05/09/2014

System firmware changes that affect all systems AF773_035

- A security problem was fixed for the Lighttpd web server that allowed arbitrary SQL commands to be run on the service processor of the compute node. The Common Vulnerabilities and Exposures issue number is CVE-2014-2323.

- A security problem was fixed for the Lighttpd web server where improperly-structured URLs could be used to view arbitrary files on the service processor of the compute node. The Common Vulnerabilities and Exposures issue number is CVE-2014-2324.

- HIPER /Pervasive A security problem was fixed in the OpenSSL Montgomery ladder implementation for the ECDSA (Elliptic Curve Digital Signature Algorithm) to protect sensitive information from being obtained with a flush and reload cache side-channel attack to recover ECDSA nonces from the service processor. The Common Vulnerabilities and Exposures issue number is CVE-2014-0076. The stolen ECDSA nonces could be used to decrypt the SSL sessions and compromise the Flex System Manager (FSM) access password to the service processor. Therefore, the FSM access password for the compute node should be changed after applying this fix.

- HIPER /Pervasive A security problem was fixed in the OpenSSL Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) to not allow Heartbeat Extension packets to trigger a buffer over-read to steal private keys for the encrypted sessions on the service processor. The Common Vulnerabilities and Exposures issue number is CVE-2014-0160 and it is also known as the heartbleed vulnerability. The stolen private keys could be used to decrypt the SSL sessions and and compromise the Flex System Manager (FSM) access password to the service processor. Therefore, the FSM access password for the compute node should be changed after applying this fix.

09/10/2013

10/15/2013 - re-released for readme updates ONLY - no change to binaries

New features and functions in system firmware AF773_033

- Support for the P7+ Flex System p270 compute node (DCM 2-socket compute node) with MTM 7954-24X.

- Support for the P7+ Flex System p260 compute node (SCM 2-socket compute node) with MTM 7895-23A for IBMi only.

- Support for the P7+ Flex System p460 compute node (SCM 4-socket compute node) with MTM 7895-43X.

- Support for the IBM Flex System CN4058 8-port 10Gb converged network adapter (CNA) mezzanine expansion card with feature code (F/C) EC24 for Power System compute nodes that support 10 Gb ethernet and Fibre Channel over Ethernet (FCoE).

- Support for the IBM Flex System FC5054 4-port 16Gb fibre channel adapter with feature code (F/C) EC2E. This adapter features a dual-ASIC (FC5054) controller using the Emulex XE201 design, which allows for logical partitioning on Flex Power Systems compute nodes.

- Support for the IBM Flex System Dual VIOS adapter for the p270 compute node (7954-24X) with feature code (F/C) EC2F. This adapter provides a second integrated SAS controller enabling dual VIOS support with two internal disks.

- Support for the IBM Flex System FC5052 2-port 16Gb fibre channel adapter with feature code (F/C) EC23. This adapter features a 2-port 16 Gb Fibre Channel adapter with a single-ASIC controller using the Emulex XE201 design.

- Support for the IBM Flex System compute nodes by the Hardware Management Console (HMC). Note that the HMC does not provide any Flex System chassis management capabilities.

- Support for the IBM Flex System compute nodes by the Integrated Virtualization Manager (IVM). This provides an option for very basic system partition management for customers who do not want to purchase a Flexible System Management (FSM) or Hardware Management Console (HMC) appliance for system management.

- Support for network enhancements between the IBM Flex System and the service processor.
1. Support for network configuration options for default values and DHCP configurations were added.
2. Support added for LDAP active directory forest.
3. Support added for password change/expiration support through LDAP that enable users to change password on LDAP servers.
4. Support added for LDAP DNS so that LDAP servers can be located from the DNS server instead of passing IP addresses to find the LDAP servers.
5. Support added for local authorization for LDAP on the service processor in addition to the already supported remote authorization.
6. Support added for service processor Advanced System Management Interface (ASMI) to open directly from the Flex System CMM.

- Support for Flex System LDAP configuration authentication-only mode (AOM) on the service processor.

- Support for Flexible System Manager (FSM) increase in capacity to handle eight Flex system chassis for up to 112 compute nodes.

- Support for Flexible System Manager (FSM) increase in capacity to handle up to 4096 managed system partitions running on the Flex System compute nodes.

System firmware changes that affect all systems

- Support was dropped for Secured Socket Layer (SSL) Version 2 and SSL weak and medium cipher suites in the service processor web server (Ligthttpd). Unsupported web browser connections to the Advanced System Management Interface (ASMI) secured port 443 (using https) will now be rejected if those browsers do not support SSL version 3. Supported web browsers for Power7 ASMI are Netscape (version 9.0.0.4), Microsoft Internet Explorer (version 7.0), Mozilla Firefox (version 2.0.0.11), and Opera (version 9.24).

- A problem was fixed that prevented the Advanced Management Module (AMM) and Chassis Management Module (CMM) from displaying the blade's gateway IP address when DHCP is enabled.

- A problem was fixed that caused the hypervisor to fail to read the backplane VPD. When this problem occurs, the compute node will not boot.

- A problem was fixed that caused SRC B1813221, which indicates a failure of the battery on the compute node, to be erroneously logged after a service processor reset or power cycle.

- A problem was fixed that caused a service processor dump to be generated with SRC B18187DA "NETC_RECV_ER" logged.

- A problem was fixed that caused a L2 cache error to not guard out the faulty processor, allowing the system to checkstop again on an error to the same faulty processor.

- A problem was fixed that caused a HMC code update failure for the FSP on the accept operation with SRC B1811402 or FSP is unable to boot on the updated side.

- A problem was fixed that caused the system information LED to be lit without a corresponding SRC and error log for the event. This problem typically occurs when an operating system on a partition terminates abnormally.

- A problem was fixed that may cause inaccurate processor utilization reporting.

- A problem was fixed that caused a migrated partition to reboot during transfer to a VIOS 2.2.2.0, and later, target system. A manual reboot would be required if transferred to a target system running an earlier VIOS release. Migration recovery may also be necessary.

- A problem was fixed that caused an error log generated by the partition firmware to show conflicting firmware levels. This problem occurs after a firmware update or a logical partition migration (LPM) operation on the system.

System firmware changes that affect certain systems

- A problem was fixed that was caused by an attempt to modify a virtual adapter from the management console command line when the command specifies it is an Ethernet adapter, but the virtual ID specified is for an adapter type other than Ethernet. The managed system has to be rebooted to restore communications with the management console when this problem occurs; SRC B7000602 is also logged.

- On a P7 system, a problem was fixed that caused a system checkstop during hypervisor time keeping services. This deferred fix addresses a problem that has a very low probability of occurrence. As such customers may wait for the next planned service window to activate the deferred fix via a system reboot.

- A problem was fixed in the run-time abstraction services (RTAS) extended error handling (EEH) for fundamental reset that caused partitions to crash during adapter updates. The fundamental reset of adapters now returns a valid return code. The adapter drivers using fundamental reset affected by this fix are the following-- QLogic PCIe Fibre Channel adapters (combo card), IBM PCIe Obsidian, Emulex BE3-based ethernet adapters, Broadcom-based PCIe2 4-port 1Gb ethernet, Broadcom-based FlexSystem EN2024 4-port 1Gb ethernet for compute nodes

- On a compute node, a problem was fixed that caused a Flexible Service Processor (FSP) dump with SRC B1818A0F when the Dynamic Host Control Protocol (DHCP) server failed to respond with a valid IPV4 address. For this scenario, the FSP network configuration will now issue an informational error log for DHCP and continue with the previously known IP address if possible.

- On a compute node, a problem was fixed that caused SRCs B1818601, B1818611, and B181F12C to be logged with the chassis fans speeding up to the maximum fan speed. A race condition was found in the Common Information Model (CIM) process when it was changing IP addresses on the compute node that caused CIM pointer corruption and the associated errors.

- On a compute node, a problem was fixed that caused a virtual session (Vtty) to fail to a partition with the message 'Unable to open virtual serial connection - lock failed".

- On a compute node, a problem was fixed that caused the compute node to log SRC B1768BBF when resetting the network adapters to factory configuration using the Advanced System Manager Interface (ASMI).

- On a compute node, a problem was fixed to stop frequent Secure Socket Layer (SSL) certificate provisioning from the Flex System Chassis Management Module (CMM) in the case of a DHCP server not responding. If the DHCP server is unresponsive, the previously received DHCP IP address is used by the compute node without further certificate provisioning.

- On a compute node, a problem was fixed where the Flexible Service Manager (FSM) could not establish communications to the Flexible Service Processor (FSP) due to a FSP process deadlock condition. The deadlock error also caused dumps on the FSP anytime the FSM tried to connect to the FSP.

- On a compute node, a problem was fixed for Flex System Chassis Management Module (CMM) failovers causing the Flexible Service Processor (FSP) to log SRC B181D50E for an out of memory condition for threads.

- On a compute node, a problem was fixed where "VPD has changed" messages were not sent to the Flex System Chassis Management Module (CMM) for mezzanine I/O card updates, resulting in old firmware levels being displayed on the CMM for the cards.

- On Power7+ systems, a problem was fixed that caused a system checkstop during hypervisor time keeping services.

- On a compute node, a problem was fixed that caused the Common Information Model (CIM) server to core dump and have a long restart time when loading new Secure Socket Layer (SSL) certificates provided by the Flex System Chassis Management Module (CMM). This fix allows faster changes in the network configuration of the compute node and facilitates faster node discovery by the Flexible System Manager (FSM).

- A problem was fixed that can cause Anchor (VPD) card corruption and A70047xx SRCs to be logged. Note-- If a serviceable event with SRC A7004715 is present or was logged previously, damage to the VPD card may have occurred. After the fix is applied, replacement of the Anchor VPD card is recommended in order to restored full redundancy.

05/01/2013

System firmware changes that affect all systems
- A problem was fixed that caused a warning message indicating "VPD is not available" to be erroneously logged in the Chassis Management Module (CMM) after the concurrent firmware update of a compute node from the Flex System Manager (FSM).
- A problem was fixed that caused the compute node to experience a Flexible Service Processor (FSP) dump with SRC B181EF88 and the CIM status on the security screen on the FSM to be displayed as "No access" when the state was actually "Partial access".

System firmware changes that affect certain systems
- On compute nodes managed by a Flex System Manager (FSM), a problem was fixed that caused a mismatch between the state of the compute node power LED and the status of the power LED displayed on the FSM.
- On systems running AIX or Linux, a problem was fixed that caused a partition to fail to boot with SRC CA260203. This problem also can cause concurrent firmware updates to fail.
- On a partition with the virtual Trusted Platform Module (vTPM) enabled, a problem was fixed that caused errors to occur when the memory assigned to the partition was changed.
- On a system running a Live Partition Mobility (LPM) operation, a problem was fixed that caused the partition to successfully appear on the target system, but hang with a 2005 SRC.
- On a partition with the virtual Trusted Platform Module (vTPM) enabled, a problem was fixed that caused the partition to stop functioning after certain operations. When this problem occurs, the client partition may not power off.
- On systems running more than one instance of VIOS, a problem was fixed that prevented the partition that obtained the IBM Fabric Manager (IFM) lock from performing IFM operations when two VIOS partitions were powered on at the same time.
- On systems managed by a management console, a problem was fixed that caused a partition to become unresponsive when the AIX command "update_flash -s" is run.
- On systems with the 10GbE converged network adapter mezzanine card (F/C EC24) installed, a problem was fixed that caused SRC B146D547 to be erroneously logged.
- On systems running Active Memory Sharing (AMS) partitions, a problem was fixed that may arise due to the incorrect handling of a return code in a error path during the logical partition (LPM) of an AMS partition.
- On systems running Active Memory Sharing (AMS) partitions, a timing problem was fixed that may occur if the system is running Dynamic Platform Optimization (DPO).

12/05/2012

12/04/2012