Why is PFE useful on Linux?

[henry10210]

While trying to make a fast firewall/router, I stumbled on FRWY-LS1012A board, and brought up Ubuntu on it (following the getting started guide); currently struggling my way through understanding the Linux nftable, but still have an uneasy feeling that I just don't understand how this is supposed to work.  Initially, I thought that the PFE will offload the packet forwarding, so I just rolled the dice and decided to play around with the eval board.  But I've read the "Packet Forwarding Engine (PFE) Ethernet Ports Setting up on LS1012A Platform" document several times now, and I just don't see where such hardware acceleration can take place, because the Linux iptable/nftable runs on the CPU.  Chapter 14 of the LS1012A reference manual explains that such HW acceleration features ARE built into the PFW, but the above architecture document does not explain how/if the HW features are enabled by Linux PFE driver.

I would greatly appreciate a pointer to the driver source code, and further guidance on configuring the firewall/router to unleash the PFE HW capability.

[bpe]

PFE drivers available in free Linux kernels offer only basic network
interface functionality.  Full hardware acceleration is enabled
in commercial ASKs:

https://www.nxp.com/design/software/development-software/vortiqa-software-for-networking/vortiqa-app...

https://www.nxp.com/design/software/development-software/vortiqa-software-for-networking/vortiqa-app...

Have a great day,
Platon

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!

- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[henry10210]

Hi Platon, I thought I understood you in the morning, but now, after having read through the GSG and the LS1012A-RDB again, I am not so sure, so let me ask in a slightly different way: should I expect (after having faithfully followed the FRWY-LS1012A GSG, for example) that the PFE on the reference board does NOT in fact packet forward, because the GSG just builds the rootfs using publicly available kernel repo?  I want to confirm because this point was not stated clearly anywhere on the documentations I could read before going ahead with the reference board purchase.  I certainly would have considered other options for my prototyping effort if I had known that these reference boards would turn into paper weights (unless I get a director approval and plunk down another $10k + tax).  Charging for dev kit is not unheard of, but I feel like you guys should have been more up front in the GSG and before selling the reference boards.

Thanks for your consideration.

[bpe]

I must apologize because I overlooked that the ASK evaluation binaries
are only available for the RDB while you are working with FRWY. You
can try building open source ASK components for your board,
however, there will be no proprietary acceleration modules.
What I would suggest here, is visiting this page  and  asking if pre-built

evaluation binaries can be provided for your board by pressing any yellow

button at the bottom of the page.

Regarding PFE drivers available in open source, all supported features
are listed here.

One important remark is, that your board GSG refers to an obsolete
FWRY-specific LSDK branch which has been merged into the main Layerscape
SDK (LSDK) common to all Layerscape series processors. This LSDK is
available in both pre-built images and source.

LSDK Documentation can be found here. LSDK default kernel does include
netfilter options by default.

Hope this helps,

Platon

[henry10210]

Thank you Platon, I submitted the inquiry to sales about an hour ago.  If you would like to reference it, please look for an email from hchoi2@<my company>.com.

Sorry for being obtuse: I don't quite get the benefit of adopting the LSDK at this point--unless I can get the HW accelerated PFE driver.  I'll read through the LSDK documentation more carefully later, to see if I am misunderstanding your point.

[henry10210]

Thank you for the prompt reply, Platon. Is this ASK going to work for me?

I am on the FRWY-LS1012A board. I sort of assumed that the public

reference images would contain the HW accelerated drivers when I ordered

the eval board. I don't have experience using the NXP ASK before; it seems

a bit weird that my company has to invest a big chunk of money JUST to

evaluate the solution.

I already sunk in some time getting the Ubuntu 16.04 running on my board

(following GSG); is the proprietary driver situation the same with the

Ubuntu image available through the GSG? I ask because the Home Router

solution Linux kernel seems to be quite old (v 3.x)