Enable WireGuard on NVIDIA Jetson
By Toshihito Kikuchi
In the earlier article, I mentioned Dynamo supports ARM64 devices. At that time, I tested Amazon EC2 T4g Instances and Raspberry Pi 5. As a third ARM64 device to test, I purchased NVIDIA Jetson Orin Nano.
After landing several patches, I was able to run Dynamo on Jetson. However, you need to do one extra step before installing Dynamo on your device: Build and install WireGuard on your end. Well, I could provide pre-built binaries, but I’d like to encourage people to build linux kernel by yourself. It’s fun. And Jetson as a Kinesis Node won’t be a mainstream scenario anyway.
I saw several forums discussing this topic too. Hopefully this article will help non-Kinesis users as well.
Devices needed
I purchased:
NVIDIA Jetson Orin Nano Super Developer Kit (Amazon)
Memory Card (I bought 64GB UHS-1 via Amazon. You pick any product.)
You also need a display supporting Display Port and a USB keyboard if you don’t have any.
OS setup
Here's the official Getting Started Guide provided by NVIDIA: https://developer.nvidia.com/embedded/learn/get-started-jetson-orin-nano-devkit
In my case, the firmware was already up-to-date (36.4.x), so I directly downloaded SD Card Image of JetPack 6.2.1, but yours may not be. Don’t skip to check your firmware version. Please note that the latest version JetPack 7.0 is for Thor, not for Jetson Orin Nano (see https://developer.nvidia.com/embedded/jetpack-archive).
You can use your favorite writer to write an image to SD Card. I used balena Etcher. Once it’s done, just insert your card and power on your Jetson. No drama here.
Build WireGuard module
Let's double check WireGuard is not included in your device. You might be lucky to have it somehow. If it exists, it would be in /lib/modules/$(uname -r)/kernel/drivers/net/wireguard.
Since Linux 5.6, WireGuard is a part of kernel code in the mainstream, so you can get wireguard module by building linux kernel. Fortunately, NVIDIA provides a guide on how to customize kernel.
The guide says we can download the kernel source with a script named “source_sync.sh”. A weird thing is it doesn’t tell us where it is. It’s not included in the SD Card Image, JetPack. The answer is here. It’s included in Driver Package. You can go to Jetson Linux page and download "Driver Package (BSP)”. As of now, the package file is Jetson_Linux_r36.4.4_aarch64.tbz2, which includes ./Linux_for_Tegra/source/source_sync.sh.
To run source_sync.sh, you need to specify “release-tag”, which the guide says is included in the release notes. But which release note should we check? AI tells me to do
In the output above, the release is 36.4.7, but there is no corresponding release note. Given that the release note of 36.4.4 says its release tag is “jetson_36.4.4”, we can make a guess. The source repo is https://nv-tegra.nvidia.com/r/admin/repos/3rdparty/canonical/linux-jammy,tags, so you can check the list of tags there.
When we build linux kernel, we usually generate .config to customize build options with menuconfig or other tools. For Jetson Linux, however, the guide suggests to use make -C kernel to build, where Makefile applies defconfig to build by default. Even if we run menuconfig, Makefile overrides .config with defconfig.
As you can see, CONFIG_WIREGUARD is not defined there.
Let’s simply add CONFIG_WIREGUARD=m at the end of the file and kick off build. Once build is done, wireguard.ko is generated.
Install WireGuard module
To install a single module, you simply copy a file under /lib/modules, generate dependencies, and load with modprobe.
Oops, the last modprobe command failed with the following error.
Don’t panic. You can see more details with dmesg.
These are simple dependency errors. Searching code, you can easily find these symbols are implemented in libchacha20poly1305.ko, which is not installed in the kernel.
Let’s install this module and try to load wireguard again.
You’ll get the same error from modprobe, but it’s caused by different symbols.
Repeat the same thing, searching code, identifying a missing module implementing the symbols. This time it’s poly1305-neon.ko. Neon is SIMD extension for ARM.
Let’s just copy and try to load wireguard.ko once again.
It should work this time, and you’ll see it’s loaded as below.
Verification
Dynamo uses wireguard through our gateway container. You can simulate this scenario by creating a minimum wireguard conf and running a container as follows. An endpoint can be random which doesn’t need to be valid for this verification purpose.
Conclusion
Congratulations! Your Jetson device is ready to run Dynamo and join the Kinesis Network as a Global Node. In short, you need to clone Jetson Linux Kernel from NVIDIA’s repo, build it, and copy wireguard.ko along with a couple of dependent (crypto-related) modules. Pretty straightforward.
You might be interested in installing the kernel itself and debugging it. That’s good ambition. Let’s discuss it as another topic!
Last updated
Was this helpful?