BMC/OpenBmc/bmcweb.git/config, branch master

Allow setting Mozilla modern

2026-07-02T18:30:22+00:00

Mozilla publishes recommendations for TLS cipher suites to support. For many years bmcweb selected "intermediate" because of compatibility with clients that didn't yet support TLS1.3. This commit adds the ability to use the Mozilla modern recommendations, and disable TLS1.2 support through a new meson option, tls-profile. Tested: Loaded on qemu, and verified with testssl.sh[1] that parameters were applied. [1] https://github.com/testssl/testssl.sh Change-Id: I38e915b3943b5dbe5fb31e54eb3ebda9bbaeb811 Signed-off-by: Ed Tanous

fix systemd unit description

2026-03-27T14:00:16+00:00

Observed following problem: ``` Mar 27 13:10:04 s5549-bmc-a0423f63b4a5 systemd[1]: Stopping Start bmcweb server... Mar 27 13:10:04 s5549-bmc-a0423f63b4a5 systemd[1]: bmcweb.service: Deactivated successfully. Mar 27 13:10:04 s5549-bmc-a0423f63b4a5 systemd[1]: Stopped Start bmcweb server. Mar 27 13:10:04 s5549-bmc-a0423f63b4a5 systemd[1]: bmcweb.service: Consumed 1.946s CPU time. Mar 27 13:10:04 s5549-bmc-a0423f63b4a5 systemd[1]: Started Start bmcweb server. ``` The description is wrong and logs do not form properly. Fix the unit description as per systemd docs [1] Tested: on Tyan S5549 ``` Mar 27 13:56:36 s5549-bmc-a0423f63b4a5 systemd[1]: Stopping bmcweb server... Mar 27 13:56:36 s5549-bmc-a0423f63b4a5 systemd[1]: bmcweb.service: Deactivated successfully. Mar 27 13:56:36 s5549-bmc-a0423f63b4a5 systemd[1]: Stopped bmcweb server. Mar 27 13:56:36 s5549-bmc-a0423f63b4a5 systemd[1]: bmcweb.service: Consumed 1.017s CPU time. Mar 27 13:56:36 s5549-bmc-a0423f63b4a5 systemd[1]: Started bmcweb server. ``` References: [1] https://www.freedesktop.org/software/systemd/man/latest/systemd.unit.html#%5BUnit%5D%20Section%20Options Fixes: 5a7094b22c9b ("Add systemd unit files") Change-Id: Ia363b15a4e4de6b825473f8761adbdaedd5ca95c Signed-off-by: Alexander Hansen

Fix socket startup when mode is http

2026-03-10T21:43:17+00:00

When starting up in http mode, the socket needs to be of type http to allow the flow to work correctly. As is, enabling insecure-disable-ssl results in a non functional api due to hardcoded https. Teted: enabled insecure-disable-ssl; Verify that curl to http port 80 works Change-Id: I2958d6f39b642a02b6ce5f1c69d1da409dafc70d Signed-off-by: Ed Tanous

Sensors: Convert fan_tach sensors to Percent

2026-02-05T20:17:04+00:00

Redfish 2025.3 clarified the reporting of fan sensors should always be as ReadingType Percent to address issue #6197. [1] The fan_tach sensors on D-Bus are Rotational sensors. Conversion is necessary for these sensor values to reflect Percent instead. [2] This is reflected in a published mockup. [3] The Redfish update includes an additional sentence for the ReadingType description: ``` "... Services should represent fan speed and pump speed sensors with the `ReadingType` value `Percent`." ``` The ReadingRangeMax and ReadingRangeMin properties also must be converted to percent basis as they are defined to reflect the range of the Reading property. ``` curl -s https://redfish.dmtf.org/schemas/v1/Sensor.v1_11_1.json | jq .definitions.Sensor.properties.ReadingRangeMax.longDescription "This property shall indicate the maximum possible value of the `Reading` property for this sensor. This value is the range of valid readings for this sensor. Values outside this range are discarded as reading errors." ``` A new compile option, redfish-allow-rotational-fans, will maintain the old behavior of reporting fan_tach sensors as Rotational. When the option is disabled they will be reported as Percent. This will allow time for distributions to make adjustments to handle Percent reported fan sensors. The SpeedRPM Redfish property contains the RPM value for these sensors whether this option is enabled or disabled. Clients wanting to use the RPM value should convert to use the SpeedRPM property instead of the Reading property. ``` curl -s https://redfish.dmtf.org/schemas/v1/Sensor.v1_11_1.json | jq .definitions.Sensor.properties.SpeedRPM { "description": "The rotational speed.", "excerpt": "SensorFan,SensorFanArray,SensorPump", "longDescription": "This property shall contain a reading of the rotational speed of the device in revolutions per minute (RPM) units.", "readonly": true, "type": [ "number", "null" ], "units": "{rev}/min", "versionAdded": "v1_2_0" } ``` With the compile option disabled the following differences will be reflected in the responses for /redfish/v1/Chassis/chassis/Sensors/{}: - ReadingRangeMax/ReadingRangeMin: Converted to percent range, (100,0) - ReadingType: "Percent" - ReadingUnits: "%" - Reading: Computed percent value. The computation is the percent of the RPM Value within the MaxValue to MinValue range as reported by D-Bus for the sensor. - Note: If the percent cannot be computed for any reason the Reading property is set to null. - Note: SpeedRPM: Remains unchanged, it continues to report the RPM value as reported by D-Bus. Implementation Notes: - The SensorFanExcerpt and SensorFanArrayExcerpt definitions also include the SpeedRPM property. So moved setting of this property to be handled for excerpts as well. - The Sensor schema version has been updated regardless of the compile option setting. [1] https://github.com/DMTF/Redfish/issues/6197 [2] https://redfish.dmtf.org/schemas/v1/Sensor.v1_11_1.json [3] https://github.com/DMTF/Redfish-Publications/blob/main/mockups/public-rackmount1/Chassis/1U/Sensors/CPUFan1/index.json Tested: - Added new unit tests for new function getFanPercent() - Adjusted existing unit tests for Sensors to reflect changes for fan_tach sensors. - Redfish Service Validator passes (with option enabled and disabled) - Using hardware simulator hand-edited values for the min/max of the fan_tach sensors: - Option enabled: confirmed Redfish response same before and after code changes. - Option disabled: Confirmed Redfish responses and percent calculation. Example responses with compile option disabled: ``` // D-Bus: "Value" d 18000 "MaxValue" d 18000 "MinValue" d 0 curl -s -k -H "X-Auth-Token: $token" -X GET https://${bmc}/redfish/v1/Chassis/chassis/Sensors/fantach_fan0_0 { "@odata.id": "/redfish/v1/Chassis/chassis/Sensors/fantach_fan0_0", "@odata.type": "#Sensor.v1_11_1.Sensor", "Id": "fantach_fan0_0", "Name": "fan0 0", "Reading": 100, "ReadingRangeMax": 100, "ReadingRangeMin": 0, "ReadingType": "Percent", "ReadingUnits": "%", "SpeedRPM": 18000.0, "Status": { "Health": "OK", "State": "Enabled" } } // D-Bus: "Value" d 18000 "MaxValue" d 36000 "MinValue" d 0 curl -s -k -H "X-Auth-Token: $token" -X GET https://${bmc}/redfish/v1/Chassis/chassis/Sensors/fantach_fan1_0 { "@odata.id": "/redfish/v1/Chassis/chassis/Sensors/fantach_fan1_0", "@odata.type": "#Sensor.v1_11_1.Sensor", "Id": "fantach_fan1_0", "Name": "fan1 0", "Reading": 50, "ReadingRangeMax": 100, "ReadingRangeMin": 0, "ReadingType": "Percent", "ReadingUnits": "%", "SpeedRPM": 18000.0, "Status": { "Health": "OK", "State": "Enabled" } } // Minimum is non-zero // D-Bus: "Value" d 18000 "MaxValue" d 27000 "MinValue" d 9000 curl -s -k -H "X-Auth-Token: $token" -X GET https://${bmc}/redfish/v1/Chassis/chassis/Sensors/fantach_fan2_0 { "@odata.id": "/redfish/v1/Chassis/chassis/Sensors/fantach_fan2_0", "@odata.type": "#Sensor.v1_11_1.Sensor", "Id": "fantach_fan2_0", "Name": "fan2 0", "Reading": 50, "ReadingRangeMax": 100, "ReadingRangeMin": 0, "ReadingType": "Percent", "ReadingUnits": "%", "SpeedRPM": 18000.0, "Status": { "Health": "OK", "State": "Enabled" } } // Minimum is not initialized - Reading is null // D-Bus: "Value" d 18000 "MaxValue" d 18000 "MinValue" d -inf curl -s -k -H "X-Auth-Token: $token" -X GET https://${bmc}/redfish/v1/Chassis/chassis/Sensors/fantach_fan3_0 { "@odata.id": "/redfish/v1/Chassis/chassis/Sensors/fantach_fan3_0", "@odata.type": "#Sensor.v1_11_1.Sensor", "Id": "fantach_fan3_0", "Name": "fan3 0", "Reading": null, "ReadingRangeMax": 100, "ReadingRangeMin": 0, "ReadingType": "Percent", "ReadingUnits": "%", "SpeedRPM": 18000.0, "Status": { "Health": "OK", "State": "Enabled" } } // Minimum and Maximum are not initialized - so Reading is null // D-Bus: "Value" d 18000 "MaxValue" d inf "MinValue" d -inf curl -s -k -H "X-Auth-Token: $token" -X GET https://${bmc}/redfish/v1/Chassis/chassis/Sensors/fantach_fan4_0 { "@odata.id": "/redfish/v1/Chassis/chassis/Sensors/fantach_fan4_0", "@odata.type": "#Sensor.v1_11_1.Sensor", "Id": "fantach_fan4_0", "Name": "fan4 0", "Reading": null, "ReadingRangeMax": 100, "ReadingRangeMin": 0, "ReadingType": "Percent", "ReadingUnits": "%", "SpeedRPM": 18000.0, "Status": { "Health": "OK", "State": "Enabled" } } ``` Example of unchanged response with compile option enabled: ``` curl -s -k -H "X-Auth-Token: $token" -X GET https://${bmc}/redfish/v1/Chassis/chassis/Sensors/fantach_fan0_0 { "@odata.id": "/redfish/v1/Chassis/chassis/Sensors/fantach_fan0_0", "@odata.type": "#Sensor.v1_11_1.Sensor", "Id": "fantach_fan0_0", "Name": "fan0 0", "Reading": 18000.0, "ReadingRangeMax": 18000.0, "ReadingRangeMin": 0.0, "ReadingType": "Rotational", "ReadingUnits": "RPM", "SpeedRPM": 18000.0, "Status": { "Health": "OK", "State": "Enabled" } } ``` Change-Id: I8ec1e739bcd5ebce7453a2570569f2edc2284341 Signed-off-by: Janet Adkins

Fabric: add support for PCIe Switch Port URI

2026-02-03T17:24:36+00:00

This patch enable support for following properties for Port of a PCIe Switch. [1] - PortProtocol - PortType - CurrentSpeedGbps - ActiveWidth One of the devices that gets enabled with this patch is Nvidia ConnectX devices, which are network cards featuring an integrated PCIe switch. These devices combine both PCIe ports and network ports in a single unit. Since such devices don't strictly qualify as Fabric Adapters, the Switch URI is used instead of the FabricAdapter URI. Port schema only allows certain URIs as Port URI. URI /redfish/v1/Fabrics/{FabricId}/Switches/{SwitchId}/Ports/{PortId} seems most appropriate choice for PCIe Switch Port. [1] The Fabric resource is modeled similarly to the System resource, meaning that only one Fabric resource will exist for each BMC. Route handler for collections and each individual components are added in this patch for each URI resource under /redfish/v1/Fabrics. DBus Interface "xyz.openbmc_project.Inventory.Item.PCIeSwitch" is used to identify the Switch resources. Association between Switch and Port is `connecting` and `connected_to`. Feature like Port Metrics properties (for PCIe Error Counters) can be added in future at Port Metric URI. dbus-sensors patches - https://gerrit.openbmc.org/c/openbmc/dbus-sensors/+/84079 https://gerrit.openbmc.org/c/openbmc/dbus-sensors/+/83202 Tested: Build an image for nvl32-obmc machine with the following patch cherry picked. https://gerrit.openbmc.org/c/openbmc/dbus-sensors/+/84079 https://gerrit.openbmc.org/c/openbmc/openbmc/+/85490 The openbmc patch cherry-picks the following patches that are currently under review. ``` 1. device tree https://lore.kernel.org/all/aRbLqH8pLWCQryhu@molberding.nvidia.com/ 2. mctpd patches https://github.com/CodeConstruct/mctp/pull/85 3. u-boot changes https://lore.kernel.org/openbmc/20251121-msx4-v1-0-fc0118b666c1@nvidia.com/T/#t 4. kernel changes as specified in the openbmc patch (for espi) 5. entity-manager changes https://gerrit.openbmc.org/c/openbmc/entity-manager/+/85455 6. platform-init changes https://gerrit.openbmc.org/c/openbmc/platform-init/+/85456 7. spi changes https://lore.kernel.org/all/20251121-w25q01jv_fixup-v1-1-3d175050db73@nvidia.com/ ``` redfish service validator is passing. ``` $ curl -k -u 'root:0penBmc' https://${bmc_ip}/redfish/v1/Fabrics/ { "@odata.id": "/redfish/v1/Fabrics", "@odata.type": "#FabricCollection.FabricCollection", "Members": [ { "@odata.id": "/redfish/v1/Fabrics/fabric" } ], "Members@odata.count": 1, "Name": "Fabric Collection" }% $ curl -k -u 'root:0penBmc' https://${bmc_ip}/redfish/v1/Fabrics/fabric/ { "@odata.id": "/redfish/v1/Fabrics/fabric", "@odata.type": "#Fabric.v1_2_0.Fabric", "Id": "fabric", "Name": "fabric Fabric", "Switches": { "@odata.id": "/redfish/v1/Fabrics/fabric/Switches" } }% $ curl -k -u 'root:0penBmc' https://${bmc_ip}/redfish/v1/Fabrics/fabric/Switches/ { "@odata.id": "/redfish/v1/Fabrics/fabric/Switches", "@odata.type": "#SwitchCollection.SwitchCollection", "Members": [ { "@odata.id": "/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_0" }, { "@odata.id": "/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_1" }, { "@odata.id": "/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_2" }, { "@odata.id": "/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_3" } ], "Members@odata.count": 4, "Name": "fabric Switch Collection" }% $ curl -k -u 'root:0penBmc' https://${bmc_ip}/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_0 { "@odata.id": "/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_0", "@odata.type": "#Switch.v1_7_0.Switch", "Id": "Nvidia_ConnectX_0", "Name": "Nvidia_ConnectX_0", "Ports": { "@odata.id": "/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_0/Ports" }, "Status": { "Health": "OK", "State": "Enabled" } }% $ curl -k -u 'root:0penBmc' https://${bmc_ip}/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_0/Ports/ { "@odata.id": "/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_0/Ports", "@odata.type": "#PortCollection.PortCollection", "Members": [ { "@odata.id": "/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_0/Ports/DOWN_0" }, { "@odata.id": "/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_0/Ports/DOWN_1" }, { "@odata.id": "/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_0/Ports/UP_0" } ], "Members@odata.count": 3, "Name": "Nvidia_ConnectX_0 Port Collection" }% $ curl -k -u 'root:0penBmc' https://${bmc_ip}/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_0/Ports/UP_0/ { "@odata.id": "/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_0/Ports/UP_0", "@odata.type": "#Port.v1_4_0.Port", "ActiveWidth": 8, "CurrentSpeedGbps": 32.0, "Id": "UP_0", "Metrics": { "@odata.id": "/redfish/v1/Fabrics/fabric/Switches/Nvidia_ConnectX_0/Ports/UP_0/Metrics" }, "Name": "Nvidia_ConnectX_0 UP_0 Port", "PortProtocol": "PCIe", "PortType": "UpstreamPort", "Status": { "Health": "OK", "State": "Enabled" } }% ``` [1]: https://redfish.dmtf.org/schemas/v1/Port_v1.xml Change-Id: I52f4ca62b4953f6196c589e340602a0d7885d9c1 Signed-off-by: Harshit Aghera

Enable TCP keepalives for HTTP connections

2026-01-06T22:02:00+00:00

This fix enables TCP keepalives at the OS layer. It also enables a 15 minute deadline timer at the bmcweb level when waiting on an idle HTTP keepalive connection. Tested: romulus image running bmcweb, start connections with keepalive, block incoming connections `iptables -P INPUT DROP`, validate that sockets eventually die and are tracked with keepalives `ss -nto` Change-Id: I8f5040440348c060dae1d0516ec202a0e4dc349e Signed-off-by: Joey Berkovitz

Add temp file and FD support to TemporaryFileHandle

2025-11-25T18:23:48+00:00

This commit adds file descriptor and temporary file management to DuplicatableFileHandle, removing the redundant test-only TemporaryFileHandle utility. Changes: - Add file descriptor constructor and setFd() method - Add temporary file constructor with string_view content - Add filePath member and automatic cleanup in destructor - Add configurable temp-dir meson option (default: /tmp/bmcweb) - Remove include/file_test_utilities.hpp - Update all tests to use DuplicatableFileHandle - Rename stringPath to filePath These features will be used by the multipart parser to stream large uploads to temporary files instead of keeping them in memory, and by the update service to pass file descriptors over D-Bus. Change-Id: I982f5928d453f9f0c13d91c3525006134ddc87b3 Signed-off-by: Rajeev Ranjan

Add Journal EventLog to Manager

2025-11-20T22:38:53+00:00

In order to get access to the EventLog on multi-host platforms, add Journal EventLog to Manager. This implementation is based on the discussion we had on patch 76319 [1]. TLDR: On multi-host, we technically would have to split the event log on a per host node basis, so that each host node has its own specific event log. However, this is currently not supported so we had to decide, whether we put it on a specific ComputerSystem, or refactor the current implementation of the EventLog, to allow for the EventLog LogService to be part of the Managers resource. We chose the latter one, because a), it is not clear on which ComputerSystem to put the EventLog, as long as we aren't splitting the event log per host node, and b), if that particular ComputerSystem is not existing at runtime, there would be no access to the EventLog at all. This feature can be enabled with the redfish-eventlog-location meson option. By default it is set to 'systems', which translates to the EventLog being under the Systems resource. To enable the EventLog under the Managers resource set ``` -Dredfish-eventlog-location=managers ``` This in turn, disables the EventLog under the ComputerSystem resource. Tested: Redfish validation succeeded for both ComputerSystem and Managers tree. ``` curl command: curl -w "@curl-format.txt" -c cjar -b cjar -k -X GET 'https://'"${BMC}"':4443/redfish/v1/'"$ROUTE"'' \ -H 'X-Auth-Token: '"$BMCWEB_SESSION_TOKEN"'' GET /redfish/v1/Managers/bmc/LogServices { "@odata.id": "/redfish/v1/Managers/bmc/LogServices", "@odata.type": "#LogServiceCollection.LogServiceCollection", "Description": "Collection of LogServices for this Manager", "Members": [ { "@odata.id": "/redfish/v1/Managers/bmc/LogServices/Journal" }, { "@odata.id": "/redfish/v1/Managers/bmc/LogServices/EventLog" } ], "Members@odata.count": 2, "Name": "Open BMC Log Services Collection" } GET /redfish/v1/Managers/bmc/LogServices/EventLog { "@odata.id": "/redfish/v1/Managers/bmc/LogServices/EventLog", "@odata.type": "#LogService.v1_2_0.LogService", "Actions": { "#LogService.ClearLog": { "target": "/redfish/v1/Managers/bmc/LogServices/EventLog/Actions/LogService.ClearLog" } }, "DateTime": "2025-09-24T15:22:36+00:00", "DateTimeLocalOffset": "+00:00", "Description": "Manager Event Log Service", "Entries": { "@odata.id": "/redfish/v1/Managers/bmc/LogServices/EventLog/Entries" }, "Id": "EventLog", "Name": "Event Log Service", "OverWritePolicy": "WrapsWhenFull" } GET /redfish/v1/Managers/bmc/LogServices/EventLog/Entries { "@odata.id": "/redfish/v1/Managers/bmc/LogServices/EventLog/Entries", "@odata.type": "#LogEntryCollection.LogEntryCollection", "Description": "Collection of Manager Event Log Entries", "Members": [ { "@odata.id": "/redfish/v1/Managers/bmc/LogServices/EventLog/Entries/1730009576", "@odata.type": "#LogEntry.v1_9_0.LogEntry", "Created": "2024-10-27T06:12:56+00:00", "EntryType": "Event", "Id": "1730009576", "Message": "Host system DC power is off", "MessageArgs": [], "MessageId": "OpenBMC.0.1.DCPowerOff", "Name": "Manager Event Log Entry", "Severity": "OK" }, ... ], "Members@odata.count": 2820, "Members@odata.nextLink": "/redfish/v1/Managers/bmc/LogServices/EventLog/Entries?$skip=1000", "Name": "Manager Event Log Entries" } GET /redfish/v1/Managers/bmc/LogServices/EventLog/Entries/1730009576 { "@odata.id": "/redfish/v1/Managers/bmc/LogServices/EventLog/Entries/1730009576", "@odata.type": "#LogEntry.v1_9_0.LogEntry", "Created": "2024-10-27T06:12:56+00:00", "EntryType": "Event", "Id": "1730009576", "Message": "Host system DC power is off", "MessageArgs": [], "MessageId": "OpenBMC.0.1.DCPowerOff", "Name": "Manager Event Log Entry", "Severity": "OK" } ``` ClearLog action: Log files are being successfully deleted from /var/log [1] https://gerrit.openbmc.org/c/openbmc/bmcweb/+/76319 Change-Id: If5b4fe10151b6bfd28a1b49c41f8cfcec1b9132c Signed-off-by: Oliver Brewka

Remove redfish-use-3-digit-messageid

2025-11-10T14:54:25+00:00

redfish-use-3-digit-messageid stated it would be removed in 2Q25, it is now 4Q25. Searching OpenBMC doesn't show any users of this option. This option was added in December 2014 and fixed a bug with us not following the Redfish Spec.[1] [1]: https://gerrit.openbmc.org/c/openbmc/bmcweb/+/76180 Tested: This is a pretty straightforward removal. Inspection and build only. Change-Id: I8a103d42184c21f75db19d44d8004f54d3fae01a Signed-off-by: Gunnar Mills

Allow configuring user

2025-10-14T19:02:47+00:00

Add a new option to allow configuring bmcweb to run as a 'bmcweb' user instead of root. This option is disabled by default, and the behavior is very broken at this point, but should serve as a starting point for getting the issues resolved. Tested: Enabled option. Observed with ps, that bmcweb launched correctly, and was running as the bmcweb user. With authentication disabled, passes redfish service validator. Booted without option enabled, and saw bmcweb boot and function. Change-Id: Iac0335697020308bb632f5522b712f5eea0b2486 Signed-off-by: Ed Tanous