Performance Summary:

Validation Errors:

•   No Validation Errors Found

Physical Configuration:

Virtual Configuration:

Notes:

Physical System Notes

• Firmware version 5.32
• Firmware settings used:
• Intel(R) VMD Technology: Enabled
• The test sponsor attests, as of date of publication, that CVE-2017-5754 (Meltdown) is mitigated in the system as tested and documented:
• Yes: hosts, guests
• The test sponsor attests, as of date of publication, that CVE-2017-5753 (Spectre variant 1) is mitigated in the system as tested and documented:
• Yes: hosts, guests
• The test sponsor attests, as of date of publication, that CVE-2017-5715 (Spectre variant 2) is mitigated in the system as tested and documented:
• Yes: hosts, guests
• The test sponsor attests, as of date of publication, that CVE-2018-3620 and CVE-2018-3646 (Foreshadow) are mitigated in the system as tested and documented:
• Yes: hosts, guests

Storage Notes

• The System Under Test has 4 7.68TB NVMe SSDs configured as one RAID5 arrays in BIOS by Intel(R) Virtual RAID on CPU.
• The System Under Test has one NVMe SSD contains the logical volume for the hypervisor OS that was booted.
• The RAID disk is formated by xfs and mounted to a directory. The disks for the VMs were in that directory.

Virtualization Software Notes

• The following kernel boot options were used:
• selinux=0 audit=0 elevator=deadline clocksource=tsc intel_iommu=on pci=realloc nosoftlockup intel_idle.max_cstate=0 mce=ignore_ce mds=off pti=off nopcid default_hugepagesz=1G
• The following services were disabled:
• kdump irqbalance
• The following items were added in /etc/sysctl.conf:
• net.ipv4.ip_forward=1
• fs.aio-max-nr = 1572864
• kernel.perf_event_max_sample_rate = 250
• kernel.sched_min_granularity_ns = 30000000
• kernel.sched_wakeup_granularity_ns = 30000000
• kernel.sched_latency_ns = 100000
• kernel.sched_migration_cost_ns = 13000
• kernel.sched_rt_runtime_us = 960000
• kernel.numa_balancing = 0
• vm.dirty_background_ratio = 5
• vm.dirty_ratio = 10
• vm.swappiness = 0
• Network configuration was as follows:
• Ethernet devices ens2, ens3, ens5, ens6 were the physical functions that were used by the host to provide physical transport for the virtual functions.
• 96 virtual functions were configured for each port.
• All VMs were assigned a VF that is routed to the NUMA node to which the VM's VCPUs were pinned.
• After the system booted, 1GB huge pages were manually allocated on the NUMA nodes. 950 1GB huge pages were allocated on each NUMA node.
• VM configurations were as follows:
• All VMs were managed with libvirt and created using the virsh utility
• All VMs were created with the following script template:
  • <domain type='kvm'>
  •   <name>$vm_name</name>
  •   <memory unit='$vm_memory_unit'>$vm_memory</memory>
  •   <memoryBacking>
  •     <hugepages>
  •       <page size='1' unit='G'/>
  •     </hugepages/>
  •   </memoryBacking>
  •   <vcpu cpuset='$host-cpu-list'>$vm_vcpus</vcpu>
  •   <os>
  •     <type arch='x86_64' machine='pc'>hvm</type>
  •     <boot dev='hd'/>
  •   </os>
  •   <features>
  •     <acpi/>
  •     <vmport state='off'/>
  •   </features>
  •   <cpu mode='host-passthrough'>
  •     <topology sockets='1' cores='$vm_vcpus' threads='1'/>
  •   </cpu>
  •   <clock offset='utc'>
  •     <timer name='pit' tickpolicy='delay'/>
  •   </clock>
  •   <on_poweroff>destroy</on_poweroff>
  •   <on_reboot>restart</on_reboot>
  •   <on_crash>restart</on_crash>
  •   <devices>
  •     <emulator>/usr/libexec/qemu-kvm</emulator>
  •     <disk type='file' device='disk'>
  •       <driver name='qemu' type='raw' cache='none' io='native'/>
  •       <source file='$vm_disk'/>
  •       <target dev='vda' bus='virtio'/>
  •     </disk>
  •     <interface type='hostdev' managed='yes'>
  •       <mac address='$mac'/>
  •       <source>
  •         <address type='pci' domain='0x0000' bus='$bus' slot='$slot' function='$function'/>
  •       </source>
  •     </interface>
  •     <serial type='pty'>
  •       <target port='0'/>
  •     </serial>
  •     <console type='pty'>
  •       <target type='serial' port='0'/>
  •     </console>
  •     <input type='mouse' bus='ps2'/>
  •     <graphics type='vnc' port='-1' autoport='yes' keymap='en-us'/>
  •     <memballoon model='none'/>
  •     <rng model='virtio'>
  •     <backend model='random'>/dev/urandom</backend>
  •     <address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0' />
  •     </rng>
  •   </devices>
  • </domain>
• Db, Infra and Mail VMs have this additional XML in the <devices> section for their data disk:
  •   <disk type='file' device='disk'>
  •     <driver name='qemu' type='raw' cache='none' io='native'/>
  •     <source file='$vm_data_disk'/>
  •     <target dev='vdb' bus='virtio'/>
  •   </disk>
• VMs were bound to host CPUs via their scripts in the following manner:
• All VMs of tiles 01, 02, 03, 04, 09, 10, 11, 12, 17, 18, 19, 20, 25, 26, 27, 28, 33, 34, 35, 36, 41, 42, 43 and 44 were bound to NUMA node 0.
• All VMs of tiles 05, 06, 07, 08, 13, 14, 15, 16, 21, 22, 23, 24, 29, 30, 31, 32, 37, 38, 39, 40, 45, 46, 47 and 48 were bound to NUMA node 1.
• Infra and web VMs of tile 49 were bound to node 1, other VMs of tile 50 were bond to node 0
• App VM of tile 50 were bound to node 0, other VMs of tile 50 were bond to node 1
• Db VMs of tiles 01, 09, 17, 25, 33, 41 and 49 were bound to node 0
• Db VMs of tiles 05, 13, 21, 29, 37 and 45 were bound to node 1
• App VMs were reniced -4.
• Db VMs were reniced -8.
• Web VMs were reniced -2.
• Mail VMs were reniced 18.
• Infra VMs were reniced 19.
• Batch VMs were reniced 19.
• After the system booted, power of CPU was set manually with the command: cpupower frequency-set -g performance.

Web Server VM Notes

• The following boot options were used:
• selinux=0 audit=0 elevator=deadline clocksource=tsc tsc=reliable highres=off ipv6.disable=1 nowatchdog intel_idle.max_cstate=0 processor.max_cstate=1 cgroup_disable=memory,cpu,blkio spec_store_bypass_disable=off quiet
• The following services were disabled:
• atd auditd crond httpd irqbalance kdump mcelog nfs-server nginx php-fpm psacct rdisc rhnsd rhsmcertd rngd saslauthd smartd sssd
• root file system mount options: noatime,barrier=0
• The tuned package was installed and activated with the virtual-guest profile.
• The following items were added in /etc/sysctl.d/sysctl.conf:
• fs.file-max = 500000
• kernel.sched_features = 7275
• net.core.netdev_budget = 3000
• net.core.netdev_max_backlog = 30000
• net.core.somaxconn = 81920
• net.ipv4.conf.default.arp_filter = 1
• net.ipv4.conf.all.arp_filter = 1
• net.ipv4.tcp_fin_timeout = 20
• net.ipv4.tcp_keepalive_intvl = 30
• net.ipv4.tcp_keepalive_probes = 4
• net.ipv4.tcp_keepalive_time = 120
• net.ipv4.tcp_max_syn_backlog = 20000
• net.ipv4.tcp_max_tw_buckets = 1500000
• net.ipv4.tcp_timestamps = 0
• net.ipv4.tcp_tw_recycle = 1
• net.ipv4.tcp_tw_reuse = 1
• vm.swappiness = 0
• The following commands were run before the benchmark was started:
• ulimit -n 1048576
• ulimit -u 1000000
• The php-fpm package was installed. /etc/php-fpm.d/www.conf changes:
• user = apache
• group = apache
• pm.max_children = 700
• pm.start_servers = 250
• pm.min_spare_servers = 100
• pm.max_spare_servers = 300
• /etc/nginx/nginx.conf contains:
• user                 apache apache;
• worker_processes     4;
• worker_cpu_affinity  0001 0001 0010 0010;
• worker_rlimit_nofile 65535;
• pid         /var/run/nginx.pid;
• events {
•   use                epoll;
•   worker_connections 65535;
•   multi_accept       on;
•   accept_mutex       off;
• }
• http {
•   include            /etc/nginx/mime.types;
•   default_type       application/octet-stream;
•   log_format common '$remote_addr - $remote_user [$time_local] $request'
•                     '"$status" $body_bytes_sent ';
•   access_log         off;
•   sendfile           on;
•   sendfile_max_chunk 1m;
•   tcp_nopush         on;
•   tcp_nodelay        on;
•   keepalive_timeout  120;
•   keepalive_requests 10000;
•   open_file_cache          max=204800 inactive=20s;
•   open_file_cache_min_uses 1;
•   open_file_cache_valid    30s;
•   open_file_cache_errors   on;
•   read_ahead               4096;
•   charset utf-8;
•   server_names_hash_bucket_size 128;
•   client_header_buffer_size     2k;
•   large_client_header_buffers   4 4k;
•   include /etc/nginx/conf.d/*.conf;
• }
• /etc/nginx/conf.d/default.conf contains:
• upstream fastcgi_backend {
•   server 127.0.0.1:9000;
•   keepalive 128;
• }
• server {
•   listen 80 backlog=81920;
•   server_name  localhost;
•   location / {
•     root   /var/www/html;
•     index  index.html index.htm index.php;
•   }
•   error_page   500 502 503 504  /50x.html;
•   location = /50x.html {
•     root   /usr/share/nginx/html;
•   }
•   location = /error.log {
•     root   /var/log/nginx;
•   }
•   location ~ .*\.(html|htm|gif|jpg|jpeg|bmp|png|ico|txt|js|css)$ {
•     root     /var/www/html;
•     expires  100d;
•   }
•   location ~ ^/images/ {
•     root     /var/www/html/support;
•     expires  100d;
•   }
•   location ~ \.php$ {
•     root           html;
•     fastcgi_pass   fastcgi_backend;
•     fastcgi_keep_conn on;
•     fastcgi_index  index.php;
•     fastcgi_param  SCRIPT_FILENAME /var/www/html$fastcgi_script_name;
•     include        fastcgi_params;
•   }
• }
• /etc/nginx/conf.d/ssl.conf contains:
• server {
•   listen       443 ssl backlog=81920;
•   ssl_certificate      /etc/pki/tls/certs/localhost.crt;
•   ssl_certificate_key  /etc/pki/tls/private/localhost.key;
•   ssl_session_cache    shared:SSL:1m;
•   ssl_session_timeout  5m;
•   ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
•   ssl_ciphers   ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW;
•   ssl_prefer_server_ciphers   on;
•   location / {
•     root   /var/www/html;
•     index  index.html index.htm index.php;
•   }
•   location ~ .*\.(html|htm|gif|jpg|jpeg|bmp|png|ico|txt|js|css)$ {
•     root     /var/www/html;
•     expires  100d;
•   }
•   location ~ ^/images/ {
•     root    /var/www/html/support;
•     expires 100d;
•   }
•   location ~ \.php$ {
•     root           html;
•     fastcgi_pass   fastcgi_backend;
•     fastcgi_keep_conn on;
•     fastcgi_index  index.php;
•     fastcgi_param  SCRIPT_FILENAME /var/www/html$fastcgi_script_name;
•     include        fastcgi_params;
•   }
• }
• Web VM used NFS to access files from infra VM.
• After the Infra VM was booted and its NFS service was up, the Web VM mounted the NFS file system via test automation software.
• The datastore was mounted on /var/www/html/support/downloads

Application Server VM Notes

• The following boot options were used:
• quiet
• The following services were disabled:
• firewalld nfs numad psacct rdisc rhnsd
• root file system mount options: defaults
• The tuned package was installed and activated with the virtual-guest profile.
• The following items were added in /etc/sysctl.d/sysctl.conf:
• fs.file-max = 500000
• kernel.sched_features = 7275
• net.core.somaxconn = 8192
• net.ipv4.conf.default.arp_filter = 1
• net.ipv4.conf.all.arp_filter = 1
• net.ipv4.tcp_max_tw_buckets = 500000
• vm.swappiness = 0
• There were two WebSphere profiles, AppSrv01 for SPECjAppServer2004 and AppSrv02 for SPEC Emulator.
• Heap size for AppSrv01 was changed to 2880 MB.

Mail Server VM Notes

• The following boot options were used:
• selinux=0 audit=0 elevator=deadline clocksource=tsc tsc=reliable highres=off ipv6.disable=1 nowatchdog intel_idle.max_cstate=0 processor.max_cstate=1 cgroup_disable=memory,cpu,blkio spec_store_bypass_disable=off quiet
• The following services were disabled:
• atd auditd crond irqbalance kdump lvm2-monitor mcelog mdmonitor psacct rdisc rhnsd rhsmcertd rngd smartd sssd
• root file system mount options: defaults,noatime
• Mail storage file system mount options: noatime,barrier=0,data=writeback
• The tuned package was installed and activated with the virtual-guest profile.
• The following items were added in /etc/sysctl.d/sysctl.conf:
• fs.file-max = 500000
• kernel.sched_features = 7275
• net.core.somaxconn = 8192
• net.ipv4.conf.default.arp_filter = 1
• net.ipv4.conf.all.arp_filter = 1
• net.ipv4.tcp_max_tw_buckets = 500000
• vm.swappiness = 0
• Dovecot was configured with the command: ./configure --with-passwd-file --with-passwd --without-shadow --without-pam --without-pop3d --prefix=$dovecotdir
• The following dovecot.conf was used:
• base_dir = /var/run/dovecot/
• ssl = no
• ssl_cert =
• ssl_key =
• disable_plaintext_auth = no
• listen = *
• log_path = /var/log/dovecot.log
• mail_debug = no
• mail_location = dbox:/mailstore/dovecot/maildir/%u
• mdbox_rotate_size = 8192
• maildir_very_dirty_syncs = yes
• mbox_very_dirty_syncs = yes
• mbox_write_locks = fcntl
• mmap_disable = yes
• mail_fsync = never
• mailbox_list_index = yes
• mailbox_list_index_very_dirty_syncs = yes
• auth_cache_size = 5000
• passdb {
•   args = scheme=plain /etc/passwd.dovecot
•   driver = passwd-file
• }
• protocols = imap
• service auth {
•   user = root
• }
• service imap-login {
•   inet_listener imap {
•     port = 143
•   }
•   process_min_avail = 10
•   service_count = 0
• }
• service imap {
•   process_min_avail = 10
• }
• userdb {
•   driver = passwd
• }
• dict {
• }

Database Server VM Notes

• The following boot options were used:
• selinux=0 audit=0 elevator=mq-deadline clocksource=tsc tsc=reliable highres=off ipv6.disable=1 nowatchdog intel_idle.max_cstate=0 processor.max_cstate=1 cgroup_disable=memory,cpu,blkio spec_store_bypass_disable=off quiet
• The following services were disabled:
• auditd crond firewalld irqbalance rdisc rhnsd rhsmcertd rngd sssd
• root file system mount options: defaults
• Database storage file system mount options: noatime,barrier=0,data=writeback
• The tuned package was installed and activated with the virtual-guest profile.
• The following items were added in /etc/sysctl.d/sysctl.conf:
• fs.file-max = 500000
• kernel.randomize_va_space = 0
• kernel.sched_features = 7275
• net.core.somaxconn = 32384
• net.ipv4.tcp_max_tw_buckets = 1000000
• net.ipv4.conf.default.arp_filter = 1
• net.ipv4.conf.all.arp_filter = 1
• vm.swappiness = 0
• kernel.shmmax = 137438953472
• kernel.shmmni = 11118096
• kernel.shmall = 8294967296
• kernel.sched_migration_cost_ns = 150000
• kernel.randomize_va_space=0
• vm.nr_hugepages=0
• vm.nr_hugepages=13312
• vm.nr_overcommit_hugepages=512
• The following lines were added to /etc/security/limits.conf:
• db2inst1 soft nofile 1048576
• db2inst1 hard nofile 1048576
• db2inst1 soft nproc 1000000
• db2inst1 hard nproc 1000000
• 13312 2MB huge pages were allocated prior to starting the database instance.
• Database tuning options:
• db2 update db cfg for specdb using DATABASE_MEMORY 6553600
• db2set DB2_LARGE_PAGE_MEM=DB
• db2set DB2_PINNED_BP=ON
• alter bufferpool IBMDEFAULTBP size 5898240
• alter tablespace roll_space NO FILE SYSTEM CACHING
• alter tablespace C_cust_space NO FILE SYSTEM CACHING
• alter tablespace C_supp_space NO FILE SYSTEM CACHING
• alter tablespace C_site_space NO FILE SYSTEM CACHING
• alter tablespace C_parts_space NO FILE SYSTEM CACHING
• alter tablespace C_custinv_space NO FILE SYSTEM CACHING
• alter tablespace M_parts_space NO FILE SYSTEM CACHING
• alter tablespace M_bom_space NO FILE SYSTEM CACHING
• alter tablespace M_wo_space NO FILE SYSTEM CACHING
• alter tablespace M_lo_space NO FILE SYSTEM CACHING
• alter tablespace M_inv_space NO FILE SYSTEM CACHING
• alter tablespace O_cust_space NO FILE SYSTEM CACHING
• alter tablespace O_ords_space NO FILE SYSTEM CACHING
• alter tablespace O_ordl_space NO FILE SYSTEM CACHING
• alter tablespace O_item_space NO FILE SYSTEM CACHING
• alter tablespace S_comp_space NO FILE SYSTEM CACHING
• alter tablespace S_sc_space NO FILE SYSTEM CACHING
• alter tablespace S_po_space NO FILE SYSTEM CACHING
• alter tablespace S_site_space NO FILE SYSTEM CACHING
• alter tablespace S_supp_space NO FILE SYSTEM CACHING
• alter tablespace U_space NO FILE SYSTEM CACHING
• update database config for specdb using LOGFILSIZ 65536
• update database config for specdb using logprimary 64 logsecond 4

Infraserver VM Notes

• The following boot options were used:
• selinux=0 audit=0 elevator=deadline clocksource=tsc tsc=reliable highres=off ipv6.disable=1 nowatchdog intel_idle.max_cstate=0 processor.max_cstate=1 cgroup_disable=memory,cpu,blkio spec_store_bypass_disable=off quiet
• The following services were disabled:
• atd auditd crond irqbalance kdump lvm2-monitor mcelog mdmonitor psacct rdisc rhnsd rhsmcertd rngd saslauthd smartd sssd
• root file system mount options: defaults
• The tuned package was installed and activated with the virtual-guest profile.
• The following items were added in /etc/sysctl.d/sysctl.conf:
• fs.file-max = 500000
• kernel.sched_features = 7275
• net.core.somaxconn = 81920
• net.ipv4.conf.default.arp_filter = 1
• net.ipv4.conf.all.arp_filter = 1
• net.ipv4.tcp_max_tw_buckets = 1500000
• net.ipv4.tcp_tw_reuse=1
• net.ipv4.tcp_keepalive_time = 120
• net.ipv4.tcp_keepalive_intvl = 30
• net.ipv4.tcp_timestamps = 0
• net.ipv4.tcp_syn_retries = 4
• net.ipv4.tcp_retries2 = 7
• vm.swappiness = 0
• httpd.conf changes:
• ServerLimit 10240
• MaxClients 10240
• Listen 81
• Include conf/fcgi.conf
• fcgi package was built from Fedora 14 source RPM, which includes a patch to compile with GCC 4.4.
• Created /etc/httpd/conf/fcgi.conf that contains:
• LoadModule fastcgi_module modules/mod_fastcgi.so
• ScriptAlias /fcgi-bin/ "/var/www/fcgi-bin/"
• FastCgiIpcDir /etc/httpd/fastcgi
• <Directory "/var/www/fcgi-bin">
•   AllowOverride None
•   Options +ExecCGI -Includes
•   SetHandler fastcgi-script
•   Order allow,deny
•   Allow from all
• </Directory>
• AddHandler fastcgi-script fcgi
• FastCgiServer /var/www/fcgi-bin/besim_fcgi.fcgi -processes 50
• Standard Linux NFS server was enabled to serve files to the Web VM.
• /etc/exports file contains:
• /home/webfiles/downloads webserver-int(rw,async,no_subtree_check,no_root_squash)

Batch Server VM Notes

• The following boot options were used:
• selinux=0 audit=0 elevator=deadline clocksource=tsc tsc=reliable highres=off ipv6.disable=1 nowatchdog intel_idle.max_cstate=0 processor.max_cstate=1 cgroup_disable=memory,cpu,blkio spec_store_bypass_disable=off quiet
• The following services were disabled:
• atd auditd crond irqbalance kdump lvm2-monitor mcelog mdmonitor nfs psacct rdisc rhnsd rhsmcertd rngd smartd sssd
• root file system mount options: defaults,noatime
• The tuned package was installed and activated with the virtual-guest profile.
• The following items were added in /etc/sysctl.d/sysctl.conf:
• fs.file-max = 500000
• kernel.sched_features = 7275
• net.core.somaxconn = 8192
• net.ipv4.tcp_max_tw_buckets = 500000
• net.ipv4.conf.default.arp_filter = 1
• net.ipv4.conf.all.arp_filter = 1
• vm.swappiness = 0

Client Driver Notes

• Two client systems each host twenty-five prime client VMs. One client system hosts the prime controller VM.
• Each prime client VM has 8 VCPUs, 16 GB memory, and a 10 GB disk. 1 ixgbevf and 1 virtio_blk device were used in all client VMs.
• All prime client VMs run Red Hat Enterprise Linux 8.0.The first prime client acted as prime controller therefore had one more ixgbevf device for management

Other Notes

• An external 25Gb/100Gb H3C S6850-56HF switch was used to connect the client systems to the system under test (SUT).
• The SUT used the four single-port 100Gb PCIe NICs for communication with the VMs.
• The SUT NICs and the external client systems were connected to the switch using 100Gb QSFP DAC cables.

Performance Details: