Oracle Solaris 11.4 SRU 95 is now available via “pkg update” from the support repository or by downloading the SRU from My Oracle Support Doc ID KB631614. Highlights of the changes in this release are given in the release announcement and important information to read before installing it is provided in the Readme linked from the above support document. This blog post provides more details about selected new features and interface changes in this SRU, as well as some preparation work for changes coming in future SRUs.

Security and Compliance Features

TLS certificate chain handling support in Solaris sendmail

Starting in SRU 95, the Solaris package for sendmail is compiled with the optional _FFR_TLS_USE_CERTIFICATE_CHAIN_FILE flag, allowing the use of a certificate chain in a single file, making for easier configuration when used with intermediate certificate authorities.

Data Management Features

nvmeadm updates

nvmeadm(8) is the Solaris command-line utility for administering NVM Express controllers and namespaces. It was moved to a new package, system/storage/nvme-administration, in SRU 95 and a number of changes were made to it.

  • Previously, nvmeadm could only be used on a limited set of platforms. Starting in SRU 95, it can be used anywhere the nvme(4D) driver attaches, for example on OCI DenseIO shapes and many 3rd-party systems.
  • Individual namespaces can now be formatted with ‘nvmeadm format’, the -a option is no longer required.
  • The “Relative Performance” field has been added to the output of ‘nvmeadm format -l’.
  • The output of ‘nvmeadm namespace -v’ and ‘nvmeadm getlog -h’ has been made more user-friendly.
  • A new help subcommand is introduced to display overall help or help for individual subcommands.
  • The -s and --secure options used with the erase subcommand has been obsoleted. They have been documented as performing a “secure” erase. However, because the erase subcommand has always performed an NVMe secure erase operation regardless of these options, they have never had any real effect. They will therefore no longer be documented, but will continue to be accepted and ignored for backwards compatibility.

Removal of NTLM authentication for SMB server

In prior releases, the Solaris SMB server accepted both NTLM and NTLMv2 authentication mechanisms for local user authentication. When clients initiated NTLM authentication, the SMB server was required to use the DES encryption algorithm. Many security policies, including FIPS 140-3, however no longer allow use of the DES algorithm. The support for NTLM authentication of local users was removed in SRU 95 and only NTLMv2 is supported now. This is equivalent to the level 5 setting for the server_lmauth_level SMF property, which has been the default value since Solaris 11.4.0 shipped in 2018, so only sites which changed that value should be affected.

zpool monitor provider defaults and multi-provider selection

Previously, ‘zpool monitor’ required specifying -t provider and only allowed one provider. Starting in SRU 95, omitting -t defaults to ‘all’, invoking all providers in parallel and showing all information. In addition, -t provider[,provider...] now allows selction of multiple providers.

Performance and Observability

fmdump and fmadm enhancements

SRU 95 includes improvements to fmdump(8), the Solaris Fault Manager log display tool, in ways that are visible to administrators, support engineers, and scripts that intentionally request the new behavior. The main areas were:

  • The new -S (uppercase S) option displays timestamps in RFC-3339/ISO-8601 output formats suitable for comparison, sorting, and reuse as fmdump -t/-T timestamp time filter input. This new feature provides explicit timezone information so users can correlate fmdump records with other tools.
  • The new -s (lowercase s) option extends the default timestamp format to include nine-digit subsecond timestamp output. The default output format is unchanged unless -s is specified.
  • The new -Z option enables UTC/Zulu/GMT timestamp output instead of local timezone output. The default local timezone behavior is unchanged unless -Z is specified.
  • The existing -t and -T options now support broader timestamp parsing for -t and -T filters, including RFC-3339/ISO-8601 style timestamps, missing seconds in supported legacy forms, signed relative times, and fractional seconds finer than microseconds.
  • When both -t and -T are used, improved validation alerts the user if they’ve selected an empty or zero-width time range.
  • Support has been added for multiple file operands, with explicit compatibility semantics: without -A, files are dumped one at a time in operand order; with -A, selected files are aggregated and merged by timestamp.
  • A warning is now generated when selected log sets have compressed rotated logs named logname.N.gz that fmdump cannot read while compressed.

Backward compatibility was a primary design point. Existing default fmdump output formatting did not change. New timestamp output forms are produced only when new flags are specified, and existing filters continue to accept their previous input forms.

Similar -S and -Z options for timestamp formats were also added to fmadm(8). See the man page for details.

gzip optimization for SPARC CPUs with VIS3 instructions

gzip 1.14 introduced optimizations for calculating CRC checksums, including specific optimizations for x64 processors using the PCLMUL instruction, which sped up decompression by up to 40% over previous versions. In SRU 95, a similar optimization has been added to our SPARC gzip package using the XMULX instruction available as part of the VIS3 extensions in Oracle SPARC T4 and later CPUs, which improved performance over the 1.14 baseline by 9-10% in our testing.

psrinfo(8) -P option for parsable output

This SRU documents as an officially supported public interface the -P option that has been in the psrinfo(8) command since Solaris 11.2 for producing parsable output.

The -P option requires -t. The output consists of one line per core in the format:

socket:core:cpu-list

If -L is included, the output includes lgroup membership information:

lgrp-list:socket:core:cpu-list

The ‘socket’ and ‘core’ elements are single numbers, and the ‘lgrp-list’ and ‘cpu-list’ elements are space separated ID lists.

Example:

$ psrinfo -tPL
1 0:0:0:0 1 2 3 4 5
1 0:0:1:6 7 8 9 10 11

sar & timex moved to new package

The SVR4 System Activity Reporter commands, including sar, timex, and their associated cron jobs, have been moved from the system/accounting/legacy-accounting package to a new package named system/accounting/sar. An IPS dependency of type “group” has been left in the legacy-accounting package for now so that when it is upgraded or installed, the sar package will be installed by default, but admins can choose to remove the sar package if they do not need it.

When the sar package is installed, a release note will be displayed warning that the data files used by the utilities in this package cannot handle a timestamp beyond 03:14:07 UTC, January 19, 2038, and as such, these utilities will cease to function correctly at that time, and thus we plan to remove this package in a future Solaris 11.4 SRU. Customers are advised to migrate to the Solaris 11.4 StatsStore instead before that happens.

Virtualization Features

Improved support for SPARC migration-class2

Starting with Oracle Solaris 11.4.95, a new kernel CPU module is included for SPARC systems using LDOMs or kernel zones configured with the migration class “migration-class2”. The new CPU module includes better support for ADI as well as better optimized low level kernel routines.

In order for logical domains to use this new kernel module, the control domain needs to be upgraded to Oracle Solaris 11.4.95 or later. Additionally, each logical ldom using migration-class2 needs to be re-bound.

In order for kernel zones to use this new kernel module, the global zone which hosts the kernel zones needs to be upgraded to Oracle Solaris 11.4.95 or later.

Note that for kernel zones live migration and suspend/resume work from earlier releases to Oracle Solaris 11.4.95 and later but not vice versa.

System Management Features

pbind(8) enhancements

pbind(8) controls CPU bindings of processes or LWPs. It binds to processors, processors groups, and locality groups but not to psets nor pools. For the latter, see resource-management(7).

pbind supports binding and querying processes that belong to users and groups based on their numeric UIDs and GIDs using the ‘-i idtype’ option with an idtype of “uid” or “gid”, respectively. For example:

root# pbind -b 0 -i uid 25    # smmsp user
pbind(8): LWP 1085/1  strongly bound to processor(s) 0.
root# pbind -q -i uid 25
pbind(8): LWP 1085/1  strongly bound to processor(s) 0.

However, the command was missing support for user and group names on top of numeric ID support, similar to the already existing support for zone and project names. Starting in SRU 95, usernames and group names are also supported.

The return values provided by pbind when the command exits were also made more consistent and better documented in the pbind(8) man page.

Enhancements for Developers

int8_t definition updated for C99 and newer C standards

In order to comply with the C99 and newer C standards, the definition of the int8_t, int_fast8_t, and int_least8_t types defined by <sys/int_types.h> have changed. The corrected definitions are:

     typedef signed char int8_t;
     typedef signed char int_fast8_t
     typedef signed char int_least8_t;

These definitions replace the original, which were previously:

     typedef char int8_t;
     typedef char int_fast8_t
     typedef char int_least8_t;

On Oracle Solaris, char is a signed type, meaning that char and signed char are equivalent types at a binary ABI (machine) level. As such, this change has no impact on the ability to run previously built objects, including those built on older releases of Solaris, on newer systems. Backward compatibility is therefore preserved.

There is a small chance that issues may be encountered when rebuilding code. Most code is expected to build normally, and without issue, when moved to a newer Oracle Solaris system with this change. However, in the case where errors are encountered, the _LEGACY_INT8_T macro can be defined at compile time to restore the original definitions, and allow such code to be built without making other changes: C:% cc -D_LEGACY_INT8_T ... C++:% CC -D_LEGACY_INT8_T ...

This can often be done by adding a single -D_LEGACY_INT8_T to the common compiler flags in a central Makefile, and then rebuilding everything from scratch.

In many cases, the errors reveal programming practices that could be easily improved. Doing so avoids the need to set -D_LEGACY_INT8_T, and will improve the portability of that code. The following cases may be encountered:

  1. [C or C++] Compile time errors or warnings about mixing char and int8_t data may be encountered. A common example is that of code that passes an (int8_t *) argument to to a function declared as expecting (char *). The basic string functions such as strcpy() are common examples where this has been seen. While char and signed char are the same type on Solaris, this is not a portable assumption. Portable code should declare data intended to hold text as char, and not as int8_t.
  2. [C++] Link time errors for unsatisfied symbols may be seen. C++ encodes function return and argument types in the symbol name for each function, a process commonly referred to as “name mangling”. In C++, char and signed char are different types, and result in different mangled symbol names. Rebuilding only part of an application, rather than doing a complete build from scratch, can create a situation in which the old and new mangled names are both present. This will prevent the application from linking cleanly, typically with “unsatisfied external symbol” errors. All related C++ code should be rebuilt completely from scratch. This includes all programs (executables), and all libraries (archives, or shared objects) that those programs rely on. This should ensure that all objects use the same mangled names, and allow linking to complete cleanly.

Note that while we have made this change in the system headers in Solaris 11.4.95 and later, the gcc compiler has also made the same change in the headers used by gcc 16 and later releases, regardless of which version of Solaris it is running on.

GCC 16 added

Version 16 of the GNU Compiler Collection has been added, including compilers for C, C++, D, Ada, Fortran, Go, and Objective C. See GCC 16 Release Series: Changes, New Features, and Fixes for more information on the changes in this generation of the GNU family of compilers, and Porting to GCC 16 for information on changes you may need to make to code and/or compiler flags in order to build it with GCC 16.

This is the first version of the GNU Compiler Collection packages for Solaris in which we have included gdc, the GNU compiler for the D language. It is provided in a separate, optional package. To use it, pkg install developer/gcc/d.

CTF extended to use the .SUNW_ldynsym symbol table

The CTF (Compact C Type Format) data in Solaris ELF objects is usually associated with the .symtab symbol table. Optionally, one can choose to associate it with the .dynsym dynamic symbol table. Normally, the .symtab is preferred, as it contains a superset of the .dynsym‘s contents, but one advantage of using the .dynsym is that one can later strip the object without also losing the CTF.

All dynamic executables and shared objects built on Solaris since 2006 have an additional dynamic symbol table named .SUNW_ldynsym, that provides local function symbols. The idea behind .SUNW_ldynsym is that it can be logically concatenated with the .dynsym to provide more symbols than the .dynsym provides alone. Previously, Solaris CTF did not support the .SUNW_ldynsym. Starting in SRU 95, when ‘dynsym’ is given in the ld -zctf flags or the -s flag is used with ctfconvert or ctfmerge, CTF will look for both the .SUNW_ldynsym and .dynsym, and if both are present, they will be used together as a single logical table. See the manual pages for ctfconvert(1), ctfmerge(1), ld(1), and ctf(5) for more details.

ld -zrelax=relocfit

The SPARC version of the ELF relocation engine, used by the link-editor (ld), runtime linker (ld.so.1), and kernel runtime linker (krtld) did not properly validate a number of relocations. Unfortunately, there is existing code which contains these invalid relocations, so starting in SRU 95, these generate warnings, which do not stop linking unless the -zfatal-warnings option is also used. SRU 95 also added a -zrelax=relocfit option to ld to suppress these relocation overflow warnings. While the objects may be linked, the relocations are still invalid and unsupported, and should be fixed in the underlying code.

Other Changes

Time Zone data updated to 2026c

The system time zone database has been updated to the 2026c release from the IANA Time Zone Database project in SRU 95. Most notably, this will cause the America/Edmonton time zone to stay on UTC-6 year round, and not change the time in November 2026 when Daylight Savings Time would previously have ended in Alberta, Canada. This builds upon the changes for British Columbia in 2026b, which was included in SRU 93. It does not yet cover the necessary changes for Canada’s Northwest Territories or Manitoba, which will be coming in a later SRU as we bring in later time zone updates as they become available from IANA.

Before Upgrading to SRU 95

Ensure no smbfs mounts are in use

Prior releases included an SMB client that allowed access to remote SMB file shares by mounting smbfs file systems. This client only supported version 1 of the SMB protocol, which is outdated and insecure, was deprecated by Microsoft in 2013, and is no longer installed in modern versions of Microsoft Windows. This was provided via the system/file-system/smb package, which has been marked obsolete and will be removed on upgrade to SRU 95.

Before upgrading to SRU 95, ensure you are not mounting any smbfs file systems via vfstab, the automounter, or other means.

Migration from older libpng versions to libpng 1.6

Previous SRUs provided packages for versions 1.0, 1.2, 1.4, and 1.6 of the Portable Network Graphics (PNG) library, libpng. Upstream ended support for versions 1.5 and earlier in 2017 and recommends all users port to version 1.6. In SRU 93, the packages for versions 1.0 and 1.2 were obsoleted and removed on upgrade. SRU 95 does the same for version 1.4. All locally built applications and ISV applications that use the system provided image/library/libpng14 package need to migrate to image/library/libpng16 before upgrading to SRU 95.

Migration from MySQL 8.0 to 8.4

SRU 78 added packages for version 8.4 of the MySQL database alongside the existing packages for version 8.0. Upstream support for MySQL 8.0 ended in April 2026 and it has been marked obsolete and will be removed upon upgrade to SRU 95. Administrators of MySQL 8.0 databases should follow the instructions in MySQL 8.4 Reference Manual: Upgrading MySQL to migrate their databases to version 8.4 before upgrading to an SRU in which 8.0 has been removed.

Preparation for Upcoming SRUs

The following are a subset of the removals planned for future SRUs. See End of Feature Notices for Oracle Solaris 11 for the complete list of removals announced so far.

Migration from gcc 13 to a later version

SRU 95 provides packages for versions 13, 14, 15, and 16 of the GNU Compiler Collection. GCC 13 will be removed in a future SRU. Users of the gccgo compiler need to note that the removal of GCC 13 will also include the removal of the libgo.so.22 library used by Go programs compiled with GCC 13, and that they thus will need to recompile any such programs with a newer version of gccgo before upgrading to the SRU that removes it.

Migration from PHP 8.2 to a later version

SRU 95 provides packages for PHP versions 8.2, 8.3, 8.4, and 8.5. PHP 8.2 will be removed in a future SRU, since the PHP community is ending support for 8.2 at the end of December 2026.

All locally built applications and ISV applications that use the system provided PHP 8.2 need to migrate to a later PHP version before updating to an SRU that removes PHP 8.2. The PHP Group has supplied information on Migrating from PHP 8.2.x to PHP 8.3.x, Migrating from PHP 8.3.x to PHP 8.4.x, and Migrating from PHP 8.4.x to PHP 8.5.x, to help with this.