Helping with ARM support + recommended ARM hardware

[franco]

We'll definitely opt for RPI2 with 17.1 (100% CPU is a point...), not sure if there will be a build before 17.1 is out though.

Haven't played with the console yet, used HDMI+keyboard all the time.

Also, this:

https://twitter.com/g0mb0/status/792612100011065344
https://twitter.com/g0mb0/status/796203293269757952

all the way up to 12-CURRENT

[chemlud]

This might be fun, tooo:

http://www.banana-pi.org/r1.html

;-)

PS: For serial console try one of these:

https://www.amazon.de/gp/product/B00AFRXKFU/ref=oh_aui_detailpage_o06_s00?ie=UTF8&psc=1

https://www.amazon.de/gp/product/B00R76SCJ6/ref=oh_aui_detailpage_o06_s00?ie=UTF8&psc=1

[franco]

Yes, nice! Eventually we will see convergence for armv6. It's nice that packages and base builds will be (hopefully) compatible. The blockers here are the multitude of ways to treat the release images and the problem of a device-specific kernel, especially during bootstraps. It can be solved. And it will take more time to get there.

[chemlud]

Bad news!

Raspi 2B has recently changed hardware from ARM7 to ARM8 (aarch64), same CPU as in Raspi 3

http://raspi.tv/2016/new-raspberry-pi-2b-1-2-with-pi3-bcm2837-processor

So the planned 17.1 ARM release will only work on "older" Raspi 2 (not available to buy anymore...)

Very sad! We will have to wait for full support of BSD for ARM8, preferably as 64 bit. That should give a HUGH boost to performance, though, will give a very good an handy firewall for IO(shitty)T and for traveling.

I should switch to IT, it's so exciting to see the developments there, compared to my boring "daytime" job! :-D

[franco]

This is a weird decision, especially with the highly acclaimed decision of RPI-1 being binary-compatible with RPI-2.

Of course, until it's not.

[chemlud]

... with the standard Raspian not really a problem. All 32 bit. You can run the same SDcard on a Raspi zero, Rapsi 1, Raspi 2 and  Raspi 3. Only ONE image for the complete range of hardware. ;-)

[franco]

Yet this differs from how FreeBSD approaches this, or did I miss something?

[chemlud]

If you treat the whole range as one device (raspian style) you give away a whole lot of potential of the hardware, I guess.

Apparently BSD has a different approach, tailored for each hardware-release of the rasp-foundation.

http://www.raspbsd.org/
https://wiki.freebsd.org/FreeBSD/arm/Raspberry%20Pi

Brand new support for Raspi 3:

https://www.raspberrypi.org/forums/viewtopic.php?f=85&t=164863&sid=17e1a3d1e3df2f142ae2421b38a37c4b

(In fact, the change in hardware of Raspi 2B will kill the support of BSD for this model)

As has openSUSE, SUSE, with releases for 64bit only (SLES) or for each individual device (openSUSE)...


Would it be possible to bootstrap opnsense on a raspi 3 with the raspiBSD image?

[depekavienna]

Hi!

I just registered an account here, because I was hoping to get more information on the BPI (M1). I have such a unit from Lemaker and found franco's posting about the RPI 1B https://forum.opnsense.org/index.php?topic=3793.0#msg13161.

Is that setup method just the same for the BPI? I.E. get an image from FreeBSD for via https://github.com/freebsd/crochet, or ftp://ftp.freebsd.org/pub/FreeBSD/releases/arm/armv6/ISO-IMAGES/11.0/FreeBSD-11.0-RELEASE-arm-armv6-BANANAPI.img.xz respectively, then download and run the OPNsense install script?

Should it really be that simple?

Thanks!

[franco]

Yes and no. The kernel part is currently a problem. You can try these instructions, but make sure to boot kernel.old from the boot menu, the one we ship is specifically for the RPI-1B.

Luckily, our kernel diverges little from FreeBSD these days, so that's not a fatal issue.

We have someone trying different ARM boards with OPNsense on FreeBSD 12-CURRENT, but he's done the same: skipping using the default kernels for now.

Once we can support a kernel per device, we could potentially offer support for the whole armv6 Architecture scope including the old PRIs, BPI and others.


Cheers,
Franco

[depekavienna]

Hi franco!

Can you please explain to me, what OPNsense's changes to the kernel are, compared to the FreeBSD mainline kernel?
How deep are the modifications to the base system, especially on ARM?

I'll now try to set up the Banana PI, as you suggested. If there is anything special I should report back or log while doing so, please let me know. Would it be advisable to use FreeBSD 11 with 16.7, or rather FreeBSD 12-Current with 17.1?

Thank you!

[franco]

Hi depekavienna,

ARM is pretty fragmented. We've put out a build for "armv6" Architecture based on a 16.7.x release based on FreeBSD 10.3.

For all other architectures or things that require FreeBSD 11.x or higher the ecosystem has to be built from scratch.

If Banana Pi M1 is armv6, then you can use the same instructions as RPI1-B, but need to switch the kernel back before final reboot:

# mv /boot/kernel /boot/kernel.opnsense
# mv /boot/kernel.old /boot/kernel

As far as changes go, I went through all the commits for the upcoming 17.1:

1. A significant patch that we have is for symmetric traffic shaping, something that doesn't work on FreeBSD in conjunction with pf+ipfw at the moment. The patch actually dates back to m0n0wall. Not having this patch in the kernel may cause traffic shaping to not fully adhere to its setup, but the scope is really small and causes no other service interruption.

https://github.com/opnsense/src/commit/4036f873755a3ceeb73c9292065c3530ebfd08e0

2. We have several imported features from HardenedBSD: ASLR, PIE and SEGVGUARD. All of those are optional.

https://github.com/opnsense/src/commit/2d787654c799ace1e033ee69a9fe7e7156eccff4
https://github.com/opnsense/src/commit/885c2e557f71a67020c72c5997fa3c9280e1e9a4
https://github.com/opnsense/src/commit/132c9174a61dbfac2cdc8081fed65382f42373c8

3. We build a slightly different kernel config than GENERIC and src.conf for base.

https://github.com/opnsense/tools/blob/master/config/17.1/SMP
https://github.com/opnsense/tools/blob/master/config/17.1/src.conf

That's it for 17.1. For 16.7 the list is still a little longer due to inherited patches, but compatible too as far as I have seen.

EDIT: BANANAPI is for 11.0 only, so no prebuilt packages yet.

ftp://ftp.freebsd.org/pub/FreeBSD/releases/arm/armv6/ISO-IMAGES/11.0/


Cheers,
Franco

[depekavienna]

FYI: Banana PI specs: http://www.bananapi.org/p/product.html and http://www.banana-pi.org/m1.html
In short: Allwinner A20* (ARM Cortex-A7 dual-core, 1GHz), 1 GB DDR3 SDRAM, GE internally connected through USB. The OS gets loaded through U-Boot via SD-Card. (It's quite easy to repair wrong kernel issues that way.)

The fact, that FreeBSD lists it under the armv6 directory made me wonder. AFAIK, there is no armv6 banana.

For symetric traffic shaping - will this patch be included in FreeBSD's upcoming mainline kernels?

Ok, let me repeat the procedure:
I'll get the FreeBSD 11.0 image first and put it on sdcard. Then I boot to FreeBSD and get the OPNsense bootstrap script from https://raw.githubusercontent.com/opnsense/update/master/bootstrap/opnsense-bootstrap.sh and execute it. Is that script the correct one (for 11.0?) or will it rather break things? In the end I put the mainline kernel back in place.

[franco]

opnsense-bootstrap only works for prebuilt packages, which we do not have for 11.0 ARM at this moment.

Strictly armv6 or not, if FreeBSD lists it there the chances for binary compatibility is high. I don't have a BPI to test though.

[freebee]

http://www.raspbsd.org/raspberrypi.html

I think this page can help.
Packages from 11x can work.

Glad to see this effort.
I can help with vms and hardware test.