Power7 High-End Power Subsystem Firmware
Applies to: 9119-FHB
This document provides information about the installation of
Licensed
Machine or Licensed Internal Code, which is sometimes referred to
generically
as microcode or firmware.
Contents
This package provides firmware for Power 795 (9119-FHB) Servers
only. Do not use on any other systems.
The firmware level in this package is:
HMC-Managed Systems
This firmware level requires HMC V7 R7.6.0.
Go to the following URL to access the HMC code packages:
NOTE: You must be logged in as hscroot in order for
the
firmware installation to complete correctly.
Use the following example as a reference to determine whether your
installation will be concurrent or disruptive.
Note: The file names and service pack levels used in
the
following examples are for clarification only, and are not
necessarily levels that have been, or will be released.
Power Subsystem firmware file naming convention:
02ABXXX_YYY_ZZZ
- XXX is the release level
- YYY is the service pack level
- ZZZ is the last disruptive service pack level
NOTE: Values of service pack and last disruptive service
pack level (YYY and ZZZ) are only unique
within a release level (XXX). For example, 02AB720_067_045 and
02AB730_067_053 are different
service packs.
An installation is disruptive if:
- The release levels (XXX) are different.
Example: Currently installed release is AB720, new release is
AB730
- The service pack level (YYY) and the last
disruptive service pack level (ZZZ) are equal.
Example: AB720_061_061 is disruptive, no matter what level of
AB720
is currently
installed on the system
- The service pack level (YYY) currently installed on the system
is lower than the last disruptive service pack level (ZZZ) of the
service pack to be installed.
Example: Currently installed service pack is AB720_120_120 and
new service pack is AB720_152_130
An installation is concurrent if:
- The service pack level (YYY) is higher than the service
pack level currently installed on your system.
Example: Currently installed service pack is AB720_061_061,
new service pack is AB720_070_061.
Firmware Information and Update Description
Filename |
Size |
Checksum |
02AB760_089_043.rpm |
19,300,317 |
28624 |
AB760_089_043 / FW760.51
04/16/2015
|
Impact:
Security Severity:
HIPER
Changes:
- Merely refreshing the BPC image - no functional changes.
New BPC FSP image is required for CEC FSP firmware code update process
to work correctly.
|
AB760_087_043 / FW760.50
01/09/2015
|
Impact:
Security Severity:
HIPER
Changes:
- A security problem was fixed in OpenSSL for padding-oracle
attacks known as Padding Oracle On Downgraded Legacy Encryption
(POODLE). This attack allows a man-in-the-middle attacker to obtain a
plain text version of the encrypted session data. The Common
Vulnerabilities and Exposures issue number is CVE-2014-3566. The
service processor POODLE fix is based on a selective disablement of
SSLv3 using the Advanced System Management Interface (ASMI) "System
Configuration/Security Configuration" menu options. The Security
Configuration options of "nist_sp800_131a", "nist_compat", and "legacy"
for affects the disablement SSLv3 and determines the level of
protection from POODLE. The management console also requires a POODLE
fix for APAR MB03867(FIX FOR CVE-2014-3566 FOR HMC V7 R7.9.0 SP1 with
PTF MH01484) to eliminate all vulnerability to POODLE and allow use of
option 1 "nist_sp800_131a" as shown below--
- 1)nist_sp800_131a (SSlv3 disabled)- This highest level
of security protection does not allow service processor clients to
connect using SSLv3, thereby eliminating any possibility of a POODLE
attack. All clients must be capable of using TLS v1.2 to make the
secured connections to the service processor to use this option. This
requires the management console be at a minimum level that has a poodle
fix such as HMC V7 R7.9.0 SP1 with POODLE PTF MH01484 or HMC V7 R7.8.0
SP2 with POODLE PTF MH01432 when it becomes available.
- 2)nist_compat (default mode - SSLv3 enabled for HMC)-
This medium level of security protection disables SSLv3 (TLS v1.2 must
be used instead) for the web browser sessions to ASMI and for the CIM
clients and assures them of POODLE-free connections. But the older
management consoles are allowed to use SSLv3 to connect to the service
processor. This is intended to allow non-POODLE compliant HMC levels to
be able to connect to the CEC servers until they can be planned and
upgraded to the POODLE compliant HMC levels. Running a non-POODLE
compliant HMC to a service processor in this default mode will prevent
the ASMI-proxy sessions from the HMC from connecting as these proxy
sessions require SSLv3 support in ASMI.
- 3) legacy (SSLv3 enabled)- This basic level of
security protection enables SSLv3 for all service processor client
connection. It relies on all clients being at POODLE fix compliant
levels to provide full POODLE protection using the TLS Fallback
Signaling Cipher Suite Value (TLS_FALLBACK_SCSV) to prevent fallback to
vulnerable SSLv3 connections. This legacy option is intended for
customer sites on protected internal networks that have a large
investment in older hardware that need SSLv3 to make browser and HMC
connections to the service processor. The level of POODLE protection
actually achieved in legacy mode is determined by the percentage of
clients that are at the POODLE fix compliant levels.
- A security problem was fixed in OpenSSL for memory leaks
that allowed remote attackers to cause a denial of service (out of
memory on the service processor). The Common Vulnerabilities and
Exposures issue numbers are CVE-2014-3513 and CVE-2014-3567.
- System gets stuck in Low Power Mode for certain Power Line
Disturbance events. Fix to take system out of this mode when
disturbance recovers.
- Post call home SRC when system is left in Low Power Mode
after failed DCA repair
- Detect and report errors on CFAM bus at DCA to reduce
length and complications of repair
- Add filtering to BPR firmware to prevent susceptibility to
350V bus noise that can cause erroneous overvoltage induced BPR power
off.
|
AB760_079_043 /
FW760.41
06/24/2014
|
Impact:
Security Severity:
HIPER
Changes:
- HIPER /Pervasive A security problem was fixed in the
OpenSSL (Secure Socket Layer) protocol that allowed clients and
servers, via a specially crafted handshake packet, to use weak keying
material for communication. A man-in-the-middle attacker could use this
flaw to decrypt and modify traffic between the management console and
the service processor. The Common Vulnerabilities and Exposures issue
number for this problem is CVE-2014-0224.
- HIPER /Pervasive A security problem was fixed in OpenSSL
for a buffer overflow in the Datagram Transport Layer Security (DTLS)
when handling invalid DTLS packet fragments. This could be used to
execute arbitrary code on the service processor. The Common
Vulnerabilities and Exposures issue number for this problem is
CVE-2014-0195.
- HIPER /Pervasive Multiple security problems were fixed in
the way that OpenSSL handled read and write buffers when the
SSL_MODE_RELEASE_BUFFERS mode was enabled to prevent denial of service.
These could cause the service processor to reset or unexpectedly drop
connections to the management console when processing certain SSL
commands. The Common Vulnerabilities and Exposures issue numbers for
these problems are CVE-2010-5298 and CVE-2014-0198.
- HIPER /Pervasive A security problem was fixed in OpenSSL to
prevent a denial of service when handling certain Datagram Transport
Layer Security (DTLS) ServerHello requests. A specially crafted DTLS
handshake packet could cause the service processor to reset. The Common
Vulnerabilities and Exposures issue number for this problem is
CVE-2014-0221.
- HIPER /Pervasive A security problem was fixed in OpenSSL to
prevent a denial of service by using an exploit of a null pointer
de-reference during anonymous Elliptic Curve Diffie Hellman (ECDH) key
exchange. A specially crafted handshake packet could cause the service
processor to reset. The Common Vulnerabilities and Exposures issue
number for this problem is CVE-2014-3470.
|
AB760_072_043 /
FW760.40
01/20/2014
|
Impact:
Availability Severity:
SPE
Changes:
- Frame input power information is not correctly returned to
the HMC for the second line cord when there are 3 BPRs per BPA
- Fix to no longer recover DCA power for internal hardware
resets if CEC node is critical (powered off from fault). This allows
normal SRC to be posted to improve servicability.
- Fix location codes used in part callouts for SRCs 1402328C
and 1402328B
- Fix to allow servicing of a DCA in a CEC that is already in
Low Power Mode if the HMC sends commands to BPA side B
- Fix to prevent erroneous posting of DCA to DCA
communication faults during code updates
- Fix to prevent system level power off if a critical CEC
node fault independently occurs before or during concurrent BPA service
|
AB760_066_043 /
FW760.30
06/24/2013
|
Impact:
Availability Severity:
SPE
Changes:
- Post error code if BPC bypass switch is left in bypass
position after service
- Fix cross-power cable's circuit breaker not being opened as
part of BPC service when mailbox cable is broken
- Detect and block service of power supplies that have been
left in voltage biased down condition
- Allow service procedure to continue if CEC node being
serviced for power supply repair is already in Low Power Mode from a
prior repair
- Add tests to detect and report a dead voltage level 6 on
5797/5798 I/O drawers
- Fix to prevent erroneous defective planar error posted
after power off of 5797/5798 I/O drawer
- Robustness added to various hardware recovery processes
|
AB760_055_043 /
FW760.20
02/26/2013
|
Impact:
Availability Severity:
SPE
Changes:
- When a BPA error condition is detected, BPA fan speeds will
be raised to a lower setting than the previous firmware level.
|
AB760_043_043
11/23/2012
|
Impact:
New Severity: NEW
Changes:
|
You can view the frame's current firmware level on the Advanced System
Management Interface (ASMI) Welcome pane. It appears in the top
right
corner. Example: AB720_061.
Follow the instructions on the web page. You must read and agree to
the license agreement to obtain the firmware packages.
Note: If your HMC is not internet-connected you will need to
download the new firmware level to a CD-ROM or ftp server.
The method used to install new firmware will depend on the release
level of firmware which is currently installed on your server. The
release level can be determined by the prefix of the new firmware's
filename.
Example: ABXXX_YYY_ZZZ
Where XXX = release level
- If the release level will stay the same (Example: Level
AB720_061_061 is currently installed and you are attempting to
install level AB720_081_061) this is considered an update.
- If the release level will change (Example: Level AB720_061_061
is currently installed and you are attempting to install level
AB730_096_096) this is considered an upgrade.
Instructions for installing firmware updates and upgrades can be found
at http://publib.boulder.ibm.com/infocenter/powersys/v3r1m5/index.jsp?topic=/p7ha1/updateschapter.htm