HMC V7 cumulative README

HMC V7 is supported on Power Systems with POWER6 or POWER5 processors.

[ Last updated: May 15, 2009 ]

Special upgrade instructions for HMC V7 R3.1.0

Note: HMC machine type 7315 cannot be upgraded to Version 7 Release 3.1.0. Only HMC machine type 7310 can be upgraded to HMC V7 R3.1.0. The minimum HMC level is V6 R1.2.

Customers with existing HMC machine type 7310 with V6 R1.2 or higher may upgrade to HMC V7 R3.1.0 by ordering the MES (Miscellaneous Equipment Specification) 0962 through their IBM Sales Representative or Business Partner. The HMC code V7 R3.1.0 may also be downloaded, but MES 0962 must still be ordered to complete the conversion from V6 to V7. The MES updates the HMC machine records to ensure continued product support. Machine records are not automatically updated when the code is downloaded so this requirement of ordering MES 0962 is displayed on the download web site for the MES. The MCRSA (Machine Control Program Remote Support Agreement) is common for HMC V4, V5, V6, and V7.

For information on converting HMCs from Version 6 to Version 7, please refer to the following document:

PTF-specific information

This section lists the PTFs released for HMC Version 7. The information for each PTF includes sections for enhancements and fixes, known issues (if applicable), and package information. The Package information section provides information to use during the download, installation and verification procedures for HMC packages. You can also access this PTF-specific information by clicking on the "View" link for any package on the "Downloads" pages of the HMC web site.

PTF MH01169

Fix for HMC Version 7 Release 3.3.0 Service Pack 3

This package includes fixes for HMC Version 7 Release 3.3.0 Service Pack 3 (MH01150). That is, PTF MH01150 must be installed before you install this fix. You can reference this package by APAR MB03007. This PTF replaces MH01161.

Note: You must perform an additional reboot of the HMC after the mandatory reboot required by installing MH01169.

Package information
Package name Size (bytes) Checksum APAR # PTF#
MH01169.iso
MH01169.zip
101926912
99579723
36107
32418
MB03007 MH01169
Splash panel information (lshmc -V command output)
"version= Version: 7
Release: 3.3.0
Service Pack: 3
HMC Build level 20090507.1
MH01169: Fix for HMC V7R3.3.0 SP3 (05-07-2009)
","base_version=V7R3.3.0
"

Fixes

This package includes the following fixes

PTF MH01161

Required Fix for HMC Version 7 Release 3.3.0 Service Pack 3

This package includes fixes for HMC Version 7 Release 3.3.0 Service Pack 3 (MH01150). MH01150 must be installed before you install this fix. You can reference this package by APAR# MB03032.

Package information
Package name Size (bytes) Checksum APAR # PTF#
MH01161.iso
MH01161.zip
39170048
34491662
58307
60540
MB03032 MH01161
Splash panel information (lshmc -V command output)
MH01161: Fill and drain fix for 9125-F2A; Lost PEL events (01-08-29)

Fixes

This package includes the following fixes

PTF MH01160

Required security fix for HMC Version 7 Release 3.2.0 Service Pack 1

This package includes fixes that are essential for HMC Version 7 Release 3.2.0 Service Pack 1. HMC V7R3.2.0 Service Pack 1 (MH01084), MH01101 and MH01133 must be installed before installing this fix. You can reference this package with APAR# MB02834.

Package information
Package name Size (bytes) Checksum APAR # PTF#
MH01160.iso
MH01160.zip
432128
17330
58428
00124
MB02834 MH01160
Splash panel information (lshmc -V command output)
MH01160: Security fix for HMC V7R3.2.0 (01-05-2009)

Fixes

This package includes the following fixes

Security patch for HMC 7.3.2.0 SP1

PTF MH01150

HMC V7R3.3.0 Update package

This package updates your HMC from HMC V7R3.3.0 Service Pack 2 to HMC V7R3.3.0 Service Pack 3. You can also reference this package by APAR MB02772. This PTF replaces MH01119, MH01130, MH01134 and MH01146. If your HMC is at V7 R3.3.0 SP0 (MH01097) or V7 R3.4.0 SP1 (MH01105), you must first install V7 R3.3.0 SP2 (MH01119) before installing this update.

Note: You must perform an additional reboot of the HMC after the mandatory reboot required by installing MH01150.

Package information
Package name Size (bytes) Checksum APAR # PTF#
HMC_Update_V7R330_SP3_1.iso
HMC_Update_V7R330_SP3_1.zip
122064896
119517791
51002
35754
MB02772 MH01150
Splash panel information (lshmc -V command output)
"version= Version: 7
Release: 3.3.0
Service Pack: 3
HMC Build Level 20081119.1
","base_version=V7R3.3.0
"

Enhancements and fixes

This package includes the following fixes and enhancements:

PTF MH01146

CIM Object Manager fix for HMC V7R3.3.0

One must install HMC V7R3.3.0 SP2 (MH01119), MH01130 and MH01134 before installing this fix. This package may also be referenced by APAR MB02753.

Package information
Package name Size (bytes) Checksum APAR # PTF#
MH01146.iso
MH01146.zip
13004800
11973064
47867
52623
MB02753 MH01146
Splash panel information (lshmc -V command output)
MH01146: HMC performance, upgrade fix (10-21-2008)

Fixes

This package includes the following fixes:

PTF MH01135

HMC V7R3.1.0 upgrade fix

HMC V7R3.1.0 (MH00998) must be installed before installing this fix. You can also reference this package by APAR MB02661.

Package information
Package name Size (bytes) Checksum APAR # PTF#
MH01135.iso
MH01135.zip
409600
7336
49690
50287
MB02661 MH01135
Splash panel information (lshmc -V command output)
MH01135: Enable Upgrading to V7R3.4.0 (09-22-2008)

Fixes

This package includes the following fix:

Fix to enable the ability to upgrade the HMC from V7R3.1.0 to V7R3.4.0.

PTF MH01134

HMC V7R330 Service Pack 2 security fix

HMC V7R3.3.0 Service Pack 2 (MH01119) and MH01130 must be installed before installing this fix. You can also reference this package by APAR MB02485.

Fixes

This package includes the following fixes:

Package information
Package NameSizeChecksumAPAR#PTF#
MH01134.iso
MH01134.zip
30912512
29683295
17913
20630
MB02485 MH01134

Splash panel information (or lshmc -V output)

MH01134: Prevent invalid client packet length from terminating RMC daemon (09-26-2008)

PTF MH01133

HMC V7R320 Service Pack 1 security fix

HMC V7R3.2.0 Service Pack 1 (MH01084) and MH01101 must be installed before installing this fix. You can also reference this package by APAR MB02482.

Fixes

This package includes the following fixes:

Package information
Package NameSizeChecksumAPAR#PTF#
MH01133.iso
MH01133.zip
29806592
28607337
36758
56202
MB02482 MH01133

Splash panel information (or lshmc -V output)

MH01133: Prevent invalid client packet length from terminating RMC daemon (09-26-2008)

PTF MH01130

HMC V7R330 Service Pack 2 CEC DCA Deactivation fix

This fix is installed on HMC V7R3.3.0 Service Pack 2 (MH01119). You can also reference this package by APAR MB02481.

Fixes

This package includes the following fixes:

This issue applies to IBM Power 595 systems managed by HMCs running V7.3.3.0 Service Pack 2: Repair and Verify will not work if you use the SRC to replace a defective PU Book DCA. SRCs 14012x51 or 14012x52 (where x is 2-9) will identify a defective PU Book DCA. If you are following Repair and Verify via the SRC, then the HMC will not deactivate the PU BOOK DCA. As a result, the PU Book DCA LED remains on. If the repair steps continue, then the PU Book DCA would be pulled hot and cause the system to crash.

This PTF also includes the fix for PTF MH01126 which has been removed from the web. PTF MH01126 addressed the following:

Package information
Package NameSizeChecksumAPAR#PTF#
MH01130.iso
MH01130.zip
101337088
99006582
23435
16022
MB02481 MH01130

Splash panel information (or lshmc -V output)

MH01130: Fix for CEC DCA deactivation problem (08-29-2008)

PTF MH01126

HMC V7R330 Service Pack 2 fix for 9125-F2A models

This fix is installed on HMC V7R3.3.0 Service Pack 2 (MH01119). You can also reference this package by APAR MB02827.

Note: MH01126 is an optional PTF only needed for customers that have HMCs that manage model 9125-F2A systems.

Fixes

This package includes the following fixes.

Package information
Package NameSizeChecksumAPAR#PTF#
MH01126.iso
MH01126.zip
54786048
52525637
18417
42522
MB02827 MH01126

Splash panel information (or lshmc -V output)

MH01126: Fixes for Fill and Drain tool (08-07-2008)

PTF MH01119 HMC 7.3.3 service pack

HMC V7R3.3.0 Service Pack 2 update package

This package updates your HMC from HMC V7R3.3.0 Service Pack 0 or HMC V7R3.3.0 Service Pack 1 to HMC V7R3.3.0 Service Pack 2. It replaces MH01105, MH01108 and MH01113. You can also reference this package by APAR MB02400.

Note: You must perform an additional reboot of the HMC after the mandatory reboot required by installing MH01119.

Package information
Package NameSizeChecksumAPAR#PTF#
HMC_Update_V7R330_SP2_1.zip
HMC_Update_V7R330_SP2_2.zip
343330896
605000850
59039
50847
MB02400MH01119
HMC_Update_V7R330_SP2_1.iso
HMC_Update_V7R330_SP2_2.iso
343730176
607860736
17312
06829

Splash panel information (or lshmc -V output)

"version= Version: 7
Release: 3.3.0
Service Pack: 2
HMC Build Level 20080729.1
","base_version=V7R3.3.0
"

Enhancements and fixes

Server and Partition Management

Platform Management

Problem Analysis

Repair and Verify

System Plan

PTF MH01108

Security fixes for HMC 7.3.3.0

This fix must be installed on HMC 7.3.3.0 Service Pack 1 (PTF MH01105). If the optional fix provided in MH01113 is needed, install MH01113 before you install this fix.

A reboot of the HMC is not required after you install this fix package.

You can also reference this package by APAR MB02307.

Fixes

This package includes the following fix.

Fixes a problem where modification to Kerberos and LDAP configuration on the HMC incorrectly updates PAM configuration files. This situation can lead to improper authentication.

Package information
Package NameSizeChecksumAPAR#PTF#
MH01108.iso
MH01108.zip
417792
8088
47261
13016
MB02307 MH01108

Splash panel information (or lshmc -V output)

MH01108: Fix Kerberos/LDAP configuration problems (06-27-2008)

PTF MH01113

HMC V7.3.3.0 fix for OEM synergy brand field

This fix is an optional PTF. It is required only by OEM partners to support their different brand fields. IBM-branded servers do not need this fix.

This fix is pre-installed on HMC V7R3.3, so you will see the fix on the HMC splash panel (or lshmc -V output).

Since this PTF is not needed for IBM servers, the fix is not orderable or downloadable and this information is on the website for informational purposes.

This fix is installed on HMC V7R3.3.0 Service Pack 1 (MH01105).

Splash panel information (or lshmc -V output)

MH01113: Support for new T0 Synergy brand (06-02-2008)

PTF MH01105 HMC 7.3.3 service pack

HMC V7.3.3.0 Service Pack 1

This package updates your HMC from HMC V7R3.3.0 Service Pack 0 to HMC V7R3.3.0 Service Pack 1. You can also reference this package by APAR MB02290. This package replaces PTF MH01102.

Note: You must perform an additional reboot of the HMC after the mandatory reboot required by installing MH01105.

Package information
Package NameSizeChecksumAPAR#PTF#
HMC_Update_V7R330_SP1_1.zip
HMC_Update_V7R330_SP1_2.zip
HMC_Update_V7R330_SP1_1.iso
HMC_Update_V7R330_SP1_2.iso
315871184
594045740
316256256
596783104
12934
39917
46465
15544
MB02290MH01105

Splash panel information (lshmc -v output)

"version= Version: 7
Release: 3.3.0
Service Pack: 1
HMC Build Level 20080518.1
MH01105: V7R3.3.0 Service Pack (05-18-2008)
","base_version=V7R3.3.0

Enhancements and fixes

PTF MH01102 - Required fix

This fix has been replaced by MH01105.

This package includes fixes that are essential for HMC Version 7 Release 3.3.0 Service Pack 0. This is a MANDATORY efix. If you install MH01097 (HMC V7R3.3.0SP0) then you must install MH01102.

Note: You must perform an additional reboot of the HMC after the mandatory reboot required by installing MH01102.

Package information
Package NameSizeChecksumAPAR#PTF#
MH01102.iso
MH01102.zip
595890176
593160813
24085
55399
MB02285 MH01102
Splash panel information (or lshmc -V output)
MH01102: Required fix for HMC V7R3.3.0 (04-21-2008)

PTF MH01097 HMC V7R3.3.0 Recovery media

This package represents the Recovery image that can be used to upgrade your HMC from HMC V7R3.1.0 or HMC V7R3.2.0 to HMC V7R3.3.0. This package can also be used to install a clean version of HMC V7R3.3.0. You can also reference this package by APAR MB02269.

Special installation and upgrade notes

Notes

  1. For HMCs managing POWER5 servers: If your HMC is at HMC V6 R1.2 or V6 R1.3, upgrading your HMC to HMC V7 R3.3.0 is a two-step process. You must first upgrade the HMC to HMC V7 R3.1.0, and then upgrade to HMC V7 R3.3.0.
  2. The HMC 7.3.3.0 service pack updates are not upgrade packages. That is, they do not upgrade a lower level of HMC V7 to HMC V7 R3.3.0. They are service packs for HMC 7.3.3.0 only. Upgrading from HMC 7.3.2.0 or HMC 7.3.1.0 requires the use of the HMC 7.3.3.0 recovery media.
  3. After you install V7R3.3.0, you must install PTF MH01105. You must perform an additional reboot of the HMC after the mandatory reboot required by installing MH01105

Package information and notes

Package NameSizeChecksumAPAR#PTF#
HMC_Recovery_V7R330_1.iso
HMC_Recovery_V7R330_2.iso
1594570752
1375275008
56682
50911
MB02269 MH01097
Splash Panel information (or lshmc -V output)
Version: 7
Release: 3.3.0
Service Pack: 0
HMC Build level 20080408.1
","base_version=V7R3.3.0

Enhancements and Fixes

This package provides the following enhancements and fixes:

Server and Partition Management


Platform Management


Command Line


Licensed Internal Code (LIC) update


Scheduled Operations


Problem Analysis

Improved problem reporting and call home data to include additional component logging for processor related recoverable errors.


Service Agent


Help

Enhancements and updates were made to the help documentation.


Repair and Verify


System Plan

National Language Support in HMC V7R3.3.0

The NLS support remains the same but there are these known issues:

Security Fixes

FixDescription
CVE=2007-5612Security Vulnerability in L1 agent (Pegasus CIM object manager)
CVE-2007-5707
CVE-2007-5708
SECURITY: openldap2 remote denial of service
FIX_BY_IBMSECURITY: Pegasus CIM object manager - CVE-2008-0003 PAM Callback stack buff...
CVE-2007-4135SECURITY: nfsidmap name - uid translation flaw
CVE-2007-4752SECURITY: openssh X11 cookie and SIGALRM fixes
CVE-2007-2445SECURITY: libpng DOS
CVE-2007-2442
CVE-2007-2443
CVE-2007-2798
SECURITY: krb5 remote code execution
CVE-2007-2754SECURITY: freetype remote code execution
CVE-2007-2926SECURITY: bind DNS cache poisoning
CVE-2007-3387
CVE-2007-3798
SECURITY: findutils local vulnerability
CVE-2007-3798SECURITY: tcpcump BGP packet handler overflow

HMC ports

PortsProtocolApplication nameDescriptionEnabled by default
22 TCP ssh.name Allows remote secure shell access No
443
9960
TCP SecureRemoteAccess.name Allow access to the HMC via remote web browser No
5989 TCP pegasus.name Allows access to OpenPegasus Server Yes
5988
9197
TCP CSM_SNIA.name SNIA CIM for Cluster System Management No
657 TCP/UDP RMC.name Allows access between HMC and partitions Yes
9920
9900
TCP/UDP FCS.name Allow HMC to HMC communication Yes
9735 TCP vtty.name Allows remote virtual terminal access Yes
2302 TCP vtty_proxy.name Allows remote virtual terminal access Yes
2300
2301
TCP i5250.name 5250 terminal access Yes
123 UDP ntp.name Network Time Protocol No
1701 UDP l2tp.name Allows the HMC to share its modem with an i5 OS partition Yes
427 UDP SLP.name Allows the HMC to receive and respond to Service Location Protocol service Yes
12347
12348
UDP RPD.name Allow group communication and aliveness UDP packets produced by RSCT subsystems. This is required when forming an RSCT Peer Domain across multiple HMCs. Yes
8899 TCP hwserver.name Allow hardware servers between CSM and HMC, or between HMCs to communicate. This is required for FNM to log errors and report to the ELA master on HMC. RSCT Peer Domains must also be enabled for this to work properly Yes
162 TCP/UDP snmptrap.name Receive Simple Network Management Protocol (SNMP) Trap messages. No
Incoming ping Echo-request:icmp ping.name Allow the HMC to respond to the ping network utility. Yes

The chhmc command can be used to change the firewall settings for each of the applications in the preceding table.

Examples:

To disable access to port 5989 for OpenPegasus on network interface eth0:
chhmc -c pegasus.name -s remove -a 0.0.0.0 -nm 0.0.0.0 -i eth0

To enable access to port 123 for NTP on network interface eth0:
chhmc -c ntp.name -s add -a 0.0.0.0 -nm 0.0.0.0 -i eth0

Known Issues in HMC V7R3.3.0

PTF MH01101

Description

Miscellaneous fixes for HMC V7R3.2.0

Replaces MH01100. Install HMC V7R3.2.0 Service Pack 1 before installing this fix.

Package information

Package name Size (bytes) Checksum APAR # PTF#
MH01101.zip
MH01101.iso
71888041
76718080
19620
02747
MB02284 MH01101

Enhancements and fixes

The following fixes are addressed in this PTF:

  • Corrected a problem with IBM.ServiceRM core dumping and reporting SRC E32D040A for call home when more than one partition has "Redundant Reporting" enabled.
  • Inventory collection using IBM Director fails.
  • Corrected a performance problem when multiple HMC user profiles are defined.
  • Corrected a problem where saving an i5/OS partition profile that has no alternate restart device would cause an activate to fail with HSCL058A and either HSCL146A or HSCL1517.
  • Corrected a problem with the Kerberos login after installing V7R3.2.0 Service Pack 1 (MH01084).
  • Corrected a problem where non-hscroot user profiles using 'View Hardware Topology' would receive a blank or out-of-date view of the topology.
  • Corrected a performance problem when the HMC was connected to IBM Director.

Splash panel information (lshmc -V command output)

MH01101: Miscellaneous fixes for HMC V7R320.

PTF MH01100

Description

Service Agent call home fixes.

Install HMC V7R3.2.0 Service Pack 1 before installing this fix.

Package information

Package name Size (bytes) Checksum APAR # PTF#
MH01100.zip
MH01100.iso
70360981
75173888
07686
56598
MB02281 MH01100

Enhancements and fixes

The following fixes are addressed in this PTF:

  • Fix for multiple calls home of a E332FFFF refcode. That refcode indicates that a javacore and/or a java heapdump has been discovered and is being called home.
  • Fix for Service Agent being unable to generate remote support call when any of the following data areas contains any character that is not contained in the US-ASCII (Latin alphabet).
    • On the Administrator tab of the Manage Customer Information panel:
      • Company name:
      • Phone number:
      • Street address:
      • Street address 2:
      • City or locality:
      • Postal code:
    • On the System tab of the Manage Customer Information panel:
      • Street address:
      • Street address 2:
      • City or locality:
      • Postal code:
  • Fix for a problem associated with the concurrent repair of GX+ adapter in release EL320_031 or EL320_040.

Splash panel information (lshmc -V command output)

MH01100: Fix for Service Agent call home problems. (03-16-2008)

PTF MH01084

Description

HMC V7R3.2.0 Update Package.

This package updates your HMC from HMC V7R3.2.0 Service Pack 0 to HMC V7R3.2.0 Service Pack 1.

Note: replaces MH01062, MH01067, and MH01081.

Package information

Package name Size (bytes) Checksum APAR # PTF#
HMC_Update_V7R320_SP1.zip
HMC_Update_V7R320_SP1.iso
521500784
526520320
27630
35561
MB02252 MH01084

Enhancements and fixes

The following fixes are addressed in this PTF:

  • Server and Partition Management:
    • Fix to getupgfiles computing checksum.
  • Platform Management:
    • Corrected a problem where a null pointer exception error was reported as call home SRC E355104C when a user logged off the HMC while the HMC was processing a response for a session that had already been destroyed.
    • The logon page was changed for Internet Explorer to leave the logon button disabled (greyed out) until a java applet is successfully run.
  • Media Services:
    • Improved media services to recognize USB connected DVD drives.
  • Call Home:
    • Corrected a problem with trace buffers that resulted in a call home SRC E2FF1801.
  • Problem Analysis:
    • Enhanced FEDC collected and transmitted for system monitoring detected SRC E212E151.
    • Fixed problem with collection of logs copyLogs script resulting in error "too many arguments".
  • Repair and Verify:
    • Improved Repair Verify service procedures to ensure that messages directing the user to refer to FRU LED's are not missed.
    • Enhanced Resource Constraint detected message to be more meaningful to the user.
    • Updated RV procedures to include 8204-E8A server pictures.
    • Updated RV service actions to include the proper isolation procedures for 8204-E8A power FRU's.
    • Corrected a problem where a concurrent add of an enclosure in 9406-MMA resulted in a failure.
  • System Plan:
    • Corrected a problem with create or deploy system plan failing with Inventory Scout message " Inventory Gathering Error".
  • Licensed Internal Code (LIC) Update:
    • Fix for E302F842 code update error when updating from firmware level 01EM310_048.
  • Known issues in HMC V7R3.2.0:
    • Concurrent FRU replacement of Feature Code 1802 GX Dual Port 12X Channel Attached Adapter fails with a Null exception when the operation is performed from an HMC at levels V7R3.2.0 base or V7R3.2.0 with Service Pack 1 installed. The failure will occur during the reconfiguration steps which follow the physical adapter replacement. Recovery of the adapter and it's attached resources will require a platform IPL. This issue is resolved with the installation of PTF MH01100.
    • Remote web based user interface using Internet Explorer version 6, java: 1.5.x, the logon button is greyed out. To resolve this issue, install the latest available version of supported Java Runtime Environment (JRE) (i.e.: 1.6) for your browser. Then erase all temporary Internet files, cookies, etc. Then close and relaunch the browser.

Splash panel information (lshmc -V command output)

version= Version: 7
Release: 3.2.0
Service Pack: 1
HMC Build Level 20080216.1
","base_version=V7R3.2.0

PTF MH01081

Description

Pegasus CIM server Security fix, new DST updates and Code Update fix.

Note: HMC V7R3.2.0, MH01062 and MH01067 must be installed before installing this fix.

Package information

Package name Size (bytes) Checksum APAR # PTF#
MH01081.zip
MH01081.iso
61489144
62109696
50626
04741
MB02236 MH01081

Fixes

The following fixes are addressed in this PTF:

  • Pegasus CIM Server Denial of Service Security fix.
  • Fix for Code Update failures with E302F842, B1818A0D and B1818A0E.
  • The following Daylight Savings Time (DST) updates:
    • Argentina: Changes to DST starting on 30 Dec 2007.
    • Venezuela: Changes to offset starting 09 Dec 2007.
    • Brazil: Changes to DST starting 14 Oct 2007.
    • Australia: Changes to DST starting 06 Apr 2008.
    • New Zealand: Extension of DST by 3 weeks starting 30 Sep 2007.
    • US, Canada, Bermuda, and Bahamas: Adjusting the DST start and end dates in 2007 and beyond.
    • Western Australia: Providing support for DST starting on 03 Dec 2006.
    • Brazil: Adjustments for the 2006-2007 DST period.

Splash panel information (lshmc -V command output)

MH01081: Pegasus CIM security fix, code update fix, and new DST updates. (01-09-2008)

PTF MH01067

Description

Partition Mobility and Scheduled Ops for Power Management.

Note: MH01067 replaces MH01065. You must install MH01062 before installing MH01067. If you reinstall MH01062, then you must reinstall MH01067.

Package information

Package name Size (bytes) Checksum APAR # PTF#
MH01067.zip
MH01067.iso
74398411
79224832
00255
23464
MB02235 MH01067

Fixes

The following fixes are addressed in this PTF:

  • Fix for scheduling power saver mode enablement or disablement.
  • Fix for partition migration to recover from failures.
  • Fix for system plan creation failure when running hardware discovery for unassigned I/O.

Splash panel information (lshmc -V command output)

MH01067: Partition Mobility and Scheduled Ops for Power Management (11-15-2007)

PTF MH01065

Description

HMC Security: Privilege escalation by some HMC commands

You must install MH01062 before installing this fix. If you reinstall MH01062, then you will also need to reinstall MH01065.

Package information

Package name Size (bytes) Checksum APAR # PTF#
MH01065.zip
MH01065.iso
26895159
27705344
30186
23246
MB02226 MH01065

Fixes

The following fixes are addressed in this PTF:

  • Security fix CVE-2007-5135: openssl off-by-one overflow.
  • Fix for security exposure in some HMC commands.

Splash panel information (lshmc -V command output)

MH01065: HMC Security: privilege escalation by some HMC commands (11-12-2007)

PTF MH01062

Description

Required Fix for HMC Version 7 Release 3.2.0 Service Pack 0

Package information

Package name Size (bytes) Checksum APAR # PTF#
MH01062.zip
MH01062.iso
472581698
477810688
61346
13149
MB02153 MH01062

Splash panel information (lshmc -V command output)

MH01062: Required fix for HMC V7R3.2.0 (11-08-2007)

Fixes

The following fixes are addressed in this PTF:

  • Provided fix for partition migration failure when virtual Ethernet failover is configured and the Ethernet adapter on one of the VIO servers is not functional.
  • Fixed an issue where unexpected characters were being displayed on panels in double byte language locales.
  • Corrected a problem in the procedure to change the network types from private to public or from public to private that caused the DHCP server to cease operation until a HMC reboot is initiated.
  • Corrected a problem on the HMC model CR4 where a change in the speed/duplex of an integrated Ethernet adapter from Auto_negotiation to another value is not maintained after a reboot.
  • Corrected a problem with MMA fan FRU that caused the exchange procedure to be run non-concurrently when it is a concurrent operation.
  • Fixed problem with LoginGraceTime not enforced by sshd.

PTF MH01060

Description

Updates your HMC from HMC V7R3.1.0 to HMC V7R3.2.0.

Package information

Package name Size (bytes) Checksum APAR # PTF#
HMC_Update_V7R320_1.zip
HMC_Update_V7R320_2.zip
HMC_Update_V7R320_1.iso
HMC_Update_V7R320_2.iso
448843903
587757793
450058240
593747968
21397
28531
55065
30828
MB02134 MH01060

Splash panel information (lshmc -V command output)

Version: 7 Release: 3.2.0
Service Pack: 0
HMC Build level 20071018.1
","base_version=V7R3.2.0

Fixes

The following fixes are addressed in this PTF:

This package updates your HMC from HMC V7R3.1.0 to HMC V7R3.2.0. You can also reference this package by APAR MB02134. All enhancements and fixes included in this package is the same as for PTF MH01059.

Server and Partition Management

  • I/O Reporting Partition (Hardware Discovery). Available only for POWER6 hardware.
    • Provides summary of I/O attached to the system pre-OS for configuration.
    • Provides HMC users more detailed view of slot contents including child devices.
    • Allows administrators to view Ethernet MAC addresses and FibreChannel WWNs from the HMC before partitions are configured.
    • Provides detailed inventory to System Plan Tool to verify system configuration and validate customer orders
  • Ability to create multiple virtual processor pools, providing easier license management by capping the number of processor cycles that can be consumed by a group of uncapped logical partitions.
  • Partition mobility - a new HMC function, on systems that are capable to use this function, that enables moving a partition from one managed system to another. The active partition mobility function provides the HMC administrator the ability to non-disruptively move a running partition, with its operating system and applications, profiles, and virtualized resources, across two capable and compatible servers that are under the control of the same HMC. The inactive partition mobility function provides the ability to move an inactive, powered-off partition, with its profiles and virtualized resources, across two servers that are under the control of the same HMC.
  • Support for redundant POWER6 FSP failover.

Platform Management

  • Added support to allow the use of Kerberos to authenticate users on HMC. Users are created on the local HMC, but uses a remote Kerberos server for authentication.
  • Added support to setup Kerberos Key Distribution Center (KDC) server configuration.
  • Corrected Manage Dumps task handling of dump parameters for a POWER5 server.
  • Redundant FSP enhancements and corrections.
  • Added a Deactivate Attention LED task that allows a user to deactivate the attention LED's on multiple servers and/or partitions. This new task simplifies the previous methods for deactivating LED's, View System Attention tasks for systems and Manage Attention LED for partitions, which were single target tasks.
  • Corrected a problem where a FSP dump could not be initiated from HMC when system is in poweron state giving unrecoverable error message.
  • Added console log events for adding and deleting NTP servers to create audit trail.
  • Corrected a problem in the HMC backup critical console data task where it does not detect specific permission problem on a remote directory on the ftp server. This problem prevented backup from completing although a message was displayed that indicated the task completed successfully.
  • Corrected errors that caused mail to be sent to the HMC console resulting in performance degradation on the HMC.
  • Corrected an issue with backup of the HMC where their HMC archive data may be directed to an unknown location. If the user did NOT specify an optional directory to offload their HMC archive to, there will be an internal 'cd /' issued from within the ftp session. Where that directs their data depends on how their ftp server is set up. It may be re-directed to user's home directory or to their ftp server's physical "/" directory.
  • Corrected an issue with the HMC interface with multiple column tables where a sort option was not performing correctly.
  • Corrected user interface code to handle the change in formatting of the V7 HMC model type and display the information correctly.
  • Corrected a problem in Systems Management where a user could not toggle between Capacity on Demand and default views using MS Internet Explorer V6.0.
  • Fixed a problem where data replication of 'Group Data' failed to replicate changes to any of the slave HMCs.
  • Corrected a problem where the HMC User Interface Task Bar was flashing continuously.
  • Updated the Network Settings task's reboot/restart requirements. A reboot is no longer required for most modifications to network settings.
  • Enhanced Partition Availability Priority user interface.
  • Miscellaneous improvements to the Guided Setup Install Wizard.
  • Corrected the deployment of the main HMC user interface window to adjust the screen height on the local console.
  • Corrected a problem when using a context menu or drop-down menu in the HMC Work Pane, the opened menu will freeze.
  • Corrected an error found when using the provided icon or drop down options to filter a table to reduce the number of visible rows. Instead of only rows that are NOT filtered out being selected, all rows of the table are selected.
  • Corrected problems seen on an HMC console with more than one console active (local and remote), where tasks were not visible and panels were not fully rendered.
  • Corrected a problem with Network Settings when attempting to return the network interface from an open, non-DHCP Server configuration (on the private subnet shared with the FSPs and DHCP Server) to a previous private, DHCP Server configuration.
  • Corrected a problem in Manage Task and Resource Roles with copying the customized resource roles.
  • Clarified and handled the field 'No IPv4 address' on the Change Network Settings/Adapter Details panel.
  • Enhanced HMC User Roles so that users assigned Super User roles (hmcsuperadmin) will be able to customize their individual user settings independently of other HMC Super Users. Previously all user assigned Super User roles shared user settings.
  • Added help to Customizable Data Replication for "Customer Information" data.
  • Enhanced Change User Password task user interface.

Power Management

  • With power saver mode capable system, customers can enable this feature through HMC to save power by dropping the voltage and frequency to a fixed percentage.
  • Customers can now schedule the power saver mode feature through the schedule operations task by selecting a managed system.
  • IBM Systems Director Active Energy Manager can collect trending information and perform other advanced EnergyScale features by utilizing HMC's network connections to managed systems.
  • For more information on EnergyScale feature, refer to the white paper for IBM EnergyScale for POWER6 Processor-Based Systems.

Service Management

  • Enhanced the HMC Serviceable Event feature to not only provide Serviceable Events for the managed system, but to now also include Serviceable Events for the HMC.
  • SNMP traps were extended to generate HMC related notices.
  • New HMC monitored resources including:
  1. CCFW JVM activity.
  2. Total HMC system usage.
  3. Individual process usage.
  4. Disk partition utilization.
  • A new command, chhmcfs, was created to manage log files.
  • Enhanced ServiceRM to handle increased number of partitions in a single PHYP based system.
  • The design ServiceRM was enhanced to control the flow of data between itself, the RMC daemon and the client on the HMC to better handle memory and alleviate contention for resources.
  • ServiceRM was also modified from handling RMC requests one at a time to handling multiple requests. Previously, if one request did not complete the subsequent requests would be queued and resulting in possible deadlock. Now requests are honored with multiple threads.

Command Line

  • The following commands have been added to manage HMC file system disk space usage:
    • chhmcfs - frees up space in HMC file systems
    • lshmcfs - lists HMC file system disk space usage information
  • A new command, rnvi, has been added to enable HMC users to edit text files in a restricted mode.
  • The following commands have been added to configure and list power management settings for a managed system (POWER6 servers only):
    • chpwrmgmt - changes power management settings
    • lspwrmgmt - lists power management settings
  • The following commands have been added to support partition mobility (POWER6 servers only):
    • lslparmigr - lists partition migration information
    • migrlpar - performs a partition migration operation
  • The following commands have been enhanced to support partition mobility (POWER6 servers only): chsyscfg, lssyscfg, and mksyscfg.
  • The following commands have been added to support Kerberos configuration on the HMC:
    • getfile - gets and deploys the Kerberos service key (keytab) file on the HMC
    • rmfile - removes the Kerberos service key (keytab) file from the HMC
  • The following commands have been enhanced to support Kerberos configuration on the HMC and remote Kerberos authentication: chhmc, lshmc, chhmcusr, lshmcusr, and mkhmcusr.
  • The following commands have been enhanced to support multiple shared processor pools (POWER6 servers only): chsyscfg, lssyscfg, mksyscfg, chhwres, lshwres, and lslparutil.
  • The following commands have been enhanced to support hardware discovery (POWER6 servers only): chsysstate and lshwres.
  • A new option has been added to the chhmc command to set the SSH protocol version for the HMC to use.
  • The chhmc and lshmc commands have been enhanced to support enabling and disabling remote web browser access to the HMC.
  • A new -s option has been added to the getupgfiles command to allow secure FTP to be used to transfer the upgrade files.
  • The lssyscfg -r sys command has been changed. The sp_failover_enabled and sp_failover_state attributes are no longer output unless the -F option is specified on the command. Now those attribute values will only be displayed if either the -F option is specified with no attribute names, or if the sp_failover_enabled and sp_failover_state attribute names are specified with the -F option.
  • The -o noprobe option for the mksysplan command has been deprecated. It has been replaced by the --noprobe option. In addition, two new options for inventory collection have been added to the mksysplan command: --nohwdisc and --noinvscout.
  • A new option has been added to the sendfile command to allow the user to specify the name of the file on the remote system.
  • A new option has been added to the updlic command to synchronize Licensed Internal Code on redundant service processors, and also on redundant Bulk Power Controllers.
  • Hardware Discovery command line enhancements:
    • chsysstate -r sys will include the new option onhwdisc
    • lssyscfg -r sys will display the new cec capability for Hardware Discovery, hardware_discovery_capable
    • lssyscfg -r lpar will display the new lpar definition state for Hardware Discovery in the lpar_env and lpar_type attribute.
    • lssyscfg -r lpar will display the new VSP definition state for Hardware Discovery in the state attribute.
    • lssyscfg -r prof will display the new lpar definition state for Hardware Discovery in the lpar_env attribute.
    • lshwres -r io -rsubtype will include a new type slotchildren to list Hardware Discovery slot information

 

Licensed Internal Code (LIC) update

  • Enhanced Code Update logic to disallow accept/reject if all components are running on the "wrong" flash side:
    • If all components are on the T side, the reject option is grayed out in the GUI, and the "updlic -o j" command will give the following error message:
      • The reject operation cannot be performed because all components are running on the temporary flash side.
    • Likewise, if all components are on the P side, the accept option is grayed out in the GUI, and the "updlic -o c" command will give the following error message:
      • The accept operation cannot be performed because all components are running on the permanent flash side.
    • If there is a mixture of components on the T and P sides, the accept/reject operations can be performed to the subset of components that are on the correct side for the operation (i.e. those running on T side for accept and those running on P side for reject). In this situation, a message will be displayed to the user asking if they wish to continue.
  • Enhanced estimated time values.
  • Amended Code Update to make E302F8A5 an informational log instead of an error log when exceptions are received from lslic command in an effort to determine HMC code update ownership.
  • Corrected a code update issue where if multiple updates were started at approximately the same time but to different repositories the data from one repository survey could be overwritten by the second.
  • Corrected code update to support updating of systems that have only one BPC.

Scheduled Operations

  • Added support to Scheduled Operations for Utility Capacity on Demand (CoD). There are two different scheduled operations for Utility CoD:
    • Moving Utility CoD processors in/out of the shared processor pool. This will be accomplished via the chcod command.
    • Setting the maximum Utility CoD minute usage limit. The idea is that the customer could schedule the setting of this limit on a monthly basis, therefore implementing a monthly Utility CoD minute usage limit. This will be accomplished via the chcod command.
  • Corrected Scheduled Operations Backup Profile Data to include a --force parameter to always overwrite any pre-existing backup file.
  • Corrected a problem seen in Dynamic configuration Scheduled Operation View Details. This was an issue that only affects Dynamic Reconfiguration Scheduled Operation that were migrated from the 6.1.2 HMC.

Problem Analysis

  • Corrected handling of contention for dumps from 2 HMC's to prevent the incorrect HMC from retrieving the dump and multiple call homes for the same error. A serviceable event will be created on one of the HMC's indicating a dump could not be retrieved.
  • Enhanced Dump Manager to track call home status and problem association.
  • Enhanced SFP Serviceable Event Overview sorting.
  • Modify serviceable event text for PEL-based events to not include PEL severity information.
  • Enhanced call home data to include a reference code summary file to provide a more concise, complete, and readable version of the serviceable event data that includes all serviceable events on the HMC.
  • Amended refcode lookup code to handle the refcode format passed in via the partition view's refcode column that includes the partition as part of the input. (e.g. B2004158 LP=002)
  • Added a busy/processing window to eServer Registration process interface so that it is apparent that background processing is going on.

Service Agent

  • Change to handle 9 character refcodes.
  • Corrected a problem with remote session when running with Firefox browser handling password updates and resets.

Repair and Verify

  • Added support to concurrently add a new GX adapter as an upgrade and for the concurrent (cold) repair support for GX Adapters. The adapter must be deconfigured/garded during IPL/reIPL prior to the repair.
  • Added support for I/O Drawers MTM 7041-SD1, Feature Code 5886, and MTM 7214-1U2. Since these drawers are connected via SAS cables from the I/O adaptors in the server, the HMC will not be able to detect their presence in a configuration. The Repair and Verify procedures will be written to instruct the user to manually interact with the drawer. The procedures for each FRU will be displayed within a browser in HTML format.
  • Corrected the 5094 exchange procedure graphics to include the locations of the connectors on the card in location C10.
  • Corrected repair procedure for PCI adapter cards on System I.
  • Enhanced and/or corrected instructions for Service Processor cable removal
  • Enhanced concurrent repair instructions for removable media devices to include quiescent of applications running on operating systems that may be using a removable media device and using operation procedures to manually shut down of all applications and logical partitions
  • Enhanced process for exchange of VPD passthru card
  • Corrected panel flow for the exchange of the power cables for the 5094
  • Corrected/enhanced concurrent and nonconcurrent procedures for the exchange of MMA fans.
  • Add support to procedures and service guides to handle the I/O expansion units G30, 5790, 5796 and 5296.
  • Clarified the A2 Fan Exchange procedure to instruct the user to replace the Op Panel only if it was removed.
  • Corrected the way that surveillance errors are logged by the HMC for valid managed systems without an MTMS. Previously, by default RV launched Info Center content. Now the correct isolate procedures will be run.
  • Corrected the procedure for an MMA fan to be concurrent.

Known issues in HMC V7R3.2.0

  • Concurrent FRU replacement of Feature Code 1802 GX Dual Port 12X Channel Attached Adapter fails with a Null exception when the operation is performed from an HMC at levels V7R3.2.0 base or V7R3.2.0 with Service Pack 1 installed. The failure will occur during the reconfiguration steps which follow the physical adapter replacement. Recovery of the adapter and it's attached resources will require a platform IPL. This issue is resolved with the installation of PTF MH01100.
  • A timing issue exists where 2 panels, using the same set of information, and one panel modifies some data and the other panel knows nothing about the modifications. This situation can result in "stale" data overwriting newer data. The problem will be fixed in a later PTF.
  • If a HMC is attached to an initialized system without micropartitioning turned on, LPAR profile creation will fail. The workaround is to rebuild the managed system. The problem will be fixed in a later PTF.
  • A DLPAR "Move Memory" operation will partially fail if the move hits pinned memory. Sometimes the pinned memory is higher than the reported minimum. The amount of memory moved will be some fraction of the amount of memory requested in the move. The error message gives the impression that the whole operation failed. The problem will be fixed in a later PTF.
  • If a Virtual Ethernet Adapter is added with a VLAN ID of 1, the adapter will show up as missing in the LPAR Properties panel for an AIX partition. The problem will be fixed in a later PTF.
  • When a customized user logs in, the "tip of the day" panel displays a task error. The problem will be fixed in a later PTF.
  • After performing a dynamic logical partition action on a virtual serial adapter, the virtual adapter properties window may only show the lpar id and value "65536" for the name field. The Manage Profile and dynamic logical partition windows show the name properly. A reboot of the HMC will resolve the inconsistency and populate the name field. The problem will be fixed in a later PTF.
  • After upgrade to V7R3.2.0 if a backup critical console data at that version is later restored during a recovery of the HMC, then the first initial login attempt is not accepted and a second login is required. The problem will be fixed in a later PTF.

PTF PTF MH01048

Description

Required for CSM to support SSL on HMC V7R3.1.0 Service Pack 1

Prerequisite

PTF MH01042 must be installed before installing this PTF.

Package information

Package name Size (bytes) Checksum APAR # PTF#
MH01048.zip
MH01048.iso
21701627
22292480
37741
10804
MB02122 MH01048

Splash panel information (lshmc -V command output)

MH01048: SNIA CIMOM SSL support for CSM (09-19-07)

PTF MH01042

Description

Updates HMC from V7R3.1.0 Service Pack 0 to V7R3.1.0 Service Pack 1

Package information

Package name Size (bytes) Checksum APAR # PTF#
HMC_Update_V7R310_SP1_1.zip
HMC_Update_V7R310_SP1_2.zip
HMC_Update_V7R310_SP1_1.iso
HMC_Update_V7R310_SP1_2.iso
428074841
414051572
429228032
417060864
37925
44582
10797
10085
MB02101 MH01042

Splash panel information (lshmc -V command output)

"version= Version: 7
Release: 3.1.0
Service Pack: 1
HMC Build Level 20070828.1
","base_version=V7R3.1.0

Fixes

This package updates your HMC from HMC V7R3.1.0 Service Pack 0 to HMC V7R3.1.0 Service Pack 1. You can also reference this package by APAR MB02101. This release replaces MH01015, MH01030, MH01041 and MH01045.

Server and Partition Management

  • Fix for CoD extraneous pop-up message problem - HSCL0019 and HSCL0020.
  • Fix for displaying virtual Ethernet backing devices.
  • Fix for displaying multiple VIOSs with SEA failover enabled from Virtual Adapters panel.
  • Fix for profile modification problem with LHEA adapter which resulted in "port group not found" error.
  • Update multiple adapter descriptions in the I/O properties panel.
  • Fix for logging problem which resulted in /var file system filling up.
  • Fix for timing issue which generated unnecessary serviceable event reference code E3550715.
  • Fix for full system partition activation problem with HEA adapter due to HSCL058A and HSCL0658.
  • Fix for shared 5250 console session input inhibited problem.

Security fixes

  • CVE-2007-1536: file, integer underflow
  • CVE-2007-1003
  • CVE-2007-1667
  • CVE-2007-1352
  • CVE-2007-1351: X Security issues
  • CVE-2006-4250: man heap overflow

Platform Management

  • Corrected a problem on the HMC Server Management panel where, after selecting a row, the table would display the selected row twice - once in its original (pre-select) position and once in its correct (post-select) position.
  • Corrected the Remote Support Call procedure for initial enrollment of a newly installed system where the system has non-English characters in the customer information. The enrollment failure caused the initial and all future Remote Support requests to fail.
  • Corrected a problem where some system errors may be called home more than once from multiple HMCs connected to the same system but not on the same subnet.
  • Added support for New Zealand daylight savings time (DST) changes.
  • Corrected an intermittent problem where a HTTP 500 Status code was displayed in the tasks pad area of any resources table view when the tasks pad is enabled.

Repair and Verify

  • Corrected a problem on systems with redundant FSPs with failover enabled where an administrative failover initiated from the HMC or Repair and Verify could result in a HMC system failure.
  • Corrected a problem that resulted in HSCL8001 error during the addition of an enclosure using Repair and Verify.
  • Corrected a problem that caused reference code E3550046 00007E0B to be called home after an HMC upgrade to V7R3.1.0.
  • Corrected and enhanced the Repair and Verify procedure for the replacement of the shuttle assembly on a 7314-G30 drawer.
  • Corrected the Repair and Verify procedure for the replacement of the VPD card on an 570 system.
  • Corrected an omission in the Repair and Verify procedure for performing a repair operation on any 7314-G30 I/O tower that requires the tower to be powered off. Instructions were not given to vary on devices that were previously varied off. This includes SPCN card, Backplane, InfiniBand card, or non redundant power supply repair.
  • Corrected an error in the instructions for the concurrent repair of a 570/560 power supply where the incorrect location is given for the redundant power supply.
  • Corrected a problem in a multiple HMC environment where the user was instructed to initiate the Launch Remote Hardware Management Console from the HMC Management screen of the secondary HMC. That option can not be initiated remotely. The user is now instructed to go to the local console to initiate the task.
  • Corrected a problem when performing a repair operation on a 7311-D10 I/O backplane. Repair Verify does not instruct the CE to record and restore the configuration information associated with the I/O tower that is contained in ASM. This could leave the tower unusable.
  • Correct some Repair and Verify procedures that were not launching HTML panels or panels were missing graphics.
  • Fix to allow vary off for Repair and Verify exchange FRU and remove FRU.
  • Clarified instructions for the installation and removal of FSP cables.
  • Removed incorrect video for the exchange of a 570 D20 DASD Backplane.
  • Corrected exchange procedure for the fan at location A2 in a 570 to eliminate the removal of the control panel.
  • Enhanced the exchange procedure for the OP Panel of the I/O expansion tower to include conditional power off instructions.
  • Clarified instructions for the exchange of the 570 7311-D10 Power Supply.
  • Corrected the instructions for the exchange of the 570 7311-D10 HSL/RIO cables to show the correct locations.
  • Corrected a problem with Add/Remove/Exchange FRU option on 9116-561 systems where machine type and model numbers were not being recognized and were being flagged as unsupported for that option.
  • Corrected issues with the exchange procedure for a Signal Cable (SIG 60) in a I/O expansion tower (5094) attached to a System I 570. The unit will now be powered off automatically, and the managed system will not be powered off. The user will be warned if resources in the unit are in use by partitions currently active on the system.
  • Corrected a problem where the verification of the exchange of a 7314-G30 or 7311-D10 RIO/NIC card would post SRC 100090F0.
  • Corrected issues with the exchange procedure for a signal cable. The procedure failed to instruct the user to properly power off and subsequently power on the D20 DASD.
  • Corrected a problem where graphics associated with the repair and verification of certain System I expansion units FRUs were not being displayed.
  • Corrected the procedures for the concurrent and non concurrent exchange procedures for System I disk drives.

System Plan

  • Fix for VIOS system plan deployment with SAS disk problem.
  • Fix for profile deployment problem with planned partitions with multiple profiles that have vSCSI dependencies.
  • Fix for mksysplan and CreateSystemPlan runtime errors.
  • Fix for 7314-G30 expansion unit reporting error which caused deployment failure.
  • Fix for deployment problem with LHEA ports when deploying twice.
  • Fix for deployment of a system plan unable to determine HEA settings.
  • Fix for mksysplan and deploysysplan errors due to older versions of Ethernet firmware not recognizing the MAC address.
  • Fix for deployment problems of system plans to VIOS partitions with multiple 7311.D20 DASD.

Licensed Internal Code (LIC) update

  • For systems with with redundant FSPs code was added to - detect conditions on systems with where the secondary FSP has never IPLed the machine.
  • Prevent concurrent updating of the system when this "half-genesis" condition, because redundancy will be lost.
  • Incorporated a change to provide a recovery method to concurrently activate PHYP and PFW firmware that may have been updated by not activated during a previous code update failure.

Service Agent

  • Corrected spelling errors and enhanced terminology in the Manage eService Registration user interface, Service Management menu and Authorize User panel.

Problem Analysis

  • Correct a problem where some Serviceable Events were being opened and called home, that were never intended to be called home.

Known Issues

  • User can no longer select "Save Settings and Power off" task inside the ASM interface launched from a remote HMC (HMC connected from a remote browser). The user must do this task from a local HMC.)
  • Lpar activation may fail when an LHEA is assigned to a regular partition that is later changed to be a "use all resources" partition. For successful activation create a new partition as the full resources partition instead of changing the current partition definition.
Supported languages
Languages Locales
English en_US, en_GB, en_GB@euro, en_AU, en_BE, en_BE@preeuro, en_CA, en_HK, en_Ne, en_IE, en_IE@preeuro, en_NZ, en_PH, en_PK, en_ZA, en_SG
Catalan ca_ES, ca_ES@preeuro
German de_DE, de_DE@preeuro, de_CH, de_AT, de_AT@preeuro, de_LU, de_LU@euro
French fr_FR, fr_FR@preeuro, fr_CH, fr_CA, fr_BE, fr_BE@euro, fr_LU, fr_LU@euro
Italian it_IT, it_IT@preeuro, it_CH
Spanish es_ES, es_ES@preeuro, es_AR, es_BO, es_CL, es_CO, es_CR, es_DO, es_EC,es_SV, es_GT, es_HN, es_MX, es_NI, es_PA, es_PY,es_PE, es_PR, es_US, es_UY,es_VE
Brazilian Portuguese pt_BR
Portugal Portuguese pt_PT, pt_PT@preeuro
Polish pl_PL, pl_PL@euro,pl_PL@preeuro
Japanese ja_JP
Simplified Chinese zh_CN, zh_SG
Traditional Chinese zh_TW, zh_HK
Korean ko_KR
Hungarian hu_HU
Dutch nl_NL, nl_NL@preeuro, nl_BE, nl_BE@preeuro
Russian ru_RU
Czech cs_CZ
Slovakian sk_SK

Hints / Tips:

  • Korean input is supported. Press Shift-Space to switch between English and Korean input mode.
  • Traditional and Simplified Chinese input is supported in zh_TW and zh_CN locales. Press CTRL-Space to switch between English and Chinese input mode. Press CTRL-Shift to select an input method. Press space bar to see more Chinese characters.
  • Japanese input is supported. Press Shift-Space to switch between English and Japanese input mode.
  • To modify remote session language setting, configure your browser's Language settings.
  • An ibm5250 session opened on the HMC locally will be in the same locale as the one that is set for the HMC. To open a session in a different locale, change the HMC locale first, logout, login and then invoke ibm5250. The other option is to connect to the HMC using a remote emulator, e.g. IBM Personal Communications or iSeries Access, in the desired locale.
  • To configure virtual terminal session to display translated text, select the appropriate encoding from virtual terminal encoding menu.

Known issues:

  • Mnemonics is no longer supported in the new UI. However, mnemonics are still being shown in certain language environments.
  • Number format issues with decimal point in certain locales. For example, sometimes period (.) is used instead of comma (,) for decimal point.
  • To allow all UI displayed in English only in remote management, users can only have English or none in the language list of their browser setting.
  • Due to the limitation of groff, some characters in the output of "man" command might be corrupted in traditional Chinese, simplified Chinese and Korean when the window is too narrow. Widen the window and retry the command again.
  • User ID, User information, HMC User password, Partition name, managed system name, profile name and system profile name are in English only.
  • IBM275 doesn't work well when connecting from IBM Personal Communications or iSeries Access to an HMC. Use another Brazil codepage. The codepage "IBM930 Japan Katakana" doesn't work well either. Use "IBM930 Japan Katakana Extended" instead.
  • In some double byte locales, some grayed out menu would disappear if mouse over the menu item.

PTF MH01045

Description

Additional required fixes for CSM on HMC V7R3.1.0

Prerequisite

PTF MH01041 must be installed before you can install this PTF. A mandatory reboot is required when this service pack is applied.

Package information

Package name Size (bytes) Checksum APAR # PTF#
MH01045.zip
MH01045.iso
877705
1304576
54291
53756
MB02111 MH01045

Splash panel information (lshmc -V command output)

MH01045: Required fix to support CSM release 1.6.0.12 (08-13-07)

Fixes

The following fix is addressed in this PTF:

Fixes the remote microcode commit and recover functions from CSM. This fix is only needed if you use CSM 1.6.0.12. You must install PTF MH01041 before you install PTF MH01045.

PTF MH01041

Description

Required fix for CSM on HMC V7R3.1.0

Package information

Package name Size (bytes) Checksum APAR # PTF#
MH01041.zip
MH01041.iso
36990056
37650432
48027
51304
MB02095 MH01041

Splash panel information (lshmc -V command output)

MH01041: Required fix to support CSM release 1.6.0.12 (07-26-07). A mandatory reboot is required when this service pack is applied.

Fixes

The following fix is addressed in this PTF:

Added Cluster Systems Management (CSM) SNIA port to Network Firewall to support CSM Version 1.6.0.12. CSM will query the HMC through the existing SNIA CIMOM interface. This is supported in both the GUI and Command line. This fix is only needed if you use CSM 1.6.0.12.

PTF MH01030

Description

Security fixes for HMC V7R3.1.0

Package information

Package name Size (bytes) Checksum APAR # PTF#
MH01030.zip
MH01030.iso
20612592
21166080
24240
32782
MB02045 MH01030

Splash panel information (lshmc -V command output)

MH01030: Security fix for HMC V7R3.1.0 (06-22-07). A mandatory reboot is required when this service pack is applied.

Fixes

The following fixes are addressed in this PTF:

  • Fix to suppress logging sensitive data during adding a managed system or changing the managed system password.
  • Fix to CLI commands to disable parameter logging which could contain sensitive data.

PTF MH01015 Required fix for HMC V7 R3.1.0

Description

Required fix for HMC V7 R3.1.0

Package information

Package name Size (bytes) Checksum APAR # PTF#
MH01015.zip
MH01015.iso
453769524
454711296
62548
27570
MB02025 MH01015

Splash panel information (lshmc -V command output)

MH01015: Required fix for HMC V7R3.1.0 (05-29-2007)

Enhancements and fixes

This package includes the following enhancements and fixes:

Server and Partition Management

  • Fix for erroneously displayed message during a dedicated processor DLPAR move.
  • Fix for error when changing the multi core scaling (MCS) value of Host Ethernet Adapter.
  • Fix for sharing/donor mode setting during a restore profile data operation.

Platform Management

  • Fix for collecting HMC debug information.
  • Fix for 5250 console closing problem during logoff.
  • Fix for 7316-TF3 Display problem.
  • Add support for the cut and paste function from HMC spawned terminal windows.

Fixes for IBM Director

  • Fix for returning the correct error message during IPL of Partitions.
  • Fix to GetHMCVPD command to retrieve the correct UUID information.
  • Fix for the correct mapping of the Power State for managed systems.

Repair and Verify

  • Correct Repair and Verify FSP battery procedure
  • Correct a problem where links in Repair and Verify to symbolics and isolates don't work for non English browser settings
  • Correct problem with Add/Remove FRU task for systems with Active AIX/Linux Partitions
  • Correct a problem where multiple call home events were being generated when powering off an I/O drawer via the power on/off utility or through the Repair and Verify Exchange FRU procedure.
  • Correct a problem in Repair Verify that would not allow concurrent repair of the 7314-G30 MM power supply, forcing a power down of the I/O unit.
  • Updated Repair and Verify BPR add procedure to include missing panel
  • Updated Repair and Verify exchange procedures for 7311-D20 and I/O Backplane to include missing graphics and content
  • Corrected a problem that prevented a CE from adding a system to an existing frame
  • Corrected concurrent maintenance exchange procedure for the IB E1 Power Supply.

Scheduled Operations

  • Corrected a timing gap during initialization where Scheduled Operations was targeting partitions not yet created
  • Corrected a problem where Scheduled Operations settings were not persisted from HMC V6 to HMC V7 upgrades

License Internal Code Update

    Corrected a coding issue where PHYP and PFW might not be activated during concurrent firmware update

Service Focal Point

  • Corrected a problem where a serviceable event was displayed in Service Focal Point after HMC install
  • Provided additional descriptive text for SRCs in Service Focal Point error reporting

Miscellaneous Fixes

  • Correct Update Welcome page with proper Education and Tutorial URL)
  • Correct HMC Help titles
  • Corrected situation where the power on panel is erroneously displayed
  • Remove references to ResourceLink
  • Improved panel checkbox selection performance for large tables
  • Provided updates to online HMC Operations Guide
  • Corrected a potential memory leak in Redundant FSP Failover

PTF MH00998 HMC V7 R3.1.0 Recovery media

Description

HMC V7 R3.1.0 Recovery Media images

The HMC V7 R3.1.0 Recovery Media images can be used to upgrade your HMC to V7 R3.1.0, or to perform a clean installation of HMC V7 R3.1.0.

Updating to HMC V7 R3.1.0 requires an Upgrade by means of Recovery Media or the Network. There are no updates to be used with the Install Corrective Service task. For upgrade instruction, please refer to the Special Upgrade Instructions for V7 R3.1.0.

Package information

Package name Size (bytes) Checksum APAR # PTF#
HMC_Recovery_V7R3.1.0_1.iso
HMC_Recovery_V7R3.1.0_2.iso
1133940736
1341313024
16008
02858
MB02021 MH00998

Splash panel information (lshmc -V command output)

Version: 7
Release: 3.1.0
Service Pack: 0
HMC Build level 20070518.1
","base_version=V7R3.1.0

Enhancements and fixes for HMC V7 3.1.0

This package provides the following enhancements and fixes:

Server and Partition Management

The most significant and the most noticeable change in the HMC for V7 R3.1.0 is the move to a new Web-based User Interface both locally and remote. This interface uses a tree style navigation model providing hierarchical views of system resources and tasks using drill-down and launch-in-context techniques to enable direct access to hardware resources and task management capabilities. It provides views of system resources and provides tasks for system administration.

HMC V7 R3.1.0 can manage both POWER5 (with SF240_299 firmware level and above) and POWER6 servers.

On Power6 servers the following new features/enhancements have been added.

  • Support for Host Ethernet Adapter (HEA). An HEA provides each logical partition using the adapter with its own virtual adapter and logical ports. An HEA may be shared between multiple partitions. This provides direct data and control path between the partitions and the adapter, allowing partition-to-partition connectivity.
  • Partition Availability Priority. This can be used to prevent transient and catastrophic CPU (processor core) failures from resulting in system or partition termination. Total recovery from catastrophic CPU failures will require that a spare processor is or can be made available to replace the failed CPU.
  • Utility CoD is a new CoD offering for HMC V7 R3.1.0. It replaces the Reserve CoD offering. Utility CoD is only available for processor resources.
  • Enhancements to the Dump facilities. These enhancements will reduce unplanned customer outages and improve platform serviceability, by eliminating unneeded and duplicate hardware data from platform system dump, and moving all formatting of dump data to the post-collection analysis phase. This improves dump runtime performance and frees up FSP control store to allow more problem-specific hardware data to be collected.
  • Shared Pool Usage of Dedicated Capacity. This feature provides the ability for partitions that normally run as "dedicated processor" partitions to contribute unused processor capacity to the shared processor pool. Customers may use some of the capacity that is formerly locked up in dedicated processor partitions to satisfy peak needs for the shared processor pool without resorting to using utility on-demand processors.
  • Virtual Server Model Instrumentation. This feature provides a common interface for server system management. Driven by IBM and several other companies, there is an effort to standardize the Virtual Server Model (VS Model) for the server system management, which includes the managed server resource representation and the management service functions. HMC V7 R3.1.0 contains the first phase of work for HMC to provide the standardized VS Model as the common interface for third parties to manage the server system and their hardware resources.

System Plan

  • Automated installation of VIOS into LPAR
  • Automated provisioning of virtual resources with the VIOS LPAR
  • Improved capability of creating a system plan from a managed system
  • Additional import &export capability via HTTPS
  • Improved System Plan Viewer user controls and details

HMC command line

  • A new command, dump, has been added. The dump command sets the system dump parameters for a managed system (POWER6 servers only).
  • The following commands have been added for system plan resource management on the HMC:
    defsysplanres
    defines a system plan resource
    lssysplanres
    lists defined system plan resources
    rmsysplanres
    removes a defined system plan resource
  • The following commands have been enhanced to support barrier synchronization (POWER6 servers only): chsyscfg, lshwres, lssyscfg, and mksyscfg.
  • The following commands have been enhanced to support partition availability priorities (POWER6 servers only): chsyscfg, lssyscfg, and mksyscfg.
  • The following commands have been enhanced to support the new processor sharing mode that allows an active dedicated processor partition to share its unused processors (POWER6 servers only): chhwres, chsyscfg, lshwres, lslparutil, lssyscfg, and mksyscfg.
  • The following commands have been enhanced to support electronic error reporting for i5/OS partitions (POWER6 servers only): chsyscfg, lssyscfg, and mksyscfg.
  • The following commands have been enhanced to support processor compatibility modes (POWER6 servers only): chsyscfg, lssyscfg, and mksyscfg.
  • The following commands have been enhanced to support Host Ethernet Adapters (POWER6 servers only): chhwres, chsyscfg, lshwres, lssyscfg, mksyscfg, and rsthwres.
  • The following commands have been enhanced to support Utility Capacity on Demand (POWER6 servers only): chcod, lscod, and lslparutil.
  • The lssyscfg -r prof command to list partition profiles has been changed. The --filter option to specify the partition for which profiles are to be listed is no longer required. Therefore, all partition profiles for all partitions in the managed system can now be listed by issuing lssyscfg -r prof -m <managed system>.
  • The mksyscfg -r lpar and mksyscfg -r prof commands have been changed. The load_source_slot attribute is no longer required to be specified when creating an i5/OS partition or partition profile on a POWER6 server.
  • The partition shared_proc_pool_util_auth attribute has been deprecated. It has been replaced by the allow_perf_collection attribute. These two attributes will always have the same value. The commands that use these attributes are chsyscfg, lssyscfg, and mksyscfg.
  • A new option has been added to the chsysstate command to enable console service functions for an i5/OS partition.
  • New options have been added to the chhmc command to set the date, time, time zone and clock type on the HMC.
  • A new option has been added to the chsvcevent command to close all serviceable events on the HMC.
  • A new option has been added to the mksysplan command to limit the inventory gathered to just the PCI slot devices.
  • A new option has been added to the mksysplan command to display verbose output during command processing.
  • A new option has been added to the lsdump command to list the system dump parameters for a managed system (POWER6 servers only).
  • The lsdump -h command has been enhanced to display dump offload progress.
  • The lslic -t power and lslic -t syspower commands have been enhanced to display automatic code download status.
  • A new option has been added to the lslic command to display Power FRU level and status information.
  • The dlslic command has been removed. The information that was displayed by the dlslic command is now displayed by the lslic command.
  • Due to security restrictions in the HMC Web-based user interface, an HTML file containing Terms and Conditions can no longer be presented to users who login locally on the HMC. Instead, a text file containing welcome text can be presented to users who login locally on the HMC. Therefore, the chusrtca command has been changed to no longer support deployment of Terms and Conditions and to support deployment of welcome text instead. If you are upgrading from HMC V6 R1 and the display or Terms and Conditions at login is currently enabled on your HMC, then the contents of the UserLicense.html file containing the Terms and Conditions is preserved. After the upgrade is complete, the contents of the UserLicense.html file will exist unchanged in the /opt/hsc/data/license/WelcomeFile.txt file and will be displayed as welcome text to users that login locally on the HMC. You may then want to deploy a new welcome text file that does not contain HTML and that has text that better fits a welcome message.
  • The lsusrtca command has been deprecated.
  • To use X11Forwarding on HMC, from the SSH client, run your ssh command with the -Y or set the value of ForwardX11Trusted in your /etc/ssh_config file to yes
  • The max_capacity_sys_proc_units and max_capacity_sys_mem attributes displayed by the lshwres command have been deprecated since these values cannot be accurately determined for all managed systems. For partition profiles, the maximum memory value will now be limited to the value 4,294,967,295 (0xFFFFFFFF) MB. The maximum processor values for a partition profile will now be limited to a new value, which is displayed by the new attribute max_procs_per_lpar in the lshwres command.
  • The lsmediadev command has been enhanced to display the mount point for each removable media device.

Licensed Internal Code (LIC) update

  • A new task was added which allows the user to ensure that the system has no errors which will prevent Licensed Internal Code update from working correctly. This new task is invoked by selecting "Check System Readiness" from the Updates task selection list or using the -o k parameter of the updlic command.
  • A new task was added which allows the user to view system information without entering a "change" task. This new task is invoked by selecting "View System Information" from the Updates task selection list.
  • The restricted-access dlslic command was removed. Equivalent capability was added to the lslic command. For more details, see the command line section of the readme.

Save Upgrade Data/Backup

Added support for saving data to USB memory stick.

Network connectivity

Allow VPN selectable interface and route for ipsec communication

Previously, VPN did not work if the interface for ipsec traffic was different from the public default gateway interface. For instance, if eth1 had been set up for the VPN connection, and eth2 was the "public" network and had the default route, then even after adding static routes for the VPN catchers for eth1, the ipsec program used the default route for communication. This behavior has been changed so that the defined routes will be used to establish the VPN.

RIO Topology

The GUI path to view the RIO Topology is:

Hardware (Information) -> Adapters -> View RIO Topology

Under this path, "View RIO Topology" has been changed to "View Hardware Topology"

Service Focal Point (SFP)

Added refcode links to Manage Serviceable Events.

DLPAR

    Memory and Processors
    You will notice that the DLPAR operations have slightly changed in the V7 R3.1.0 HMC. An overall change is that the Add and Remove operations for memory and processor resources have been combined into one task. For example, when you want to change the amount of memory that is assigned to the partition you simply launch the "Add/Remove" memory task and enter in the amount of memory you would like to have assigned to the lpar.
    Physical I/O
    For Physical I/O resources we have combined the move and remove operation into one task so that now you can optionally move the I/O resource that you are trying to remove to another partition. The "Add" operation for I/O resources has basically stayed the same.
    RMC-less DLPAR for AIX/Linux Partitions
    POWER5 HMC supported DLPAR operations between two AIX or Linux partitions that do not have RMC connections. This function has been removed from the UI due to the fact that these types of operations require multiple steps for the user in order to be successful. You can still remove or add resources to a partition that doesn't have an RMC connection, however you will not be able to move resources between two AIX or Linux partitions that do not have active RMC connections.
    Another change that has been implemented for DLPAR operations is that the task will display an indicator within the dialog for AIX and Linux partitions the alerts you to the fact that an RMC connection is missing. This is so that you know you are about to perform and RMC-less DLPAR operation before you start entering data into the fields in the dialog.
    If you would still like to move resources between two AIX or Linux partitions that do not have RMC connections the command line "chhwres" command can still be used to facilitate the move operation.
Security fixes in HMC V7 R3.1.0
FixDescription
CAN-2003-0989tcpdump remote DOS
CAN-2003-0190OpenSSH: info leak issue
CAN-2004-0078 mutt remote buffer overflow
CAN-2004-0110 libxml2 URI Parsing Remote Buffer Overflow
CAN-2004-0109
CAN-2004-0181
Kernel ISO9660/JFS local privilege escalation, info leak
CAN-2004-0183tcpdump ISAKMP remote DOS
CA-2005-35SSH Protocol 1 Weakness and Vulnerability
CAN-2004-0427
CAN-2004-0424
CAN-2004-0229
CAN-2004-0228
CAN-2004-0394
Kernel privilege escalation, local DoS
CAN-2004-0554Kernel "__clear_fpu()" Macro local DoS
CAN-2004-0523kerberos aname_to_localname remote root compromise
CVE-2004-0493Input Header Memory Allocation Denial of Service
CVE-2004-0488Apache mod_ssl FakeBasicAuth Buffer overflow
CVE-2004-0747
CVE-2004-0748
CVE-2004-0751
CVE-2004-0786
CVE-2004-0809
Apache 2 Multiple Denial of Service
CVE-2004-0942Apache MIME Header Memory Consumption
CAN-2004-0460
CAN-2004-0461
VU#317350
VU#654390
dhcp-server: remote system compromise
CVE-2002-1363libpng remote DoS
CAN-2004-0590Certificate chain authentication in Openswan pluto
CAN-2004-0649L2tpd: remote execution of arbitrary files w/ privs of l2tpd user
VU#388984
VU#236656
VU#160448
VU#477512
VU#817368
VU#286464
CAN-2004-0597
CAN-2004-0598
CAN-2004-0599
libpng: multiple vulnerabilities
CAN-2004-0415 Kernel: local privilege escalation, race condition in file offset pointer handling
VU#550464
CAN-2004-0644
krb5: remote unauthenticated DoS
CAN-2004-0817imlib: local execution via heap overflow
CAN-2004-0687
CAN-2004-0688
xf86: multiple buffer overflows with malformed xpm images
CAN-2004-0966gettext: Insecure temporary file handling
CAN-2004-0804
CAN-2004-0886
tiff: Buffer overflows in image decoding
CAN-2004-0884Cyrus-sasl2: (ver2.1.7)Insecure handling of environment variable
CAN-2004-0971krb5: krb5-workstation: Possible symlink attack, priv escalation via temporary file mishandling
CAN-2004-0989 libxml: remote code execution, buffer overflow
CVE-2004-0079Openssl vulnerability
CAN-2004-0975Openssl: possible symlink attack via temp file mishandling
SUSE-SA:2004:041 xf86: SuSE security updates for libxpm
CAN-2004-0782imlib: xpm security updates in imlib
CAN-2004-1010zip: buffer overflow in info-zip when using recursive folder compression
CAN-2004-1308tiff: multiple buffer overflows
CAN-2004-0986iptables: variable init failure can cause failure to load firewall rules
CAN-2004-0883
CAN-2004-0949
CAN-2004-1070
CAN-2004-1071
CAN-2004-1072
CAN-2004-1073
CAN-2004-1074
Kernel update for multiple local and remote DoS vulnerabilities
CAN-2004-0079
CAN-2004-0112
OpenSSL remote DOS
CVE-2006-2937
CVE-2006-2940
CVE-2006-2969
CVE-2006-3738
CVE-2006-4339
CVE-2006-4343
OpenSSL vulnerability
CAN-2005-0155
CAN-2004-0452
CAN-2005-0077
Perl: Security update to address two priv escalation and a buffer overflow condition
CAN-2005-0449
CAN-2005-0209
CAN-2005-0529
CAN-2005-0530
CAN-2005-0532
CAN-2005-0384
CAN-2005-0210
CAN-2005-0504
CAN-2004-0814
CAN-2004-1333
CAN-2005-0003
Updates for multiple issues on 2.4-2.6.11 kernels
CAN-2005-1993sudo: vulnerabilities allow execution of arbitrary commands
CAN-2005-1267
CAN-2005-1278
CAN-2005-1279
CAN-2005-1280
tcpdump: fix for several DOS vulnerabilities
CAN-2005-1151
CAN-2005-1152
CAN-2005-1349
CAN-2005-0103
CAN-2005-0104
CAN-2005-1455
CAN-2005-1454
CAN-2004-1456 -
CAN-2004-1470
tiff: buffer overflow allows execution of arbitrary code
CAN-2005-0109OpenSSL update
CAN-2005-2969OpenSSL fix for potential SSL 2.0 Rollback vulnerability
CVE-2001-0572SSHv1 Protocol Available
CVE-2004-0175OpenSSH SCP Client File Corruption Vulnerability
CVE-2006-0225OpenSSH scp remote attack vulnerability
CVE-2006-4924
CVE-2006-4925
Open SSH vulnerability
CVE-2006-5051Open SSH vulnerability not applicable to HMC due to GSSAPI being disabled
CVE-2006-5794Open SSH vulnerability
CVE-2006-0058Sendmail remote code execution
CVE-2006-1721Cyrus-sasl remote denial of service
CVE-2006-2024
CVE-2006-2025
CVE-2006-2026
Libtiff: various denial of service attacks
CVE-2005-3352
CVE-2005-3357
Apache2 cross site scripting in mod_imap and mod_ssl
CVE-2006-0455Gpg remote execution by signature checking
CVE-2005-3353
CVE-2005-3389
CVE-2005-3390
CVE-2005-3391
CVE-2005-3392
CVE-2005-3883
Multiple vulnerabilities in php4
CVE-2005-2970Apache2 worker memory leak
CVE-2005-2974
CVE-2005-3350
Libungif denial of service attack/buffer overflow
CVE-2005-2959Sudo environment cleaning privilege escalation vulnerability
CAN-2005-2491PCRE: Integer overflow vulnerability
CVE-2005-3119
CVE-2005-3179
CVE-2005-3180
CVE-2005-3181
Kernel potential denial of service and information disclosure
CAN-2005-2797
CAN-2005-2798
OpenSSH: fixes to prevent escalation of privileges and bypass certain security restrictions
CVE-2005-2876Util-linux umount "-r" Re-Mounting security issue
CAN-2005-2495Xf86: Fix remote command execution
CAN-2005-2491
CAN-2005-2700
CAN-2005-2728
Apache2: Security fixes
CAN-2005-1761
CAN-2005-1768
CAN-2005-2500
Kernel: Various Security Fixes
CAN-2005-2452Tiff: Vulnerability allows DOS attack due to divide by zero error
CAN-2005-2177Net-snmp remote attack vulnerability
CAN-2005-0448Perl vulnerabilities
CAN-2005-0758
CAN-2005-0988
CAN-2005-1228
CAN-2005-1260
CAN-2005-0953
Bzip2 vulnerability
CAN-2004-1189Krb5 multiple security issues
CAN-2005-1849
CAN-2005-2096
Zlib buffer overflow
CAN-2005-2088
CAN-2005-1268
Apache2: fix for multiple vulnerabilities
CVE-2005-2970Apache2: memory leak
CVE-2005-3357Apache2 Cryptographic problem
CVE-2006-3747Apache2: Off-by-one error in the ldap scheme handling in the Rewrite module
CVE-2006-3918Apache2 vulnerability
CVE-2005-2728Apache Byte Range Denial of Service
CAN-2004-1453
CAN-2004-0968
CAN-2004-1382
Glibc: Infoleak and symlink attack vulnerabilities
CAN-2005-1111
CAN-2005-1229
Cpio directory traversal and privilege escalation
CAN-2005-0605Xf86: libXPM integer overflow
CAN-2004-0970Gzip: temporary file mishandling
CAN-2005-0160
CAN-2005-0161
CAN-2005-0961
telnet: ENV buffer overflow
CAN-2005-1704Binutils vulnerabilities
CAN-2005-1993Sudo: race condition
CAN-2005-0373Cyrus-sasl, cyrus-sasl2 remote code execution
CVE-2005-0916
CVE-2005-2456
CVE-2005-2457
CVE-2005-2458
CVE-2005-2555
CVE-2006-0554
CVE-2006-0555
CVE-2006-0557
CVE-2006-0744
CVE-2006-1055
CVE-2006-1056
CVE-2006-1242
CVE-2006-1523
CVE-2006-1524
CVE-2006-1525
CVE-2006-1527
CVE-2006-1528
CVE-2006-1857
CVE-2006-1858
CVE-2006-1863
CVE-2006-1864
CVE-2006-2271
CVE-2006-2272
CVE-2006-2274
CVE-2006-2444
CVE-2006-2448
CVE-2006-2451
CVE-2006-2934
CVE-2006-2935
CVE-2006-3085
CVE-2005-3180
CVE-2006-3468
CVE-2006-3626
CVE-2006-3745
CVE-2006-4093
CVE-2006-4145
CVE-2006-4813
CVE-2006-4997
CVE-2006-5757
CVE-2006-5823
CVE-2006-6053
CVE-2006-2274
CVE-2006-2444
CVE-2006-2448
CVE-2006-2451
CVE-2006-2934
CVE-2006-2935
CVE-2006-3085
CVE-2005-3180
CVE-2006-3468
CVE-2006-3626
CVE-2006-3745
CVE-2006-4093
CVE-2006-4145
CVE-2006-4813
CVE-2006-4997
CVE-2006-5757
CVE-2006-5823
CVE-2006-6053
Kernel Vulnerabilities

Known issues in HMC V7 R3.1.0

Web browser requirements

Hardware Management Console web browser support requires HTML 2.0, JavaScript 1.0, Java Virtual Machine (JVM), and cookie support in browsers that will connect to it. Contact your support personnel to assist you in determining if your browser is configured with a Java Virtual Machine. It is required that the web browser uses the HTTP 1.1 protocol and if you are using a proxy server, the HTTP 1.1 protocol is enabled for the proxy connections. Additionally, pop-ups must be enabled for all Hardware Management Consoles addressed in the browser if running with pop-ups disabled. The following browsers have been tested:

    Microsoft Internet Explorer 6.0 or later
    If this browser is configured to use an Internet proxy, then local intranet addresses should be included in the exception list, consult your network administrator for more information. If you still need to use the proxy to get to the Hardware Management Console, enable Use HTTP 1.1 through proxy connections under the Advanced tab in your Internet Options window.
    Firefox 1.5.0.6 or later.
    For Firefox 2.0 make sure the JavaScript options to raise or lower windows and move or resize existing windows are enabled. To enable these options, go to the Content tab in the browser's Options dialog. Click the Advanced button adjacent to the Enable JavaScript checkbox, and then select Raise or lower windows option and Move or resize existing windows option. These features allow you to switch easily between HMC tasks.

Other Web Browser Considerations

Session cookies need to be enabled in order for ASMI to work when connected to HMC remotely. The asm proxy code saves session information and uses it.

Using Internet Explorer

  1. Select Tools -> Internet Options.
  2. Select Privacy tab and select 'Advanced'.
  3. Check if 'Always allow session cookies'.
  4. If not checked, check 'Override automatic cookie handling' and check 'Always allow session cookies'.
  5. You can choose how you want to handle First-party Cookies and Third-party Cookies, block or prompt or accept. (Prompt is preferred in which case you will be prompted every time a site tries to write cookies. It may be a little annoying, but it is the safe thing to do. Some sites need to be allowed to write cookies)

Using Firefox

  1. Tools -> Options
  2. Select Cookies Tab
  3. Select check box Allow sites to set cookies.
  4. If you want to allow only specific sites then select 'Exceptions' and then you can just add this HMC to allow.

Other Issues

  • The HMC now reserves the first ten virtual adapter slots on each VIOS (Virtual I/O Server) partition for internal HMC use.
    Configuration rules:
  1. The maximum Virtual I/O Slot Number should be set to (at least) 10 plus the number of virtual I/O slots desired by the customer.
    Note that setting the maximum higher is OK, the danger is setting it too low. Setting it below 10 will cause a compatibility issue with newer levels of HMC code. Excess virtual slots use a small amount of additional memory, but otherwise have no impact.
  2. All customer virtual I/O slots (virtual SCSI, virtual Ethernet or virtual serial) must use virtual slot IDs 11 or greater.
  • When using the updhmc command with the -i flag, input echo is not restored when the command finishes. You can use the CTRL-D key to logoff then log back in.
  • The System Plan tasks "Create System Plan" and "Import System Plan" are only available from the Task pad pane. If the task pad pane has been disabled, it can be re-enabled by clicking HMC Management in the navigation area, then clicking "Change User Interface Settings" in the Work Pane. Check the "Tasks pad" box and click apply.
  • Existing system plans on a Version 6.1.2 HMC are not migrated on an upgrade.
  • An ASM session brought up from the HMC can still be available even after the user logs off the HMC. The ASM window can be left open for unauthorized access. The proper method for a graceful exit from the ASM session is to select the "Log off" button in the ASMI window, then close the ASMI window. This can happen in both local and remote mode.

Hints and tips for the HMC user interface

Several major components comprise this user interface:

    Banner
    Across the top of the workplace window, the Banner identifies the product and logo. It is optionally displayed and is set by using the Change User Interface Settings task.
    Task bar
    Located below the Banner, the Task bar displays the name(s) of any tasks that are running, the user ID under which you are logged in and online help information. It also provides the ability to log off or disconnect from the console.
    Navigation pane
    Located in the left portion of the window, the Navigation pane contains the primary navigation links for managing your system resources and the Hardware Management Console. The items are referred to as nodes.
    Work pane
    Located in the right portion of the window, the Work pane displays information based on the current selection from the Navigation pane. For example, when Welcome is selected in the Navigation pane, the Welcome window content is displayed in the Work pane.
    Status bar
    Located in the bottom left portion of the window, the Status bar provides visual indicators of current overall system status. It also contains a status overview icon which may be selected to display more detailed status information in the Work pane.

The System p Operations Guide for the Hardware Management Console and Managed Systems can be accessed online on the HMC. Select Welcome in the Navigation pane. The Welcome window content is displayed in the Work pane. Select HMC Operations Guide to view it.

Additional education, support, tutorial and technical information can also be accessed online on the HMC. Select Welcome in the Navigation pane. The Welcome window content is displayed in the Work pane. Select Online Information to view it.

To log on to the HMC from a remote browser, the HMC must first be configured for web browser access. See Appendix B of the System p Operations Guide for the Hardware Management Console and Managed Systems for instructions on how to configure the HMC for remote web browser access. After the HMC has been properly configured, from your web browser enter the URL of the HMC using the format https://xxx.xxx.xxx.xxx. Also in Appendix B, it is important to read the "Logging on the HMC from a LAN connected Web browser" section. Security warnings may be presented to your Web browser and the issues related to certificate management should be understood prior to using this function so you can perform the appropriate actions.

Other hints and tips

Upgrade hints

Certificates and key ring files generated by the System Manager Security application (on HMC Version 6) will not be migrated to HMC Version 7. Applications such as remote 5250, which import the public key ring file to establish a secure connection with HMC, will need to import a new public key ring file. The new file, SM.pubkr, will be generated and stored on HMC V7 under the /opt/ccfw/data directory. You can copy this file by using the scp or sendfile command.

For further information on how to set up remote 5250 by using SSL, see the support document located on the System i Technical Support website. This document and many others can be found by selecting the "Technical databases" link.

The IBM System p Information Delivery Design

With the introduction of IBM System p with POWER6 technology, IBM is changing many aspects of its product information delivery. IBM has produced a full-color document that identifies these changes and explains the improvements to user experience. This document is called Introducing Improved Information Delivery for IBM System p Hardware, and includes these topics:

  • Highlights of the IBM System p information delivery design.
  • The IBM System p product information that is available, who it is intended for, and where it is located.
  • IBM System p product information that is available from the Hardware Management Console.
  • The organization and delivery of IBM System p product information and education through the IBM Systems Support Site.
  • Access and navigation of IBM System p publications.
  • Who does what to service IBM system p hardware.

Introducing Improved Information Delivery for IBM System p Hardware is available from this Support for IBM System p web site.

  1. From this page, make sure that System p is the hardware entry selected, and then click Go.
  2. Select System p hardware publications under Hardware/Documentation.
  3. Select Introducing Improved Information Delivery for IBM System p Hardware from the publication titles listed.

With HMC V7 External web sites, including the "IBM Systems Hardware Information Center" and "IBM Systems Support Site", can no longer be accessed directly from the HMC and will require a remote HMC session or separate system with Internet access.

Repair and verify information is launched automatically on the HMC during the repair of a serviceable event. Repair and verify information, on-line help, reference codes, the "Operations Guide for the Hardware Management Console," and the "IBM Systems Hardware Information Center" are all included as part of the HMC licensed internal code. The "IBM Systems Hardware Information Center," which provides POWER5 technical data, is included in the licensed internal code for situations where HMC V7 (with SF240_299 firmware level and above) is managing POWER5 systems, with access only to the information required to address the serviceable event.

V6 R1.X to V7 R3.1.0 Task Mappings

This information is used to aid POWER5 HMC users in locating the equivalent WebSM HMC task in the new Web-based HMC UI. The information is divided into the following sections:

  • Server and Partition Management
  • Manage On Demand Activations
  • Frame Management
  • Utilization Data Management
  • System Plans
  • Licensed Internal Code Maintenance
  • HMC Management
  • Service Applications

Refer to the System p Operations Guide for the Hardware Management Console and Managed Systems for a complete list of the Task Mappings.

eServer i5 and p5 Education available on Resource Link

The following customer courses will be available from Resource Link for the Product Announce on May 4, 2004.

  • How to Use the eServer i5 and p5 Hardware Management Console
    This course explains how to install and configure the Hardware Management Console (HMC) for the Model 520/570. It also covers the HMC's basic operations by exploring the general user interface. Partitioning is discussed in detail, with explanations showing both command line and GUI support.
  • eServer i5 and p5 - Physical Planning for Installation
    This course discusses considerations for the physical planning for installation of eServer Models 520 and 570. It then provides the user with links to obtaining the step-by-step installation procedures.
  • Resource Link Highlights
    This course provides an overall look at the major Resource Link (RL) areas and how to use them. These areas are Planning, Education, Library, Forums, Fixes, Problem Solving, Services, Customer Initiated Upgrade, and Tools. It also provides step-by-step procedures in using the Subscription function.
  • Performing Licensed Internal Code Maintenance
    This course discusses about maintaining the software that enables hardware such as the service processor on your eServer POWER5 system.

Access to these courses requires an IBM Registration ID and Resource Link Access.

To obtain an IBM Registration ID

  1. Go to http://www.ibm.com/servers/resourcelink
  2. Select "Register" under New users
  3. On the My IBM Registration, fill in an e-mail address for IBM ID and password, and the Security question and answer and the Country of residence and then click Continue and fill in the rest of the User information and click Submit.

Resource Link Access for New Users

  1. Go to http://www.ibm.com/servers/resourcelink
  2. Select "Sign in" enter the IBM ID and password you used to register above
  3. Select "Customer"
  4. Click "Submit" Once submitted it will take an hour before the access takes effect

To view a course:

  1. Sign in to Resource Link
  2. Select Education in the navigation bar on the left
  3. From the Education page, select "eServer i5 and p5 courses"
  4. Select "How to Use the eServer i5 and p5 Hardware Management Console"
  5. Select "Performing Licensed Internal Code Maintenance"
  6. Double-click the link to open the course.

Notes:

  1. The courses are browser based. For optimal viewing, we recommend Microsoft Internet Explorer 6.0 or higher with your display set at 1024 x 768. To set your display, go to My Computer -> Display -> Settings
  2. Course pages can be book marked for easy retrieval.
  3. Course simulations open in a separate window. Use the X in the upper right corner of the window to close the simulation.
  4. If there are QuickTime videos in the course, you need to have the QuickTime viewer installed. A link to the free viewer is on each Resource Link course page and on the related page within each course.