DEC3920 / DEC3940 / DEC3960 CPU

[pfry]

Sorry, I meant your estimate of Wireguard and ZenArmor performance from their Passmark scores vs. the Deciso marketing materials. How do they look to you? (Another comparison.)

[dirtyfreebooter]

my latest testbed i had protectli vp2440 with N150, so with zenarmor (also noting this is variable based on how many things are in the policy, etc), with wireguard, testing with iperf3, i could get 2.2 Gbps upload, 1.7 Gbps download with 4-8 parallel streams. watching top, every once in a while you can see one of the CPUs go down to 0% idle, which is zenarmor on one core and wireguard over all 4 cores, hit a state where one cpu is totally consumed.

if zenarmor would ever bring multi-core to home edition, n150, would be a great 2.5g option, with zenarmor and wireguard (for home users where the # of connections is relatively low).

so seems like anything around 10,000+ multicore score could do 4 Gbps wireguard (without zenarmor).

but again, just post the specs and cpu model. i wasn't really asking for ppl's opinions on my setup or their opinions on real world performance, etc.  all of the numbers and testing are very install/situation dependent, so just knowing the model and benchmark scores, you can start there and do some napkin math to help you decide if its something you want to try or not. not saying passmark == exact real world performance.

why opnsense/deciso is so secretive about this is ridiculous, frankly.

[pfry]

I would prefer a formal (preferably third-party) review, too. (Although I'm not in the market for hardware - I prefer to assemble my own.) It may simply not be a priority for Deciso, and they may have the right of it - marketing is not one of my skills.

[dirtyfreebooter]

sales confirmed it the V3C18I cpu

[OPNenthu]

Is this a new platform, meaning a desktop variant could be on the horizon?

I would prefer a formal (preferably third-party) review, too. (Although I'm not in the market for hardware - I prefer to assemble my own.) It may simply not be a priority for Deciso, and they may have the right of it - marketing is not one of my skills.

That would be my guess, too.  Reviewers would focus on price:performance comparisons though I'm guessing Deciso isn't keen to do that.  They are not really selling h/w kit but rather integrated firewall solutions; premium ones designed by them and certified for OPNsense. ;)

[spaceharrier]

I just installed a 3920 on my home 10Gbit connection, upgrading from a DEC750. Doing casual speed tests with my provider (Sonic.com) and using just my normal firewall rules the 3920 has no problem saturating the connection. Enabling Zenarmor the download speed caps at a little below 3.5Gb/s, showing about 20% CPU utilization. That's using the default policy with Moderate Control settings.

(The DEC750 couldn't fully saturate the 10Gbit connection with just firewall rules, and dropped to a little below 2Gb/s running the same Zenarmor config.)

[sopex]

I just installed a 3920 on my home 10Gbit connection, upgrading from a DEC750. Doing casual speed tests with my provider (Sonic.com) and using just my normal firewall rules the 3920 has no problem saturating the connection. Enabling Zenarmor the download speed caps at a little below 3.5Gb/s, showing about 20% CPU utilization. That's using the default policy with Moderate Control settings.

(The DEC750 couldn't fully saturate the 10Gbit connection with just firewall rules, and dropped to a little below 2Gb/s running the same Zenarmor config.)

The Zenarmor engine is not multi-core, so this is to be expected.

[spaceharrier]

The Zenarmor engine is not multi-core, so this is to be expected.

Right, just illustrating how that pans out on the 3920.

[qw0rd]

I just purchased DEC3940 and it shows weird values about processor: AMD Ryzen Embedded V3C18 8-Core Processor (4 cores, 8 threads)

V3C18 should have 8-cores and that's what Deciso also says in their tech specs about this model. Does anyone have similar model and what it says about CPU?

[qw0rd]

Well, resetting BIOS to Default and then changing SMT control from Disabled to Enabled made OPNsense to show all cores and threads.

AMD Ryzen Embedded V3C18 8-Core Processor (8 cores, 16 threads)

Now I'm thinking what was the reason for brand new DEC3940 purchased directly from Deciso to have such a configuration on first place? Is there something wrong with this particular device? Is it refurbished, but sold as new? Can I trust it security and hardware wise etc.

[Kets_One]

There is a piece of text on the Deciso / OPNsense website: https://docs.opnsense.org/hardware/bios.html#hyper-threading

[tuto2]

I just purchased DEC3940 and it shows weird values about processor: AMD Ryzen Embedded V3C18 8-Core Processor (4 cores, 8 threads)

V3C18 should have 8-cores and that's what Deciso also says in their tech specs about this model. Does anyone have similar model and what it says about CPU?

Where did you see (4 cores, 8 threads)?

# sysctl hw.model
hw.model: AMD Ryzen Embedded V3C18 8-Core Processor

# sysctl kern.smp.cpus
kern.smp.cpus: 8

# sysctl kern.smp.cores
kern.smp.cores: 8

[qw0rd]

I just purchased DEC3940 and it shows weird values about processor: AMD Ryzen Embedded V3C18 8-Core Processor (4 cores, 8 threads)

V3C18 should have 8-cores and that's what Deciso also says in their tech specs about this model. Does anyone have similar model and what it says about CPU?

Where did you see (4 cores, 8 threads)?

# sysctl hw.model
hw.model: AMD Ryzen Embedded V3C18 8-Core Processor

# sysctl kern.smp.cpus
kern.smp.cpus: 8

# sysctl kern.smp.cores
kern.smp.cores: 8

I noticed it first on OPNsense Lobby page and then running multiple those sysctl commands to confirm, that it's just not the GUI showing wrong information. Also when console is attached it is shown during boot. I'm currently away from the firewall so I can't confirm what those sysctl commands show now, but now the Lobby page shows also correct information.

I understand that the HyperThreding could be disabled by default, but default was 4 cores and 8 threads, so the HyperThreading was enabled and cores capped and that sounds weird.

Here is the beginning of the bootlog.

Code Select Expand

Copyright (c) 1992-2023 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
    The Regents of the University of California. All rights reserved.

FreeBSD is a registered trademark of The FreeBSD Foundation.

FreeBSD 14.3-RELEASE-p16 stable/26.1-n272152-9b6eef552f24 SMP amd64
FreeBSD clang version 19.1.7 (https://github.com/llvm/llvm-project.git llvmorg-19.1.7-0-gcd708029e0b2)
VT(vga): resolution 640x480

CPU: AMD Ryzen Embedded V3C18 8-Core Processor (1896.52-MHz K8-class CPU)
  Origin="AuthenticAMD"  Id=0xa40f41  Family=0x19  Model=0x44  Stepping=1
  Features=0x178bfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,MMX,FXSR,SSE,SSE2,HTT>
  Features2=0x7ef8320b<SSE3,PCLMULQDQ,MON,SSSE3,FMA,CX16,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,AESNI,XSAVE,OSXSAVE,AVX,F16C,RDRAND>
  AMD Features=0x2e500800<SYSCALL,NX,MMX+,FFXSR,Page1GB,RDTSCP,LM>
  AMD Features2=0x75c237ff<LAHF,CMP,SVM,ExtAPIC,CR8,ABM,SSE4A,MS,Prefetch,OSVW,IBS,SKINIT,WDT,TCE,Topology,PCXC,PNXC,DBE,PL2I,MWAITX,ADMSKX>
  Structured Extended Features=0x219c97a9<FSGSBASE,BMI1,AVX2,SMEP,BMI2,ERMS,INVPCID,PQM,PQE,RDSEED,ADX,SMAP,CLFLUSHOPT,CLWB,SHA>
  Structured Extended Features2=0x40069c<UMIP,PKU,OSPKE,VAES,VPCLMULQDQ,RDPID>
  Structured Extended Features3=0x10<FSRM>
  XSAVE Features=0xf<XSAVEOPT,XSAVEC,XINUSE,XSAVES>
  AMD Extended Feature Extensions ID EBX=0x191ef657<CLZERO,IRPerf,XSaveErPtr,RDPRU,BE,WBNOINVD,IBPB,INT_WBINVD,IBRS,STIBP,STIBP_ALWAYS_ON,PREFER_IBRS,SAMEMODE_IBRS,NOLMSLE,SSBD,CPPC,PSFD>
  SVM: NP,NRIP,VMClean,AFlush,DAssist,NAsids=32768
  TSC: P-state invariant, performance statistics

real memory  = 34359738368 (32768 MB)
avail memory = 33130860544 (31596 MB)

Event timer "LAPIC" quality 600
ACPI APIC Table: <INSYDE EDK2>

FreeBSD/SMP: Multiprocessor System Detected: 8 CPUs
FreeBSD/SMP: 1 package(s) x 4 core(s) x 2 hardware threads

random: registering fast source Intel Secure Key RNG
random: fast provider: "Intel Secure Key RNG"
random: unblocking device.

loapic0 <Version 2.1> irqs 0-23