Netgate SG-1000 microFirewall

Author Topic: PC Engines apu2 experiences  (Read 48210 times)

0 Members and 1 Guest are viewing this topic.

Offline FreeMinded

  • Newbie
  • *
  • Posts: 23
  • Karma: +1/-0
    • View Profile
Re: PC Engines apu2 experiences
« Reply #60 on: December 27, 2016, 09:14:07 am »
Here some "facts" from tests with APU2C4 and the latest pfSense (2.3.2_1)

WAN Speed on a clean Gigabit Link: ~640 MBits/s
OpenVPN Speed: ~50 MBits/s (AES-128-CBC with SHA256)

By enabling "Hardware Checksum Offloading" (by unchecking the setting) and "Hardware TCP Segmentation Offloading" (by unchecking the setting) I was able to get a 20-30 MBits/s improvement. Better, but still way off real Gigabit Speed.

Same for the OpenVPN throughput
  • Activating the AES-NI support doesn't currently do anything (should hopefully improve with OpenVPN Version 2.4+)
  • Activating BSD Crypto engine reduces (!) the throughput by ~5MBits/s
  • setting sndbuf 393216; rcvbuf 393216 in the client config as suggest above didn't do anything neither. But this might be due to the server side still using an older OpenVPN version (2.3.2) where there are low defaults. The OpenVPN log shows Socket Buffers: R=[42080->393216] S=[57344->393216]

Looking forward to other reports and suggestions!

Offline VAMike

  • Sr. Member
  • ****
  • Posts: 428
  • Karma: +67/-11
    • View Profile
Re: PC Engines apu2 experiences
« Reply #61 on: December 28, 2016, 12:08:28 pm »
Activating the AES-NI support doesn't currently do anything (should hopefully improve with OpenVPN Version 2.4+)
Activating BSD Crypto engine reduces (!) the throughput by ~5MBits/s

AES-NI is always on in current openvpn. Activating cryptodev overrides the built-in AES-NI support and does generally make openvpn slower. This is not specific to the APU2. If AES-NI were actually off (this can be done by setting an environment variable to tell openssl to ignore AES-NI support when running openvpn from the command line) you'd get a substantial reduction in throughput (more like 30% than 5%; the actual difference in crypto rates is much greater but openvpn has other bottlenecks).

Offline Af0x

  • Newbie
  • *
  • Posts: 7
  • Karma: +0/-0
    • View Profile
Re: PC Engines apu2 experiences
« Reply #62 on: February 05, 2017, 04:33:36 pm »
hi guys, has anyone managed to use the full capacity of your storage. I installed by this guide: http://pcengines.ch/howto.htm#OS_installation

Problem is that it only uses a part of my storage capacity. Can anyone tell me how to install on all available storage capacity?

Offline doktornotor

  • Hero Member
  • *****
  • Posts: 8551
  • Karma: +964/-278
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: PC Engines apu2 experiences
« Reply #63 on: February 05, 2017, 04:41:22 pm »
hi guys, has anyone managed to use the full capacity of your storage.

Stop using nanobsd.
Do NOT PM for help!

Offline Af0x

  • Newbie
  • *
  • Posts: 7
  • Karma: +0/-0
    • View Profile
Re: PC Engines apu2 experiences
« Reply #64 on: February 09, 2017, 11:56:53 pm »
Stop using nanobsd.
ok, thank you. I did that and want to know which kernel is suitable for the apu2? I think it is the embedded one, but am not sure.

Offline doktornotor

  • Hero Member
  • *****
  • Posts: 8551
  • Karma: +964/-278
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: PC Engines apu2 experiences
« Reply #65 on: February 10, 2017, 02:52:50 am »
Cannot recall ever selecting something there.  Get the memstick-serial image and leave it at default. :)
Do NOT PM for help!

BlueKobold

  • Guest
Re: PC Engines apu2 experiences
« Reply #66 on: February 10, 2017, 06:05:08 am »
Quote
Can anyone tell me how to install on all available storage capacity?
Where you want to install pfSense? In a mSATA, USB drive or a real HDD/SSD?
If you take an usb drive and put on it the MEMSTICK-Serial-AM64 image and the you install from there onto a.......
That is a fresh and full install and might be the best bet for you.

Offline Af0x

  • Newbie
  • *
  • Posts: 7
  • Karma: +0/-0
    • View Profile
Re: PC Engines apu2 experiences
« Reply #67 on: February 10, 2017, 09:29:48 am »
hi, thanks you guys. I already downloaded and installed on my mSATA. During Installation you get the choice like on the picture:
https://doc.pfsense.org/images/1/11/Installer_05_select_console.png

I chose embedded but I read that it has reduced possibilities talking about packages.

Offline hda

  • Hero Member
  • *****
  • Posts: 600
  • Karma: +32/-4
    • View Profile
Re: PC Engines apu2 experiences
« Reply #68 on: February 10, 2017, 09:55:00 am »
...mSATA...
APU2 & mSata ? >>> ***64***-bit Full Install.

Offline Ofloo

  • Full Member
  • ***
  • Posts: 117
  • Karma: +3/-2
    • View Profile
Re: PC Engines apu2 experiences
« Reply #69 on: April 07, 2017, 05:36:17 am »
apu1d4: throughput was arround 700mbit/s ~ 900mbit/s, when i first bought it pfsense did 500mbit/s later on that changed
apu3a4: throughput is 250mbit/s ~ 300mbit/s

What i do notice is that apu1d4 uses realtek(re) drivers and the apu3 uses intel(igb)
for the igb driver: TSO LRO .. checksum offload turned on or off makes no difference

strange thing is when I run iperf through vlan but not hosted on the router but on a server on a different subnet which is routed though the router i get

------------------------------------------------------------
[  3] local 192.168.1.100 port 44774 connected with 172.18.1.11 port 5001
[ ID] Interval       Transfer     Bandwidth
[  3]  0.0-10.0 sec   715 MBytes   600 Mbits/sec


when i turn on tso lro checksum offload, cpu rather then hiadapt to maximum

Code: [Select]
------------------------------------------------------------
Client connecting to loki, TCP port 5001
TCP window size: 85.0 KByte (default)
------------------------------------------------------------
[  3] local 192.168.1.100 port 45468 connected with 172.18.1.11 port 5001
[ ID] Interval       Transfer     Bandwidth
[  3]  0.0-10.0 sec   757 MBytes   635 Mbits/sec


------------------------------------------------------------
Client connecting to loki, TCP port 5001
TCP window size: 85.0 KByte (default)
------------------------------------------------------------
[  3] local 192.168.1.100 port 45462 connected with 172.18.1.11 port 5001
[ ID] Interval       Transfer     Bandwidth
[  3]  0.0-10.0 sec   742 MBytes   622 Mbits/sec


« Last Edit: April 07, 2017, 06:18:32 am by Ofloo »

BlueKobold

  • Guest
Re: PC Engines apu2 experiences
« Reply #70 on: April 08, 2017, 02:46:49 am »
Quote
apu1d4: throughput was arround 700mbit/s ~ 900mbit/s, when i first bought it pfsense did 500mbit/s later on that changed
Without PowerD (hi adaptive) it was more around ~450 - 550 MBit/s but with "turned on" PowerD it Comes nearly to that numbers
like you are naming here, ~650 MBit/s - 750 MBit/s and yes for sure that can be different from OS to OS! From FreeBSD to Linux
as the base system, such as IPFire or ZeroShell are based on due to the better driver support.

Quote
apu3a4: throughput is 250mbit/s ~ 300mbit/s
The APU1D4 and APU2C4 are regular boards that was produced for the whole public, but likes in the past too, there
are options, that you might be calling for a customized board based on the number of boards you must then buy.
Let us say 150 - 1000 as a minimum and in former times this boards where then only for you or that customer and
not available for the rest of us or the whole public customers, this was changing now, and so rests of such a special
version or customized board will now also available to the public by sale. But please accept that this APU3 boards are
optimized for LTE usage, also the LAN ports as I am right informed and this might be then driving such a throughput
test in a total other direction! If you are using 3G and/or LTE modems inside  this will be then perhaps once more
again differing from what you see now or get out now!

Quote
What i do notice is that apu1d4 uses realtek(re) drivers and the apu3 uses intel(igb)
for the igb driver: TSO LRO .. checksum offload turned on or off makes no difference
That might be shinning as the changing point for sure and first of all, but there are also two other things
that will be interesting now. The PowerD is bursting the APU1 cpu (T40E dual core) much more then the
APU2 cpu (GX-412TC quad core) that is taking not really a benefit well from activating this PowerD option
and then the igb(4) driver is now also multi cpu threading but even not the PPPoE part!

I donīt know if that "optimized option" will be able to change or something else, but perhaps this might be
then pushing that number somehow in the high, if there will be an option to change them. Perhaps in the BIOS!?




Offline Veldkornet

  • Jr. Member
  • **
  • Posts: 36
  • Karma: +7/-0
    • View Profile
Re: PC Engines apu2 experiences
« Reply #71 on: May 05, 2017, 02:08:15 am »
Has anyone  updated to the latest BIOS?

I noticed in pfSense that the system is now just seen as "pfSense" where as it was "PC Engines APU2"
See screenshots.

Not that the name really matters to me, was just wondering others had the same.

Offline kevindd992002

  • Sr. Member
  • ****
  • Posts: 409
  • Karma: +5/-0
    • View Profile
Re: PC Engines apu2 experiences
« Reply #72 on: May 05, 2017, 03:18:54 am »
Has anyone  updated to the latest BIOS?

I noticed in pfSense that the system is now just seen as "pfSense" where as it was "PC Engines APU2"
See screenshots.

Not that the name really matters to me, was just wondering others had the same.

I didn't even know that there was an updated BIOS until I read your reply, lol. Is there a way to be notified with these updates from pcengines?

I'd have to wait for a week to have access to a null modem, so I can't update my APU2 until then.

Offline Veldkornet

  • Jr. Member
  • **
  • Posts: 36
  • Karma: +7/-0
    • View Profile
Re: PC Engines apu2 experiences
« Reply #73 on: May 05, 2017, 03:24:11 am »
I just updated it via SSH.

You just need to install the "flashrom" package.

So basically:
Code: [Select]
pkg install flashrom
Download the firmware from here

Unzip the download and copy the .rom file to /tmp. Then flash with the following:
Code: [Select]
flashrom -w /tmp/apu2_v4.0.7.rom -p internal
Once done, reboot.

*Edit: Updated to use the flashrom package from pfsense
« Last Edit: May 05, 2017, 04:07:32 am by Veldkornet »

Offline kevindd992002

  • Sr. Member
  • ****
  • Posts: 409
  • Karma: +5/-0
    • View Profile
Re: PC Engines apu2 experiences
« Reply #74 on: May 05, 2017, 03:30:34 am »
Oh ok, I didn't know you can do that. I was referring to following the BIOS update instructions in pcengine's website using tinycore.