PC Engines apu2 experiences

Jailer · May 5, 2017, 12:00 PM

Has anyone updated to the latest BIOS?

I noticed in pfSense that the system is now just seen as "pfSense" where as it was "PC Engines APU2"
See screenshots.

Not that the name really matters to me, was just wondering others had the same.

Mine still says PC Engines APU2 after the update to 2.3.4.

Veldkornet · May 5, 2017, 12:07 PM

@Jailer:

Mine still says PC Engines APU2 after the update to 2.3.4.

Yeah, mine did too. I more meant after the latest firmware update.

kevindd992002 · May 5, 2017, 3:40 PM

@Veldkornet:

@kevindd992002:

So i assume I just need to run the flashrom syntax under the pfsense shell and i'm all set?

Yup, pretty much. I've updated my initial post showing the use of the pfsense flashrom package instead. So it's a lot simpler now.

Thanks. I've just done the update and I get the same results regarding the 'System' as yours. I guess it's pfsense not detecting the APU properly because of a newer version.

blimpyboy · May 5, 2017, 10:39 PM

I've just taken delivery of a couple of new APU2C2 units today - I need to install pfSense 2.3.4-RELEASE tomorrow and will be taking them to two of my customers on Monday. I've been using Alix 2D3 units for years so a bit of a culture shock to my standard build procedure!

First thing I'd like to be clear on is which BIOS I should be using. The boards arrived with 160307 so I looked in the PCEngines 'BIOS Update' area and have flashed one of the boards with 160311. I then came across this post and I'm now thinking I should be flashing with 4.0.7. It's hard to be sure that this is the most recent as the accompanying text is pretty vague - the versioning pattern is also confusing going from 160311 to 4.0.7! The date stamp on 160311 is 12th March 2016 and 4.0.7 is 28th Feb 2017 so I assume that's the one I should be using? The 4.5.5 file is marked as 'experimantal' so I 'll steer clear of that for now I think!

Before I go to the next stage of workoing out how to get pfSense v2.3.4-Rel (hot off the press yesterday!) on my 16GB mSATA SSD units, could you guys just confirm that I should indeed be using BIOS 4.0.7.

One last observation is that the board I've not yet flashed shows 'SeaBIOS (version ?-20160307_153453_michael-desktop64)' on my PuTTY serial screen when the unit starts up - quite a strange stamp, but it does have the '160307' sub-string in there so must be correct. However, I've just flashed the other board with 4.0.7 and the serial output at startup reads 'SeaBIOS (version rel-1.10.0.1)'. I'm hoping that's all in agreement with what other people see when they take a look at their pfSense boot screens!

Regards
Ian

Jailer · May 5, 2017, 10:55 PM

I'm still running the 160311 that the board shipped with without issue. If it aint broke don't fix it.

Veldkornet · May 5, 2017, 11:02 PM

4.0.7 is indeed the latest as far as I am aware. Maybe the way that they note the updates here makes more sense? Looks like they were using the date and now they've switched to actual version numbers.

I was also running 160311 up until yesterday, didn't really have any issues either.

FYI, this is the changelog for 4.0.7:


coreboot https://github.com/pcengines/coreboot/blob/coreboot-4.0.x/CHANGELOG.md
	reduced log level: display mainboard, DRAM and ECC info only
	improved SD card performance
	forced to use SD in 2.0 mode
	reset J17 GPIO's (NCT5104D) during boot to inputs
	update sortbootorder to v4.0.3 (UART C/D toggling)
	mPCIe1 working with ASM1061 based sata controllers (mPCIe2 still not working)
	fixed RAM size displaying during the boot (for 2GB sku's)

iPXE (no changelog available yet)
	added autoboot command

seabios https://github.com/pcengines/seabios/blob/coreboot-4.0.x/CHANGELOG.md
	allowed for one-time PXE boot with N key
	enable/disable option for USB boot
	enable/disable option for PXE boot

sortbootorder https://github.com/pcengines/sortbootorder/blob/coreboot-4.0.x/CHANGELOG.md
	EHCI0 controller disable/enable option
	UART C and D toggling

memtest86+ https://github.com/pcengines/memtest86plus/blob/coreboot-4.0.x/CHANGELOG.md
	refreshed procedure, so that full screen content is reprinted on refresh
	macro SPD_DISABLED for disabling SPD related functionality
	refresh option label (l) to bottom menu

blimpyboy · May 6, 2017, 8:32 AM

Ah, well spotted Veldkornet, the BIOS naming makes sense after all! Thanks for your reply, and also to Jailer. Jailer, I fully understand your 'if it aint broke…' sentiment, very wise if you have had systems running for some time with no issues. However, I don't have any run-time behind me with any APU2 BIOS so I'm going to assume that PCEngines know what they are doing and flash my two new boards with 4.0.7.

Right... now I need to work out how to get pfSense onto a 16GB mSATA SSD! I've always used CF cards with nanobsd images - I just pop a fresh card into a CF card reader connected to my Windows laptop and use physdiskwrite to push the image onto the 4GB CF card. I then pop the CF card into the Alix board and I'm ready to configure pfSense. My problem now is that I don't have an mSATA slot in anything but the new APU2 board - can you get a USB adapter with an mSATA slot? I think the PCEngines support site has instructions on how to use the APU2 to burn the image to mSATA, have you guys done that for your systems at all?

Also, I've always used nanobsd images which have worked just great out in the field - about 30 pfSense systems with nanobsd on CF for up to six years and not a single issue! The CF cards were mostly cheap Kingston units (I now use Sandisk btw) so nanobsd made sense to avoid burning out the read/write cycle limit. I now have the PCEngines 16GB mSATA for the APU2 which should, I presume, have wear leveling so might not need to worry about wear and can finally install full version. I know I can still use nanobsd on the mSATA drives, but just wondered what other people have been doing. The one big advantage I see with a full/normal (non-nanobsd) install is that it opens up the world of installed packages at a future date.

Thanks again
Ian

Veldkornet · May 6, 2017, 8:39 AM

I have a 256GB M2 SSD. I just used rufus to create a USB installer, booted from the USB with a console cable and installed.

Is this what you were asking?

doktornotor · May 6, 2017, 9:58 AM

@Veldkornet:

@Jailer:

Mine still says PC Engines APU2 after the update to 2.3.4.

Yeah, mine did too. I more meant after the latest firmware update.

Can you post the output of


/bin/kenv -q smbios.system.product
/bin/kenv -q smbios.system.maker

with the 4.0.7 FW.

blimpyboy · May 6, 2017, 10:34 AM

For my APU2C2 board with v4.0.7 BIOS:

/bin/kenv -q smbios.system.product : APU2
/bin/kenv -q smbios.system.maker : PC Engines

Veldkornet · May 6, 2017, 10:57 AM

@blimpyboy:

For my APU2C2 board with v4.0.7 BIOS:

/bin/kenv -q smbios.system.product : APU2
/bin/kenv -q smbios.system.maker : PC Engines

Same for me

doktornotor · May 6, 2017, 12:10 PM

OK, used to be lowercase. Easy fix. https://github.com/pfsense/pfsense/pull/3724

Veldkornet · May 6, 2017, 11:18 AM

@doktornotor:

OK, used to be lowercase. Easy fix. https://github.com/pfsense/pfsense/pull/3724

Cool, thanks! 8)

Jailer · May 6, 2017, 11:37 AM

@blimpyboy:

Right… now I need to work out how to get pfSense onto a 16GB mSATA SSD!

Create a bootable USB drive and install to SATA drive. It really is that simple.

kevindd992002 · May 7, 2017, 2:35 AM

For my APU2C4 board with v4.0.7 BIOS:

/bin/kenv -q smbios.system.product : APU2
/bin/kenv -q smbios.system.maker : PC Engines

dugeem · Aug 25, 2017, 6:14 AM

Have recently upgraded my apu2b4 to 2.4 RC.

Prior to the upgrade I used the flashrom utility to upgrade BIOS to v4.0.7.

For my configuration (LAN, WLAN + dual WAN) it was a smooth upgrade - kudos to pfSense team!

Some updated OpenSSL benchmarks, showing GCM performance improvement (ready for OpenVPN 2.4):

 openssl speed -elapsed -evp aes-128-cbc
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128-cbc     121916.58k   174865.28k   214507.52k   226282.50k   230230.70k

openssl speed -elapsed -evp aes-128-gcm
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128-gcm      43423.18k   113562.28k   276355.50k   358399.32k   431721.13k

valnar · Oct 10, 2017, 2:24 PM

Hi. I'm coming late to the party and bought an APU2C4 board, running the latest 2.40RC based on FreeBSD 11.1. I'm using the full install on an mSATA board. BIOS v4.0.7

I read every post in the thread… How many of these tweaks (from the defaults) are still needed on the latest pfSense?

Temperature probe changes
PowerD
Trim support
Hardware TCP & large receive offload changes
AES-NI changes

Also, do you recommend the 32-bit or 64-bit version for this platform?

Thanks!

Oct 10, 2017, 9:39 PM

@valnar:

Hi. I'm coming late to the party and bought an APU2C4 board, running the latest 2.40RC based on FreeBSD 11.1. I'm using the full install on an mSATA board. BIOS v4.0.7

I read every post in the thread… How many of these tweaks (from the defaults) are still needed on the latest pfSense?

Temperature probe changes

PowerD

Trim support

Hardware TCP & large receive offload changes

AES-NI changes

Also, do you recommend the 32-bit or 64-bit version for this platform?

Thanks!

It;s a 64 bit processor, so what do you think? :)

valnar · Oct 10, 2017, 10:31 PM

Not sure. It only has 4GB RAM, and some 32-bit operating systems are faster.

How about those other things?

Oct 10, 2017, 11:59 PM

I'm using the full install on an mSATA board. BIOS v4.0.7

Would be also my personal choice and is also highly recommended from netgate in their Version 2.4.0 blog.
_A few noteworthy items about running or upgrading to 2.4:

32-bit x86 and NanoBSD have been deprecated and are not supported on 2.4. Hardware capable of
running 64-bit images should be reinstalled with a 64-bit version.
NanoBSD installs on 64-bit hardware should be reinstalled as a full installation.
32-bit x86 hardware can continue to run pfSense software version 2.3.x, which will
receive security updates for at least a year after 2.4.0-RELEASE._

I read every post in the thread… How many of these tweaks (from the defaults) are still needed on the latest pfSense?

You don´t need to setup tune or organize something, but you cold do so and that is more a additional option for the
admins and nothing you must be pressed to do.

Temperature probe changes

Do you need the temperature sensor?

PowerD

Is the cpu scaling from the lowest bottom to the highest top as needed by default?

Trim support

Is this a mSATA or SSD that supports TRIM?

Hardware TCP & large receive offload changes

Is all running fine without any issues, like you was imagine it?

AES-NI changes

Are you using the OpenVPN or IPSec VPN method?

Some need it, some want it and some are aware of doing something in that direction!

Also, do you recommend the 32-bit or 64-bit version for this platform?

Since version 2.4.0 there will be only the amd64Bit version and ARM images only!!!

no NanoBSD
no 32Bit OS image
AES-NI support in the CPU is a must be since version 2.5.0

Not sure. It only has 4GB RAM, and some 32-bit operating systems are faster.

Today this information is really outdated, it was due to the changing between 32Bit and 64Bit hardware
where 64Bit hardware were brand new on the marked, but today you may better of using the 64Bit image
if you have real 64Bit hardware, due to many differences likes;

drivers will be not even ported back to 32Bit hardware (due to the lag of time and from the hardware side)
nearly any new hardware will be 64Bit and is more capable as the older 32Bit technic
since the ARM support other things are gone, or we all must waiting a longer time to get updates/upgrades

How about those other things?

pfSense 2.4.0 blog
_A few noteworthy items about running or upgrading to 2.4:

32-bit x86 and NanoBSD have been deprecated and are not supported on 2.4.
Hardware capable of running 64-bit images should be reinstalled with a 64-bit version.
NanoBSD installs on 64-bit hardware should be reinstalled as a full installation.
32-bit x86 hardware can continue to run pfSense software version 2.3.x, which will
receive security updates for at least a year after 2.4.0-RELEASE._