Ipq806x NSS build (Netgear R7800 / TP-Link C2600 / Linksys EA8500)

I enabled Software offloading and reach 280 Mbit.

@ACwifidude Why we have "software offloading disabled" in the recommended configuration?

If you are more interested in the throughput performance for VPN (e.g. wireguard, openvpn etc.), don't use these NSS-based builds, as the crypto encryption/decryption have to be separately processed by the Krait cores while the networking processing is done by the NSS cores.

Enabling software offloading on these NSS builds negates the NSS-accelerated benefits for routing/nat, and it's pretty much the same as running a vanilla OpenWrt build with software offloading enabled.


Built an image off of the newest 5.15 NSS master for the Askey RT4230W and has been up 2 days so far with no issues or reboots. I removed some packages that I don't use and added others (mini-dlna, samba 4, hd-idle and wol). It has a 5TB USB 3 drive connected serving files and as back-up storage. Normal single family home use. Couple laptops, firesticks, phones and two wired desktops all working as well as on 22.03 NSS previously. Thanks!


Thanks for your explanation!

I compared the vanilla OpenWrt build and NSS build. Both with software offloading enabled. NSS build shows better results:

  • I have full internet speed over the wireless (500 Mbit). On vanilla - ~350 Mbit.
  • Up to 280 Mbit on wireguard tunnel

So, I conclude that some NSS-accelerated benefits still work even if software offloading is enabled.

1 Like

Did you use the NSS build with ath10k-ct when doing the comparison tests? Please keep in mind that vanilla builds always use ath10k-ct.

It was NSS build with ath10k and vanilla with default ath10k-ct.

When you have some time, please try to run the test again for NSS build with ath10k-ct. The mainline ath10k always seems to give my devices much better throughput than the ath10k-ct.

Installed the latest 5.15 build on three R7800, 2 are just dumb AP's, 1 is a 100/100 router + AP. It works perfect with NSS Fq_codel. Haven't seen any stability issues either. Thank you for these builds!
Only thing I encounter is this on a opkg update:

Collected errors:
 * opkg_download: Failed to download https://downloads.openwrt.org/snapshots/packages/arm_cortex-a15_neon-vfpv4/nss/Packages.gz, wget returned 8.

root@OpenWrtMain:~# opkg install kmod-usb-ohci
Package kmod-usb-ohci (5.15.88-1) installed in root is up to date.
Collected errors:
 * pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.90-1-fa09f9ede241bc84ae852c0f768eb58b) for kmod-nls-base
 * pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.90-1-fa09f9ede241bc84ae852c0f768eb58b) for kmod-usb-core
 * pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.90-1-fa09f9ede241bc84ae852c0f768eb58b) for kmod-usb-ohci

Ok changed the distfeeds.conf
src/gz openwrt_nss https://raw.githubusercontent.com/ACwifidude/openwrt/kernel5.15-nss-qsdk11/bin/targets/ipq806x/generic/packages-MasterNSS-ath10k

edit: Can't get it to work, can't find the opkg-keys directory in te github repo to download the key from...
Not sure how much work it is to fix this in the next build? Thanks!

I have another issue since I run the NSS build, which is very probably a configuration issue though. I am unable to connect a server I run using my external IP/port combination when I am connected to my internal WiFi network. When I connect from outside (i.e. cellular) all is ok

Since it is a custom build, kmods won’t install from opkg because custom builds get a different hash added to the end that makes the kernel version “incompatible”. To have custom kmods - I recommend recreating my build from post #2 with all the additional features (kmods) you want.

1 Like

Apart from the upload and download throughput (900 Mbps symmetric in the above quote), should any of those other values be adjusted depending on one's Internet connection? I don't understand what they do.

For example, I know that with the regular, non-NSS SQM settings with LuCI, you're supposed to set the per packet overhead based on what type of Internet connection you have.

I have DOCSIS 3.1 (Arris S33 modem + R7800 running 22.03 + Optimum as my ISP), and when I ran Waveform's test with the computer connected directly to the modem via Ethernet, I got 211.5 Mbps down and 19.2 Mbps down and a bufferbloat grade of C. Currently, my startup script looks like the above quote, but with the ingress set to 90350Kbit (95%) and the egress set to 17280Kbit (also 95%).

Is there documentation I can read to understand how to adjust those other values for my particular connection, if needed? Thanks.

Currently I'm unable to compile my own build (both master and 22.03). I've tried on Debian a few times but I always get the same qca-nss-drv error. Has anyone here compiled successfully on Debian. Previously when the master was on 5.10 kernel I compiled it successfully.
What are these ipk packages for?
I'm interested in trying ksmbd-server which cannot be added to the NSS build the easy way.
Is it possible to have the ksmbd-server and its dependencies as a separate ipk package that can be installed later on the NSS build.

I've installed prerelease 0.8.0pre4-1 version of banip (for nftables). So far seems to work.

root@R7800:~# /etc/init.d/banip status
::: banIP runtime information
  + status            : active
  + version           : 0.8.0pre4-1
  + element_count     : 20557
  + active_feeds      : allowlistvMAC, allowlistv4, allowlistv6, blocklistvMAC, blocklistv6, blocklistv4, firehol1v4, fire
  + active_devices    : eth0.2
  + active_interfaces : wan
  + active_subnets    : xx.xx.xx.xx/20
  + run_info          : base_dir: /tmp, backup_dir: /tmp/banIP-backup, report_dir: /tmp/banIP-report, feed_archive: /etc/b
  + run_flags         : protocol (4/6): ✔/✔, log (inp/fwd): ✔/✘, deduplicate: ✔, split: ✔, allowed only: ✘
  + last_run          : action: init, duration: 0m 18s, date: 30.01.2023 21:49:09
  + system_info       : cores: 2, memory: 193, device: Netgear Nighthawk X4S R7800, OpenWrt SNAPSHOT r21829+15-1cefb14230

root@R7800:~# /etc/init.d/banip report
::: banIP Set Statistics (30.01.2023 21:53:40)
    Set                  | Set Elements  | Chain Input   | Chain Forward | Input Packets | Forward Packets
    allowlistvMAC        | 0             | n/a           | OK            | n/a           | 0
    allowlistv4          | 1             | OK            | OK            | 0             | 0
    allowlistv6          | 0             | OK            | OK            | 0             | 0
    blocklistvMAC        | 0             | n/a           | OK            | n/a           | 0
    blocklistv6          | 0             | OK            | OK            | 0             | 0
    blocklistv4          | 0             | OK            | OK            | 0             | 0
    firehol1v4           | 1836          | OK            | OK            | 5             | 21
    firehol2v4           | 18720         | OK            | OK            | 20            | 11
    8                    | 20557         | 6             | 8             | 25            | 32

If you don't mind using the 22.03.3 version instead of snapshot, that module was built as part of this which I posted above:
22.03.3 build. The 22.03.2 version is posted further up, that is the one I'm using.

Maybe all you need is the commit right after all NSS commits are done. Failures to build without it were in the GRE module and in a bunch of NSS kmods that I can live without.

1 Like

Thanks for your work. I will try your build.
Is it possible that you upload Image Builder anywhere (what about mega) so we are able to get it and build with it.