5. Reverse engineering, from the open sources¶
The adapters failed because they started at the wrong end. The turn came from reading. Sophos publishes the source code of the open-source parts of its firmware, and the software on the coprocessor is built on open-source components. So the reverse engineering proper began there: with the open files and the vendors' own sources, read until the hardware could be described from them.
What there was to read¶
| material | what it gave |
|---|---|
Sophos's open-source release for each firmware version - for the XGS 136's family, 794 files including Marvell's pcie_ep_armada; for the XGS 3300's, the pcie_ep_octeontx SDK, four archives deep inside the release disc |
the protocol across the PCIe link: register offsets, command numbers, descriptor layouts |
| Marvell's UMSD switch driver, in the same release | the 88E6193X switch: its registers and its forwarding table |
| Sophos's NetAgent sources | the network agent: its messages and attributes |
| the vendor's platform data for each assembly | the port maps: which label is which switch port, which PHY, which bus |
the coprocessor's root filesystem and its fast path, usfp, with symbols |
structure layouts and names, from the debug information left in it |
| the vendor's host tools | the reset line's commands and the per-board masks, by disassembly |
| the appliances' own boot logs | confirmation that a reading was right |
A story about reading literally¶
Reading is not the same as believing what you read. The front panel of the XGS 3300 taught that best - later, in the repository's second week.
The vendor's own script sets the panel's serial line to 2400 baud, so 2400 is what was tried. At
2400 the display filled with scattered x-with-a-bar glyphs - HD44780 character 0xF8, which is
exactly what bytes look like when they arrive at a quarter of the receiver's rate: the stretched start
bit holds the first three sampled bits at zero, and the next stretched bit fills the other five with
ones.
The script was right about the command and wrong about the effect. stty ispeed 2400 sets only the
input speed, and the port is a 16450 with a single divisor, so on the vendor's own system that
command never moved the line at all: it stayed at Linux's default, 9600. At 9600 the text was
legible, and on 2026-10-02 two correct lines were read off the panel. Reading the vendor's script
literally had kept that question open for a week.
The boundary I keep¶
The project is BSD-2-Clause, and almost none of it could have been written without material licensed differently. So it keeps one rule about that material, and says so where anyone can check:
Facts are transcribed. Expression is not copied.
A register offset, a command number or a field width is a fact about a piece of hardware; the code that acts on it is written from nothing. Each family has its own account of exactly what was read and from where: ARMADA and OCTEON TX.
Previous: 4. The first XGS 3300 · Next: 6. A firmware of its own, and a board of many chips
The discussion of this page is held in the project's GitHub Discussions. Showing it here loads giscus from giscus.app and GitHub, and writing in it needs a GitHub account - what that means.