Hardware and the role of NSS
The NETGEAR Nighthawk X4S R7800 is a Qualcomm IPQ8065 platform with a dual-core 1.7 GHz application processor, 512 MB RAM and 128 MB flash. It has four external antennas, dual-band 4×4 wireless, five Gigabit Ethernet ports in total, two USB 3.0 ports and eSATA. AC2600 describes combined wireless signalling classes, not a promise of routed application throughput. See NETGEAR support and the OpenWrt device page for model-specific references.
NSS is Qualcomm’s Network SubSystem. The community integration supplies drivers and connection-management components that can move eligible network traffic away from the main CPU. It is a distinct integration from simply enabling generic Linux flow offload. Eligibility depends on the actual path: bridging, VLANs, tunnels, PPPoE, VPNs, filtering and shaping can each change behaviour. This site makes no measured throughput or latency claim for r1. Establish a conventional routing baseline before evaluating acceleration.
What the published release establishes
The profile metadata identifies target ipq806x/generic, package architecture arm_cortex-a15_neon-vfpv4, version 23.05-SNAPSHOT and revision r23734-cd265bb1a5. The installed-package manifest records Linux 5.15.146. The Apache listing shows files published in October 2026; that date does not establish the age of every bundled component.
SOURCE-COMMIT.txt records cd265bb1a5229aec79aa675d9c2f0289ca75e684. A hash alone does not identify the maintainer’s source remote, local patches, signing material or build environment. Those details were not established by the inspected release files. Do not substitute an arbitrary upstream branch and describe the result as this exact firmware. Rebuilding byte-for-byte also requires the original environment and any local changes.
Prepare a Linux build host
Use a supported Debian or Ubuntu Linux host, a normal user account and a case-sensitive local filesystem. Reserve generous disk space for the toolchain, source archives and package outputs; an initial build can take considerable time. Keep the working path free of spaces. Do not build as root or reuse a half-configured tree from another target. These are operational preparation steps, not a claim about the original builder’s host.
The following is a starting dependency set for Debian/Ubuntu. Package names vary with distribution releases; resolve any prerequisite message rather than bypassing it. Consult the official host preparation guide. On Windows use a Linux environment with the source stored inside its Linux filesystem. Record your distribution version, compiler tools and available resources alongside the build log.
sudo apt update
sudo apt install build-essential clang flex bison g++ gawk gcc-multilib \
g++-multilib gettext git libncurses-dev libssl-dev python3 \
python3-setuptools rsync swig unzip zlib1g-dev file wget curl
mkdir -p ~/build
cd ~/build
# Obtain the maintainer-confirmed source checkout here.
# Its remote URL is not supplied by the inspected release metadata.A separately identified upstream baseline
If the original NSS source is unavailable, an official OpenWrt checkout provides a separate reference build. This does not recreate MySwift r1 and does not supply its NSS integration. Choose a supported release appropriate to the R7800 from the official device documentation and verify its release tag before building; the historical branch shown here explains the 23.05-era workflow only. In menuconfig choose the R7800 profile and save the configuration before compiling. Keep this reference tree separate from your NSS checkout so package outputs cannot be confused.
git clone https://git.openwrt.org/openwrt/openwrt.git openwrt-reference
cd openwrt-reference
# Historical baseline only; review release support before deployment.
git checkout openwrt-23.05
./scripts/feeds update -a
./scripts/feeds install -a
make menuconfig
make defconfig
make download -j8
make -j$(nproc)Configure, compile and preserve the evidence
First obtain the maintainer’s confirmed source remote and feed definitions. In that checkout, verify that the recorded source commit exists, inspect changes, then select it. Preserve any required local patches separately. Review feeds.conf or feeds.conf.default before executing feed scripts: these scripts fetch third-party build inputs. Import the published r1 diffconfig as .config. It is a build seed, not a router configuration backup.
Run feed update to obtain their checkouts, then pin each to the revision below before installing packages. Confirm each checkout contains its recorded commit; failure indicates a missing or incorrect source, not permission to silently pick the latest revision. After make defconfig, inspect make menuconfig: the target must remain Qualcomm Atheros IPQ806X, Generic, NETGEAR R7800. In OpenWrt configuration, y includes a package in the image and m normally builds an installable package without including it.
Download sources before the long compile. If a parallel build fails, retry serially with verbose output and diagnose the first real error. Do not treat missing files, failed signatures or compiler errors as harmless. Outputs belong under bin/targets/ipq806x/generic/. Save the complete configuration, diffconfig, source/feed commits, build log, manifest and checksums with each release. Test a new image on a recoverable device before distributing it.
cd ~/build/maintainer-confirmed-checkout
git status --short
git cat-file -t cd265bb1a5229aec79aa675d9c2f0289ca75e684
git checkout --detach cd265bb1a5229aec79aa675d9c2f0289ca75e684
./scripts/feeds update -a
# Pin the existing feed checkouts to FEED-COMMITS.txt before continuing.
./scripts/feeds install -a
curl -fL https://openwrt.myswift.co.uk/releases/23.05-nss-r7800/r1/r7800-nss-r1-success.diffconfig -o .config
make defconfig
make menuconfig
make download -j8
make -j$(nproc)
# Diagnostic retry after a failure:
make -j1 V=s
./scripts/diffconfig.sh > my-build.diffconfig
git rev-parse HEADPublished feed revisions
The following identifiers come directly from FEED-COMMITS.txt. They establish intended feed states, not the location of each source repository. Verify the feed remote against the maintainer’s definitions before checking out these commits. Installation feeds hosted below are binary packages; they are not replacements for build-system source feeds.
git -C feeds/luci checkout --detach 3d39e8c38cfa276d5cdfad7105dbf47933eaed4f
git -C feeds/nss checkout --detach 2fcff66d5279156bc67034a3547528a5fd48b0b2
git -C feeds/packages checkout --detach eb758024a9c2fb841326ccd8e59d98bd3b975ff9
git -C feeds/routing checkout --detach fa22ff1f05662f2ea456aaff6745ee3da519c1f7
git -C feeds/sqm_scripts_nss checkout --detach bf905d85137817b49f619a3b2544c2e6f70dd22d
git -C feeds/telephony checkout --detach 98c8a5aa4624312ed758e2e2b6d4039050a1649dChoose the correct image and install safely
Confirm the label says R7800 and record the current firmware, network settings and recovery procedure. Use a wired LAN connection, stable power and a downloaded recovery image. Disconnect unnecessary devices. Back up settings and copy the backup off the router. Preserve a package list and notes for custom services, certificates and passwords. A backup is a recovery aid; restoring old network settings across incompatible releases can recreate the fault you are trying to avoid.
For a compatible stock NETGEAR installation, the published squashfs-factory.img is the factory-format candidate; follow the current device-specific installation instructions and stock updater requirements. For an existing compatible OpenWrt installation use squashfs-sysupgrade.bin. The initramfs uImage serves specialist RAM-boot/recovery workflows and is not the routine persistent update. Never rename formats to satisfy an updater.
Download the matching sha256sums and compare the exact file before upload. A hash checks file consistency; when downloaded from the same server it does not independently authenticate the publisher. The inspected directory did not establish a signed checksum file or signing-key fingerprint. Stop on a mismatch or uncertain provenance.
For OpenWrt, run an image compatibility test before flashing. Review sysupgrade guidance and decide whether settings may safely carry over. When changing between switch architectures such as swconfig and DSA, or incompatible forks, plan a clean configuration and manual migration. This r1 manifest contains swconfig; do not infer compatibility from the version number. Never force an image past failed checks. Flashing interrupts access; leave power connected until the device has fully restarted.
From stock firmware
- Download the R7800 factory image and checksum to your computer. Confirm the exact checksum before browsing to the router.
- Connect through a LAN cable and sign into the current Netgear management address. Under Advanced → Administration → Firmware Update, select the matching factory image.
- Accept the update only after confirming the model and image. Keep power connected and allow the router to finish flashing and restarting.
- With default OpenWrt settings, reconnect to the LAN and open its management interface. Configure a password, verify connectivity and rebuild settings deliberately.
The documented stock-updater route was tested by OpenWrt with a specific Netgear firmware version; later stock firmware may enforce different acceptance rules. If it rejects a valid image, use the documented recovery procedure rather than renaming or forcing a format.
# On the router, then copy these files to your computer:
sysupgrade -b /tmp/r7800-backup.tar.gz
opkg list-installed > /tmp/r7800-packages.txt
ubus call system board
# After transferring the verified sysupgrade image to /tmp:
sha256sum /tmp/openwrt-ipq806x-generic-netgear_r7800-squashfs-sysupgrade.bin
sysupgrade -T /tmp/openwrt-ipq806x-generic-netgear_r7800-squashfs-sysupgrade.bin
# Only after review; -n deliberately starts with fresh settings:
sysupgrade -n /tmp/openwrt-ipq806x-generic-netgear_r7800-squashfs-sysupgrade.binUse matching binary package repositories
The release publishes architecture feed directories for base, luci, packages, routing, telephony, nss and sqm_scripts_nss, plus the target-specific targets/ipq806x/generic/packages directory. At inspection the compressed indexes for routing, telephony, nss and sqm_scripts_nss were empty. Their directory names do not establish that installable packages are available. NSS packages already present in the firmware are evidenced by its manifest.
Inspect /etc/opkg/distfeeds.conf and /etc/opkg/customfeeds.conf first. Use a consistent release set; do not combine these URLs with arbitrary snapshot or official-release feeds. Kernel modules require the precise kernel ABI, beyond the human-readable kernel version. The manifest identifies 5.15.146-1-b4a6d2687972e539090cdb37d10ca434. An architecture match alone is insufficient. Keep the target packages feed as well as the architecture feeds.
The example below is a review template for this release, not an instruction to replace working configuration blindly. Preserve signature checking. A trusted image may already carry its package verification key; otherwise obtain the maintainer’s public key and verify its fingerprint through a trusted channel. No unverified key-download command or invented fingerprint is supplied here. Investigate signature failures rather than disabling checks. Run opkg update then install only needed packages. Do not run a blanket opkg upgrade; update firmware through a compatible sysupgrade instead.
src/gz myswift_core https://openwrt.myswift.co.uk/releases/23.05-nss-r7800/r1/targets/ipq806x/generic/packages
src/gz myswift_base https://openwrt.myswift.co.uk/releases/23.05-nss-r7800/r1/packages/arm_cortex-a15_neon-vfpv4/base
src/gz myswift_luci https://openwrt.myswift.co.uk/releases/23.05-nss-r7800/r1/packages/arm_cortex-a15_neon-vfpv4/luci
src/gz myswift_packages https://openwrt.myswift.co.uk/releases/23.05-nss-r7800/r1/packages/arm_cortex-a15_neon-vfpv4/packages
src/gz myswift_routing https://openwrt.myswift.co.uk/releases/23.05-nss-r7800/r1/packages/arm_cortex-a15_neon-vfpv4/routing
src/gz myswift_telephony https://openwrt.myswift.co.uk/releases/23.05-nss-r7800/r1/packages/arm_cortex-a15_neon-vfpv4/telephony
src/gz myswift_nss https://openwrt.myswift.co.uk/releases/23.05-nss-r7800/r1/packages/arm_cortex-a15_neon-vfpv4/nss
src/gz myswift_sqm_nss https://openwrt.myswift.co.uk/releases/23.05-nss-r7800/r1/packages/arm_cortex-a15_neon-vfpv4/sqm_scripts_nssNSS configuration and verification
The diffconfig selects kmod-qca-nss-drv, kmod-qca-nss-gmac, kmod-qca-nss-ecm-standard, kmod-qca-nss-drv-qdisc and kmod-nss-ifb. The manifest confirms these in the image, together with PPPoE and L2TPv2 NSS driver packages. Several other options are only modular build selections. In particular sqm-scripts=m does not mean SQM is installed, active or acceleration-aware by default.
Start with the shipped defaults. Check boot logs for driver or firmware errors before altering tunables. Test WAN/LAN connectivity, DNS, IPv6, firewall policy and any VLANs independently. Measure with a wired endpoint on each side of the router rather than running the whole benchmark on its CPU. Record CPU load, throughput and latency under load. Repeat with the exact tunnel, filtering and shaping configuration you intend to use. Compare like-for-like runs and include client limitations.
A loaded module is not proof a specific flow was accelerated. Consult the matching fork’s documentation for counters and supported paths; debug interfaces can differ by driver revision. Do not combine generic software/hardware flow-offload switches, NSS tweaks and arbitrary SQM recipes without understanding their interaction. If latency or policy changes unexpectedly, revert the last change and compare against the saved baseline. No universal NSS clock, memory or firewall tweak is prescribed here.
For this custom NSS path, leave generic software flow offloading disabled unless the matching fork explicitly documents otherwise. In LuCI review Network → Firewall → General Settings. The generic “hardware flow offloading” toggle is not proof of NSS operation on this platform. For shaping, use the matching NSS-aware implementation and test its counters and latency; do not assume a normal SQM package keeps accelerated traffic in its queue.
uname -a
opkg list-installed | grep -E 'qca-nss|nss-ifb|sqm|kernel'
lsmod | grep -E 'nss|ecm'
dmesg | grep -i -E 'nss|ecm|firmware|error'
logread | tail -n 100
ubus call network.interface.wan statusRecovery and troubleshooting
Prepare recovery before your first flash. The R7800 has a bootloader TFTP recovery route documented on the device page. Use its current timing and LED sequence with a wired LAN connection. Typically the recovery host uses a static address in the bootloader’s subnet and transfers a compatible factory-format image to the bootloader address. Confirm the exact addresses, image and button sequence against that device-specific procedure rather than treating a generic TFTP command as universal. Use binary transfer mode and allow the flash operation to finish without interruption.
If TFTP receives nothing, check the chosen interface, cable, host firewall, link establishment and recovery timing; a small Ethernet switch can keep host link stable through a reboot. Never erase calibration partitions or write raw MTD partitions as a routine fix. Serial access is an advanced diagnostic path requiring correct voltage levels and pinout. Preserve the boot log before attempting invasive repair.
After a successful boot but lost access, establish whether the router has the expected address, whether DHCP has changed and whether your computer retained an old lease. With fresh settings, configure the administrator password promptly and rebuild LAN/WAN settings before reconnecting the wider network. For missing packages check time, DNS, TLS, feed URL, signatures and ABI in that order. For wireless faults distinguish radio association, authentication and routing. Keep a known-good firmware image and off-device backup so a performance experiment remains reversible.
Further references: failsafe and reset, package management, build-system workflow, and the MySwift repository root. OpenWrt documentation returned an automated-access challenge during this review; these are reference links, not a claim that their current text was retrieved successfully.
R7800 TFTP recovery checklist
- Obtain a known-good R7800 factory image, verify its checksum and keep it locally. On an isolated recovery computer configure a static address such as
192.168.1.10/24, avoiding address conflicts. - Connect to a LAN port (LAN 4 is a common first choice). Power the router off. Hold Reset while powering on; keep holding through the orange flashing sequence until the power LED flashes white, then release.
- The bootloader recovery endpoint is
192.168.1.1. Use a TFTP client in binary mode to send the factory image. On Windows, with the optional TFTP client installed, the command form istftp -i 192.168.1.1 PUT factory.img, substituting the verified file path. - A transfer-complete message confirms transfer, not completion of flash writing. Wait for reboot and stable LEDs before reconnecting to management. Do not interrupt power.
- Restore the computer’s normal DHCP settings afterward. If recovery fails, check the device page for the applicable LED sequence and investigate logs or hardware rather than repeatedly forcing writes.