IBM announces PowerVM v4.1.1.0 and AIX 7.3.3

IBM Champion Jaqui Lynch highlights the latest IBM announcements of PowerVM 4.1.1.0 and AIX 7.3.3

Jaqui Lynch January 23, 2025

On December 12, 2024, IBM released AIX v7.3.3 and PowerVM 4.1.1.0 updates. So far, I have had the opportunity to install a fresh VIO environment at 4.1.1.0, upgrade from 4.1.0.21 and to upgrade multiple LPARs from 7.3.2 to 7.3.3. In this article, I will look at some of the new features in these two releases and point out some of the things I experienced when updating.

AIX 7.3.3

AIX 7.3.3 includes many updates to current commands as well as updates to documentation and man pages. The “What’s new in Commands” web page provides details on the commands that were updated or added. Some of these include:

grep and ugrep

The grep command has two new flags (-U and -I) to assist with Unicode pattern searches. ugrep is a new command that also helps with Unicode pattern searches.

nimadm

New flags (-f and -n) were added to allow for parallel multi-client alternate disj migrations and multi-client mksysb to client migrations. nimadm can also be used to create a JSON file with client LPAR data.

installp

Documentation was updated for the -G flag that validates signatures for software and updates.

emgr

emgr was updated to support read-only access for nor-root users to list applied fixes. This requires the use of AIX RBAC controls.

There were a number of additional updates that are not listed above, so I highly recommend looking at the 7.3.3 web pages (see references below). A number of updates also came out in November 2023 that are listed further down that page. These include updates to vfcstat, restvg, emgr, nimadm, find, schedo, fcstat, vmo, ioo, raso, schedo, asoo, rmlv, reducevg, mount and lsmpio.

Additionally, AIX 7.3 and then 7.3.1 made some changes to filesystem and file size limitations. At AIX 7.3 the maximum supported capacity for JFS2 files and file systems was increased to 128TB. At 7.3.1 the network file system (NFS) client was changed to support file sizes up to 256TB. There were also changes to mkvg, mklv and crfs to change some of the defaults when volume groups, logival volumes and file systems are created.

AIX 7.3.3 introduces the virtual ethernet multi queue feature, which helps drive more network traffic though the virtual ethernet adapters. There are 12 transmit queues and zero receive queues by default. Receive queues can be increased using the queues_rx tunable, but be aware this requires more CPU resources.

AIX 7.3.3 also introduces dynamic page management that, by default, promotes 64KB applications text pages to 16MB pagees when warranted. There are also enhancements to dynamic socket buffer sizing for transmission control protocol (TCP) connections, updates to virtual process management (VPM) throughput mode for Power10 and enhancements to live kernel update (LKU).

There were several updates to lparstat. One was to check for update access key (UAK) expirations. On the Power10 server it shows:

#lparstat -u
FW Update Access Key Expiration  (YYYYMMDD):  20260714
AIX Update Access Key Expiration (YYYYMMDD):  20260714
AIX Image Date                   (YYYYMMDD):  20240607

On the Power9 it shows:

#lparstat -u
FW Update Access Key Expiration  (YYYYMMDD):  20250331
AIX Update Access Key Expiration (YYYYMMDD):  -
AIX Image Date                   (YYYYMMDD):  -

lparstat is a very useful command and it is one every administrator should keep in their toolbox. A couple of other useful flags include the -L, -m and -e flags. The -L flag allows you to display whether LPM is enabled or not.

#lparstat -L
AIX Live Partition Mobility               : Enabled

The -m and -e flags display information about I/O memory entitlement pools, the meaning of which is documented in the lparstat man page.

#lparstat -m -e
System configuration: lcpu=8 mem=204800MB mpsz=0.00GB iome=204800.00MB iomp=8

physb   hpi  hpit  pmem    iomin   iomu   iomf  iohwm iomaf
0.01     0   0     200.00  59.0    -      -      -    0
iompn: 		iomin  	iodes   iomu  iores  iohwm  iomaf
ent0.txpool  	0.80    	0.80    0.75  0.80   0.75      0
ent0.rxpool_4  4.00  	32.00   3.50  4.00   3.50      0
ent0.rxpool_3  4.00      32.00   2.00  32.00  2.51      0
ent0.rxpool_0 	17.00  	51.00  16.00  17.00 16.00    0
ent0.phypmem  	0.20     	 0.20   0.19   0.20  0.19    0
vscsi1 		16.50 	16.50   0.13  16.50  0.13    0
vscsi0 		16.50 	16.50   0.13  16.50  0.13    0
sys0 		 0.00      0.00   0.00   0.00  0.00    0

After the update oslevel should show AIX 7.3.3.

oslevel -s
7300-03-00-2446

I recommend regularly checking the “Release Notes” and the “What’s new in Commands” to see what has been added at each level. You should also read the release notes prior to the updates to make sure you are at the right firmware and hardware management console (HMC), etc., levels prior to the updates.

PowerVM 4.1.1.0

PowerVM 4.1.1.0 no longer includes IBM Tivoli Monitoring (ITM) agents, Java7, sysmgt.cim and X11. Additionally, active memory sharing (AMS) is no longer supported. It is important to read the release notes as they indicate some potential error messages during the update. The release notes also list the adapters that may need microcode updates before the 4.1.1.0 upgrade can take place. There are a number of new features in VIO 4.1.1.0, including significant improvements to shared ethernet adapter (SEA) performance, shared storage pools and live partition mobility (LPM) validation for N_Port ID virtualization (NPIV) storage.

The updates include the ability to use NFS for virtual optical media. This involves the use of the -nfslink option on the mkvopt which creates a symbolic link to an NFS-mounted ISO file. Significant updates have been made to backupios, updateios and viosupgrade—all three of these can now be run in the background. The new options are -bg and -q.

The vfchost adapter has been updated to allow two new attributes—num_local_cmds and bufs_per_cmd. These attributes enhance the buffer requirements of the vfchost devices at the adapter level, which should help with errors that can occur with large I/O workloads and serial I/O.

Updating to or Installing PowerVM 4.1.1.0

For the fresh installation I was doing, I had to use the HMC for the install, as there was no network installation manager (NIM) server available. It would be nice if IBM would make the images on entitled systems support (ESS) available via sftp so that they could be loaded directly to the HMC instead of having to download to the desktop and then upload to the HMC. Additionally, the install from the HMC would not work over an aggregate, so I had to get the network team to change the ports back to access ports, then aggregate them after the install was complete.

There are some updated commands that may be of interest in the new version:

The first command lists the languages installed. On the system that I updated it showed:

$updateios -listlang
Below listed message language filesets are installed:
ca_ES: Spanish(Catalan)
cs_CZ: Czech
de_DE: German
en_US: English
es_ES: Spanish
fr_FR: French
hu_HU: Hungarian
it_IT: Italian
ja_JP: Japanese
ko_KR: Korean
pl_PL: Polish(Poland)
pt_BR: Portuguese, Brazilian
ru_RU: Russian
sk_SK: Slovak
zh_CN: Chinese, Simplified
zh_TW: Chinese, Traditional

You can then run the following command to remove all languages except the one you want to keep. In my case, I wanted to keep US English.

updateios -rmlang -preserve en_US

Over time, you can end up with outdated filesets on the VIO. You can now remove those outdated packages using updateios.

updateios -remove_outdated_filesets

When doing the updates you can use updateios if updating from v4.1, but you have to use viosupgrade if updating from v3.1. When updating to VIOS 4.1.1.0, it will update ios.database.rte fileset. This may show the error below, which IBM says can be ignored:

3001-408 The user “vpgadmin” has an invalid lastupdate attribute.

Gotchas

After the PowerVM 4.1.1.0 fresh install, I noted that the PowerVM install still creates two-page spaces (hd6 and paging00) on the same logical unit number (LUN). They were 1GB in size. As usual, I removed paging00 and increased hd6 to 8GB.

The fresh install was done from the ISO image on the HMC, and the update from 4.1.0.21 to 4.1.1.0 was done using updateios. I copied the contents of the flash ISO to the powervm4110-base directory, then updated from there. There were 611 filesets in the update done using updateios.

updateios -commit
updateios -accept -install -dev /usr/local/soft/powervm41/powervm4110-base

PowerVM 4.1.1.0 updates many of the packages, such as secure shell (SSH), secure sockets layer (SSL) and Java. However, they still need further updating to patch some security holes.

Below are the releases installed with 4.1.1.0:

OpenSSH 9.7.3013.1000

OpenSSL 3.0.13.1000

Java 8.0.0.825

Python 3.9.19.2

TCL 8.6.10.0

Java needs to be updated to 8.0.0.835, Python to 3.9.20.0 and TCL to 8.6.10.1.

Additionally, there are currently two security patches to apply:

curl_fix6 and openssl_fix43.

These patches can all be installed using updateios. I did so as follows:

updateios -commit
updateios -accept -install -dev /usr/local/soft/patches/sshssljava-dec222024
updateios -accept -install -dev /usr/local/soft/patches/openssl_fix43
updateios -accept -install -dev /usr/local/soft/patches/curl_fix6
updateios -accept -install -dev /usr/local/soft/patches/python-3.9.20.0
updateios -accept -install -dev /usr/local/soft/patches/tcl_fix

All of the updates and patches went on with no issues, and the new levels were as follows. These are the same patches I put on my AIX 7.3.3 systems after I updated them:

OpenSSH 9.7.3013.1000

OpenSSL 3.0.13.1000

Java 8.0.0.835

Python 3.9.20.0

TCL 8.6.10.1

emgr -P showed that the following two patches were also installed:

PACKAGE         	INSTALLER   		LABEL
openssl.base     	installp    		3013ma
oss.lib.libcurl     installp    		2466ma

For the system that I updated from 4.1.0.21, I ran into one issue. Everything went smoothly until I ran bosboot at the end, which I always do prior to the reboot. When I ran bosboot I got the following:

bosboot -a -d hdisk1
trustchk: Verification of attributes failed: /usr/sbin/bootinfo
: accessauths
bosboot: Boot image is 69681 512 byte blocks.

It turns out the resolution for this is to run trustchk twice as the first one may fail.

# trustchk -y /usr/sbin/bootinfo
trustchk: Verification of attributes failed: accessauths
trustchk: Verification of stanza failed:
# trustchk -y /usr/sbin/bootinfo

After running trustchk twice and getting a clean return the second time, bosboot ran fine and there were no further issues.

When the install or update are complete I always check the levels.

$ioslevel
4.1.1.00

# oslevel -s
7300-03-00-2446
# instfix -i | grep ML
    All filesets for 7.3.0.0_AIX_ML were found.
    All filesets for 7300-00_AIX_ML were found.
    All filesets for 7300-01_AIX_ML were found.
    All filesets for 7300-02_AIX_ML were found.
    All filesets for 7300-03_AIX_ML were found.