|
The hub and the pages beside it docs/ |
5 |
60 days |
|
|
| 1 |
The documentation |
|
|
2026-10-18 |
2026-12-17 |
| 2 |
How the pages are kept current |
|
|
2026-10-18 |
2026-12-17 |
| 3 |
Problem reports |
|
|
2026-10-18 |
2026-12-17 |
| 4 |
Where the knowledge in this tree came from |
|
|
2026-10-11 |
2026-12-10 |
| 5 |
How it was found |
|
|
2026-10-12 |
2026-12-11 |
|
The guide - what the README used to carry docs/guide/ |
9 |
60 days |
|
|
| 6 |
Background, and what the two appliances are |
|
|
2026-10-17 |
2026-12-16 |
| 7 |
Families and hardware |
|
|
2026-10-17 |
2026-12-16 |
| 8 |
How it works, briefly |
|
|
2026-10-17 |
2026-12-16 |
| 9 |
Installing, the pages, updating |
|
|
2026-10-17 |
2026-12-16 |
| 10 |
What it cannot do |
|
|
2026-10-17 |
2026-12-16 |
| 11 |
Every badge, as the README carried them until 2026-10-18 |
|
|
2026-10-17 |
2026-12-16 |
| 12 |
The pages, one by one |
|
|
2026-10-19 |
2026-12-18 |
| 13 |
Updating an appliance, step by step |
|
|
2026-10-19 |
2026-12-18 |
| 14 |
What works |
|
|
2026-10-17 |
2026-12-16 |
|
The coprocessor families docs/families/ |
13 |
90 days |
|
|
| 15 |
Families |
|
|
2026-10-01 |
2026-12-30 |
| 16 |
ARMADA - Marvell CN913x |
|
|
2026-10-17 |
2027-01-15 |
| 17 |
Each board's own limits |
|
|
2026-10-18 |
2027-01-16 |
| 18 |
GR |
|
|
2026-09-28 |
2026-12-27 |
| 19 |
The crypto path, and why a host frame is refused |
|
|
2026-10-11 |
2027-01-09 |
| 20 |
The rest of the appliance, and what driving each piece would need |
|
|
2026-10-17 |
2027-01-15 |
| 21 |
OCTEON TX - the reference |
|
|
2026-10-17 |
2027-01-15 |
| 22 |
The RPC facility, and the LIF gate behind the return direction |
|
|
2026-10-07 |
2027-01-05 |
| 23 |
OCTEON TX - Cavium CN83XX |
|
|
2026-10-11 |
2027-01-09 |
| 24 |
OCTEON TX2 98XX - Marvell CN98XX |
|
|
2026-09-28 |
2026-12-27 |
| 25 |
OCTEON TX2 - Marvell CN9xxx |
|
|
2026-09-28 |
2026-12-27 |
| 26 |
What one appliance has and the other does not |
|
|
2026-10-18 |
2027-01-16 |
| 27 |
TOPAZ |
|
|
2026-09-28 |
2026-12-27 |
|
The appliances as objects docs/hardware/ |
2 |
90 days |
|
|
| 28 |
The XGS 136 |
|
|
2026-10-18 |
2027-01-16 |
| 29 |
The XGS 3300 |
|
|
2026-10-16 |
2027-01-14 |
|
The ARMADA driver docs/npuep/ |
10 |
90 days |
|
|
| 30 |
The facility protocol |
|
|
2026-10-11 |
2027-01-09 |
| 31 |
GIU, the datapath that owns the fourteen front ports |
|
|
2026-10-11 |
2027-01-09 |
| 32 |
The management link gets its place in OPNsense |
|
|
2026-10-14 |
2027-01-12 |
| 33 |
mvmgmt0, the management interface |
|
|
2026-10-11 |
2027-01-09 |
| 34 |
The NetAgent mailbox, and per-port control |
|
|
2026-10-11 |
2027-01-09 |
| 35 |
Bringing the NPU out of reset |
|
|
2026-10-11 |
2027-01-09 |
| 36 |
Offload on the ARMADA family: the plan |
|
|
2026-10-14 |
2027-01-12 |
| 37 |
Porting notes |
|
|
2026-10-11 |
2027-01-09 |
| 38 |
The control channel's payloads on the ARMADA, beside the OCTEON TX's |
|
|
2026-10-14 |
2027-01-12 |
| 39 |
The control channel, and the tables that make receive work |
|
|
2026-10-11 |
2027-01-09 |
|
The OCTEON TX driver docs/octep/ |
10 |
90 days |
|
|
| 40 |
The appliance in OPNsense's own settings |
|
|
2026-10-17 |
2027-01-15 |
| 41 |
The coprocessor's section of the menu |
|
|
2026-10-17 |
2027-01-15 |
| 42 |
Expansion modules: every port the coprocessor reports, named as the coprocessor names it |
|
|
2026-10-18 |
2027-01-16 |
| 43 |
Binding an offloaded flow to a pf state |
|
|
2026-10-17 |
2027-01-15 |
| 44 |
Plan: the front ports assign themselves at the first boot, with a countdown |
|
|
2026-10-17 |
2027-01-15 |
| 45 |
if_ipsec_accel_methods: the six calls, their contracts, and the order that must not be got wrong |
|
|
2026-10-11 |
2027-01-09 |
| 46 |
The LIF table: what has to be created, in what order, and why one entry was found |
|
|
2026-10-16 |
2027-01-14 |
| 47 |
Offloading, as a setting the owner decides |
|
|
2026-10-17 |
2027-01-15 |
| 48 |
Where a flow has to come from |
|
|
2026-10-11 |
2027-01-09 |
| 49 |
Where OPNsense reloads pf, and where a revision bump has to attach |
|
|
2026-10-16 |
2027-01-14 |
|
OCTEON TX provenance docs/octeontx/ |
2 |
90 days |
|
|
| 50 |
Where the OCTEON TX knowledge came from |
|
|
2026-10-12 |
2027-01-10 |
| 51 |
Capturing the XGS 3300 while it runs its own firmware |
|
|
2026-10-11 |
2027-01-09 |
|
The measurements docs/measurements/ |
18 |
180 days |
|
|
| 52 |
Measurements, by appliance |
|
|
2026-10-17 |
2027-04-15 |
| 53 |
Unusual traffic, reported, measured, 2026-10-19 |
|
|
2026-10-19 |
2027-04-17 |
| 54 |
Three appliances on one bench, 2026-10-17 |
|
|
2026-10-17 |
2027-04-15 |
| 55 |
What a cage carries, read from its module, measured, 2026-10-19 |
|
|
2026-10-19 |
2027-04-17 |
| 56 |
Does the coprocessor drop an address it is given? Measured, 2026-10-19 |
|
|
2026-10-19 |
2027-04-17 |
| 57 |
What the coprocessor counts of a connection, measured, 2026-10-19 |
|
|
2026-10-19 |
2027-04-17 |
| 58 |
IPv6 through the coprocessor, and the XGS 136's transmit queues, 2026-10-18 |
|
|
2026-10-18 |
2027-04-16 |
| 59 |
Connections cut by their TLS fingerprint (JA4), measured, 2026-10-19 |
|
|
2026-10-19 |
2027-04-17 |
| 60 |
A block list that cuts the connections already open, measured, 2026-10-19 |
|
|
2026-10-19 |
2027-04-17 |
| 61 |
The MTU, from 576 to 9000, on the three-appliance bench |
|
|
2026-10-17 |
2027-04-15 |
| 62 |
A posted command stays in its slot, measured, 2026-10-19 |
|
|
2026-10-19 |
2027-04-17 |
| 63 |
Slow minutes on the XGS 136, looked for, 2026-10-19 |
|
|
2026-10-19 |
2027-04-17 |
| 64 |
What the XGS 136's coprocessor says about the traffic it forwards, measured, 2026-10-19 |
|
|
2026-10-19 |
2027-04-17 |
| 65 |
A connection given back by the XGS 136's fast path, and made again at once, measured, 2026-10-19 |
|
|
2026-10-19 |
2027-04-17 |
| 66 |
The XGS 136 forwarding by its coprocessor, measured, 2026-10-18 |
|
|
2026-10-18 |
2027-04-16 |
| 67 |
Two hours of TLS through the XGS 136, every byte checked, 2026-10-19 |
|
|
2026-10-19 |
2027-04-17 |
| 68 |
A thousand connections at once through the XGS 3300, measured, 2026-10-19 |
|
|
2026-10-19 |
2027-04-17 |
| 69 |
XGS 3300 - what has been measured on it |
|
|
2026-10-17 |
2027-04-15 |
|
The findings, dated docs/findings/ |
71 |
365 days |
|
|
| 70 |
AES-CBC with an HMAC runs at two thirds of GCM's rate |
|
|
2026-10-12 |
2027-10-12 |
| 71 |
AES-CBC with an HMAC on the ARMADA: the four hashes taken, both ways in hardware |
|
|
2026-10-14 |
2027-10-14 |
| 72 |
Every command cost ten milliseconds on the ARMADA |
|
|
2026-10-18 |
2027-10-18 |
| 73 |
A connection that collides with itself |
|
|
2026-10-11 |
2027-10-11 |
| 74 |
A flow the host named, dropped by the ARMADA's fast path: the first action on this family |
|
|
2026-10-14 |
2027-10-14 |
| 75 |
A frame was accelerated |
|
|
2026-10-11 |
2027-10-11 |
| 76 |
A give-back is answered at once |
|
|
2026-10-11 |
2027-10-11 |
| 77 |
A hundred polls a second |
|
|
2026-10-17 |
2027-10-17 |
| 78 |
A packet is not a buffer |
|
|
2026-10-11 |
2027-10-11 |
| 79 |
A ring that fills |
|
|
2026-10-12 |
2027-10-12 |
| 80 |
A sleeping thread held the RPC lock: the control channel's lock had to be sleepable |
|
|
2026-10-14 |
2027-10-14 |
| 81 |
A slot holds both directions |
|
|
2026-10-12 |
2027-10-12 |
| 82 |
A state that sees nothing runs out |
|
|
2026-10-11 |
2027-10-11 |
| 83 |
A takeout took nothing out on the ARMADA, and what came back stopped at pf |
|
|
2026-10-18 |
2027-10-18 |
| 84 |
A visit is not a pass |
|
|
2026-10-12 |
2027-10-12 |
| 85 |
A replay window on the ARMADA: the engine's check, measured with a replayed frame |
|
|
2026-10-14 |
2027-10-14 |
| 86 |
A window wider than 256 ends the coprocessor's replay drops |
|
|
2026-10-12 |
2027-10-12 |
| 87 |
Accelerating a flow breaks it, and it always has |
|
|
2026-10-11 |
2027-10-11 |
| 88 |
AMD's platform crypto engine breaks IPsec AES-GCM on the XGS 136 host |
|
|
2026-10-17 |
2027-10-17 |
| 89 |
Asking pf, and two ways of reaching it that do not work |
|
|
2026-10-11 |
2027-10-11 |
| 90 |
Both ends exist, and the counter means something smaller than it was read as |
|
|
2026-10-11 |
2027-10-11 |
| 91 |
Under ESN, what arrives stays with the kernel |
|
|
2026-10-12 |
2027-10-12 |
| 92 |
ESP behind UDP on the ARMADA: NAT-T, both ways in hardware |
|
|
2026-10-14 |
2027-10-14 |
| 93 |
The UDP header is the host's to write |
|
|
2026-10-12 |
2027-10-12 |
| 94 |
Every next hop named an empty cage on the ARMADA, and the entries the flow maker needed |
|
|
2026-10-18 |
2027-10-18 |
| 95 |
Fragmentation before the envelope on the ARMADA, and a neighbour not yet resolved |
|
|
2026-10-14 |
2027-10-14 |
| 96 |
GCM-12 is the kernel's no, transport mode the vendor's |
|
|
2026-10-12 |
2027-10-12 |
| 97 |
Installed first, taken second |
|
|
2026-10-12 |
2027-10-12 |
| 98 |
IPv6 inside the tunnel, delivered |
|
|
2026-10-12 |
2027-10-12 |
| 99 |
A connection made between polls |
|
|
2026-10-11 |
2027-10-11 |
| 100 |
LO_MFLOW_READ: a claim withdrawn, and the instrument decoded two days later |
|
|
2026-10-11 |
2027-10-11 |
| 101 |
The NetAgent transaction is not serialised, and npuep already fixed it |
|
|
2026-10-16 |
2027-10-16 |
| 102 |
One connection, two microflows: the table the coprocessor expects |
|
|
2026-10-11 |
2027-10-11 |
| 103 |
One encryptor per association |
|
|
2026-10-12 |
2027-10-12 |
| 104 |
One next hop for many flows on the ARMADA: the next-hop table is shared |
|
|
2026-10-14 |
2027-10-14 |
| 105 |
Half the connections kept one strict state |
|
|
2026-10-11 |
2027-10-11 |
| 106 |
Reading the frame settled it, and the fault was in the request all along |
|
|
2026-10-11 |
2027-10-11 |
| 107 |
The bridge cannot be asked, so the flow answers |
|
|
2026-10-11 |
2027-10-11 |
| 108 |
The association belongs to an interface, and that was the whole refusal |
|
|
2026-10-11 |
2027-10-11 |
| 109 |
The crypto path completes, and the counter that said otherwise was never the one to read |
|
|
2026-10-11 |
2027-10-11 |
| 110 |
The decrypted frame is dropped on the ARMADA: the receive model is not the OCTEON TX's |
|
|
2026-10-14 |
2027-10-14 |
| 111 |
The driver accelerates a flow on the ARMADA: FLOW_CREATE_FP, and the microflow goes active |
|
|
2026-10-14 |
2027-10-14 |
| 112 |
The engine accepts the frame, and no completion path is armed |
|
|
2026-10-11 |
2027-10-11 |
| 113 |
The engine decrypts inbound ESP on the ARMADA: an accepted association, decrypting in hardware |
|
|
2026-10-14 |
2027-10-14 |
| 114 |
The engine encrypts outbound ESP on the ARMADA: the transmit side, and the two doors to it |
|
|
2026-10-14 |
2027-10-14 |
| 115 |
The engine hands up the decrypted frame on the ARMADA: the OCTEON TX's receive model after all |
|
|
2026-10-14 |
2027-10-14 |
| 116 |
The engine takes an association on the ARMADA: SA_ADD is accepted |
|
|
2026-10-14 |
2027-10-14 |
| 117 |
The entry first, then the gate, then the flow table: the ARMADA's chain, measured |
|
|
2026-10-14 |
2027-10-14 |
| 118 |
The flow carries the association |
|
|
2026-10-12 |
2027-10-12 |
| 119 |
The driver's flow table on the ARMADA begins: the candidates, and the vnet that killed the sweep |
|
|
2026-10-14 |
2027-10-14 |
| 120 |
The frames arrive, and TCP will not have them |
|
|
2026-10-11 |
2027-10-11 |
| 121 |
The handle is the index plus one |
|
|
2026-10-11 |
2027-10-11 |
| 122 |
The handlers were readable all along |
|
|
2026-10-11 |
2027-10-11 |
| 123 |
The host answers through the tunnel on the ARMADA: the receive termination |
|
|
2026-10-14 |
2027-10-14 |
| 124 |
The kernel drives the coprocessor |
|
|
2026-10-12 |
2027-10-12 |
| 125 |
The kernel offers an association on the ARMADA: the IPsec offload contract is wired |
|
|
2026-10-14 |
2027-10-14 |
| 126 |
The MTU is the LIF's, and a frame is as many buffers as it needs |
|
|
2026-10-17 |
2027-10-17 |
| 127 |
The outbound half was programmed without its translation |
|
|
2026-10-11 |
2027-10-11 |
| 128 |
The outer header can be IPv6 |
|
|
2026-10-12 |
2027-10-12 |
| 129 |
The resolver asked lo0 for a neighbour: looutput: af=35 unexpected, once a second |
|
|
2026-10-14 |
2027-10-14 |
| 130 |
The revision barrier on the ARMADA: a ruleset reload discards every offloaded flow |
|
|
2026-10-14 |
2027-10-14 |
| 131 |
The receive ring was the ceiling |
|
|
2026-10-11 |
2027-10-11 |
| 132 |
The second acknowledge: measured, and made unnecessary |
|
|
2026-10-11 |
2027-10-11 |
| 133 |
The sensors answer on the host's own bus, and the bus had been there all along |
|
|
2026-10-13 |
2027-10-13 |
| 134 |
A microflow is inert until its state says MF_ACTIVE |
|
|
2026-10-11 |
2027-10-11 |
| 135 |
The sweep accelerates flows on its own on the ARMADA: flow.auto, a flow table, and a keepalive |
|
|
2026-10-14 |
2027-10-14 |
| 136 |
A flow table, a sweep, and the panic that came with them |
|
|
2026-10-11 |
2027-10-11 |
| 137 |
The switch dropped IPv6's neighbour solicitations on the ARMADA |
|
|
2026-10-18 |
2027-10-18 |
| 138 |
The encrypted frames are not lost, and the trigger cannot keep up |
|
|
2026-10-11 |
2027-10-11 |
| 139 |
The way back keeps up |
|
|
2026-10-12 |
2027-10-12 |
| 140 |
Address translation lives in the connection, not the microflow |
|
|
2026-10-11 |
2027-10-11 |
|
Images docs/images/ |
1 |
90 days |
|
|
| 141 |
Images |
|
|
2026-10-19 |
2027-01-17 |
The discussion of this page is held in the project's GitHub Discussions. Showing it here loads giscus from giscus.app and GitHub, and writing in it needs a GitHub account - what that means.