Oracle SPARC T7 and M7 Servers - A New Platform for Secure Computing
The SPARC technology has been owned by Oracle for five years. During this time, Oracle has released the SPARC T3, SPARC T4, SPARC T5, SPARC M5, and SPARC M6 microprocessors (Figure 1), each of which was an important step in the evolution of technology — moreover, SPARC T3 and T4 were also developed by Sun Microsystems, and subsequent processors inherited much from them.
As for the SPARC M7, this is the first processor that was fully developed, starting with ideology and basic design, for Oracle and Oracle. The main goal of the development project was to ensure maximum efficiency of the Oracle software - and as a result, the industry's first 32-core processor was created with unprecedented load capacity, core performance, fast encryption capabilities and hardware decompression.
')
If you compare the parameters of the SPARC M7 microprocessor with the parameters of the most advanced SPARC T5 processor released earlier, you will find that many of the parameters have doubled and some of them have increased four (Table 1). The SPARC M7 processor has 32 general-purpose cores, i.e., twice as large as the T5 processor. Also, the SPARC M7 processor has twice as many computation threads and four times more cache per core, and the new architecture has significantly improved the performance of each core. New memory controllers made it possible to increase memory bandwidth and memory access speed, while I / O bandwidth increased fourfold. The processor clock speed has also increased. In general, the SPARC M7 processor is about three times faster than the SPARC T5 processor.
Table 1
But the historic revolutionary step made by Oracle with the new processor is the implementation of software functions directly on the chip. This is on-chip security, i.e., encryption acceleration and hardware memory protection, and, more importantly, SQL-on-chip, i.e. the world's first hardware implementation of accelerating SQL query processing and decompression for Oracle Database In-Memory.
It would seem, and so it is clear why security is so important, but we will explain something. According to the CSO Online Market Pulse report, the number of stolen data lines in the world for 2014 amounted to hundreds of millions, and the losses incurred by the business are measured in millions and millions of dollars. But, unfortunately, in the corporate security system, database protection is actually the weakest point. More than 50% of companies believe that the most important and most valuable data is stored in their databases, but most companies invest primarily in network protection, and they prefer to spend as little money on database protection as possible. As a result, 76% of all successful attacks on corporate data were not stopped by network security tools.
There are three main types of security threats:
Oracle DBMS technologies address database vulnerability problems with built-in encryption features. In turn, the operating system Oracle Solaris has a number of functions that allow you to minimize the possibility and potential damage from the unauthorized use of administrative rights of privileged users. And finally, the functionality of Oracle Application Data Integrity, which allows you to find the most difficult to detect memory access errors in large, complex programs, as well as prevent unauthorized intrusion into systems, is now built into the processor and is called Security in Silicon.
Encryption is an extremely time-consuming and costly process. Security has always had to be paid for performance, and only the release of the SPARC M7 solves this problem, since this processor has unique functionality that allows you to provide transparent data encryption using 15 of the most well-known encryption algorithms: a special mathematical block of processing encryption instructions is built into each processor core. provides an encryption speed almost equal to the speed of the core and the speed of working with memory (Fig. 2). Since all algorithms are processed directly in the processor, the performance drop is less than 3%.
According to the results of comparative testing of system performance from two single-processor servers based on SPARC M7, working in protected mode, and systems from two 4-processor servers produced by the nearest competitor, working in unencrypted mode, the system based on SPARC M7 showed performance 25,093.06 EjOPS, and the opponent is only 22,543.34 EjOPS. This also means that, in terms of a SPARC M7 processor, systems operating in protected mode are about 4.5 times faster than the closest competitors operating in unprotected mode.
Systems based on the SPARC M7 also offer hardware support for secure domain migration, which none of the competitors have. During migration, a virtual machine with critical data is transmitted through the network, and the virtual machine image is encrypted for transmission. At the same time, data is protected during transmission by a complex encryption algorithm. This ensures that the transferred data is protected with minimal impact on the performance of the migrating virtual machine during the transfer.
Finally, it is extremely important to ensure the security of direct memory access. Most viruses for RISC / UNIX systems attempt to directly address the memory outside of their allocated buffers, and use either the stack overflow mechanisms or the buffer overflow mechanisms for this. For the first time in history, the SPARC M7 system has hardware memory protection and helps prevent unauthorized memory access at the level of hardware processor resources. This feature prevents malware from accessing both the memory of applications and any functions of the operating system, while it does not affect performance and cannot be circumvented. As a result, we not only get more secure systems, but also more efficient systems from a development point of view.
In fact, the virtual addresses that the M7 processors operate on are not limited to 64 bits. When a memory area is allocated for an application, four bits above the standard 64 are used as a color label, which is assigned to that memory area and transmitted along with a pointer to that area. This avoids the possibility of accessing memory areas outside the allocated array. This mechanism has a rather subtle protection at the level of memory pages, 64 bytes in size. Since tags are hardware, are added by the processor and transmitted directly to the program with a pointer, they are inaccessible to any software and neutralize any viruses that have not yet been created that use stack overflow and buffer overflow mechanisms.
I must say that the operating system Oracle Solaris 11.3 supports all the above functionality. In addition, Solaris has a number of features that provide an additional level of security. For example, in Solaris 11.3, there is a read-only zone mechanism, and once you create this zone, you can be sure that none of its parameters can ever be changed by anyone. In addition, Solaris has a special automated mechanism for updating the operating system, which creates a fully certified stack of all updates and at the same time provides a very fast rollback to the latest running version in the event of a crash. The system can also automatically generate reports on system compliance with security requirements and transfer them to an independent external server. Finally, the access control mechanisms of the Solaris operating system allow administrators to control the rights - both at the level of their functions and over time - and contain a very powerful rights management mechanism that allows minimizing damage even in the case of malicious administrator actions.
Before discussing the SQL in Silicon functionality — processing queries to a database implemented directly on the processor — you need to recall the In-Memory functionality implemented in Oracle Database 12.1 by creating a dedicated area in the RAM in which information from the tables is stored, unlike the traditional line-by-line representation, in column format. Already release 12.1 provided extremely fast building of reports and analytics, and in release 12.2 these operations were accelerated by 3–10 times. In version 12.1, data from several tables are scanned and merged, which is much more efficient in the column view than regular joins, while in version 12.2, even faster joins are implemented at the dictionary level, and not at the data level.
The SPARC M7 processor has specialized SQL instruction accelerators that operate independently in synchronous and asynchronous mode. And if, with the transition to In-Memory, the speed of processing instructions was millions of lines per second, then using specialized accelerators in the M7 processor, it reached billions of lines per second. The maximum result achieved on Oracle's internal tests was 170 billion lines per second on SPARC M7 processors using the In-Memory mechanism and embedded co-processors. Built-in coprocessors not only increase the speed of processing SQL queries, but also free up general-purpose processor cores for other applications — OLTP queries, etc.
As a result, the analyst on the SPARC M7 runs more than eight times faster than on the x86 platform system architecture. OLTP runs about three times faster. This means that, where previously five five-processor servers were required for OLTP processing and analytics, now you can get by with a single-processor SPARC M7 server that will simultaneously process both OLTP and analytical queries. Savings on hardware, licenses, space, electricity, and IT staff time are guaranteed.
The more complex the request, the greater the amount of data with which the systems are based on the SPARC M7 processor, the more pronounced the increase in performance. One of the major customers of Oracle, which is engaged in online trading, when testing a SPARC T7-4 server based on SPARC M7 processors with Oracle Database 12.1.0.2 and the In-Memory option, received an increase in query processing speed of 83 times. And this is not an isolated example. Systems based on the SRARC M7 have already been tested by Accenture PLC, DZ Bank AG, HPCVL, Infosys Limited, MSC Software Corporation, SAS, Siemens AG, Software AG, Temenos, UZ Leuven and several other companies, including some Russian ones. All of them confirmed that the performance of the SPARC M7 system is quite high and that all applications of these companies continue to run on SPARC M7 systems with a fairly high level of efficiency.
Once again, Oracle continues to develop the SPARC architecture, investing much more resources in it than in earlier Micrographs. In doing so, Oracle develops SPARC as a platform that primarily provides the maximum level of performance. And finally, although Oracle optimizes the SPARC architecture for Oracle software and you can never find a system that works better with Oracle products than SPARC-based systems, products from third-party software vendors also work quite well and efficiently on the SPARC platform which was proven by beta testing in a number of international and Russian corporations, as well as by the examples of Oracle partners who work with SPARC systems.
As for the SPARC M7, this is the first processor that was fully developed, starting with ideology and basic design, for Oracle and Oracle. The main goal of the development project was to ensure maximum efficiency of the Oracle software - and as a result, the industry's first 32-core processor was created with unprecedented load capacity, core performance, fast encryption capabilities and hardware decompression.
')
If you compare the parameters of the SPARC M7 microprocessor with the parameters of the most advanced SPARC T5 processor released earlier, you will find that many of the parameters have doubled and some of them have increased four (Table 1). The SPARC M7 processor has 32 general-purpose cores, i.e., twice as large as the T5 processor. Also, the SPARC M7 processor has twice as many computation threads and four times more cache per core, and the new architecture has significantly improved the performance of each core. New memory controllers made it possible to increase memory bandwidth and memory access speed, while I / O bandwidth increased fourfold. The processor clock speed has also increased. In general, the SPARC M7 processor is about three times faster than the SPARC T5 processor.
Table 1
| SPARC T5 | SPARC M7 | Boost | |
| Number of cores | sixteen | 32 | 2 x |
| Number of threads | 128 | 256 | 2 x |
| Kernel cache size | 0.5 MB | 2 MB | 4 x |
| Memory bandwidth | 79 GB / s | 160 GB / s | 2 x |
| Memory access speed | 163 ns | 131 ns | 20% |
| I / O Bandwidth | 32 GB / s | 145 GB / s | 4 x |
| Frequency | 3.60 GHz | 4.13 GHz | 15% |
But the historic revolutionary step made by Oracle with the new processor is the implementation of software functions directly on the chip. This is on-chip security, i.e., encryption acceleration and hardware memory protection, and, more importantly, SQL-on-chip, i.e. the world's first hardware implementation of accelerating SQL query processing and decompression for Oracle Database In-Memory.
Safety on chip
It would seem, and so it is clear why security is so important, but we will explain something. According to the CSO Online Market Pulse report, the number of stolen data lines in the world for 2014 amounted to hundreds of millions, and the losses incurred by the business are measured in millions and millions of dollars. But, unfortunately, in the corporate security system, database protection is actually the weakest point. More than 50% of companies believe that the most important and most valuable data is stored in their databases, but most companies invest primarily in network protection, and they prefer to spend as little money on database protection as possible. As a result, 76% of all successful attacks on corporate data were not stopped by network security tools.
There are three main types of security threats:
- Database Vulnerabilities as Physical Media
- Operating system vulnerabilities leading to infiltration and unauthorized access to data
- Memory Access Errors
Oracle DBMS technologies address database vulnerability problems with built-in encryption features. In turn, the operating system Oracle Solaris has a number of functions that allow you to minimize the possibility and potential damage from the unauthorized use of administrative rights of privileged users. And finally, the functionality of Oracle Application Data Integrity, which allows you to find the most difficult to detect memory access errors in large, complex programs, as well as prevent unauthorized intrusion into systems, is now built into the processor and is called Security in Silicon.
Encryption is an extremely time-consuming and costly process. Security has always had to be paid for performance, and only the release of the SPARC M7 solves this problem, since this processor has unique functionality that allows you to provide transparent data encryption using 15 of the most well-known encryption algorithms: a special mathematical block of processing encryption instructions is built into each processor core. provides an encryption speed almost equal to the speed of the core and the speed of working with memory (Fig. 2). Since all algorithms are processed directly in the processor, the performance drop is less than 3%.
According to the results of comparative testing of system performance from two single-processor servers based on SPARC M7, working in protected mode, and systems from two 4-processor servers produced by the nearest competitor, working in unencrypted mode, the system based on SPARC M7 showed performance 25,093.06 EjOPS, and the opponent is only 22,543.34 EjOPS. This also means that, in terms of a SPARC M7 processor, systems operating in protected mode are about 4.5 times faster than the closest competitors operating in unprotected mode.
Systems based on the SPARC M7 also offer hardware support for secure domain migration, which none of the competitors have. During migration, a virtual machine with critical data is transmitted through the network, and the virtual machine image is encrypted for transmission. At the same time, data is protected during transmission by a complex encryption algorithm. This ensures that the transferred data is protected with minimal impact on the performance of the migrating virtual machine during the transfer.
Finally, it is extremely important to ensure the security of direct memory access. Most viruses for RISC / UNIX systems attempt to directly address the memory outside of their allocated buffers, and use either the stack overflow mechanisms or the buffer overflow mechanisms for this. For the first time in history, the SPARC M7 system has hardware memory protection and helps prevent unauthorized memory access at the level of hardware processor resources. This feature prevents malware from accessing both the memory of applications and any functions of the operating system, while it does not affect performance and cannot be circumvented. As a result, we not only get more secure systems, but also more efficient systems from a development point of view.
In fact, the virtual addresses that the M7 processors operate on are not limited to 64 bits. When a memory area is allocated for an application, four bits above the standard 64 are used as a color label, which is assigned to that memory area and transmitted along with a pointer to that area. This avoids the possibility of accessing memory areas outside the allocated array. This mechanism has a rather subtle protection at the level of memory pages, 64 bytes in size. Since tags are hardware, are added by the processor and transmitted directly to the program with a pointer, they are inaccessible to any software and neutralize any viruses that have not yet been created that use stack overflow and buffer overflow mechanisms.
I must say that the operating system Oracle Solaris 11.3 supports all the above functionality. In addition, Solaris has a number of features that provide an additional level of security. For example, in Solaris 11.3, there is a read-only zone mechanism, and once you create this zone, you can be sure that none of its parameters can ever be changed by anyone. In addition, Solaris has a special automated mechanism for updating the operating system, which creates a fully certified stack of all updates and at the same time provides a very fast rollback to the latest running version in the event of a crash. The system can also automatically generate reports on system compliance with security requirements and transfer them to an independent external server. Finally, the access control mechanisms of the Solaris operating system allow administrators to control the rights - both at the level of their functions and over time - and contain a very powerful rights management mechanism that allows minimizing damage even in the case of malicious administrator actions.
SQL on a chip
Before discussing the SQL in Silicon functionality — processing queries to a database implemented directly on the processor — you need to recall the In-Memory functionality implemented in Oracle Database 12.1 by creating a dedicated area in the RAM in which information from the tables is stored, unlike the traditional line-by-line representation, in column format. Already release 12.1 provided extremely fast building of reports and analytics, and in release 12.2 these operations were accelerated by 3–10 times. In version 12.1, data from several tables are scanned and merged, which is much more efficient in the column view than regular joins, while in version 12.2, even faster joins are implemented at the dictionary level, and not at the data level.
The SPARC M7 processor has specialized SQL instruction accelerators that operate independently in synchronous and asynchronous mode. And if, with the transition to In-Memory, the speed of processing instructions was millions of lines per second, then using specialized accelerators in the M7 processor, it reached billions of lines per second. The maximum result achieved on Oracle's internal tests was 170 billion lines per second on SPARC M7 processors using the In-Memory mechanism and embedded co-processors. Built-in coprocessors not only increase the speed of processing SQL queries, but also free up general-purpose processor cores for other applications — OLTP queries, etc.
As a result, the analyst on the SPARC M7 runs more than eight times faster than on the x86 platform system architecture. OLTP runs about three times faster. This means that, where previously five five-processor servers were required for OLTP processing and analytics, now you can get by with a single-processor SPARC M7 server that will simultaneously process both OLTP and analytical queries. Savings on hardware, licenses, space, electricity, and IT staff time are guaranteed.
The more complex the request, the greater the amount of data with which the systems are based on the SPARC M7 processor, the more pronounced the increase in performance. One of the major customers of Oracle, which is engaged in online trading, when testing a SPARC T7-4 server based on SPARC M7 processors with Oracle Database 12.1.0.2 and the In-Memory option, received an increase in query processing speed of 83 times. And this is not an isolated example. Systems based on the SRARC M7 have already been tested by Accenture PLC, DZ Bank AG, HPCVL, Infosys Limited, MSC Software Corporation, SAS, Siemens AG, Software AG, Temenos, UZ Leuven and several other companies, including some Russian ones. All of them confirmed that the performance of the SPARC M7 system is quite high and that all applications of these companies continue to run on SPARC M7 systems with a fairly high level of efficiency.
Once again, Oracle continues to develop the SPARC architecture, investing much more resources in it than in earlier Micrographs. In doing so, Oracle develops SPARC as a platform that primarily provides the maximum level of performance. And finally, although Oracle optimizes the SPARC architecture for Oracle software and you can never find a system that works better with Oracle products than SPARC-based systems, products from third-party software vendors also work quite well and efficiently on the SPARC platform which was proven by beta testing in a number of international and Russian corporations, as well as by the examples of Oracle partners who work with SPARC systems.
Source: https://habr.com/ru/post/280077/
All Articles