We are taking a short break between July 1-7. Orders made during this period will be delayed in shipping.

APU2 APU3 APU4 BIOS upgrade instructions

This page has been updated on March 20, 2021

PC Engines publishes a new BIOS for APU, every 4-8 weeks. Some recent BIOS versions added better support for ECC Ram, and CPU boost to 1.4Ghz therefore it's worth upgrading.

Download the latest BIOS versions here: https://pcengines.github.io/

There are many different ways of flashing a new BIOS on APU routers. Below I'll show how to do it quickly on a few popular operating systems.

  • Method 1: using pfSense
  • Method 2: using IPFire
  • Method 3: using OPNSense
  • Method 4: Generic method, not dependent on the operating system you use.
     

Method 1: flash bios from pfSense

If you have pfSense installed on your router, this is the easier method to use.

Step 1: install flashrom utility

In pfSense web UI, go to Diagnostics -> Command Prompt

Under "Execute Shell Command" type

pkg install -y flashrom

and click Execute. The output should look simialr to this:


Step 2: Download bios your file to your computer.

Get bios file from here: https://pcengines.github.io/

Now upload the file from your computer to the pfsense using "Upload File" under Diagnostics -> Command Prompt

Notice your file will be uploaded to /tmp/

The output should look similar to this:


Step 3: unpack the file

Some BIOS files come packaged in .tar.gz. some come directly as .rom

If you have a .tar.gz file, you will have to extract the .rom first.

To unpack your file issue the following command under "Execute Shell Command". 

tar -xvf /tmp/apu2_v4.12.0.3.rom.tar.gz

 

You will see something like this

Shell Output - tar -xvf /tmp/apu2_v4.12.0.3.rom.tar.gz
tar: Failed to set default locale
x apu2_v4.12.0.3.rom
x apu2_v4.12.0.3.rom.md5

Step 4: Flash bios

Now Under "Execute Shell Command" type

flashrom -w /tmp/apu2_v4.12.0.3.rom -p internal:boardmismatch=force

 

You will see something like this 

flashrom v1.1 on FreeBSD 11.3-STABLE (amd64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 4, resolution: 2ns).
coreboot table found at 0xdffae000.
Found chipset "AMD FCH".
Enabling flash write... OK.
Found Winbond flash chip "W25Q64.V" (8192 kB, SPI) mapped at physical address 0x00000000ff800000.
This coreboot image (PC Engines:apu2) does not appear to
be correct for the detected mainboard (PC Engines:PCEngines apu2).
Proceeding anyway because user forced us to.
Reading old flash chip contents... done.
Erasing and writing flash chip... Erase/write done.
Verifying flash... VERIFIED.

 


Power off the router and then power it back on to load the new BIOS. Hot reboot may not load the new BIOS payload.

Method 2: Flash BIOS from IPFire

IPFire operating system has a pcengines-apu-firmware package that automates the process of installing a new BIOS.

Step 1: SSH to the router or use a serial cable to gain access to the command line.

Step 2: Install pcengines-apu-firmware package

Step 3: Run the update command.

The result should look similar to this:


Method 3: OPNSense BIOS upgrade

If you have OPNSense installed, this is the quickest method.

Step 1: Gain access to command line

Either use ssh or a serial cable. If you decide to use serial cable, you can find putty instructions for Windows here and for macOS here.

Step 2: Install flashrom utility

Execute the following command to install "flashrom". This utility is needed to write a new BIOS to the chip.

 pkg install -y flashrom

Step 3: Download the latest BIOS file

Find the latest BIOS version for your motherboard here https://pcengines.github.io/

Copy the link to the ".rom" file and use wget to download it onto the router. In my case It's APU2 and the latest BIOS is v4.13.0.4. The command I used for downloading the rom file is:

curl -o apu2_v4.13.0.4.rom https://3mdeb.com/open-source-firmware/pcengines/apu2/apu2_v4.13.0.4.rom

Step 4: write the new BIOS to the chip

Use the below command. Make sure you replace the image name with the image you downloaded.

flashrom -w apu2_v4.13.0.4.rom -p internal:boardmismatch=force

Here's how it should look like, if you have done it correctly. 

root@OPNsense:~ # flashrom -w apu2_v4.13.0.4.rom -p internal:boardmismatch=force 
flashrom v1.2 on FreeBSD 12.1-RELEASE-p12-HBSD (amd64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 4, resolution: 2ns).
coreboot table found at 0x7eec2000.
Found chipset "AMD FCH".
Enabling flash write... OK.
Found Winbond flash chip "W25Q64.V" (8192 kB, SPI) mapped at physical address 0x00000000ff800000.
Reading old flash chip contents... done.
Erasing and writing flash chip... Erase/write done.
Verifying flash... VERIFIED.


Method 4: Generic method using Debian Live USB drive

If you don't have pfSense, IPFire or OPNSense installed, use this method.

Step 1: create a bootable USB stick

This method requires you to prepare a bootable USB stick with Debian live distribution. 

Download a "standard" Debian ISO image from here https://cdimage.debian.org/debian-cd/current-live/amd64/iso-hybrid/.

At the time of writing, I'm using debian-live-10.8.0-amd64-standard.iso file. You may see a more recent version, but make sure you download the "-standard.iso" file.

If you are using Windows, flash the image using Rufus: https://rufus.akeo.ie/ if you are using Linux, use dd. 

Connect a Serial cable to APU, and a LAN cable to the first NIC port (closest to serial), insert the newly flashed USB and boot the system.

Use putty to connect to the serial port. Putty instructions for Windows are available here and for macOS here.

Connect power to APU to boot the system. Your Debian Live USB should now boot and display a boot menu as shown on the screenshot below. 


Select the first option and press Tab. Add "console=ttyS0,115200n8" to the end of the command to make the serial connection usable. It should look similar to this:


The password and username to the live Debian USB are

 username: user
 password: live

After logging in, type "sudo su" to become root.


Step 2: install flashrom

You can simply install flashrom from the repository

apt update
apt install flashrom

 

Step 3: download BIOS version for your board

Download the latest BIOS version from here: https://pcengines.github.io/

Make sure you download the correct version. If you have APU3, make sure you download APU3 image.

wget https://3mdeb.com/open-source-firmware/pcengines/apu3/apu3_v4.9.0.3.rom

ls -l apu3_v4.9.0.3.rom

You need a file with .rom extension.

 

Step 4: write the new BIOS to the chip

Use the below command, make sure you replace the image name with the image you downloaded.

flashrom -w apu3_v4.8.0.5.rom -p internal:boardmismatch=force

Here's how it should look like, if you have done it correctly. 

root@debian:~# flashrom -w apu3_v4.8.0.5.rom -p internal:boardmismatch=force
flashrom v0.9.9-r1954 on Linux 4.9.0-6-amd64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Calibrating delay loop... OK.
coreboot table found at 0xcfed1000.
Found chipset "AMD FCH".
Enabling flash write... OK.
Found Winbond flash chip "W25Q64.V" (8192 kB, SPI) mapped at physical address 0x00000000ff800000.
Reading old flash chip contents... done.
Erasing and writing flash chip... Erase/write done.
Verifying flash... VERIFIED.

 

All ready! Power off the router and power it back on. 

 

Troubleshooting

New version of flashrom detects the BIOS chip twice, so you will need to specify it explicitly if you get an error similar to the following.

Using clock_gettime for delay loops (clk_id: 4, resolution: 2ns).
coreboot table found at 0xcfed0000.
Found chipset "AMD FCH".
Enabling flash write... OK.
Found Winbond flash chip "W25Q64BV/W25Q64CV/W25Q64FV" (8192 kB, SPI) mapped at physical address 0x00000000ff800000.
Found Winbond flash chip "W25Q64JV-.Q" (8192 kB, SPI) mapped at physical address 0x00000000ff800000.
Multiple flash chip definitions match the detected chip(s): "W25Q64BV/W25Q64CV/W25Q64FV", "W25Q64JV-.Q"
Please specify which chip definition to use with the -c <chipname> option.

Use the -c flag to specify the chip. Full command:

root@OPNsense:~ # flashrom -w new.rom -p internal:boardmismatch=force -c W25Q64BV/W25Q64CV/W25Q64FV

 

BIOS recovery after failed flashing

If you managed to write a wrong BIOS to the board, or you lost electricity during the upgrade, you can recover with the BIOS flash recovery module.

We have flashed hundreds of BIOSes on these boards and never needed this module. Don't buy it ahead of time :-)