Drivers & software

October 2016: Release notes were updated to add a link to the SHA1 deprecation advisory, to remove a known issue where OA would rarely show product name as unknown after a force takeover, and to add that versions 4.0.4 and 4.1.8 were bridge releases.

Prerequisites:

WARNING: If you are updating from a version prior to 4.0.4, you must install 4.0.4 or 4.1.8 (bridge releases) prior to updating to this version.

HP strongly recommends implementing the following security best practices to help reduce both known and future security vulnerability risks:

1. Isolate the management network by keeping it separate from the production network and not putting it on the open internet without additional access authentication.
2. Patch and Maintain LDAP and web servers.
3. Run the up-to-date viruses and malware scanners in your network environment
4. Apply HP Firmware updates as recommended.

Minimum HP-UX OS and patch requirements for supporting the CB900s i4 blades are documented in the HP-UX Errata for HP Integrity Superdome 2 (Superdome 2 CB900s i2 or i4 Server Blade model) Additional HP-UX 11i v3 (B.11.31) drivers, products, and patches.
Note: No specific patches are required when using HP-UX 11i v3 March 2013 update or later.

Note: As part of fixing a FPL log issue in Superdome 2 complex firmware, FPL logs will be cleared when updating from version 3.7.14 (or lower) to version 3.7.60 (or higher). SEL logs will remain intact.  HP recommends capturing the FPL logs prior to the firmware update by running the SHOW FPL command and selecting ‘F’ (first record) then ‘D’ (dump).

Note: Before updating firmware from version 1.3.x to 2.2.27 or later, the IO slots 6 & 7 (USB and ILO) should be removed from the vPars that currently own these resources as you won't be able to delete them from the vPar after the update.

IMPORTANT:

• In order to prevent running into iCAP issues (see issue examples under the Note below), BEFORE upgrading to complex firmware 2014.07 (version 3.7.98) or later, iCAP Customers using GiCAP MUST do the following on the HP-UX system acting as the Active Group Manager (AGM) and the Standby Group Manager (SGM) :

1. Install OpenSSL 0.9.8za or later on the AGM and if one exists on the SGM. This version of OpenSSL is backwards compatible with current firmware and is available for download from https://h20392.www2.hpe.com/portal/swdepot/displayProductInfo.do?productNumber=OPENSSL11I
2. Restart the cimserver on the AGM and on the SGM

Note: It is supported for a GiCAP group to have members with different firmware versions.

Note: it is possible for the AGM and SGM to be installed on systems other than one of the Superdome 2 partitions. To determine which systems are acting as the AGM and SGM, use the icapstatus command from the OA CLI or from any one of the configured nPars or vPars.

# icapstatus

Software version:          B.11.31.10.07.00.00
Complex Information
-------------------
  Complex name : SD2-16S
  Complex serial number : USE211Y4YW
  Complex product order number : AH337A
  Complex model string : N/A
  Complex UUID : 82a2ccb1-8aa5-11e1-be25-1314a17d3f43
 
Member SD2_alf in GiCAP group SD2
---------------------------------
  Active Group Manager:     hostname.company.net
  Standby Group Manager:    N/A
  Borrowed core usage rights:  0
  Borrowed memory usage rights:  0.0 GB 

Examples of iCAP issues seen when using an OpenSSL version prior to 0.9.8za:
1.  icapmanage –s  on the AGM/SGM cannot get RTU information from the complex.
      Output would look like:
             Group Members:         
                       <server name> (cannot be contacted)
 
2.  Core activation operations may fail despite of sufficient rights available within the complex:
# icapmodify -a2 -p1
 iCAP authorization denied for partition 1.
              Error: Insufficient core usage rights for 2 additional core(s).
 
3.  Adding a member running the new firmware version 3.7.98 or later to an existing group may fail:
#icapmanage -a -m mem04:mem04oa1.fchst.com -g sd2
Enter the password for root on mem04oa1.fchst.com:
icapmanage command failed.
ERROR:   The following low-level error occurred:
           PGS08001: CIM HTTP or HTTPS connector cannot connect to mem04oa1.fchst.com:5989.
           Connection failed.
 
4.  Enabling temporary capacity in a complex may fail:
icapmodify -a1 -t -p1
 iCAP authorization denied for partition 1.
Error: Insufficient usage rights or temporary capacity for 1 additional cores.

Complex firmware version 3.6.48, with all nPartitions running firmware version 2.53.0 or later and HP-UX 11i v3 September 2011 update or later, supports the following features, which may require additional software (see Related Software below and Pre-Requisites below):

• Dynamic Cores vPars
• Dynamic Core Migration (with gWLM)
• Dynamic Processor Resiliency (DPR)
• GiCAP (Global Instant Capacity)
• Locality Optimized Resource Management (LORA)
• Rolling upgrades

Note: If the system is already running on complex firmware 3.6.48 or later and you do no not intend to use any of the features from the list above, you can skip to the “information on supported I/O firmware versions” section in this document.

RELATED SOFTWARE:
The following software is required to use the associated functionality:

• HP Matrix Operating Environment 7.1 Update 2 - includes the minimum version of gWLM (Global Workload Manager) for supporting Dynamic Cores
• Global Workload Manager (gWLM) with patch PHSS_43165 installed on a managed node on top of gWLM Agent of HP MOE 7.1 Update 2
• Dynamic Cores vPars A.05.09 or later
• HP-SIM 7.1 Update 2
• Insight Control Power Management 7.1 Update 2
• GiCAP (Global Instant Capacity) Group Manager and partition-resident iCAP software (released in the HP-UX 11i v3 December 2011 update) which require the updated HP WBEM Services for HP-UX version A 2.09.14 and GiCAP rule file version 2.19.
• Pay-per-use (PPU) requires the Utility Meter 9.4 or higher to enable dynamic cores support.

See the individual software release notes for Related Software information.

Other Pre-Requisites:

• If running HP-UX 11i v3 March 2013 update or later, no additional patches are required with this firmware.
• HP-UX 11i v3 September 2011 update (or later) is required to support this firmware.  The following HP-UX patches (or superseding) must be installed when running on partitions with 2.53.0 or later nPartition firmware.
  •  PHKL_41942 (enable CPU OL*)
  •  PHKL_42482 (enable CPU OL*)
  • PHCO_42306 (enhancement for machinfo)
  • PHKL_42230 (strongly recommended)
  • PHKL_42314 (strongly recommended
     
• With this firmware, if the  HP-UX version is HP-UX 11i v3 September 2011 update or HP-UX 11i v3 March 2012 update:
  • An updated WBEM bundle is required to be installed to add a member Complex to the GiCAP group.
  • An updated SFM bundle is required to send actionable events (with alert level greater than Warning) and test events to the Error Analysis Engine.

                 The updated WBEM bundle and SFM bundle is part of September 2012 web release of WBEM Management bundle (version C.05.01 or later) and can be installed from https://h20392.www2.hpe.com/portal/swdepot/displayProductInfo.do?productNumber=WBEMMgmtBundle

Note: HP-UX 11i v3 September 2012 update already contains the updated WBEM bundle and updated SFM bundle.

• With this firmware, if the HP-UX version is HP-UX 11i v3 March 2012 update or HP-UX 11i v3 September 2012 update, an updated SFM bundle is required to be installed to get the One Stop Fault Management functionality and to handle the new positive return values. This bundle is part of September 2012 web release of WBEM Management bundle (version C.05.01 or later) and can be installed from: https://h20392.www2.hpe.com/portal/swdepot/displayProductInfo.do?productNumber=WBEMMgmtBundle

Note: HP-UX 11i v3 September 2011 update does not support the One Stop Fault Management functionality

• For Superdome 2-32S configurations, HP SIM support requires patch version SIM 6.3 Update 1 or higher


• Dynamic core migration with gWLM & iCAP enablement requires:
  • HP Matrix Operating Environment 7.1 Update 2 or higher
  • Global Workload Manager (gWLM) support with HP SIM 7.1 Update 2 or higher
  • Pay Per Use (PPU) with Utility Meter 9.4
  • HP Instant Capacity version 10.06.01 or later

For information on supported I/O firmware versions, please refer to this Matrix:
HPE Release set for Superdome 2 servers.

To ensure the integrity of your download, HPE recommends verifying your results with this SHA-256 Checksum value:

Reboot Requirement:
Reboot is required after installation for updates to take effect and hardware stability to be maintained.

Installation:

INSTALLATION INSTRUCTIONS:

Please review all instructions and the "Hewlett Packard Enterprise Support Tool License Terms" or your Hewlett Packard Enterprise support terms and conditions for precautions, scope of license, restrictions, and limitation of liability and warranties, before installing this package. It is important that you read and understand these instructions completely before you begin. This can determine your success in completing the firmware update.

These instructions describe how to install the firmware version 4.1.34, and also provide an overview of installing gWLM on a dedicated HP-UX CMS (Central Management Server). The list below is a summary of the steps to install the firmware, OS patches, CMS and gWLM.

1. Update HP-UX

2. Extract the bundle

3. Update Complex and nPartition firmware using OA CLI (2 alternate procedures: updating offline from 1.3.x and updating online from 2.2.27 or later)

4. Update SD2 nPartition firmware using OA CLI (optional)

5. Download and Install the latest IO firmware and drivers as applicable, from the Superdome 2 Download Drivers, Software and Firmware page on http://www.hpe.com/support/hpesc

6. Install the iCAP OS depot on each nPar or vPar

7. Install SIM 7.1 update 2 plus HP Matrix Environment 7.0 with updates onto the CMS to bring it to 7.0 and initialize the VSE configuration

8. Install the gWLM agent on each nPar or vPar where it should run and start it

Update SD2 Complex from Integrated Firmware Bundle using Onboard Administrator's Command Line Interface (CLI)

A. Updating HP-UX September 2011 or later (Required if not already installed)

1.       Install HP-UX September 2011 update or later if not already installed (earlier versions are not supported with complex firmware 4.1.34)

• Complex and nPartition firmware 3.6.48 or later and HP-UX 11i v3 September 2012 update or later are required to support the new CB900s i4 blades.

• Complex firmware 3.6.48 or later requires HP-UX 11i v3 September 2011 update or later and nPartition firmware 2.53.0 or later for CB900s i2 blades.

2. Install HP-UX patches from http://www.software.hpe.com

• See all required patches, including patches that apply to related software, in the Pre-requisites section.

• See also the Compatibility section for features supported with Complex firmware 4.1.34 with each combination of OS versions and Partition firmware.

3. Reboot as required for HP-UX patch install

B. Extracting the bundle

1.       Download the zip file hpsd2-4.1.34-fw.zip in a new folder in your desktop.

2.       Extract the zip file in the same folder. It will extract integrated firmware bundle file hpsd2-4.1.34-fw.bundle, a more complete version of this release note and End User License Agreement Document.

3.       Copy the bundle to a USB Key or to a FTP Server reachable from Onboard Administrator.

NOTE: If you are using FTP, then please make sure the transfer mode is set to "Binary".

C. Updating Superdome 2 Complex and nPartition firmware using OA CLI

1.       Connect to Onboard Administrator over Telnet or SSH and login to get the command line prompt.

NOTE: Steps 2-3 are only required when updating firmware versions earlier than 2.2.27 (e.g. 1.3.x). They require downtime for the entire server. Online update of complex firmware is recommended for systems with 2.2.27 or later firmware. DO NOT perform steps 2-3 for online update of complex firmware.

2.       Gracefully shutdown OS in each partition, using shutdown -h, as forcing partition power off is likely to corrupt OS.

3.       Power down all blades and IOXs using the following command (not required if performing an online firmware update).

OA1-CLI> POWEROFF PARTITION X FORCE OVERRIDE

This may take some time and it asks for confirmation status for partitions before moving on. You can use the following command to confirm status of partitions.

OA1-CLI> parstatus -P

[Partition]

Par    State/           Status*    # of    # of      ILM/          Partition Name

Num RunState                     Blades IOBays SLM     (first 15 (GB)** characters)

=== ======================= ======= ====== ====== =============

  1   Inactive/DOWN  OK       2        2          6.0/56.0            vpars5_6

  2 Inactive/DOWN    OK       3        1          96.0/0.0              klaus

Power off all xBARs using the following command:

OA1-CLI> poweroff xfabric

Wait till it completes the command successfully, it may take a minute.

NOTE: The update procedure for online update of complex firmware on systems with 2.2.27 or later firmware starts here.

4.       To prevent a Link Loss Failover (LLF) from interrupting the firmware update, disable LLF:

OA-CLI> disable LLF

NOTE: Once update is complete, re-enable LLF:

OA-CLI> enable LLF

5.       Verify communications between the OA and all installed Blades, using the connect blade command for each of the installed Blades.

NOTE:  If the OA to Blade communications is not working, update firmware will fail

sd-oa1> connect blade 1

Connecting to bay 1 ...

Hewlett-Packard Integrated Lights-Out 3

(C) Copyright 1999-2010 Hewlett-Packard Development Company, L.P.

iLO Host Name: iLO-643150f79ba0

Revision: 01.34.00

Fri Feb 04 11:37:47 2011

iLO MAIN MENU:

CM: Command Menu

HE: Main Help Menu

X: Exit Connection

[iLO-643150f79ba0] hpiLO-> x

Connection terminated by server.

sd-oa1>

6.       Use the update firmware command, as shown below, to point to Integrated Firmware Update Bundle at a valid ftp location.

OA1-CLI> UPDATE FIRMWARE <uri> all

NOTE: The "all" option must be used in order to update complex AND partition firmware

Where The <uri> should be formatted as usb://<path> for USB installations. Use the SHOW USBKEY command to obtain the <path>.

Example:

Using FTP:

update firmware ftp://user:passwd@15.1.1.75/firmware/hpsd2-4.1.34-fw.bundle all

Using USB Key:

update firmware usb://d2/ hpsd2-4.1.34-fw.bundle all

NOTE: The Firmware update process can take up to 1 hour to complete. During this process you might notice no progress for up to 30 minutes at certain time. In between the updates, connection to OA will be lost as OA will reboot to proceed towards other firmware updates. OA might take up to 30 minutes to come to ready state after the reboot. After OA is rebooted you can reconnect back to OA and login to confirm successful update.

7.       Run the OA command UPDATE SHOW FIRMWARE to display the versions of complex bundle last installed and firmware versions installed.

Example:

OA1-CLI> UPDATE SHOW FIRMWARE

Configured complex firmware bundle version: 4.1.34

====================================================================

Firmware on all devices matches the complex configured bundle version

Note: When doing an “online” update from version 4.1.8 to version 4.1.34, the “show npartition update all” will show a different active and configured version of SFW and the GUI will show “!” for all the online-updated partitions in the complex until the next partition reboot.

8.       Verify all partitions are ready to be started using:

parstatus -P command (this command will not work until the OA restart is complete)

NOTE: Step 9 is only needed if steps 2-3 were performed.

9.       Now the complex is ready to be powered on using poweron partition [X] for each of the nPartitions.

D. Updating SD2 nPartition firmware using OA CLI (optional)

NOTE: Step D is not required if both Complex and nPartition firmware were updated in Step C or when updating from 1.3.x. The nPartition firmware will already be updated.

1.       Connect to Onboard Administrator over Telnet or SSH and login to get the command line prompt.

2.       Run the OA command UPDATE SHOW NPARTITION ALL to display the versions of partition firmware installed.

Example:

OA1-CLI> UPDATE SHOW NPARTITION ALL

nPartition firmware version applied to partition 1 nPar0001

Configured nPartition Firmware Version: 4.1.34

Active nPartition Firmware Version: 4.1.34

nPartition firmware on all blades matches the partition's configured version
 

3.       Use the UPDATE NPARTITION command, as shown below, to point to Integrated Firmware Update Bundle at a valid ftp location and update the desired partition, taking into account planned downtime for OS update and reboot.

OA1-CLI> UPDATE NPARTITION <npar name or number> <uri>

Where <npar name or number> is the partition whose nPartition firmware should be updated.

The <uri> should be formatted as usb://<path> for USB installations. Use the SHOW USBKEY command to obtain the <path>.

Examples:

Using FTP:

update npartition 1 ftp://user:passwd@15.1.1.75/firmware/hpsd2-4.1.34-fw.bundle

Using USB Key:

update npartition 1 usb://d2/hpsd2-4.1.34-fw.bundle

1.       Repeat step 2 to verify that the requested update was successful

2.       Restart nPar to activate partition firmware

NOTE: if nPartition firmware was updated in step C, but not activated, shut down all running OSs in the nPar then power off the nPar, then power on the nPar. The nPar restart will cause the updated nPartition firmware to be activated. The following sequence can be used:

OA1-CLI>POWEROFF PARTITION <npar#> OVERRIDE

• Gracefully shuts down nPar or all vPars at once

• Alternatively, run /etc/shutdown -h on all running OSs

OA1-CLI> POWEROFF PARTITION <npar#> FORCE OVERRIDE

• Really power off the nPar

OA1-CLI> POWERON PARTITION <npar#>

• The nPar, and all vPars if defined, start.

3.       Run the OA command UPDATE SHOW NPARTITION ALL to display the versions of partition firmware installed.

Example:

OA1-CLI> UPDATE SHOW NPARTITION ALL

• nPartition firmware version applied to partition 1 nPar00

• Configured nPartition Firmware Version: 4.1.34

• Active nPartition Firmware Version: 4.1.34

• nPartition firmware on all blades matches the partition's configured version.

E. Update IO firmware

See the Superdome 2 release set matrix for required versions. IO firmware packages are posted on the Superdome 2 firmware download page for HP-UX 11i v3 Operating System.

F. Install the iCAP depot on each partition (nPar or vPar)

Refer to the release notes for HP Instant Capacity 10.x listed in the table of related documentation above, and associated user guides for instructions. If you need to upgrade to Managed iCAP, please contact HPE support.

G. Install SIM 7.1 update 2 onto the CMS to bring it to 6.3.2

Refer to the release notes for gWLM listed in the table of related documentation above, and associated user guides for instructions.

H. Install the gWLM agent on each partition (nPar or vPar) where it should run and configure to start and enable

• Refer to the release notes for gWLM listed in the table of related documentation above, and associated user guides for instructions.
• Perform customer-specific configuration by creating gWLM policies, SRDs
• Integrate the vPars into HP-SIM.
• From the HP Systems Insight Manager web interface, from the top horizontal menu (Tools, Deploy, Configure...) select Configure -> Configure or Repair Agents... For the target of this command, select all of the partitions to be managed by this SIM instance
• Create gWLM policies
• Create gWLM SRD
• Deploy gWLM SRD (start in advisory mode then in managed mode, doing load testing to check for correct response)
• Log into the OA and run SHOW SYSLOG OA. Look for evidence of cores being dynamically moved.

COMPATIBILITY/INTEROPERABILITY:

WARNING: Do not disconnect AC power to HP Integrity Servers or remove HP Server Blades from the enclosure during the firmware upgrade process. Doing so may corrupt the programming of the firmware, rendering the Server inoperable.

• See the supported firmware/OS combinations and recommendations for using PCI OL* in the full release notes bundled with the binary.

DETERMINING CURRENT VERSION:

• Establish a telnet session with OA and login to the get the command prompt
• Type the OA command "UPDATE SHOW FIRMWARE" to display the version of complex bundle installed. Type the OA command “UPDATE SHOW NPARTITION ALL“ to display the version of nPartition firmware installed on each partition.

End User License Agreements:
HPE Software License Agreement v1
BladeSystem Onboard Administrator Software End User License Agreement
Superdome 2 Software End User License Agreement

Upgrade Requirement:
Optional - Users should update to this version if their system is affected by one of the documented fixes or if there is a desire to utilize any of the enhanced functionality provided by this version.

Version 4.1.34(a) contains the same firmware version 4.1.34 as bundle version 4.1.34. Version (a) was created to update the release notes, packaged with the firmware bits.

Important:

TITLE: HP Integrity Superdome 2 Server Firmware Bundle - for manual install

VERSION:
Bundle Version: 4.1.34(a)
Firmware version: 4.1.34

DESCRIPTION:
This bundle contains the Complex and nPartition Firmware updates for HP Integrity Superdome 2 Servers.

SUPERSEDES:
Firmware version 4.1.8

PRODUCT MODEL(S):
Superdome 2 – 8s
Superdome 2 – 16s
Superdome 2 – 32s

OPERATING SYSTEMS:
- HP-UX 11i v3 September 2011 update (or later) is required to support this firmware with CB900s i2 blades only
- HP-UX 11i v3 March 2012 update
- HP-UX 11i v3 September 2012 update or later is required to support this firmware with CB900s i4 blades

RELATED SOFTWARE:
See details in the full release notes bundled with the binary, under Related Software.

LANGUAGES:
International English

WARNING: To ensure that the OA GUI continues to work after December 31, 2016, after upgrading to version 4.1.34, the OA SHA1 self-signed certificate will be removed and replaced with SHA256 self-signed certificate.

• To prevent security warnings, user is encouraged to re-generate the self-signed certificate with the common name (CN) matching exactly the OA hostname as known by the web browser. See the Certificate Administration section in the OA user guide and this advisory c05315790 for more information.

• Also GiCAP users must update the OA certificates stored on the Active Group Manager (AGM) and the Standby Group Manager (SGM) so they can continue to borrow or loan core usage rights in their GiCAP group or perform TiCAP prefetch. This is because AGM and SGM will keep the stale OA certificate for the GiCAP member. More information is available in this advisory c05242542.

Warning: Due to the use of a stronger signing key in version 4.1.34, you need to contact HPE support in order to downgrade from version 4.1.34 to an earlier version.

Notes:

• Version 4.1.34 includes changes for Complex firmware only.
• Complex firmware version must be equal to or higher than the nPartitions firmware version
• Partitions containing CB900s i4 blades (Intel Itanium 9500 series processors) must run HP-UX 11i v3 September 2012 or later and both the Complex and nPartitions must run firmware version 3.6.48 or later
• Partitions containing CB900s i2 blades (Intel Itanium 9300 series processors) must run HP-UX 11i v3 September 2011 update or later, the Complex must run firmware version 3.6.48 or later and nPartitions must run firmware version 2.53.0 or later
• After updating complex firmware to 3.6.48 or later, partitions on CB900s i2 blades can continue to run 2.53.0 nPartition firmware and the complex can have a mix of nPartition firmware version 2.53.0 and later versions active at the same time
• Rolling upgrades:
  • Servers with complex firmware version 1.3.0 or 1.3.1 require bringing down the entire complex to perform the firmware update.
  • Servers with complex firmware version 2.2.27 or later and running HP-UX 11i v3 September 2011 update or later can be updated online without bringing down the complex. A partition reboot must be scheduled when convenient to activate a new nPartition firmware.
    • You may update the complex and all the nPartitions firmware at the same time; otherwise make sure that your intermediate combination of complex and nPartitions firmware is supported (see table in the Compatibility section)
• Firmware update process notes:
  • If LLF (Link Loss Failover setting) is enabled and a loss of link occurs on the active OA during a firmware update from complex version 2.53.0 or earlier, blades can be left in an unusable state. Workaround: Disable LLF prior to a firmware update using "disable LLF" and re-enable LLF upon completion using "enable LLF”
  • For gWLM users, it is recommended to stop gWLM while performing an online update.
  • If running Business iCAP software, you must update to Managed iCAP. See dependencies under Pre-Requisites. For more details on the iCAP upgrade, please contact HPE support.
  • When updating active IOX enclosures from a version 2.53.0 or earlier, the update will be partial until each IOX can be updated after shutting down affected partitions.  It is supported to run indefinitely in the partially updated (Mixed) state.  IOX enclosures in this state will not have the increased thermal tolerance introduced in version 3.6.48. To complete the update, you must shutdown all partitions using an IOX and then reapply the firmware update to the complex only (not to the nPartition).
  • When updating to this release from 2.2.27 or earlier, Socket Level Memory (SLM) values for nPars that still have default factory values will be set to 0.You should check and document the values before the update using the parstatus command. After the update has completed, reset the values using the parmodify command.
  • Firmware update can be performed using HP SUM or from the OA CLI or GUI.
• User access to commands for managing the partitions and their configuration can be controlled through the Parcon_Admin access right and partition access assignments using the ASSIGN PARCON_ADMIN and ASSIGN PARTITION commands. This was enforced starting with version 3.6.48 and OA user with operator capabilities can’t use “parstatus, parcreate, etc”.

KNOWN ISSUES AND WORKAROUNDS:

• iLO may hang occasionally when running with complex firmware version 3.7.60 or higher. 
  Workaround: A new "reset ilo <bay #>" CLI command was introduced in version 4.0.4 to recover from the hang.

• When removing an SNMP receiver’s IP address (ex. 10.11.12.13), OA will also incorrectly remove all receivers’ IP addresses that contain that IP address as a substring (ex. 10.11.12.13 and 10.11.12.133). The user will have to manually add back the removed IP addresses (ex. 10.11.12.133).

• No error is reported for loss of power supply redundancy if all but one of the upper power supplies are removed or failed.
• If SSL certificates are renewed with GiCAP_OA_keygen on GMs after some members are removed, you must restart all the OAs specified for a member before re-adding the member or the addition will fail.
• iLO is affected by the OpenSSL Poodle (Padding Oracle on Downgraded Legacy Encryption) CVE-2014-3566 vulnerability. More information can be found in this advisory c04496345 and on the HP support center at this link (Enter CVE-2014-3566 in the Search box).
• Several iCAP commands may fail when using GiCAP on an AGM/SGM system running a version of OpenSSL prior to 0.9.8za. See the Pre-Requisites section for error examples.
  Workaround: Install OpenSSL 0.9.8za or later on the AGM and if one exists on the SGM (see Pre-Requisites section for details).
• Update show nPartition can fail to read the configured firmware version
  Workaround: Since this issue is intermittent, repeating the command may return the correct information. The SHOW BLADE INFO command will also return the nPartition firmware version for each blade in the partition.
• The connection to the system console logs is lost after hitting CTRL-c.
• Java Runtime Environment (JRE) must be installed on the client system to view the remote serial console screens (see advisory c04675356).
• When adding privileges to a user or group account via the OA GUI, only the first enclosure’s Server and IO Bays are displayed for selection.  This issue only impacts systems with multiple enclosures (32-socket systems).  Since Superdome privileges are assigned on a partition basis, not a Server or IO Bay basis, there is no effect on system operation.
• When a Fabric configuration change needs to be propagated across partitions and blades, and one of the nPars is a single blade nPar where the blade is missing, FAB_DAEMON_ERROR is generated.  There is no impact to performance or functionality.
• Rapid navigation through the partition pages can result in incorrect content being displayed.  Please wait for pages to load completely before navigating away to another tab.
• When a user navigates from Create nPartition to Modify nPartition in the GUI, fields in the Modify nPartition page may end up displaying empty fields.  Select the newly created partition from the left navigation menu and click on the Modify button on the Status tab to update the blank fields.
• vPar state handling gets stuck in INIT when a TOC is issued on the vPar while it is activating. 
  Workaround: Force a reboot or shut down the vPar to recover the state.
• An nPar may get stuck in the reboot state if a TOC is issued on the nPar and a reboot is issued before the TOC completes. 
  Workaround:  Force a power off on the nPar.
• If a blade is left in a bad state after an online firmware update, the GUI does not provide enough information to diagnose the problem. 
  Workaround: The OA CLI command “show update firmware” can provide additional information.
• Under conditions of very high, unnatural stress involving reboot cycles and core license and assignment migration, some core movement requests may fail.  An example scenario would be a user running an OL* operation via a script in a stressful way, issuing both icapmodify and vparmodify commands on the same vPar. 
  Workaround: The problem is resolved by retrying the failed request.
• If a vPar does not have SLM (Socket Local Memory) assigned to it, the SLM field under “Memory Details” from the vparstatus -v command is blank.
• Upon the rapid issue of multiple parallel vparcreate commands on the same nPar, one of the commands may fail.  This failure is typically encountered when a script is created to issue multiple vparcreate commands in rapid succession. 
  Workaround: It is advisable to insert a delay of 1-2 seconds between successive vparcreate commands in scripts to avoid facing this issue.
• De-configuring a CPU socket causes the memory associated with the socket to be lost to the partition but this change is not reflected in the nPar "Status" page.
• The OA GUI shows the status of CPUs and DIMMs on an indicted/de-configured blade as OK instead of indicted or de-configured.
  Workaround: Check the status using the CLI interface.
• A user without partition access privileges may select "Update All Firmware" in the OA GUI Firmware Update page but the command will fail with the error "The action did not complete successfully."
  Workaround: If this message is displayed, verify that the user has sufficient permissions.
• If the SLM (socket local memory) for a blade is provided in absolute value (GB) during nPartition creation and/or modification, then “Total SLM” field in parstatus output (parstatus –c <blade_path> –V) and “SLM at Next Boot” field in parstatus output (parstatus –Z <parspec_name>) will display --.-% instead of the percentage of SLM memory configured. The values  however are properly configured internally.
  Workaround: To view the values configured at the nPartition level, you may run the command “parstatus –p <partition> -V”.
• In vPars mode, "Virtual Devices" tab, which allows access to internal DVD and other virtual devices, is not available to OA users configured with "Operator" level privilege.
  Workaround: Use the privilege "Administrator" for this task.
• After a FW update and after power-on, the nPartition ILM/SLM setting may rarely be altered due to a timing issue.
  Workaround: Powering off and powering on the partition will restore the expected values.
• Some BPS may rarely show in dynamic power saving mode although dynamic power saving is turned off for the complex.
  Workaround: Turn on dynamic power saving for the complex and turn it off again.
• For powered off partitions, after OA failover or OA restart, 'show xfm status all’ and ‘show IOX status all’ may show J-LINKs as “OK” instead of “Dormant”.
• If an active J-LINK cable gets disconnected, ‘show XFM status all’ and ‘show IOX status all’ may report that LINK as “Degraded” instead of “Failed” and as “OK” instead of “Dormant.
  Workaround: Restart OA to see the proper status.
• Superdome 2 OA/CAMNet uses 169.254.0.x and 10.254.x.x addresses for internal management. Those addresses are visible to the outside LAN via “SNMPwalk”, which may cause incorrect reports of IP address conflicts. However since the internal management network traffic is contained within the complex, this will not affect the customer’s management network.
  Note: The OA EBIPA cannot use addresses 169.254.x.x or 10.254.x.x.
• After a CAMNET link failure, “Show complex status” continues to report CAMNET status as “Degraded” even after recovery of the CAMNET cable and acquitting the IOX indictment.
  Workaround: Restart OA to see proper status.
• The system does not detect or report when there is a problem with the standby CAMNET.
• After an OA restart, a partition state may become Unknown/Detached. Refer to the HPE Superdome 2 Partitioning Administrator Guide HP-UX 11i v3 for details.

Known IO Issue with 10 GbE Superdome 2 LOM and AM225A/AM232A/AM233A cards (EFI 5.2.60/ROM 6.2.28):

• A general exception fault may rarely occur when using the Broadcom 10 GbE adapter on a Superdome 2 server connected to a network switch with STP disabled. This failure only occurs in the UEFI environment, in presence of abundant broadcast traffic, and prevents from booting the partition to the OS. As a workaround, enable STP on the switch.

Known issues related to PCI OL*

• See a list of known issues related to PCI OL* in the full release notes bundled with the binary.

COMPATIBILITY/INTEROPERABILITY:
See more Compatibility/Interoperability information in the full release notes bundled with the binary.

DETERMINING CURRENT VERSION:

• Establish a telnet session with OA and login to the get the command prompt
• Type the OA command "UPDATE SHOW FIRMWARE" or “UPDATE SHOW NPARTITION ALL” to display the version of complex or nPartition firmware installed. 

DISCLAIMER:
The information in this document is subject to change without notice.
Hewlett Packard Enterprise makes no warranty of any kind with regard to this material, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. Hewlett Packard Enterprise shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material.
This document contains proprietary information that is protected by copyright. All rights are reserved. No part of this document may be reproduced, photocopied, or translated to another language without the prior written consent of Hewlett Packard Enterprise Company.
(C) Copyright 1994-2016 Hewlett Packard Enterprise Development, L.P.

FEEDBACK
As we are continuing to improve the firmware management process we welcome your feedback on this document and on the firmware update process: TEAM-FWupdateFeedback@groups.ext.hpe.com

Upgrade Requirement:
Optional - Users should update to this version if their system is affected by one of the documented fixes or if there is a desire to utilize any of the enhanced functionality provided by this version.

Version 4.1.34(a) contains the same firmware version 4.1.34 as bundle version 4.1.34. Version (a) was created to update the release notes, packaged with the firmware bits.

None from version 4.1.34. Only the release notes were updated in version 4.1.34(a).

TITLE: HP Integrity Superdome 2 Server Firmware Bundle - for manual install

VERSION:
Bundle Version: 4.1.34(a)
Firmware version: 4.1.34

DESCRIPTION:
This bundle contains the Complex and nPartition Firmware updates for HP Integrity Superdome 2 Servers.

SUPERSEDES:
Firmware version 4.1.8

PRODUCT MODEL(S):
Superdome 2 – 8s
Superdome 2 – 16s
Superdome 2 – 32s

OPERATING SYSTEMS:
- HP-UX 11i v3 September 2011 update (or later) is required to support this firmware with CB900s i2 blades only
- HP-UX 11i v3 March 2012 update
- HP-UX 11i v3 September 2012 update or later is required to support this firmware with CB900s i4 blades

RELATED SOFTWARE:
See details in the full release notes bundled with the binary, under Related Software.

LANGUAGES:
International English

WARNING: To ensure that the OA GUI continues to work after December 31, 2016, after upgrading to version 4.1.34, the OA SHA1 self-signed certificate will be removed and replaced with SHA256 self-signed certificate.

• To prevent security warnings, user is encouraged to re-generate the self-signed certificate with the common name (CN) matching exactly the OA hostname as known by the web browser. See the Certificate Administration section in the OA user guide and this advisory c05315790 for more information.

• Also GiCAP users must update the OA certificates stored on the Active Group Manager (AGM) and the Standby Group Manager (SGM) so they can continue to borrow or loan core usage rights in their GiCAP group or perform TiCAP prefetch. This is because AGM and SGM will keep the stale OA certificate for the GiCAP member. More information is available in this advisory c05242542.

Warning: Due to the use of a stronger signing key in version 4.1.34, you need to contact HPE support in order to downgrade from version 4.1.34 to an earlier version.

Notes:

• Version 4.1.34 includes changes for Complex firmware only.
• Complex firmware version must be equal to or higher than the nPartitions firmware version
• Partitions containing CB900s i4 blades (Intel Itanium 9500 series processors) must run HP-UX 11i v3 September 2012 or later and both the Complex and nPartitions must run firmware version 3.6.48 or later
• Partitions containing CB900s i2 blades (Intel Itanium 9300 series processors) must run HP-UX 11i v3 September 2011 update or later, the Complex must run firmware version 3.6.48 or later and nPartitions must run firmware version 2.53.0 or later
• After updating complex firmware to 3.6.48 or later, partitions on CB900s i2 blades can continue to run 2.53.0 nPartition firmware and the complex can have a mix of nPartition firmware version 2.53.0 and later versions active at the same time
• Rolling upgrades:
  • Servers with complex firmware version 1.3.0 or 1.3.1 require bringing down the entire complex to perform the firmware update.
  • Servers with complex firmware version 2.2.27 or later and running HP-UX 11i v3 September 2011 update or later can be updated online without bringing down the complex. A partition reboot must be scheduled when convenient to activate a new nPartition firmware.
    • You may update the complex and all the nPartitions firmware at the same time; otherwise make sure that your intermediate combination of complex and nPartitions firmware is supported (see table in the Compatibility section)
• Firmware update process notes:
  • If LLF (Link Loss Failover setting) is enabled and a loss of link occurs on the active OA during a firmware update from complex version 2.53.0 or earlier, blades can be left in an unusable state. Workaround: Disable LLF prior to a firmware update using "disable LLF" and re-enable LLF upon completion using "enable LLF”
  • For gWLM users, it is recommended to stop gWLM while performing an online update.
  • If running Business iCAP software, you must update to Managed iCAP. See dependencies under Pre-Requisites. For more details on the iCAP upgrade, please contact HPE support.
  • When updating active IOX enclosures from a version 2.53.0 or earlier, the update will be partial until each IOX can be updated after shutting down affected partitions.  It is supported to run indefinitely in the partially updated (Mixed) state.  IOX enclosures in this state will not have the increased thermal tolerance introduced in version 3.6.48. To complete the update, you must shutdown all partitions using an IOX and then reapply the firmware update to the complex only (not to the nPartition).
  • When updating to this release from 2.2.27 or earlier, Socket Level Memory (SLM) values for nPars that still have default factory values will be set to 0.You should check and document the values before the update using the parstatus command. After the update has completed, reset the values using the parmodify command.
  • Firmware update can be performed using HP SUM or from the OA CLI or GUI.
• User access to commands for managing the partitions and their configuration can be controlled through the Parcon_Admin access right and partition access assignments using the ASSIGN PARCON_ADMIN and ASSIGN PARTITION commands. This was enforced starting with version 3.6.48 and OA user with operator capabilities can’t use “parstatus, parcreate, etc”.

KNOWN ISSUES AND WORKAROUNDS:

• iLO may hang occasionally when running with complex firmware version 3.7.60 or higher. 
  Workaround: A new "reset ilo <bay #>" CLI command was introduced in version 4.0.4 to recover from the hang.

• When removing an SNMP receiver’s IP address (ex. 10.11.12.13), OA will also incorrectly remove all receivers’ IP addresses that contain that IP address as a substring (ex. 10.11.12.13 and 10.11.12.133). The user will have to manually add back the removed IP addresses (ex. 10.11.12.133).

• No error is reported for loss of power supply redundancy if all but one of the upper power supplies are removed or failed.
• If SSL certificates are renewed with GiCAP_OA_keygen on GMs after some members are removed, you must restart all the OAs specified for a member before re-adding the member or the addition will fail.
• iLO is affected by the OpenSSL Poodle (Padding Oracle on Downgraded Legacy Encryption) CVE-2014-3566 vulnerability. More information can be found in this advisory c04496345 and on the HP support center at this link (Enter CVE-2014-3566 in the Search box).
• Several iCAP commands may fail when using GiCAP on an AGM/SGM system running a version of OpenSSL prior to 0.9.8za. See the Pre-Requisites section for error examples.
  Workaround: Install OpenSSL 0.9.8za or later on the AGM and if one exists on the SGM (see Pre-Requisites section for details).
• Update show nPartition can fail to read the configured firmware version
  Workaround: Since this issue is intermittent, repeating the command may return the correct information. The SHOW BLADE INFO command will also return the nPartition firmware version for each blade in the partition.
• The connection to the system console logs is lost after hitting CTRL-c.
• Java Runtime Environment (JRE) must be installed on the client system to view the remote serial console screens (see advisory c04675356).
• When adding privileges to a user or group account via the OA GUI, only the first enclosure’s Server and IO Bays are displayed for selection.  This issue only impacts systems with multiple enclosures (32-socket systems).  Since Superdome privileges are assigned on a partition basis, not a Server or IO Bay basis, there is no effect on system operation.
• When a Fabric configuration change needs to be propagated across partitions and blades, and one of the nPars is a single blade nPar where the blade is missing, FAB_DAEMON_ERROR is generated.  There is no impact to performance or functionality.
• Rapid navigation through the partition pages can result in incorrect content being displayed.  Please wait for pages to load completely before navigating away to another tab.
• When a user navigates from Create nPartition to Modify nPartition in the GUI, fields in the Modify nPartition page may end up displaying empty fields.  Select the newly created partition from the left navigation menu and click on the Modify button on the Status tab to update the blank fields.
• vPar state handling gets stuck in INIT when a TOC is issued on the vPar while it is activating. 
  Workaround: Force a reboot or shut down the vPar to recover the state.
• An nPar may get stuck in the reboot state if a TOC is issued on the nPar and a reboot is issued before the TOC completes. 
  Workaround:  Force a power off on the nPar.
• If a blade is left in a bad state after an online firmware update, the GUI does not provide enough information to diagnose the problem. 
  Workaround: The OA CLI command “show update firmware” can provide additional information.
• Under conditions of very high, unnatural stress involving reboot cycles and core license and assignment migration, some core movement requests may fail.  An example scenario would be a user running an OL* operation via a script in a stressful way, issuing both icapmodify and vparmodify commands on the same vPar. 
  Workaround: The problem is resolved by retrying the failed request.
• If a vPar does not have SLM (Socket Local Memory) assigned to it, the SLM field under “Memory Details” from the vparstatus -v command is blank.
• Upon the rapid issue of multiple parallel vparcreate commands on the same nPar, one of the commands may fail.  This failure is typically encountered when a script is created to issue multiple vparcreate commands in rapid succession. 
  Workaround: It is advisable to insert a delay of 1-2 seconds between successive vparcreate commands in scripts to avoid facing this issue.
• De-configuring a CPU socket causes the memory associated with the socket to be lost to the partition but this change is not reflected in the nPar "Status" page.
• The OA GUI shows the status of CPUs and DIMMs on an indicted/de-configured blade as OK instead of indicted or de-configured.
  Workaround: Check the status using the CLI interface.
• A user without partition access privileges may select "Update All Firmware" in the OA GUI Firmware Update page but the command will fail with the error "The action did not complete successfully."
  Workaround: If this message is displayed, verify that the user has sufficient permissions.
• If the SLM (socket local memory) for a blade is provided in absolute value (GB) during nPartition creation and/or modification, then “Total SLM” field in parstatus output (parstatus –c <blade_path> –V) and “SLM at Next Boot” field in parstatus output (parstatus –Z <parspec_name>) will display --.-% instead of the percentage of SLM memory configured. The values  however are properly configured internally.
  Workaround: To view the values configured at the nPartition level, you may run the command “parstatus –p <partition> -V”.
• In vPars mode, "Virtual Devices" tab, which allows access to internal DVD and other virtual devices, is not available to OA users configured with "Operator" level privilege.
  Workaround: Use the privilege "Administrator" for this task.
• After a FW update and after power-on, the nPartition ILM/SLM setting may rarely be altered due to a timing issue.
  Workaround: Powering off and powering on the partition will restore the expected values.
• Some BPS may rarely show in dynamic power saving mode although dynamic power saving is turned off for the complex.
  Workaround: Turn on dynamic power saving for the complex and turn it off again.
• For powered off partitions, after OA failover or OA restart, 'show xfm status all’ and ‘show IOX status all’ may show J-LINKs as “OK” instead of “Dormant”.
• If an active J-LINK cable gets disconnected, ‘show XFM status all’ and ‘show IOX status all’ may report that LINK as “Degraded” instead of “Failed” and as “OK” instead of “Dormant.
  Workaround: Restart OA to see the proper status.
• Superdome 2 OA/CAMNet uses 169.254.0.x and 10.254.x.x addresses for internal management. Those addresses are visible to the outside LAN via “SNMPwalk”, which may cause incorrect reports of IP address conflicts. However since the internal management network traffic is contained within the complex, this will not affect the customer’s management network.
  Note: The OA EBIPA cannot use addresses 169.254.x.x or 10.254.x.x.
• After a CAMNET link failure, “Show complex status” continues to report CAMNET status as “Degraded” even after recovery of the CAMNET cable and acquitting the IOX indictment.
  Workaround: Restart OA to see proper status.
• The system does not detect or report when there is a problem with the standby CAMNET.
• After an OA restart, a partition state may become Unknown/Detached. Refer to the HPE Superdome 2 Partitioning Administrator Guide HP-UX 11i v3 for details.

Known IO Issue with 10 GbE Superdome 2 LOM and AM225A/AM232A/AM233A cards (EFI 5.2.60/ROM 6.2.28):

• A general exception fault may rarely occur when using the Broadcom 10 GbE adapter on a Superdome 2 server connected to a network switch with STP disabled. This failure only occurs in the UEFI environment, in presence of abundant broadcast traffic, and prevents from booting the partition to the OS. As a workaround, enable STP on the switch.

Known issues related to PCI OL*

• See a list of known issues related to PCI OL* in the full release notes bundled with the binary.

COMPATIBILITY/INTEROPERABILITY:
See more Compatibility/Interoperability information in the full release notes bundled with the binary.

DETERMINING CURRENT VERSION:

• Establish a telnet session with OA and login to the get the command prompt
• Type the OA command "UPDATE SHOW FIRMWARE" or “UPDATE SHOW NPARTITION ALL” to display the version of complex or nPartition firmware installed. 

DISCLAIMER:
The information in this document is subject to change without notice.
Hewlett Packard Enterprise makes no warranty of any kind with regard to this material, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. Hewlett Packard Enterprise shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material.
This document contains proprietary information that is protected by copyright. All rights are reserved. No part of this document may be reproduced, photocopied, or translated to another language without the prior written consent of Hewlett Packard Enterprise Company.
(C) Copyright 1994-2016 Hewlett Packard Enterprise Development, L.P.

FEEDBACK
As we are continuing to improve the firmware management process we welcome your feedback on this document and on the firmware update process: TEAM-FWupdateFeedback@groups.ext.hpe.com