Only 6 months left for Solaris 10 and 11.3

Oracle does provide patches under Extended Support for 
Solaris 10 and Solaris 11.3 till January 2027. 

The dates are documented in 
https://www.oracle.com/us/support/library/lifetime-support-hardware-301321.pdf

You can continue to run this Solaris versions, but who does
that without new patches and the security risks?

Migrate to Solaris 11.4, which will receive patches and new features
till January 2037 for sure, probably longer. Oracle extended
this date in the past already several times.

For Solaris 11.3 systems it is just SRU updates to Solaris 11.4.
For Solaris 10 you have to move the systems into Solaris branded zones
on Solaris 11.4. Your Solaris 10 apps and binaries will then run on 
a current Solaris 11.4 kernel.

If you need help with such migrations you can use our JomaSoft
VDCF management tool and we offer migration and consulting services.

https://www.jomasoft.ch

The State of Oracle Solaris - Jan 2026

Oracle Solaris is not much in the press anymore, but used
for critical systems around the world.

Solaris 11.4 was launched in 2018. Oracle provides updates/patches
every month. Every quarter (Feb,May,Aug,Nov) the update includes new features.
Oracle will provide this monthly updates till at least November 2037.

Documented in:
http://www.oracle.com/us/support/library/lifetime-support-hardware-301321.pdf

Oracle is working to make sure Solaris will run properly after 2037 for example
with changes in SRU72 delivered in August 2024. It would be no surprise
if the updates will continue after November 2037.
https://blogs.oracle.com/solaris/announcing-oracle-solaris-114-sru72

For developers a pretty current version (CBE) is available
for free to develop and test software.

Solaris CBE Download:
https://www.oracle.com/solaris/solaris11/downloads/solaris-downloads.html

Oracle even provides patches for the older releases Solaris 10
and Solaris 11.3. The last patches are expected by January 2027.
We highly recommend to migrate to Solaris 11.4 and we are
happy to support you with our very experiences engineers.

Oracle's Management and Monitoring tools (OpsCenter and VM Manager for SPARC) 
reached End-Of-Life. No patches are provided anymore. 

We at JomaSoft continue to enhance our VDCF management and monitoring tool 
for Oracle Solaris and Linux
https://www.jomasoft.ch/vdcf/

If you don't have a SPARC server yourself, maybe the JomaSoft
SPARC cloud could be helpful for you.
https://www.jomasoft.ch/services/ 

OVM SPARC Agent End of Life

Extended Support for the OV Manager SPARC Agent ended by June 2024.
No patches are provided by Oracle anymore.

It is expected OVM SPARC Agent will not work anymore in 2025,
after old insecure components will be removed from Solaris.

Details in MOS DOC:
OVM : SPARC Solaris Support in OVM Environment After The End of OVM Extended Support. (Doc ID 3041724.1)

With JomaSoft VDCF we offer a complete and easy to use CLI solution to deploy, operate
and monitor Solaris SPARC LDoms.

WebCasts, Documentation and a Free Trial Version is available on
https://www.jomasoft.ch/vdcf/

Cleanup Oracle Solaris Audit files

Auditing is enabled by default on Solaris 11.4 and records security-related system events,
like logins, reboots, etc.

The audit files are stored in /var/share/audit.
Overtime this files use quiet some disk space

# cd /var/share/audit/
# du -sh
18.3G   .

For later analysis a backup of this files is recommended.
Maybe you have a central archive or security tools for this.

On the Solaris server there is no automatically cleanup
of this files active. This should be done manually from time to time.

For example to delete files older than 3 years.
find /var/share/audit -mtime +1095 -exec rm {} \;

If you are using JomaSoft VDCF you can execute this on all your Solaris 11 Nodes

# su
Password:
# echo "# cleanup audit files older than 3 years" >/var/opt/jomasoft/vdcf/config/script/cleanup_audit
# echo "find /var/share/audit -mtime +1095 -exec rm {} \;" >>/var/opt/jomasoft/vdcf/config/script/cleanup_audit

# exit
-bash-5.2$ config -c add type=SCRIPT name=cleanup_audit script=cleanup_audit os=11
Configuration SCRIPT successfully added.

-bash-5.2$ serverconfig -c exec servertype=node type=SCRIPT name=cleanup_audit
INFO: Servertype <node> selected, the following 'running' server are processed:
....

To learn more about Solaris Auditing take a look into the
Doc "Managing Auditing in Oracle Solaris 11.4"
https://docs.oracle.com/cd/E37838_01/html/E61027/index.html

Checkout what you can do with JomaSoft VDCF
https://www.jomasoft.com/vdcf/

Solaris 11.4 x86 in Oracle Cloud OCI VM

Oracle currently offers the Oracle Cloud in 40 regions.
One of the many options available is a Solaris 11.4 x86 Virtual Machine.
You can create a VM with up to 1TB RAM and 64 OCPUs (cores).

The creation is very easy and the setup is done in a few minutes.

How to create a VM can be found on the Oracle Solaris Blog


The OS management is currently not available to monitor the Solaris instances.
The commercial JomaSoft VDCF tool is an option to be used for monitoring.

I/O performance depends on the configuration of the block volumes and on
the CPU resources used by the Virtual Machine.
But even with 16 cores I never reached more than 100MB/s

How easy is it to import OpsCenter created systems into JomaSoft VDCF ?

Ops Center is Oracle's management and monitoring tool for Oracle Solaris.
Premier Support for the current version 12.4 ends April 2024.

JomaSoft VDCF is a lightweight CLI management and monitoring tool with similar features.
VDCF could be an alternative for customers with focus beyond April 2024.

Find more information about VDCF
https://www.jomasoft.ch/vdcf/

This blog shows how easy it is to integrate systems created using OpsCenter into VDCF.
After the import VDCF can be used to operate, manage, update and monitor this systems.

We will import 3 systems into VDCF. First the SPARC S7 control domain and then two LDoms
where one is running Solaris 10 and the second is running Solaris 11.4. The process is done in a few minutes. It is required to execute 2 commands on each system to install the JomaSoft VDCF Client pkg and add the required ssh key.

Step 1 / Install VDCF pkg and key on each target system

On Solaris 11.4 SRU60 (Aug 2023) and later we need to use 2 commands

# wget http://vdcf/pkg/$(uname -p)/JSvdcf-client.pkg
# yes | pkgadd -d ./JSvdcf-client.pkg all

On older Solaris versions one command works

# yes | pkgadd -d http://vdcf/pkg/$(uname -p)/JSvdcf-client.pkg all

## Downloading...
..............25%..............50%..............75%..............100%
## Download Complete

Processing package instance <JSvdcf-client> from <http://vdcf/pkg/sparc/JSvdcf-client.pkg>

JomaSoft VDCF - Client(sparc) 8.3.5

Copyright (c) 2005-2022 JomaSoft GmbH
All rights reserved.
Use is subject to license terms.

## Executing checkinstall script.

Using </opt/jomasoft/vdcf> as the package base directory.

## Processing package information.

## Processing system information.
## Verifying disk space requirements.
## Checking for conflicts with packages already installed.
## Checking for setuid/setgid programs.

This package contains scripts which will be executed with super-user
permission during the process of installing this package.

Do you want to continue with the installation of <JSvdcf-client> [y,n,?]

Installing JomaSoft VDCF - Client as <JSvdcf-client>

## Installing part 1 of 1.
/opt/jomasoft/vdcf/client/conf/patch_kernel.cfg
/opt/jomasoft/vdcf/client/pkgs/JSvdcf-sync.pkg
/opt/jomasoft/vdcf/client/release
/opt/jomasoft/vdcf/client/rexec/asr_mgr_config
/opt/jomasoft/vdcf/client/rexec/cdom_config

<snip>

/opt/jomasoft/vdcf/client/smf/vdcf_iscsi.xml

/opt/jomasoft/vdcf/client/smf/zfs_encryption_load_key.xml/opt/jomasoft/vdcf/client/smf/zfs_on_nfs.xml

[ verifying class <none> ]

## Executing postinstall script.

*** MANUAL-TASK TODO ***

Add Public Key of root at Management Server to vdcfexec authorized_keys using :

/opt/jomasoft/vdcf/client/sbin/update_key -u <FLASH_WEBSERVER_URL>

Installation of <JSvdcf-client> was successful.

# /opt/jomasoft/vdcf/client/sbin/update_key -u http://vdcf

Obtaining public key ... done.

SSH Key updated successfully.

Step 2 / Import the systems into VDCF

The step to integrate the systems into the VDCF tool is by executing a single simple node import command on the VDCF central management server.

First we have to import the control domain.

-bash-5.1$ time node -c import name=s0012

Importing new Node s0012 ...

Warning: Permanently added 's0012,192.168.100.12' (ED25519) to the list of known hosts.
Discover Systeminfo ...
Discover Rootdiskinfo ...
Discover Diskinfo ...
This may take some time, it depends on the number of disks
.......................
Discover Netinfo ...

Node configuration successfully added.

WARN: No matching build found. Patchlevel 4.48.0.1.126.1 set as build name.
System registration done for s0012.
registering disks from node s0012
New visible Lun 60002AC000000000000004AF0001507B Size: 30.00 GB
New visible Lun 60002AC000000000000004C00001507B Size: 30.00 GB
New visible Lun 60002AC000000000000004C20001507B Size: 30.00 GB
New visible Lun 60002AC000000000000004C80001507B Size: 30.00 GB
New visible Lun 60002AC000000000000004CC0001507B Size: 30.00 GB
Registered BootDisk of Node s0012: 60002AC000000000000004D20001507B Size: 50.00 GB
Registered new Lun: 60002AC000000000000004E00001507B Size: 30.00 GB
Registered new Lun: 60002AC000000000000004E10001507B Size: 30.00 GB
Found Control Domain s0012 (primary).
Found new control domain on 's0012'
importing node datasets from node s0012
Root Dataset s0012_root (ZPOOL: rpool) with Size 49.79 GB successfully imported from Node s0012
Successfully added node filesystem 'ROOT/s11.4.48.0.1.126.1' with mountpoint '/' (ZPOOL: rpool) to dataset 's0012_root'
Successfully added node filesystem 'ROOT/s11.4.48.0.1.126.1/var' with mountpoint '/var' (ZPOOL: rpool) to dataset 's0012_root'
Successfully added node filesystem 'VARSHARE' with mountpoint '/var/share' (ZPOOL: rpool) to dataset 's0012_root'
Successfully added node filesystem 'VARSHARE/tmp' with mountpoint '/var/tmp' (ZPOOL: rpool) to dataset 's0012_root'
Successfully added node filesystem 'VARSHARE/kvol' with mountpoint '/var/share/kvol' (ZPOOL: rpool) to dataset 's0012_root'
Successfully added node filesystem 'VARSHARE/zones' with mountpoint '/system/zones' (ZPOOL: rpool) to dataset 's0012_root'
Successfully added node filesystem 'VARSHARE/cores' with mountpoint '/var/share/cores' (ZPOOL: rpool) to dataset 's0012_root'
Successfully added node filesystem 'VARSHARE/crash' with mountpoint '/var/share/crash' (ZPOOL: rpool) to dataset 's0012_root'
Successfully added node filesystem 'export' with mountpoint '/export' (ZPOOL: rpool) to dataset 's0012_root'
Successfully added node filesystem 'export/home' with mountpoint '/export/home' (ZPOOL: rpool) to dataset 's0012_root'
Successfully added node filesystem 'export/home/admin' with mountpoint '/export/home/admin' (ZPOOL: rpool) to dataset 's0012_root'
Successfully added node filesystem 'guests' with mountpoint '/guests' (ZPOOL: rpool) to dataset 's0012_root'
Successfully added node filesystem 'VARSHARE/sstore' with mountpoint '/var/share/sstore/repo' (ZPOOL: rpool) to dataset 's0012_root'
No vServer found on Node s0012.

WARN: Add console configuration manually using: console -c add node=s0012

Node s0012 import finished

real 1m18.610s

user 0m15.031s
sys 0m56.736s

Now we can import the ldom1 with Solaris 10 and ldom2 with Solaris 11.4

-bash-5.1$ time node -c import name=ldom1

Importing new Node ldom1 ...

Warning: Permanently added 'ldom1,192.168.20.201' (RSA) to the list of known hosts.
Discover Systeminfo ...
psrinfo: Physical processor view not supported
Discover Rootdiskinfo ...
Discover Diskinfo ...
This may take some time, it depends on the number of disks

Discover Netinfo ...
Discovered Node ldom1 as Guest Domain ldom1 on Control Domain s0012

Importing Guest Domain ldom1 ...
Discovering CDom s0012 ...
Found Control Domain s0012 (primary).
using partitioning.cfg as profile for root disk.
GDom ldom1 (Imported GDom) is created.
Commit guest domain to update configuration
AutoBoot for GDom ldom1 set to false
Network 'management' for GDom 'ldom1' defined
Assigned disk 60002AC000000000000004AF0001507B as ROOTDISK to GDom ldom1
committing guest domain <ldom1>
Updating ActiveBuild from '-' to 'imported' for Node ldom1
System registration done for ldom1.
node with all vservers being checked: ldom1
check on node ldom1 successful
patch deployment updated from node ldom1
registering disks from node ldom1
importing node datasets from node ldom1
Root Dataset ldom1_root (ZPOOL: rpool) with Size 29.79 GB successfully imported from Node ldom1
Successfully added node filesystem 'ROOT/_SUNWCAT_S' with mountpoint '/' (ZPOOL: rpool) to dataset 'ldom1_root'
Successfully added node filesystem 'export' with mountpoint '/export' (ZPOOL: rpool) to dataset 'ldom1_root'
Successfully added node filesystem 'export/home' with mountpoint '/export/home' (ZPOOL: rpool) to dataset 'ldom1_root'
No vServer found on Node ldom1.
Node ldom1 import finished

real 1m3.560s

user 0m13.010s
sys 0m37.529s

-bash-5.1$ time node -c import name=ldom2

Importing new Node ldom2 ...

Warning: Permanently added 'ldom2,192.168.20.202' (ED25519) to the list of known hosts.
Discover Systeminfo ...
Discover Rootdiskinfo ...
Discover Diskinfo ...
This may take some time, it depends on the number of disks

Discover Netinfo ...
Discovered Node ldom2 as Guest Domain ldom2 on Control Domain s0012
Importing Guest Domain ldom2 ...
Discovering CDom s0012 ...

Found Control Domain s0012 (primary).
using partitioning.cfg as profile for root disk.
GDom ldom2 (Imported GDom) is created.
Commit guest domain to update configuration
AutoBoot for GDom ldom2 set to false
Network 'management' for GDom 'ldom2' defined
Assigned disk 60002AC000000000000004E00001507B as ROOTDISK to GDom ldom2
committing guest domain <ldom2>
WARN: No matching build found. Patchlevel 4.0.0.1.15.0 set as build name.
Updating ActiveBuild from '-' to '4.0.0.1.15.0' for Node ldom2
System registration done for ldom2.
registering disks from node ldom2
importing node datasets from node ldom2
Root Dataset ldom2_root (ZPOOL: rpool) with Size 29.79 GB successfully imported from Node ldom2
Successfully added node filesystem 'ROOT/solaris' with mountpoint '/' (ZPOOL: rpool) to dataset 'ldom2_root'
Successfully added node filesystem 'ROOT/solaris/var' with mountpoint '/var' (ZPOOL: rpool) to dataset 'ldom2_root'
Successfully added node filesystem 'VARSHARE' with mountpoint '/var/share' (ZPOOL: rpool) to dataset 'ldom2_root'
Successfully added node filesystem 'VARSHARE/tmp' with mountpoint '/var/tmp' (ZPOOL: rpool) to dataset 'ldom2_root'
Successfully added node filesystem 'VARSHARE/kvol' with mountpoint '/var/share/kvol' (ZPOOL: rpool) to dataset 'ldom2_root'
Successfully added node filesystem 'VARSHARE/zones' with mountpoint '/system/zones' (ZPOOL: rpool) to dataset 'ldom2_root'
Successfully added node filesystem 'export' with mountpoint '/export' (ZPOOL: rpool) to dataset 'ldom2_root'
Successfully added node filesystem 'export/home' with mountpoint '/export/home' (ZPOOL: rpool) to dataset 'ldom2_root'
Successfully added node filesystem 'export/home/admin' with mountpoint '/export/home/admin' (ZPOOL: rpool) to dataset 'ldom2_root'
Successfully added node filesystem 'guests' with mountpoint '/guests' (ZPOOL: rpool) to dataset 'ldom2_root'
Successfully added node filesystem 'VARSHARE/sstore' with mountpoint '/var/share/sstore/repo' (ZPOOL: rpool) to dataset 'ldom2_root'No vServer found on Node ldom2.
Node ldom2 import finished

real 1m20.849s
user 0m18.075s

sys 0m51.073s

After this successful import, we can use VDCF's gdom command to manage this two ldoms.

-bash-5.1$ gdom -c show cdom=s0012

Name  cState rState           CDom  Model           OS Patch-Level   
      Cores Max-Cores VCPUs RAM/GB #V Comment

ldom1 ACTIVE ACTIVE (RUNNING) s0012 ORCL,SPARC-S7-2 10 150400-40 (U11+) 0 0 1 4.0 0 Imported GDom

ldom2 ACTIVE ACTIVE (RUNNING) s0012 ORCL,SPARC-S7-2 11 4.0.0.1.15.0 (U4) 0 0 1 4.0 0 Imported GDom

Operation, Migration, Patch/Update and Monitoring using VDCF is as easy as importing with its consistent CLI.

Check out the VDCF demo videos about other powerful features
https://www.youtube.com/user/JomaSoftVideo

Using Ops Center on current Solaris 11.4 SRUs is a fight

Ops Center causes troubles, because it uses old software versions,
which are not available anymore by default on current Solaris 11.4 SRUs.

It requires python 2.7 & perl 5.22

On Control Domains using SRU48 or later you even need to open a Oracle Support Service Request to download a required Agent bugfix.

Here a few MOS Doc Ids with details about the workarounds

Ops Center 12.4: CDOM Agents fail to start after a Solaris upgrade to 11.4 SRU 48 (Doc ID 2892465.1)

Ops Center 12.4 upgrades to Solaris 11.4 SRU 39 on an EC will fail (Doc ID 2826475.1)

Ops Center Will Not Start After Upgrading to Solaris 11.4.3- SRU 30 - Svc:/application/scn/ajaxterm:default is Restarting Too Quickly (Doc ID 2760685.1)

Ops Center: Running With Solaris 11.4 SRU21 or Higher Precautions (Doc ID 2783309.1)

If you are happy with CLI tools, the JomaSoft VDCF framework is an alternative management software.
https://www.jomasoft.ch/vdcf/

Solaris 11.4 SRU42 (Feb 2022) - LDom Migration Class 2

SRU42 introduced a new LDom Migration Class. This class
allows to do Cross CPU Live Migration between SPARC S7,M7 and M8
CPUs. LDoms using this migration-class2 can use the ADI features
of this new CPUs and still can Live Migrate between this modern
SPARC Servers.

To change the cpu-arch setting you need to shutdown and unbind
your LDom

# ldm stop g0061
# ldm unbind g0061
# ldm set-domain cpu-arch=migration-class2 g0061
# ldm bind g0061
# ldm start g0061

The JomaSoft VDCF Management Software recognises this new
cpu-arch with Version 8.2.2 or later.

Find out more about VDCF
https://www.jomasoft.ch/vdcf/

Don't remove Data Disks from Solaris Zpools if performance is important

Solaris 11.4 delivers a new feature to remove data disks from existing zpools.
zpool remove myzpool <disk>

We used this feature a few times without problems on test environments.

But it has performance impact if the removed disk had data on it.
Especially if read performance is important. We know customers with oracle databases
where latency around 1ms is expected. After removing a disk from a
large zpool the performance was terrible and the only solution was to
re-create the zpool.

Important to understand there is an expected performance impact while the disk is removing.
Sure. The data needs to be copied to the remaining disks.
But even after the remove there can be a major performance impact when the data (from the removed disk) must be read, because the data copy added additional internal redirections.

The recommendation is to use this feature only after an accidentally add
of a disk to a wrong zpool. there is no performance impact if the
removed disk has no data.

Find the details of this recommendation in the Solaris 11.4 ZFS Manual:
https://docs.oracle.com/cd/E37838_01/html/E61017/remove-devices.html

 

To avoid such troubles we disabled the dataset -c remdisk feature for data disks
by default in VDCF Version 8.1.8

More about our VDCF Solaris Management product can be found on
https://www.jomasoft.ch/vdcf/

Do you have the overview of your Solaris server patch levels?

To have updated systems is very important for security and stability reasons.

Oracle releases patch updates each quarter for Solaris 10 and Solaris 11.3 till 01/2024.
This patches only fix the most important issues, but not all.
To receive this patches for the older Solaris releases you need Extended Support.

It is highly recommended to update to the current Solaris 11.4 release.
For Solaris 11.4 there is a SRU (Support Repository Update) each month.

Make sure you know which Solaris server are not yet on the recommended level.

With our JomaSoft VDCF management tool for Solaris you have a good realtime overview of the Levels.

Learn more about VDCF
bitly.com/jomasoft

 

Online Events about Oracle Solaris 03/2021

Mar 10, 2021 09:00 - 10:00 CET

Oracle Webinar: Oracle Solaris Update

This webinar will give an update on the Oracle Solaris operating system recent advancements. There is a specific focus on the observability in Solaris and compliance in Solaris. These will help you to improve the performance and secure compliance to regulatory requirements like PCI DSS for example. The webinar consists of a presentation and demonstrations of these features. 

 

 

Mar 16, 2021 19:00 - 20:30 CET

FRAOSUG - Frankfurt Area OpenSolaris User Group: Virtual Datacenter Cloud Framework

German/Deutsch

Das “Virtual Datacenter Cloud Framework” (VDCF ) ist seit 2006 verfügbar, inzwischen in der Version 8.1. Es deckt den ganzen Life Cycle von Solaris Systemen ab und unterstützt die SPARC und x86 Platform. Mittels einer Handvoll intuitiver Befehle können virtuelle Solaris Umgebungen auch von unerfahrenen Solaris Administratoren erstellt und betrieben werden.

Does your system contain the fixes for CVEs or are you vulnerable?

On Solaris 11 the software packages are stored in a IPS repository.
One of the packages is 'solaris-11-cpu'.

If a CVE is fixed Oracle adds the CVE info into this package as metadata.

That's great. You can easly search for a CVE to find out which
package and Solaris Update contains the fix.

Current sample for CVS-2020-14871 "component: Pluggable authentication module"

-bash-5.0$ pkg search :CVE-2020-14871:
INDEX          ACTION VALUE              PACKAGE
CVE-2020-14871 set    pkg://solaris/consolidation/osnet/osnet-incorporation@11.4,5.11-11.4.25.0.1.75.3 pkg:/support/critical-patch-update/solaris-11-cpu@2020.12-1
CVE-2020-14871 set    pkg://solaris/consolidation/osnet/osnet-incorporation@11.4,5.11-11.4.25.0.1.75.3 pkg:/support/critical-patch-update/solaris-11-cpu@2020.9-2
CVE-2020-14871 set    pkg://solaris/consolidation/osnet/osnet-incorporation@11.4,5.11-11.4.25.0.1.75.3 pkg:/support/critical-patch-update/solaris-11-cpu@2020.11-1
CVE-2020-14871 set    pkg://solaris/consolidation/osnet/osnet-incorporation@11.4,5.11-11.4.25.0.1.75.3 pkg:/support/critical-patch-update/solaris-11-cpu@2020.10-2
CVE-2020-14871 set    pkg://solaris/consolidation/osnet/osnet-incorporation@11.4,5.11-11.4.27.0.1.82.2 pkg:/support/critical-patch-update/solaris-11-cpu@2020.12-1
CVE-2020-14871 set    pkg://solaris/consolidation/osnet/osnet-incorporation@11.4,5.11-11.4.27.0.1.82.2 pkg:/support/critical-patch-update/solaris-11-cpu@2020.11-1
CVE-2020-14871 set    pkg://solaris/system/library@0.5.11,5.11-0.175.3.36.0.22.0    pkg:/support/critical-patch-update/solaris-11-cpu@2020.6-2
CVE-2020-14871 set    pkg://solaris/system/library@0.5.11,5.11-0.175.3.36.0.22.0    pkg:/support/critical-patch-update/solaris-11-cpu@2020.12-1
CVE-2020-14871 set    pkg://solaris/system/library@0.5.11,5.11-0.175.3.36.0.22.0   pkg:/support/critical-patch-update/solaris-11-cpu@2020.8-2
CVE-2020-14871 set    pkg://solaris/system/library@0.5.11,5.11-0.175.3.36.0.22.0   pkg:/support/critical-patch-update/solaris-11-cpu@2020.9-2
CVE-2020-14871 set    pkg://solaris/system/library@0.5.11,5.11-0.175.3.36.0.22.0    pkg:/support/critical-patch-update/solaris-11-cpu@2020.11-1
CVE-2020-14871 set    pkg://solaris/system/library@0.5.11,5.11-0.175.3.36.0.22.0   pkg:/support/critical-patch-update/solaris-11-cpu@2020.10-2
CVE-2020-14871 set    pkg://solaris/system/library@0.5.11,5.11-0.175.3.36.0.22.0   pkg:/support/critical-patch-update/solaris-11-cpu@2020.7-2

This means you have the fix installed if you are on
Solaris 11.4  CPU 2020-09 or later which is S11.4 SRU 25

Users of our JomaSoft VDCF tool can list the systems centrally
where the required package is already installed

-bash-5.0$ vpkgadm -c show_server id=solaris/system/library@0.5.11-0.175.3.36.0.22.0

Package: system/library - Core system libraries
PKG-ID : solaris/system/library@0.5.11-0.175.3.36.0.22.0
Version: 0.5.11-0.175.3.36.0.22.0 is installed on:
   Name  Type     PatchLevel                GroupPkg       Comment
  g0062  Node     3.36.0.23.0 (U3.SRU36)    large-server   ZFS Cloning / Shared DS
  v0123  vServer  3.36.0.23.0 (U3.SRU36)    mini-server    ZFS Clones
  v0143  vServer  3.36.0.23.0 (U3.SRU36)    mini-server    Shared dataset

If the fix is not installed, it does not mean you are vulnerable in this special case,
because the bug has no impact on Solaris 11.1 or later.

This is documented here:
https://www.oracle.com/security-alerts/cpuoct2020.html#AppendixSUNS

Anyway ... make sure you are up-to-date ...

Why we are using SPARC LDoms

Oracle and Fujitsu SPARC Servers include the LDoms Technology. There are no additional costs.
If you see the "Marketing" name 'Oracle VM Server for SPARC'. That is exactly this LDoms Technology.

You can create individual Domains with dedicated CPU and RAM resources running
different Solaris Releases. Use of CPU and RAM is very efficient, because there is no software layer involved. You can add and remove CPU and RAM while the LDoms is running!

Access to Disk and Network can be done virtualized. Performance is good. Using such a virtualized setup the Domains can be live migrated between Servers with the same type of CPU. You can cold migrate (with downtime) between different types of Server in a few minutes.

You place different customers and applications in different LDoms. Good aproach to consolidate your environment.

We at JomaSoft use this technology very successful since years ourselfs and at customer sites.
Our VDCF tool makes deployment and management of LDoms very easy.

Learn more:
https://www.oracle.com/virtualization/vm-server-for-sparc/

https://www.oracle.com/technetwork/server-storage/vm/ovmsparc-best-practices-2334546.pdf

https://blog-archive.global.fujitsu.com/easy-flexible-control-of-your-virtualized-datacenter-with-vdcf-2/ 

https://www.jomasoft.ch/vdcf/

Oracle SPARC CPUs compared

Oracle produced several new SPARC CPUs in the recent years.

At JomaSoft we compared the performance using our own VDCF Solaris Management Application.
VDCF is running in a LDom using only 1 core. The VDCF function we used to compare is a typical single thread task. See the results of our tests below. The VDCF function runs around 1.5x faster with each new CPU.

Upgrade from Solaris 11.3 to 11.4 Beta with only 4 commands using JomaSoft VDCF

You need VDCF 7.0.8 or later which supports the Solaris 11.4 Beta release.
Check your current Version using vdcfadm -c show_version

-bash-4.1$ vdcfadm -c show_version
      Package  Version     Arch.   Install-Date        Name
  JSvdcf-base  7.0.8f      i386    Feb 07 2018 11:30   JomaSoft VDCF - Base

If you don't use VDCF so far here the link to the Free Edition download
https://www.jomasoft.ch/downloads/#vdcf-free
VDCF automates lots of Solaris operations and includes best practices to save time and avoid errors.

To install Solaris 11.4 Beta and to upgrade existing systems,
we create an IPS repository. Download the 7 files from
http://www.oracle.com/technetwork/server-storage/solaris11/114beta/114betarepo-4258266.html

Place the files in a temporary directory

-bash-4.1$ ls -l /ips/zipfiles
total 18352831
-rw-r--r--   1 marcel   staff      12262 Feb  7 10:51 install-repo.ksh
-rw-r--r--   1 marcel   staff    2008529484 Feb  7 11:30 sol-11_4-beta-repo_1of5.zip
-rw-r--r--   1 marcel   staff    1702107787 Feb  7 11:23 sol-11_4-beta-repo_2of5.zip
-rw-r--r--   1 marcel   staff    2002857649 Feb  7 11:39 sol-11_4-beta-repo_3of5.zip
-rw-r--r--   1 marcel   staff    1956904984 Feb  7 11:32 sol-11_4-beta-repo_4of5.zip
-rw-r--r--   1 marcel   staff    1719447798 Feb  7 11:41 sol-11_4-beta-repo_5of5.zip
-rw-r--r--   1 marcel   staff        520 Feb  7 10:51 sol-11_4-beta-repo_digest.txt

The first VDCF command creates the new repository including the SMF service.

-bash-4.1$ ipsadm -c create_repo name=s114 dir=/ips/zipfiles zpool=repo114
Port 8282 is assigned to the repository
Using sol-11_4-beta-repo download.
Uncompressing sol-11_4-beta-repo_1of5.zip...done.
Uncompressing sol-11_4-beta-repo_2of5.zip...done.
Uncompressing sol-11_4-beta-repo_3of5.zip...done.
Uncompressing sol-11_4-beta-repo_4of5.zip...done.
Uncompressing sol-11_4-beta-repo_5of5.zip...done.
Repository can be found in /ips/repo/s114.
Repository installed in /ips/repo/s114
refresh smf service application/pkg/server:s114 ...
Repo server application/pkg/server:s114 listening on http://localhost:8282
rebuilding index (pkgrepo rebuild)
enable smf service application/pkg/server:s114 ...
Setup of IPS repository finished:
PUBLISHER PACKAGES STATUS           UPDATED
solaris   6435     online           2018-02-07T11:45:13.891850Z
Repository s114 successfully created

Then we create an AI service to allow us to install new systems with the
second VDCF command

-bash-4.1$ ipsadm -c create_service name=s114beta platform=i386 patchlevel=4.0 repository=http://localhost:8282
Creating Install service s114beta - this may take a moment ...
Service s114beta successfully created


VDCF uses reusable build definitions to reference a specific Solaris SRU, AI service
and IPS repository:

-bash-4.1$ ipsadm -c create_build name=s114betax service=s114beta repository=http://localhost:8282
Repo server http://localhost:8282 with Solaris 11 patchlevel 4.0.0.0.12.1 (U4) selected
Build s114betax successfully created


Now we can upgrade an existing Solaris 11.3 server:

-bash-4.1$ node -c upgrade name=vbox-sol11c build=s114betax reboot
Node Upgrade started for Node vbox-sol11c ...
doing a 'pkg set-publisher -g http://10.1.1.78:8282/ solaris' now ..
 Startup: Refreshing catalog 'solaris' ... Done
 Startup: Caching catalogs ... Done
doing a 'pkg update  -C 5 --accept --be-name s11.4.0.0.0.12.1 --ignore-missing --reject system/input-method/ibus/anthy --reject system/input-method/ibus/pinyin --reject system/input-method/ibus/sunpinyin --reject system/input-method/library/m17n/contrib entire@11.4,5.11-11.4.0.0.0.12.1' now ...
 Startup: Refreshing catalog 'solaris' ... Done
Planning: Solver setup ... Done
Planning: Running solver ... Done
Planning: Finding local manifests ... Done
Planning: Fetching manifests:    0/1416  0% complete

< CUT >

Current BootEnvironment list:
BE               Flags Mountpoint Space  Policy Created
--               ----- ---------- -----  ------ -------
s11.3.26.0.5.0   N     /          6.69M  static 2018-02-07 15:37
s11.4.0.0.0.12.1 R     -          29.91G static 2018-02-07 17:39
Node vbox-sol11c updated to Solaris 11 entire@11.4,5.11-11.4.0.0.0.12.1. Node is rebooting now.

SPARC/Solaris Events in February / March 2017

16.02.2017  Oracle SPARC Day, Moscow/Russia

23.02.2017  JomaSoft Webinar: Efficient Virtualization of Oracle Solaris with VDCF, Live/Online

09.03.2017  Oracle SPARC Solaris Tech Day, Munich/Germany