Cisco Custom ISO MISSING_DEPENDENCY_VIBS ERROR during upgrade ESXi 6.7 -> 7.0

I found a problem and workaround to fix Cisco Custom ISO MISSING_DEPENDENCY_VIBS ERROR during upgrade 6.7 -> 7.0.

It was during these type of upgrade from VMware_ESXi_6.7.0_13006603_Custom_Cisco_6.7.2.1.iso to VMware_ESXi_7.0.0_15843807_Custom_Cisco_4.1.1a.iso

Workaround is to remove VIBs with dependency collision:

# esxcli software vib list | grep QLC
qcnic                          1.0.22.0-1OEM.670.0.0.8169922         QLC 
qedentv                        3.9.31.0-1OEM.670.0.0.8169922         QLC 
qedrntv                        3.9.31.1-1OEM.670.0.0.8169922         QLC 
qfle3                          1.0.77.2-1OEM.670.0.0.8169922         QLC 
qfle3f                         1.0.63.0-1OEM.670.0.0.8169922         QLC 
qfle3i                         1.0.20.0-1OEM.670.0.0.8169922         QLC 
scsi-qedil                     1.2.13.0-1OEM.600.0.0.2494585         QLC 

# esxcli software vib remove -f -n scsi-qedil
# esxcli software vib remove -f -n qfle3f
# reboot

vExpert Applications are Open – Don’t Miss Out!

vExpert Applications are Open – Don’t Miss Out!

vExpert Applications are Open! Don’t miss out on the opportunity to join this amazing program & community. Applications will be open from June 1st, 2020 to July 19th, 2020 and the awards will be announced on July 17th. Apply for vExpert 2020 What the Program is About The vExpert Program is […]


VMware Social Media Advocacy

VCPs and VCAPs Around the World: Are you on the…

VCPs and VCAPs Around the World: Are you on the map?

VCPs and VCAPs Around the World: Are you on the…

VMware Certified Professional (VCP) and VMware Certified Advanced Professional (VCAP) represents two of the most popular levels of certification offered by VMware to validate your knowledge and skills. These certifications provide many benefits and span across five tracks including: Data Center Virtualization Cloud Management and Automation Desktop and Mobility Network Virtualization Digital Workspace. The post VCPs and VCAPs Around the World: Are you on the map? appeared first on VMware…Read More


VMware Social Media Advocacy

Memory Controller May Hang While in Virtual Lockstep – fix in UCSM 4.1(1c)

SAP HANA is very intensive for memory operation. With ADDDC Sparing We can add System reliability. It is optimized by holding memory in reserve so that it can be used in case other DIMMs fail. But there Could be another problem with.

Memory Controller May Hang While in Virtual Lockstep

For more information – Intel® Xeon® Processor Scalable Family Specification Update, # SKX108:

Problem: Under complex microarchitectural conditions, a memory controller that is in VirtualLockstep (VLS) may hang on a partial write transaction.

Workaround: It is possible for BIOS to contain a workaround see below.

Implication: The memory controller hangs with a mesh-to-mem timeout Machine Check Exception(MSCOD=20h, MCACOD=400h). The memory controller hang may lead to other machine check timeouts that can lead to an unexpected system shutdown.

Cisco UCS Manager, Release 4.1(1c) fix it

Cisco applied BIOS workaround for this scenario.

Defect IDSymptom
CSCvr79388Cisco UCS servers stop responding and reboot after ADDDC virtual lockstep is activated. This results in #IERR and M2M timeout in the memory system. This issue is resolved.
CSCvr79396On Cisco UCS M5 servers, the Virtual lock step (VLS) sparing copy finishes early, leading to incorrect values in the lock step region. This issue is resolved.
Resolved Caveats in Release 4.1(1c)

I recommended to update ASAP, firmware 4.1(1c) is stable. Cisco THX!

Vulnerability in the VMware Directory Service (vmdir) (CVE-2020-3952) – VMSA-2020-0006

On April 9th, 2020 VMSA-2020-0006 was published. This advisory documents a critical severity sensitive information disclosure vulnerability identified by CVE-2020-3952.

Affected versions

The vulnerability received a CVSSv3 score of 10 out of 10. Which means this is a very serious security issue. Response matrix is VMSA-2020-0006.

How I can check it?

Additional Documentation for VMSA-2020-0006: Determining if a vCenter 6.7 deployment w/embedded or external Platform Services Controller (PSC) is affected by CVE-2020-3952 (78543)

https://kb.vmware.com/s/article/78543

Virtual Appliance Log File Location: /var/log/vmware/vmdird/vmdird-syslog.log or in /var/log/vmware/vmdird/vmdird-syslog.log.*.gz

zgrep "ACL" /var/log/vmware/vmdird/*.gz
/var/log/vmware/vmdird/vmdird-syslog.log.x.gz:2020-xx-xxTxxxxxx+00:00 info vmdird t@xxxxxx: ACL MODE: Legacy

Notes from KB:

  • In order to be affected by CVE-2020-3952, a deployment must meet 2 criteria. First, it must be a 6.7 deployment prior to 6.7u3f. Second, it must be running in legacy ACL mode.
  • Because the ACL MODE: Legacy log entry is only thrown at vmdir startup,  it is possible that it will be absent due to log file rollover even on affected deployments.
  • The ACL MODE: Legacy log entry will still be thrown after upgrading to 6.7u3f and/or 7.0 even though CVE-2020-3952 is resolved in these releases.

Path it NOW ! – PoC was published !

It is recommended to block any access over the LDAP port (389) except for administrative use.

Clean installations of vCenter Server 6.7 (embedded or external PSC) are not affected.

vCenter Server 6.7 (embedded or external PSC) prior to 6.7u3f is affected by CVE-2020-3952 if it was upgraded from a previous release line such as 6.0 or 6.5.

Path it ASAP because:

  • On April 15th, 2020 was relased information about How to reconstructed the faulty code flow that led to this vulnerability.

How to fix? The CPU in this host is not supported by ESXi 7.0.0. -> allowLegacyCPU=True

Thank You William for these Quick Tip.

On my HomeLAB I have older server with NOT supported CPU for ESXi 7.0. During install I had an error:

The CPU in this host is not supported by ESXi 7.0.0.

CPU_SUPPORT ERROR:
The CPU in this host is not supported by ESXi
7.0.0. Please refer to the VMware Compatibility Guide (VCG) for
the list of supported CPUs.
Only possibilty is F11 Reboot.

FIX – The CPU in this host may not be supported in future ESXi releases …

It could be fix during boot SHIFT-O:

allowLegacyCPU=True
SHIFT-O will open options for boot:
With adding > allowLegacyCPU=True. Installer will convert an error to a warning.
Now we have only Warning – Enter will continue.
CPU_SUPPORT WARNING:
The CPU in this host is not supported by ESXi
7.0.0. Please refer to the VMware Compatibility Guide (VCG) for
the list of supported CPUs.

\UPGRADE\PRECHECK.PY

On ISO image VMware-VMvisor-Installer-7.0.0-15843807.x86_64.iso is \UPGRADE\PRECHECK.PY script which is checking it during instalation.

On line 1720 we could see our solution allowLegacyCPU = True

Disclaimer: This is not officially supported by VMware and you run on your own risk.

Automated vSphere 7 and vSphere with Kubernetes…

Automated vSphere 7 and vSphere with Kubernetes Lab Deployment Script

Automated vSphere 7 and vSphere with Kubernetes…

I know many of you have been asking me about my vSphere with Kubernetes automation script which I had been sharing snippets of on Twitter. For the past couple of weeks, I have been hard at work making the required changes between the vSphere 7 Beta and GA workflows, some additional testing and of course […]


VMware Social Media Advocacy

vSphere Lifecycle Manager Convert Baselines -> Image

After sucessfull ESXi 7.0 upgrade. We can start using vSphere Lifecycle Manager and convert VUM Baselines -> vLCM Image.

ACTION – Import Updates
Import VMware-ESXi-7.0.0-15843807-depot.zip
We start with SETUP IMAGE
– Select ESXi version
– ADD COMPONENTS – example VMWare USB NIC Fling Driver
Check Step 2
FINISH IMAGE SETUP with YES
Baselines menu disapear …
REMEDIATE ALL – start dialog
START REMETIATION will install our example VMWare USB NIC Fling Driver