Oracle Solaris Overview
1 like1,702 views
This document provides an overview of Oracle Solaris. It discusses security features like Silicon Secured Memory that protects against memory attacks. It describes how Oracle Solaris leverages across Oracle products and accelerates analytics and encryption workloads. Oracle Solaris also provides simple, secure deployment of applications in private or public clouds.
Oracle Solaris Overview
- 2. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | Oracle Confidential – Internal/Restricted/Highly Restricted Solaris Overview Markus Flierl Vice President Oracle Solaris
- 4. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | Leverage Across the Portfolio Storage Products Engineered Systems ServersOracle Cloud Software in Silicon/ Solaris
- 5. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | Security In Silicon: Silicon Secured Memory Applications Memory Pointer “Y” Pointer “R” GO Pointer “B” GO • Protects data in memory • Hidden “color” bits added to pointers (key), and content (lock) • Pointer color (key) must match content color or program is aborted • Set on memory allocation, changed on memory free’ • Protects against access off end of structure, stale pointer access and malicious attacks M7 Processor
- 7. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | • Memory access vulnerability in the open source Quick Emulator hypervisor (QEMU) • Malicious code in VM executes code in hypervisor security context. • Code escapes the guest VM to control the entire host • Caused by buffer over-write, allowing data to be stored beyond allocated memory Example Venom-Type Vulnerability 7 Host System Sales server VM DB server VM Web server VM VM Hypervisor Host Hardware Hacker exploits VENOM to escape VM VENOM executes instructions in hypervisor and gains control of host hardware Venom escape
- 8. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | • Memory access vulnerability in the open source Quick Emulator hypervisor (QEMU) • Malicious code in VM executes code in hypervisor security context. • Code escapes the guest VM to control the entire host • Caused by buffer over-write, allowing data to be stored beyond allocated memory Prevents Venom-Type Vulnerability 8 Host System Sales server VM DB server VM Web server VM VM Hypervisor Host Hardware Hacker exploits VENOM to escape VM M7 Processor with SSM prevents QEMU driver over-writeStop!
- 9. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | Secure Software Made Simple – A Case Study We Find Bugs For You • Large enterprise app with memory intensive processing – 4 cross platform bugs tagged in 2 days – 180x faster bug identification • Other memory validation tool: 3 hours • SSM and Discover tool: 1 minute Integrated. Simple. Fast. Silicon Secured Memory Oracle Solaris Studio +
- 10. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | M7 Query Accelerator Engine • 32 In-Silicon Offload Engines • Cores/Threads Operate Synchronous or Asynchronous to Offload Engines • User Level Synchronization Through Shared Memory • High Performance at Low Power • 3x more Memory Bandwidth than x86 Decompress Unpack/ Alignment Scan, Filter, Join Result Format/ Encode Data Input Queues Local SRAM Decompress Unpack/ Alignment Result Format/ Encode Decompress Unpack/ Alignment Result Format/ Encode Decompress Unpack/ Alignment Result Format/ Encode Data Output Queues M7 Query Engine (1 of 32) On-Chip Network Data Input Queues Data Output Queues On-Chip Network On-Chip Network On-Chip Network Scan, Filter, Join Scan, Filter, Join Scan, Filter, Join
- 12. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | Much Faster End-To-End Encryption 12 M7 Advantage Increases on Highest Security Ciphers Oracle M7 32 cores IBM Power8 6 cores Intel X86 E5 v3 18 cores 4X Faster vs. X86 11X Faster vs. IBM Power AES 128-CBC: Popular for Cloud, DB Oracle M7 32 cores IBM Power7+ 8 cores Intel X86 E5 v3 18 cores SHA 512-1024: Important for Banking Operations 83 GB/s 22 GB/s 8 GB/s 84 GB/s 4.7 GB/s 1.4 GB/s 18X Faster vs. X86 60X Faster vs. IBM Power
- 13. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | Query Acceleration: Not Just Simply Queries • Real-world Enterprise analytics accelerated – Hardware for common range comparisons – “How many between start-date and end-date?” • The following query runs entirely in silicon • Results placed directly in processor cache 13 SQL: SELECT count(*) …WHERE lo_orderdate = d_datekey …AND lo_partkey = 1059538 AND d_year_monthnum BETWEEN 201311 AND 201312;
- 14. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | Performance: Decompression within Acceleration Engines • Compression is key to placing more data in- memory and in storage • Speed of decompression is most important for database – reading typically outweighs writing • Performance of decompress on today’s processors is fine for disk access, slow for flash, huge bottleneck for in-memory database • Solution: Efficient compression algorithm plus acceleration engines runs decompress at full in- memory database speed, >120 GB/sec – Equivalent to 16 decompression PCI cards, 64 CPU cores Process Decompress Acceleration Engine In-Memory Data Stream 14
- 15. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | Decompress at memory speed >120 GB/sec SQL In Silicon: Accelerating Oracle Database 12c 15 One step 10Xfaster Decompress More than Doubles data size Read Software scan Read Write Write Read DAX Write Multiple steps SQL: SELECT count(*) …WHERE lo_orderdate = d_datekey …AND lo_partkey = 1059538 AND d_year_monthnum BETWEEN 201311 AND 201312; t
- 20. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | ✓ Secure and Compliant ✓ Simple ✓ Efficient ✓ Open ✓ Affordable Your Enterprise Cloud Oracle Solaris 11.3 – Security. Speed. Simplicity. 20 YOUR APP
- 21. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | Oracle Solaris Immutable Guest # Immutable Guest Firewall • Locked down hypervisor and guests • Stop malware before it gets in • Prevent administrator mistakes • Update and patch but unwritable by users, applications, or hackers • Simple on/off with ready made security levels 21 Protects Hypervisor and Guest Environments
- 22. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | Eliminates Vulnerability During Live Migration • Encryption by default • No performance impact hardware cryptographic offload • Access via RESTful APIs* 22 Oracle Solaris Oracle Solaris Solaris Zone Solaris Zone Solaris Zone Solaris Zone *Available soon
- 25. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | 25 Secure OpenStack-Based IaaS • Secure services – Minimum privileges • Data at Rest – ZFS Encryption • Data in Motion – Secure Migration • Network – Data link Protection • Application – Read only VM Oracle Solaris Oracle SolarisOracle Solaris Zone Zone Zone Zone Zone Zone Zone Zone
- 26. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | Benefits of Running OpenStack on Oracle Solaris • Engineered for security and compliance – Minimal privileges for cloud services – Lock down infrastructure with immutability • Assured reliability and scale – Automatic service restart and node dependencies – Guaranteed data integrity • Seamless upgrade, instant roll-back OS. Virtualization. SDN. OpenStack. Complete.
- 28. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | DevOps for the Enterprise 28 Continuous DeploymentContinuous Integration • Correlation of app and HW interactions, DTrace • Memory protection in HW • Optimized, remote IDE Agile Development • Rich performance monitoring tool • Scalable • Secure • Multi-level fault-tolerant YOUR APP YOUR APP
- 29. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | DevOps for the Enterprise Agile Development Continuous Integration Continuous Deployment Monitoring and Measurement 29
- 30. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | CPU Full MT-hot kernel, scales to 100s of cores and 1,000s of HW threads Support for Critical Threads features in T4 chip 5x performance improvement of high-resolution timer Multi-processing and multi-threading support for Oracle DB Multi-CPU binding for NUMA-aware interrupt distribution Multi CPU binding for pools Memory Large Page support Optimized Shared Memory (OSM) NUMA I/O Framework Fast DB Restart Latency-aware kernel memory allocator (x86, SPARC) Re-architecture of Virtual Memory sub-system (VM 2) Userland Fast-Memory Registration and Shared Protection Domain Read-only access to In-Memory Columnar Data In-Memory time stamps Up to 20x faster SGA fill times with VM2 and OSM integration Memory reservation pools File System Userland file system for DB, Oracle File Server support I/O Support for low-latency Infiniband: RDSv3, SDP Direct I/O with concurrent writes Network Resource Management for RDSv3, Prioritized flows for TCP/IP IB I/O Resiliency Examples of Optimizations for Oracle DB The Tip of the Iceberg Key: Solaris 11.2 New in Solaris 11.3
- 31. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | Observability Enhanced observability for segmentation faults Read-out of libdtrace by Oracle 12c Fine-grain IB performance stats for RDSv3 and OFUV Reliability and Availability Dynamic reconfiguration notifications for DB for resources rebalancing FMA callback for bad hardware Alternative Path Migration (APM) fail-over for RDSv3 Hot add and remove of IB HCA Performance Improved PGA performance 2x faster DB Start and Stop Kernel lock acceleration for Oracle RAC SR-IOV support for OVM SPARC Exafusion Multi-tenancy Zones: Secure isolation, lowest latency virtualization; Kernel Zones PDBs: Reservation of multiple virtual address spaces Security Transparent crypto off-load for SPARC and x86; Immutable kernel and global zones Examples of Optimizations for Oracle DB The Tip of the Iceberg Key: Solaris 11.2 New in Solaris 11.3
- 32. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | • SPARC M7 6.8x faster than IBM Power8(6c) per chip – SPARC M7 is 28% faster per core than Power8 • SPARC M7 2.8x faster than E5 v3 per chip • SPARC M7 is 56% faster per core than E5 v3 0 1 2 3 4 5 6 Per-Chip M tpmOLTP SPARC M7 vs the Competition Power8 (6 core) x86 E5 v3 SPARC M7 Oracle SPARC M7 Beats the Competition World Record OLTP Database Performance 32 6.8x Faster 2.8x Faster
- 33. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | Virtual Memory Management Optimized for Oracle DB 33 12 12 16 29 69 166 81 155 305 609 1221 3122 0 500 1000 1500 2000 2500 3000 3500 128GB 256GB 512GB 1T 2T 5T Seconds to Full Allocation SGA Size Time to Full SGA Allocation Oracle Solaris 11.3, 2M pages RHEL 7.0, 2m pages - New Virtual Memory system optimized for Oracle DB: - Scalable to 100s of TB of DBRAM - Faster SGA allocation and shutdown - Dynamic Resizing of SGA
- 34. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | Oracle OpenStack Database Cloud • Simplified support through end-to- end Oracle OpenStack solution: – Oracle DB, compute, networking and storage • Enterprise-class DBaaS • Zero overhead virtualization • 10x faster self-provisioning of DBs 34 Solaris Solaris Oracle ES-1 Oracle ZS-3 storage Oracle Compute
- 35. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | 0.73 1.340.00 0.30 0.26 0.16 0.00 0.47 0.00 0.22 0.28 1.14 0.11 0.45 0.01 1.36 0.00 1.00 2.00 3.00 4.00 5.00 6.00 T7-1 DL580 Gen9 Virtualization "performance tax" 3rd Party App Server 3rd Party App Server Hw/ Virt/ OS Acqu. + 3-yr Support Virtualization 3-year Support OS 3-year Support Server 3-year Support Server Virtualization Acquisition Server Acquisition 1.40 5.44 USD/ crit. jOps* 1.40 5.44 Comparison of TCA T7-1 and HP DL580 *Based on SPECjbb2015 0.73 1.340.00 0.30 0.26 0.16 0.00 0.47 0.00 0.22 0.28 1.14 0.11 0.45 0.01 1.36 0.00 1.00 2.00 3.00 4.00 5.00 6.00 T7-1 DL580 Gen9 Virtualization "performance tax" 3rd Party App Server 3rd Party App Server Hw/ Virt/ OS Acqu. + 3-yr Support Virtualization 3-year Support OS 3-year Support Server 3-year Support Server Virtualization Acquisition Server Acquisition
- 36. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | SuperCluster Customer Overview Deployments by Originating/Competing Platform • IBM Replacement • Financial trading application and Oracle Database 11gR2 • 3x higher throughput • 4x higher trades • 30x consolidation ratio • X86 / Linux Replacement • Oracle E-Business Suite and Oracle Database 11gR2 • 22x system consolidation • 9x faster data operations • Deployment in 63 days Over 50% of customers are competitive take-outs or new Deployments 26% 18%47% 9% HP IBM SPARC New Oracle
- 37. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | Oracle Solaris 11.3 – Key Features • New repo for early access to FOSS • Zones/Kernel Zones • Secure live migration for Kernel Zones • ZOSS over NFS • Performance and NUMA enhancements • Live reconfiguration of I/O • IB support for Kernel Zones • OpenStack • Automated OpenStack updates • Support for Orchestration (Heat) • Support for Bare Metal Provisioning (Ironic) • RAD – REST, Python binding • ZFS – LZ4 compression • Application Driven SDN • PVLAN support • Security and Compliance • Compliance policy tailoring • Verified boot for kernel zones • Best for Oracle • Faster DB reboots (OSM Integration with VM2) • OVN support Oracle Confidential – Highly Restricted 37
- 38. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. | Required Benchmark Disclosure Statement Must be in SPARC M7 Presentations with Benchmark Results •Additional Info: http://blogs.oracle.com/bestperf •Copyright 2015, Oracle &/or its affiliates. All rights reserved. Oracle & Java are registered trademarks of Oracle &/or its affiliates.Other names may be trademarks of their respective owners •SPEC and the benchmark name SPECjEnterpriseare registered trademarks of the Standard Performance Evaluation Corporation. Results from www.spec.org as of 10/25/2015. SPARC T7-1, 25,818.85 SPECjEnterprise2010 EjOPS (unsecure); SPARC T7-1, 25,093.06 SPECjEnterprise2010 EjOPS (secure); Oracle Server X5-2, 21,504.30 SPECjEnterprise2010 EjOPS (unsecure); IBM Power S824, 22,543.34 SPECjEnterprise2010 EjOPS (unsecure); IBM x3650 M5, 19,282.14 SPECjEnterprise2010 EjOPS (unsecure). •SPEC and the benchmark name SPECvirt_sc are registered trademarks of the Standard Performance Evaluation Corporation. Results from www.spec.org as of 10/25/2015. SPARC T7-2, SPECvirt_sc2013 3026@168 VMs; HP DL580 Gen9, SPECvirt_sc2013 3020@168 VMs; Lenovo x3850 X6; SPECvirt_sc2013 2655@147 VMs; Huawei FusionServer RH2288H V3, SPECvirt_sc2013 1616@95 VMs; HP ProLiant DL360 Gen9, SPECvirt_sc2013 1614@95 VMs; IBM Power S824, SPECvirt_sc2013 1371@79 VMs. •SPEC and the benchmark names SPECfp and SPECint are registered trademarks of the Standard Performance Evaluation Corporation. Results as of October 25, 2015 from www.spec.org and this report. 1 chip resultsSPARC T7-1: 1200 SPECint_rate2006, 1120 SPECint_rate_base2006, 832 SPECfp_rate2006, 801 SPECfp_rate_base2006; SPARC T5-1B: 489 SPECint_rate2006, 440 SPECint_rate_base2006, 369 SPECfp_rate2006, 350 SPECfp_rate_base2006; Fujitsu SPARC M10-4S: 546 SPECint_rate2006, 479 SPECint_rate_base2006, 462 SPECfp_rate2006, 418 SPECfp_rate_base2006. IBM Power 710 Express: 289 SPECint_rate2006, 255 SPECint_rate_base2006, 248 SPECfp_rate2006, 229 SPECfp_rate_base2006; Fujitsu CELSIUS C740: 715 SPECint_rate2006, 693 SPECint_rate_base2006; NEC Express5800/R120f-1M: 474 SPECfp_rate2006, 460 SPECfp_rate_base2006. •SPEC and the benchmark name SPEC OMP are registered trademarks of the Standard Performance Evaluation Corporation. Results as ofOctober 25, 2015 from www.spec.org and this report. SPARC T7-4 (4 chips, 128 cores, 1024 threads): 27.9 SPECompG_peak2012, 26.4 SPECompG_base2012; HP ProLiant DL580 Gen9 (4 chips, 72 cores, 144 threads): 21.5 SPECompG_peak2012, 20.4 SPECompG_base2012; Cisco UCS C460 M7 (4 chips, 72 cores, 144 threads): 20.8 SPECompG_base2012. • Two-tier SAP Sales and Distribution (SD) standard application benchmarks, SAP Enhancement Package 5 for SAP ERP 6.0 as of 10/23/15: SPARC T7-2 (2 processors, 64 cores, 512 threads) 30,800 SAP SD users, 2 x 4.13 GHz SPARC M7, 1 TB memory, Oracle Database 12c, Oracle Solaris 11, Cert# 2015050. IBM Power System S824 (4 processors, 24 cores, 192 threads) 21,212 SAP SD users, 4 x 3.52 GHz POWER8, 512 GB memory, DB2 10.5, AIX 7, Cert#201401. Dell PowerEdge R730 (2 processors, 36 cores, 72 threads) 16,500 SAP SD users, 2 x 2.3 GHz Intel Xeon Processor E5-2699 v3 256 GB memory, SAP ASE 16, RHEL 7, Cert#2014033. HP ProLiant DL380 Gen9 (2 processors, 36 cores, 72 threads) 16,101 SAP SD users, 2 x 2.3 GHz Intel Xeon Processor E5-2699 v3 256 GB memory, SAP ASE 16, RHEL 6.5, Cert#2014032. SAP, R/3, reg TM of SAP AG in Germany and other countries. More info www.sap.com/benchmark 38