6. A firmware of its own, and a board of many chips¶
With the sources read, the attempts came in stages - and most of the stages failed. The most ambitious of them was to give the coprocessor a firmware of its own: to replace the vendor's software on it with an independent one, and own the ports outright instead of asking the vendor's software for them.
The coprocessor is not alone¶
That road ran straight into the reality of the XGS 3300's board. The coprocessor does not own the front ports by itself. Several other chips complete its work, each set up in a particular way that nothing outside the vendor's software describes:
| part | what it does for the coprocessor |
|---|---|
| Marvell 88E6193X switch | ten of the twelve front ports sit behind it, each frame on its uplink tagged with the port it came from |
| Marvell 88X5113 PHY | the 10G line behind the two direct cages |
Lattice CPLD, LCMXO3LF-2100C |
the SFP cages' pins, the bypass relays, the board's events |
| nine fail-to-wire relays | the bypass pairs that let traffic through when the firewall is down |
| the front panel's micro-controller, a GIFAR bridge | the LCD and its keys, behind a serial protocol of its own |
A firmware of my own would have had to bring up every one of them, exactly right, with nothing to say how.
Three small stories from that board¶
Each of these parts had a story of its own later, once the road of the next chapter had been taken:
 |
One bit, a dark cage. Two of the SFP cages stayed dark, and each was held by a single bit in the CPLD, reached over the coprocessor's own SPI bus. Clearing that bit lit a cage that had been dark since the appliance was built. |
 |
Read, and left alone. Nine relays, one per differential pair, two pairs per port: the hardware behind three CPLD registers. The project reads them, and has decided not to write them. |
 |
A claim withdrawn. The 10G PHY behind the two direct cages. A claim about it was published once and withdrawn: a register was taken for an indicator it never was. The part itself was never in doubt, and now it is on a photograph. |
Photographed on 2026-10-01 and later, when the board was documented for the repository.
What the failures taught¶
Every failed stage pointed the same way. The vendor's software on the coprocessor already boots it, runs its fast path and its crypto engine, and then waits for a host to talk to it. Replacing it meant rebuilding everything it does. Speaking to it meant learning one conversation - and doing, from the host, only what the vendor's own host software had done around it.
Previous: 5. Reverse engineering, from the open sources · Next: 7. The host and the coprocessor
The discussion of this page is held in the project's GitHub Discussions. Showing it here loads giscus from giscus.app and GitHub, and writing in it needs a GitHub account - what that means.