The Sophos XGS 87/107 desktop firewall is, inside, two separate computers: a Marvell CN9130 network processor (4 Cortex-A72 cores) driving all 8 gigabit ports, the SFP cage and LuCI, and an AMD x86 board driving the Wi-Fi radio and the front USB port. A PCIe endpoint link between the two, turned into a virtual Ethernet interface, joins them into one LAN. This project replaces Sophos's firmware (SFOS) on both sides with OpenWrt. No Sophos code is used.
Status: working. Both computers run OpenWrt with their own LuCI, joined by a virtual Ethernet (
ntb0) over the internal PCIe link. Wired ports run at line rate, Wi-Fi and the front USB port work. The stock Sophos system stays bootable on the NPU as a fallback; the x86 has no fallback once converted.
Two independent OpenWrt systems, two web interfaces, two passwords — connected by
ntb0 so the network sees one LAN. How it was built, and every dead end on the
way, is in the write-up.
Two systems, two web interfaces
| Address | Manages | |
|---|---|---|
| NPU (Marvell CN9130) | http://192.168.1.1 | the router: 8 ports, SFP, WAN/LAN, firewall, DHCP, LEDs |
| x86 (AMD) | http://192.168.1.2 | Wi-Fi, the front USB port, its own status |
They are connected by an internal virtual Ethernet and share one LAN, but there is no single combined interface — the NPU's menu only links to the x86's.
Measured
| Result | |
|---|---|
| Wired ports (NPU ↔ PC) | 941 Mbit/s (line rate) |
| Internal NPU ↔ x86 link | 630 Mbit/s (NPU→x86), 1.7 Gbit/s (x86→NPU) |
| Wi-Fi 5 GHz, no external antennas fitted | 300–500 Mbit/s down, 200–400 up (5 streams, one client) |
| Front USB port | drive detected and readable; speed and hot-plug not measured |
Not working or untested: the SFP cage (no module on hand), port LED polarity and colour
(wired in the device tree, unconfirmed), 2.4 GHz Wi-Fi and range, LAN-to-LAN routing
throughput, and install.sh --serial end-to-end on hardware.
Requirements
- The appliance, a PC on the same network, and the x86 console (micro-USB) for the installer.
- Back up the stock system first (both the NPU eMMC and the x86 disk).
- Access to the SFOS advanced shell (login
admin, menu 5, then 3) to run the installer on the appliance.
Quick start
git clone https://github.com/nicologiuliani6/openwrt-sophos-xgs107.git
cd openwrt-sophos-xgs107
./install.sh --serial
This builds the images, serves them, and runs both installers on the appliance
(./install.sh without --serial prints the two commands to paste
instead). Then power-cycle the appliance and open http://192.168.1.1 (router)
and http://192.168.1.2 (x86, Wi-Fi), and set a root password on each — there is
no default.
Never let SFOS boot on the x86 after conversion: it erases the OpenWrt root. On the NPU, SFOS stays bootable as a fallback.
Documentation
The reference documentation lives in the repository:
| Page | Contents |
|---|---|
| install | Full installer walk-through. |
| usage | Wi-Fi setup, consoles, day-to-day operation. |
| architecture | What runs where, the boot chains, why it's built this way. |
| hardware | Full board reference: SoC, switch, port map, PCIe endpoint facts. |
| npu-x86-link | The ntb0 PCIe endpoint link, the patches it needed. |
| backup / recovery | Backing up the stock system and recovering from a bad boot. |
| troubleshooting | Known issues and fixes. |
| build | Building the images from source. |
| upstreaming | The kernel/device-tree patches sent to the Linux maintainers. |
FAQ
Does this need any Sophos code?
No. Both sides run stock OpenWrt on mainline Linux drivers. The proprietary SFOS kernel
modules the x86 used to reach the switch (mv_armada_drv, mv_pcinet_drv,
…) are not used anywhere in this stack.
Is it reversible?
On the NPU, yes — the stock Sophos system stays on its own eMMC slot and boots as a fallback if OpenWrt's kernel fails to load. On the x86, no: OpenWrt is written over SFOS's own swap area, and booting SFOS again on that side erases the OpenWrt root. Back up both sides before installing.
How do the two computers talk to each other?
Over the CN9130's PCIe endpoint controller, which the stock firmware already leaves in
endpoint mode against the x86. A pci-epf-vntb virtual-NTB function turns that
link into an ordinary Ethernet interface (ntb0) on both sides — mainline Linux
code plus five small patches (BAR alignment, cache coherency, MSI, and two throughput fixes).
See the write-up.
What if the NPU reboots or the x86 loses the link?
Resetting or losing the NPU while the x86 has the link bound reboots the x86 (the PCIe endpoint disappears from under the driver). It comes back and re-links itself; the boot order of the two systems does not matter.
Are these patches going upstream?
Yes. The mv88e6xxx switch driver fix is reviewed and accepted by the DSA
maintainer; the device-tree series describing the board is still waiting on a maintainer
ack. Neither is required to use the board today — the same changes already ship inside this
project's OpenWrt image. Status: upstreaming.md.
What's not working yet?
The SFP cage is untested (no module on hand), port LED wiring is a best guess pending confirmation, 2.4 GHz Wi-Fi and range are unmeasured, and LAN-to-LAN routing throughput has not been benchmarked.
Questions, or testing on your own unit?
Open an issue or a discussion on the repository, or email me@nicologiuliani.site. Results from other XGS 87/107 units are especially welcome — everything here was developed against a single unit.