ML1030_026_026 / FW1030.00
12/09/22 |
Impact: New
Severity: New
GA Level with key features listed below along with security fixes.
New Features and Functions
- This server
firmware includes the SR-IOV adapter firmware level xx.34.1002 for the
following Feature Codes and CCINs: #EC2R/EC2S with CCIN 58FA;
#EC2T/EC2U with CCIN 58FB; and #EC66/EC67 with CCIN 2CF3.
Update instructions: https://www.ibm.com/docs/en/power10?topic=updates-sr-iov-firmware-update
- Support was added for Secure Boot for SUSE Linux Enterprise
Server (SLES) partitions. The SUSE Linux level must be SLES 15
SP4 or later. Without this feature, partitions with SLES 15 SP4
or later and which have the OS Secure Boot partition property set to
"Enabled and Enforced" will fail to boot. A workaround to this is
to change the partition's Secure Boot setting in the HMC partition
configuration to "Disabled" or "Enabled and Log only".
- HIPER/Pervasive:
For systems with Power Linux partitions, support was added for a new
Linux secure boot key. The support for the new secure boot key
for Linux partitions may cause secure boot for Linux to fail if the
Linux OS for SUSE or RHEL distributions does not have a secure boot key
update.
The affected Linux distributions are as follows that need the Linux fix
level that includes "Key for secure boot signing grub2 builds ppc64le".
1) SLES 15 SP4 - The GA for this Linux level includes the secure boot
fix.
2) RHEL 8.5- This Linux level has no fix. The user must update to
RHEL: 8.6 or RHEL 9.0.
3) RHEL 8.6
4) RHEL 9.0.
The update to a Linux level that supports the new secure boot key also
addresses the following security issues in Linux GRUB2 and are the
reasons that the change in secure boot key is needed as documented in
the following six CVEs:
1) CVE-2021-3695
2) CVE-2022-28733
3) CVE-2022-28734
4) CVE-2022-28735
5) CVE-2022-28736
6) CVE-2022-28737
Please note that when this firmware level of FW1030.00 is installed,
any Linux OS not updated to a secure boot fix level will fail to secure
boot. And any Linux OS partition updated to a fix level for
secure boot requires a minimum firmware level of FW1010.30 or
later, FW1020.00 or later, or FW1030.00 or later to be able to do
a secure boot. If lesser firmware levels are active but the Linux
fix levels for secure boot are loaded for the Linux partition, the
secure boot failure that occurs will have BA540010 logged. If
secure boot verification is enabled, but not enforced (log only mode),
then the fixed Linux partition will boot, but a BA540020 informational
error will be logged.
- Support has been dropped for the smaller logical-memory
block (LMB) sizes of 16MB, 32MB, and 64MB. 128MB and 256MB are the only
LMB sizes that can be selected in the eBMC ASMI.
- Password quality rules were enhanced on the eBMC for local
passwords such that new passwords must have characters from at least
two classes: lower-case letters, upper-case letters, digits, and other
characters. With this enhancement, you can get a new error message from
the `passwd` command:
"BAD PASSWORD: The password contains less than 2 character classes".
- Live Partition Mobility (LPM) support for partitions with
vPMEM volumes assigned to them. With this feature, the PowerVM
hypervisor manages the migration of the data in the vPMEM volumes as
part of its normal LPM operations.
- Support added to display on the management console (HMC,
NovaLink) the physical port MAC address of an SR-IOV shared mode
enabled adapter's physical ports. This allows for verification of
an adapter's physical port connection to an external switch without
physically tracing cables.
- Support for concurrent maintenance for the system operator
panel.
- Advanced Memory Mirroring (AMM) support for the
Virtualization Management Interface (VMI). This feature adds AMM
support for mirroring the memory used by VMI.
- Support for Linux 2 MB I/O mappings (TCEs)
for a PCIe slot enabled with Huge Dynamic DMA Window capability (HDDW)
using the I/O Adapter Enlarged Capacity setting in ASMI.
This applies to both dedicated PCIe slots as well as SR-IOV virtual
functions.
- Support populating two 4-core processors (Feature Code
#EPGR) in the model IBM Power S1022s (9105-22B) server with native
support for IBM i, P10 license tier, and a maximum of eight cores
active. Native IBM i is allowed only when there are two #EPGR
4-core processors in the system. This also allows IBM i as a
client of VIOS, and IBM i as a client of IBM i (IBM i hosting i).
#EPGR pertains only to model S1022s (9105-22B).
- Support for PCIe3 4-port 10GbE BaseT RJ45 Adapter with
Feature Codes #EN2W and #EN2X. These features are electronically
identical with the same CCIN of 2F04, but they have different tailstock
brackets. Feature #EN2W has a tailstock for full-height PCIe
slots and pertains to the S1022 (9105-22A), S1022s (9105-22B), L1022
(9786-22H), S1014(9105-41B), S1024(9105-42A) and L1024(9786-42H)
models. Feature #EN2X has a short tailstock for low-profile PCIe
slots and pertains to the S1022 (9105-22A), S1022s (9105-22B), and
L1022 (9786-22H) models.
- Support for enablement of the self-encrypting drive (SED)
capability of NVMe drives on Power10 systems. This enables data-at-rest
encryption on NVMe drives without additional impact to I/O performance
or CPU utilization. IBM PowerVM Platform KeyStore (PKS) must be enabled
for NVMe SED key management. The new AIX command line utility nvmesed
is introduced to provide management of NVMe SED drives. Booting
from the NVMe SED-enabled drive is supported.
Note: NVMe SED enablement requires a SED-capable NVMe drive and AIX 7,3
TL1 or later.
Power firmware version FW1030.00 or later is required for this feature.
- Improvements to Fibre Channel (FC) Non-Volatile Memory
Express (FC-NVMe) capability to include N-port ID virtualization (NPIV)
client support. This capability requires AIX 7.3 TL1 or later,
IBM PowerVM Virtual I/O Server (VIOS) 3.1.4, an NVMeoF NPIV-capable FC
adapter that supports NVMeof; and an NVMeoF storage subsystem.
The FC adapters supported include the PCIe4 2-Port 64 Gb FC
Adapter ( feature codes #EN1N and #EN1P); and the PCIe4 4-Port 32 Gb FC
Adapter (feature codes #EN1L and #EN1M); or any any
high-bandwidth FC adapters that support NVMeoF protocol in the AIX
physical stack.
NVMe Over Fabric (SAN) Boot is supported.
Note: Booting from FC-NVMe disk may fail if certain fabric errors are
returned, hence a boot disk set up with multiple paths is
recommended. In case there is a failure to boot, the boot process
may continue if you exit from the SMS menu. Another potential
workaround is to discover boot LUNs from the SMS menu and then retry
boot.
Power firmware version FW1030.00 or later is required for this feature.
- Support for a 1000 W 100-127V/200-240V AC Titanium power
supply on the IBM Power S1022s (9105-22B) server. The Feature
Code for this power supply is #EB3R.
- Support for a PowerVM Watchdog for AIX and Linux using a
hypervisor call to set up a watchdog for kernel and userspace use.
- Support for SR-IOV including NIC, RoCE, and vNIC for
a PCIe4 2-port 100Gb No Cryptographic ConnectX-6 DX QFSP56 adapter with
Feature Codes #EC75 and #EC76 with CCIN 2CFB, This PCIe Gen4
Ethernet x16 adapter provides two 100 GbE QFSP56 ports. The
adapter is based on a Mellanox ConnectX-6 adapter, which uses a
ConnectX-6 EN network controller. Features #EC75 and #EC76 have
identical electronics, but they have different tailstock
brackets. Feature #EC75 is low profile and available for Power
S1022 (9105-22A), Power S1022s (9105-22B), and Power L1022 (9786-22H)
servers and feature #EC76 is high profile and available for Power S1014
(9105-41B), Power S1024(9105-42A), and Power L1024 (9786-42H) servers.
OS support is as follows:
AIX 7.2 TL5 and later: Dedicated, SR-IOV NIC/RoCE, VIOS, and vNIC.
IBM i: Virtual client for NIC - All supported IBM i releases (IBM i
7.3, 7.4, 7.5)
IBM i: Dedicated and SR-IOV for NIC, vNIC, and HNV - IBM i 7.4
and IBM i 7.5
IBM i: Dedicated and SR-IOV for RoCE for Db2 Mirror only -
IBM i 7.4 and IBM i 7.5
Linux RHEL 8.4, RHEL 9, and SLES 15 SP3: Dedicated, SR-IOV NIC/RoCE,
VIOS, and vNIC
- Support for a PCIe 4.0 8x 2-port 64 Gigabit optical fibre
channel (FC) adapter with feature codes #EN1N and #EN1P. Support
includes direct attach configurations. Features #EN1N and #EN1P
are electronically identical with the same CCIN of 2CFD. They differ
physically only in that the #EN1N has a tail stock for full height PCIe
slots and the #EN1P has a short tail stock for low profile PCIe slots.
Feature #EN1N is high profile and pertains to the S1022 (9105-22A),
S1022s (9105-22B), L1022 (9786-22H), S1014(9105-41B),S1024(9105-42A)
and L1024(9786-42H) models. Feature #EN1P is low profile and pertains
to the S1022 (9105-22A), S1022s (9105-22B), and L1022 (9786-22H)
models. Firmware support is for all P10 and later levels.
OS support is as follows for AIX, IBM i, and Linux:
AIX 7.2 TL5 and later.
IBM i dedicated support is for IBM i 7.4 and 7.5 and later.
IBM i virtual support is for IBM i 7.3, 7.4, 7.5, and later for Virtual
Client support for both IBM i hosting IBM i and for VIOS.
Linux RHEL 8 and SLES 15.
- Support for a PCIe 4.0 8x 4-port 32 Gigabit optical fibre
channel (FC) adapter with feature codes #EN1L and CCIN 2CFC.
Support includes direct attach configurations. Feature #EN1L has
a tail stock for full height PCIe slots. Firmware support is for
all P10 and later levels.
OS support is as follows for AIX, IBM i, and Linux:
AIX 7.2 TL5 and later.
IBM i dedicated support is for IBM i 7.4 and 7.5 and later.
IBM i virtual support is for IBM i 7.3, 7.4, 7.5, and later for Virtual
Client support for both IBM i hosting IBM i and for VIOS.
Linux RHEL 8 and SLES 15.
System
firmware changes that
affect all systems
- HIPER/Pervasive:
The following problems were fixed for certain SR-IOV adapters in shared
mode when the physical port is configured for Virtual Ethernet Port
Aggregator (VEPA):
1) A security problem for CVE-2022-34331 was addressed where switches
configured to monitor network traffic for malicious activity are not
effective because of errant adapter configuration changes. The
misconfigured adapter can cause network traffic to flow directly
between the VFs and not out the physical port hence bypassing any
possible monitoring that could be configured in the switch.
2) Packets may not be forwarded after a firmware update, or after
certain error scenarios which require an adapter reset. Users
configuring or using VEPA mode should install this update. These fixes
pertain to adapters with the following Feature Codes and CCINs:
#EC2R/EC2S with CCIN 58FA; #EC2T/EC2U with CCIN 58FB; and #EC66/EC67
with CCIN 2CF3.
Update instructions: https://www.ibm.com/docs/en/power10?topic=updates-sr-iov-firmware-update
- Security problems were fixed for vTPM 1.2 by updating its
OpenSSL library to version 0.9.8zh. Security vulnerabilities
CVE-2022-0778, CVE-2018-5407, CVE-2014-0076, and CVE-2009-3245 were
addressed. These problems only impact a partition if vTPM version
1.2 is enabled for the partition.
- A security problem was fixed for vTPM 2.0 by updating its
libtpms library. Security vulnerability CVE-2021-3746 was
addressed. This problem only impacts a partition if vTPM version
2.0 is enabled for the partition. The biggest threat from this
vulnerability is system availability.
- A security problem was fixed for the Virtualization
Management Interface (VMI) for vulnerability CVE-2021-45486 that could
allow a remote attacker to reveal sensitive information. This can
happen for session connections using IPv4.
- A security problem was fixed for the eBMC for vulnerability
CVE-2022-3435 that could allow a remote attacker to reveal sensitive
information from the eBMC. This can happen for session
connections using IPv4.
- A security problem was fixed for the eBMC HTTPS server
where a specially crafted multi-part HTTPS header, on a specific URI
only available to admin users, could cause a buffer overflow and lead
to a denial of service for the eBMC. This Common Vulnerabilities
and Exposures issue number is CVE-2022-2809.
- A security problem was fixed for a flaw in OpenSSL
certificate parsing that could result in an infinite loop in the
hypervisor, causing a hang in a Live Partition Mobility (LPM) target
partition. The trigger for this failure is an LPM migration
of a partition with a corrupted physical trusted platform module (pTPM)
certificate. This is expected to be a rare problem. The Common
Vulnerability and Exposure number for this problem is CVE-2022-0778.
- A problem was fixed where the eBMC ASMI user was not
informed that changing settings to enable or disable the eBMC's SSH or
IPMI service will take about 15 seconds to take effect, after
successfully changing the setting. The operation for changing the
setting does not take effect immediately. With the fix, the eBMC
ASMI user is given a message about this delay when performing the
operation.
|