Broadcom ASF Firmware v6.26 Installation/Configuration Instructions
-------------------------------------------------------------------

$Archive: /Source/BCM5700/asf/firmware/575x/Generic/readme.txt $
$Revision: 7 $
$Date: 3/31/05 1:14p $
$Author: Swindell $

This version of the ASF firmware uses a new packaging method that
requires b57diag version 7.20 (or later) to update the ASF firmware
in the adapter's NVRAM (using the "seprg -a" command).

This version of the ASF firmware requires b57diag version 7.13 (or later)
to configure the ASF configuration table (version 6) in the adapter's NVRAM.

Version 6 of the ASF firmware adds support for the ASF 2.0 specification.

This firmware only supports the following devices: BCM5750, 5751, 5752, 5753
and 5721, and only in LOM configurations. This firmware will run on a NIC
device, but some of the functionality will be absent, primarily due to the
controller losing power (and the shared memory being cleared) during a reset.


Background
----------
The ASF (Alert Standard Format) defines methods for remote management and
control of systems in OS-absent environments.

The Remote Management and Control Protocol (RMCP) defined as part of ASF 1.0
provided no security mechanisms to protect systems (managed clients) from
unauthorized remote management. A managed client listens for RMCP packets on
UDP port 26Fh (623).

ASF 2.0 introduced the RMCP Security-Extensions Protocol (RSP) to provide
authentication and integrity services for remote management. The secure RMCP
protocol defined in ASF 2.0 listens for secure RMCP packets on UDP port 298h
(664).


About ASF 2.0
-------------
There are 2 supported authenticated "session" types for ASF 2.0 remote
management: Operator and Administrator. The implication is that authenticated
Administrators may have more "rights" than authenticated Operators, but that
determination is actually made by the individual that configures the Security
Policy of the managed client (NIC). It's actually possible for an
Administrator to have fewer rights than an Operator, if the Security Policy
is configured as such.

Most RMCP messages can be sent to an ASF 2.0 managed client using a
"Bypass Session" which provides no authentication or integrity. However, the
potentially destructive RMCP commands (e.g. Reset, PowerDown, etc.) require
an authenticated session with the proper "rights" to send these commands.


You Will Need
-------------
ASF testing requires a minimum of two computers:

1. A managed client with an ASF-enabled Broadcom Ethernet adapter (only LOM
   controllers are officially supported by the ASF firmware). This PC should
   be tested in both OS-present and OS-absent states.

2. A management console with any Ethernet NIC, running ASF Management Console
   software (presumably on Windows).


Software You will need
-------------------
1. A version of b57diag built with Secure ASF support.
   You can verify this version by the existence of the "asfcfg" option after
   running b57diag with both the "-b57eng" and "-asfeng" options:

        ASF 2.0 (Secure RMCP)

2. ASF firmware v6.xx.

3. ASF Management Console (replacement for ASF NetMon), AsfMgmtCon.exe.
   To verify the receipt of PET packets, this application requires Windows
   SNMP Services be installed and running.

4. An ASF configuration application (i.e. ASFConfig.exe, ASFSCfg.exe/asfscfg)
   installed on the managed client.

5. The Broadcom ASF IP Monitor service (aka ASFIpMon) installed on the 
   managed client.


Installation
------------
Program the ASF firmware with the b57diag "seprg -a<filename>" command.
Example: "seprg -aa25721c6.26"


Manual Configuration
--------------------
Run "b57diag -shasta -b57eng -asfeng" on the managed client and use the 
"asfcfg" command to:

1. Set the NIC (client) IP address and the IP address of the management
   console.

2. Enable the RMCP, PET, and Heartbeat options.

3. Enable ASF 2.0 (Secure RMCP), set the Keys to the desired secret
   (password) strings. You can have different Keys for operators and
   administrators (the equivalent of different passwords), but both
   session types use the same Generation Key.

4. Set the Operator and Administrator Rights values to the desired bit mask
   (0x0-0xf), allowing any combination of the following commands to be sent
   from an authenticated management console: PowerUp, Reset, ResetPower,
   PowerDown. These values determine the Security Policy for the managed
   client.

5. Enable ASF in option 24 of the b57diag "secfg" command menu, or use the
   "setasf -e" command to enable this option more easily.

6. Reset the controller to execute the ASF firmware.


Automatic Configuration
-----------------------
The preferred/official method of ASF configuration is to use an ASF
Configuration program which will import the system's ASF! description table
(using the ACPI System Description Table architecture). The system's IP
address will be configured automatically by the ASF IP Monitor service. Other
parameters like the management console IP address and security-related
parameters must still be configured manually (using either b57diag or one of
the ASF configuration applications).

See the documentation for ASFIpMon (Windows or Linux), ASFConfig (Windows
only), or ASFSilentConfig (Windows or Linux) for more details.


Operation
---------
Run AsfMgmtCon on the managment console. Check the "Secure Management"
checkbox if you wish to use/test secure management operation.

Under the "Security" tab, select a "User Role" (Administrator or Operator)
and set the Key values to match the corresponding Key values configured on
the managed client.

You should now be able to click the "Authenticate" button (on either the
"Manage" or "Security" tabs) to authenticate the management console with the
managed client. The "End Session" button should become active on the 
"Security" tab indicating you have been successfully authenticated. If the 
authentication fails, you can check the log output in the "Manage" tab for 
detailed dumps of the authentication packet exchange. Error messages are
prefixed with exclamation marks ('!').

After successful authentication, you should be able to "Ping" the managed
client and send remote control commands (i.e. Reset, PowerUp, PowerDown, 
PowerReset) using the "Send" button or the convenient tool bar buttons on
on the "Manage" tab. The effect of the remote control commands depends on the
ASF compatibility of the managed client platform and the SMBus configuration.

All other RMCP commands (e.g. Ping, Capabilities Request, System State
Request) may be sent without prior authentication. If the "Secure Management"
checkbox is not checked on the "Manage" tab, AsfMgmtCon will operate in ASF
1.0 compatibility mode.

/* End-of-file */                                                                       
