topic Re: R80.40 VSX VSLS (JHF Take 77) on Openservers has Multi-Queue and SMT enabled in Firewall and Security Management

R80.40 VSX VSLS (JHF Take 77) on Openservers has Multi-Queue and SMT enabled

JasonMcAllister — Tue, 22 Jun 2021 21:32:34 GMT

Hi All,

I've just upgraded a 6 member VSX VSLS cluster from R80.10 to R80.40.

Before the upgrade there was no multi-queue or SMT configuration.
Whilst multi-queue was supported on R80.10 because of the ixgbe driver, I did not have it configured.
SMT was well known to not be supported on Openservers, so also not configured.

The hardware for each member is HP ProLiant DL380p Gen 8.

After upgrading to R80.40, to my surprise I suddenly found 32 CPU cores instead of 16 CPU cores, and that every interface had automatic multi-queues.

The documentation suggests that both SMT and multi-queue are items you have to 'decide' to enable.

So, given I've not chosen to enable these myself... Is R80.40 now supporting SMT and automatically enabling it?

Each VSX Gateway in the cluster only has a license for 16 Cores, so I don't know how that affects this also.

cpconfig has no options to disable hyper-threading.

Is anyone else seeing this as a default behaviour?

Is this behaviour to do with the new 'automatic resource allocation' features?

Many thanks,

Re: R80.40 VSX VSLS (JHF Take 77) on Openservers has Multi-Queue and SMT enabled

PhoneBoy — Fri, 04 Sep 2020 18:37:57 GMT

On Open Servers, virtual cores created by Hyperthreading need to be licensed if you want to use them.
Hyperthreading has to be disabled in the BIOS.

Multiqueue is now enabled by default from R80.40.

Re: R80.40 VSX VSLS (JHF Take 77) on Openservers has Multi-Queue and SMT enabled

JasonMcAllister — Fri, 04 Sep 2020 18:43:22 GMT

Hi @PhoneBoy,

Thanks for the reply. TAC also managed to clarify although what your saying seems at odds with the message they gave me.

TAC have pointed me to:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk156793&partition=Advanced&product=Security

This seems to read to me that the license for cores is based on REAL cores and not SMT/Hyperthreaded logicals - Especially based on the last line of the SK.

I would appreciate your thoughts on this?

Best regards,

Re: R80.40 VSX VSLS (JHF Take 77) on Openservers has Multi-Queue and SMT enabled

JasonMcAllister — Fri, 04 Sep 2020 18:44:47 GMT

Just to add, I understand now that 3.10 Kernel honours the BIOS setting rather than having a setting to disable/enable SMT/HT in cpconfig. 😃

Re: R80.40 VSX VSLS (JHF Take 77) on Openservers has Multi-Queue and SMT enabled

PhoneBoy — Fri, 04 Sep 2020 20:53:34 GMT

The licensing issue was discussed a while back here: https://community.checkpoint.com/t5/Enterprise-Appliances-and-Gaia/Does-R80-40-support-HP-DL380-G10/m-p/74920
Entirely possible this has changed since that discussion took place.
@Guy_Israeli can you clarify as it seems sk156793 contradicts what we've said in the past regarding licensing and Hyper-Therading on Open Servers?

Re: R80.40 VSX VSLS (JHF Take 77) on Openservers has Multi-Queue and SMT enabled

JasonMcAllister — Fri, 04 Sep 2020 20:55:44 GMT

Thank for checking, despite my license being "CPSG-8-C-U CPSG-8-C-U", I have noticed coreXL seems to have put the 16 extra into use from the looks of it in fw ctl affinity -l and mq_mng --show.

Re: R80.40 VSX VSLS (JHF Take 77) on Openservers has Multi-Queue and SMT enabled

shais — Sun, 06 Sep 2020 07:31:18 GMT

Hi,

I would like to add my input and verify all is clear.

Since R80.30 3.10, we do not have any option to disable SMT via code, this is something we aim to change in later versions.

Since open servers did not support SMT up until R80.30 3.10 we added, we created a code in R80.40 jumbo to disable SMT when upgrading for non-R80.30 3.10 via the blink option.

Since VSX currently does not support blink, you received SMT enabled by default.
This is ok and supported now but in case you would like to disable it again and keep the same configuration you did before, you should disable SMT via the BIOS.
In later versions, we will add such support in CLI.

Regarding Multi-Q, as was already answered below, supported by default

Re: R80.40 VSX VSLS (JHF Take 77) on Openservers has Multi-Queue and SMT enabled

PhoneBoy — Mon, 07 Sep 2020 06:07:19 GMT

Can you confirm the licensing issue (i.e. will an 8 core Open Server license officially support 16 cores with SMT enabled)?

Re: R80.40 VSX VSLS (JHF Take 77) on Openservers has Multi-Queue and SMT enabled

Guy_Israeli — Mon, 07 Sep 2020 10:49:06 GMT

Currently (R80.40), license is counting only the physical cores, but in the future we will enforce based on the virtual cores.

Thanks, Guy

Re: R80.40 VSX VSLS (JHF Take 77) on Openservers has Multi-Queue and SMT enabled

JasonMcAllister — Mon, 14 Sep 2020 09:06:35 GMT

@Guy_Israeli thank you for the reply.

Can you advise on when R&D would be looking to change this?

I do not wish to be stung by applying a JHF or a major update and not realise this is being changed.

Re: R80.40 VSX VSLS (JHF Take 77) on Openservers has Multi-Queue and SMT enabled

Guy_Israeli — Thu, 17 Sep 2020 05:11:01 GMT

Hi @JasonMcAllister

We are planning to return the license enforcement back to normal in R81.10.

It will be mentioned in the release notes.

Guy

Re: R80.40 VSX VSLS (JHF Take 77) on Openservers has Multi-Queue and SMT enabled

JasonMcAllister — Thu, 17 Sep 2020 09:11:22 GMT

@Guy_Israeli thank you for clarifying.

Knowing this allows me to better plan for future.