[PATCH 3/3] arm64: dts: marvell: Add Sophos XGS 107w NPU board
From: Nicolo Giuliani via B4 Relay
Date: Sat Sep 19 2026 - 15:44:56 EST
From: Nicolo Giuliani <nicolo.giuliani6@xxxxxxxxxxxxxxx>
Add a device tree for the network processing unit (NPU) of the Sophos
XGS 87/107 desktop firewalls. The appliance pairs an AMD x86 host with the
NPU, a Marvell Armada CN9130 SoC with its own eMMC and SPI NOR flash that
runs independently of the host and serves the front panel ports.
The eight RJ45 ports and the SFP cage are connected through a Marvell
88E6193X switch on the MDIO bus of the SoC, at address 2. Switch port 0
is the CPU port, a 10GBASE-R link to the first mvpp2 port. Ports 1 to 8
are the RJ45 ports, which use the internal PHYs of the switch, and
port 9 is the SFP cage, connected over 1000BASE-X.
Describe the UART console, the eMMC, the SPI NOR flash that holds the boot
loader and its environment (read-only), the PCA9555 GPIO expander that
drives the port LEDs, the SFP cage and the switch with its ports. The LEDs
themselves, the PCIe link to the x86 host and the USB ports are not
described.
The reset line of the switch (CP GPIO2 pin 17) is deliberately not given
to the mv88e6xxx driver as reset-gpios. The 88E6193X needs about two
seconds after a reset before it can be used, much longer than the driver
waits, so the probe would time out. The boot loader resets the switch
before it starts the kernel.
Tested on an XGS 107w with Linux 6.18: boot from eMMC, eMMC and SPI NOR
access, the mvpp2 link to the switch at 10 Gb/s, the 88E6193X probing with
its eight user ports, and 936 Mbit/s through a front port. The SFP cage
and the PCA9555 outputs are untested.
Assisted-by: LLM
Signed-off-by: Nicolo Giuliani <nicolo.giuliani6@xxxxxxxxxxxxxxx>
---
arch/arm64/boot/dts/marvell/Makefile | 1 +
.../boot/dts/marvell/cn9130-sophos-xgs107w.dts | 209 +++++++++++++++++++++
2 files changed, 210 insertions(+)
diff --git a/arch/arm64/boot/dts/marvell/Makefile b/arch/arm64/boot/dts/marvell/Makefile
index 09d1544041..81f892715b 100644
--- a/arch/arm64/boot/dts/marvell/Makefile
+++ b/arch/arm64/boot/dts/marvell/Makefile
@@ -34,5 +34,6 @@ dtb-$(CONFIG_ARCH_MVEBU) += cn9130-cf-base.dtb
dtb-$(CONFIG_ARCH_MVEBU) += cn9130-cf-pro.dtb
dtb-$(CONFIG_ARCH_MVEBU) += cn9131-cf-solidwan.dtb
dtb-$(CONFIG_ARCH_MVEBU) += cn9132-clearfog.dtb
+dtb-$(CONFIG_ARCH_MVEBU) += cn9130-sophos-xgs107w.dtb
subdir-y += mmp
diff --git a/arch/arm64/boot/dts/marvell/cn9130-sophos-xgs107w.dts b/arch/arm64/boot/dts/marvell/cn9130-sophos-xgs107w.dts
new file mode 100644
index 0000000000..d98d8da10e
--- /dev/null
+++ b/arch/arm64/boot/dts/marvell/cn9130-sophos-xgs107w.dts
@@ -0,0 +1,209 @@
+// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
+/*
+ * Device tree for the network processing unit (NPU) of the Sophos XGS 87/107
+ * firewalls: a Marvell CN9130 SoC with a Marvell 88E6193X switch.
+ *
+ * The x86 host on the same board is not described here.
+ */
+
+/dts-v1/;
+
+#include "cn9130.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+ model = "Sophos XGS 107w (CN9130 NPU)";
+ compatible = "sophos,xgs107w-npu", "marvell,cn9130",
+ "marvell,armada-ap807-quad", "marvell,armada-ap807";
+
+ chosen {
+ stdout-path = "serial0:115200n8";
+ };
+
+ aliases {
+ ethernet0 = &cp0_eth0;
+ i2c0 = &cp0_i2c0;
+ i2c1 = &cp0_i2c1;
+ };
+
+ memory@0 {
+ device_type = "memory";
+ reg = <0x0 0x0 0x0 0x80000000>;
+ };
+
+ reserved-memory {
+ /* OP-TEE, reserved by the firmware */
+ tee@4400000 {
+ reg = <0x0 0x4400000 0x0 0x1000000>;
+ no-map;
+ };
+ };
+
+ /* Front-panel SFP cage "F1", wired to switch port 9 */
+ sfp: sfp {
+ compatible = "sff,sfp";
+ i2c-bus = <&cp0_i2c1>;
+ los-gpios = <&cp0_gpio1 1 GPIO_ACTIVE_HIGH>;
+ tx-fault-gpios = <&cp0_gpio1 2 GPIO_ACTIVE_HIGH>;
+ mod-def0-gpios = <&cp0_gpio1 3 GPIO_ACTIVE_LOW>;
+ tx-disable-gpios = <&cp0_gpio1 7 GPIO_ACTIVE_HIGH>;
+ };
+};
+
+&uart0 {
+ status = "okay";
+};
+
+/* eMMC on the AP */
+&ap_sdhci0 {
+ bus-width = <8>;
+ non-removable;
+ mmc-ddr-1_8v;
+ status = "okay";
+};
+
+/*
+ * The MPP pin muxing is left as configured by the boot loader; the pin
+ * controller node only exists to back the GPIO banks.
+ */
+&cp0_syscon0 {
+ cp0_pinctrl: pinctrl {
+ compatible = "marvell,cp115-standalone-pinctrl";
+ };
+};
+
+&cp0_i2c0 {
+ clock-frequency = <100000>;
+ status = "okay";
+
+ /* Drives the port speed LEDs, which are not described yet */
+ gpio@20 {
+ compatible = "nxp,pca9555";
+ reg = <0x20>;
+ gpio-controller;
+ #gpio-cells = <2>;
+ };
+};
+
+&cp0_i2c1 {
+ /* SFP EEPROM (0x50/0x51) */
+ clock-frequency = <100000>;
+ status = "okay";
+};
+
+/* 4 MB SPI NOR with U-Boot and its environment, read-only on purpose */
+&cp0_spi0 {
+ status = "okay";
+
+ flash@0 {
+ compatible = "jedec,spi-nor";
+ reg = <0>;
+ spi-max-frequency = <40000000>;
+
+ partitions {
+ compatible = "fixed-partitions";
+ #address-cells = <1>;
+ #size-cells = <1>;
+
+ partition@0 {
+ label = "u-boot";
+ reg = <0x0 0x3f0000>;
+ read-only;
+ };
+
+ partition@3f0000 {
+ label = "u-boot-env";
+ reg = <0x3f0000 0x10000>;
+ read-only;
+ };
+ };
+ };
+};
+
+&cp0_ethernet {
+ status = "okay";
+};
+
+/* 10G link to switch port 0 */
+&cp0_eth0 {
+ phy-mode = "10gbase-r";
+ phys = <&cp0_comphy4 0>;
+ managed = "in-band-status";
+ status = "okay";
+};
+
+&cp0_mdio {
+ status = "okay";
+
+ switch@2 {
+ compatible = "marvell,mv88e6190";
+ reg = <2>;
+ /*
+ * The reset line of the switch is CP GPIO2 pin 17. It is not
+ * described as reset-gpios: the 88E6193X needs about two
+ * seconds after a reset before it can be used, much longer
+ * than the driver waits, and the probe would time out. The
+ * boot loader resets the switch before starting the kernel.
+ */
+
+ ports {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ port@0 {
+ reg = <0>;
+ ethernet = <&cp0_eth0>;
+ phy-mode = "10gbase-r";
+ managed = "in-band-status";
+ };
+
+ port@1 {
+ reg = <1>;
+ label = "p1";
+ };
+
+ port@2 {
+ reg = <2>;
+ label = "p2";
+ };
+
+ port@3 {
+ reg = <3>;
+ label = "p3";
+ };
+
+ port@4 {
+ reg = <4>;
+ label = "p4";
+ };
+
+ port@5 {
+ reg = <5>;
+ label = "p5";
+ };
+
+ port@6 {
+ reg = <6>;
+ label = "p6";
+ };
+
+ port@7 {
+ reg = <7>;
+ label = "p7";
+ };
+
+ port@8 {
+ reg = <8>;
+ label = "p8";
+ };
+
+ port@9 {
+ reg = <9>;
+ label = "sfp";
+ phy-mode = "1000base-x";
+ managed = "in-band-status";
+ sfp = <&sfp>;
+ };
+ };
+ };
+};
--
2.48.1