Some information about HP T620 Plus Flexible Thin Client machines for network appliance builds...

[nthu9280]

Interesting... I have a base T620 and I tested itsi 65W PS on the Plus model and no go. Blinking Red on power switch LED & some beep pattern.

 

[BLinux]

EDIT: nevermind, just confirmed BOTH power supplies do indeed have 3 contacts, one of them being a sense pin - the 14v I was measuring was between the outer metal and the center pin which was 14v- so the center pin seems to be a sense pin. If you measure from the outer metal ring (ground) to the inner metal (being careful not to touch the center pin) it measures the expected 19V - making the inner metal the positive contact.

I would imagine the voltage between ground (outer metal) and the center sense pin is different between the two power bricks and that's how the t620 knows what's plugged in

Yeah, I can confirm on the working T620 90W PSU, I measured 20V from the outer ring to the inner ring and I measured 15.4V from the outer ring to the center pin.

Strangely, on the 65W PSU I got that does *not* work on the T620, I measured 19.4V from the outer ring to inner ring, and 14V from the outer ring to center pin. It doesn't seem like that big of a difference compared to 90W version?

 

[fohdeesha]

Can anyone running pfsense on one of these verify if it satisfies the "AES-NI" requirement? (I know it's not a strict requirement NOW, but I'm curious - esp for openvpn acceleration) I know the spec sheet for the amd proc in these things mention crypto accel, but it's not intel's specific AES-NI obviously

EDIT: nevermind, this confirms it does! makes this box even more of a gem The HP T620 Plus Thin Client: A hidden gem in the world of pfSense hardware

 

[BLinux]

Can anyone running pfsense on one of these verify if it satisfies the "AES-NI" requirement? (I know it's not a strict requirement NOW, but I'm curious - esp for openvpn acceleration) I know the spec sheet for the amd proc in these things mention crypto accel, but it's not intel's specific AES-NI obviously

EDIT: nevermind, this confirms it does! makes this box even more of a gem The HP T620 Plus Thin Client: A hidden gem in the world of pfSense hardware

I'm not sure that person's article actually shows it working at a technical level. It sounded more like a spec sheet review?

 

[fohdeesha]

See the screenshot they included in their article:

As netgate plans to remove support for any hardware that doesn't light up this option with "yes" in version 2.5, that's all I was worried about. Glad to see it's detected as supported

 

[nthu9280]

EDIT: nevermind, this confirms it does! makes this box even more of a gem The HP T620 Plus Thin Client: A hidden gem in the world of pfSense hardware

I'm still on T610+ and haven't yet switched over to T620+. It does support AES-NI. That was the whole reason I got this in the first place. I can hook it up tomorrow and confirm.

 

[Samir]

Hey I just noticed you guys have discovered the wonder world of these thin clients. Here's a web site that has a TON of information on the unit (as well as other models). He's responsive too if you have questions:
HP Thin Client: t620

 

[brianmc]

I'm not great at these things. Mine arrived. How do I open it?

 

[Samir]

I'm not great at these things. Mine arrived. How do I open it?

Try this:
Thin Clients: HP t620

 

[BLinux]

I'm not great at these things. Mine arrived. How do I open it?

 

[brianmc]

Thanks! I've got it open. Surprisingly, extremely easy to do. Way easier than your average Supermicro.

 

[nthu9280]

Since this is being used by many here for pfSense or other firewall appliance, Thought I'd post HP Security advisory / update for TPM. Not just for T620 but a whole host of other systems.

HPSBHF03568 rev. 9 - Infineon TPM Security Update | HP® Customer Support

https://support.microsoft.com/en-us/help/4096377/windows-10-update-security-processor-tpm-firmware


TL;DR direct link for T620.

HP t620 PLUS Flexible Thin Client
SLB9660 TPM 1.2 ver. 4.43.257.0
SP82133
https://ftp.hp.com/pub/softpaq/sp82001-82500/sp82133.exe

 

[BLinux]

On the T620+ that is deployed and running Linux, here are some numbers on this CPU for AES:

Without AES-NI:

# export OPENSSL_ia32cap="~0x200000200000000"
# openssl speed -elapsed -evp aes-256-ecb
You have chosen to measure elapsed time instead of user CPU time.
Doing aes-256-ecb for 3s on 16 size blocks: 9424929 aes-256-ecb's in 3.00s
Doing aes-256-ecb for 3s on 64 size blocks: 2459627 aes-256-ecb's in 3.00s
Doing aes-256-ecb for 3s on 256 size blocks: 626959 aes-256-ecb's in 3.00s
Doing aes-256-ecb for 3s on 1024 size blocks: 157503 aes-256-ecb's in 3.00s
Doing aes-256-ecb for 3s on 8192 size blocks: 19714 aes-256-ecb's in 3.00s
OpenSSL 1.0.2k-fips  26 Jan 2017
built on: reproducible build, date unspecified
options:bn(64,64) md2(int) rc4(8x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx) 
compiler: gcc -I. -I.. -I../include  -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -Wall -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic -Wa,--noexecstack -DPURIFY -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-256-ecb      50266.29k    52472.04k    53500.50k    53761.02k    53832.36k

With AES-NI:

# unset OPENSSL_ia32cap
# openssl speed -elapsed -evp aes-256-ecb
You have chosen to measure elapsed time instead of user CPU time.
Doing aes-256-ecb for 3s on 16 size blocks: 52718022 aes-256-ecb's in 3.00s
Doing aes-256-ecb for 3s on 64 size blocks: 46909311 aes-256-ecb's in 3.00s
Doing aes-256-ecb for 3s on 256 size blocks: 17730992 aes-256-ecb's in 3.00s
Doing aes-256-ecb for 3s on 1024 size blocks: 4871118 aes-256-ecb's in 3.00s
Doing aes-256-ecb for 3s on 8192 size blocks: 636955 aes-256-ecb's in 3.00s
OpenSSL 1.0.2k-fips  26 Jan 2017
built on: reproducible build, date unspecified
options:bn(64,64) md2(int) rc4(8x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx) 
compiler: gcc -I. -I.. -I../include  -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -Wall -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic -Wa,--noexecstack -DPURIFY -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-256-ecb     281162.78k  1000731.97k  1513044.65k  1662674.94k  1739311.79k

 

[nthu9280]

Is my understanding of the numbers right?
it's about 281M Bytes/s *8 ~ 2.24gbps?
IIRC, my pfSense metrics were lot lower.

If you have OpenVPN package installed on your Linux, can you measure test-crypto performance? These was even lower than openssl speed.

OpenVPN - estimate performance via OpenVPN

 

[BLinux]

Is my understanding of the numbers right?
it's about 281M Bytes/s *8 ~ 2.24gbps?
IIRC, my pfSense metrics were lot lower.

If you have OpenVPN package installed on your Linux, can you measure test-crypto performance? These was even lower than openssl speed.

OpenVPN - estimate performance via OpenVPN

Ok, so if I follow that methodology:

With AES-NI:

# time openvpn --test-crypto --secret /tmp/secret --verb 0 --tun-mtu 20000 --cipher aes-256-cbc
Wed Jul 25 10:55:51 2018 disabling NCP mode (--ncp-disable) because not in P2MP client or server mode
real    0m14.717s
user    0m14.682s
sys    0m0.025s
# echo "3200 / 14.717" | bc
217

So i guess that means about 217Mbps?

Now, disable AES-NI in openssl:

# export OPENSSL_ia32cap="~0x200000200000000"
# time openvpn --test-crypto --secret /tmp/secret --verb 0 --tun-mtu 20000 --cipher aes-256-cbc
Wed Jul 25 10:57:29 2018 disabling NCP mode (--ncp-disable) because not in P2MP client or server mode
real    0m19.614s
user    0m19.529s
sys    0m0.071s
# echo "3200 / 19.614" | bc
163

So that's about 163Mbps without AES-NI? It would almost seem like AES-NI doesn't really help OpenVPN that much, there's a lot of other stuff it must be doing?

Just to be sure, enable AES-NI again:

# unset OPENSSL_ia32cap
# time openvpn --test-crypto --secret /tmp/secret --verb 0 --tun-mtu 20000 --cipher aes-256-cbc
Wed Jul 25 10:58:18 2018 disabling NCP mode (--ncp-disable) because not in P2MP client or server mode
real    0m14.657s
user    0m14.573s
sys    0m0.074s
# echo "3200 / 14.657" | bc
218

So, we're back to 218Mbps? Close enough to the previous 217Mbps.

218Mbps vs 163Mbps is only about 33% speed up with AES-NI help... doesn't seem to be that much.

 

[nthu9280]

I don't know how the AES-NI & Intel QAT help. Lower CPU usage may be for the same throughput. However for folks using pfSense the upcoming 2.5 requires AES-NI.

 

[kapone]

OpenVPN is single threaded...you're measuring the performance with a single core.

As another benchmark, here's the same test with an i3-3220 (which is what my pfSense uses right now), which does not have AES-NI.

[2.4.3-RELEASE][admin@pfSense.localdomain]/root: openssl speed -elapsed -evp aes-256-ecb

You have chosen to measure elapsed time instead of user CPU time.
Doing aes-256-ecb for 3s on 16 size blocks: 37527487 aes-256-ecb's in 3.01s
Doing aes-256-ecb for 3s on 64 size blocks: 11017668 aes-256-ecb's in 3.00s
Doing aes-256-ecb for 3s on 256 size blocks: 2868677 aes-256-ecb's in 3.03s
Doing aes-256-ecb for 3s on 1024 size blocks: 743094 aes-256-ecb's in 3.10s
Doing aes-256-ecb for 3s on 8192 size blocks: 90886 aes-256-ecb's in 3.03s
OpenSSL 1.0.2m-freebsd 2 Nov 2017
built on: date not available
options:bn(64,64) rc4(16x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx)
compiler: clang
The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
aes-256-ecb 199626.74k 235043.58k 242270.12k 245337.07k 245620.82k

 

[BLinux]

OpenVPN is single threaded...you're measuring the performance with a single core.

I'm not sure how your remark ties into the conversation here.... OpenVPN being single threaded, it seems aes-ni only makes a 33% improvement using the testing methodology @nthu9280 pointed to.

 

[BLinux]

So, if I compare your i3-3220 to the GX-420CA:

i3-3220:
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-256-ecb     199626.74k   235043.58k   242270.12k   245337.07k   245620.82k

AMD GX-420CA:
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-256-ecb     281162.78k  1000731.97k  1513044.65k  1662674.94k  1739311.79k

that's a pretty significant difference in raw AES performance!!

 

[kapone]

It is. But remember, the i3 does not have AES-NI, so, apples to apples...

AMD GX-420CA:
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-256-ecb      50266.29k    52472.04k    53500.50k    53761.02k    53832.36k

i3-3220
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-256-ecb     199626.74k   235043.58k   242270.12k   245337.07k   245620.82k