7. The host and the coprocessor¶
The way through was to stop fighting the coprocessor, and to learn instead how the host and the coprocessor deal with each other. The vendor's firmware stays on the coprocessor, doing everything it already does well. What I write is the other half of the conversation - the host's side - for FreeBSD.
Of every road I tried, this is by far the best, and everything since stands on it:
- nothing on the coprocessor is replaced, so it boots and runs its fast path and its crypto engine exactly as its maker intended;
- what the vendor's host software did around it, the driver does - the switch behind the ports programmed over the coprocessor's management bus, the CPLD's bits set, the ports named - each from what the sources say;
- the host speaks the coprocessor's own protocol over PCIe - its handshake, its management link, its network agent, its RPC, its datapath rings - learned from the open sources of chapter 5;
- and OPNsense stays in charge: its firewall decides, and the coprocessor's fast path and crypto engine are handed the decisions.
The conversation, in five parts¶
Both families offer the host the same kinds of thing, in two different protocols:
| what it is | |
|---|---|
| control | the handshake that tells the coprocessor a host is present |
| management link | a virtual Ethernet between the two computers |
| network agent | the coprocessor's view of its ports and its switch |
| RPC | commands and their answers - the flow table, the crypto associations |
| datapath | the rings that carry the front ports' frames |
On the XGS 136 they are five facilities in a table the coprocessor publishes into a PCIe window, the datapath among them called GIU. On the XGS 3300 there is no GIU: the datapath is the OCTEON TX's own SDP rings, with doorbells of their own. Two families, two protocols - one road.
The XGS 3300's coprocessor, a Marvell OCTEON TX CN8365 - the die cap confirming what the platform database had named.
Into the open¶
With the road settled, the two drivers were written for it - npuep for the XGS 136 and octep for
the XGS 3300 - and the work was prepared for publishing. The repository's first commit is dated
2026-09-25: Release the Marvell NPU on Sophos XGS appliances, and answer what it waits for.
From here on the story is in the repository's own history, and every chapter can point at the commit, the measurement or the photograph it rests on.
Previous: 6. A firmware of its own, and a board of many chips · Next: 8. Fourteen ports on the XGS 136
The discussion of this page is held in the project's GitHub Discussions. Showing it here loads giscus from giscus.app and GitHub, and writing in it needs a GitHub account - what that means.