Some information about HP T620 Plus Flexible Thin Client machines for network appliance builds...

Discussion in 'DIY Server and Workstation Builds' started by BLinux, Jul 2, 2018.

  1. nthu9280

    nthu9280 Well-Known Member

    Joined:
    Feb 3, 2016
    Messages:
    1,418
    Likes Received:
    358
    Interesting... I have a base T620 and I tested itsi 65W PS on the Plus model and no go. Blinking Red on power switch LED & some beep pattern.
     
    #41
  2. BLinux

    BLinux cat lover server enthusiast

    Joined:
    Jul 7, 2016
    Messages:
    2,346
    Likes Received:
    812
    Yeah, I can confirm on the working T620 90W PSU, I measured 20V from the outer ring to the inner ring and I measured 15.4V from the outer ring to the center pin.

    Strangely, on the 65W PSU I got that does *not* work on the T620, I measured 19.4V from the outer ring to inner ring, and 14V from the outer ring to center pin. It doesn't seem like that big of a difference compared to 90W version?
     
    #42
  3. Tha_14

    Tha_14 Server Newbie

    Joined:
    Mar 9, 2017
    Messages:
    71
    Likes Received:
    9
    It's probably not the voltage difference. Remember, we are talking about HP here. It is most probably the sense logic. The 65W power brick must be giving a different signal to the t620 than the 90W one gives and the t620 is just being dumb about it.
     
    #43
    SwanRonson likes this.
  4. fohdeesha

    fohdeesha Kaini Industries

    Joined:
    Nov 20, 2016
    Messages:
    1,384
    Likes Received:
    1,115
    Can anyone running pfsense on one of these verify if it satisfies the "AES-NI" requirement? (I know it's not a strict requirement NOW, but I'm curious - esp for openvpn acceleration) I know the spec sheet for the amd proc in these things mention crypto accel, but it's not intel's specific AES-NI obviously

    EDIT: nevermind, this confirms it does! makes this box even more of a gem The HP T620 Plus Thin Client: A hidden gem in the world of pfSense hardware
     
    #44
    tommybackeast likes this.
  5. BLinux

    BLinux cat lover server enthusiast

    Joined:
    Jul 7, 2016
    Messages:
    2,346
    Likes Received:
    812
    I'm not sure that person's article actually shows it working at a technical level. It sounded more like a spec sheet review?
     
    #45
  6. fohdeesha

    fohdeesha Kaini Industries

    Joined:
    Nov 20, 2016
    Messages:
    1,384
    Likes Received:
    1,115
    See the screenshot they included in their article:

    [​IMG]

    As netgate plans to remove support for any hardware that doesn't light up this option with "yes" in version 2.5, that's all I was worried about. Glad to see it's detected as supported
     
    #46
  7. nthu9280

    nthu9280 Well-Known Member

    Joined:
    Feb 3, 2016
    Messages:
    1,418
    Likes Received:
    358
    #47
    Tha_14 and fohdeesha like this.
  8. Samir

    Samir Active Member

    Joined:
    Jul 21, 2017
    Messages:
    771
    Likes Received:
    152
    Hey I just noticed you guys have discovered the wonder world of these thin clients. Here's a web site that has a TON of information on the unit (as well as other models). He's responsive too if you have questions:
    HP Thin Client: t620
     
    #48
  9. brianmc

    brianmc New Member

    Joined:
    Jun 25, 2018
    Messages:
    29
    Likes Received:
    7
    I'm not great at these things. Mine arrived. How do I open it?
     
    #49
  10. Samir

    Samir Active Member

    Joined:
    Jul 21, 2017
    Messages:
    771
    Likes Received:
    152
    Try this:
    Thin Clients: HP t620
     
    #50
    brianmc likes this.
  11. BLinux

    BLinux cat lover server enthusiast

    Joined:
    Jul 7, 2016
    Messages:
    2,346
    Likes Received:
    812
     
    #51
    brianmc and Patrick like this.
  12. brianmc

    brianmc New Member

    Joined:
    Jun 25, 2018
    Messages:
    29
    Likes Received:
    7
    Thanks! I've got it open. Surprisingly, extremely easy to do. Way easier than your average Supermicro.
     
    #52
  13. nthu9280

    nthu9280 Well-Known Member

    Joined:
    Feb 3, 2016
    Messages:
    1,418
    Likes Received:
    358
    Since this is being used by many here for pfSense or other firewall appliance, Thought I'd post HP Security advisory / update for TPM. Not just for T620 but a whole host of other systems.

    HPSBHF03568 rev. 9 - Infineon TPM Security Update | HP® Customer Support

    https://support.microsoft.com/en-us/help/4096377/windows-10-update-security-processor-tpm-firmware


    TL;DR direct link for T620.

    HP t620 PLUS Flexible Thin Client
    SLB9660 TPM 1.2 ver. 4.43.257.0
    SP82133
    https://ftp.hp.com/pub/softpaq/sp82001-82500/sp82133.exe
     
    #53
  14. BLinux

    BLinux cat lover server enthusiast

    Joined:
    Jul 7, 2016
    Messages:
    2,346
    Likes Received:
    812
    On the T620+ that is deployed and running Linux, here are some numbers on this CPU for AES:

    Without AES-NI:
    Code:
    # export OPENSSL_ia32cap="~0x200000200000000"
    # openssl speed -elapsed -evp aes-256-ecb
    You have chosen to measure elapsed time instead of user CPU time.
    Doing aes-256-ecb for 3s on 16 size blocks: 9424929 aes-256-ecb's in 3.00s
    Doing aes-256-ecb for 3s on 64 size blocks: 2459627 aes-256-ecb's in 3.00s
    Doing aes-256-ecb for 3s on 256 size blocks: 626959 aes-256-ecb's in 3.00s
    Doing aes-256-ecb for 3s on 1024 size blocks: 157503 aes-256-ecb's in 3.00s
    Doing aes-256-ecb for 3s on 8192 size blocks: 19714 aes-256-ecb's in 3.00s
    OpenSSL 1.0.2k-fips  26 Jan 2017
    built on: reproducible build, date unspecified
    options:bn(64,64) md2(int) rc4(8x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx) 
    compiler: gcc -I. -I.. -I../include  -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -Wall -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic -Wa,--noexecstack -DPURIFY -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM
    The 'numbers' are in 1000s of bytes per second processed.
    type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
    aes-256-ecb      50266.29k    52472.04k    53500.50k    53761.02k    53832.36k
    
    With AES-NI:
    Code:
    # unset OPENSSL_ia32cap
    # openssl speed -elapsed -evp aes-256-ecb
    You have chosen to measure elapsed time instead of user CPU time.
    Doing aes-256-ecb for 3s on 16 size blocks: 52718022 aes-256-ecb's in 3.00s
    Doing aes-256-ecb for 3s on 64 size blocks: 46909311 aes-256-ecb's in 3.00s
    Doing aes-256-ecb for 3s on 256 size blocks: 17730992 aes-256-ecb's in 3.00s
    Doing aes-256-ecb for 3s on 1024 size blocks: 4871118 aes-256-ecb's in 3.00s
    Doing aes-256-ecb for 3s on 8192 size blocks: 636955 aes-256-ecb's in 3.00s
    OpenSSL 1.0.2k-fips  26 Jan 2017
    built on: reproducible build, date unspecified
    options:bn(64,64) md2(int) rc4(8x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx) 
    compiler: gcc -I. -I.. -I../include  -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -Wall -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic -Wa,--noexecstack -DPURIFY -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM
    The 'numbers' are in 1000s of bytes per second processed.
    type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
    aes-256-ecb     281162.78k  1000731.97k  1513044.65k  1662674.94k  1739311.79k
    
     
    #54
    fohdeesha likes this.
  15. nthu9280

    nthu9280 Well-Known Member

    Joined:
    Feb 3, 2016
    Messages:
    1,418
    Likes Received:
    358
    Is my understanding of the numbers right?
    it's about 281M Bytes/s *8 ~ 2.24gbps?
    IIRC, my pfSense metrics were lot lower.

    If you have OpenVPN package installed on your Linux, can you measure test-crypto performance? These was even lower than openssl speed.

    OpenVPN - estimate performance via OpenVPN
     
    #55
  16. BLinux

    BLinux cat lover server enthusiast

    Joined:
    Jul 7, 2016
    Messages:
    2,346
    Likes Received:
    812
    Ok, so if I follow that methodology:

    With AES-NI:
    Code:
    # time openvpn --test-crypto --secret /tmp/secret --verb 0 --tun-mtu 20000 --cipher aes-256-cbc
    Wed Jul 25 10:55:51 2018 disabling NCP mode (--ncp-disable) because not in P2MP client or server mode
    real    0m14.717s
    user    0m14.682s
    sys    0m0.025s
    # echo "3200 / 14.717" | bc
    217
    
    So i guess that means about 217Mbps?

    Now, disable AES-NI in openssl:
    Code:
    # export OPENSSL_ia32cap="~0x200000200000000"
    # time openvpn --test-crypto --secret /tmp/secret --verb 0 --tun-mtu 20000 --cipher aes-256-cbc
    Wed Jul 25 10:57:29 2018 disabling NCP mode (--ncp-disable) because not in P2MP client or server mode
    real    0m19.614s
    user    0m19.529s
    sys    0m0.071s
    # echo "3200 / 19.614" | bc
    163
    
    So that's about 163Mbps without AES-NI? It would almost seem like AES-NI doesn't really help OpenVPN that much, there's a lot of other stuff it must be doing?

    Just to be sure, enable AES-NI again:
    Code:
    # unset OPENSSL_ia32cap
    # time openvpn --test-crypto --secret /tmp/secret --verb 0 --tun-mtu 20000 --cipher aes-256-cbc
    Wed Jul 25 10:58:18 2018 disabling NCP mode (--ncp-disable) because not in P2MP client or server mode
    real    0m14.657s
    user    0m14.573s
    sys    0m0.074s
    # echo "3200 / 14.657" | bc
    218
    
    So, we're back to 218Mbps? Close enough to the previous 217Mbps.

    218Mbps vs 163Mbps is only about 33% speed up with AES-NI help... doesn't seem to be that much.
     
    #56
    Last edited: Jul 25, 2018
    nthu9280 likes this.
  17. nthu9280

    nthu9280 Well-Known Member

    Joined:
    Feb 3, 2016
    Messages:
    1,418
    Likes Received:
    358
    I don't know how the AES-NI & Intel QAT help. Lower CPU usage may be for the same throughput. However for folks using pfSense the upcoming 2.5 requires AES-NI.
     
    #57
  18. kapone

    kapone Active Member

    Joined:
    May 23, 2015
    Messages:
    616
    Likes Received:
    247
    OpenVPN is single threaded...you're measuring the performance with a single core.

    As another benchmark, here's the same test with an i3-3220 (which is what my pfSense uses right now), which does not have AES-NI.

    [2.4.3-RELEASE][admin@pfSense.localdomain]/root: openssl speed -elapsed -evp aes-256-ecb

    You have chosen to measure elapsed time instead of user CPU time.
    Doing aes-256-ecb for 3s on 16 size blocks: 37527487 aes-256-ecb's in 3.01s
    Doing aes-256-ecb for 3s on 64 size blocks: 11017668 aes-256-ecb's in 3.00s
    Doing aes-256-ecb for 3s on 256 size blocks: 2868677 aes-256-ecb's in 3.03s
    Doing aes-256-ecb for 3s on 1024 size blocks: 743094 aes-256-ecb's in 3.10s
    Doing aes-256-ecb for 3s on 8192 size blocks: 90886 aes-256-ecb's in 3.03s
    OpenSSL 1.0.2m-freebsd 2 Nov 2017
    built on: date not available
    options:bn(64,64) rc4(16x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx)
    compiler: clang
    The 'numbers' are in 1000s of bytes per second processed.
    type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
    aes-256-ecb 199626.74k 235043.58k 242270.12k 245337.07k 245620.82k
     
    #58
    Tha_14 likes this.
  19. BLinux

    BLinux cat lover server enthusiast

    Joined:
    Jul 7, 2016
    Messages:
    2,346
    Likes Received:
    812
    I'm not sure how your remark ties into the conversation here.... OpenVPN being single threaded, it seems aes-ni only makes a 33% improvement using the testing methodology @nthu9280 pointed to.
     
    #59
  20. BLinux

    BLinux cat lover server enthusiast

    Joined:
    Jul 7, 2016
    Messages:
    2,346
    Likes Received:
    812
    So, if I compare your i3-3220 to the GX-420CA:
    Code:
    i3-3220:
    type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
    aes-256-ecb     199626.74k   235043.58k   242270.12k   245337.07k   245620.82k
    
    AMD GX-420CA:
    type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
    aes-256-ecb     281162.78k  1000731.97k  1513044.65k  1662674.94k  1739311.79k
    
    that's a pretty significant difference in raw AES performance!!
     
    #60

Share This Page