Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PC Engines apu2 experiences

    Scheduled Pinned Locked Moved Hardware
    711 Posts 73 Posters 764.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • valnarV
      valnar
      last edited by

      I guess I should have read outside of the PCEngines website!  Thanks for that info.

      OK, so has everyone successfully run 4.6.6 or should I just go to 4.0.11?

      1 Reply Last reply Reply Quote 0
      • K
        kevindd992002
        last edited by

        @pvoigt:

        @kevindd992002:

        I thought 4.07 is the latest?

        No, development is going on. Unfortunately, version schema is confusing and PC Engines does not update their corresponding web page. Moreover, binaries are at least for me, difficult to find.

        What I have understood so far: There are two actively developed branches: 4.0.x denoted as "legacy" and a "mainline" 4.5.x/4.6.x. Latest versions are 4.0.14 and 4.6.6, respectively. Latest binary downloads for APU2 are available as 4.0.11 and 4.6.1.

        One thing that I have just become aware of: coreboot determines the version number of the APU2 BIOS ROM but the APU2 ROM consists of several other components with its own version numbers like e.g. seabios and ipxe.

        Oh I see. So everything is on github? I remember choosing between 4.0.x and 4.5.x before and many people we're having problems with 4.5.x for some reason. And this is why I chose to go with 4.0.7. Did this change now? Would it be recommended to go with the mainline this time?

        @valnar:

        I guess I should have read outside of the PCEngines website!  Thanks for that info.

        OK, so has everyone successfully run 4.6.6 or should I just go to 4.0.11?

        Me too! All along I thought their website was updated.

        1 Reply Last reply Reply Quote 0
        • valnarV
          valnar
          last edited by

          I just went to 4.0.11 and it's working fine.  I didn't see anything listed in the bios's after 4.0.11 that was relevant to APU2 boards.

          I also noticed that PC Engines recommends the 4.0x track here:
          http://pcengines.ch/howto.htm#bios

          1 Reply Last reply Reply Quote 1
          • VeldkornetV
            Veldkornet
            last edited by

            FYI, anyone updating to the 4.5.x or 4.6.x mainline firmware (https://github.com/pcengines/apu2-documentation), you need to edit the /boot/loader.conf and add the following:

            hint.ahci.0.msi="0"

            Otherwise it reboots every 4-5 hours.

            The rest of the items that they mention here were all already added on my system by default.

            I'm now running 4.6.1 without any problems.

            1 Reply Last reply Reply Quote 1
            • VeldkornetV
              Veldkornet
              last edited by

              @doktornotor:

              @Veldkornet:

              @Jailer:

              Mine still says PC Engines APU2 after the update to 2.3.4.

              Yeah, mine did too. I more meant after the latest firmware update.

              Can you post the output of

              
              /bin/kenv -q smbios.system.product
              /bin/kenv -q smbios.system.maker
              
              

              with the 4.0.7 FW.

              FYI, This has changed again…. below the output from firmware 4.6.1:

              /bin/kenv -q smbios.system.product -> PC Engines apu2
              /bin/kenv -q smbios.system.maker -> PC Engines

              1 Reply Last reply Reply Quote 0
              • VeldkornetV
                Veldkornet
                last edited by

                @PiBa:

                @Veldkornet:

                On a sidenote, does anyone else have 2x haproxy services?

                I havn't seen that before..you should only have the lowercase 'haproxy' service.. Probably need to edit the config.xml to remove the wrong service tag.. (backup>edit>restore)or the more tricky:(edit /conf/config.xml,delete /tmp/config.cache) just make sure to keep the xml format valid..

                Thanks! :)

                1 Reply Last reply Reply Quote 0
                • VeldkornetV
                  Veldkornet
                  last edited by Veldkornet

                  Question, should I see the serial number of my PC Engines on the pfSense dashboard?

                  Reason I ask is because one of the PC Engines firmwares made the serial number show random characters. However, in doing so, the serial number field all of a sudden showed up on the dashboard

                  Dashboard

                  However, once I got the next firmware, the field was gone again from the dashboard.

                  The below command gives an actual output:

                  /bin/kenv -q smbios.system.serial
                  

                  However, it’s not shown on the dashboard.

                  Is this intentional? Or should it be shown?

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    It's not expected to show in 2.4.3p1.

                    The input validation on that field was improved since it was first introduced. It should only appear now on devices that expose a real serial number via ACPI in the correct field.

                    I think the new forum code may have cut-off your kenv output.

                    Looking on an APU here it does seem to be present so perhaps the validation there could be tweaked.

                    It's not an issue with your board though, that's the expected behaviour currently.

                    Steve

                    1 Reply Last reply Reply Quote 1
                    • K
                      kevindd992002
                      last edited by

                      I have a site-to-site VPN using an OpenVPN tunnel between two APU2C4's with pfSense on them (2.4.3-RELEASE-p1 (amd64)). I've been reading a few hours now on how to really have OpenVPN utilize hardware AES-NI as the CPU supports it. There are several threads about this but not one is clear enough to really explain how pfSense uses this.

                      So, if I want to use hardware AES-NI, do I need to choose AES-NI CPU-based Acceleration under System > Advanced > Miscellaneous > Cryptographic Hardware? Or should I set it to None (no module loaded) and OpenVPN will use the AES-NI natively from the hardware without any module conflicts from the pfSense BSD OS?

                      If I choose the former, under the OpenVPN Server/Client settings the only selection I have for Hardware Crypto is No Hardware Crypto Acceleration. The only time I have an extra option in the Client settings is when I choose BSD Crypto Device (cryptodev) under Miscellaneous. So which is which? I'm starting to have a headache because of the confusing pfSense GUI :)

                      1 Reply Last reply Reply Quote 0
                      • VeldkornetV
                        Veldkornet
                        last edited by

                        I'm also curious as to what the "correct" settings are... I can say that I did a couple of tests wrt speed, and I eventually settled on (apart from a bunch of other tweaks) enabling AES-NI CPU-based Acceleration under System > Advanced > Miscellaneous > Cryptographic Hardware, and then in the OpenVPN Server/Client settings the only selection I have No Hardware Crypto Acceleration.

                        I know a while back, in the OpenVPN settings you could choose between AES-NI and cryptodev, but after some update the cryptodev disappeard.

                        Additionally, I think that the best speeds were achieved when both AES-NI CPU-based Acceleration and cryptodev were enabled, which is now the default if you have AES-NI CPU-based Acceleration enabled on the system.
                        So, I've just assumed that it doesn't matter anymore about the setting in OpenVPN since the system is already using all it can.

                        K 1 Reply Last reply Reply Quote 0
                        • K
                          kevindd992002 @Veldkornet
                          last edited by

                          @veldkornet said in PC Engines apu2 experiences:
                          Additionally, I think that the best speeds were achieved when both AES-NI CPU-based Acceleration and cryptodev were enabled, which is now the default if you have AES-NI CPU-based Acceleration enabled on the system.
                          So, I've just assumed that it doesn't matter anymore about the setting in OpenVPN since the system is already using all it can.

                          Enabling both where? Let's call both places Miscellaneous settings and Client settings to avoid confusion. Like I said, I don't have any options for a cryptodev Client setting IF I keep the Miscellaneous settings to AES-NI. All I have is the No Hardware Crypto Acceleration option.

                          1 Reply Last reply Reply Quote 0
                          • VeldkornetV
                            Veldkornet
                            last edited by

                            My mistake, I actually have the Miscellaneous set to AES-NI and BSD Crypto Device (aesni, cryptodev).
                            This is the update that I referred to in my previous post where both are enabled.

                            0_1530260662775_d9ee068e-c72f-4821-ae32-bbde3d0b7fad-image.png

                            OpenVPN Client & Server:
                            0_1530260748281_8d54c185-19b7-402f-8440-0950e3140ea4-image.png

                            And these are the options available to me within OpenVPN:
                            0_1530260866736_5a0be8e7-7748-46a2-8c02-11cecd47bad8-image.png

                            K 1 Reply Last reply Reply Quote 0
                            • K
                              kevindd992002 @Veldkornet
                              last edited by

                              @veldkornet said in PC Engines apu2 experiences:

                              My mistake, I actually have the Miscellaneous set to AES-NI and BSD Crypto Device (aesni, cryptodev).
                              This is the update that I referred to in my previous post where both are enabled.

                              0_1530260662775_d9ee068e-c72f-4821-ae32-bbde3d0b7fad-image.png

                              OpenVPN Client & Server:
                              0_1530260748281_8d54c185-19b7-402f-8440-0950e3140ea4-image.png

                              And these are the options available to me within OpenVPN:
                              0_1530260866736_5a0be8e7-7748-46a2-8c02-11cecd47bad8-image.png

                              Ok, that makes more sense and we have the same set of available options in both places. Although I'm reading a lot that it generally is not a good thing to have both modules loaded (which is what you have set in Misc.) so I was wondering how you got better speeds with that?

                              1 Reply Last reply Reply Quote 0
                              • VeldkornetV
                                Veldkornet
                                last edited by

                                @kevindd992002 said in PC Engines apu2 experiences:

                                Ok, that makes more sense and we have the same set of available options in both places. Although I'm reading a lot that it generally is not a good thing to have both modules loaded (which is what you have set in Misc.) so I was wondering how you got better speeds with that?

                                With regards to having both loaded, see resolved bug 7810.

                                In the OpenVPN settings, selecting BSD cryptodev engine made it slower indeed and shouldn't be selected.

                                Not related to the crypto, but what also made a big difference is setting the following:
                                0_1530261425126_7b97f90a-589e-43be-97de-ee7c51c9e837-image.png

                                Anyway, this is just my opinion of how it should be since this works the best in my situation.

                                K 1 Reply Last reply Reply Quote 0
                                • K
                                  kevindd992002 @Veldkornet
                                  last edited by

                                  @veldkornet said in PC Engines apu2 experiences:

                                  @kevindd992002 said in PC Engines apu2 experiences:

                                  Ok, that makes more sense and we have the same set of available options in both places. Although I'm reading a lot that it generally is not a good thing to have both modules loaded (which is what you have set in Misc.) so I was wondering how you got better speeds with that?

                                  With regards to having both loaded, see resolved bug 7810.

                                  In the OpenVPN settings, selecting BSD cryptodev engine made it slower indeed and shouldn't be selected.

                                  Not related to the crypto, but what also made a big difference is setting the following:
                                  0_1530261425126_7b97f90a-589e-43be-97de-ee7c51c9e837-image.png

                                  Anyway, this is just my opinion of how it should be since this works the best in my situation.

                                  Ahh, I see what you mean. Thanks for the heads up. I'm setting it that way then.

                                  Yeah, I have both UDP Fast I/O and send/receiver buffer set to those values also as I read they can speed up things.

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    Setting those tweaks will definitely show an improvement. Usually a significant one though I've never tested it on the APU2 myself.

                                    OpenSSL should use the AES-NI instructions on your CPU directly if it supports them. The danger here is that instead of using them directly it tries to use the BSD crypto framework where the AES-NI kernel module has registered itself for the algorithms it supports. That means a load of additional cycles to do the same calculation.

                                    As long as you don't have AES-NI+BSD crypto set in Adv. > MIsc. and BSD crypto set in openvpn you should avoid that.

                                    When I last tested it Fast I/O and send/receiver buffer made a greater difference to throughput.

                                    Steve

                                    K 1 Reply Last reply Reply Quote 0
                                    • K
                                      kevindd992002 @stephenw10
                                      last edited by

                                      @stephenw10 said in PC Engines apu2 experiences:

                                      Setting those tweaks will definitely show an improvement. Usually a significant one though I've never tested it on the APU2 myself.

                                      OpenSSL should use the AES-NI instructions on your CPU directly if it supports them. The danger here is that instead of using them directly it tries to use the BSD crypto framework where the AES-NI kernel module has registered itself for the algorithms it supports. That means a load of additional cycles to do the same calculation.

                                      As long as you don't have AES-NI+BSD crypto set in Adv. > MIsc. and BSD crypto set in openvpn you should avoid that.

                                      When I last tested it Fast I/O and send/receiver buffer made a greater difference to throughput.

                                      Steve

                                      I see. So are you saying that setting AES-NI+BSD in Misc. and just no hardware crypto in the OpenVPN client settings would be fine?

                                      D stephenw10S 2 Replies Last reply Reply Quote 0
                                      • D
                                        daemonix @kevindd992002
                                        last edited by

                                        @kevindd992002 said in PC Engines apu2 experiences:

                                        I see. So are you saying that setting AES-NI+BSD in Misc. and just no hardware crypto in the OpenVPN client settings would be fine?

                                        Im interested in this too! And Im a bit confused after reading 20 posts about it in this thread.
                                        cheers

                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator @kevindd992002
                                          last edited by

                                          @kevindd992002 said in PC Engines apu2 experiences:

                                          I see. So are you saying that setting AES-NI+BSD in Misc. and just no hardware crypto in the OpenVPN client settings would be fine?

                                          That's what I would expect. In 2.4 at least.

                                          The last time I tested this though I achieved greatest throughput with both fields set to none or BSD with AES-NI disabled. Use AES-GCM and enable fastio and larger send/rec buffers.
                                          That was a while back, 2.3.4 vs 2.4.0.

                                          More testing is always good.

                                          Steve

                                          D 1 Reply Last reply Reply Quote 0
                                          • D
                                            daemonix @stephenw10
                                            last edited by

                                            @stephenw10 said in PC Engines apu2 experiences:

                                            I achieved greatest throughput with both fields set to none or BSD with AES-NI disabled

                                            What is a good throughput for APU2c4? My initial tests with openvpn server running on the apu2 (128-cbc) is around 20Mbit only... (150Mbit line max).
                                            But I havent done your test with all OFF.

                                            VeldkornetV 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.