Some information about HP T620 Plus Flexible Thin Client machines for network appliance builds...

Notice: Page may contain affiliate links for which we may earn a small commission through services like Amazon Affiliates or Skimlinks.

nthu9280

Well-Known Member
Feb 3, 2016
1,628
498
83
San Antonio, TX
Interesting... I have a base T620 and I tested itsi 65W PS on the Plus model and no go. Blinking Red on power switch LED & some beep pattern.
 

BLinux

cat lover server enthusiast
Jul 7, 2016
2,669
1,081
113
artofserver.com
EDIT: nevermind, just confirmed BOTH power supplies do indeed have 3 contacts, one of them being a sense pin - the 14v I was measuring was between the outer metal and the center pin which was 14v- so the center pin seems to be a sense pin. If you measure from the outer metal ring (ground) to the inner metal (being careful not to touch the center pin) it measures the expected 19V - making the inner metal the positive contact.

I would imagine the voltage between ground (outer metal) and the center sense pin is different between the two power bricks and that's how the t620 knows what's plugged in
Yeah, I can confirm on the working T620 90W PSU, I measured 20V from the outer ring to the inner ring and I measured 15.4V from the outer ring to the center pin.

Strangely, on the 65W PSU I got that does *not* work on the T620, I measured 19.4V from the outer ring to inner ring, and 14V from the outer ring to center pin. It doesn't seem like that big of a difference compared to 90W version?
 

Tha_14

Server Newbie
Mar 9, 2017
72
10
8
Yeah, I can confirm on the working T620 90W PSU, I measured 20V from the outer ring to the inner ring and I measured 15.4V from the outer ring to the center pin.

Strangely, on the 65W PSU I got that does *not* work on the T620, I measured 19.4V from the outer ring to inner ring, and 14V from the outer ring to center pin. It doesn't seem like that big of a difference compared to 90W version?
It's probably not the voltage difference. Remember, we are talking about HP here. It is most probably the sense logic. The 65W power brick must be giving a different signal to the t620 than the 90W one gives and the t620 is just being dumb about it.
 
  • Like
Reactions: SwanRonson

fohdeesha

Kaini Industries
Nov 20, 2016
2,728
3,078
113
33
fohdeesha.com
Can anyone running pfsense on one of these verify if it satisfies the "AES-NI" requirement? (I know it's not a strict requirement NOW, but I'm curious - esp for openvpn acceleration) I know the spec sheet for the amd proc in these things mention crypto accel, but it's not intel's specific AES-NI obviously

EDIT: nevermind, this confirms it does! makes this box even more of a gem The HP T620 Plus Thin Client: A hidden gem in the world of pfSense hardware
 
  • Like
Reactions: tommybackeast

BLinux

cat lover server enthusiast
Jul 7, 2016
2,669
1,081
113
artofserver.com
Can anyone running pfsense on one of these verify if it satisfies the "AES-NI" requirement? (I know it's not a strict requirement NOW, but I'm curious - esp for openvpn acceleration) I know the spec sheet for the amd proc in these things mention crypto accel, but it's not intel's specific AES-NI obviously

EDIT: nevermind, this confirms it does! makes this box even more of a gem The HP T620 Plus Thin Client: A hidden gem in the world of pfSense hardware
I'm not sure that person's article actually shows it working at a technical level. It sounded more like a spec sheet review?
 

fohdeesha

Kaini Industries
Nov 20, 2016
2,728
3,078
113
33
fohdeesha.com
See the screenshot they included in their article:



As netgate plans to remove support for any hardware that doesn't light up this option with "yes" in version 2.5, that's all I was worried about. Glad to see it's detected as supported
 

Samir

Post Liker and Deal Hunter Extraordinaire!
Jul 21, 2017
3,257
1,446
113
49
HSV and SFO
Hey I just noticed you guys have discovered the wonder world of these thin clients. Here's a web site that has a TON of information on the unit (as well as other models). He's responsive too if you have questions:
HP Thin Client: t620
 

brianmc

New Member
Jun 25, 2018
29
7
3
Thanks! I've got it open. Surprisingly, extremely easy to do. Way easier than your average Supermicro.
 

nthu9280

Well-Known Member
Feb 3, 2016
1,628
498
83
San Antonio, TX
Since this is being used by many here for pfSense or other firewall appliance, Thought I'd post HP Security advisory / update for TPM. Not just for T620 but a whole host of other systems.

HPSBHF03568 rev. 9 - Infineon TPM Security Update | HP® Customer Support

https://support.microsoft.com/en-us/help/4096377/windows-10-update-security-processor-tpm-firmware


TL;DR direct link for T620.

HP t620 PLUS Flexible Thin Client
SLB9660 TPM 1.2 ver. 4.43.257.0
SP82133
https://ftp.hp.com/pub/softpaq/sp82001-82500/sp82133.exe
 

BLinux

cat lover server enthusiast
Jul 7, 2016
2,669
1,081
113
artofserver.com
On the T620+ that is deployed and running Linux, here are some numbers on this CPU for AES:

Without AES-NI:
Code:
# export OPENSSL_ia32cap="~0x200000200000000"
# openssl speed -elapsed -evp aes-256-ecb
You have chosen to measure elapsed time instead of user CPU time.
Doing aes-256-ecb for 3s on 16 size blocks: 9424929 aes-256-ecb's in 3.00s
Doing aes-256-ecb for 3s on 64 size blocks: 2459627 aes-256-ecb's in 3.00s
Doing aes-256-ecb for 3s on 256 size blocks: 626959 aes-256-ecb's in 3.00s
Doing aes-256-ecb for 3s on 1024 size blocks: 157503 aes-256-ecb's in 3.00s
Doing aes-256-ecb for 3s on 8192 size blocks: 19714 aes-256-ecb's in 3.00s
OpenSSL 1.0.2k-fips  26 Jan 2017
built on: reproducible build, date unspecified
options:bn(64,64) md2(int) rc4(8x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx) 
compiler: gcc -I. -I.. -I../include  -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -Wall -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic -Wa,--noexecstack -DPURIFY -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-256-ecb      50266.29k    52472.04k    53500.50k    53761.02k    53832.36k
With AES-NI:
Code:
# unset OPENSSL_ia32cap
# openssl speed -elapsed -evp aes-256-ecb
You have chosen to measure elapsed time instead of user CPU time.
Doing aes-256-ecb for 3s on 16 size blocks: 52718022 aes-256-ecb's in 3.00s
Doing aes-256-ecb for 3s on 64 size blocks: 46909311 aes-256-ecb's in 3.00s
Doing aes-256-ecb for 3s on 256 size blocks: 17730992 aes-256-ecb's in 3.00s
Doing aes-256-ecb for 3s on 1024 size blocks: 4871118 aes-256-ecb's in 3.00s
Doing aes-256-ecb for 3s on 8192 size blocks: 636955 aes-256-ecb's in 3.00s
OpenSSL 1.0.2k-fips  26 Jan 2017
built on: reproducible build, date unspecified
options:bn(64,64) md2(int) rc4(8x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx) 
compiler: gcc -I. -I.. -I../include  -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -Wall -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic -Wa,--noexecstack -DPURIFY -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-256-ecb     281162.78k  1000731.97k  1513044.65k  1662674.94k  1739311.79k
 
  • Like
Reactions: fohdeesha

BLinux

cat lover server enthusiast
Jul 7, 2016
2,669
1,081
113
artofserver.com
Is my understanding of the numbers right?
it's about 281M Bytes/s *8 ~ 2.24gbps?
IIRC, my pfSense metrics were lot lower.

If you have OpenVPN package installed on your Linux, can you measure test-crypto performance? These was even lower than openssl speed.

OpenVPN - estimate performance via OpenVPN
Ok, so if I follow that methodology:

With AES-NI:
Code:
# time openvpn --test-crypto --secret /tmp/secret --verb 0 --tun-mtu 20000 --cipher aes-256-cbc
Wed Jul 25 10:55:51 2018 disabling NCP mode (--ncp-disable) because not in P2MP client or server mode
real    0m14.717s
user    0m14.682s
sys    0m0.025s
# echo "3200 / 14.717" | bc
217
So i guess that means about 217Mbps?

Now, disable AES-NI in openssl:
Code:
# export OPENSSL_ia32cap="~0x200000200000000"
# time openvpn --test-crypto --secret /tmp/secret --verb 0 --tun-mtu 20000 --cipher aes-256-cbc
Wed Jul 25 10:57:29 2018 disabling NCP mode (--ncp-disable) because not in P2MP client or server mode
real    0m19.614s
user    0m19.529s
sys    0m0.071s
# echo "3200 / 19.614" | bc
163
So that's about 163Mbps without AES-NI? It would almost seem like AES-NI doesn't really help OpenVPN that much, there's a lot of other stuff it must be doing?

Just to be sure, enable AES-NI again:
Code:
# unset OPENSSL_ia32cap
# time openvpn --test-crypto --secret /tmp/secret --verb 0 --tun-mtu 20000 --cipher aes-256-cbc
Wed Jul 25 10:58:18 2018 disabling NCP mode (--ncp-disable) because not in P2MP client or server mode
real    0m14.657s
user    0m14.573s
sys    0m0.074s
# echo "3200 / 14.657" | bc
218
So, we're back to 218Mbps? Close enough to the previous 217Mbps.

218Mbps vs 163Mbps is only about 33% speed up with AES-NI help... doesn't seem to be that much.
 
Last edited:
  • Like
Reactions: nthu9280

nthu9280

Well-Known Member
Feb 3, 2016
1,628
498
83
San Antonio, TX
I don't know how the AES-NI & Intel QAT help. Lower CPU usage may be for the same throughput. However for folks using pfSense the upcoming 2.5 requires AES-NI.
 

kapone

Well-Known Member
May 23, 2015
1,095
642
113
OpenVPN is single threaded...you're measuring the performance with a single core.

As another benchmark, here's the same test with an i3-3220 (which is what my pfSense uses right now), which does not have AES-NI.

[2.4.3-RELEASE][admin@pfSense.localdomain]/root: openssl speed -elapsed -evp aes-256-ecb

You have chosen to measure elapsed time instead of user CPU time.
Doing aes-256-ecb for 3s on 16 size blocks: 37527487 aes-256-ecb's in 3.01s
Doing aes-256-ecb for 3s on 64 size blocks: 11017668 aes-256-ecb's in 3.00s
Doing aes-256-ecb for 3s on 256 size blocks: 2868677 aes-256-ecb's in 3.03s
Doing aes-256-ecb for 3s on 1024 size blocks: 743094 aes-256-ecb's in 3.10s
Doing aes-256-ecb for 3s on 8192 size blocks: 90886 aes-256-ecb's in 3.03s
OpenSSL 1.0.2m-freebsd 2 Nov 2017
built on: date not available
options:bn(64,64) rc4(16x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx)
compiler: clang
The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
aes-256-ecb 199626.74k 235043.58k 242270.12k 245337.07k 245620.82k
 
  • Like
Reactions: Tha_14

BLinux

cat lover server enthusiast
Jul 7, 2016
2,669
1,081
113
artofserver.com
OpenVPN is single threaded...you're measuring the performance with a single core.
I'm not sure how your remark ties into the conversation here.... OpenVPN being single threaded, it seems aes-ni only makes a 33% improvement using the testing methodology @nthu9280 pointed to.
 

BLinux

cat lover server enthusiast
Jul 7, 2016
2,669
1,081
113
artofserver.com
So, if I compare your i3-3220 to the GX-420CA:
Code:
i3-3220:
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-256-ecb     199626.74k   235043.58k   242270.12k   245337.07k   245620.82k

AMD GX-420CA:
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-256-ecb     281162.78k  1000731.97k  1513044.65k  1662674.94k  1739311.79k
that's a pretty significant difference in raw AES performance!!