful if we start with talking in terms of the UART numbers as documented in the datasheet, (e.g. UART4 and and UART5 as you have here) and work our way up to how you should configure the software once we've got the routing sorted out.

Second, I suspect you're talking about the hardware UART routing function. Is this the case? obmc-console is a way to do the routing in software, so combining the two can be confusing.

no message come out, when i input something, uart4 and uart5 will generate interrupts.

This comes back to the point about what hardware ttyS3 maps to. There might be better ways to tell, but one thing you can do is look in sysfs:

root@bmc:~# ls -l /sys/bus/platform/devices/*.serial/tty/
/sys/bus/platform/devices/1e784000.serial/tty/:
drwxr-xr-x    3 root     root             0 Apr 28 07:52 ttyS4

/sys/bus/platform/devices/1e787000.serial/tty/:
drwxr-xr-x    3 root     root             0 Apr 28 07:52 ttyS5

/sys/bus/platform/devices/1e788000.serial/tty/:
drwxr-xr-x    3 root     root             0 Apr 28 07:52 ttyS0

From there we can figure out what's what and how you might need to configure your system.

[pzh2386034]

i use aspeed 2500 as the bmc chip, and tty* info as below

root@bmc:~# ls -l /sys/bus/platform/devices/*.serial/tty/
/sys/bus/platform/devices/1e783000.serial/tty/:
drwxr-xr-x 2 root root 0 Jan 1 00:00 ttyS0

/sys/bus/platform/devices/1e784000.serial/tty/:
drwxr-xr-x 2 root root 0 Jan 1 00:00 ttyS4

/sys/bus/platform/devices/1e787000.serial/tty/:
drwxr-xr-x 2 root root 0 Jan 1 00:00 ttyS5

/sys/bus/platform/devices/1e78e000.serial/tty/:
drwxr-xr-x 2 root root 0 Jan 1 00:00 ttyS2

/sys/bus/platform/devices/1e78f000.serial/tty/:
drwxr-xr-x 2 root root 0 Jan 1 00:00 ttyS3

[pzh2386034]

and my detail operator as below:

1. route UART5 to IO4, route IO4 to UART4, route UART4 to UART5;
   root@bmc:~# devmem 0x1e78909c 64 0x80000200

2. stop the default obmc-console-server
   root@bmc:~# systemctl stop obmc-console@ttyVUART0.service

3. start obmc-console-server
   root@bmc:~# /usr/bin/env obmc-console-server --config /etc/obmc-console.conf ttyS3
   

4. start obmc-console-client to test; display nothing, but when i input something, ttyS3 and ttyS4 will generator interrupts
   

36 is the interrupt num of ttyS3

[amboar]

Oh! I think one of your issues is that by playing with the routing, you can only Tx to UART5, you can't Rx from it.

I exploited this to get an in-band console going from the host to the BMC here:

https://www.youtube.com/watch?v=QCVjzcKq5Pw&t=1440s

The implementation for that demo lives here:

https://github.com/amboar/cve-2019-6260/blob/master/cmd/console.c

Basically, the hardware makes it impossible to do what you're wanting to achieve.

But that said, why not just log in via ssh? is that not a feasible solution?

[amboar]

That said, I guess there's nothing stopping you from e.g. launching a getty on UART3 on the BMC, routing UART3 to UART4, then starting obmc-console-server on UART4 because no other UART has the routing restriction that UART5 has.

[amboar]

@pzh2386034 is there anything further here?

[pzh2386034]

but, aspeed 2500 default bmc console is uart5, if I launching a Getty on uart3, it can be work?
I will have a try

[mdmillerii]

It will give you login but not printk output.

Unless you change console= but that is not advised, as printk output preempts all userspace that would capture the output for Sol and the fifo is only 16 characters.

[amboar]

I can't see why you'd want on-going printk coming out through obmc-console. Obviously it can't provide you printk output during boot because it's not running. And if you're trying to capture kernel crashes or weirdness there's no guarantee that obmc-console is going to provide it to you depending on how the kernel crashes. If it's just log messages you're after then you can use journalctl or dmesg, either of which can also be viewed over an ssh session without UART gymnastics.

So I guess what I'm trying to say is I don't understand the use-case, and doing what's requested is not possible with UART5.

[pzh2386034]

Oh! I think one of your issues is that by playing with the routing, you can only Tx to UART5, you can't Rx from it.

I exploited this to get an in-band console going from the host to the BMC here:

https://www.youtube.com/watch?v=QCVjzcKq5Pw&t=1440s

The implementation for that demo lives here:

https://github.com/amboar/cve-2019-6260/blob/master/cmd/console.c

Basically, the hardware makes it impossible to do what you're wanting to achieve.

But that said, why not just log in via ssh? is that not a feasible solution?

yes, Tx is ok, rx no use.
./doit console HOST_UART BMC_UART BAUD USER PASSWORD. is the function which I want. but doit is not integrated in linux; so I cannot run it in standard linux.
if it can be interact with bmc through sol, then I can use it through ipmi, which is in most standard linux.

[pzh2386034]

I have try "launching a getty on UART3 on the BMC, routing UART3 to UART4, then starting obmc-console-server on UART4", below is the step:

1. stop serial-getty@ttyS4.service
   root@bmc:~# systemctl stop serial-getty@ttyS4.service

2. start serial-getty@ttyS2.service
   root@bmc:~# systemctl start serial-getty@ttyS2.service

3. route UART3 to IO4, route IO4 to UART4, route UART4 to UART3;
   root@bmc:~# devmem 0x1e78909c 64 0x1000800

4. stop the default obmc-console-server

5. start obmc-console-server on ttyS2
   root@bmc:~# /usr/bin/env obmc-console-server --config /etc/obmc-console.conf ttyS2

6. start obmc-console-client to test
   can not see any thing, tx, rx both disable

[mdmillerii]

lets rewind. What is your use case?

If you are just trying to access the bmc from the host, then using the serial mux makes sense.

If you are trying to reach a shell on the bmc from across the network, then a direct ssh connection is more appropriate.

If you want to observe printk output from the kernel on another host, then a direct network console is probably the most reliable choice (where udp packets are sent out to a preferably local receiver), but does require some more specialized recording. Alternatively the system logs can be sent across from userspace, either as syslog or systemd-journald specific transport.

If you want a sharable session that can be recorded then a using this server might make sense, but it would be simpler to setup a session over a pty master/slave vs using the serial mux (although I haven't proven this).

[joseph-reynolds]

I have been (very slowly) working on this, tracked here: ibm-openbmc/dev#2243

[xiaoxinm]

And uart route uart5 to uart4.

may I ask a question about uart-routing？
for what you route UART5 to IO4, route IO4 to UART4, route UART4 to UART5 rather than route UART4 to UART5 & route UART5 to UART4.
thx so much