IPQ807X NSS Build

New build with all governors:

root@dimfish:~# cat /sys/devices/system/cpu/cpufreq/policy0/scaling_available_governors
conservative ondemand userspace powersave performance schedutil

https://openwrt.admincomps.ru/nss/

1 Like

good work! thank U~

@dimfish are you using a fork of @Ansuel ecm wifi or @bitthief ? thank you

Here is structure

  • bitthief NSS branch
  • Ansuel nss Wifi offload for mac80211 5.15
  • my fixes to support for mac80211 6.1rc8
1 Like

Hi all,
I also cherry-picked @Ansuel 's patches for wifi offload, based on @bitthief 's openwrt code, and also encountered kernel panic. But I don't have enough knowledge to solve this issue, can anyone give me some advice?

My commits: https://github.com/obhasqr/openwrt/commits/master
The crash log is as below, and I added some logs to print the relevant variables, It looks like it's because vif is null in the ath11k_mac_op_tx method:

[   14.140593] br-lan: port 2(phy0-ap0) entered blocking state
[   14.140650] br-lan: port 2(phy0-ap0) entered disabled state
[   14.145988] device phy0-ap0 entered promiscuous mode
[   14.151343] br-lan: port 2(phy0-ap0) entered blocking state
[   14.155799] br-lan: port 2(phy0-ap0) entered forwarding state
[   14.161620] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   14.571501] br-lan: port 2(phy0-ap0) entered disabled state
[   14.857166] ath11k c000000.wifi: ath11k_mac_op_tx skb_cb = 000000004a4b5e5e
[   14.857213] ath11k c000000.wifi: ath11k_mac_op_tx ar = 00000000ce452949
[   14.862966] ath11k c000000.wifi: ath11k_mac_op_tx info = 00000000dc59296d
[   14.869551] ath11k c000000.wifi: ath11k_mac_op_tx vif = 00000000455fb7a4
[   14.876495] ath11k c000000.wifi: ath11k_mac_op_tx arvif = 0000000049e0b9c6
[   14.883266] ath11k c000000.wifi: ath11k_mac_op_tx hw = 000000007a7149ff
[   14.889950] ath11k c000000.wifi: ath11k_mac_op_tx control = 00000000f2edd779
[   14.896461] ath11k c000000.wifi: ath11k_mac_op_tx skb = 00000000d8ee4594
[   14.903807] IPv6: ADDRCONF(NETDEV_CHANGE): phy0-ap0: link becomes ready
[   14.910556] br-lan: port 2(phy0-ap0) entered blocking state
[   14.916777] br-lan: port 2(phy0-ap0) entered forwarding state
[   14.925116] ath11k c000000.wifi: ath11k_mac_op_tx skb_cb = 00000000ca5079e8
[   15.587089] ath11k_warn: 62 callbacks suppressed
[   15.587107] ath11k c000000.wifi: ath11k_mac_op_tx skb_cb = 00000000ee1fcaf1
[   15.590811] ath11k c000000.wifi: ath11k_mac_op_tx ar = 00000000ce452949
[   15.597485] ath11k c000000.wifi: ath11k_mac_op_tx info = 00000000bfdb8483
[   15.604083] ath11k c000000.wifi: ath11k_mac_op_tx vif = 0000000000000000
[   15.611027] ath11k c000000.wifi: ath11k_mac_op_tx arvif = 00000000048dfdfe
[   15.617798] ath11k c000000.wifi: ath11k_mac_op_tx hw = 000000007a7149ff
[   15.624481] ath11k c000000.wifi: ath11k_mac_op_tx control = 00000000d8496728
[   15.630998] ath11k c000000.wifi: ath11k_mac_op_tx skb = 00000000b37c0fdd
[   15.638306] ath11k c000000.wifi: no vif found for mgmt frame
[   15.859688] ath11k c000000.wifi: ath11k_mac_op_tx skb_cb = 00000000e62ccaf3
[   16.672184] nss-dp 3a003000.dp5-syn lan: PHY Link up speed: 1000
[   16.672285] br-lan: port 1(lan) entered blocking state
[   16.677278] br-lan: port 1(lan) entered forwarding state
[   16.864183] nss-dp 3a007000.dp6-syn wan: PHY Link up speed: 1000
[   16.864271] IPv6: ADDRCONF(NETDEV_CHANGE): wan: link becomes ready
[   17.216498] Unable to handle kernel read from unreadable memory at virtual address 0000000000000440
[   17.216553] Mem abort info:
[   17.224370]   ESR = 0x0000000096000005
[   17.227141]   EC = 0x25: DABT (current EL), IL = 32 bits
[   17.230963]   SET = 0, FnV = 0
[   17.236434]   EA = 0, S1PTW = 0
[   17.239293]   FSC = 0x05: level 1 translation fault
[   17.242334] Data abort info:
[   17.247191]   ISV = 0, ISS = 0x00000005
[   17.250317]   CM = 0, WnR = 0
[   17.253875] user pgtable: 4k pages, 39-bit VAs, pgdp=00000000498cf000
[   17.257008] [0000000000000440] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
[   17.263436] Internal error: Oops: 96000005 [#1] PREEMPT SMP
[   17.271929] Modules linked in: ecm iptable_nat ath11k_ahb ath11k xt_nat xt_REDIRECT xt_MASQUERADE nft_redir nft_nat nft_masq nft_fullcone nft_flow_offload nft_fib_inet nft_ct nft_chain_nat nf_nat nf_flow_table_ipv6 nf_flow_table_ipv4 nf_flow_table_inet nf_flow_table nf_conntrack_netlink nf_conntrack mac80211 ipt_REJECT cfg80211 xt_time xt_tcpudp xt_tcpmss xt_statistic xt_multiport xt_mark xt_mac xt_limit xt_length xt_hl xt_ecn xt_dscp xt_comment xt_TPROXY xt_TCPMSS xt_LOG xt_HL xt_DSCP xt_CLASSIFY tcp_bbr sch_cake qrtr_smd qrtr qmi_helpers pptp ppp_async ns nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_quota nft_objref nft_numgen nft_log nft_limit nft_hash nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_counter nft_compat nf_tproxy_ipv4 nf_tables nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c iptable_mangle iptable_filter ipt_ECN ip_tables crc_ccitt compat sch_tbf sch_ingress sch_htb sch_hfsc em_u32 cls_u32 cls_tcindex cls_route cls_matchall
[   17.272146]  cls_fw cls_flow cls_basic act_skbedit act_mirred act_gact qca_nss_crypto qca_nss_pppoe pppoe pppox ppp_generic slhc qca_nss_bridge_mgr qca_nss_vlan xt_set x_tables ip_set_list_set ip_set_hash_netportnet ip_set_hash_netport ip_set_hash_netnet ip_set_hash_netiface ip_set_hash_net ip_set_hash_mac ip_set_hash_ipportnet ip_set_hash_ipportip ip_set_hash_ipport ip_set_hash_ipmark ip_set_hash_ipmac ip_set_hash_ip ip_set_bitmap_port ip_set_bitmap_ipmac ip_set_bitmap_ip ip_set nfnetlink bonding ip_gre gre ifb qca_nss_drv ip_tunnel shortcut_fe_ipv6 shortcut_fe seqiv michael_mic leds_gpio xhci_plat_hcd xhci_pci xhci_hcd dwc3 dwc3_qcom qca_nss_dp qca_ssdk gpio_button_hotplug aquantia hwmon crc32c_generic
[   17.404904] CPU: 1 PID: 3535 Comm: odhcpd Not tainted 5.15.96 #0
[   17.427139] Hardware name: ZTE MF269 (DT)
[   17.433212] pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   17.437122] pc : ath11k_nss_tx+0x1c/0x140 [ath11k]
[   17.443889] lr : ath11k_mac_tx_mgmt_pending_free+0x25cc/0x7aa0 [ath11k]
[   17.448754] sp : ffffffc00800b5a0
[   17.455258] x29: ffffffc00800b5a0 x28: 000000000000003c x27: 0000000000000000
[   17.458738] x26: 0000000000000420 x25: ffffff8003cad128 x24: 0000000000000000
[   17.465856] x23: ffffffc00800b6b8 x22: ffffff80073f0880 x21: ffffff8003cad130
[   17.472974] x20: ffffff8003cad100 x19: 0000000000000420 x18: ffffff80034d8090
[   17.480092] x17: ffffffc0174a2000 x16: ffffffc00800c000 x15: 0000000000004000
[   17.487210] x14: ffffff80034d8028 x13: 0000000000ffffff x12: 0000000000000002
[   17.494328] x11: ffffffc000f48618 x10: ffffffc00800b580 x9 : ffffffc00800b5a0
[   17.501446] x8 : ffffff8003cad14e x7 : 0000000000000000 x6 : a002389093a09ee8
[   17.508565] x5 : a186d9b29568391e x4 : 0000000000000000 x3 : 0000000000000010
[   17.515683] x2 : 0000000000000001 x1 : ffffff8003cad100 x0 : 0000000000000420
[   17.522801] Call trace:
[   17.529910]  ath11k_nss_tx+0x1c/0x140 [ath11k]
[   17.532169]  ath11k_mac_tx_mgmt_pending_free+0x25cc/0x7aa0 [ath11k]
[   17.536688]  ieee80211_unreserve_tid+0x180/0x1360 [mac80211]
[   17.542850]  ieee80211_subif_start_xmit_8023+0x258/0x4b0 [mac80211]
[   17.548754]  dev_hard_start_xmit+0xe0/0x170
[   17.554738]  __dev_queue_xmit+0x85c/0xaf4
[   17.558905]  dev_queue_xmit+0x14/0x20
[   17.563070]  br_dev_queue_push_xmit+0xac/0x194
[   17.566717]  br_forward_finish+0x9c/0xbc
[   17.571059]  br_nf_hook_thresh+0xdc/0x100
[   17.575138]  br_nf_forward_finish+0xec/0x1e0
[   17.579044]  br_nf_forward_arp+0x258/0x2a4
[   17.583384]  nf_hook_slow+0x4c/0xf0
[   17.587288]  __br_forward+0xa4/0x160
[   17.590675]  br_flood+0xe8/0x1f0
[   17.594494]  br_handle_frame_finish+0x1a8/0x5b0
[   17.597708]  br_handle_frame+0x3f0/0x464
[   17.601960]  __netif_receive_skb_core.constprop.0+0x494/0xcd0
[   17.606131]  __netif_receive_skb_list_core+0xd8/0x1f0
[   17.611771]  netif_receive_skb_list_internal+0x1c8/0x2c0
[   17.616807]  napi_complete_done+0x68/0x1b0
[   17.622187]  nss_core_handle_napi_queue+0x60/0x80 [qca_nss_drv]
[   17.626096]  __napi_poll+0x5c/0x1b4
[   17.631907]  net_rx_action+0xec/0x274
[   17.635379]  _stext+0x10c/0x28c
[   17.639199]  irq_exit+0xbc/0x100
[   17.642150]  handle_domain_irq+0x64/0x90
[   17.645625]  gic_handle_irq+0x54/0xe0
[   17.649530]  call_on_irq_stack+0x28/0x54
[   17.653089]  do_interrupt_handler+0x54/0x60
[   17.657082]  el1_interrupt+0x30/0x70
[   17.660988]  el1h_64_irq_handler+0x18/0x24
[   17.664809]  el1h_64_irq+0x78/0x7c
[   17.668712]  lzma_main+0x384/0x910
[   17.672099]  xz_dec_lzma2_run+0x6cc/0x840
[   17.675485]  xz_dec_run+0x194/0x904
[   17.679563]  squashfs_xz_uncompress+0xc8/0x1c4
[   17.682864]  squashfs_decompress+0x54/0xb0
[   17.687377]  squashfs_read_data+0xbc/0x440
[   17.691458]  squashfs_cache_get+0x120/0x2f0
[   17.695537]  squashfs_get_fragment+0x20/0x30
[   17.699618]  squashfs_readpage+0x4dc/0x660
[   17.704130]  read_pages+0x1c0/0x200
[   17.708036]  page_cache_ra_unbounded+0x15c/0x1f0
[   17.711424]  ondemand_readahead+0x190/0x314
[   17.716284]  page_cache_sync_ra+0xd8/0xe0
[   17.720190]  filemap_get_pages+0xac/0x560
[   17.724356]  filemap_read+0x90/0x2a0
[   17.728349]  generic_file_read_iter+0xec/0x180
[   17.731997]  do_iter_readv_writev+0x118/0x17c
[   17.736249]  do_iter_read+0x7c/0x220
[   17.740674]  vfs_iter_read+0x1c/0x30
[   17.744320]  ovl_read_iter+0x1e0/0x234
[   17.747881]  __kernel_read+0xe8/0x26c
[   17.751439]  kernel_read+0x28/0x60
[   17.755171]  bprm_execve+0x19c/0x4f0
[   17.758471]  do_execveat_common+0x180/0x214
[   17.762203]  __arm64_sys_execve+0x38/0x4c
[   17.766110]  invoke_syscall.constprop.0+0x5c/0x104
[   17.770278]  do_el0_svc+0x6c/0x15c
[   17.774962]  el0_svc+0x18/0x54
[   17.778347]  el0t_64_sync_handler+0xe8/0x114
[   17.781388]  el0t_64_sync+0x184/0x188
[   17.785818] Code: a90153f3 aa0003f3 aa0103f4 f90013f5 (f9401015)
[   17.789380] ---[ end trace d2e927d1d497e308 ]---
[   17.795454] Kernel panic - not syncing: Oops: Fatal exception in interrupt
[   17.800143] SMP: stopping secondary CPUs
[   17.806827] Kernel Offset: disabled
[   17.810899] CPU features: 0x0,00000000,00000802
[   17.814114] Memory Limit: none
[   18.818733] Rebooting in 3 seconds..

gdb info:

(gdb) list *(ath11k_nss_tx+0x1c)
0x4958c is in ath11k_nss_tx (/home/sss/projects/openwrt_bitthief/build_dir/target-aarch64_cortex-a53_musl/linux-ipq807x_generic/backports-6.1-rc8/drivers/net/wireless/ath/ath11k/nss.c:617).
612             ath11k_nss_deliver_rx(arvif->vif, skb, eth_decap, data_offs, napi);
613     }
614
615     int ath11k_nss_tx(struct ath11k_vif *arvif, struct sk_buff *skb)
616     {
617             struct ath11k *ar = arvif->ar;
618             nss_tx_status_t status;
619             int encap_type = ath11k_dp_tx_get_encap_type(arvif, skb);
620             struct ath11k_soc_dp_stats *soc_stats = &ar->ab->soc_stats;
621
(gdb) list *(ath11k_mac_tx_mgmt_pending_free+0x2608)
0x1434c is in ath11k_mac_op_tx (/home/sss/projects/openwrt_bitthief/build_dir/target-aarch64_cortex-a53_musl/linux-ipq807x_generic/backports-6.1-rc8/drivers/net/wireless/ath/ath11k/mac.c:5864).
5859
5860            if (control->sta)
5861                    arsta = (struct ath11k_sta *)control->sta->drv_priv;
5862
5863            if (ar->ab->nss.enabled)
5864                    ret = ath11k_nss_tx(arvif,skb);
5865            else
5866                    ret = ath11k_dp_tx(ar, arvif, arsta, skb);
5867
5868            if (unlikely(ret)) {

If need any other info let me know, thanks.

4 Likes

oh wow gbd.... can you list a guide on how you manage to use the symbol ?

Glad to do it, here are the steps I used:

  1. Find the .ko file with debug_info, If not found please try to compile with CONFIG_DEBUG=y, as wiki said.
$ cd build_dir/
$ find . -name ath11k.ko
./target-aarch64_cortex-a53_musl/root-ipq807x/lib/modules/5.15.96/ath11k.ko
./target-aarch64_cortex-a53_musl/root.orig-ipq807x/lib/modules/5.15.96/ath11k.ko
./target-aarch64_cortex-a53_musl/linux-ipq807x_generic/backports-6.1-rc8/drivers/net/wireless/ath/ath11k/ath11k.ko
./target-aarch64_cortex-a53_musl/linux-ipq807x_generic/backports-6.1-rc8/ipkg-aarch64_cortex-a53/kmod-ath11k/lib/modules/5.15.96/ath11k.ko
./target-aarch64_cortex-a53_musl/linux-ipq807x_generic/backports-6.1-rc8/.pkgdir/kmod-ath11k/lib/modules/5.15.96/ath11k.ko

$ file ./target-aarch64_cortex-a53_musl/root-ipq807x/lib/modules/5.15.96/ath11k.ko ./target-aarch64_cortex-a53_musl/linux-ipq807x_generic/backports-6.1-rc8/drivers/net/wireless/ath/ath11k/ath11k.ko ./target-aarch64_cortex-a53_musl/linux-ipq807x_generic/backports-6.1-rc8/ipkg-aarch64_cortex-a53/kmod-ath11k/lib/modules/5.15.96/ath11k.ko ./target-aarch64_cortex-a53_musl/linux-ipq807x_generic/backports-6.1-rc8/.pkgdir/kmod-ath11k/lib/modules/5.15.96/ath11k.ko
./target-aarch64_cortex-a53_musl/root-ipq807x/lib/modules/5.15.96/ath11k.ko:                                                                ELF 64-bit LSB relocatable, ARM aarch64, version 1 (SYSV), not stripped
./target-aarch64_cortex-a53_musl/linux-ipq807x_generic/backports-6.1-rc8/drivers/net/wireless/ath/ath11k/ath11k.ko:                         ELF 64-bit LSB relocatable, ARM aarch64, version 1 (SYSV), BuildID[sha1]=8f62e99d8a05f9e32bd71de93d55455c31763629, with debug_info, not stripped
./target-aarch64_cortex-a53_musl/linux-ipq807x_generic/backports-6.1-rc8/ipkg-aarch64_cortex-a53/kmod-ath11k/lib/modules/5.15.96/ath11k.ko: ELF 64-bit LSB relocatable, ARM aarch64, version 1 (SYSV), not stripped
./target-aarch64_cortex-a53_musl/linux-ipq807x_generic/backports-6.1-rc8/.pkgdir/kmod-ath11k/lib/modules/5.15.96/ath11k.ko:                 ELF 64-bit LSB relocatable, ARM aarch64, version 1 (SYSV), BuildID[sha1]=8f62e99d8a05f9e32bd71de93d55455c31763629, with debug_info, not stripped
  1. Find openwrt toolchain gdb, I tried to use the host gdb, and an error occurs when loading symbol.
$ find . -type f -name gdb
./toolchain-aarch64_cortex-a53_gcc-12.2.0_musl/gdb-12.1/gdb/gdb
  1. Load file with symbol
./toolchain-aarch64_cortex-a53_gcc-12.2.0_musl/gdb-12.1/gdb/gdb ./target-aarch64_cortex-a53_musl/linux-ipq807x_generic/backports-6.1-rc8/drivers/net/wireless/ath/ath11k/ath11k.ko
6 Likes

well done !

no idea .ko could be used as a symbol source this was my missing info in all this time

i don't know it's related but there is a patch for only bug triggered when offload enabled fix null ptr dereference when tx offload is enabled

Thank you for sharing, but I found that this patch is already included in @Ansuel 's patches. And I found out that it's a patch series, so I tested another patch as well, but the same problem still occurs.
image

1 Like

I managed to have nss-qdisc/nss-ifb supporting more than one device (as i use mwan3).

Simple hack - created a copy of the nss-ifb package (nss-ifb2) and changed the device name in the code from nssifb to nssifb2 ...a few other things

[  972.120374] Created a NSS virtual interface for dev [nssifb]
[  972.126932] NSS IFB data callback registered
[  972.132645] NSS IFB transmit callback registered
[  972.137442] NSS IFB module loaded.
[  975.908739] 00000000a69bf544: Found net device [10g-1]
[  975.908789] 00000000a69bf544: Net device [10g-1] has NSS intf_num [5]
[  975.912909] Nexthop successfully set for [10g-1] to [nssifb]
[  988.464905] debugfs: File 'virt_if' in directory 'stats' already present!
[  988.465126] Created a NSS virtual interface for dev [nssifb2]
[  988.470702] NSS IFB data callback registered
[  988.476425] NSS IFB transmit callback registered
[  988.481301] NSS IFB module loaded.
[  999.285221] 00000000a69bf544: Found net device [lan1]
[  999.285269] 00000000a69bf544: Net device [lan1] has NSS intf_num [4]
[  999.289357] Nexthop successfully set for [lan1] to [nssifb2]

qdisc nsstbl 1: dev nssifb root refcnt 2 buffer/maxburst 1Mb rate 1024Mbit mtu 1514b accel_mode 0
qdisc nssfq_codel 10: dev nssifb parent 1: target 5ms limit 10240p interval 100ms flows 1024 quantum 1514 set_default accel_mode 0
qdisc nsstbl 1: dev nssifb2 root refcnt 2 buffer/maxburst 1Mb rate 1024Mbit mtu 1514b accel_mode 0
qdisc nssfq_codel 10: dev nssifb2 parent 1: target 5ms limit 10240p interval 100ms flows 1024 quantum 1514 set_default accel_mode 0

1 Like

@adamhnat and @ccost1974 I ran into this issue again and found that it's actually from creating a Hyper-V virtual switch with the Wireless card.

After a lot of searching, I found this article which actually fixed the issue without having to delete the virtual switch, in case you are in the same boat: https://www.tenforums.com/virtualization/183576-very-slow-up-download-speeds-hyperv-external-switch-setup.html

2 Likes

Can you elaborate on how you implemented multiple nss-qdisc/nss-ifb devices? I am currently connected to 3 ISP's networks through a single fiber optic, I would love to try your method to achieve different QOS for my 3 ISPs.

how to make sqm work on AX3600 using nss_fqcodel?

when i try to setup tc commands for nsstbl and nssfq_codel
this is the error showing in ssh log:

Unknown qdisc "nsstbl", hence option "rate" is unparsable
Unknown qdisc "nssfq_codel", hence option "limit" is unparsable

seting up the nss-ifb module works with no problems.

Thank you.

the code for the second nss-ifb is on this repo ... if you diff this code with the original you will know how to create an additional device if you so wish

i couldn't find time to change the code to accept more than one device. So is not very elegant but it works

load the modules

insmod nss-ifb nss_dev_name=10g-1
insmod nss-ifb2 nss_dev_name=lan1

Bring up the nssifb interface to active ingress redirect

ip link set up nssifb
ip link set up nssifb2

Shape ingress traffic to 1024Mbit with chained NSSFQ_CODEL

tc qdisc add dev nssifb root handle 1: nsstbl rate 1024Mbit burst 4Mb
tc qdisc add dev nssifb parent 1: handle 10: nssfq_codel limit 10240 flows 1024 quantum 1514 target 5ms interval 100ms set_default

tc qdisc add dev nssifb2 root handle 1: nsstbl rate 1024Mbit burst 4Mb
tc qdisc add dev nssifb2 parent 1: handle 10: nssfq_codel limit 10240 flows 1024 quantum 1514 target 5ms interval 100ms set_default

2 Likes

have you build the kmod-qca-nss-drv-qdisc package ? this installs the nss qdisc

Yes I've included the kmod package, but for some reason it shows errors when i input those commands.

tc -d qdisc logs:

root@Xiaomi_NSS:~# tc -d qdisc
qdisc noqueue 0: dev lo root refcnt 2
qdisc mq 0: dev wan root
qdisc fq_codel 0: dev wan parent :4 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 4Mb ecn drop_batch 64
qdisc fq_codel 0: dev wan parent :3 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 4Mb ecn drop_batch 64
qdisc fq_codel 0: dev wan parent :2 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 4Mb ecn drop_batch 64
qdisc fq_codel 0: dev wan parent :1 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 4Mb ecn drop_batch 64
qdisc mq 0: dev lan1 root
qdisc fq_codel 0: dev lan1 parent :4 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 4Mb ecn drop_batch 64
qdisc fq_codel 0: dev lan1 parent :3 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 4Mb ecn drop_batch 64
qdisc fq_codel 0: dev lan1 parent :2 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 4Mb ecn drop_batch 64
qdisc fq_codel 0: dev lan1 parent :1 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 4Mb ecn drop_batch 64
qdisc mq 0: dev lan2 root
qdisc fq_codel 0: dev lan2 parent :4 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 4Mb ecn drop_batch 64
qdisc fq_codel 0: dev lan2 parent :3 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 4Mb ecn drop_batch 64
qdisc fq_codel 0: dev lan2 parent :2 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 4Mb ecn drop_batch 64
qdisc fq_codel 0: dev lan2 parent :1 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 4Mb ecn drop_batch 64
qdisc mq 0: dev lan3 root
qdisc fq_codel 0: dev lan3 parent :4 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 4Mb ecn drop_batch 64
qdisc fq_codel 0: dev lan3 parent :3 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 4Mb ecn drop_batch 64
qdisc fq_codel 0: dev lan3 parent :2 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 4Mb ecn drop_batch 64
qdisc fq_codel 0: dev lan3 parent :1 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 4Mb ecn drop_batch 64
qdisc noqueue 0: dev br-lan root refcnt 2
qdisc noqueue 0: dev phy2-ap0 root refcnt 2
qdisc noqueue 0: dev phy1-ap0 root refcnt 2
qdisc fq_codel 0: dev nssifb root refcnt 2 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 4Mb ecn drop_batch 64

When adding nsstbl,

root@Xiaomi_NSS:~# ip link set up nssifb
root@Xiaomi_NSS:~# tc qdisc add dev nssifb root handle 1: nsstbl rate 1024Mbit burst 4Mb
Unknown qdisc "nsstbl", hence option "rate" is unparsable

what "lsmod|grep qdisc" shows ?
here's what mine shows

qca_nss_drv          1056768 16 nss_ifb2,nss_ifb,act_nssmirred,ecm,qca_nss_tunipip6,qca_nss_tun6rd,qca_nss_crypto,qca_nss_qdisc,qca_nss_vxlanmgr,qca_nss_pppoe,qca_nss_map_t,qca_nss_lag_mgr,qca_nss_l2tpv2,qca_nss_gre,qca_nss_bridge_mgr,qca_nss_vlan
qca_nss_qdisc          94208  6
qca_ssdk             1720320  5 qca_nss_qdisc,qca_nss_bridge_mgr,qca_nss_vlan,qca_nss_drv,qca_nss_dp

note also that you already have nssifb attached to fq_codel ... worth rmmod nssifb before doing anything and start from the beggining with insmod