• NSM Get-Port-Network-Addresses returned an invalid format on B200/B300 HMC. It now follows the documented non-compact format.
• An issue that could prevent the adapter’s PCIe link from re-establishing after the host resumed from a deep power-down state. This fix improves the reliability of suspend/resume cycles.
• A DEAD IRISC assert that could occur during TLV NV_DATA flash access by suspending the watchdog while waiting for flash IPC (until timeout), preventing the assert on TLV access.
• An issue where repeatedly writing NVCONFIG TLVs could cause excessive NV_DATA partition swaps during garbage collection. This rapid cycling could accelerate flash wear (end-of-life at 100,000 erases) and potentially render the device inoperable. Firmware now avoids unnecessary physical writes by returning OK when the requested configuration already exists in flash, and increases the maximum supported NV_DATA partition swaps from 100,000 to 200,000.
• ICM_RES_HW_DMFS_ENCAP_H_FW was allocated per GVMI, preventing some RTTs from using it.
• vDPA doorbell resources were not released, which could cause failures when running other functionality after a vDPA FLR. Doorbell resources are now properly unlocked.
• RDMA traffic could stall in large-scale deployments for certain source IP and UDP source-port combinations when DOCA PCC was active and no congestion-control algorithm was configured in algorithm slot 0.
• The live migration target did not receive a port state change event on the resume VHCA command. The target now generates this event so software that depends on port state is notified of any changes.
• A precopy image was processed during the stop-copy phase, causing prolonged downtime due to a software limitation. The handling was slow because the handler performed a linear search for data; this was improved by replacing it with a faster search approach enabled via compile-time preprocessing.
• QPs established before loading DOCA PCC could exhibit inconsistent algorithm-selected behavior between ports in LAG mode after DOCA PCC is loaded.

• NSM Get-Port-Network-Addresses returned an invalid format on B200/B300 HMC. It now follows the documented non-compact format.
• An issue that could prevent the adapter’s PCIe link from re-establishing after the host resumed from a deep power-down state. This fix improves the reliability of suspend/resume cycles.
• A DEAD IRISC assert that could occur during TLV NV_DATA flash access by suspending the watchdog while waiting for flash IPC (until timeout), preventing the assert on TLV access.
• An issue where repeatedly writing NVCONFIG TLVs could cause excessive NV_DATA partition swaps during garbage collection. This rapid cycling could accelerate flash wear (end-of-life at 100,000 erases) and potentially render the device inoperable. Firmware now avoids unnecessary physical writes by returning OK when the requested configuration already exists in flash, and increases the maximum supported NV_DATA partition swaps from 100,000 to 200,000.
• ICM_RES_HW_DMFS_ENCAP_H_FW was allocated per GVMI, preventing some RTTs from using it.
• vDPA doorbell resources were not released, which could cause failures when running other functionality after a vDPA FLR. Doorbell resources are now properly unlocked.
• RDMA traffic could stall in large-scale deployments for certain source IP and UDP source-port combinations when DOCA PCC was active and no congestion-control algorithm was configured in algorithm slot 0.
• The live migration target did not receive a port state change event on the resume VHCA command. The target now generates this event so software that depends on port state is notified of any changes.
• A precopy image was processed during the stop-copy phase, causing prolonged downtime due to a software limitation. The handling was slow because the handler performed a linear search for data; this was improved by replacing it with a faster search approach enabled via compile-time preprocessing.
• QPs established before loading DOCA PCC could exhibit inconsistent algorithm-selected behavior between ports in LAG mode after DOCA PCC is loaded.

• ConnectX-7がプローブベースのアルゴリズムを使用してConnectX-8と通信する際に、プローブパケットがドロップされるため、帯域幅が著しく低下する可能性がある相互運用性の問題。
• DPAカーネルは、プロセスの作成/変更時に安全でないICMアクセスを使用していたため、FLR時にDPAカーネルのハングアップを引き起こしていました。
• ユーザーデバッガーの“query caps”は、機能ビットマップではなく、機能の数のみを返しました。
• スタンバイ／ブート電源シーケンスでの競合状態。特定のタイミングウィンドウで、ポートの電源オフが遅延するため、電源オンフローでポートがまだ電源オフに移行中であると検出され、シーケンスが失敗し、ポートが電源オフ状態のまま動かなくなります。
• mlxlinkは、ファームウェアのローカルポートマッピングの誤りとMFTで使用されるページ番号の誤りにより、SNR (メディアおよびホスト) の値を0と報告しました。
• SMBusの解放競合状態のため、I2Cバスが停止します。
• ヒューズの値が、異なるConnectX-7設定間で書き込まれたアップデートされた値と一致していませんでした。
• IPv6トラフィックのLAGに使用されるステアリング定義者の問題。
• 順序が正しくないパケットへの応答で、誤ったCNPが送信されました。
• ルートコンプレックスは、BDFが割り当てられる前にMCTP over PCIメッセージを送信したため、応答がBDF 0で送信されました。この修正により、有効なBDFが割り当てられるまで、IDによってルーティングされるMCTPメッセージが無視されます。
• LLPD経由でSpectrum-Xの部分的な機能 (BTH.AR) を有効にした後に、ステアリングテーブルがアップデートされませんでした。
• パケットのカプセル化解除が発生すると、FCS表示が正しく計算されませんでした。
• IBシステムで、RTT_response_sl機能がスニファーツール (例：Wireshark/Tcpdump/) で動作しませんでした。
   

• An interoperability issue where, when ConnectX-7 communicates with ConnectX-8 using the probe-based algorithm, bandwidth could become extremely low due to probe packets being dropped.
• The DPA kernel used unsafe ICM access during process creation/modification, which would cause the DPA kernel to hang during FLR.
• User Debugger “query caps” returned only the number of capabilities, not the capability bitmap.
• Race condition in standby/boot power sequencing. In certain timing windows, port power-down would be delayed such that the power-up flow detected the port still transitioning to power-down, causing the sequence to fail and leaving the port stuck in a powered-down state.
• mlxlink reported 0 values for SNR (media and host) due to incorrect local port mapping in firmware and an incorrect page number used by MFT.
• Due to an SMBus release race condition, the I2C bus would become stuck.
• Fuse values were not aligned with the updated values burned across different ConnectX-7 setups.
• Issue in the steering definers used for LAG with IPv6 traffic.
• A spurious CNP was sent in response to an out-of-sequence packet.
• The root complex sent MCTP-over-PCI messages before a BDF was assigned, causing responses to be sent with BDF 0. The fix ensures that MCTP messages routed by ID are ignored until a valid BDF is assigned.
• The steering tables were not updated after enabling partial Spectrum-X capabilities (BTH.AR) via LLPD.
• When decapsulation on a packet occurred, the FCS indication was not calculated correctly.
• In IB system, RTT_response_sl feature did not work with Sniffer tools (e.g., Wireshark/Tcpdump/).
   

このバージョンのシステムROMには、インテル製品アップデート（IPU）バージョンIPU.2026.3ガイダンスに沿ったアップデートが含まれています。

このバージョンのシステムROMは、Server Platform Services（SPS）ファームウェア06.03.04.069.0（2.40_01_12_2026）と組み合わせる必要があります。

報告されたセキュリティ脆弱性とその緩和策の詳細については、リンクセキュリティ報告ライブラリ | HPEサポートを参照してください。

ファームウェアの依存関係：

なし

修正された問題点:

Intel Xeon E-2477P (6377P) プロセッサーが、サポートされるコア数を12ではなく8と誤って報告していた問題を解決しました。

特定のMMCFG構成オプションを適用した際に、システムがハングアップしたり、異常終了が発生したりする問題を解決しました。

夏時間調整後のオフセット検証が失敗した場合に、起動時にシステムタイムゾーンが予期せずデフォルト値にリセットされる可能性がある問題を解決しました。

特定の条件下でPCIeエラー処理中にレッドスクリーンオブデス（RSOD）が発生する可能性がある問題を解決しました。

メモリトレーニング後のPOST中に予期しないプロセッサー状態が発生し、システム障害を引き起こす可能性があり、特定の診断操作中にRSODが発生する可能性がある問題を解決しました。

SPDM対応デバイスが多数存在するシステムにおいて、SPDMポリシーが無効になっている場合でも、不要な起動遅延が発生する問題を解決しました。

廃止されたASIX USB NIC RBSU設定ノブがまだ表示されていた問題を解決しました。つまみは不要になったため取り外しました。

UINT32オーバーフロー条件により、8GBまたは16GB容量のeMMCデバイスが正しく処理されない問題を解決しました。

既知の問題点：

オペレーティングシステムがタイムゾーンを構成した後、UEFIシステムユーティリティ (RBSU) で行われる以降のタイムゾーン変更は、システムの再起動後に保持されない場合があります。

This version of the System ROM contains updates aligned with the Intel Product Update (IPU) version IPU.2026.3 guidance.

This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 06.03.04.069.0 (2.40_01_12_2026).

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Resolved an issue where the Intel Xeon E-2477P (6377P) processor incorrectly reported a supported core count of 8 instead of 12.

Resolved an issue where the system could hang or assert when certain MMCFG configuration options were applied.

Resolved an issue where the system time zone could be unexpectedly reset to the default value during boot when a DST-adjusted offset validation failed.

Resolved an issue where a Red Screen of Death (RSOD) could occur during PCIe error handling under certain conditions.

Resolved an issue where an unexpected processor state could cause a system fault during POST after memory training, potentially resulting in an RSOD during certain diagnostic operations.

Resolved an issue where systems with many SPDM-capable devices could experience unnecessary boot delays even when the SPDM policy was disabled.

Resolved an issue where the deprecated ASIX USB NIC RBSU configuration knob was still visible. The knob has been removed as it is no longer required.

Resolved an issue where eMMC devices of 8GB or 16GB capacity were not handled correctly due to a UINT32 overflow condition.

Known Issues:

After the operating system configures the time zone, subsequent time zone changes made in UEFI System Utilities (RBSU) may not be retained after a system reboot.

報告されたセキュリティ脆弱性とその緩和策の詳細については、リンクセキュリティ報告ライブラリ | HPEサポートを参照してください。

ファームウェアの依存関係：

修正された問題点：

Intel Xeon E-2477P (6377P) プロセッサーが、サポートされるコア数を12ではなく8と誤って報告していた問題を解決しました。

特定のMMCFG構成オプションを適用した際に、システムがハングアップしたり、異常終了が発生したりする問題を解決しました。

夏時間調整後のオフセット検証が失敗した場合に、起動時にシステムタイムゾーンが予期せずデフォルト値にリセットされる可能性がある問題を解決しました。

特定の条件下でPCIeエラー処理中にレッドスクリーンオブデス（RSOD）が発生する可能性がある問題を解決しました。

メモリトレーニング後のPOST中に予期しないプロセッサー状態が発生し、システム障害を引き起こす可能性があり、特定の診断操作中にRSODが発生する可能性がある問題を解決しました。

SPDM対応デバイスが多数存在するシステムにおいて、SPDMポリシーが無効になっている場合でも、不要な起動遅延が発生する問題を解決しました。

廃止されたASIX USB NIC RBSU設定ノブがまだ表示されていた問題を解決しました。つまみは不要になったため取り外しました。

UINT32オーバーフロー条件により、8GBまたは16GB容量のeMMCデバイスが正しく処理されない問題を解決しました。

既知の問題点：

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Resolved an issue where the Intel Xeon E-2477P (6377P) processor incorrectly reported a supported core count of 8 instead of 12.

Resolved an issue where the system could hang or assert when certain MMCFG configuration options were applied.

Resolved an issue where the system time zone could be unexpectedly reset to the default value during boot when a DST-adjusted offset validation failed.

Resolved an issue where a Red Screen of Death (RSOD) could occur during PCIe error handling under certain conditions.

Resolved an issue where an unexpected processor state could cause a system fault during POST after memory training, potentially resulting in an RSOD during certain diagnostic operations.

Resolved an issue where systems with many SPDM-capable devices could experience unnecessary boot delays even when the SPDM policy was disabled.

Resolved an issue where the deprecated ASIX USB NIC RBSU configuration knob was still visible. The knob has been removed as it is no longer required.

Resolved an issue where eMMC devices of 8GB or 16GB capacity were not handled correctly due to a UINT32 overflow condition.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Resolved an issue where deleting or enrolling Secure Boot signatures via the Redfish API could fail.

Resolved an issue where Secure Boot key Auto Enrollment was not triggered after performing "Reset All Keys to Platform Defaults" through RBSU or the Redfish API when OEM Secure Boot customization was in use. The system now correctly re-enrolls the default Secure Boot keys after a reset.

Resolved an issue where the Secure Boot Auto Enroll Policy setting configured via the Redfish API was not correctly synchronized with the corresponding RBSU setting, and changes made in RBSU were not reflected in Redfish.

Resolved an issue where someiLO functions may stop working until the next system boot after an iLO factory reset.

Resolved an issue where a SPDM device authentication may be skipped during boot.

Resolved an issue where NVMe-oF IPv6 target hard drives were not detected during VMware 9.0 installation.

- Addressed the following security vulnerabilities:

- CVE-2026-34180 (OpenSSL)

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Resolved an issue where deleting or enrolling Secure Boot signatures via the Redfish API could fail.

Resolved an issue where Secure Boot key Auto Enrollment was not triggered after performing "Reset All Keys to Platform Defaults" through RBSU or the Redfish API when OEM Secure Boot customization was in use. The system now correctly re-enrolls the default Secure Boot keys after a reset.

Resolved an issue where the Secure Boot Auto Enroll Policy setting configured via the Redfish API was not correctly synchronized with the corresponding RBSU setting, and changes made in RBSU were not reflected in Redfish.

Resolved an issue where someiLO functions may stop working until the next system boot after an iLO factory reset.

Resolved an issue where a SPDM device authentication may be skipped during boot.

Resolved an issue where NVMe-oF IPv6 target hard drives were not detected during VMware 9.0 installation.

- Addressed the following security vulnerabilities:

- CVE-2026-34180 (OpenSSL)

Known Issues:

This revision of the System ROM includes AMD reference code GenoaPI 1.0.0.J for AMD 4th Generation EPYC processors.

This revision of the System ROM includes AMD reference code TurinPI 1.0.0.B for AMD 5th Generation EPYC processors.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where HPE Smart Memory DIMMs could be incorrectly identified as non-Smart Memory.

Addressed a security vulnerability in OpenSSL (CVE-2026-7383) where a signed integer overflow in ASN1_mbstring_ncopy() could lead to a heap buffer overflow under specific conditions.

Addressed a security vulnerability in Libpng (CVE-2026-34757) where a use-after-free condition could occur when passing a pointer returned by the PLTE, tRNS, or hIST getters back into the corresponding setters.

Addressed a security vulnerability in OpenSSL (CVE-2026-45447) involving a possible use-after-free condition in PKCS7_verify().

Addressed a security vulnerability in Libpng (CVE-2026-33416) where a dangling pointer could result in reads or writes to freed memory during palette operations.

Addressed an issue where iLO NMI could not generate a BSOD on Windows when Hyper-V was enabled on AMD Gen11 platforms.

Addressed an issue where VMware ESXi 9.1 installation could intermittently fail with a PSOD indicating inconsistent SVM MSR lock status across CPU cores.

Addressed an issue where the Tiered Memory Page Migration (TMPM) device was not generated in the ACPI SSDT table, preventing the MPDMA device from being recognized by the operating system.

Addressed an issue where the system could experience unnecessary boot halts on heavily loaded SPDM configurations when iLO discovery exceeded the BIOS timeout, even when SPDM policy was disabled.

Addressed an issue where the sysconfig shell command for enabledcoresperproc returned options inconsistent with the RBSU GUI.

Addressed an issue where the system timezone could be reset to default when DST-adjusted offset validation or stale mnemonic caused a validation failure during boot.

Addressed an issue where the progress bar was misaligned on the initial POST screen in Quiet Mode when a non-default OEM logo was configured.

Addressed an issue where visual noise appeared on OEM logo during POST screen display.

Addressed an issue where restoring defaults on high core count AMD Turin platforms (>=255 logical cores) could trigger an unnecessary full memory training cycle due to incorrect APIC mode handling.

Known Issues:

None

This revision of the System ROM includes AMD reference code GenoaPI 1.0.0.J for AMD 4th Generation EPYC processors.

This revision of the System ROM includes AMD reference code TurinPI 1.0.0.B for AMD 5th Generation EPYC processors.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where HPE Smart Memory DIMMs could be incorrectly identified as non-Smart Memory.

Addressed a security vulnerability in OpenSSL (CVE-2026-7383) where a signed integer overflow in ASN1_mbstring_ncopy() could lead to a heap buffer overflow under specific conditions.

Addressed a security vulnerability in Libpng (CVE-2026-34757) where a use-after-free condition could occur when passing a pointer returned by the PLTE, tRNS, or hIST getters back into the corresponding setters.

Addressed a security vulnerability in OpenSSL (CVE-2026-45447) involving a possible use-after-free condition in PKCS7_verify().

Addressed a security vulnerability in Libpng (CVE-2026-33416) where a dangling pointer could result in reads or writes to freed memory during palette operations.

Addressed an issue where iLO NMI could not generate a BSOD on Windows when Hyper-V was enabled on AMD Gen11 platforms.

Addressed an issue where VMware ESXi 9.1 installation could intermittently fail with a PSOD indicating inconsistent SVM MSR lock status across CPU cores.

Addressed an issue where the Tiered Memory Page Migration (TMPM) device was not generated in the ACPI SSDT table, preventing the MPDMA device from being recognized by the operating system.

Addressed an issue where the system could experience unnecessary boot halts on heavily loaded SPDM configurations when iLO discovery exceeded the BIOS timeout, even when SPDM policy was disabled.

Addressed an issue where the sysconfig shell command for enabledcoresperproc returned options inconsistent with the RBSU GUI.

Addressed an issue where the system timezone could be reset to default when DST-adjusted offset validation or stale mnemonic caused a validation failure during boot.

Addressed an issue where the progress bar was misaligned on the initial POST screen in Quiet Mode when a non-default OEM logo was configured.

Addressed an issue where visual noise appeared on OEM logo during POST screen display.

Addressed an issue where restoring defaults on high core count AMD Turin platforms (>=255 logical cores) could trigger an unnecessary full memory training cycle due to incorrect APIC mode handling.

Known Issues:

None

•     corner case performance enhance.
•     Servo change that resolves issue with early heat application from Idle sweep seek terminated that may cause read errors.

•     corner case performance enhance.
•     Servo change that resolves issue with early heat application from Idle sweep seek terminated that may cause read errors.

•     corner case performance enhance.
•     Servo change that resolves issue with early heat application from Idle sweep seek terminated that may cause read errors.

•     corner case performance enhance.
•     Servo change that resolves issue with early heat application from Idle sweep seek terminated that may cause read errors.

このバージョンのシステムROMには、Intel IPU2026.3アップデートに合わせたアップデートが含まれています。このバージョンのシステムROMは、Server Platform Services（SPS）ファームウェア06.01.04.230.0（2.90_08_16_2026）と組み合わせる必要があります。

報告されたセキュリティ脆弱性とその緩和策の詳細については、リンクセキュリティ報告ライブラリ | HPEサポートを参照してください。

ファームウェアの依存関係：

なし

修正された問題点:

CNSAモードでiLOを工場出荷時設定にリセットした後、BIOS設定が失われ、複数のiLO管理機能が動作しなくなる可能性がある問題に対処しました。

OEMセキュアブートのカスタマイズが有効になっているシステムで、RBSUの[すべてのキーをプラットフォームのデフォルトにリセット] を使用した後、セキュアブートキーの自動登録がトリガーされない場合がある問題に対処しました。

RBSUとRedfishのインターフェイス間でセキュアブート自動登録ポリシーの設定が正しく同期されない可能性がある問題に対処しました。

SPDM全体のブートポリシーが正しい場所から読み込まれず、SPDMブートポリシーの予期しない動作を招く可能性がある問題に対処しました。

Redfish APIを介したセキュアブート署名の削除が失敗する可能性がある問題に対処しました。

既知の問題点：

オペレーティングシステムがタイムゾーンを構成した後、UEFIシステムユーティリティ (RBSU) で行われる以降のタイムゾーン変更は、システムの再起動後に保持されない場合があります。

This version of the System ROM contains updates aligned with the Intel IPU2026.3 update. This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 06.01.04.230.0 (2.90_08_16_2026).

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

After the operating system configures the time zone, subsequent time zone changes made in UEFI System Utilities (RBSU) may not be retained after a system reboot.

報告されたセキュリティ脆弱性とその緩和策の詳細については、リンクセキュリティ報告ライブラリ | HPEサポートを参照してください。

ファームウェアの依存関係：

修正された問題点:

CNSAモードでiLOを工場出荷時設定にリセットした後、BIOS設定が失われ、複数のiLO管理機能が動作しなくなる可能性がある問題に対処しました。

OEMセキュアブートのカスタマイズが有効になっているシステムで、RBSUの[すべてのキーをプラットフォームのデフォルトにリセット] を使用した後、セキュアブートキーの自動登録がトリガーされない場合がある問題に対処しました。

RBSUとRedfishのインターフェイス間でセキュアブート自動登録ポリシーの設定が正しく同期されない可能性がある問題に対処しました。

SPDM全体のブートポリシーが正しい場所から読み込まれず、SPDMブートポリシーの予期しない動作を招く可能性がある問題に対処しました。

Redfish APIを介したセキュアブート署名の削除が失敗する可能性がある問題に対処しました。

既知の問題点：

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

• NSM Get-Port-Network-Addresses returned an invalid format on B200/B300 HMC. It now follows the documented non-compact format.
• An issue that could prevent the adapter’s PCIe link from re-establishing after the host resumed from a deep power-down state. This fix improves the reliability of suspend/resume cycles.
• A DEAD IRISC assert that could occur during TLV NV_DATA flash access by suspending the watchdog while waiting for flash IPC (until timeout), preventing the assert on TLV access.
• An issue where repeatedly writing NVCONFIG TLVs could cause excessive NV_DATA partition swaps during garbage collection. This rapid cycling could accelerate flash wear (end-of-life at 100,000 erases) and potentially render the device inoperable. Firmware now avoids unnecessary physical writes by returning OK when the requested configuration already exists in flash, and increases the maximum supported NV_DATA partition swaps from 100,000 to 200,000.
• ICM_RES_HW_DMFS_ENCAP_H_FW was allocated per GVMI, preventing some RTTs from using it.
• vDPA doorbell resources were not released, which could cause failures when running other functionality after a vDPA FLR. Doorbell resources are now properly unlocked.
• RDMA traffic could stall in large-scale deployments for certain source IP and UDP source-port combinations when DOCA PCC was active and no congestion-control algorithm was configured in algorithm slot 0.
• The live migration target did not receive a port state change event on the resume VHCA command. The target now generates this event so software that depends on port state is notified of any changes.
• A precopy image was processed during the stop-copy phase, causing prolonged downtime due to a software limitation. The handling was slow because the handler performed a linear search for data; this was improved by replacing it with a faster search approach enabled via compile-time preprocessing.
• QPs established before loading DOCA PCC could exhibit inconsistent algorithm-selected behavior between ports in LAG mode after DOCA PCC is loaded.

• NSM Get-Port-Network-Addresses returned an invalid format on B200/B300 HMC. It now follows the documented non-compact format.
• An issue that could prevent the adapter’s PCIe link from re-establishing after the host resumed from a deep power-down state. This fix improves the reliability of suspend/resume cycles.
• A DEAD IRISC assert that could occur during TLV NV_DATA flash access by suspending the watchdog while waiting for flash IPC (until timeout), preventing the assert on TLV access.
• An issue where repeatedly writing NVCONFIG TLVs could cause excessive NV_DATA partition swaps during garbage collection. This rapid cycling could accelerate flash wear (end-of-life at 100,000 erases) and potentially render the device inoperable. Firmware now avoids unnecessary physical writes by returning OK when the requested configuration already exists in flash, and increases the maximum supported NV_DATA partition swaps from 100,000 to 200,000.
• ICM_RES_HW_DMFS_ENCAP_H_FW was allocated per GVMI, preventing some RTTs from using it.
• vDPA doorbell resources were not released, which could cause failures when running other functionality after a vDPA FLR. Doorbell resources are now properly unlocked.
• RDMA traffic could stall in large-scale deployments for certain source IP and UDP source-port combinations when DOCA PCC was active and no congestion-control algorithm was configured in algorithm slot 0.
• The live migration target did not receive a port state change event on the resume VHCA command. The target now generates this event so software that depends on port state is notified of any changes.
• A precopy image was processed during the stop-copy phase, causing prolonged downtime due to a software limitation. The handling was slow because the handler performed a linear search for data; this was improved by replacing it with a faster search approach enabled via compile-time preprocessing.
• QPs established before loading DOCA PCC could exhibit inconsistent algorithm-selected behavior between ports in LAG mode after DOCA PCC is loaded.

• ConnectX-7がプローブベースのアルゴリズムを使用してConnectX-8と通信する際に、プローブパケットがドロップされるため、帯域幅が著しく低下する可能性がある相互運用性の問題。
• DPAカーネルは、プロセスの作成/変更時に安全でないICMアクセスを使用していたため、FLR時にDPAカーネルのハングアップを引き起こしていました。
• ユーザーデバッガーの“query caps”は、機能ビットマップではなく、機能の数のみを返しました。
• スタンバイ／ブート電源シーケンスでの競合状態。特定のタイミングウィンドウで、ポートの電源オフが遅延するため、電源オンフローでポートがまだ電源オフに移行中であると検出され、シーケンスが失敗し、ポートが電源オフ状態のまま動かなくなります。
• mlxlinkは、ファームウェアのローカルポートマッピングの誤りとMFTで使用されるページ番号の誤りにより、SNR (メディアおよびホスト) の値を0と報告しました。
• SMBusの解放競合状態のため、I2Cバスが停止します。
• ヒューズの値が、異なるConnectX-7設定間で書き込まれたアップデートされた値と一致していませんでした。
• IPv6トラフィックのLAGに使用されるステアリング定義者の問題。
• 順序が正しくないパケットへの応答で、誤ったCNPが送信されました。
• ルートコンプレックスは、BDFが割り当てられる前にMCTP over PCIメッセージを送信したため、応答がBDF 0で送信されました。この修正により、有効なBDFが割り当てられるまで、IDによってルーティングされるMCTPメッセージが無視されます。
• LLPD経由でSpectrum-Xの部分的な機能 (BTH.AR) を有効にした後に、ステアリングテーブルがアップデートされませんでした。
• パケットのカプセル化解除が発生すると、FCS表示が正しく計算されませんでした。
• IBシステムで、RTT_response_sl機能がスニファーツール (例：Wireshark/Tcpdump/) で動作しませんでした。
   

• An interoperability issue where, when ConnectX-7 communicates with ConnectX-8 using the probe-based algorithm, bandwidth could become extremely low due to probe packets being dropped.
• The DPA kernel used unsafe ICM access during process creation/modification, which would cause the DPA kernel to hang during FLR.
• User Debugger “query caps” returned only the number of capabilities, not the capability bitmap.
• Race condition in standby/boot power sequencing. In certain timing windows, port power-down would be delayed such that the power-up flow detected the port still transitioning to power-down, causing the sequence to fail and leaving the port stuck in a powered-down state.
• mlxlink reported 0 values for SNR (media and host) due to incorrect local port mapping in firmware and an incorrect page number used by MFT.
• Due to an SMBus release race condition, the I2C bus would become stuck.
• Fuse values were not aligned with the updated values burned across different ConnectX-7 setups.
• Issue in the steering definers used for LAG with IPv6 traffic.
• A spurious CNP was sent in response to an out-of-sequence packet.
• The root complex sent MCTP-over-PCI messages before a BDF was assigned, causing responses to be sent with BDF 0. The fix ensures that MCTP messages routed by ID are ignored until a valid BDF is assigned.
• The steering tables were not updated after enabling partial Spectrum-X capabilities (BTH.AR) via LLPD.
• When decapsulation on a packet occurred, the FCS indication was not calculated correctly.
• In IB system, RTT_response_sl feature did not work with Sniffer tools (e.g., Wireshark/Tcpdump/).
   

このバージョンのシステムROMには、Intel IPU2026.3アップデートに合わせたアップデートが含まれています。このバージョンのシステムROMは、Server Platform Services（SPS）ファームウェア06.01.04.230.0（2.90_08_16_2026）と組み合わせる必要があります。

報告されたセキュリティ脆弱性とその緩和策の詳細については、リンクセキュリティ報告ライブラリ | HPEサポートを参照してください。

ファームウェアの依存関係：

なし

修正された問題点:

CNSAモードでiLOを工場出荷時設定にリセットした後、BIOS設定が失われ、複数のiLO管理機能が動作しなくなる可能性がある問題に対処しました。

OEMセキュアブートのカスタマイズが有効になっているシステムで、RBSUの[すべてのキーをプラットフォームのデフォルトにリセット] を使用した後、セキュアブートキーの自動登録がトリガーされない場合がある問題に対処しました。

RBSUとRedfishのインターフェイス間でセキュアブート自動登録ポリシーの設定が正しく同期されない可能性がある問題に対処しました。

SPDM全体のブートポリシーが正しい場所から読み込まれず、SPDMブートポリシーの予期しない動作を招く可能性がある問題に対処しました。

Redfish APIを介したセキュアブート署名の削除が失敗する可能性がある問題に対処しました。

既知の問題点：

オペレーティングシステムがタイムゾーンを構成した後、UEFIシステムユーティリティ (RBSU) で行われる以降のタイムゾーン変更は、システムの再起動後に保持されない場合があります。

This version of the System ROM contains updates aligned with the Intel IPU2026.3 update. This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 06.01.04.230.0 (2.90_08_16_2026).

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

After the operating system configures the time zone, subsequent time zone changes made in UEFI System Utilities (RBSU) may not be retained after a system reboot.

報告されたセキュリティ脆弱性とその緩和策の詳細については、リンクセキュリティ報告ライブラリ | HPEサポートを参照してください。

ファームウェアの依存関係：

修正された問題点:

CNSAモードでiLOを工場出荷時設定にリセットした後、BIOS設定が失われ、複数のiLO管理機能が動作しなくなる可能性がある問題に対処しました。

OEMセキュアブートのカスタマイズが有効になっているシステムで、RBSUの[すべてのキーをプラットフォームのデフォルトにリセット] を使用した後、セキュアブートキーの自動登録がトリガーされない場合がある問題に対処しました。

RBSUとRedfishのインターフェイス間でセキュアブート自動登録ポリシーの設定が正しく同期されない可能性がある問題に対処しました。

SPDM全体のブートポリシーが正しい場所から読み込まれず、SPDMブートポリシーの予期しない動作を招く可能性がある問題に対処しました。

Redfish APIを介したセキュアブート署名の削除が失敗する可能性がある問題に対処しました。

既知の問題点：

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

This revision of the System ROM includes AMD reference code GenoaPI 1.0.0.J for AMD 4th Generation EPYC processors.

This revision of the System ROM includes AMD reference code TurinPI 1.0.0.B for AMD 5th Generation EPYC processors.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where HPE Smart Memory DIMMs could be incorrectly identified as non-Smart Memory.

Addressed a security vulnerability in OpenSSL (CVE-2026-7383) where a signed integer overflow in ASN1_mbstring_ncopy() could lead to a heap buffer overflow under specific conditions.

Addressed a security vulnerability in Libpng (CVE-2026-34757) where a use-after-free condition could occur when passing a pointer returned by the PLTE, tRNS, or hIST getters back into the corresponding setters.

Addressed a security vulnerability in OpenSSL (CVE-2026-45447) involving a possible use-after-free condition in PKCS7_verify().

Addressed a security vulnerability in Libpng (CVE-2026-33416) where a dangling pointer could result in reads or writes to freed memory during palette operations.

Addressed an issue where iLO NMI could not generate a BSOD on Windows when Hyper-V was enabled on AMD Gen11 platforms.

Addressed an issue where VMware ESXi 9.1 installation could intermittently fail with a PSOD indicating inconsistent SVM MSR lock status across CPU cores.

Addressed an issue where the Tiered Memory Page Migration (TMPM) device was not generated in the ACPI SSDT table, preventing the MPDMA device from being recognized by the operating system.

Addressed an issue where the system could experience unnecessary boot halts on heavily loaded SPDM configurations when iLO discovery exceeded the BIOS timeout, even when SPDM policy was disabled.

Addressed an issue where the sysconfig shell command for enabledcoresperproc returned options inconsistent with the RBSU GUI.

Addressed an issue where the system timezone could be reset to default when DST-adjusted offset validation or stale mnemonic caused a validation failure during boot.

Addressed an issue where the progress bar was misaligned on the initial POST screen in Quiet Mode when a non-default OEM logo was configured.

Addressed an issue where visual noise appeared on OEM logo during POST screen display.

Addressed an issue where restoring defaults on high core count AMD Turin platforms (>=255 logical cores) could trigger an unnecessary full memory training cycle due to incorrect APIC mode handling.

Known Issues:

None

This revision of the System ROM includes AMD reference code GenoaPI 1.0.0.J for AMD 4th Generation EPYC processors.

This revision of the System ROM includes AMD reference code TurinPI 1.0.0.B for AMD 5th Generation EPYC processors.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where HPE Smart Memory DIMMs could be incorrectly identified as non-Smart Memory.

Addressed a security vulnerability in OpenSSL (CVE-2026-7383) where a signed integer overflow in ASN1_mbstring_ncopy() could lead to a heap buffer overflow under specific conditions.

Addressed a security vulnerability in Libpng (CVE-2026-34757) where a use-after-free condition could occur when passing a pointer returned by the PLTE, tRNS, or hIST getters back into the corresponding setters.

Addressed a security vulnerability in OpenSSL (CVE-2026-45447) involving a possible use-after-free condition in PKCS7_verify().

Addressed a security vulnerability in Libpng (CVE-2026-33416) where a dangling pointer could result in reads or writes to freed memory during palette operations.

Addressed an issue where iLO NMI could not generate a BSOD on Windows when Hyper-V was enabled on AMD Gen11 platforms.

Addressed an issue where VMware ESXi 9.1 installation could intermittently fail with a PSOD indicating inconsistent SVM MSR lock status across CPU cores.

Addressed an issue where the Tiered Memory Page Migration (TMPM) device was not generated in the ACPI SSDT table, preventing the MPDMA device from being recognized by the operating system.

Addressed an issue where the system could experience unnecessary boot halts on heavily loaded SPDM configurations when iLO discovery exceeded the BIOS timeout, even when SPDM policy was disabled.

Addressed an issue where the sysconfig shell command for enabledcoresperproc returned options inconsistent with the RBSU GUI.

Addressed an issue where the system timezone could be reset to default when DST-adjusted offset validation or stale mnemonic caused a validation failure during boot.

Addressed an issue where the progress bar was misaligned on the initial POST screen in Quiet Mode when a non-default OEM logo was configured.

Addressed an issue where visual noise appeared on OEM logo during POST screen display.

Addressed an issue where restoring defaults on high core count AMD Turin platforms (>=255 logical cores) could trigger an unnecessary full memory training cycle due to incorrect APIC mode handling.

Known Issues:

None

• A BlueField-3 host SF could remain stuck in the inactive+attached state and fail to reactivate after host restart flows.
• A NULL pointer dereference in the mlx5_core driver that could cause a kernel panic and report PCIe completion-timeout errors on ConnectX-8 bare-metal systems.
• An issue that occurred when CONFIG_UBSAN=y and the user provided an invalid value, resulting in the following UBSAN error:UBSAN: shift-out-of-bounds in drivers/net/ethernet/mellanox/mlx5/core/diag/diag_cnt.c:190:11 shift exponent 4294967293 is too large for 32-bit type 'int'
• A race condition in the ib_core kernel module during concurrent address resolution that could produce a zero destination MAC (DMAC), causing silent packet loss and RDMA retry-exceeded errors.
• Upgrading doca-ofed did not always upgrade doca-extra (which includes the module sources and doca-kernel-support build scripts). In some cases, this caused doca-kernel-support to build against sources from an older release.
• Accessing timestamping mode could fail on kernel 7.0 and later.

• A BlueField-3 host SF could remain stuck in the inactive+attached state and fail to reactivate after host restart flows.
• A NULL pointer dereference in the mlx5_core driver that could cause a kernel panic and report PCIe completion-timeout errors on ConnectX-8 bare-metal systems.
• An issue that occurred when CONFIG_UBSAN=y and the user provided an invalid value, resulting in the following UBSAN error:UBSAN: shift-out-of-bounds in drivers/net/ethernet/mellanox/mlx5/core/diag/diag_cnt.c:190:11 shift exponent 4294967293 is too large for 32-bit type 'int'
• A race condition in the ib_core kernel module during concurrent address resolution that could produce a zero destination MAC (DMAC), causing silent packet loss and RDMA retry-exceeded errors.
• Upgrading doca-ofed did not always upgrade doca-extra (which includes the module sources and doca-kernel-support build scripts). In some cases, this caused doca-kernel-support to build against sources from an older release.
• Accessing timestamping mode could fail on kernel 7.0 and later.

• RHELシステムで、mlnx-ofa_kernel (doca-ofedやdoca-hostなどのパッケージによって取得) の後にchkconfigをインストールすると、インストール中に失敗する可能性があるという問題。このシーケンスでは、/etc/init.dの下にinitスクリプトを配置するパッケージの依存関係として、chkconfigを間接的にインストールできますが、/etc/init.dが既にディレクトリとして存在するため (chkconfigはそれをシンボリックリンクとして管理することを想定しています)、インストールでエラーが発生します。この修正により、RPMパッケージの解凍失敗の原因となっていた/etc/init.dディレクトリ/シンボリックリンクの競合が回避されます。
• LAGモードでは、ファームウェアのリセット競合により、UMRの完了を待っている間にドライバーがアンロード時にハングアップする可能性がありました。この修正により、sys_error通知が早期に登録され、デバイスの登録解除後も保持されるため、ティアダウン時にエラーイベントがボンドデバイスに届きます。
• 解放フロー中に定期的にCPUを譲ることで、大容量UMEMの解放中に発生する可能性のあるソフトロックアップ警告。
• デバイスをswitchdevモードに切り替え中に、devlinkユーザー空間プロセスが終了した場合に発生する可能性のあるカーネルクラッシュ。
• Devlink操作がfw_resetと同期されていなかったため、さまざまな障害が発生する可能性がありました。fw_resetとdevlink操作を調整するメカニズムを追加しました。
• ドライバーがポーリング専用CQ (例えばASO CQ) を誤って初期化し、まれなケースでEQ割り込みを受信する可能性がありました。ポーリング専用CQの割り込みを防止するため、CQ初期化フローがアップデートされました。
• 最大レート値が符号なし8ビット整数型に格納されていたため、255を超える値がラップされる (例：257が1になる) オーバーフローの問題。
• SFのCPUアフィニティを設定するために、8コアを超えて使用できない問題。この制限は削除されました。

• An issue on RHEL systems where installing chkconfig after mlnx-ofa_kernel (pulled in by packages such as doca-ofed and doca-host) could fail during installation. In this sequence, chkconfig could be installed indirectly as a dependency of a package that places init scripts under /etc/init.d, but the install would error out because /etc/init.d already existed as a directory (whereas chkconfig expects to manage it as a symlink). This fix prevents the /etc/init.d directory/symlink conflict that caused the RPM unpacking failure.
• In LAG mode, a firmware reset race could cause the driver to hang during unload while waiting for UMR completion. The fix ensures sys_error notifications are registered early and kept through device unregister so error events reach the bond device during teardown.
• Soft lockup warnings that could occur while releasing large UMEMs by periodically yielding the CPU during the release flow.
• A kernel crash that could occur if the devlink userspace process was terminated while switching the device to switchdev mode.
• Devlink operations were not synchronized with fw_reset, which could lead to various failures. Added a mechanism to coordinate fw_reset with devlink operations.
• The driver could incorrectly initialize polling-only CQs (e.g., ASO CQs), allowing them to receive EQ interrupts in rare cases. The CQ initialization flow was updated to prevent interrupts for polling-only CQs.
• An overflow issue where the max-rate value was stored in a unsigned 8-bit integer type , causing values above 255 to wrap (e.g., 257 became 1).
• An issue that prevented using more than 8 cores to set SF CPU affinity. This restriction has now been removed.

• A BlueField-3 host SF could remain stuck in the inactive+attached state and fail to reactivate after host restart flows.
• A NULL pointer dereference in the mlx5_core driver that could cause a kernel panic and report PCIe completion-timeout errors on ConnectX-8 bare-metal systems.
• An issue that occurred when CONFIG_UBSAN=y and the user provided an invalid value, resulting in the following UBSAN error:UBSAN: shift-out-of-bounds in drivers/net/ethernet/mellanox/mlx5/core/diag/diag_cnt.c:190:11 shift exponent 4294967293 is too large for 32-bit type 'int'
• A race condition in the ib_core kernel module during concurrent address resolution that could produce a zero destination MAC (DMAC), causing silent packet loss and RDMA retry-exceeded errors.
• Upgrading doca-ofed did not always upgrade doca-extra (which includes the module sources and doca-kernel-support build scripts). In some cases, this caused doca-kernel-support to build against sources from an older release.
• Accessing timestamping mode could fail on kernel 7.0 and later.

• A BlueField-3 host SF could remain stuck in the inactive+attached state and fail to reactivate after host restart flows.
• A NULL pointer dereference in the mlx5_core driver that could cause a kernel panic and report PCIe completion-timeout errors on ConnectX-8 bare-metal systems.
• An issue that occurred when CONFIG_UBSAN=y and the user provided an invalid value, resulting in the following UBSAN error:UBSAN: shift-out-of-bounds in drivers/net/ethernet/mellanox/mlx5/core/diag/diag_cnt.c:190:11 shift exponent 4294967293 is too large for 32-bit type 'int'
• A race condition in the ib_core kernel module during concurrent address resolution that could produce a zero destination MAC (DMAC), causing silent packet loss and RDMA retry-exceeded errors.
• Upgrading doca-ofed did not always upgrade doca-extra (which includes the module sources and doca-kernel-support build scripts). In some cases, this caused doca-kernel-support to build against sources from an older release.
• Accessing timestamping mode could fail on kernel 7.0 and later.

• RHELシステムで、mlnx-ofa_kernel (doca-ofedやdoca-hostなどのパッケージによって取得) の後にchkconfigをインストールすると、インストール中に失敗する可能性があるという問題。このシーケンスでは、/etc/init.dの下にinitスクリプトを配置するパッケージの依存関係として、chkconfigを間接的にインストールできますが、/etc/init.dが既にディレクトリとして存在するため (chkconfigはそれをシンボリックリンクとして管理することを想定しています)、インストールでエラーが発生します。この修正により、RPMパッケージの解凍失敗の原因となっていた/etc/init.dディレクトリ/シンボリックリンクの競合が回避されます。
• LAGモードでは、ファームウェアのリセット競合により、UMRの完了を待っている間にドライバーがアンロード時にハングアップする可能性がありました。この修正により、sys_error通知が早期に登録され、デバイスの登録解除後も保持されるため、ティアダウン時にエラーイベントがボンドデバイスに届きます。
• 解放フロー中に定期的にCPUを譲ることで、大容量UMEMの解放中に発生する可能性のあるソフトロックアップ警告。
• デバイスをswitchdevモードに切り替え中に、devlinkユーザー空間プロセスが終了した場合に発生する可能性のあるカーネルクラッシュ。
• Devlink操作がfw_resetと同期されていなかったため、さまざまな障害が発生する可能性がありました。fw_resetとdevlink操作を調整するメカニズムを追加しました。
• ドライバーがポーリング専用CQ (例えばASO CQ) を誤って初期化し、まれなケースでEQ割り込みを受信する可能性がありました。ポーリング専用CQの割り込みを防止するため、CQ初期化フローがアップデートされました。
• 最大レート値が符号なし8ビット整数型に格納されていたため、255を超える値がラップされる (例：257が1になる) オーバーフローの問題。
• SFのCPUアフィニティを設定するために、8コアを超えて使用できない問題。この制限は削除されました。

• An issue on RHEL systems where installing chkconfig after mlnx-ofa_kernel (pulled in by packages such as doca-ofed and doca-host) could fail during installation. In this sequence, chkconfig could be installed indirectly as a dependency of a package that places init scripts under /etc/init.d, but the install would error out because /etc/init.d already existed as a directory (whereas chkconfig expects to manage it as a symlink). This fix prevents the /etc/init.d directory/symlink conflict that caused the RPM unpacking failure.
• In LAG mode, a firmware reset race could cause the driver to hang during unload while waiting for UMR completion. The fix ensures sys_error notifications are registered early and kept through device unregister so error events reach the bond device during teardown.
• Soft lockup warnings that could occur while releasing large UMEMs by periodically yielding the CPU during the release flow.
• A kernel crash that could occur if the devlink userspace process was terminated while switching the device to switchdev mode.
• Devlink operations were not synchronized with fw_reset, which could lead to various failures. Added a mechanism to coordinate fw_reset with devlink operations.
• The driver could incorrectly initialize polling-only CQs (e.g., ASO CQs), allowing them to receive EQ interrupts in rare cases. The CQ initialization flow was updated to prevent interrupts for polling-only CQs.
• An overflow issue where the max-rate value was stored in a unsigned 8-bit integer type , causing values above 255 to wrap (e.g., 257 became 1).
• An issue that prevented using more than 8 cores to set SF CPU affinity. This restriction has now been removed

• A BlueField-3 host SF could remain stuck in the inactive+attached state and fail to reactivate after host restart flows.
• A NULL pointer dereference in the mlx5_core driver that could cause a kernel panic and report PCIe completion-timeout errors on ConnectX-8 bare-metal systems.
• An issue that occurred when CONFIG_UBSAN=y and the user provided an invalid value, resulting in the following UBSAN error:UBSAN: shift-out-of-bounds in drivers/net/ethernet/mellanox/mlx5/core/diag/diag_cnt.c:190:11 shift exponent 4294967293 is too large for 32-bit type 'int'
• A race condition in the ib_core kernel module during concurrent address resolution that could produce a zero destination MAC (DMAC), causing silent packet loss and RDMA retry-exceeded errors.
• Upgrading doca-ofed did not always upgrade doca-extra (which includes the module sources and doca-kernel-support build scripts). In some cases, this caused doca-kernel-support to build against sources from an older release.
• Accessing timestamping mode could fail on kernel 7.0 and later.

• A BlueField-3 host SF could remain stuck in the inactive+attached state and fail to reactivate after host restart flows.
• A NULL pointer dereference in the mlx5_core driver that could cause a kernel panic and report PCIe completion-timeout errors on ConnectX-8 bare-metal systems.
• An issue that occurred when CONFIG_UBSAN=y and the user provided an invalid value, resulting in the following UBSAN error:UBSAN: shift-out-of-bounds in drivers/net/ethernet/mellanox/mlx5/core/diag/diag_cnt.c:190:11 shift exponent 4294967293 is too large for 32-bit type 'int'
• A race condition in the ib_core kernel module during concurrent address resolution that could produce a zero destination MAC (DMAC), causing silent packet loss and RDMA retry-exceeded errors.
• Upgrading doca-ofed did not always upgrade doca-extra (which includes the module sources and doca-kernel-support build scripts). In some cases, this caused doca-kernel-support to build against sources from an older release.
• Accessing timestamping mode could fail on kernel 7.0 and later.

• A BlueField-3 host SF could remain stuck in the inactive+attached state and fail to reactivate after host restart flows.
• A NULL pointer dereference in the mlx5_core driver that could cause a kernel panic and report PCIe completion-timeout errors on ConnectX-8 bare-metal systems.
• An issue that occurred when CONFIG_UBSAN=y and the user provided an invalid value, resulting in the following UBSAN error:UBSAN: shift-out-of-bounds in drivers/net/ethernet/mellanox/mlx5/core/diag/diag_cnt.c:190:11 shift exponent 4294967293 is too large for 32-bit type 'int'
• A race condition in the ib_core kernel module during concurrent address resolution that could produce a zero destination MAC (DMAC), causing silent packet loss and RDMA retry-exceeded errors.
• Upgrading doca-ofed did not always upgrade doca-extra (which includes the module sources and doca-kernel-support build scripts). In some cases, this caused doca-kernel-support to build against sources from an older release.
• Accessing timestamping mode could fail on kernel 7.0 and later.

• A BlueField-3 host SF could remain stuck in the inactive+attached state and fail to reactivate after host restart flows.
• A NULL pointer dereference in the mlx5_core driver that could cause a kernel panic and report PCIe completion-timeout errors on ConnectX-8 bare-metal systems.
• An issue that occurred when CONFIG_UBSAN=y and the user provided an invalid value, resulting in the following UBSAN error:UBSAN: shift-out-of-bounds in drivers/net/ethernet/mellanox/mlx5/core/diag/diag_cnt.c:190:11 shift exponent 4294967293 is too large for 32-bit type 'int'
• A race condition in the ib_core kernel module during concurrent address resolution that could produce a zero destination MAC (DMAC), causing silent packet loss and RDMA retry-exceeded errors.
• Upgrading doca-ofed did not always upgrade doca-extra (which includes the module sources and doca-kernel-support build scripts). In some cases, this caused doca-kernel-support to build against sources from an older release.
• Accessing timestamping mode could fail on kernel 7.0 and later.

•     corner case performance enhance.
•     Servo change that resolves issue with early heat application from Idle sweep seek terminated that may cause read errors.

•     corner case performance enhance.
•     Servo change that resolves issue with early heat application from Idle sweep seek terminated that may cause read errors.

• FWがCQ回復モードに入った後、ファームウェアはPFの正しいCQをスキャンできませんでした。その結果、PFのCQが回復されませんでした。

• Firmware failed to scan the correct CQs for the PF after the FW entered into the CQ recovery mode., resulting in CQs for the PF not being recovered.

このバージョンのシステムROMには、Intel IPU2026.3アップデートに合わせたアップデートが含まれています。このバージョンのシステムROMは、Server Platform Services（SPS）ファームウェア06.01.04.230.0（2.90_08_16_2026）と組み合わせる必要があります。

報告されたセキュリティ脆弱性とその緩和策の詳細については、リンクセキュリティ報告ライブラリ | HPEサポートを参照してください。

ファームウェアの依存関係：

なし

修正された問題点:

CNSAモードでiLOを工場出荷時設定にリセットした後、BIOS設定が失われ、複数のiLO管理機能が動作しなくなる可能性がある問題に対処しました。

OEMセキュアブートのカスタマイズが有効になっているシステムで、RBSUの[すべてのキーをプラットフォームのデフォルトにリセット] を使用した後、セキュアブートキーの自動登録がトリガーされない場合がある問題に対処しました。

RBSUとRedfishのインターフェイス間でセキュアブート自動登録ポリシーの設定が正しく同期されない可能性がある問題に対処しました。

SPDM全体のブートポリシーが正しい場所から読み込まれず、SPDMブートポリシーの予期しない動作を招く可能性がある問題に対処しました。

Redfish APIを介したセキュアブート署名の削除が失敗する可能性がある問題に対処しました。

既知の問題点：

オペレーティングシステムがタイムゾーンを構成した後、UEFIシステムユーティリティ (RBSU) で行われる以降のタイムゾーン変更は、システムの再起動後に保持されない場合があります。

This version of the System ROM contains updates aligned with the Intel IPU2026.3 update. This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 06.01.04.230.0 (2.90_08_16_2026).

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

After the operating system configures the time zone, subsequent time zone changes made in UEFI System Utilities (RBSU) may not be retained after a system reboot.

報告されたセキュリティ脆弱性とその緩和策の詳細については、リンクセキュリティ報告ライブラリ | HPEサポートを参照してください。

ファームウェアの依存関係：

修正された問題点:

CNSAモードでiLOを工場出荷時設定にリセットした後、BIOS設定が失われ、複数のiLO管理機能が動作しなくなる可能性がある問題に対処しました。

OEMセキュアブートのカスタマイズが有効になっているシステムで、RBSUの[すべてのキーをプラットフォームのデフォルトにリセット] を使用した後、セキュアブートキーの自動登録がトリガーされない場合がある問題に対処しました。

RBSUとRedfishのインターフェイス間でセキュアブート自動登録ポリシーの設定が正しく同期されない可能性がある問題に対処しました。

SPDM全体のブートポリシーが正しい場所から読み込まれず、SPDMブートポリシーの予期しない動作を招く可能性がある問題に対処しました。

Redfish APIを介したセキュアブート署名の削除が失敗する可能性がある問題に対処しました。

既知の問題点：

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

• FWがCQ回復モードに入った後、ファームウェアはPFの正しいCQをスキャンできませんでした。その結果、PFのCQが回復されませんでした。

• Firmware failed to scan the correct CQs for the PF after the FW entered into the CQ recovery mode., resulting in CQs for the PF not being recovered.

システムROMのこのリビジョンには、AMD第5世代EPYCプロセッサー用のAMDリファレンスコードTurinPI 1.0.0.Bが含まれています。

このバージョンのシステムROMは、CVE-2025-47827に対応するため、デフォルトのUEFIセキュアブート禁止署名データベース (dbx) をアップデートします。システムROMのみをアップデートしても、アップデートされたdbxは適用されません。ユーザーは、セキュアブートキーを製造時のデフォルト設定にリセットするか、Windows、Linux、RBSU、またはRedfishを介してアップデートされたdbxを登録する必要があります。

システムROMのこのリビジョンは、次のGPUをサポートします。 Nvidia H200 GPU Nvidia B200 GPU Nvidia B300 GPU AMD Instinct MI355X GPU

報告されたセキュリティ脆弱性とその緩和策の詳細については、リンクセキュリティ報告ライブラリ | HPEサポートを参照してください。

ファームウェアの依存関係：

iLO 6 v1.72またはそれ以降 システムROMをリビジョン2.54またはそれ以降にアップデートする前に、iLOをiLO6 v1.72またはそれ以降にアップデートしてください。

修正された問題点：

POST中にサーバーが停止し、SPDMが無効に構成されている場合でも[SPDM component authentication failure]が表示される問題に対処しました。

起動時にDST調整後のオフセットや古いニーモニックが原因で検証が失敗した場合、システムタイムゾーン設定がデフォルトにリセットされる可能性がある問題に対処しました。

AMD EPYC 9005シリーズ (Turin) ベースのプラットフォームで、製造時のデフォルトのリストアにより、誤ったメモリ構成値が適用される可能性がある問題に対処しました。

コア数の多いAMD EPYC 9005シリーズ (Turin) プラットフォーム (論理コア数255以上) でデフォルト設定を復元すると、APICモードの不適切な処理が原因で不要なフルメモリトレーニングサイクルが発生する可能性がある問題に対処しました。

階層型メモリページ移行 (TMPM) デバイスがACPI SSDTテーブルに生成されないため、MPDMAデバイスがオペレーティングシステムによって認識されない問題に対処しました。

高負荷SPDM構成で、SPDMポリシーが無効な場合でも、iLO検出がBIOSタイムアウトを超過すると不必要な起動停止がシステムで発生する可能性がある問題に対処しました。

RBSU GUIと整合性のないオプションがenabledcoresperprocのsysconfig UEFI shellコマンドから返される問題に対処しました。

ASN1_mbstring_ncopy()での符号付き整数オーバーフローが原因で、特定の条件下でヒープバッファーオーバーフローが発生する可能性があるOpenSSLのセキュリティ脆弱性 (CVE-2026-7383) に対処しました。

PLTE、tRNS、またはhISTのゲッターから返されたポインターを対応するセッターに渡すときにuse-after-free条件が発生する可能性があるLibpngのセキュリティ脆弱性 (CVE-2026-34757) に対処しました。

PKCS7_verify()でのuse-after-free条件の可能性に関係するOpenSSLのセキュリティ脆弱性 (CVE-2026-45447) に対処しました。

ダングリングポインターによってパレット操作中に解放済みメモリへの読み取りまたは書き込みが発生する可能性があるLibpngのセキュリティ脆弱性 (CVE-2026-33416) に対処しました。

AMD EPYC 9005シリーズ (Turin) プラットフォームでHyper-Vが有効になっている場合に、iLO 6の仮想NMIボタンを使用してWindowsでブルースクリーン (BSOD) を生成しようとしても機能しない問題に対処しました。

既知の問題点：

なし

This revision of the System ROM includes AMD reference code TurinPI 1.0.0.B for AMD 5th Generation EPYC processors.

This version of the System ROM updates the default UEFI Secure Boot forbidden signature database (dbx) for CVE-2025-47827. Updating the System ROM alone does not apply the updated dbx. Users must reset Secure Boot keys to manufacturing defaults, or enroll the updated dbx through Windows, Linux, RBSU, or Redfish.

This revision of the System ROM supports the following GPUs: Nvidia H200 GPU Nvidia B200 GPU Nvidia B300 GPU AMD Instinct MI355X GPU

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

HPE iLO 6 v1.72 or later. Please update the iLO to iLO6 v1.72 or later prior to updating the system ROM to revision 2.54 or later.

Problems Fixed:

Addressed an issue where servers could halt during POST displaying an "SPDM component authentication failure" even when SPDM was configured as disabled.

Addressed an issue where the system time zone setting could be reset to default when a DST-adjusted offset or stale mnemonic caused validation failure during boot.

Addressed an issue where restoring manufacturing defaults could result in incorrect memory configuration values being applied on AMD EPYC 9005 Series (Turin)-based platforms.

Addressed an issue where restoring defaults on high core count AMD EPYC 9005 Series (Turin) platforms (>=255 logical cores) could trigger an unnecessary full memory training cycle due to incorrect APIC mode handling.

Addressed an issue where the Tiered Memory Page Migration (TMPM) device was not generated in the ACPI SSDT table, preventing the MPDMA device from being recognized by the operating system.

Addressed an issue where the system could experience unnecessary boot halts on heavily loaded SPDM configurations when iLO discovery exceeded the BIOS timeout, even when SPDM policy was disabled.

Addressed an issue where the sysconfig UEFI shell command for enabledcoresperproc returned options inconsistent with the RBSU GUI.

Addressed a security vulnerability in OpenSSL (CVE-2026-7383) where a signed integer overflow in ASN1_mbstring_ncopy() could lead to a heap buffer overflow under specific conditions.

Addressed a security vulnerability in Libpng (CVE-2026-34757) where a use-after-free condition could occur when passing a pointer returned by the PLTE, tRNS, or hIST getters back into the corresponding setters.

Addressed a security vulnerability in OpenSSL (CVE-2026-45447) involving a possible use-after-free condition in PKCS7_verify().

Addressed a security vulnerability in Libpng (CVE-2026-33416) where a dangling pointer could result in reads or writes to freed memory during palette operations.

Addressed an issue where attempting to generate a Blue Screen of Death (BSOD) under Windows via iLO 6’s Virtual NMI Button does not function when Hyper-V is enabled on AMD EPYC 9005 Series (Turin) platforms.

Known Issues:

None

このバージョンのシステムROMには、インテル製品アップデート（IPU）バージョンIPU.2026.3ガイダンスに沿ったアップデートが含まれています。

このバージョンのシステムROMは、Server Platform Services（SPS）ファームウェア06.03.04.069.0（2.40_01_12_2026）と組み合わせる必要があります。

報告されたセキュリティ脆弱性とその緩和策の詳細については、リンクセキュリティ報告ライブラリ | HPEサポートを参照してください。

ファームウェアの依存関係：

なし

修正された問題点:

Intel Xeon E-2477P (6377P) プロセッサーが、サポートされるコア数を12ではなく8と誤って報告していた問題を解決しました。

特定のMMCFG構成オプションを適用した際に、システムがハングアップしたり、異常終了が発生したりする問題を解決しました。

夏時間調整後のオフセット検証が失敗した場合に、起動時にシステムタイムゾーンが予期せずデフォルト値にリセットされる可能性がある問題を解決しました。

特定の条件下でPCIeエラー処理中にレッドスクリーンオブデス（RSOD）が発生する可能性がある問題を解決しました。

メモリトレーニング後のPOST中に予期しないプロセッサー状態が発生し、システム障害を引き起こす可能性があり、特定の診断操作中にRSODが発生する可能性がある問題を解決しました。

SPDM対応デバイスが多数存在するシステムにおいて、SPDMポリシーが無効になっている場合でも、不要な起動遅延が発生する問題を解決しました。

廃止されたASIX USB NIC RBSU設定ノブがまだ表示されていた問題を解決しました。つまみは不要になったため取り外しました。

UINT32オーバーフロー条件により、8GBまたは16GB容量のeMMCデバイスが正しく処理されない問題を解決しました。

既知の問題点：

オペレーティングシステムがタイムゾーンを構成した後、UEFIシステムユーティリティ (RBSU) で行われる以降のタイムゾーン変更は、システムの再起動後に保持されない場合があります。

This version of the System ROM contains updates aligned with the Intel Product Update (IPU) version IPU.2026.3 guidance.

This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 06.03.04.069.0 (2.40_01_12_2026).

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Resolved an issue where the Intel Xeon E-2477P (6377P) processor incorrectly reported a supported core count of 8 instead of 12.

Resolved an issue where the system could hang or assert when certain MMCFG configuration options were applied.

Resolved an issue where the system time zone could be unexpectedly reset to the default value during boot when a DST-adjusted offset validation failed.

Resolved an issue where a Red Screen of Death (RSOD) could occur during PCIe error handling under certain conditions.

Resolved an issue where an unexpected processor state could cause a system fault during POST after memory training, potentially resulting in an RSOD during certain diagnostic operations.

Resolved an issue where systems with many SPDM-capable devices could experience unnecessary boot delays even when the SPDM policy was disabled.

Resolved an issue where the deprecated ASIX USB NIC RBSU configuration knob was still visible. The knob has been removed as it is no longer required.

Resolved an issue where eMMC devices of 8GB or 16GB capacity were not handled correctly due to a UINT32 overflow condition.

Known Issues:

After the operating system configures the time zone, subsequent time zone changes made in UEFI System Utilities (RBSU) may not be retained after a system reboot.

報告されたセキュリティ脆弱性とその緩和策の詳細については、リンクセキュリティ報告ライブラリ | HPEサポートを参照してください。

ファームウェアの依存関係：

修正された問題点：

Intel Xeon E-2477P (6377P) プロセッサーが、サポートされるコア数を12ではなく8と誤って報告していた問題を解決しました。

特定のMMCFG構成オプションを適用した際に、システムがハングアップしたり、異常終了が発生したりする問題を解決しました。

夏時間調整後のオフセット検証が失敗した場合に、起動時にシステムタイムゾーンが予期せずデフォルト値にリセットされる可能性がある問題を解決しました。

特定の条件下でPCIeエラー処理中にレッドスクリーンオブデス（RSOD）が発生する可能性がある問題を解決しました。

メモリトレーニング後のPOST中に予期しないプロセッサー状態が発生し、システム障害を引き起こす可能性があり、特定の診断操作中にRSODが発生する可能性がある問題を解決しました。

SPDM対応デバイスが多数存在するシステムにおいて、SPDMポリシーが無効になっている場合でも、不要な起動遅延が発生する問題を解決しました。

廃止されたASIX USB NIC RBSU設定ノブがまだ表示されていた問題を解決しました。つまみは不要になったため取り外しました。

UINT32オーバーフロー条件により、8GBまたは16GB容量のeMMCデバイスが正しく処理されない問題を解決しました。

既知の問題点：

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Resolved an issue where the Intel Xeon E-2477P (6377P) processor incorrectly reported a supported core count of 8 instead of 12.

Resolved an issue where the system could hang or assert when certain MMCFG configuration options were applied.

Resolved an issue where the system time zone could be unexpectedly reset to the default value during boot when a DST-adjusted offset validation failed.

Resolved an issue where a Red Screen of Death (RSOD) could occur during PCIe error handling under certain conditions.

Resolved an issue where an unexpected processor state could cause a system fault during POST after memory training, potentially resulting in an RSOD during certain diagnostic operations.

Resolved an issue where systems with many SPDM-capable devices could experience unnecessary boot delays even when the SPDM policy was disabled.

Resolved an issue where the deprecated ASIX USB NIC RBSU configuration knob was still visible. The knob has been removed as it is no longer required.

Resolved an issue where eMMC devices of 8GB or 16GB capacity were not handled correctly due to a UINT32 overflow condition.

Known Issues:

このバージョンのシステムROMには、Intel IPU2026.3アップデートに合わせたアップデートが含まれています。このバージョンのシステムROMは、Server Platform Services（SPS）ファームウェア06.01.04.230.0（2.90_08_16_2026）と組み合わせる必要があります。

報告されたセキュリティ脆弱性とその緩和策の詳細については、リンクセキュリティ報告ライブラリ | HPEサポートを参照してください。

ファームウェアの依存関係：

なし

修正された問題点:

CNSAモードでiLOを工場出荷時設定にリセットした後、BIOS設定が失われ、複数のiLO管理機能が動作しなくなる可能性がある問題に対処しました。

OEMセキュアブートのカスタマイズが有効になっているシステムで、RBSUの[すべてのキーをプラットフォームのデフォルトにリセット] を使用した後、セキュアブートキーの自動登録がトリガーされない場合がある問題に対処しました。

RBSUとRedfishのインターフェイス間でセキュアブート自動登録ポリシーの設定が正しく同期されない可能性がある問題に対処しました。

SPDM全体のブートポリシーが正しい場所から読み込まれず、SPDMブートポリシーの予期しない動作を招く可能性がある問題に対処しました。

Redfish APIを介したセキュアブート署名の削除が失敗する可能性がある問題に対処しました。

既知の問題点：

オペレーティングシステムがタイムゾーンを構成した後、UEFIシステムユーティリティ (RBSU) で行われる以降のタイムゾーン変更は、システムの再起動後に保持されない場合があります。

This version of the System ROM contains updates aligned with the Intel IPU2026.3 update. This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 06.01.04.230.0 (2.90_08_16_2026).

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

After the operating system configures the time zone, subsequent time zone changes made in UEFI System Utilities (RBSU) may not be retained after a system reboot.

報告されたセキュリティ脆弱性とその緩和策の詳細については、リンクセキュリティ報告ライブラリ | HPEサポートを参照してください。

ファームウェアの依存関係：

修正された問題点:

CNSAモードでiLOを工場出荷時設定にリセットした後、BIOS設定が失われ、複数のiLO管理機能が動作しなくなる可能性がある問題に対処しました。

OEMセキュアブートのカスタマイズが有効になっているシステムで、RBSUの[すべてのキーをプラットフォームのデフォルトにリセット] を使用した後、セキュアブートキーの自動登録がトリガーされない場合がある問題に対処しました。

RBSUとRedfishのインターフェイス間でセキュアブート自動登録ポリシーの設定が正しく同期されない可能性がある問題に対処しました。

SPDM全体のブートポリシーが正しい場所から読み込まれず、SPDMブートポリシーの予期しない動作を招く可能性がある問題に対処しました。

Redfish APIを介したセキュアブート署名の削除が失敗する可能性がある問題に対処しました。

既知の問題点：

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

• Garbled characters are observed in the System Utilities(F9) configuration screens with Japanese Environment when HPE Emulex Fibre Channel Host Bus Adapter is installed on ProLiant Gen11 and ProLiant Gen12 servers
• Unified Extensible Firmware Interface (UEFI) protocol driver does not complete the polling device; causing the UEFI diagnostics system board component test incomplete.

• Garbled characters are observed in the System Utilities(F9) configuration screens with Japanese Environment when HPE Emulex Fibre Channel Host Bus Adapter is installed on ProLiant Gen11 and ProLiant Gen12 servers
• Unified Extensible Firmware Interface (UEFI) protocol driver does not complete the polling device; causing the UEFI diagnostics system board component test incomplete.

SPDM - 証明書取得応答で範囲外の値が返されます

SPDM - Get Certificate response returns out of bound values

• FWがCQ回復モードに入った後、ファームウェアはPFの正しいCQをスキャンできませんでした。その結果、PFのCQが回復されませんでした。

• Firmware failed to scan the correct CQs for the PF after the FW entered into the CQ recovery mode., resulting in CQs for the PF not being recovered.

このバージョンのシステムROMには、Intel IPU2026.3アップデートに合わせたアップデートが含まれています。このバージョンのシステムROMは、Server Platform Services（SPS）ファームウェア06.01.04.230.0（2.90_08_16_2026）と組み合わせる必要があります。

報告されたセキュリティ脆弱性とその緩和策の詳細については、リンクセキュリティ報告ライブラリ | HPEサポートを参照してください。

ファームウェアの依存関係：

なし

修正された問題点:

CNSAモードでiLOを工場出荷時設定にリセットした後、BIOS設定が失われ、複数のiLO管理機能が動作しなくなる可能性がある問題に対処しました。

OEMセキュアブートのカスタマイズが有効になっているシステムで、RBSUの[すべてのキーをプラットフォームのデフォルトにリセット] を使用した後、セキュアブートキーの自動登録がトリガーされない場合がある問題に対処しました。

RBSUとRedfishのインターフェイス間でセキュアブート自動登録ポリシーの設定が正しく同期されない可能性がある問題に対処しました。

SPDM全体のブートポリシーが正しい場所から読み込まれず、SPDMブートポリシーの予期しない動作を招く可能性がある問題に対処しました。

Redfish APIを介したセキュアブート署名の削除が失敗する可能性がある問題に対処しました。

既知の問題点：

オペレーティングシステムがタイムゾーンを構成した後、UEFIシステムユーティリティ (RBSU) で行われる以降のタイムゾーン変更は、システムの再起動後に保持されない場合があります。

This version of the System ROM contains updates aligned with the Intel IPU2026.3 update. This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 06.01.04.230.0 (2.90_08_16_2026).

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

After the operating system configures the time zone, subsequent time zone changes made in UEFI System Utilities (RBSU) may not be retained after a system reboot.

報告されたセキュリティ脆弱性とその緩和策の詳細については、リンクセキュリティ報告ライブラリ | HPEサポートを参照してください。

ファームウェアの依存関係：

修正された問題点:

CNSAモードでiLOを工場出荷時設定にリセットした後、BIOS設定が失われ、複数のiLO管理機能が動作しなくなる可能性がある問題に対処しました。

OEMセキュアブートのカスタマイズが有効になっているシステムで、RBSUの[すべてのキーをプラットフォームのデフォルトにリセット] を使用した後、セキュアブートキーの自動登録がトリガーされない場合がある問題に対処しました。

RBSUとRedfishのインターフェイス間でセキュアブート自動登録ポリシーの設定が正しく同期されない可能性がある問題に対処しました。

SPDM全体のブートポリシーが正しい場所から読み込まれず、SPDMブートポリシーの予期しない動作を招く可能性がある問題に対処しました。

Redfish APIを介したセキュアブート署名の削除が失敗する可能性がある問題に対処しました。

既知の問題点：

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

このバージョンのシステムROMには、Intel IPU2026.3アップデートに合わせたアップデートが含まれています。このバージョンのシステムROMは、Server Platform Services（SPS）ファームウェア06.01.04.230.0（2.90_08_16_2026）と組み合わせる必要があります。

報告されたセキュリティ脆弱性とその緩和策の詳細については、リンクセキュリティ報告ライブラリ | HPEサポートを参照してください。

ファームウェアの依存関係：

なし

修正された問題点:

CNSAモードでiLOを工場出荷時設定にリセットした後、BIOS設定が失われ、複数のiLO管理機能が動作しなくなる可能性がある問題に対処しました。

OEMセキュアブートのカスタマイズが有効になっているシステムで、RBSUの[すべてのキーをプラットフォームのデフォルトにリセット] を使用した後、セキュアブートキーの自動登録がトリガーされない場合がある問題に対処しました。

RBSUとRedfishのインターフェイス間でセキュアブート自動登録ポリシーの設定が正しく同期されない可能性がある問題に対処しました。

SPDM全体のブートポリシーが正しい場所から読み込まれず、SPDMブートポリシーの予期しない動作を招く可能性がある問題に対処しました。

Redfish APIを介したセキュアブート署名の削除が失敗する可能性がある問題に対処しました。

既知の問題点：

オペレーティングシステムがタイムゾーンを構成した後、UEFIシステムユーティリティ (RBSU) で行われる以降のタイムゾーン変更は、システムの再起動後に保持されない場合があります。

This version of the System ROM contains updates aligned with the Intel IPU2026.3 update. This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 06.01.04.230.0 (2.90_08_16_2026).

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

After the operating system configures the time zone, subsequent time zone changes made in UEFI System Utilities (RBSU) may not be retained after a system reboot.

報告されたセキュリティ脆弱性とその緩和策の詳細については、リンクセキュリティ報告ライブラリ | HPEサポートを参照してください。

ファームウェアの依存関係：

修正された問題点:

CNSAモードでiLOを工場出荷時設定にリセットした後、BIOS設定が失われ、複数のiLO管理機能が動作しなくなる可能性がある問題に対処しました。

OEMセキュアブートのカスタマイズが有効になっているシステムで、RBSUの[すべてのキーをプラットフォームのデフォルトにリセット] を使用した後、セキュアブートキーの自動登録がトリガーされない場合がある問題に対処しました。

RBSUとRedfishのインターフェイス間でセキュアブート自動登録ポリシーの設定が正しく同期されない可能性がある問題に対処しました。

SPDM全体のブートポリシーが正しい場所から読み込まれず、SPDMブートポリシーの予期しない動作を招く可能性がある問題に対処しました。

Redfish APIを介したセキュアブート署名の削除が失敗する可能性がある問題に対処しました。

既知の問題点：

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

• CREATE_PARSE_GRAPH_NODE incorrectly applied validation intended for WA mode, in which header_length_field_offset is adjusted by firmware. Since ConnectX-8 and newer adapters use normal mode only, these checks were redundant and could reject valid input. Validation is now mode-specific: normal-mode rules are applied on ConnectX-8 and newer adapters, while WA-mode rules are applied on older adapters.
• The firmware did not enforce the adapter limit for the number of flow match samples per parse graph node across the device. As a result, creation could succeed even when the total exceeded the hardware-supported limit. Firmware now enforces this limit before allocating samples. Creating a parse graph node that would exceed the maximum number of hardware flow match samples now fails with a “no resources” error.
• When Flex Parser overwrite native arc was enabled, destroying or closing a parse graph node on a native protocol arc did not restore the native protocol parser. As a result, the native parser remained unavailable on the device until a reset or another recovery action was performed. Native protocol parsing is now restored as expected when the parse graph node is closed or destroyed. Native parsers are disabled only while the Flex Parser graph owns the arc.
• A corner-case race condition triggered by DSP resets, causing the link to be unresponsive.
• A DEAD IRISC assert that could occur during TLV NV_DATA flash access by suspending the watchdog while waiting for flash IPC (until timeout), preventing the assert on TLV access.
• In rare cases, certain module types experienced link-up failures.
• After toggling all ports, one port could become unresponsive in the Receiver Detect state.
• Repeatedly writing NVCONFIG TLVs could cause excessive NV_DATA partition swaps during garbage collection. This rapid cycling could accelerate flash wear (end-of-life at 100,000 erases) and potentially render the device inoperable. Firmware now avoids unnecessary physical writes by returning OK when the requested configuration already exists in flash, and increases the maximum supported NV_DATA partition swaps from 100,000 to 200,000.
• NSM did not function reliably in multihost configurations when a DMA physical function (PF) was present.
• ICM_RES_HW_DMFS_ENCAP_H_FW was allocated per GVMI, preventing some RTTs from using it.
• Queue pairs (QPs) created during a PCC process transition could miss congestion-control (CC) information, preventing them from being fully managed.
• The LAG layer steering table had only one strict-SQ entry, causing strict no-port-select traffic to be routed to a single default port. With LOAD_BALANCE_MODE_P1=3, this could lead to link flapping because LACP packets were transmitted only from that default port. The fix expands the LAG layer steering table and adds additional strict-port entries to distribute strict traffic correctly.
• RDMA traffic could stall in large-scale deployments for certain source IP and UDP source-port combinations when DOCA PCC was active and no congestioncontrol algorithm was configured in algorithm slot 0.
• The live migration target did not receive a port state change event on the resume VHCA command. The target now generates this event so software that depends on port state is notified of any changes.
• An issue during hitless upgrade where, after the SACK generation/handler fence, firmware could mark the old port configuration ID as invalid. If SACK causes were still active, a race could cause SACK ISRs to stop unexpectedly. The fix is to always return BUSY while handover is active.
• When using multiplane ZTRCC congestion control with multiple flows, the RTT timeout counter in the PPCC register could increase even when the network was not congested.
• A firmware race condition between packet receive and QP cleanup could move a QP to error when reopening the same QP and sending the same MSN. This could occur when interrupting traffic (e.g., Ctrl+C) and running many iterations until the same QP/MSN combination is reused.
• The FMT Static PF verifier did not account for the Tools PF when verifying the DMA PF. 
• QPs established before loading DOCA PCC could exhibit inconsistent algorithm-selected behavior between ports in LAG mode after DOCA PCC is loaded.
• One-to-one RoCE traffic using a single QP might not achieve line rate on some platforms when using the default ROCE_CC_COMPATIBILITY_MODE setting in mlxconfig.
• In some configurations with ConnectX-8 connected to an MP3 switch, the link might fail to come up on the switch side after toggling ports. In these cases, ConnectX-8 reported opcode 14, indicating detected remote faults and that the partner was not bringing the link up.
• ACS errors could occur due to a race condition when performing LDE/SBR while MCTP traffic to the device was active.
• A potential routing error when IOVAs assigned to the NIC overlap with the PCIe address space. In certain configurations, an IOVA could fall into an “unclaimed address” range, within a PCIe switch’s Upstream Port (USP) window but outside any Downstream Port (DSP) aperture. Note: Since this is a kernel issue, to ensure packets are routed correctly in these scenarios, users must enable the ACS Unclaimed Request Redirect bit in the PCIe bridges’ Access Control Services (ACS) capability via the kernel.
• Partially enabling ACS enhanced capability could cause unexpected driver and system behavior. ACS enhanced capability remains disabled and will not be enabled.

• CREATE_PARSE_GRAPH_NODE incorrectly applied validation intended for WA mode, in which header_length_field_offset is adjusted by firmware. Since ConnectX-8 and newer adapters use normal mode only, these checks were redundant and could reject valid input. Validation is now mode-specific: normal-mode rules are applied on ConnectX-8 and newer adapters, while WA-mode rules are applied on older adapters.
• The firmware did not enforce the adapter limit for the number of flow match samples per parse graph node across the device. As a result, creation could succeed even when the total exceeded the hardware-supported limit. Firmware now enforces this limit before allocating samples. Creating a parse graph node that would exceed the maximum number of hardware flow match samples now fails with a “no resources” error.
• When Flex Parser overwrite native arc was enabled, destroying or closing a parse graph node on a native protocol arc did not restore the native protocol parser. As a result, the native parser remained unavailable on the device until a reset or another recovery action was performed. Native protocol parsing is now restored as expected when the parse graph node is closed or destroyed. Native parsers are disabled only while the Flex Parser graph owns the arc.
• A corner-case race condition triggered by DSP resets, causing the link to be unresponsive.
• A DEAD IRISC assert that could occur during TLV NV_DATA flash access by suspending the watchdog while waiting for flash IPC (until timeout), preventing the assert on TLV access.
• In rare cases, certain module types experienced link-up failures.
• After toggling all ports, one port could become unresponsive in the Receiver Detect state.
• Repeatedly writing NVCONFIG TLVs could cause excessive NV_DATA partition swaps during garbage collection. This rapid cycling could accelerate flash wear (end-of-life at 100,000 erases) and potentially render the device inoperable. Firmware now avoids unnecessary physical writes by returning OK when the requested configuration already exists in flash, and increases the maximum supported NV_DATA partition swaps from 100,000 to 200,000.
• NSM did not function reliably in multihost configurations when a DMA physical function (PF) was present.
• ICM_RES_HW_DMFS_ENCAP_H_FW was allocated per GVMI, preventing some RTTs from using it.
• Queue pairs (QPs) created during a PCC process transition could miss congestion-control (CC) information, preventing them from being fully managed.
• The LAG layer steering table had only one strict-SQ entry, causing strict no-port-select traffic to be routed to a single default port. With LOAD_BALANCE_MODE_P1=3, this could lead to link flapping because LACP packets were transmitted only from that default port. The fix expands the LAG layer steering table and adds additional strict-port entries to distribute strict traffic correctly.
• RDMA traffic could stall in large-scale deployments for certain source IP and UDP source-port combinations when DOCA PCC was active and no congestioncontrol algorithm was configured in algorithm slot 0.
• The live migration target did not receive a port state change event on the resume VHCA command. The target now generates this event so software that depends on port state is notified of any changes.
• An issue during hitless upgrade where, after the SACK generation/handler fence, firmware could mark the old port configuration ID as invalid. If SACK causes were still active, a race could cause SACK ISRs to stop unexpectedly. The fix is to always return BUSY while handover is active.
• When using multiplane ZTRCC congestion control with multiple flows, the RTT timeout counter in the PPCC register could increase even when the network was not congested.
• A firmware race condition between packet receive and QP cleanup could move a QP to error when reopening the same QP and sending the same MSN. This could occur when interrupting traffic (e.g., Ctrl+C) and running many iterations until the same QP/MSN combination is reused.
• The FMT Static PF verifier did not account for the Tools PF when verifying the DMA PF. 
• QPs established before loading DOCA PCC could exhibit inconsistent algorithm-selected behavior between ports in LAG mode after DOCA PCC is loaded.
• One-to-one RoCE traffic using a single QP might not achieve line rate on some platforms when using the default ROCE_CC_COMPATIBILITY_MODE setting in mlxconfig.
• In some configurations with ConnectX-8 connected to an MP3 switch, the link might fail to come up on the switch side after toggling ports. In these cases, ConnectX-8 reported opcode 14, indicating detected remote faults and that the partner was not bringing the link up.
• ACS errors could occur due to a race condition when performing LDE/SBR while MCTP traffic to the device was active.
• A potential routing error when IOVAs assigned to the NIC overlap with the PCIe address space. In certain configurations, an IOVA could fall into an “unclaimed address” range, within a PCIe switch’s Upstream Port (USP) window but outside any Downstream Port (DSP) aperture. Note: Since this is a kernel issue, to ensure packets are routed correctly in these scenarios, users must enable the ACS Unclaimed Request Redirect bit in the PCIe bridges’ Access Control Services (ACS) capability via the kernel.
• Partially enabling ACS enhanced capability could cause unexpected driver and system behavior. ACS enhanced capability remains disabled and will not be enabled.

• In certain configurations with the ConnectX-8 PCIe switch enabled, downstream devices (including GPUs) might not be detected and could drop from the PCI bus, with GPU sensors/properties reporting NA. This was caused by the device not receiving the required PERST# assertion during initialization, and was seen only when PCIe settings were manually modified via mlxconfig (e.g., restricting link speed/width or ASPM on specific PCI buses).
• The DPA kernel used unsafe ICM access during process creation/modification, which could cause the DPA kernel to hang during FLR.
• Link failures were occasionally observed at PAM4 speeds over optical interfaces in rare cases.
• An issue in the User Debugger “query caps” where it returned only the number of capabilities, not the capability bitmap.
• CR dumps could time out when accessing xpl_top addresses across all three pcores.
• The Virtio and NVMe EMU_MNG settings were exposed incorrectly, which could cause confusion when using mlxconfig.
• The PHY LED could show green during the initializing state when active speed was set to full speed. In IB mode, the initializing-state LED should be amber only.
• On multi-PF-per-port systems, a PF FLR could impact the traffic bandwidth of other PFs on the same port.
• PTP could converge to an incorrect time/offset and report an inaccurate path delay.
• In Flit Mode, the device could become unresponsive when receiving malformed or invalid traffic from a link partner.
• "mlxlink" reported 0 values for SNR (media and host) due to incorrect local port mapping in firmware and an incorrect page number used by MFT.
• Parallel accesses to the MCIA register could return incorrect data. In some hosts running ethtool -m <interface> repeatedly (e.g., once per second), this could intermittently report Identifier: 0x00 (unknown/no module), causing health checks to fail.
• A rare attestation certificate signature formatting issue leading to an unnecessary zero byte in the “r” or “s” value.
• In certain Gen6 setups, RDMA READ bidirectional traffic required at least 5 QPs to reach full wire speed.
• An issue affecting single-process, unidirectional RDMA READ to GPU memory (4 QPs, 128KB messages) by enabling ZERO_TOUCH_TUNING_ENABLE via MLXCONFIG.
• An issue where probe packets might not be sent under heavy traffic.
• The root complex sent MCTP-over-PCI messages before a BDF was assigned, causing responses to be sent with BDF 0. The fix ensures that MCTP messages routed by ID are ignored until a valid BDF is assigned.
• The steering tables were not updated after enabling partial Spectrum-X capabilities (BTH.AR) via LLPD.
• An intX message was sent with a Requester ID of 0, causing an ACS violation at the root port. The fix uses the correct BDF as the Requester ID instead of 0.

• In certain configurations with the ConnectX-8 PCIe switch enabled, downstream devices (including GPUs) might not be detected and could drop from the PCI bus, with GPU sensors/properties reporting NA. This was caused by the device not receiving the required PERST# assertion during initialization, and was seen only when PCIe settings were manually modified via mlxconfig (e.g., restricting link speed/width or ASPM on specific PCI buses).
• The DPA kernel used unsafe ICM access during process creation/modification, which could cause the DPA kernel to hang during FLR.
• Link failures were occasionally observed at PAM4 speeds over optical interfaces in rare cases.
• An issue in the User Debugger “query caps” where it returned only the number of capabilities, not the capability bitmap.
• CR dumps could time out when accessing xpl_top addresses across all three pcores.
• The Virtio and NVMe EMU_MNG settings were exposed incorrectly, which could cause confusion when using mlxconfig.
• The PHY LED could show green during the initializing state when active speed was set to full speed. In IB mode, the initializing-state LED should be amber only.
• On multi-PF-per-port systems, a PF FLR could impact the traffic bandwidth of other PFs on the same port.
• PTP could converge to an incorrect time/offset and report an inaccurate path delay.
• In Flit Mode, the device could become unresponsive when receiving malformed or invalid traffic from a link partner.
• "mlxlink" reported 0 values for SNR (media and host) due to incorrect local port mapping in firmware and an incorrect page number used by MFT.
• Parallel accesses to the MCIA register could return incorrect data. In some hosts running ethtool -m <interface> repeatedly (e.g., once per second), this could intermittently report Identifier: 0x00 (unknown/no module), causing health checks to fail.
• A rare attestation certificate signature formatting issue leading to an unnecessary zero byte in the “r” or “s” value.
• In certain Gen6 setups, RDMA READ bidirectional traffic required at least 5 QPs to reach full wire speed.
• An issue affecting single-process, unidirectional RDMA READ to GPU memory (4 QPs, 128KB messages) by enabling ZERO_TOUCH_TUNING_ENABLE via MLXCONFIG.
• An issue where probe packets might not be sent under heavy traffic.
• The root complex sent MCTP-over-PCI messages before a BDF was assigned, causing responses to be sent with BDF 0. The fix ensures that MCTP messages routed by ID are ignored until a valid BDF is assigned.
• The steering tables were not updated after enabling partial Spectrum-X capabilities (BTH.AR) via LLPD.
• An intX message was sent with a Requester ID of 0, causing an ACS violation at the root port. The fix uses the correct BDF as the Requester ID instead of 0.

報告されたセキュリティ脆弱性とその緩和策の詳細については、リンクセキュリティ報告ライブラリ | HPEサポートを参照してください。

ファームウェアの依存関係：

修正された問題点:

Smartコンポーネントを使用してME/SPSファームウェアをアップデートした後でシステムがリセットループに陥る可能性がある問題に対処しました。

既知の問題点：

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where the system may encounter reset loop after updating ME/SPS firmware using smart components.

Known Issues:

このバージョンのシステムROMには、Intel IPU2026.3アップデートに合わせたアップデートが含まれています。このバージョンのシステムROMは、Server Platform Services（SPS）ファームウェア06.01.04.230.0（2.90_08_16_2026）と組み合わせる必要があります。

報告されたセキュリティ脆弱性とその緩和策の詳細については、リンクセキュリティ報告ライブラリ | HPEサポートを参照してください。

ファームウェアの依存関係：

なし

修正された問題点:

CNSAモードでiLOを工場出荷時設定にリセットした後、BIOS設定が失われ、複数のiLO管理機能が動作しなくなる可能性がある問題に対処しました。

OEMセキュアブートのカスタマイズが有効になっているシステムで、RBSUの[すべてのキーをプラットフォームのデフォルトにリセット] を使用した後、セキュアブートキーの自動登録がトリガーされない場合がある問題に対処しました。

RBSUとRedfishのインターフェイス間でセキュアブート自動登録ポリシーの設定が正しく同期されない可能性がある問題に対処しました。

SPDM全体のブートポリシーが正しい場所から読み込まれず、SPDMブートポリシーの予期しない動作を招く可能性がある問題に対処しました。

Redfish APIを介したセキュアブート署名の削除が失敗する可能性がある問題に対処しました。

既知の問題点：

オペレーティングシステムがタイムゾーンを構成した後、UEFIシステムユーティリティ (RBSU) で行われる以降のタイムゾーン変更は、システムの再起動後に保持されない場合があります。

This version of the System ROM contains updates aligned with the Intel IPU2026.3 update. This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 06.01.04.230.0 (2.90_08_16_2026).

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

After the operating system configures the time zone, subsequent time zone changes made in UEFI System Utilities (RBSU) may not be retained after a system reboot.

報告されたセキュリティ脆弱性とその緩和策の詳細については、リンクセキュリティ報告ライブラリ | HPEサポートを参照してください。

ファームウェアの依存関係：

修正された問題点:

CNSAモードでiLOを工場出荷時設定にリセットした後、BIOS設定が失われ、複数のiLO管理機能が動作しなくなる可能性がある問題に対処しました。

OEMセキュアブートのカスタマイズが有効になっているシステムで、RBSUの[すべてのキーをプラットフォームのデフォルトにリセット] を使用した後、セキュアブートキーの自動登録がトリガーされない場合がある問題に対処しました。

RBSUとRedfishのインターフェイス間でセキュアブート自動登録ポリシーの設定が正しく同期されない可能性がある問題に対処しました。

SPDM全体のブートポリシーが正しい場所から読み込まれず、SPDMブートポリシーの予期しない動作を招く可能性がある問題に対処しました。

Redfish APIを介したセキュアブート署名の削除が失敗する可能性がある問題に対処しました。

既知の問題点：

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

•     corner case performance enhance.
•     Servo change that resolves issue with early heat application from Idle sweep seek terminated that may cause read errors.

•     corner case performance enhance.
•     Servo change that resolves issue with early heat application from Idle sweep seek terminated that may cause read errors.

• vDPA doorbell resources were not released causing failures when running other functionality after a vDPA FLR. Doorbell resources are now properly unlocked.
• Live migration target would not receive a port state change event on the resume VHCA command. The target now generates this event so software that depends on port state is notified of any changes.
• PCC issue where RDMA traffic would stall at large scale for certain IP and UDP source-port combinations when a PCC user algorithm was active and no CC algorithm was configured in slot 0.

• vDPA doorbell resources were not released causing failures when running other functionality after a vDPA FLR. Doorbell resources are now properly unlocked.
• Live migration target would not receive a port state change event on the resume VHCA command. The target now generates this event so software that depends on port state is notified of any changes.
• PCC issue where RDMA traffic would stall at large scale for certain IP and UDP source-port combinations when a PCC user algorithm was active and no CC algorithm was configured in slot 0.

• vDPA doorbell resources were not released causing failures when running other functionality after a vDPA FLR. Doorbell resources are now properly unlocked.
• Live migration target would not receive a port state change event on the resume VHCA command. The target now generates this event so software that depends on port state is notified of any changes.
• PCC issue where RDMA traffic would stall at large scale for certain IP and UDP source-port combinations when a PCC user algorithm was active and no CC algorithm was configured in slot 0.

• vDPA doorbell resources were not released causing failures when running other functionality after a vDPA FLR. Doorbell resources are now properly unlocked.
• Live migration target would not receive a port state change event on the resume VHCA command. The target now generates this event so software that depends on port state is notified of any changes.
• PCC issue where RDMA traffic would stall at large scale for certain IP and UDP source-port combinations when a PCC user algorithm was active and no CC algorithm was configured in slot 0.