OpenBMC

OpenBMC
Name	OpenBMC
Developer	Linux Foundation, IBM, Google, Facebook, Microsoft, Intel
Released	2015
Programming language	C, Python, Shell
Operating system	Linux
License	Apache License 2.0

OpenBMC is an open-source project producing a Linux distribution and software stack for Baseboard Management Controllers used in datacenter servers and embedded systems. It provides firmware, system services, and management interfaces to perform out-of-band platform management tasks such as power control, sensor monitoring, firmware update, and hardware inventory. The project is driven by a consortium of major technology companies and integrates components from established projects in the Linux kernel and OpenEmbedded ecosystems.

History

OpenBMC originated in corporate firmware initiatives and was publicly launched in 2015 with contributions from multiple companies including Facebook, Google, IBM, Intel, Microsoft, and ARM. Early development built on experience from vendor-specific projects at Dell EMC, HPE, Lenovo, and research at Rutgers University. The project aligned with governance models used by the Linux Foundation and mirrored collaboration patterns from projects such as Yocto Project, OpenWrt, U-Boot, and systemd efforts. Over time, OpenBMC absorbed lessons from proprietary firmware stacks produced by Supermicro, Quanta Computer, and Foxconn while interoperating with datacenter orchestration platforms like Kubernetes, OpenStack, Ansible, and Nagios.

Architecture

OpenBMC implements a modular architecture centered on a Linux userspace and a kernel often based on the Linux kernel stable trees. It leverages D-Bus for inter-process communication and integrates with init systems such as systemd for service management. The build system commonly uses Yocto Project and OpenEmbedded to produce reproducible images, while bootloaders like U-Boot initialize hardware. OpenBMC exposes management APIs over protocols including HTTP, HTTPS, Redfish, IPMI, and SNMP, enabling integration with BMC ecosystems from Dell Technologies, HPE, and Lenovo. Hardware abstraction layers interface with microcontrollers and peripherals via buses such as I²C, SPI, PCI Express, and GPIO controllers found in SoCs from Intel, AMD, Broadcom, Marvell, and NVIDIA.

Features

OpenBMC provides telemetry and control features including sensor telemetry, power sequencing, firmware update mechanisms, and system event logging compatible with standards like DMTF's Redfish standard and the IPMI specification. It supports over-the-air firmware updates, secure boot integration with Trusted Platform Module (TPM) chips, hardware inventory reporting, watchdog timers, and chassis control. Management interfaces include RESTful APIs, web UIs, and command-line utilities that can interoperate with orchestration and monitoring tools such as Prometheus, Grafana, Zabbix, and Splunk. The stack supports scripting and automation via interfaces compatible with Python, Bash, and configuration management systems like Puppet and Chef.

Supported hardware and deployments

OpenBMC runs on a range of Baseboard Management Controller platforms and SoCs from suppliers like Aspeed Technology, Nuvoton Technology, Broadcom, Marvell Technology Group, and Renesas Electronics. It is deployed in server chassis produced by manufacturers such as Quanta Computer, Supermicro, Wiwynn, Tyan, and Inventec. Cloud providers and hyperscalers including Meta (formerly Facebook), Google, and Microsoft have used OpenBMC in production designs and testbeds. High-performance computing centers and research institutions such as Lawrence Livermore National Laboratory, Oak Ridge National Laboratory, and universities like Stanford University and Massachusetts Institute of Technology have evaluated or adopted OpenBMC for cluster management.

Development and governance

OpenBMC is hosted under collaboration models inspired by the Linux Foundation and includes corporate contributors like IBM Research, Google LLC, Facebook, Inc., Intel Corporation, and Microsoft Corporation. Development uses distributed version control with workflows similar to projects like Kernel.org and GitHub, employing continuous integration systems akin to Jenkins and GitLab CI. The project organizes technical meetings, working groups, and spec reviews, drawing governance parallels to OpenStack Foundation and Apache Software Foundation models. Contributors follow licensing and contribution policies consistent with the Apache License and community norms established by Linux Foundation-backed projects such as Zephyr Project.

Security and vulnerabilities

OpenBMC integrates security controls including secure boot chains, signed firmware images, TPM-based attestation, and role-based access control for management APIs. It has had coordinated vulnerability disclosures handled through vendor and CERT channels like US-CERT and security mailing lists similar to OSS-Security. Public advisories have referenced CVE identifiers tracked by organizations such as Mitre Corporation and databases like NVD. Security hardening intersects with standards and tools from Common Criteria evaluations, SELinux policies, and cryptographic libraries like OpenSSL and mbed TLS.

Adoption and use cases

Adoption spans hyperscale datacenters, telco facilities, edge computing sites, and HPC clusters. Use cases include remote power cycling for blade servers used by Amazon Web Services, remote firmware provisioning for nodes in OpenStack clouds, hardware telemetry feeding observability stacks used by Netflix, and lifecycle management in orchestration environments operated by Equinix. OpenBMC enables integration with asset management and automation platforms from vendors such as Red Hat, Canonical, SUSE, and ecosystem tools like Terraform and SaltStack.

Category:Open source software