Differences between PSU , CPU and SPU in Oracle 11g

Differences between PSU , CPU and SPU in Oracle 11g.


Critical Patch Update (CPU) Release of security fixes each quarter instead the cumulative database security patch for the quarter. 

Patch Set Updates (PSU)  Cumulative patches that include both the security fixes and priority fixes.  They are "version upgrades" modifying the las number of version (11.2.0.1.1, 11.2.0.1.2,...).

Security Patch Update (SPU)  It is the new terminology of CPU (From October 2012) . SPU's can't be applied if any PSU's have been applied, unless your database is upgraded with a new base version.

Here is brief  summary of what is the difference between patch set , PSU and CPU. I will start with a image, might not be 100% accurate but will help a long way in understanding the differences.

Patch sets and PSU

PSU’s(Patch set updates) are patch sets but with some major differences with respect to regular patch sets.

PSUs are generally low risk and do not contain fixes to bugs that require configuration changes or impact database components like optimizer. To achieve this low risk behavior, Each PSU is limited from 25 to 100 new bug fixes. PSU’s are also well tested by Oracle compared to one off patches.

PSUs are referenced by their 5th place in the Oracle version numbers which makes it easier to track ( (e.g. 10.2.0.3.1) and will not change the version of oracle binaries (like sqlplus, exp/imp etc.) As of now (10.2, 11,2) , the best way to  determine the PSU version installed  is to use opatch utility using the command below

opatch lsinv -bugs_fixed | grep -i  PSU

From the database , you can execute the following query(Assuming that catbundle.sql  was executed when PSU was installed). The last 2 columns will provide information about the PSU.

select substr(action_time,1,30) action_time, substr(id,1,10) id, substr(action,1,10) action,substr(version,1,8) version, 
substr(BUNDLE_SERIES,1,6) bundle, substr(comments,1,20) comments from registry$history;

In summary PSU’s  contain fix for bugs that cause

• Instance crash
• Wrong results
• Data Corruption

PSU’s  do not contain fix for bugs  that may result in

• Dictionary changes
• Major Algorithm changes
• Architectural changes
• Optimizer plan changes

Regular patch sets on other hand include major bug fixes and most of the time requires re-certification.The importance of PSU is diminished once a regular patch set is released for a given version as they tend to be more security related fixes as CPU is part of PSU

PSU and CPU

PSUs  contain CPU’s and are released every quarter (like CPU’s) ; In other words  Critical Patch Update (CPU) is a subset of the Patch Set Update (PSU). CPU’s are built on the base Patch Set version (e.g. 10.2.0.3) whereas PSU are built on the base of the previous PSU (e.g. 10.2.0.3.1)

A PSU can always be applied over any CPU where as applying a CPU over a PSU will roll back the PSU (at least for now). Therefore it is easy to go from CPUs to PSUs and hard to go back to CPUs  from PSUs.