2.1.5 –> 2.2, nanobsd 64, random crashes on Atom N280 (HP T5740/T5745)

bfeitell

robi:
I will look tomorrow when I have access to the box again. I do not think that there is any way to disable HT in the bios. I will also try disabling PowerD completely.

I have seen another report indicating spontaneous reboot problems with 2.2 on Atom hardware.
https://forum.pfsense.org/index.php?topic=87499.msg480683#msg480683

stephenw10:
I believe that serial is already disabled in the bios, but I will double check. I do not have the cables handy to hook up a serial connection, but I will start digging for them.

robi

I remember reading somewhere that early Atoms don't support the entire 64-bit instruction set, and it also depends on the motherboard how they implemented it (bios, chipset). My guess would be that probably old FreeBSD 8 didn't actually use any of these and that's why it worked until now. I'd check it with i386 NanoBSD image too.

bfeitell

robi:

I did a little research, and I believe you are right. I'm going to prep a fresh 2G DOM with the i386 version of 2.2 nanobsd, and swap it in when I get to work. I could have sworn that the Atom N280 supported 64bit instructions, but the data I'm seeing indicate that in fact it doesn't.

Thank you!

robi

I made a note here for others to read about it: https://forum.pfsense.org/index.php?topic=84679.0

Cino

The Atom N2xx, Z5xx, Z6xx series Atom models dont support 64-bit. I'm running a D510 which does support it

robi

Unfortunately information on Intel's ARK website is confusing, they say about many Atom CPUs that they are 64-bit capable, while in reality systems containing it also depend on the motherboard implementation.

bfeitell

I have reinstalled a fresh copy of pfSense 2.2 i386 nanobsd on the HP T5740, and thus far things seem to be working correctly. If I see any spurious reboots running the i386 code, I will update this thread.

The odd thing is that 2.1.5 64bit nanobsd ran beautifully on this hardware. I must have just gotten lucky.

I would like to thank those who chimed in for their helpful advice.

Cheers,
Bennett

bfeitell

i386 nanobsd seems broken as well. The machine just rebooted spontaneously after about 38 minutes of uptime. I was not in time to catch any of the crash dump.

nefarius

Have you tried to disable IPSEC?

As posted here https://forum.pfsense.org/index.php?topic=87499 that has fixed my problem. Not a single reboot since I switched to OVPN.

Another user reported reboot-problems when trying to access webinterface via ipsec https://forum.pfsense.org/index.php?topic=87391.0

bfeitell

I switched to IPSEC from OVPN some time ago, as I found that the OVPN tunnels would not stay up, while the IPSEC ones, at least under 2.1.5, have been comparatively bulletproof.

I have taken the HP T5740 (Atom N280) out of production in favor of a more power hungry HP T5730 (AMD Sempron), which doesn't seem to suffer from the reboot issue.

At this point I'm inclined to wait for the next update before I try the Atom hardware again. I need a VPN tunnel that stays up to carry critical VOIP traffic.

bfeitell

I have now done some additional testing, and even with powerd disabled the system spontaneously reboots when there is heavy traffic across the ipsec tunnel. I will dig up a SATA drive and and install a full version of pfSense so that I may collect a proper crash dump.

bfeitell

I think I may have figured this out, even though I never managed to collect a proper crash dump. After reading through the responses to my posts I checked in the bios and found that on the HP T5740 / T5745 thin client there is no way to disable hyperthreading (HT) in the bios. I did a bit of research and found a sysctl toggle for hyperthreading.

By adding:

machdep.hyperthreading_allowed=0

to /boot/loader.local.conf I was able to disable hyperthreading.

This seems to have quelled the random crashes on my N280 Atom cpu when running i386 nanobsd in conjunction with ipsec.

Big thanks to all those who chimed in, and especially robi, who put me on to exploring hyperthreading. I hope that this info helps someone else as well. If I run into any more problems I will update this thread.

UPDATE
After some further reading about IPSec crashes on i386, I came across a thread here indicating that a different sysctl toggle may alleviate the problem in a more finely targeted manner than shutting off hyperthreading.

I have now remove the HT tweak discussed above, and I'm testing to see if setting:
net.inet.ipsec.directdispatch=0
fixes the issue.

Here is the thread and relevant post: https://forum.pfsense.org/index.php?topic=88606.msg501050#msg501050

Cheers,
Bennett