How to enable Fast-NAT support(MTK_APSOC_WIFI_FAST_NAT_SUPPORT)?

[hpx502766238]

I have tried to enable this function in menuconfig,but failed to build:"xxx is not defined".It seems to lack of some dependencies.
Can you fix it?
I guess the sourcecode from padavanonly may offer a help:
package/mtk/mt7622/Makefile

[bricco1981]

well,to do that you need other stuff in mediatek folder. here we have things missing. that is for DSA right? to do that you should be on old swconfig. i ll make a testing build before sharing the code.

[hpx502766238]

well,to do that you need other stuff in mediatek folder. here we have things missing. that is for DSA right? to do that you should be on old swconfig. i ll make a testing build before sharing the code.

DSA+Openwrt NAT,or swconfig+ MTK NAT,which is faster?

[hpx502766238]

In addition, I want the firmware to automatically "add ra0/rai0 to br-lan" during the device's first startup. How can I change the code to achieve this? I have tried setting "EAPifname=br-lan" in the file mt7615.1.dat located in package/mtk/luci-app-mtwifi/files/ before compiling the firmware. However, it doesn't take effect at startup. I still need to login to the web interface using a wired connection, then re-tick the option and manually reload the Wi-Fi settings.

[bricco1981]

well i did alot changes, but i'm having problem with luci-lib-jquery-1-4 .how you did that?
i compiled swconfig+ MTK NAT

[hpx502766238]

well i did alot changes, but i'm having problem with luci-lib-jquery-1-4 .how you did that? i compiled swconfig+ MTK NAT

copy

well i did alot changes, but i'm having problem with luci-lib-jquery-1-4 .how you did that? i compiled swconfig+ MTK NAT

luci-lib-jquery-1-4 is from bmx6
just copy bmx6 from openwrt routing 21.02 https://github.com/openwrt/routing/tree/a9e43101bb726070cbf81b6225fc0625f4a4a5e5/bmx6
https://github.com/openwrt/routing/tree/a9e43101bb726070cbf81b6225fc0625f4a4a5e5/luci-app-bmx6

[bricco1981]

I did, i can select it but it wont compile,and i get no error.very strange.

[hpx502766238]

About auto-applying "add ra0/rai0 to br-lan", I have searched for a while. The conclusion is that to apply this configuration, the sbin/mtkwifi tool does not provide a direct function for it; instead, it relies on the "vif_enable" function from mtkwifi.lua. Therefore, I need to make an HTTP request at startup, for example, using curl -s http://127.0.0.1/cgi-bin/luci/admin/network/wifi/vif_enable/ra0. However, at present, there is an issue with authentication or logging in to perform this action.

[bricco1981]

I add ra0 and rai0 to br-lan, but at first boot i like that the radios are down.today or tomorrow i'll share the firmware.

[hpx502766238]

I add ra0 and rai0 to br-lan, but at first boot i like that the radios are down.today or tomorrow i'll share the firmware.

Thanks for your work.Remember to make a new branch for swconfig.

[bricco1981]

hi @hpx502766238 can you test the build please? do not keep setting. in firewall select software and hardware offload or the device will not work at all on wan side. well you really need only hardware offloadind like this.

config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
#option flow_offloading '1'
option flow_offloading_hw '1'

[hpx502766238]

hi @hpx502766238 can you test the build please? do not keep setting. in firewall select software and hardware offload or the device will not work at all on wan side. well you really need only hardware offloadind like this.

config defaults option input 'ACCEPT' option output 'ACCEPT' option forward 'REJECT' option synflood_protect '1' #option flow_offloading '1' option flow_offloading_hw '1'

Ok,I will test later.

[hpx502766238]

hi @hpx502766238 can you test the build please? do not keep setting. in firewall select software and hardware offload or the device will not work at all on wan side. well you really need only hardware offloadind like this.

config defaults option input 'ACCEPT' option output 'ACCEPT' option forward 'REJECT' option synflood_protect '1' #option flow_offloading '1' option flow_offloading_hw '1'

At present, the wired speed test sometimes shows a sharp drop in throughput, but everything else is working normally. The wireless network is very stable without packet loss and delay.

[bricco1981]

What speed do you get via Ethernet?

try to play with software and hardware nat in firewall.

[hpx502766238]

What speed do you get via Ethernet?

I currently do not have a 1000Mbps broadband testing condition. I tested it under a 200Mbps broadband environment. Currently, the lowest speed during the sudden drop is around 50Mbps.

[hpx502766238]

What speed do you get via Ethernet?

try to play with software and hardware nat in firewall.

Software and hardware nat are already enabled.

[bricco1981]

something is wrong on your side i have 300Mbps and never fail. have you done just hardware offload like my config?
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
#option flow_offloading '1'
option flow_offloading_hw '1'
is the device using just lan or wan too? wan cable or wwan? or in repeter mode? like apclii0 on br-lan?

[hpx502766238]

something is wrong on your side i have 300Mbps and never fail. have you done just hardware offload like my config? config defaults option input 'ACCEPT' option output 'ACCEPT' option forward 'REJECT' option synflood_protect '1' #option flow_offloading '1' option flow_offloading_hw '1' is the device using just lan or wan too? wan cable or wwan? or in repeter mode? like apclii0 on br-lan?

How can I apply the above settings? I don't know how to manually edit firewall rules.In addition, I did test it in the standard main router mode, where the LAN and wireless are in the same network segment, and the WAN port automatically obtains the address through DHCP. It is not in a mode such as wireless bridging or repeating.

[hpx502766238]

something is wrong on your side i have 300Mbps and never fail. have you done just hardware offload like my config? config defaults option input 'ACCEPT' option output 'ACCEPT' option forward 'REJECT' option synflood_protect '1' #option flow_offloading '1' option flow_offloading_hw '1' is the device using just lan or wan too? wan cable or wwan? or in repeter mode? like apclii0 on br-lan?

How can I apply the above settings? I don't know how to manually edit firewall rules.In addition, I did test it in the standard main router mode, where the LAN and wireless are in the same network segment, and the WAN port automatically obtains the address through DHCP. It is not in a mode such as wireless bridging or repeating.

I plan to conduct a more thorough and professional test using iperf3 on Sunday, utilizing a 1000M ethernet connection.

[bricco1981]

Yes thanks, will be good test at that speed,i never tested. Sftp to the router,go in etc/config/firewall

[hpx502766238]

The test has been completed.
Test environment:
Terminal：Windows 11 Home，iperf3 v3.1.5
lan:192.168.31.1(wireless and switch)
wan:192.168.1.2
**server ip address:**192.168.1.3,
running in command "iperf3 -s & iperf3 -s -p 5001",(port 5201 and port 5001)
**client ip address:**192.168.31.163
Firewall settings：
【config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
option flow_offloading '1'
option flow_offloading_hw '1'】

The results are as follows:
1.Single Wired Downlink Test:

2.Single Wired Uplink Test:

3. Wired Uplink+Downlink Test:

The maximum throughput rate is approximately 1.3G, with 940M UL and 400M DL.
4. Wireless 5G 160Mhz Downlink Test:

5. Wireless 5G 160MhzUplink Test:

6.Wireless 5G 160Mhz UDP Test（test for packet loss rate）：

I also tested with DSA+Openwrt HNAT, and I will only list the differences:
1.Wired Uplink+Downlink Test:

2. Wireless 5G 160Mhz Downlink Test:

3.Wireless 5G 160MhzUplink Test:

The conclusion is:
1.It seems work well,all results are normal.
2.The maximum throughput with wired UL+DL NAT works better than DSA+OP HNAT.
3.Although the wireless 5G downlink rate is 100M higher than DSA+OP NAT, the uplink rate is 50% lower than DSA+OP HNAT.
4.In the wired test, the uplink packets have higher priority than the downlink packets, contrary to the wireless test.
5.I must enable both the "option flow_offloading" and "option flow_offloading_hw", otherwise HWNAT will not function at all, and the network performance will be extremely poor.

[hpx502766238]

Another issue is that the 5G signal is lost after the system reboot, and I must reload it manually.

[hpx502766238]

The most crucial issue lies in the uplink speed of 5G at 160Mhz, which is only 200M. I have tested DSA+Op HWNAT and found that the highest average speed can reach 800M.

[bricco1981]

Set the channel on 5ghz radio, do not leave auto.i know it's not perfect,but in the long run this firmware should be very stable.
you miss the wwan test on 5ghz radio, that is the test i was waiting.

[hpx502766238]

Set the channel on 5ghz radio, do not leave auto.i know it's not perfect,but in the long run this firmware should be very stable. you miss the wwan test on 5ghz radio, that is the test i was waiting.

Currently, it seems that I am unable to perform WWAN testing as the AX6S I am using is the standard version made in China and not a specially customized version. It does not come with a mobile broadband module. Additionally, I would appreciate it if you could share your code with me. I am very interested in studying the modifications you have made. Personally, I believe the ideal solution would be to use MTK HNAT+dsa in combination with the openwrt fork of lean lede for compilation. However, I am uncertain if this is achievable and whether swconfig is absolutely necessary.

[bricco1981]

Wwan is client mode
Create an interface wwan, set as device apclii0, scan on 5ghz and connect.here you ll see the difference, the radio in station mode should be able to do hardware nat.
make sure that the new interface wwan is on wan firewall zone.

[hpx502766238]

Wwan is client mode Create an interface wwan, set as device apclii0, scan on 5ghz and connect.here you ll see the difference, the radio in station mode should be able to do hardware nat. make sure that the new interface wwan is on wan firewall zone.

I understand now. It sounds like a wireless bridge operating in routing mode. However, before I proceed with the test in 15 days, can you share your code with me first? As I am currently away from home and do not have the test environment available, I would like to study your code in the meantime.

[hpx502766238]

Wwan is client mode Create an interface wwan, set as device apclii0, scan on 5ghz and connect.here you ll see the difference, the radio in station mode should be able to do hardware nat. make sure that the new interface wwan is on wan firewall zone.

I may have misunderstood it before. After you mentioned wwan, it suddenly occurred to me today that does the wireless fast nat only apply to wireless nat? If I understand correctly now, it calls the hnat module in the wireless chip, while the wired nat calls another hardware, I guess it's the hnat module of the mt7622 processor. These two nat modules are completely unrelated, so after enabling the wireless fast nat, it actually has no impact on the throughput and delay of wired wan to lan or wired wan to wireless, right? I don't know much about hardware, I don't know if this understanding is correct. If there is any mistake, I hope you can help me understand. Actually, my intention is to speed up the forwarding speed from wireless to wired wan port after enabling the wireless fast nat. It seems that I have always misunderstood it.

[hpx502766238]

Wwan is client mode Create an interface wwan, set as device apclii0, scan on 5ghz and connect.here you ll see the difference, the radio in station mode should be able to do hardware nat. make sure that the new interface wwan is on wan firewall zone.

I conducted a brand new test in WWAN networking mode,#8

[bricco1981]

Hi, sorry for the delay in replying. I think we will have to do more tests. as soon as I have some free time we will try. I think one test to do is to try the 5.4.xx kernel. Could this nat hardware malfunction be due to nftables? the 5.4 kernel uses iptables. We will see.

[bricco1981]

are you sure in /etc/wireless/mt7615/mt7615.2.dat is enabled? mine was not

Wds3Key=
WdsEnable=0
WdsEncrypType=NONE
WdsList=
WdsPhyMode=0
WEP1Type1=0
WEP2Type1=0
WEP3Type1=0
WEP4Type1=0
WHNAT=1
WiFiTest=0

[hpx502766238]

are you sure in /etc/wireless/mt7615/mt7615.2.dat is enabled? mine was not

Wds3Key= WdsEnable=0 WdsEncrypType=NONE WdsList= WdsPhyMode=0 WEP1Type1=0 WEP2Type1=0 WEP3Type1=0 WEP4Type1=0 WHNAT=1 WiFiTest=0

yes,I am sure it is enabled by default even if I restore to factory settings:
WEP1Type1=0
WEP2Type1=0
WEP3Type1=0
WEP4Type1=0
WHNAT=1
WiFiTest=0
WirelessMode=17
WmmCapable=1
WNMEnable=1
.I can also see whnat init info in kernel log.
Fri Oct 14 22:47:45 2022 kern.info kernel: [ 26.385225] whnat_cap_support(): chip_id=7915 is in WHNAT support list
Fri Oct 14 22:47:45 2022 kern.info kernel: [ 26.391821] wifi_slot_get(): bus name=PCI Bus 0000:01, funid=0, get slot id=0
Fri Oct 14 22:47:45 2022 kern.info kernel: [ 26.399051] whnat_entry_acquire(): PCIE SLOT:0, hook to WHNAT,entry id=0
Fri Oct 14 22:47:45 2022 kern.info kernel: [ 26.405908] wed_init(0): irq=20,base_addr=0xffffffc010dd5000
Fri Oct 14 22:47:45 2022 kern.info kernel: [ 26.412471] wed_ring_init(): wed ring init result = 0
Fri Oct 14 22:47:45 2022 kern.info kernel: [ 26.433249] create wed ok!!!
Fri Oct 14 22:47:45 2022 kern.info kernel: [ 26.436274] wdma_init(): wdma(0) base addr=ffffffc010dd7800
Fri Oct 14 22:47:45 2022 kern.info kernel: [ 26.441996] wdma_init(): wdma(0) irq[0]=33
Fri Oct 14 22:47:45 2022 kern.info kernel: [ 26.446091] wdma_init(): wdma(0) irq[1]=34
Fri Oct 14 22:47:45 2022 kern.info kernel: [ 26.450262] wdma_init(): wdma(0) irq[2]=35
Fri Oct 14 22:47:45 2022 kern.info kernel: [ 26.454877] wifi_chip_probe(): Chang CHIP IRQ: 144 to WHNAT IRQ: 20

[bricco1981]

So you said that wireless side is working better on non hardware nat drivers?

[hpx502766238]

So you said that wireless side is working better on non hardware nat drivers?

Yes,the throughput is much higher on non-hardware NAT drivers, but CPU usage is much higher, too.
(Only for wwan situation.)

[bricco1981]

and if you enable hardware and software offload in firewall? no difference on wireless side?

very strange situation.

if you tell me how i can sent you this stuff i'll sent you. so we will have two eyes on that.

[hpx502766238]

and if you enable hardware and software offload in firewall? no difference on wireless side?

very strange situation.

if you tell me how i can sent you this stuff i'll sent you. so we will have two eyes on that.

1.I didn't enable linux offload in firewall when tested your firmware.
2.In fact,there are some other difference on wireless side between your firmware and my [mtwifi+ linux offload] firmware(without mtkhnat).
https://github.com/hpx502766238/lede-R24.4.4-MTK/tree/213f2713358060901860fb1201e30b8991cca7f9/package/mtk/mt7915
This is my repo I had tested before.I changed some default options such as fast uprate in
n config.in and 7615.2.dat to improve performance,referring to profile from padavanonly and official miwifi firmware.You can compare the difference between them.

[hpx502766238]

and if you enable hardware and software offload in firewall? no difference on wireless side?

very strange situation.

if you tell me how i can sent you this stuff i'll sent you. so we will have two eyes on that.

3.you can send stuff to my email,502766238@qq.com.

[bricco1981]

you can check now

[hpx502766238]

you can check now

ok，I received.

[hpx502766238]

you can check now

Is the wifi driver you send to me different from your current github repo?I found some differences，it seems to be an older driver,similar to padavanonly.

[bricco1981]

I do not remember,if you think so use the one on the repo,and add the needed files.

[hpx502766238]

I do not remember,if you think so use the one on the repo,and add the needed files.

I compiled a new firmware with lede,kernel 5.10.214(same kernel version with Openwrt22.03 Snapshot).At present,the "wlan to wan" situation works fine,and I don't need to turn on the linux flowoffload.I am not at home now and cannot perform a test for the whnat situation.I plan to perform it after 15 days.
About your question " if you enable hardware and software offload in firewall?".the answer is no.I guess the reason why you need to turn on it on openwrt 22.03.6 is that you may use an outdated mtk/mt7622/files/mtkhnat.ko which is from old hnat driver when compiled with wireless drivers.
Instead,I added these to wireless driver Makefile:
define KernelPackage/mt_wifi
CATEGORY:=Kernel modules
TITLE:=MTK wifi AP driver
ifneq ($(CONFIG_MTK_FAST_NAT_SUPPORT), )
ifneq ($(CONFIG_NET_MEDIATEK_HNAT), )
DEPENDS+=+kmod-mediatek_hnat
endif
endif
ifneq ($(CONFIG_MTK_WHNAT_SUPPORT), )
ifneq ($(CONFIG_MTK_WARP_V2), )
so the wireless driver was compiled with the newest mtkhnat.ko which was generated by mtksdk.

[bricco1981]

show the full makefile please i have a mess here.

[hpx502766238]

show the full makefile please i have a mess here.
mt7622
https://github.com/hpx502766238/lede-R24.4.4-MTK/blob/5f25e5faa46dc37643fa6d578bcaee8e0c694755/package/mtk/mt7622/Makefile
mt7915
https://github.com/hpx502766238/lede-R24.4.4-MTK/blob/5f25e5faa46dc37643fa6d578bcaee8e0c694755/package/mtk/mt7915/Makefile

[bricco1981]

so how you know that it's working fine if you cannot test it? lol, just curios.
thanks, so you think we are on the good way to make wireless side better?

[hpx502766238]

so how you know that it's working fine if you cannot test it? lol, just curios. thanks, so you think we are on the good way to make wireless side better?

I only tested for "wlan to wan" situation just now,not all situations.
At present,it's working fine on this situation,with an average speed 750M for downlink and 650M for uplink.CPU usage never exceed 25%.
The wireless is much better than ever. Yes, we are on the right track. I guess the key factor impacting the speed of whnat might be the APCLI MIMO settings. I believe it will work well when I test it again at home next time.

[bricco1981]

yes all setting for apcli, and i think is good to force it to mode=17
that's what i'm looking too. but still i cannot do a real test. i do not have that speed

[bricco1981]

even with new makefiles it do not work right on 22.03.6 i need enable software and hardware nat. this on wwan.

[hpx502766238]

you can check now

the mtksdk seems to be published before 2021,Nov.Because it has an option called CONFIG_NET_MEDIATEK_HW_QOS,refer to the date of this commit hpx502766238/mtk-openwrt-feeds@2494820.
so if I want to use this version of hqos,how to do？Is there any instruction files？

[hpx502766238]

even with new makefiles it do not work right on 22.03.6 i need enable software and hardware nat. this on wwan.

About whnat,I will make a full test this weekend.You can try op22.03 snapshot with kernel version 5.10.214 instead if mtkhnat didn't take effect by default.

[bricco1981]

well, i'm reading the code a bit and i think the easy way is to stay on openwrt 22.03.2 because the /etc/firewall.user is working. on later version of openwrt you need adapt nftables to iptables.
it' my guess

[hpx502766238]

well, i'm reading the code a bit and i think the easy way is to stay on openwrt 22.03.2 because the /etc/firewall.user is working. on later version of openwrt you need adapt nftables to iptables. it' my guess

The test is done.The result is as follows:
5G WLAN TEST
Network topology:
PC1(iperf3 client:192.168.6.100)-(wireless connection 192.168.6.x)-AX6S(firmware test device)-(cable connection 192.168.31.x)-AX6S(stable firmware)-PC2(iperf3 server:192.168.1.3)
wlan negotiation speed:1201/1134 Mbit/s(2x2mimo)

1.1 uplink(4tcp connection):
700M cpu 20%(cpu0 is 40%,ksoftirqd/0 10%;cpu1 is 1%)

1.2 downlink(4tcp connection):
750M,cpu 20%(cpu0 is 40%,ksoftirqd/0 15%,cpu1 is 1%)

5G WWAN TEST
ApCli settings:
ApCliMuMimoDlEnable=1
ApCliMuMimoUlEnable=1
ApCliMuOfdmaDlEnable=1
ApCliMuOfdmaUlEnable=1
WHNAT=1

1.LAN(switch)-WWAN(apclii0) (WHNAT) test:
Network topology:
PC1(iperf3 client)-(cable connection 192.168.6.x)-AX6S(firmware test device)-(wireless connection 192.168.31.x)-AX6S(stable firmware)-PC2(iperf3 server 192.168.1.3)
wwan negotiation speed:1921/1921 Mbit/s(4x4mimo)

1.1 uplink(4tcp connection)(first time test after system reboot) :
890M cpu 30%(cpu0 is 60%,ksoftirqd/0 15%;cpu1 is 1%)

1.2 downlink(4tcp connection)(first time test after system reboot,seems that whnat does not take effect):
685M,cpu 50%(cpu0 is 100%,ksoftirqd/0 96%,cpu1 is 1%)

1.3 uplink(4tcp connection) (second time test after 1 client connected to rai0):
890M cpu 20%(cpu0 is 40%,ksoftirqd/0 3%;cpu1 is 1%)

1.4 downlink(4tcp connection)(second time test after 1 client connected to rai0):
910M,cpu 35%(cpu0 is 70%,ksoftirqd/0 35%,cpu1 is 1%)

2.WLAN(rai0,2x2mimo)-WWAN(apclii0,4x4mimo) (WHNAT) test:
Network topology:
PC1(iperf3 client)-(wireless connection 192.168.6.x)-AX6S(firmware test device)-(wireless connection 192.168.31.x)-AX6S(stable firmware)-PC2(iperf3 server 192.168.1.3)
wwan negotiation speed:1921/1921 Mbit/s(4x4mimo)

2.1 uplink(4tcp connection) :
450M cpu 25%(cpu0 is 50%,ksoftirqd/0 6%;cpu1 is 2%)

2.2 downlink(4tcp connection) :
390M cpu 30%(cpu0 is 60%,ksoftirqd/0 10%;cpu1 is 2%)

[hpx502766238]

As a conclusion, there are still some small issues:
1.We need an extra client connected to rai0 to activate some parts of hardware acceleration; otherwise, the whnat doesn’t take effect. (I found a new process named “kworker/0:0-events” after rai0 is connected.)
2.CPU0 is busy all the time, meanwhile CPU1 is free. We need a balance script to allocate works more sensibly.

[bricco1981]

hi is whnat working whitout enabling hardware and software offload?

[hpx502766238]

hi is whnat working whitout enabling hardware and software offload?

Yes, it was working without enabling Linux offload. I am not sure if it was due to the version of iptables I was using.
https://github.com/hpx502766238/lede-R24.4.4-MTK/blob/mtksdk/package/network/utils/iptables/Makefile

[bricco1981]

ok that's why, if you are on iptables you can fix easy the cpu oveload

[hpx502766238]

ok that's why, if you are on iptables you can fix easy the cpu oveload

Is there any newer hnat driver? The current version seems not to support HQoS.

[bricco1981]

i think you need and old HQos, check this
https://github.com/padavanonly/immortalwrtARM/tree/92b71da50a8cbea84333c02959e0aa12504e8495/package/mtk

[hpx502766238]

i think you need and old HQos, check this https://github.com/padavanonly/immortalwrtARM/tree/92b71da50a8cbea84333c02959e0aa12504e8495/package/mtk

Do I need to set CONFIG_NET_MEDIATEK_HW_QOS=y in config-5.10?I had set it but met a compile error,so I disabled.

[bricco1981]

So just do not set it