5 ms·
* [James Hamilton] believe there is a high probability we are now looking at what will become the first high volume ARM Server. More speeds and feeds: >30B tran
by yarapavan 7y ago
* [James Hamilton] believe there is a high probability we are now looking at what will become the first high volume ARM Server. More speeds and feeds: >30B transistors in 7nm process 64KB icache, 64KB dcache, and 1MB L2 cache 2TB/s internal, full-mesh fabric Each vCPU is a full non-shared core (not SMT) Dual SIMD pipelines/core including ML optimized int8 and fp16 Fully cache coherent L1 cache 100% encrypted DRAM 8 DRAM channels at 3200 Mhz
* ARM Servers have been inevitable for a long time but it’s great to finally see them here and in customers hands in large numbers.
- kortilla 7y agoIs there somewhere to buy something like this for use at home?
- downrightmike 7y agoProbably not until end of life for these chips
- wmf 7y agoAmpere QuickSilver, but don't expect an 80-core server to be cheap.
- nine_k 7y agoWhat really stands out for me is "100% encrypted DRAM". How efficient is this? Can different cores have different encryption keys, so that different VMs under a hypervisor can't benefit from breaking the hypervisor's protections?
- praseodym 7y agoI can’t speak for the Graviton2 CPUs, but AMD Epyc CPUs have RAM encryption with per-VM keys for increased isolation: https://developer.amd.com/sev/ https://developer.amd.com/sev/
- wwarner 7y agoSame question from me. At what point does dedicated hosting become more efficient than encrypted everything?
- wmf 7y agoPretty much never. With dedicated servers you don't have anyone to split the Nitro overhead with.
- amluto 7y agoSome Intel chips can encrypt memory with different keys for different VMs. This sounds great for marketing but adds basically no security whatsoever. The feature is called MKTME. What’s going on here is that “different keys for different VMs” does not actually improve isolation without a considerable amount of hardware or microcode enforcement. AMD has this type of tracking of which VM is which. Intel does not. I don’t know what AMD does. In any case, exception makes little difference. Cores aren’t bound 1:1 to VMs, so the core can access any VM’s data if it wants. And actually clearing the key on a context switch would require flushing caches and require that there is no cache shared between cores. The performance hit would be extreme.
- nine_k 7y agoWhat is the point of sharing cache between VMs? Pinning a VM to a set of cores when encryption is enabled would make sense, and could be a feature cloud users would be willing to pay for.
- amluto 7y agoBasically every recent CPU has a big cache shared between all cores. So, unless you pin a VM to one socket and you do something to encrypt cache coherency traffic between sockets per VM, you lose. The underlying issue here is that encryption is fast but not fast enough. So no one encrypts cache — instead, plaintext is cached and data is encrypted on its way to DRAM. So the actual isolation is in the access controls that the CPUs apply to which process or VM can access which pages, and this has little to do with encryption. It’s worth noting that Intel has been very bad lately at protecting cache contents from side channels, while AMD has done just fine. You can turn fancy encryption on, but those side channels leak plaintext.
- thu2111 7y agoIn fairness to Intel they also have SGX which has encrypted RAM and also a lot of isolation logic, as well as working RA, recovery, versioned sealed data and a lot of other things that AMD's equivalent just doesn't do well or at all.
- Koshkin 7y agoThat seems like another blow to high-performance computing on VMs.