The APU2 is a small x86_64 single board computer. It will easily route/packet filter a one Gigabit WAN. IPsec/VPN may drop that number a wee bit, the CPU has AES-NI acceleration, use AES-GCM for performance. Tested wifi options include the PC Engines supplied WLE900VX, WLE600VX (both ath10k, 802.11ac/a/b/g/n) and full feature support via WLE200NX (ath9k, 802.11a/b/g/n) miniPCI express radio cards. There are also board versions optimized for the usage of 3G / LTE modems, see PC Engines APU 3.
APU system boards are designed and manufactured by PC Engines in Taiwan. Boards are based on AMD Embedded G series GX-412TC low (6 to 12W) power consumption CPUs. APU boards and associated accessories are readily available from resellers across Europe and North America.
|↓ Model||CPU||Cores||MHz||RAM||Gbit ports||NICs||USB|
|APU2C0||AMD GX-412TC||4||1000||2048||2||2 Intel i211AT||2x 3.0|
|APU2C2||AMD GX-412TC||4||1000||2048||3||3 Intel i211AT||2x 3.0|
|APU2C4||AMD GX-412TC||4||1000||4096||3||3 Intel i210AT||2x 3.0|
Since the board can be put in the same box as the PCEngines Alix 2d13-Board it might be useful to know that the ethernet device order has changed. The interfaces are now ordered as shown in the following image:
(Note: this is exactly the same order as in the APU1 boards)
eth0 is labelled LAN1 on the PCB silk screen, (eth1 is LAN2 and so on).
The x86_64 images contain everything for basic operation and work out of the box on APU2 since release 17.01.2. Some modules for specific APU2 features are not included by default and can be installed using opkg, or by including them in a custom build.
|kmod-leds-apu2, kmod-leds-gpio||APU2 front LED control||Kernel modules/LED modules|
|kmod-crypto-hw-ccp||AMD Cryptographic Coprocessor||Kernel modules/Cryptographic API modules|
|kmod-gpio-nct5104d, kmod-gpio-button-hotplug||GPIO pins or COM2/3/4||Kernel modules/Other modules|
|kmod-sp5100_tco||Hardware watchdog||Kernel modules/Other modules|
|kmod-usb-core, kmod-usb-ohci, kmod-usb2, kmod-usb3||USB v2 and v3.0 support||Kernel modules/USB Support|
|kmod-sound-core, kmod-pcspkr||Onboard PC speaker||Kernel modules/Sound support|
Other software packages may also be added to use certain APU2 featues:
|amd64-microcode||AMD CPU microcode||Firmware|
|flashrom||Tool to update APU BIOS||Utilities|
|irqbalance||IRQ usage balancing for multi-core systems||Utilities|
|fstrim||discard unused blocks on SSDs||Utilities/Filesystem|
The AMD GX-412TC supports the AES-NI instruction set, which works without any kernel module or specific configuration.
The SoC also contains a cryptographic co-processor (AMD CCP), which requires
kmod-crypto-hw-ccp to be installed. The CCP can be utilized to speed up various cryptographic algorithms in kernel space, like IPSec hashing for example. See Cryptographic Hardware Accelerators on how to enable
/dev/crypto and configure userspace libraries like OpenSSL to take advantage of it. AES-GCM is currently the best security vs performance trade off. The APU2 is vulnerable to the recent AMD and Intel CPU security exploits.
APU boards use coreboot. The PC Engines BIOS firmware releases can be downloaded from https://pcengines.github.io/, flashing instructions are located at the PCEngines HowTo section. Example
flashrom -w apu2_v4.6.8.rom -p internal
There is also a documentation repository on github with information how to build and modify coreboot for APU boards.
Windows: Use PC Engine's Windows installer to write Tinycore linux to a USB pen drive.
If you wish to write data to the same disk as OpenWrt is installed on, an ext4 filesystem with write persistence is useful. If using an SD card (as opposed to using an mSATA SSD or USB-attached SSD), the writable JFFS2 filesystem has journaling and wear leveling may prolong SD card life. However, it will have to be built as OpenWrt does not auto-generate JFFS2 images. See https://downloads.openwrt.org/releases/17.01.4/targets/x86/64/
|↓ Model||Current Release||Download URL|
To install OpenWrt, download a *combined-squashfs.img[.gz] and write it to a SD-card or USB-stick. Run
lsblk to choose the correct device to write to.
sudo dd status=progress bs=8M if=lede-17.01.4-x86-64-combined-squashfs.img of=/dev/sdX
gzip -dc openwrt-x86-64-combined-squashfs.img.gz | sudo dd status=progress bs=8M of=/dev/sdX
Boot the APU from the written stick/card.
When building a custom image, choose target system x86, subtarget x86_64 and include desired APU-specific kernel modules.
It's possible to further optimize the produced binaries by generating instructions for AMD family 16h cores (march=btver2). Set
CONFIG_TARGET_OPTIMIZATION=”-Os -pipe -march=btver2“
In menuconfig this option can be found at: Advanced configuration options (for developers) → Target Options → Target Optimizations
If you don't want to build from source, you can use the image builder
With the generic image, only the first port (eth0, the one close to the serial port) is active. You should configure the other ports as appropriate.
sysupgrade on x86 works with the same images as used for installation. Upload a *combined-squashfs.img.gz via LUCI or run
Teklager.se did a Benchmark of two Compex wireless cards on pfSense and OpenWrt on an APU2C4. Quote from the article: OpenWRT is just much better at wireless. It outperforms pfSense by almost 2x.
See the PCEngines BIOS release page for known issues in different BIOS versions.
The SMBIOS board name entries differed in some releases of the coreboot 4.6.x cycle, the releases since v4.6.7 changed back to the old naming scheme. Since commit 7e42cba both naming schemes are supported. If LEDs aren't working, upgrade coreboot to at least v4.6.7 and/or install a current version of leds-apu2 which includes the mentioned commit.
Update BIOS to a recent version and test with a new (>32GB) SD card,