That is the folder where I keep my diffconfig on my build system. If you clone my directory the diffconfig is included so you can delete that part of the command.
don’t run make dirclean after all the prior commands. That thoroughly cleans out the directory and deletes everything you just did.
I’d edit the diffconfig to your liking - after you’ve edited it to your own liking your build process would look like this (the 4 after the make command represent a 3 CPU system, feel free to use more CPUs if you have more CPUs):
git clone -b kernel5.4-nss-qsdk10.0 https://github.com/ACwifidude/openwrt.git
cd openwrt
git remote add upstream https://git.openwrt.org/openwrt/openwrt.git
git fetch upstream && git rebase upstream/master && ./scripts/feeds update -a && ./scripts/feeds install -a && cp diffconfig .config && make defconfig && ./scripts/getver.sh
make -j4
Still running @ACwifidude latest and had 2 router crashes this morning. I am guessing it was the router and not the service (ATT fiber) because I could no longer get to the router UI.
Wifi load minimal. 3 computers connected 2 kids in 'school' and me at 'work'. It has been very stable since I loaded it up till this AM. I could not get to the router to see the log. Pretty low load.
68% Memory available, Load Average: 0.02, 0.04, 0.05...
The version was 20201029. I just flashed my version that I built (20201108) and will see hos it goes. It is strange that it has been stable for a number of days then just spontaneously rebooted. 3x today.
Does anyone know if any additional fixes have been made to the NSS codebase?
The last change on @Ansuel's repo is 3 weeks old
Just wondering if it makes sense to do a new build.
It has just been master rebasing since then. I like to keep up with the latest kernel to get updates to software packages and bug fixes. I push rebases every couple days.
Some people above were capturing some logs. To make further improvements the developers need logs of issues / crashes specific to NSS drivers.
NSS builds have been the equivalent of normal master builds for me so I’ve been only building with NSS drivers included to get maximum performance on my three r7800’s.
Thank you @ACwifidude and @Ansuel, bugfixes and better stability are always welcome.
It seems that the kernel mainline also had a few updates, so it is time to run a rebuild
Regarding logs, if you have some specific steps we should include to collect them, please, feel free.
WARNING: Makefile 'package/qca/qca-nss-drv/Makefile' has a dependency on 'kmod-qca-nss-dp', which does not exist
WARNING: Makefile 'package/qca/qca-nss-ecm/Makefile' has a dependency on 'kmod-qca-ovsmgr', which does not exist
WARNING: Makefile 'package/qca/qca-nss-ecm/Makefile' has a dependency on 'kmod-qca-ovsmgr', which does not exist
WARNING: Makefile 'package/qca/qca-nss-ecm/Makefile' has a dependency on 'kmod-qca-ovsmgr', which does not exist
WARNING: Makefile 'package/qca/qca-nss-ecm/Makefile' has a dependency on 'kmod-qca-hyfi-bridge', which does not exist
WARNING: Makefile 'package/qca/qca-nss-ecm/Makefile' has a dependency on 'kmod-qca-mcs', which does not exist
WARNING: Makefile 'package/qca/qca-nss-ecm/Makefile' has a dependency on 'kmod-qca-ovsmgr', which does not exist
WARNING: Makefile 'package/qca/qca-nss-ecm/Makefile' has a dependency on 'kmod-qca-hyfi-bridge', which does not exist
WARNING: Makefile 'package/qca/qca-nss-ecm/Makefile' has a dependency on 'kmod-qca-mcs', which does not exist
PS: This router is only supported on the snapshots.
PS2: I don't know if this is relevant or not, but with the November 12th snapshops, I can't get the WAN to work. Not even with static IP address. Had to return to the November 9th one:
Good to know that this finally gets some traction. The ipq806x (and I believe for ipx807x) NSS firmware currently doesn't support GCM mode tho. I guess the developers concentrated on GCM due to it being the recommended mode currently. Hopefully adding AES-CBC-SHA-HMAC mode should be straightforward.
At the moment I don't really have much time to hack router firmware due to work. Hopefully I can restart this sometime in future soon.
Do you think the openvpn kmod will give better perf as it will skip the userspace problem?
Also I wonder if wireguard performance can benefit of the crypto core.
To follow up and to raise awareness for others on the spontaneous restarts, there seem to be an underlying bug not related to NSS that may cause router restarts.
I had 17d uptime with my NSS build before a spontaneous restart yesterday.
The crash logs points directly to the already created bug report below.
The workaround mentioned in that bug report is to use performance governor.
Your restarts may be from a different cause but it might be worth a try to change to performance governor if you are still facing frequent restart problem and not already using the performance governor.
As for the fix for that reported bug, it may take quite some time to get fixed...
Definitely. From what I’ve tested with the NSS crypto core, moving from user space to kernel space for the data plane results in 4X improvement in thruput. With further optimization, it should go higher (I hope) with better integration with the NSS firmware.
I briefly looked at the ovpn-dco code. It looks like they are creating a separate network interface and not using the Linux tun interface, which makes sense since the tun interface is mainly for user space processes to send network packets. I think using the new approach should make integration with the NSS a lot easier using the NSS virtual interface APIs.
Unfortunately the NSS firmware doesn’t support the crypto algorithm or the authentication mode that WireGuard is using. Good news is that I could get about 200mbps (if my memory serves) thruput between a mt7621 and a bcm4708 SoC router over a WAN link between two ISPs across two countries. Using ipq806x SoC routers for both ends would definitely results in higher WireGuard thruput.
