BIOS/BMC pre-flash and firmware programming service

主板用的是哪颗BMC芯片？ASPEED AST2600、AST2500、海思Hi1711、还是飞腾腾珑E2000？请说明具体型号，我方需评估出口合规。

Which BMC chip is on the board — ASPEED AST2600, AST2500, HiSilicon Hi1711, or Phytium Tenglong E2000? State the exact part; we need it for export-control assessment.

HiSilicon and Phytium are Entity-Listed; this changes re-export options.

BMC支持哪些接口：Redfish（哪个schema版本）、IPMI 2.0、SNMP、HTML5 KVM、虚拟媒体、SOL、NVMe-MI？是否可禁用IPMI只保留Redfish？

Which BMC interfaces are exposed — Redfish (which schema version), IPMI 2.0, SNMP, HTML5 KVM, virtual media, SOL, NVMe-MI? Can IPMI be disabled leaving Redfish only?

Redfish support is often claimed but partial; ask for the schema version.

BIOS、BMC、CPLD、网卡和RAID卡的固件更新由谁发布？贵司自己发布还是转发上游？有没有下载入口或FTP？承诺提供更新到哪一年？有安全漏洞时多久出补丁？

Who publishes firmware updates for BIOS, BMC, CPLD, NIC and RAID — your company, or do you just forward the upstream vendor's files? Is there a download portal or FTP? Until which year do you commit to updates? What is the patch turnaround for a security vulnerability?

The core whitebox risk: firmware with no owner after shipment.

出货时BIOS/BMC/CPLD/网卡固件分别是哪个版本？能否所有机器统一到同一基线，并按序列号提供一份版本清单（CSV）？

What BIOS/BMC/CPLD/NIC firmware versions ship? Can every unit be aligned to one baseline, and can you supply a per-serial version list as CSV?

Mixed firmware across a rack is a fleet-management tax forever.

固件是否强制厂商签名？我方能否刷写自编译的OpenBMC或自有BIOS？Secure Boot的密钥（PK/KEK）能否由我方替换？是否提供源码或工具链？

Is firmware locked to vendor signing? Can we flash our own OpenBMC build or our own BIOS? Can we replace the Secure Boot keys (PK/KEK)? Is source or a toolchain provided?

Vendor-locked firmware turns a whitebox into a black box.

BMC是独立千兆管理网口，还是通过NC-SI与业务网口共享？能否完全禁用共享模式、只走独立口？BMC网口是否支持VLAN标记？失效时是否会自动切换到共享口（这在安全上是否可关闭）？

Does the BMC have a dedicated 1G management port, or does it share a production NIC over NC-SI? Can shared mode be fully disabled so management traffic only uses the dedicated port? Does the BMC port support VLAN tagging? Does it fail over to the shared port, and can that failover be turned off?

Shared-LOM-only means your management plane rides the production network — an architecture decision that cannot be fixed after delivery.

BMC出厂密码是每台唯一（印在机身标签或随资产文件提供）还是全批统一？如果唯一，能否随资产清单以CSV形式提供序列号与初始密码的对应关系？首次登录是否强制改密？

Is the factory BMC password unique per unit (printed on a label or supplied in the asset file), or shared across the batch? If unique, can the serial-to-initial-password mapping be delivered as CSV with the asset file? Is a password change forced at first login?

A shared BMC password across 400 machines is a single point of total compromise, and discovering it after delivery costs a manual walk of the whole fleet.

主板是否有独立的硬件信任根/固件防护芯片（PFR类CPLD或AST1060等）？覆盖BIOS、BMC、CPLD哪几块Flash？固件被篡改时能否自动检测并回滚到黄金镜像？还是仅靠BMC自身签名校验？

Does the board carry a separate hardware root-of-trust / firmware-resilience device (a PFR-class CPLD or AST1060-class part)? Which flash devices does it cover — BIOS, BMC, CPLD? Can it detect tampering and auto-recover to a golden image, or is protection limited to the BMC verifying its own signature?

Most low-cost whitebox boards have none. The answer is binary and cannot be retrofitted.

Redfish具体支持到什么程度？1) schema版本号；2) 是否支持UpdateService/SimpleUpdate远程刷固件；3) 是否支持TelemetryService；4) 是否支持SessionService与证书替换；5) 能否提供一份实际设备的/redfish/v1完整输出样例？

How deep is Redfish support? (1) schema version; (2) is UpdateService/SimpleUpdate supported for remote firmware flashing; (3) is TelemetryService supported; (4) SessionService and certificate replacement; (5) can you send a full /redfish/v1 tree dump from a real unit?

'Redfish supported' is claimed almost universally and usually means a read-only subset. The tree dump settles it in one attachment.

IPMI是否默认禁用Cipher Suite 0（空认证）？是否存在匿名/空用户名账号？能否整体禁用IPMI只保留Redfish且仍可远程开关机？

Is IPMI Cipher Suite 0 (null authentication) disabled by default? Are there anonymous or blank-username accounts? Can IPMI be disabled entirely, leaving Redfish only, while still supporting remote power control?

Cipher suite 0 left enabled is a documented, trivially exploitable remote root path, and it is a factory-default question, not a configuration question.

BMC/SoC的安全启动OTP熔丝在出厂时是否已经烧录厂商公钥？如果已烧录，是否可以改烧我方公钥？这是不可逆操作——请明确回答「已烧录厂商密钥、不可更改」或「未烧录、可由买方烧录」。

Are the BMC/SoC secure-boot OTP fuses already burned with the vendor's public key at the factory? If so, can they be re-burned with ours? This is irreversible — answer explicitly either 'burned to vendor key, not changeable' or 'unburned, buyer may provision'.

The report asks whether firmware is 'locked to vendor signing'. The physical answer lives in one-time-programmable fuses; once burned, no contract clause can unlock it.