DR Operations may Hang the Domain on E10K and Sun Fire Servers if Domains are "hardened" with Security Tools

---

Impact

Hardening a domain with security tools or manually securing domains on E10K and Sun Fire systems can cause a domain to hang upon use of Dynamic Reconfiguration (DR) operations.

Contributing Factors

This issue can occur on the following affected platforms:

SPARC

For Solaris 8:

• Enterprise 10000 (E10K) Server without patch 108528-17 or 111790-13
• Sun Fire Servers (3800/4800/4810/6800) without patch 108528-17
• Sun Fire 12K/15K Servers without patch 111335-14

For Solaris 9:

• Enterprise 10000 (E10K) Server without patch 113538-01
• Sun Fire Servers (3800/4800/4810/6800) without patch 113489-01
• Sun Fire 12K/15K Servers without patch 112841-04

Note: The described issue only occurs as a result of a DR operation involving the removal of a system board containing permanent memory (non-pageable OBP or kernel memory) and where its domain has been hardened or secured. The most common occurrence has been observed in conjunction with:

• Solaris Security Toolkit, also known as JumpStart Architecture and Security Scripts (JASS) prior to version 0.3.7

Please see http://wwws.sun.com/software/security/jass/ for more information on this product.

JASS version 0.3.7 or later implements a startup script which checks to see if the klmmod (lock manager) kernel module is loaded and if it isn't then it is loaded.

Symptoms

The affected domain will hang when the DR operation is performed.

Workaround

To workaround the described issue, the following line may be added to the /etc/system file:

	forceload: misc/klmmod

A reboot is necessary for the modification to take effect. This workaround will work for JASS and non-JASS configurations.

For JASS environments, this issue can also be addressed by upgrading to JASS version 0.3.7 or later.

Resolution

This issue is addressed in the following releases:

SPARC

For Solaris 8:

• Enterprise 10000 (E10K) Server with patch 108528-17 or later or 111790-13 or later
• Sun Fire Servers (3800/4800/4810/6800) with patch 108528-17 or later
• Sun Fire 12K/15K Servers with patch 111335-14 or later

For Solaris 9:

• Enterprise 10000 (E10K) Server with patch 113538-01 or later
• Sun Fire Servers (3800/4800/4810/6800) with patch 113489-01 or later
• Sun Fire 12K/15K Servers with patch 112841-04 or later

Note: Please read the Patch README file for more information regarding platform and configuration specifics.

Modification History


Date: 24-JAN-2003

• State Resolved (and Closed)
• Updated Contributing Factors and Resolution sections

Attachments

This solution has no attachment