# HP llfix physical kernel/Onload preparation

2026-10-04. **Preparation and cold installer/admission controls only. No physical
native pair, Onload latency, vendor reproduction, timing or release admission.**

User requested Onload after the retained HP kernel-loopback diagnostic. See the
[separate TX profile](../../bench/llfix_reference/PROFILE_ONLOAD.md) and
[original diagnostic record](RECORD_2026-10-04_llfix-hp-reference-timing.md).

## Final source and sealed inputs

Source controller checkpoint `758741a36`; corrected installation-path checkpoint
`2e7820655`. Both are on private main and separate source preservation refs.
Final capsule: 37 source files, archive SHA256
`b002dff151965b91205338c8b760d1f2e9549e75f5e2b41c74d0cb71389805a8`.
All 37 hashes/modes match after rebasing over concurrent private main changes.

On HP, final source is
`~/build/codex-llfix-reference/libhft/onload-source3`; final preparation is
`~/build/codex-llfix-reference/libhft/onload-generation3`. No native build occurred.
The original `generation2` and `framework-generation2` remain read-only.

Preparation verifies the actual original 204-file source tree, generated CPU-only
compile input, complete binary maps, frozen controllers/support, framework source
and header maps and matching compiler receipts. Bundled upstream llfix **1.0.7**
remains at comparison commit `165cc999fa283a4ead17a7b935c5d3f850fec851`; it does
not replace the qualified Stage 2 llfix 1.0.8 generation.

| Final TX input | Retained binary SHA256 |
| --- | --- |
| Original TX | `8003c3734c257c5e76f9a226f542c42d544ca52c83ef1401bec78ff4f09fabd5` |
| Original peer | `9f7a2379b99da6c7df7216f276bde074c30b72de0d27fcae902cb278677f1cf4` |
| Framework TX | `ac8f28091bf835ee626ef2bb851ec84b3856e2acc21eaaf6e1089c6077442a5c` |

Actual GCC 11.5 executable hash remains
`fc1ea664a2a85c301fef71284f5e4906eaeb40a40c5225f9b0ac1aae10b00c2e`.
Original flags/workload/timing boundaries are unchanged. Final preparation also
binds the installed Onload library, launcher, stackdump, ethtool, disk kernel
module bytes, loaded module version and actual `onload --version` output.

## Protected namespace entrypoint

HP's existing `sfcA`/`sfcB` namespaces contain linked Solarflare SFC9220 ports
`ens5f0`/`ens5f1`, `10.9.0.1`/`10.9.0.2`. The default host interface is not this
link. Kernel TCP and Onload use the same DAC and fixed client/peer CPUs 17/16.
The controller and monitor stay on CPUs 0-7. Both Onload TCP loopback shortcuts
are disabled; cold proof requires actual owned established sockets and positive
TX/RX physical counters on both ports. There is no TCPDirect arm.

The exact root entrypoint validates namespace, Solarflare vendor and installed
manifest/binary hashes. It drops root and supplementary groups before native
execution. To preserve the existing scoped sudo boundary, final native ELF/data
files sit **outside** the namespace sudo wildcard:

- Payload: `/usr/local/libexec/llfix-reference-hp-v1-d3cb22233f28`.
- Permitted launcher: `/usr/local/libexec/libhft-bench/llfix-reference-hp-v1-d3cb22233f28-run`.
- Manifest SHA256: `7862839bcfeb7d280e73cc593382e1c155c267f270093bc3c44732fdb46987b5`.
- Installer SHA256: `ed728188c72d1c406aa9d1705cd6afbe1c573fb5d4cd1f624fa9f5f7dcc12a46`.

Existing root/fullbench installers, launchers, sudoers and namespace topology
were not edited. No existing physical payload or SDK pin changed.

## Cold verification and retained refusals

- Final ten cold checks pass on BEELINK2 and on actual HP, zero skips. Controls
  reject kernel fallback, absent/wrong owned socket descriptors, missing physical
  counter changes, inherited preload/loopback options, incorrect execution owner,
  altered installation bytes, symlinks and direct native placement in the sudo
  wildcard. Both actual capsule CLI startup checks pass on HP.
- An actual isolated user-namespace installer fixture on BEELINK2 verifies file
  bytes/modes/ownership, refuses overwrite and refuses altered input before any
  destination writes. This is installer logic, not real HP root installation or
  native execution. The installer function AST is identical across its tested
  source and final source; final path selection has its separate tenth check.
- Initial preparation 1 lacked the final Onload runtime bindings; preparation 2
  bound those but still placed native files under the existing sudo wildcard.
  Both are retained, superseded and were observed uninstalled. The earlier
  generation 2 installation command is superseded by generation 3 below.
- HP's actual passwordless root-install attempts for generations 2 and 3 return
  `sudo: a password is required`. Their subsequent installation verifiers refuse
  missing root-owned binaries. No physical native program starts. Original logs
  and receipts are retained without rewriting the failures.
- Initial retention invocation put a global CLI argument after its subcommand
  and refused before producing an archive. Its original failure is sealed. A
  separately logged continuation corrected argument placement and verifies the
  complete archive.

Preparation, HP cold checks, installation attempts and retention use queued
shared/high slots. The staged functional manager requires a successful installed
verification, then uses isol/high for six untimed million-message TX pairs and
shared/high for complete wire/raw cold review. It has **not** started. Quiet
timing remains a separate isol-no-shared/high run with the unchanged 120-second
preflight, complete monitor coverage and equal upstream clock-scale review.

## Archive and evidence

Archive verified independently on HP and BEELINK2:
`~/archive/libhft/codex-llfix-reference-20261004/hp-onload-preparation3.tar.gz`.

- 173 sealed files; 2,274,916 compressed bytes.
- Archive SHA256: `e00a57ee4fbacc7eb1f3668836fcf6e95caebc0b0d9c11f0e0caac8408a1a6d0`.
- Seal SHA256: `33a43c334d5f958cdba5ca67de6ebde9e2ad1f48143164bba98c357cce96c0e9`.

[Selected exact metadata and source receipts](evidence/llfix-hp-onload-preparation-20261004/selection-manifest.json)
bind 50 individually verified archive selections, additional independent
operational receipts and the explicitly local installer controls. Raw binaries
and every superseded source capsule remain in the sealed archive.

## Required installation on HP

HP's sudo policy requires an interactive password to install the new entrypoint.
The corrected generation 3 command is:

```bash
printf '%s\n' 'ed728188c72d1c406aa9d1705cd6afbe1c573fb5d4cd1f624fa9f5f7dcc12a46  /home/yann/build/codex-llfix-reference/libhft/onload-generation3/install-reviewed.py' | sha256sum -c - &&
sudo /usr/bin/python3 -I /home/yann/build/codex-llfix-reference/libhft/onload-generation3/install-reviewed.py
```

The root installer verifies exact selected input bytes before creating its fixed
versioned paths and refuses overwrite. Installation receipt, actual sockets,
port traffic, all required-value/owner folds and timing remain unqualified until
the corresponding next phases actually pass. No numerical performance result is
inferred from this preparation.