Right. So, we were exploring the consequences of the fact that the generalized susceptibility chi is analytic in the upper half plane in the frequency. So, if I draw the frequency plane, this being the frequency plane with the real omega here and imaginary omega, let us call it prime. So, this is the omega prime plane out here. Then the point was that if you start with any fixed real frequency omega, we discovered that the integral over the closed contour C of the omega prime chi of omega prime over omega prime minus omega over this contour. So, all the way from minus infinity coming in and then a little indentation a semicircular indentation in the upper half plane through an radius epsilon say and then back on the real axis and all the way down and closed in this fashion. This is equal to 0 and the condition we needed for this was that this integral the integral had to vanish as omega prime went to infinity anywhere in the upper half plane. So, if chi of omega prime goes to 0, if chi of omega prime goes to 0 as mod omega prime tends to infinity in the upper half plane, then this contour C could be blown out all the way to infinity. This contribution would then vanish because this is going to give you a capital R e to the i theta. This is going to give you a capital R, the two cancel each other and then if this goes to 0, the answer goes to 0. So, a sufficient condition for this integral to converge and for this contribution to go to 0 is that this be true that chi vanish in the upper half plane. As you can see it suffices if chi vanishes along the real axis because on the imaginary axis you actually have extra convergence factors. So, if this is true then this 0 implies that the integral from minus infinity up to this point which is omega minus epsilon and this is omega plus epsilon up to infinity plus the semicircle is 0. And since the integral from this in the contribution from the semicircle is 0, anyway you end up with a statement that integral from minus infinity to omega minus epsilon the omega prime chi of omega prime over omega prime minus omega plus an integral from omega plus epsilon to infinity the same thing.  So it is a circle about the point omega. So omega prime is omega itself plus this little complex number epsilon e to the i theta. And the integration variable here is theta running from pi to 0, goes the other way here. So this is equal to epsilon e to the i theta, i d theta that is what d omega prime is, we just differentiate this quantity and then the integral runs from pi up to 0 divided by omega prime minus omega that is equal to epsilon e to the i theta and that is it. So 0 is equal to this whole thing and this cancels, this term cancels here and the integral is minus i pi times, oh sorry, the sky of omega plus epsilon e to the i theta that is of course sitting inside there. So in the limit in which epsilon goes to 0, this becomes the epsilon cancels, the theta cancels and you are left with i pi times chi of omega, right, minus i pi because this is from pi. So this finally says that i pi times chi of omega is equal to an integral from minus infinity to infinity d omega prime, chi of omega prime over omega prime minus omega leaving out a small portion which is symmetric about the point omega and this is called the principle value integral, this is called the Cauchy principle value. So this is equal to, but let me just write it as p and this stands for Cauchy principle. So this was an invention of Cauchy's, he discovered that in many cases when you have an integral with singularity on the real axis, on the axis of integration, on the contour of integration, in general the real axis, then if you leave out a small symmetrical portion about this little segment which is symmetrically situated about the singularity, in this case at omega and take the limit as epsilon goes to 0, then that can be finite and it is called the Cauchy principle value. In this case, it is finite and it is equal to the susceptibility at this point apart from this factor here. So if I bring the i pi to the right hand side over, so look at what has happened. We did an excursion, we made an excursion from real values of omega to complex values, but we are back to the real axis because this contribution went away, we are back to the real axis and what we have done is to, we have succeeded in expressing the susceptibility at any real frequency as an integral over all other frequencies except for an infinitesimal interval about that point, that frequency. This sort of thing is called a dispersion relation, we will write a simpler form of this in a minute, but notice that you are back on the real axis, so there are no complex frequencies here, it is completely physical, right. All we have to do now is to take real and imaginary parts of this. So it follows that the real part of chi of omega is equal to, it comes from the imaginary part, this is real plus i times imaginary and the i cancels and you get p over pi integral minus infinity to infinity. By the way, this, I have written this as p integral minus infinity to infinity, sometimes it is written like this, minus infinity to infinity with a slash over the integral. That notation is also used just to show you that leave out a symmetrical portion about infinitesimal symmetrical portion segment about the singularity and take the limit. That limit is not always guaranteed to exist, but in this case it does, okay. So this is equal to d omega prime, imaginary part chi of omega prime over omega prime minus omega. The singularity of the integral, at the point omega prime equal to omega is avoided by the principal value, supposed to be left out omitted. And similarly, imaginary part of chi of omega equal to, that comes from the real part but there is a minus i here, when you take this up, so it is equal to minus p over pi integral minus infinity to infinity d omega prime real part of it. So this is the reason why I asserted in the beginning that the susceptibility cannot be purely real or purely imaginary because if it were so, then being an analytic function it would just vanish identically. You cannot have this to be identically 0 or this to be identically 0 because then the whole thing is 0, okay. These relations are called dispersion relations. They are also called occasionally for historical reason. These are the people who introduced these relations first into physics, Kramers-Kronig relations. Even because it was introduced by Kramers-Kronig first in the context of refractive index, an optical susceptibility if you like. Refractive index is, the complex refractive index is just the optical susceptibility and they introduced it in that connection, okay. Now any two real functions, any two functions, real valued functions of a real variable such that you have suppose say two functions f and g, then the fact if you have f of x prime d x prime over x prime minus x principal value equal to g and g is the inverse relation, they called a pair of Hilbert transforms.  So the real part is a Hilbert transform of the imaginary part and the imaginary part is a Hilbert transform of the real part. Notice there is a minus sign. So in principle if I substitute for imaginary chi of omega from here on this, we will have one more integration to do. In principle you should get an identity. In other words that intermediate integral should turn out to be a delta function, okay, which it will, I am not going to show it here but it will. So these two guys real chi and imaginary chi form a pair of Hilbert transforms. Now what was the reason for this whole thing happening? Well it happened because this is an analytic function in the upper half plane and where did the analyticity come from? What is the origin of this business? Remember this got represented as an integral 0 to infinity d tau e to the i omega tau phi of tau. So it got represented in the terms of this one sided Fourier transform and then the argument was if this is true for real omega then for omega with positive imaginary part it is certainly true and analytic. So it arose from this and where did this come from? Why is this 0 and not minus infinity or anything else? Causality. Causality. So in all cases dispersion relations are a consequence of causality. Finally that is what is doing it. The physical reason why the generalized susceptibility satisfies dispersion relations is because it is a causal response. This has profound implications in other parts of physics especially in particle physics, quantum field theory and so on anywhere where dispersion relations appear and they appear in a large number of places but finally it stays down to causality. Now you might say look this is an integral over negative frequencies also whereas physical frequencies are positive but there the fact that this is an anti-symmetric function comes to a rate. So we can convert this integral into something that runs over from 0 to infinity. So let us do that. The real part therefore equal to p over pi, there is an integral from 0 to infinity and then the portion from minus infinity to 0, I am going to write in this form. This is minus infinity to 0 plus integral 0 to infinity times d omega prime blah blah blah. In this term, so I am going to write this as p over pi, I am going to change variables to minus omega prime. Then I pull out a minus sign due to the Jacobian, this becomes infinity to 0 and those 2 minus signs cancel. So both integrals look like 0 to infinity d omega prime and then in the first integral I have chi of omega prime over omega prime minus omega, that is the integral from 0 to infinity in this formula, in this formula and then minus infinity to 0, remember I change variables to minus omega prime. So let us write that as sorry this is imaginary plus imaginary chi of minus omega prime divided by minus omega prime minus omega because I change variables but this fellow is an odd function. So it is equal to minus imaginary chi of omega prime.  So therefore I have a nice representation which says that in general we have a useful representation which says real chi of omega equal to 2 over pi principal value 0 to infinity d omega prime, omega prime imaginary part of chi of omega prime because when I add these 2 I get 2 omega prime divided by omega prime squared minus omega square. Now everything is physical, it says this denominator has a simple pole at omega prime equal to omega, the one at minus omega is outside the region of integration and you have to take the principal value, the pole at omega prime equal to omega and integrate this quantity, okay. It is guaranteed to converge. At infinity this is going to produce a capital R, that is going to produce a capital R, this is going to produce R squared, they cancel each other but this fellow goes to 0 and the integral exists, okay. So this is the physical form of the dispersion relation. Similarly you do the same thing for imaginary part chi of omega equal to, there is still to be a 2 over pi and there was a minus sign which is going to persist, so minus 2 over pi principal times principal value from 0 to infinity d omega prime. Now you are going to subtract 1 over omega prime minus omega minus 1 over the other because this fellow is symmetric so it does not produce an extra minus sign. When you subtract that you get 2 omega so this becomes an omega which outside the integral and then the real part chi of omega prime, it is a very useful form of the dispersion relation. So this is the one that you use, you would use in practice. In practice what happens is the physical use this is put to is suppose you know the susceptibility or you measured the susceptibility both the real and imaginary parts because they have physical meanings, you measured it in some frequency range and you could approximate it by 0 or something like that outside this range. Then to find the susceptibility at any point outside the range you could use this formula. To first order it will be correct even if you cut it off at some upper limit here, that is a consequence of the fact that they are real and imaginary parts that is the reason, sure that is certainly true but it is not really better that these functions behave differently as in tautical, okay. Now you could ask the other question, we slurred over some point, we said chi of omega must go to 0 at infinity. Suppose it does not, you still have to deal with this situation because that can happen in many cases. Suppose it does not go to 0 but it goes let us say on the upper half plane suppose mod chi of omega goes to some number, some chi infinity as mod omega goes to infinity in the upper half plane. Suppose this were true then the contribution from the semicircle is not 0 that is all but you can still work out what the contribution is because now you notice that this infinite semicircle is here. On this semicircle chi goes to chi omega, chi sub infinity and then you have on this circle omega prime equal to capital R e to the i theta. So d omega prime is going to produce it R times d i d theta and so on. And in the denominator you have the same thing omega prime minus omega is going to produce an R. So you will end up with a chi infinity as a constant in the integral. So fine, you will still get dispersion relations but you get an extra contribution here plus something time pi times chi infinity or something like that. So you can still write it down, still compute it but now suppose you say well I do not know chi infinity I just know that it does not go to 0 but I do not know or suppose it is a function of the angle. Suppose the limit that it goes to does not go to 0 but suppose it is a function of which way you go to infinity you have no handle on that. I have assumed here that all through uniformly it goes to the same constant but if it depends on the angle then you cannot do the angular integration, right. Then this is the trick you do in that case. What you do is to modify the function whose analytic behaviour you are looking at. So the omega plane, omega prime plane here is omega, choose some value of the frequency at which you know the value of the susceptibility. So let us suppose there is a point omega naught and let us suppose that chi of omega naught is known or measured so suppose so you know the value at this point and now I am trying to derive dispersion relations. So the function I am going to look at is not chi of omega prime over omega minus omega prime minus omega. This is not good enough because it does not converge fast enough but if I multiply it by this omega prime minus omega naught then I am in good shape because there is an extra omega prime capital R sitting from here and the d omega prime will cancel against this. There is a 1 over capital R here and there is this fellow who goes to a constant, some constant at infinity so there is a 1 over R and this contribution will still vanish. But now you will say aha that is not good because there is a singularity at this point now. So what you will have to do is to consider the contour this way and then an indentation here and then another indentation there and then all the way to infinity. So that is one way to do this. Another way to do this so what would that amount to doing? What would this contribution be finally? It would be i pi or minus i pi whatever it is chi at that value sitting there and then omega naught minus omega would sit there. You can save yourself some trouble by considering not this function but this function. This is a constant. This function if this is got a simple pole at omega naught then this function is well behaved at omega naught. So I write this version relation for this function keeping track of the fact that this is a complex number in general. It is a yes I convert this singularity into a removable singularity by subtracting this. So since I have subtracted this this is called a subtracted dispersion relation and this is called the point of subtraction. So there are several ways of fixing this problem of chi not going to 0 at infinity. Subtracted once. This assumes that chi is such that it goes to it does not go to 0 at infinity but goes to a constant. Suppose it goes like omega prime itself what would you do? Then I would have to subtract at 2 points and so on. So each time you add a denominator it improves the convergence okay and then it is doubly subtracted dispersion relation and so on. As long as it does not have an essential singularity at that point at infinity you are in good shape as no there is no. So if it goes if it blows up like some polynomial like some power of omega prime as omega prime goes to infinity you are okay. Blows up exponentially you cannot write dispersion relation okay. So these are techniques for just techniques for getting rid of singularities but this tells you what the basic idea is. There is one more very important case where you have to deal with this situation which is as I mentioned it happens so happens in many cases that the DC susceptibility is actually divergent where it blows up namely you apply a steady force to the system forever and the response becomes it diverges okay. What do you do then? That implies that chi of omega has a pole or singularity at the origin and in the simplest case it has a simple pole okay. So suppose that happens suppose so this part is taken care of now suppose chi of omega has a simple pole at the origin so it is of the form some residue A over omega plus regular part in the neighbourhood of omega equal to 0. So suppose it has a simple pole at this point at the origin here is my omega then the thing to do is to go back and consider this contour and consider the original function itself. So you have chi of omega prime over omega prime minus omega and you look at it over this contour so indent this in the upper half plane so as to avoid the pole and stay in the region of analytic behaviour of this function and include the behaviour of include the contribution from here in the contour integral. This is going to give you this indentation is going to give you minus i pi chi of omega what is this going to give you? What is the contribution going to be? We are going to have to integrate remember that on this contour omega prime is just equal to epsilon e to the i theta plus 0 because it is at the origin so this thing here integral d omega prime over this little semicircle so let me call this little semicircle little gamma little gamma this fellow here is going to become equal to this is going to go like a over omega prime plus the rest of it right so the leading term is going to be a and then an integral from pi to 0 epsilon e to the i theta i d theta that is d omega prime divided by omega but omega is epsilon e to the i theta so epsilon e to the i theta that is the chi the behaviour of chi with an a here and then there is this factor which is harmless so that factor is 1 over epsilon e to the i theta minus omega so the pole contributed a 1 over omega prime which cancels gives you this epsilon to cancel this so this fellow goes away and this is i pi or minus i pi times a and the rest of it will follow with a minus omega so the whole integral will have a contribution which is essentially a over omega which it should because you are writing a representation for chi and if it is got a singularity with residue a at omega equal to 0 there better be an explicit term a over omega that is what is happening here so tacitly the point of subtraction has been the origin in that sense so in all these cases we know how to deal with this situation but the physics of it is that causality leads to dispersion relations from us chronic relations for the susceptibility generalized susceptibility and that is a general statement and you can write it in terms of physical frequencies using this which is then usable usable for numerical evaluations okay now let us come to terms with what this susceptibility actually is we have to look at the response function a little more carefully so let us do that we will not attach some physics to the whole thing so given for instance a quantum mechanical system can I say what the structure of this response function is what does it really look like etc in particular I want to be able to write things in terms of this spectral function if you recall I pointed out that just to write these formulas out again chi a b of omega is integral 0 to infinity d tau e to the i omega tau phi a b of tau this guy here we showed was in the canonical ensemble it is equal to beta times the equilibrium the canonical correlation between a dot of 0 and b of tau we already defined this quantity the classical case is subsumed in this as a special case and this was analytic in the upper half plane etc etc we also had defined a Fourier transform of this quantity of omega and I call this the spectral function for reasons which will become clear now this was the Fourier transform of phi the response function so this was equal to integral d tau minus infinity to infinity e to the i omega tau phi a b we still not talked very much about what is this quantity for tau less than 0 because the susceptibility just involves this guy here I will come back to this we will deal with the question of how to define it for negative values of tau but notice that this spectral function this guy here was also related to the green function we found out what the Fourier transform of the green function was and the Fourier transform of the green function which is this multiplied by a theta function of tau if I called it g a b of tau that quantity it is Fourier transform was the susceptibility exactly the susceptibility we also found a relation between this fellow and this fellow by writing a theta Fourier representation for the theta function and if you recall that was phi a b of omega was equal to an integral from minus infinity to infinity d omega prime phi a b tilde of omega prime over omega prime minus omega minus i epsilon in the limit in which epsilon goes to 0 from above and there was some i factor somewhere here would you check and let me know there was an i dependent on the Fourier transform convention which I fixed and once and for all but I am pretty sure there was an i here somewhere i or minus i or something like that minus i I just want to keep this straight so now let us see what the content of this response function is in general what would it imply we will take a specific case and I will do this in the simplest notation possible and then we can add frills to it later so we will look at a quantum mechanical system to start with we take a and b to be Hermitian operators their physical observables or operators corresponding to physical observables and then I am going to assume that there is a discrete spectrum of the Hamiltonian H naught in this system just so that the notation becomes simple. So let us suppose that this Hamiltonian H naught has a complete set of states labelled by a quantum number or set of quantum numbers let me call n for collectively so I have H naught on a normalized Eigen function phi n is En on phi n and n runs say 0 1 2 3 whatever a discrete spectrum just for notational convenience and then this is an orthonormal basis so let us say phi n phi n equal to delta nm and similarly sum over n phi n phi n equal to the identity of it so it is a complete set of states and it satisfies orthonormality are you familiar with the terms completeness and orthonormality? So given any state vector of the system you can always write it as an expansion in terms of these phi n's here. This summation here is supposed to sum over states labelled by this quantum set of quantum numbers n and not the energy levels because they could be degeneracy in general so every time I write a sum like this it is not over the energy levels per say but over the states of the system. Then this response function phi ab of tau if you recall this quantity was equal to the equilibrium expectation value of A of 0 B of tau equilibrium that was one of the formulas we had for the response function and in the quantum case this stands for 1 over ih cross A of 0 comma B of tau. So let us calculate this in this basis we need to compute a trace that is what this thing here means. So let us calculate that in the basis phi n you can compute a trace in any basis you like but let us do it in the basis of Eigen states of the unperturbed Hamiltonian H naught pardon me no it is still a commutator no no no the response function is not a dot after I compute right then it becomes dots and so on what happens then you get rid of the commutator and you get this cobalt transform or whatever it is and then it becomes a dot but before that it is just a commutator. So let us calculate this let us calculate A of 0 B of tau equilibrium this is equal to that is the first term in the commutator we just compute this number this is equal to a trace which means a summation over n phi n e to the minus beta H naught that is the equilibrium density operator A of 0 B of tau phi n which is equal to a summation over n e to the minus beta H naught on phi n is e to the minus beta E n because it is an Eigen state so e to the minus beta E n phi n A of 0 and now for this B of tau let us write this as e to the power i H naught tau over h cross B of 0 e to the minus i H naught tau over h cross that is the meaning of B of tau so that is the Heisenberg picture operator but that B of 0 is the Schrodinger picture operator because that is at t equal to 0 that is the way we define the Schrodinger picture okay. So this fellow here I have to put this in but what I could do is in between I put a phi m phi m and sum over m that is the identity operator and then I put this in e to the minus i H naught tau over h cross B of 0 e to the of plus i and minus i H naught tau over h cross times phi n this is equal to a summation over n a summation over m e to the minus beta E n on this side what would you call this? This is a Schrodinger picture operator the time independent Schrodinger picture operator and if I represent it in the basis formed by the Eigen states of the Hamiltonian unperturbed Hamiltonian that is the n mth matrix element okay. So this is just a n m there is no time dependence that is just a number some complex number in general does it have to be real number a is a Hermitian operator does this have to be real number no not true in general does the diagonal element of a have to be real number okay alright. So this thing here a n m and then here I can pull out an e to the i this becomes e sub m and this fellow becomes e sub n and you can take it outside and what is left is B m n and then in e to the power i over h cross tau and then you have an e m minus e n that is it.  So I define h cross omega n m by definition equal to e n minus e n it says a of 0 b of tau in equilibrium can be written in the compact form summation n comma m a n m b m n times e to the minus beta a n n and then e to the minus i omega n m tau. So it can be written in quite a compact form. The next step is to do it for the other part of the commutator right. So let us write the other way B of tau a of 0 and this is now going to have B of tau a of 0 and since I want to match with that let us take the sum here to be over m and the sum here in between to be over n and this fellow becomes B out here we have to work this out properly. So it is just a of 0 this fellow here and now introduce a complete set of states here by putting i equal to summation over n phi n phi n therefore you can write down directly what this quantity is B of tau a of 0 equilibrium equal to summation over n comma m you are still going to get B m n and then you are going to get a n m which is the same as this. So this is still a n m b n n but now this is going to hit this and give you e to the minus beta em. So this is going to be e to the minus beta em and the rest is going to be exactly the same as before. So therefore what does the commutator do and let us divide by 1 over ih cross because that is what the response function is. All these portions are common but this becomes e to the minus beta em minus e to the minus beta em and this goes away. So this is equal to 1 over ih cross summation over n summation over m a n m B m n times this product that is it and this is equal to phi a B of tau. So we have now explicit equations in terms of physical quantities the matrix elements of these operators you have a representation for these operators then all that rigmarole about going to the interaction picture and so on and so on finally ended up with just these quantities the tau dependence is sitting here and the temperature dependence is sitting here and this is a set of exponentials that is it.  So what will this be and we will stop with that today phi a B tilde of omega therefore equal to 1 over ih cross summation over n summation over m a n m B m n e to the minus beta em minus e to the minus beta em times e to the i omega minus omega n m integrated over all values of tau that is a delta function 2 pi times delta function. So this is 2 pi so the spectral function is a function of frequency has peaks at all these points if the number of the levels are very close to each other it is a large system with many levels then it is going to look like a continuous spectrum but this is these are the characteristic frequencies the next thing we will do is to write down the susceptibility based on this representation. So it will give you a explicit omega dependent thing involving the transition frequencies of the system these are the transition frequencies of the system between which love between which transitions can occur due to a perturbation okay. So and then we will interpret this so let me stop here today.


Hello everyone and welcome to this CUBE conversation. We're going to dig into some of the more specific and sometimes gory details of managing the nuances of database, database management systems. You know, it's a lot of fun to get into the daily buzz of cloud and database competition, get a little snarky on Twitter, but there's a lot of mundane issues that you have to address to really do proper database sizing, capacity planning, and you know, whether or not database consolidation makes sense, these are not trivial issues. And decades ago, they spawned an entire role around the database administrator. They had to do the dirty work of database management so that users and customers would be satisfied. And while automation and cloud are changing that role, at the end of the day, somebody actually has to make the databases work in the cloud and make sure that the business doesn't feel any impact on the transition along the way. So on that note, we have with us Oracle Senior Director of Product Management for Mission Critical Databases. He works in Juan Loiz's group, Chris Kraft. And Steve Zavatic, whom we know well on theCUBE, says this guy is the Jedi master when it comes to consolidating databases in the cloud. Nobody knows more on the face of the planet Earth. So we're really excited, Chris, to have you inside theCUBE. Welcome. Thanks. Thanks, Dave. That's a very humble thanks. So when it comes to running databases in the cloud, can you explain the difference between sizing and capacity planning? Aren't they two sides of the same coin? Yeah, they really are. It's like sizing is really part of capacity planning. It's really, I look at sizing as a one-time effort whereas capacity planning is more your ongoing. You perform sizing initially when the application is deployed and then when you're changing platforms, like going from on-prem to the cloud, you're going to go through a sizing exercise because you're looking at going to a new platform. That's more about a one-time effort and then ongoing, you're looking at your capacity management over time. So yeah, they are very related, so. Okay, thank you. So we're going to talk about database consolidation. And a lot of people would say, look, the cloud makes consolidating databases, maybe not a relevant, but maybe not the best strategy because I got all these different purpose-built databases. Why consolidate databases if they're already kind of consolidated in the cloud in one location? Yeah, so we're really talking about in the cloud, you're running virtual machines, but consolidation still applies on the virtual machine. So if you have a virtual machine that's dedicated to a database, that database is that server, that virtual machine is going to be underutilized over time. So what we're doing with consolidation is running multiple databases within a virtual machine or what at Oracle, a virtual cluster, we do everything on clusters. So multiple machine, multiple databases within that will drive up the utilization and improve your cost structure. So it's a sizing, it's absolutely critical on even in the cloud. Okay, but wouldn't, I might say to that, wouldn't it be better to have each database have a dedicated VM from a performance perspective? It doesn't try to make the database do too much effect performance. Yeah, so whenever, so we know historically that a database on a dedicated server, back in the day that was a physical server, today it's a virtual machine. When you do that, your utilization will be in the range of 15 to 20%. And that's very highly underutilized systems when you do that. So we don't need to isolate things onto dedicated virtual machines for a performance perspective. There are other ways that we can manage that. We have resource management built into Oracle and on the Oracle database and then on Exadata we have an integrated IO resource management as well. So we can deal with that different ways. Okay, so you're basically proposing that you're putting these databases onto a single VM and managing it accordingly? Additional details you can provide on that? So, we don't put everything into literally one VM. You want to have some isolation built in there, but say and take a more pragmatic approach. Like every single database in one VM, that's the wrong way to go. Each database in a dedicated VM is also the other extreme is also the wrong way to go. So we're kind of right down the middle and be more pragmatic about it and do some level of consolidation to drive up utilization. I remember when I first started following tech, I was studying up on kind of how this drives work and so forth and there was probably like, I can't even remember what it was. It was like probably like 10 megabytes under an actuator and people were saying, oh my God, that's so much data. You got your blast radius is so big. You got to split that up. So it's the same concept apply with availability. Some would say there's a problem because you're consolidating all this data and you've got this blast radius that increases. How do you address that? So, redundancy. So we have redundancy at all levels. If you look at a single, so we're talking about Exadata here. In an Exadata machine, we can lose up to 24 disk drives out of 30, this machine with 36 disk drives, we can use 24 of those. So that'd be 12 per storage cell. You can lose two storage cells as 24 out of 36 drives that we can lose and keep on running. We can also cluster, we also do clustering. So the database servers are clustered together for high availability. So we can suffer multiple simultaneous failures and keep on running without performance impact either. So it's, so recovery, we handle that in different ways. So it's look at blast radius from a standpoint. We, you want some, some isolation for blast radius, but we have physical failures. It's just not something that we're concerned with. Why do you deal with taking down a VM? Doesn't that normally mean there's going to be some kind of disruption? Oh, so, you know, the Oracle database, we're talking about real application clusters on Oracle database on Exadata. We've got, we have a very fast detection of failures and then resolution of the failure. So we're looking at a small blip in performance. You know, we're looking at a few milliseconds to detect failure and then maybe up around three seconds to actually affect the failover. So applications that are not getting disconnected, they continue operating in that kind of condition. So that's kind of unique to the Exadata platform. And so, you know, in our cloud, we're running Exadata. We have this built in there. So we're resilient to that type of failure. So. And sorry, you mentioned real application clusters. You're saying because you're running real application clusters, that's how you're able to become more resilient. So yeah, so we have a, so Oracle database, real application clusters runs on top of a clustered, you know, clustered virtual machines on Exadata. And we have integration that optimizes the failover times of that clustering. So it's not the cluster's same. It's the optimizations are only built into Exadata. So we have much faster, much better, tighter integration. So much more scalability because of that integration that we have. Can I run Rack and other clouds? Can I put that into Amazon's cloud? So real application clusters requires two things. You require shared storage in a fast interconnect, a fast networking interconnect. And those things just don't exist in the other clouds. We have those built into Exadata in our cloud. And we also, we also allow real application clusters in our relational data, our database cloud service offering as well. But it's really the highest implementation of that is in Exadata. Well, of course I was tongue in cheek joking, but this is why I was listening to Arvin Krishna the other day in IBM Think, and he was saying only 25% of mission critical applications have moved into the cloud. I don't think it's that high. But what you're doing is basically building a mission critical cloud or a cloud for mission critical databases. And that's unique. I mean, I would expect other cloud vendors that eventually are going to get there, but you're kind of starting with the hard stuff and working backwards. But that is what I've always interpreted as is unique to Oracle. But how does that affect cost? Isn't that more expensive? I actually know it's that we're taking services that start out at a very similar price point. And then we drive. So what we've seen from other customers that are running in like Amazon, for example, we're seeing databases on dedicated virtual machines. They'll run anywhere from 15 to 20% utilization. So what we do is that low, low utilization, what we do is take that and in triple that. So we run maybe 50% utilization. At that point, we still have full redundancy, but we've now made the service one-third the cost. So we're starting at the very similar cost and then we drive it to three times utilization. This is not crazy numbers. This is 50% is fine and retain the redundancy at that level as well. Got it. Well, so we've seen is about a third the cost. Really? Okay, well, so, but what about like, for instance, on AWS, couldn't I run this in a multi-availability zone running RDS or some other cloud database? So you can run a multi-AZ environment like in Amazon, for example, you can run locals, that's what we call local standby. If you do that, you're now, instead of being one-third the cost, you're instead of being three times more expensive, you're now six times more expensive because that is another copy of the entire platform, the entire instance, the storage, everything on the other availability zone. So you're saying- So instead of being three times more, it's now six times more. Because you're essentially replicating everything in a brute force mode. Yeah, it's a data guard standby, local standby in another AZ or what we call an availability domain in our cloud. So let's maybe geek out a little bit. So let's talk more about availability. For a year, I remember going back to reading about this stuff with tandem computers, coincident failures, how are you dealing with those in today's modern world? So what we call simultaneous failures is on, so we deal with that with redundancy in the system. So we have redundancy at all layers in the storage. Like I said earlier, we can take across two storage cells and each storage cell has a dozen drives. So that's 24 disk drives. That's eight flash card failures simultaneously. And we keep on running, no data loss, no loss of service. That's at the storage layer. We have multiple redundant networking switches at the networking layer, the internal network. Then we go up into the database server, we then have redundancy across the nodes of a cluster. They have multiple virtual machines that comprise a virtual cluster. So it's at each and every level we have redundancy and then we drive the redundancy into the application using what's called application continuity. So the application connections have knowledge of the failure modes of the database that they can follow to the surviving node and continue operating. And you do this with math? You're doing some kind of magic bit slicing or how do you do that? So that is that particular thing. Application continuity, some technology that's been built into Oracle Database since 12C. And it's been around for quite a long time and it allows the application to follow the Rack cluster, any kind of issues with the Rack cluster. We can drain connections off. It's very well proven technology. And prior to proactive maintenance, we can drain connections over and then it will also handle a failure of the connection as well. So the application is following that. I learned from my old mainframe days of David and hanging around with David Floyers. Just always ask what happens when something goes wrong? It's all about recovery. And you guys have the gold standard there. I mean, we've talked about this a lot. So you got Exadata and that's what is behind your Exadata cloud service, X8M, I think you call it. And you got Autonomous Database. I'm not great with model numbers, but talk about the way you can handle simultaneous failures. I mean, are there like triple redundancies that you've built in? Yeah, so everything we're, what we do in our cloud is everything is triple redundancy by default. So we, you can suffer that way. We can suffer two failures and continue operating. So the other thing, so recovery, if you don't get transaction recovery, when a failure occurs, the transaction will flip, that session will flip to the machine that keeps running it will reposition all in the work that's in flight, any kind of in flight transactions, any in flight queries that are going on, reposition and continue operating. So you've essentially created like the old three site data centers, but you're in a single platform, of course you're a synchronous, but that's on the same concept in a package. It's a lot of times you show a picture of an Exadata, it looks like a single box, but in the box there's redundancy built in the box. And in fact, in the cloud, it's actually across an entire aisle. So it's, we kind of obscure that a little bit from this. You're provisioning our database nodes and our storage cells and in the cloud, but it's actually across an entire aisle of a data center. Okay, and of course that's within a synchronous location. As he says, let's talk about disaster recovery and what you're doing in that area around Oracle Cloud. What kind of, what are my options there? What's different from other cloud providers? We were talking earlier about AZs. How are you different? And what are you doing there? Yeah, so we talked earlier about the multi AZ deployment, what we call availability domain AD, so a little different terminology, but we can deploy another copy of the database into another availability domain if you like. It's not often that you lose an entire AZ or AD, it's more for protecting from regional failure. So across another region, and that's where we look at, we really look at that as that technology as a standby, as a data disaster recovery solution, not for HA. HA, we build HA into the machine itself. So you're saying, you're saying, we were talking earlier about AZs, you're saying that's for HA versus DR? Is that what you're contending of? Yeah, like the, again, we're, pick on Amazon for a second here. Amazon uses a standby database, what we would normally use for disaster recovery, they're using that for availability, and you're looking at a few minutes of time to flip over to another AZ, whereas within an exadata frame, we can flip over in milliseconds, where we keep, continue running, there is no loss of connectivity, and then we use the standby in another region for disaster, that's a true disaster solution. As opposed to incurring that penalty of latency or whatever to spin up the other resource. Right, right. Okay, so that's clear how kind of you guys address that challenge. Last question, maybe you could give us your take, again, folks coming out of Oracle's mouth, but what's the bottom line cost delta based on your experience between your service and competitive services? I love these conversations, because you're not afraid to talk about the competition, so bring it on. I've seen, so we've just based on what we've seen with customers deploying databases in Amazon versus what we've replaced that within in our cloud service. We're seeing from just a list price perspective. Now, we discount, I know Amazon discounts, but the only thing I really speak to is list price perspective. It's about a third the cost. So we're talking about a more powerful platform, runs faster, we get these incredible, we haven't even talked about performance here, talk about availability, performance, we're getting IO rates, IO latencies in the 19 microsecond range now with Exadata. That's going to be 50 times faster than what you get with these traditional cloud vendors, so much, much faster and a third the cost. So you're talking about discounts, I mean, I know Oracle discounts, Oracle, from list price, Oracle provides significant discounts. I'm not as familiar with your cloud pricing, but I mean, Amazon's discounts are really in the form of like reserved instances. Is your pricing similar in that regard? I mean, if I'm just paying on demand, I'm paying through the nose. I presume it's the same with you, but if I buy in bulk, I'm getting a discount. Is that what you mean by discount or is it more similar to the way you've traditionally discounted with large customers, the more you spend, the more you get kind of thing? There's a discount structure, so we don't have the same kind of lock-in like with reserved instance structure, but yeah, there are discounts and that's going to be very customer specific. So, but I think the end result we're starting at a 3x differential on the price. But the reason I'm in question is the stats you gave me are for list price, right? Yeah. And okay, I'm sure you're saying at a list price, you're less expensive. And again, my contention would be just by experiences that your discounts would be more aggressive. Traditionally in Oracle's traditional business, I've done a lot of Oracle negotiation in my days and if you're a big customer, you can get good deals. And again, I'm not as familiar with the cloud pricing, but still, that's good. If you're doing it on a list price basis, to me, that's a conservative statement if that makes any sense. Right. Yeah. We know that's where it's starting out. So, once you get into discounts, it's very customer specific, so. Right. We know the starting point is the 3x differential. Got it. Before you do something, the multi-AZ would be a 6x differential, by the way. So. Yeah, okay. All right, Chris. Well, hey, I appreciate you taking us through this. Good stuff and best of luck, good work.   So, good job. All right. All right, thanks. Thanks for coming on. All right. Thanks. Thank you. Thank you for watching everybody. This is Dave Vellante for CUBE Conversations. We'll see you next time.


It's everyone's favorite time of day. It's meme time guys. Welcome to the channel. My name is agent zero It's your first time here man subscribe to the channel if it's your 10th time here You're not subscribed. Well, then you're just hurting my feelings at this point. The button is down Below god damn it. I asked you guys to send memes because I was bored I put out this tweet saying memes time for some good quality mba 2k 21 memes and you guys sent some And so here I go authorize meme writer on the internet about to review him Uh, let's get to 30 000 likes for no reason. It's not gonna help the video at all guys zero What's that agent from a couple hours ago has something to say I'm great at this ad stuff. This video is brought to you by keeps Did you guys know that two out of every three males will experience some kind of male pattern baldness by the time they're 35 That's such a cyclopean number keeps has revolutionized the way that men are treated for hair loss And on top of that they simplify the entire process. What you need will be at your door every three months There's no long pharmacy lines or awkward doctor visits when it comes to hair loss prevention is key You can take four to six or more months to see results. It's the fellas what you wait for hey The price is incredible and the product is too. So then what are we waiting for? I feel like phil jackson leading his team into the mba finals right now The link is on the screen right now and in the description go to keeps dot com slash agent zero zero to get 50 percent off your first order of hair loss treatments 50. That's a real number guys 50 percent hey keeps Thank you so much for sponsoring this video and supporting the channel and let's get back to it First meme you hear you sent this one, huh? Okay. It's a photo of lebron looking at two phones Oh, my phone is cracked by the way guys. I'm gonna get a new phone I'm gonna get a new phone You see it. It's cracked. Do you guys see it? How to trade a player in the middle of the playoffs how to teach someone to remember to score How to shoot a how to stop team? This is not funny. This is so Unfunny not is it not funny, but it's also not even remotely accurate They've made it to the goddamn western conference finals. All right. What are we talking about right now? He doesn't need to trade nobody bad meme to start things off two out of ten Guys, don't let me down. I just dropped a video earlier today double upload day Uh dropping 100 points on program So a link in the description if you guys missed it, uh 2k is grand plan and it's a forage tweet here saying We heard your feedback about the shot meter and we're happy to announce the new 2k glasses starting at only 24 99 these glasses allow you to see the shot meter get yours here Look at these right here ladies and gentlemen. It looks a lot like the glasses that I own I usually use this to stop seeing things personally, but these ones here amplify your vision. What a tool I'm gonna throw this one in my tech bag. I carry around with me If you guys want me to drop what's in my tech bag review mkbhd style drop a like I have a very big tech bag and this is gonna be in it now. Uh, this is uh, this is kind of funny It's funny because of mike wang's tweet telling us to zoom in if we want to see the shot meter better Mike, we know that's not a real solution. Mike. Why did you just say that to everybody? He sounds silly cut it out. This is a good meme nine out of ten Uh j sends in this one here. We have ea sports in a ship on in the sky the ship is in the sky How do you get one of these? I got to get one of those and he's looking at another ship in the sky a decent basketball game This is such a like an innocent meme. Oh my god. This is like a meme that was might have been relevant six years ago It's so sweet. This is like a sweet innocent meme.  Just like it's right here. Yeah, that's that's what this is right here He's giving me good vibes man seven out of ten. Uh hype tv sends in this It's not even a meme. He just sent a caption. That's a period and just a whole lot of pain This is gta san adreus that what we're looking at vice city. What are we looking at here? I could see the polygons in his face. So I know it's at least 15 years old This is a lot of pain going on right now g-man would be so proud of this guy. I have no doubt about it It's not 2k, but I think it's funny. So uh, here's westbrook saying f they talking about and look guys It's the audience. He's referring to Westbrook be just weird bro. Westbrook is on the court making a fool of himself daily.  All right.  I love you and bead feel better soon as it relates to this meme though Two's guard good meme accurate. It's good. It's not great. It's not bad. It's good It's solid solid memes always get a seven out of ten Hey, if I have low energy is because I just played against davante free good in a 1v1 I keep trying to tell y'all to subscribe to my second channel. I don't even drop in jams on there Hey, it was a dope video. Uh, link in the description for all of that me running through the gatorade facility Davis Why do I do that?  Hey, uh, that's funny. That's just good. That's good quality stuff right there man eight out of ten We be doing weird stuff on the channel. We have we have the weirdest youtube channel in the community Did you guys know that like what is this video?  I can't tell what kind of face this is though This is not really a crazy meme. Maybe I just don't watch enough things going on Who's shooting five from 82 not just seeing me drop a hundred point performance on a pro I know I'm not doing that. Is the youtubers is other youtubers you guys are watching shooting five for 82 guys Leave a comment. Who is this youtuber? I don't know what this is the squad when somebody with no badges tries to hop on the spot I love this meme people need to use this more here. We have brawny We have duke and we have solomonati and they all look Pointed this is the ayo.  This is it right here. Uh, it's accurate Yeah, you feel me, but it's it's missing a little bit of funny I feel like it couldn't you just didn't eat it on the mark the mark the way you should have The top response to that was I believe this is more fitting and it's a video of cash nasty Or fitting the original wasn't six this one right here fellas Nine and a half out of ten great stuff me when I couldn't change my camera in the prelude. What's going on? What is wrong with the cameras man show the angles right? That is called broadcast camera people stuck in the past still use it just let you know Yeah, this wasn't struggle. It's accurate But it's kind of dated the prelude was so long ago flights burner. He's holding on to this one for too long I because it's dated. I can't quite give it the funny rating. I was anticipating I was going to be an opportunity to give it guys. Listen, I'm just being real with you guys. I only do it real Seven out of ten me after playing ticino and getting 21.  This is just a youtube video I'm kind of pushing it with these words. That's my fault guys. I bought a dictionary recently I'm trying to get this webster sponsorship. You feel me? I am trying to put everyone on game. The english language is crazy This meme though, it's quality. I give it a cool quick little Eight out of ten, buddy. Good. Uh me and my squad headed to the paint when we see the other team has no shooters Okay, I like this Yo, we've been having too much fun these a&p shoots, man. Hey, listen a&p videos We drop from every Monday group feel me me dupe phantom kai davis, uh christ Wallet low up maybe not low. He's not really a&p. He said he didn't want to be a&p.  I hate when people do this, but it's funny So nine out of ten Mike Wang when they buff shooting after he said he wouldn't touch it Look, he just went back into the office like guys I just told him I wasn't gonna do that.  Yo, this photo illustrates this so perfectly I can't think of a better way to craft this meme. It's not killing it in the funny department, but it's so accurate It just naturally has enough funny for me personally eight and a half out of ten when 2k fixes the sliders for shooting Yo guys, I found this photo, um in a vlog phantom did like a year and a half ago This was me. This is not editing guys. Look how wide I was. Hey down 110 pounds total now fellas I remember this though. This was a dope trick. The meme though is horrible three out of ten you after the Raptors game Oh, this is davis. Um, let's not talk about it guys You feel me and shout out to the thousands of people that felt it necessary to reach out to me and mock me I was having a rough day already and you guys made it worse It's whatever though. You see me smiling to the pain on my Kanye type It's fine. You know Pascal didn't even want to be there. I could tell by the way He kept turning it over in the fourth quarter every playmaking. Oh I'm saying just just want to look real official iPod when I came through to rate your meme iPod You have let us down in more ways than we can count you feel me. Don't let me down to date the bar It's real low.  Yeah, we did but we're back at it. Don't mess this up pot every playmaking shock crater in 2k 21 After the curry slide behind screens and here we have lamello Yo davis, I need your help for a video. I need your help for a video It's gonna take two seconds iPod send a meme. This is what it says every playmaking shock crater in 2k 21 after the curry slide behind screens And it's a photo of like 13 year old lamello. That's it. iPod them. What would you rate it if you had to? Oh Well, davis Yeah, no doubt appreciate you man. Oh, it didn't come from me this time. God Damn it. You can't send memes no more buddy You're not allowed Do you not care about anyone in the community? Do you not see what you're putting everybody through every time you send a meme negative 13 out of 10? That would be it verified the worst rating in the history of this show I don't want to do this video no more. It's killed my vibe Uh, and I don't know if there's a meme that's gonna save me trying to explain I'll be back. I need to take a break Sorry about the delay fellas. Just in case I catch iPod in and around these streets Guy be willing to take the shot. You feel me? Uh, because I've had just about enough iPod king carter I think we all have feel me. It's time this ends now. Don't worry. These are training arrows. They will just tickle him They won't do any harm. All right. We have a meme here me trying to explain how I went 0 for 9 Hey my Guys that was before now. I have good vocab back then I wasn't doing a good job of communicating my uh My feelings and stuff like that. I give this meme quality solid E 7 out of 10 2k after releasing a bad game and still making millions. Ah, let me do a typo for you Hold on. I got you right there, buddy. Oh right here. I got you. I got you buddy Oh, let me just make that adjustment billions now. It says billions guys because they make billions every year That's kind of crazy, isn't it and we still have bad servers I did it Link in the description fellas. Hey, that's good quality I almost want to put a hole in my door. I was so close to doing it guys, but the camera's not even oh, it is recording it Oh, wow. Okay. Uh, okay. I have to resist the urge now. Oh my god Hey 2k after releasing a bad game still making billions. We did it. Ah Solid seven out of 10 when my point guard thinks he's ticino and does a 360 spin hop step tap the tip From 1 for 16 I'm gonna kill your parents Wow Okay, hey, how come I keep seeing this guy on the internet?  That's accurate. Is it accurate? Yes, it is. I just said it was pay attention Yep, is it funny kind of a little bit funny solid not even solid a little above solid is better than average But it's not great. It's just good. It's just a bit 8 out of 10 toasted uh 2k fixing gameplay problems versus 2k fixing vc glitches Yeah, is it the first funny meme toasted ever said toasted who'd you take this from buddy? This is gonna be the best rating you've ever gotten man But this is the 8 out of 10 me after my opponent hit this toasted again Me after my opponent hits a full white for the 10th time in a row Yo toasted who are you stealing from bro? It's not you buddy. It's another 7 and a half out of 10 Hey, if I get a 10 out of 10, I'm putting a hole in the wall. All right Oh, this Joe knows play shots after hitting their ninth white fade away in a row Hey, that's solid is not great, but it's just not average. It's not bad. It's not great It's just solid. You know what solid means get let me get that 7 out of 10 me when a non-shooting build makes a full white This might be the one guys. I might have to get ready to shoot the door. No, no Say you swear to This is good. It's just so quality. That's a nine out of 10 when an interior finisher gets his post scoring takeover Run through somebody's face. A lot of people ain't gonna be able to take that over and over and over over over over Over and over over how many more times And over and over and over and over and Over and over and over and over and over and over And over and over and over and over and over Hey Marshall Lynch is one of my favorite people. Please Marshall I would love to just shake your hand All right, man. Please. I'm desperate. Look at me I have a bow and arrow in my hand. I'm in my setup shooting a youtube video like look, look I don't even have good form like you can't even Couldn't even tell like I don't I don't have Like good form or nothing like that. I'm just a guy. You understand where I'm coming from Marshall Lynch Let me get that back Looking at the whole team camping to paint in park being a slasher Yeah, this is one of the best GTA games I've seen in a while, man. Oh my god Yo, when you start to think about it, it's like oh Like it's a wrap for me I'm gonna have to click up in square at a high velocity. You know cuz that's all slasher's do Hey, that's a good quality meme I want to give it a 10 because it's not perfect, but it's so close to perfect I can't help but give you a nine and a half out of ten. That's it for the memes guys If you guys are new to the channel you haven't already be sure to subscribe videos on the screen right now Hey, I play my ones versus Devontae Frigga. I'm gonna leave that link in the description as well AMP video We did a speed dating video. I'm gonna leave that link in the description below and Peer to peer we actually uploaded a podcast with Devontae man. It was a great time One of my favorite podcast actually be done in a while that link is also in the description content out to ask double Upload today. I'm gonna catch you guys in the next one. I'm out peace


I'd like to introduce Vladimir, who's going to be discussing writing side channels for processor software, sorry I screwed that up, writing POCs for processor software side channels, which you know, leading off the previous talk around zombie load seems like a good planning. All right. Thanks. All right. Hi everyone. So a little bit by myself, I live in Portland, Oregon. I'm a security researcher slash hardware hacker. Well, it wasn't like that for past five years I guess. Yeah, past five years I was doing, basically started doing hardware and so on, so I built up the lab and then like this year I got the SCM to do more hardware actual research, instead of doing some software that they started off with. So how did it start, you know, like I got interested into one, when I heard about the vulnerability, I say L1TF, which stands for level one cache terminal fault. And the researchers, so the previous speaker talked about their independent research that they did, they found the vulnerabilities based on that. So when this vulnerability came out, I started to look at it and then got really interested because leaking L1 cache is a really powerful thing, as it was demonstrated before. Because well, not just that, but also Intel really relies on level one cache to do things like loading ACM modules, for example, and like other things. So they can mark cache as a RAM, for example, right, and do other things. So I wanted to create, make a POC for this to make a reproduction since there was no POC online yet when the vulnerability came out. So when we have memory accesses, I haven't made that diagram, you know, very simplified. We have virtual address, you get a page fault, when the processor receives the page fault, it looks up the page table, does the page walk, it looks up the physical address in the PTE. If you're running in a hypervisor, then that address is taken and then is looked up in the PTE, which is extended page tables. So that's how hypervisor enforces the memory mapping. Then that address is converted into the physical address and then physical address used to address the information in the caches.  So what the researchers found, actually, when the fault happens, for example, when you like set, you know, you initialize the PTEs in the wrong way or you're trying to access invalid memory, the speculative execution engine keeps executing instructions in the background, because there is this synchronization issue, the signal did not, didn't get received in time, so you have a couple of cycles that when it starts executing, so it keeps executing for a couple of more cycles until signal is actually delivered, no, the fault is delivered. So and as we know from previous research of a meltdown, the speculative execution engine does not actually check anything, it's basically yellow, you just take the instructions and so it has only very limited set of instructions that can execute, so if it reaches the instruction that it doesn't know, like some hypervillage or very complicated instruction, it will stop executing, but simple instructions like move, add and other operations, it can execute, but it does not perform any checks, like as a typical execution engine, so what happens is the fault happens, the executing engine takes the page frame number from the PTE and treats it as a physical address directly without checking anything, and then from then on, you go and look up in the L1 cache, and if you have that information, now you can use it, and from what previous talk was talking about, you can leak the information. Same happens with the EPDs, which is even worse, which is even worse because when the translation happens, it's supposed to check the EPDs and that physical address, well since it's not going to match, you're not going to be able to get the information you need, and you get the execution going to stop, but since you're getting directly the physical address, it's treated as a direct physical address, you basically can read any memory without, you can read any memory as long as it's in the cache, so you can read it in SMM or VMM or any other mode, as long as it's in the cache, so I've been writing POCs, I did actually work for Big Blue, but I did not know about L1TF because I already left them, and so I've been writing POCs for quite a while, and so this is, I made a list, like what you kind of want to pay attention to, like if you're trying to make a reproduction proof of concept, you like either could use the, either could use already available POCs, like on the GitHub or not, or start your own, right, so like first thing is you're code going to be messy, like you're going to be experimenting with lots of things, you want to use like some source code version control, right, you're going to get bugs and like just stupid mistakes, so you, yeah, just be patient, right, and so the third one is really important, when you think that, oh, you found something interesting, you want to really test it against false positives or false negatives, you want to make sure you have a consistent behavior, so let's say you found something and they're like, oh, it's leaking some information, well, does that information really make any sense, right, so you want to look for patterns, like, you know, typically, so the cache organized in the cache lines, which is a size of 64 bytes, for example, right, or it can be like RSB, like a return stack buffer, which is 16, or any other, like, internal structure, typically, that is not necessary, but typically is in the power of two, right, so like typical bug you might have, like, okay, you're getting some results, but like it's like spitting out like infinite amount of like just random bytes, that doesn't make any sense, you know, yeah, you want to look up the CPU structures, like, okay, you see some, you see the leaks, but that information, not necessary is like power of two, or you don't see any familiar patterns, right, you want to, like, depends on what kind of you're going after, you want to make sure that you check the manual, right, so if you have a CPU that supports TCX, the transactional memory extensions, you want to use that, so what TCX does is it suppresses faults, so even if you do the, if you access some invalid memory, it will not actually raise an exception, CPU internally is going to suppress it and let you know, so you can do that programmatically without actually raising the exception, that will make sure that your sample cache or any other structures not getting polluted by other threads, yeah, so if you, let's say, got some results, you might want to do some visualization and graphing to get some kind of outliers or, like, averaging of your results and so on, run multiple iterations for your tests, like, you're not going to work just no single run, you want to, like, run it multiple, you know, thousands, 100,000 times to get better results and use, like, a CPU instruction to flush the pipeline, so as we've seen previously, right, like, Intel releases the patch, they introduce, like, oh, we introduce a new MSR, what actually it does, it invokes the microcode, right, and which is really expensive, so a CPU is going to do the same thing, it's going to actually flush the instruction, but see if the idea is you can call from user mode, so you don't have to worry about running, of course, I'm making development of the current module, right, so as I started to look at the information that Intel provided for this, I noticed that, well, they claim that the L1TF can be triggered only when the present bit is not set or some reserved bits are set, well, so like, just thinking about it, well, if I access invalid memory, for example, right, that means that the present bit is not set, right, but what's that say, if I do the right to the read on the memory, right, it should also raise the exception, right, so it should raise the page fault, why did not, they didn't mention that, so I started really curious, like, it's kind of weird, like, if vendor tries to provide the information, they should provide all of the information, I mean, I don't know if it's really, like, they just didn't see it as a attack vector or whatever, you know, like, for example, for me, attack vector would be really easy, you provide the read only memory to kernel, and kernel tries to read from it, and then maybe you can pivot or find the gadget in kernel that will do the load, it's for you, meanwhile, you're in the other thread trying to monitor that memory, so, you know, as I was validating my results, I found that, well, you know, like, if it's in the cache, right, I will get the really fast accesses, but how to make data not being in the cache, well, you see a flash, you flash the cache lines, right, so make it not being there, I found that, well, I'm flashing it, but I still see some leaks, so the first numbers are just number of those iterations that I mentioned before, you want to run your attack, you know, as many times as possible, the other one is just, like, page for old CPU number four, and for some reason, the same byte was leaking, and just information about the clocks, how many clocks did it take, right, so, in case of false positive, I shouldn't have seen some, like, fixed number, fixed byte number that has been leaked, right, like, if it would be just false positive, I would get, like, just random numbers, like, I don't know why it's zero two for me in this case, but, I mean, that's how it was, and then I was like, well, okay, this something is not wrong, like, I mean, something is wrong, like, how do I, you know, how do I confirm this? So, so I decided, okay, the CL flash is not working for me, so what do I do? Well, I mean, marking the memory as uncashable, obviously going to be the solution, because that's the only way to make sure that it's never in your cache, because it should not be in the cache, otherwise, we have a problem, right? So, and actually Intel mentions on their website that there's a mitigation, you should, if you're able, you can store some sensitive information in cacheable memory, since it's not going to be in the cache, right? So, it's like a perfect solution if you want to keep the secrets, right, and then this is from their optimization manual, saying that the speculative execution will never access the uncashable memory, or they're never going to take a trap or folder trap. So, as I was playing with the uncashable memory, I started to see, well, it's still leaking the information, and like, I used like, I just filled the memory with the, you know, EE pattern, and like, it, it would, it popped up there, which is like, it doesn't make any sense, right? So, I was digging to the manual a lot, like, I'm not a hacker, I'm not going to read 600 pages of like, just optimization manual, it was really frustrating to be honest. I found a, I found the, like a hint on their actually form, somebody was asking about the buffer, the these internal buffers, like you actually never heard of, because I'm not the security architect, or not the CPU architect, right? So, as it was mentioned before, you know, these, these buffers said basically, you know, between the register and the cache, but then if you have an cache memory, where does it go? Cannot go in, cannot go into the registers directly, right? Because otherwise it will be really, really slow for your uncashable memory. So, that's why, like, you know, they have, they have buffers there. You know, and it was making perfect sense, and especially because, well, these buffers are, you know, they're really tiny, right? I mean, they're not that many of them. So, that's why the results are really, really slow. So, you saw the video previously, right? The attack works, but takes time, right? So, finally made a proof of concept for what Intel called as the MDS, which is a microcredential data sampling. I made the proof of concept, the first DICI process puts the secret into the memory, then waits for the attacker to try to read it out. And they, they, they are on the same, on the same core. So, the buffers are shared between the physical threads, right? And so, you can, you cannot see it on the, on the, on the image, but I'm going to run the proof of concept right now after the next slide. The, the data that is getting leaked is actually equal of 64 bytes that exactly confirms that the, it was the size of the, of the cache line. I don't know if you can see on the, on the slide there. Oops. Sorry. So, I, I couldn't defend the screenshot with the debugger, but so, you can see the patterns like 7F, F6, 7F, FF. If you would compare 7F, F6 again, if you would look it up, these are actually system addresses of the kernel modules, or not kernel, but the user modules. So, these were actually, you know, like return addresses or something. They were matching, they, they, they are matching the, you know, the attacker process or the, well, the victim or attacker process. You know, so, so, right, so the next thing, okay, the school, we can do this attack, it, but it's kind of really slow. So what the, what the researchers did, right, they tried to leak the ETC shadow doing this. But how do you actually prime and make sure that, that, that what we saw the ETC shadow is in the, is in the cache, right? You repeatedly relaunch the, you know, password utility to make sure that it's there and get that race condition between these two threads and try to leak the, try to leak the hash. So like it is powerful, but I would say you're going to get detected. Like if, if you're like in the real environment, like it's going to be noticed like even your system, they're going to notice that. Like it's going to raise the alert, right? Other thing, in the, in virtualized environments, I don't know who does that anymore at this point. But nobody offers your VPS. Well, if they do, you shouldn't be using it. Nobody offers the VPS that schedules tenants on the single thread and they share the other thread with somebody else. That's basically just asking to get bound through using this. Like even, even if you have a mitigations like for KVM or Xen, when you, when the exception happens, you're going to go in the exception going to be processed by the host, right? You will be able to attack the actual host on the server because of like IRQs and other stuff that is getting processed. Yeah. So the POCs and the slides going to be available. I'm going to try to run this here. All right. Awesome. Nope. Nope. I don't see it here. All right. All right. So we have a first process just, I made this thing just for synchronization to make it easier. All right. So it should come up pretty fast. Yeah. Here we go. Yep. Yeah, I can see the secret string that I put in there, getting licked.  And the rem just, you know, stale or remnant data that is being in the buffer. Yeah. Okay. So what do we have? All right. Actually, when I reported this to Intel, I said the the leak happens from like a load and store buffer, which is incurred, which it was incorrect actually. Because yeah, as I said before, I'm not, I'm a hacker. I'm not going to read 600 pages. It's too much. All right. And actually, the guys from TU grads, what they call the meltdown you see, founded much earlier before that but they have they haven't shared the information in the details. What was going on? Yeah. So yeah, you really want to validate the results that that that you're seeing, right? May you might see the CL flash, okay, it's flashing, it should be flashing, right? But it's hard to say the if you're still flush actually flushed it or not, or maybe it was already pulled by by the speculative speculative execution engine into the cash again, right? Because the CL flush is out of order. It's only in order for the other all of the other seal seal flush instructions. So I I put the link down below here. This guy actually found this behavior. And there's a whole thread about it on Twitter in January, even so even before the TU grads mentioned it in their paper, that while he's seeing the same amount meltdown you see, but he was using that seal flush. And I actually haven't seen him as being mentioned on the Intel reports. I'm guessing he did not reported to Intel, or Intel may have missed it in the in the TU grads report when they reported the meltdown research, or other reasons. Well, yeah, you know, like, after after the after the the same DS came out, I actually went back and looked Oh, why it's actually in the fill buffer. And then I found that I was looking in the wrong keywords, that I was looking for an un-cashable memory. But what actually also calls it, they call it as a non temporal store. You know, that that that that's what basically the un-cashable memory means. So they use, you know, terminology that is hard to follow sometimes. And the diagrams don't really make any sense sometimes. Yeah, so you don't want to jump to conclusions, basically, right? And then the last one is, I would take research was a little bit salt grain of salt, because we don't really have any tools how to check this and check any of these buffers or or internal structures. Even if you have if you even if you get the J tag, it doesn't allow you to do that. Like, you would need like, think what what Intel calls a red unlock. But so there are some details online that now available that provide some information how they read unlock can be achieved. So guys from positive security from Moscow that they do lots of research on the PCH and ME and so on. They were able to enable red unlock, which is basic factory unlock. But there is no software available. Like, even if you have it, you don't know how to talk to the CPU, because there is no information. So and then that's it. Thank you. And as always, if you have questions, but it will be in the courtyard in a couple minutes.


Hey, sect-goers! Ever wonder what the secret to life was? What's the key to finding real, lasting happiness and fulfillment? Or how to make all your dreams come true? Chances are, you probably have. But what we don't realize is that figuring out what doesn't make us happy is what's holding us back. And getting in the way of everything we want. So here are five of the most common things we struggle with that hold us back from living a great, fulfilling life. Other People's Opinions Are you always changing how you act and behave because of what other people think? Deep down inside, you may know that you shouldn't let other people and their opinions dictate how you live your life. But it's also only human to crave love, acceptance, and approval. This desire to belong and to receive validation from those around you may make it easy to make the mistake of changing who you are. To accommodate the people you care about. But caring too much about other people's opinions to the point where you don't even get a say anymore in what it is you want to do with your life, may only serve to trap you in a life of regret and resentment. Aside from the opinions of others, you may also be guilty of letting your attachments to other people keep you from living your best life. Perhaps you're afraid to move to a new city even though you really want to. Because you'll have to leave your closest friends and family. Or maybe you want to go to a different college or declare a different major from your friends because you're afraid you'll drift away from them. Although it's always nice to take the people you love into consideration when making big life decisions, it's equally important to consider yourself and what you want as well. Even if you may think it's selfish to do so, prioritizing your own needs and wants is important for your own happiness and well-being. Do you find yourself falling into the same problematic patterns over and over again? Even when you already know better. It's been said that until you heal from your past, you create from your past. By letting your past control your future, you may be stopping yourself from getting to where you really want to go. Real authenticity and happiness comes from making peace with your past. Letting it go and learning to be more intentional with everything you do moving forward. Align your actions with the future you want instead of the past you're trying to outrun. And you might just find that it radically changes your life for the better. Are you always looking for ways to hide how you feel? Negative emotions are labeled as such because no one ever wants to feel that way. Whether it's anger, jealousy, hatred or fear.  But that doesn't mean you should repress or deny them either. All emotions serve a purpose, so when you try to repress or dismiss them, they may only build up and overwhelm you at a later time. Instead, you may want to try to identify why you're feeling this way, learn from it and find constructive ways to address the issue and resolve it. American businesswoman and multi-millionaire Mary Kay Ash once said, Many people limit themselves to what they think they can do, but you can only go as far as your mind lets you. What you believe you can achieve. There's certainly a lot of truth to be found in her statement, because all too often you may find that you are your own worst enemy when it comes to achieving success and happiness. And one of the worst ways of self-sabotage is when you buy into your own limiting beliefs and let them control your life. Perhaps you think that you're only worthy if you have the love and approval of others. Or that life is only worth living if you do something great. Once you learn to overcome these limiting beliefs and start believing that anything is possible, you may find that your potential becomes unlimited. Did you relate to any of these signs we've mentioned? Let us know in the comments below. If you found this video helpful, be sure to like, subscribe and share this video with those who might benefit from it. And don't forget to hit the notification bell icon to get notified. Whenever Psych2Go posts a new video, the references and studies used in this video are added in the description below. Thanks for watching and we'll see you in the next one.