Repository navigation
Timeline
AbdelmonemAwad edited this page Oct 19, 2026
·
4 revisions
Close to two years, in one table. The first part is the time before the repository, which the repository does not hold: its dates are mine, counted back from October 2026, and marked ≈ where they are approximate. The second part is the repository's own history, and every row links to its commit, page or release.
| when | what | chapter |
|---|---|---|
| long before | a Sophos XG 330 in my network, running OPNsense - one computer, every port a network card | 1 |
| 2024-12 | the XGS 136 bought, with a two-year Sophos licence, shipped from Japan and delivered ten days later - taken apart on the first day, then reassembled | 2 |
| 2024-12 to ≈ 2025-04 | run as it was sold, on Sophos's own operating system, under its licence | 2 |
| ≈ 2025-04 | the decision, and the start of the project's eighteen months: a strong first-generation desktop whose support is heading for its end, kept alive on open source | 2 |
| ≈ 2025-04 to 2025-12 | eight months and a few weeks of survey, in the evenings: the XGS 136 beside the XG 330; other vendors' appliances compared to understand crypto and network coprocessors; teardowns; the sources | 3 |
| ≈ 2026-01 | the first XGS 3300 - a generation whose support still runs, a different coprocessor family, bought to reach the goal | 4 |
| ≈ 2026-01 to 2026-09, in this order | the board's service headers; UART, JTAG and SPI adapters bought and tried - a certain failure | 4 |
| reverse engineering from the vendors' open sources, their platform data and the coprocessors' own filesystems | 5 | |
| attempts, in stages and with many failures, at a firmware of my own for the coprocessor - and the board's many chips that complete its work | 6 | |
| the turn: the host learns the coprocessor's own protocol, and the vendor's firmware stays where it is; the two drivers written | 7 | |
| 2026-09-25 | the repository's first commit | 7 |
| date | what | where |
|---|---|---|
| 2026-09-25 | the XGS 136's coprocessor released from reset; the management link brought up | commits |
| 2026-09-26 | every front port its own interface | #28 |
| 2026-09-27 | the gate on the front ports was a handshake - and the vendor's fast path runs | #48 |
| 2026-09-30 | the XGS 3300's last hop opens: the output ring granted in the block's own unit | #143 |
| 2026-09-30 | the XGS 3300's front ports as network interfaces | #144 |
| 2026-10-01 | one transmit buffer per slot (29% loss to 0.0%), IPv6, the crypto engine answers; the module follows the kernel | the road, #203 |
| 2026-10-03 | offload switched on - it never had been | #210 |
| 2026-10-06 | the flow table and its sweep, on the XGS 3300 | #255 |
| 2026-10-07 | IPsec associations from strongSwan on the XGS 3300's crypto engine, both directions | #295 |
| 2026-10-08 | tunnel connections in the flow table; the receive ring granted above the watermark | #305, #324 |
| 2026-10-11 | the XGS 136 opened and photographed | #333 |
| 2026-10-13 | an OPNsense update on the XGS 136: the module rebuilt for the new kernel, all fourteen ports back | armada.md |
| 2026-10-14 | the XGS 136: its first offloaded flow, and IPsec in hardware both ways | #388, #400 |
| 2026-10-16 | the front ports assign themselves at the first boot; an image from xgs-image-builder installed on an XGS 3300; a second XGS 3300 on the bench, with a 4x10G module | #411 |
| 2026-10-17 | three appliances on one bench, clear text and IPsec measured; the XGS 136's receive at 773 in and 934 out; one menu section, every string in Arabic | #419, #416, #428 |
| 2026-10-18 | IPv6 flows at 9.24 and 9.27 Gbit/s on the XGS 3300; both tables the size the board states; four transmit queues on the XGS 136; the first release, 0.1.0-alpha.1 | release |
| 2026-10-18 | 0.1.0-alpha.1.1 the same day: the problem reporter tells crashes apart, the chipset's record of why the host last reset kept at every boot, a progress bar on the Updates page | release |
| 2026-10-19 | open connections cut by a block list and by a TLS fingerprint; the XGS 3300's coprocessor counts what it forwards, and pf and the interfaces count it too; unusual traffic reported; the coprocessor's DoS commands probed - it drops no address | #508, #511, #516, #518, #519 |
| 2026-10-19 | the XGS 136 reads its coprocessor's counts into pf and the interfaces; a connection its fast path gives back soon after it was made waits with the host; each cage reports the medium its module carries; every page of the XGS menu renders again on appliances set up by the installer | #528, #532, #535, #537 |
| 2026-10-19 | 0.1.0-alpha.2: eleven fixes and twenty improvements gathered since 0.1.0-alpha.1.1 | release |
| 2026-10-19 | the three appliances updated to 0.1.0-alpha.2 from their own Updates page, every step photographed; 0.1.0-alpha.2.1 the same evening: a build from a test branch is offered the release, a reboot only when the driver changed | guide, release |
Copyright © 2026 Abdelmonem Awad · os-xgs-npu, BSD-2-Clause · OPNsense® is a registered trademark of Deciso B.V.; Sophos® and XGS are trademarks of Sophos Ltd. This project is independent of both.
Before the repository
- Two computers in one box
- The XGS 136 arrives
- Eight months of looking
- The first XGS 3300
- Reverse engineering
- A firmware of its own
- The host and the coprocessor
In the repository
- Fourteen ports on the XGS 136
- The XGS 3300 and the last hop
- From ports to offload
- An appliance again
Using it
Also
The repositories