PC Engines apu2 experiences

stephenw10

@kevindd992002 said in PC Engines apu2 experiences:

I see. So are you saying that setting AES-NI+BSD in Misc. and just no hardware crypto in the OpenVPN client settings would be fine?

That's what I would expect. In 2.4 at least.

The last time I tested this though I achieved greatest throughput with both fields set to none or BSD with AES-NI disabled. Use AES-GCM and enable fastio and larger send/rec buffers.
That was a while back, 2.3.4 vs 2.4.0.

More testing is always good.

Steve

daemonix

@stephenw10 said in PC Engines apu2 experiences:

I achieved greatest throughput with both fields set to none or BSD with AES-NI disabled

What is a good throughput for APU2c4? My initial tests with openvpn server running on the apu2 (128-cbc) is around 20Mbit only... (150Mbit line max).
But I havent done your test with all OFF.

Veldkornet

@daemonix said in PC Engines apu2 experiences:

@stephenw10 said in PC Engines apu2 experiences:

I achieved greatest throughput with both fields set to none or BSD with AES-NI disabled

What is a good throughput for APU2c4? My initial tests with openvpn server running on the apu2 (128-cbc) is around 20Mbit only... (150Mbit line max).
But I havent done your test with all OFF.

I currently get around 20Mbit as well, up and down, sometimes a bit more.

I have a 400/40 Mbit line.

I’ll need to double check my settings, but I think I have 256bit encryption.

daemonix

@veldkornet said in PC Engines apu2 experiences:

@daemonix said in PC Engines apu2 experiences:

@stephenw10 said in PC Engines apu2 experiences:

I achieved greatest throughput with both fields set to none or BSD with AES-NI disabled

What is a good throughput for APU2c4? My initial tests with openvpn server running on the apu2 (128-cbc) is around 20Mbit only... (150Mbit line max).
But I havent done your test with all OFF.

I currently get around 20Mbit as well, up and down, sometimes a bit more.

I have a 400/40 Mbit line.

I’ll need to double check my settings, but I think I have 256bit encryption.

pif Im getting 40Mbit max here. 128-GCM too.

I found this page: https://github.com/ocochard/netbenches/blob/master/AMD_GX-412TC_4Cores_Intel_i210AT/openvpn/results/fbsd11.0/README.md

But I cant see any luck. my test config below with APU2 running the openvpn server.

0_1530530102103_Screenshot 2018-07-02 12.12.00.png

0_1530530135777_Screenshot 2018-07-02 12.11.38.png

0_1530530153820_Screenshot 2018-07-02 12.11.18.png

EDIT: this page too: https://teklager.se/en/knowledge-base/apu2-vpn-performance/

Veldkornet

Just wanted to find out how everyone is getting on with 2.4.4?

I had Firmware 4.8.0.4 on my APU2 with 2.4.3 and everything was fine, but after upgrading to 2.4.4 I had lots of “stalls”, both via the web interface and via SSH. I often had to restart the SAH session (or refresh the web page).

I downgraded the firmware all the way back down to 4.0.7, and the stalls seem to be gone, although I can’t exactly say that everything is as snappy as I’d expect it to be, changing screens on the GUI still take quite a bit of time.

If I restart unbound, it seems to take a good 5 minutes before it actually starts resolving.
I seem to have to restart PHP-FPM pretty often to get the interface in a working state (never had to do this before).

Anyone else seeing this? Or whats your experience been so far with 2.4.4?

stephenw10

I'd be surprised if that was anything to do with the Coreboot version really. About the only thing I could imagine doing that would be some component that is initiallised differently and only supported in FreeBSD 11.2. But I'm not aware of that.
I would first backup the config and do a clean 2.4.4 install. If you still see the same issues you did in the upgraded 2.4.4 then did deeper. I would expect to see errors logged though.

Steve

Stewart

I need a recommendation on a console cable for the APU1/APU2 units. My laptop will be retired soon and so I'll no longer have a serial port to use. I'm sure there are USB cables that will connect in. Does anyone have a link to one that they use that we know will work? Thanks for the help!

Veldkornet

@stewart said in PC Engines apu2 experiences:

I need a recommendation on a console cable for the APU1/APU2 units. My laptop will be retired soon and so I'll no longer have a serial port to use. I'm sure there are USB cables that will connect in. Does anyone have a link to one that they use that we know will work? Thanks for the help!

I have this one, works well for me: https://www.startech.com/eu/m/Cards-Adapters/Serial-Cards-Adapters/USB-to-Null-Modem-RS232-DB9-Serial-Adapter-Cable-DCE-FTDI~ICUSB232FTN

Stewart

@ Veldkornet
Think this is the same thing?
https://www.amazon.com/USB-Serial-Adapter-Modem-9-pin/dp/B008634VJY/ref=sr_1_3?ie=UTF8&qid=1539289152&sr=8-3&keywords=startech+usb+null+modem

EDIT: Found the model on the box in the image. It is indeed. Thanks for the rec!

Veldkornet

@stewart said in PC Engines apu2 experiences:

@ Veldkornet
Think this is the same thing?
https://www.amazon.com/USB-Serial-Adapter-Modem-9-pin/dp/B008634VJY/ref=sr_1_3?ie=UTF8&qid=1539289152&sr=8-3&keywords=startech+usb+null+modem

EDIT: Found the model on the box in the image. It is indeed. Thanks for the rec!

Yup, looks like the same one indeed! :)

daemonix

hehe just in time! I was going to ask the same thing!

Last time I used a null modem was back in 2003ish for my Sun v120 :)
My pfsense gives me some php error.

cheers

Stewart

I've used a few times so far. Works great!

daemonix

@stephenw10 said in PC Engines apu2 experiences:

I'd be surprised if that was anything to do with the Coreboot version really. About the only thing I could imagine doing that would be some component that is initiallised differently and only supported in FreeBSD 11.2. But I'm not aware of that.
I would first backup the config and do a clean 2.4.4 install. If you still see the same issues you did in the upgraded 2.4.4 then did deeper. I would expect to see errors logged though.

Steve

I get the same experience too. Clean 2.4.4 install on a apu2c4.
SSH or Serial stalls after printing 10-15 chars.
Web is dead or I get 504.

Basic WAN network works ok.

Any ideas?

stephenw10

Not without some sort of error to go on.

Are you able to get any logs?

Does it stop at the same point every time?

Does the boot log complete as expected via serial?

Steve

daemonix

@stephenw10 said in PC Engines apu2 experiences:

Not without some sort of error to go on.

Are you able to get any logs?

Does it stop at the same point every time?

Does the boot log complete as expected via serial?

Steve

boot did well.
after random time I couldnt get to console or see logs.
on hard restart (PSU off/on) everything goes back to ok.

Ill continue monitoring and let you know.

Stewart

@daemonix
Right now I'm running 3 APU2C4 devices without any problems but they are all upgrades. No clean installs. I don't know the firmware versions, though. Maybe that would be a culprit? Also, can you send the system logs somewhere so they are viewable after the unit locks up? Then you can see the last thing logged. If you stay logged in via serial is there a kernel panic? You would need to stay logged in via serial. Trying to get in after it locks up would be unsuccessful. Might be a driver issue throwing a panic that doesn't get logged.

daemonix

@stewart said in PC Engines apu2 experiences:

@daemonix
Right now I'm running 3 APU2C4 devices without any problems but they are all upgrades. No clean installs. I don't know the firmware versions, though. Maybe that would be a culprit? Also, can you send the system logs somewhere so they are viewable after the unit locks up? Then you can see the last thing logged. If you stay logged in via serial is there a kernel panic? You would need to stay logged in via serial. Trying to get in after it locks up would be unsuccessful. Might be a driver issue throwing a panic that doesn't get logged.

Ill investigate. At the moment after a hard power reset Its going good.
Im monitoring via the serial.

I havent checked the firmware version.

thewhero

Hi, I also have a few issues with my apu2c4 and pfSense 2.4.4 being unresponsive. I have yet to see anything in logs that's acutally helpfull. My monitoring though raises a few alerts per day on web and ssh being unresponsive. Traffic flows normally though.

But I have also found that doing certain operations in the webUI might block all traffic through the firewall and also block any new connections to the firewall itself. So far I have identified that trying to search in the States diagnostics page will mess everyting up. All traffic stops. Last time I fourtnally had an open SSH connection and could reset php-fpm from the console menu, which cleared everthing without the need of a hard boot. Top did not show any execessive CPU load, just a normal idle system, and I did not see anything interesteing in any logs. (Not reported yet.)

It's a clean full install of 2.4.4. Configration was restored from the previous 2.4.3 install, which ran just fine on the hardware.

Coreboot is of version 4.0.7. I'm considering upgrade to 4.8.0.x just to test.

daemonix

@thewhero said in PC Engines apu2 experiences:

Coreboot is of version 4.0.7. I'm considering upgrade to 4.8.0.x just to test.

which tutorial do you follow for updating the coreboot?
cheers

thewhero

@daemonix said in PC Engines apu2 experiences:

which tutorial do you follow for updating the coreboot?
cheers

I saw this post: https://forum.netgate.com/topic/120380/pc-engines-apu2-bios-options and have decided to use flashrom directly from pfSense instead of booting a USB-stick to run flashrom. I have verified that flashrom can indeed communicate with the flash by dumping current flash image to disk.

[2.4.4-RELEASE][admin@fw]/root: flashrom --programmer internal --read flash.img
flashrom v1.0 on FreeBSD 11.2-RELEASE-p3 (amd64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 4, resolution: 2ns).
coreboot table found at 0xdffae000.
Found chipset "AMD FCH".
Enabling flash write... OK.
Found Winbond flash chip "W25Q64.V" (8192 kB, SPI) mapped at physical address 0x00000000ff800000.
Reading flash... done.

Now I just need to find a suitable maitenance window so I have time to recover if anything goes wrong.