edk2-platforms VS FSP

Almost certainly the former as the latter is barely usable (if not outright unusable). Ampere says the Altra and Altra Max are compliant with Arm SBSA and SBBR, so compliant OSes that support UEFI and ACPI should just work (no need for SoC-specific kernel trees/etc like you tend to find on SBCs with lower-end SoCs). The devkit product page also mentions that it uses "open source EDKII" firmware. It looks like Ampere released the source code for their EDK II port and is working on upstreaming it. They also published a guide on how to build the firmware.

There's an rpi3/4 edk2 uefi firmware you'd have to use in order to run it, but it does exist

It's not entirely open source (it still depends on the FSP binaries), but Intel has released UEFI initialization code for older platforms. They also contribute platform support to coreboot (though this also depends on the FSP).

If you prefer building it yourself: https://github.com/tianocore/edk2-platforms/tree/master/Platform/RaspberryPi/RPi4

> They prefer to keep inner workings secret

https://github.com/tianocore/edk2-platforms/tree/master/Sili...

I tried to find in the Intel GitHub repo, but it's not there, and there's an unanswered question about it from you https://github.com/intel/FSP/issues/74

There may be other protections to restrict SPI flash access for security reasons (so you might not be able to flash your custom firmware in the OS), but worst case you can use a HW flasher (or maybe USB flashback). Still, this doesn't address the elephant in the room - platform initialization code might be open-sourced, but that isn't everything. You'll still need to figure out the board-specific stuff (the Super I/O chip, chipset GPIOs, other peripherals, etc.). Using coreboot as an example, Intel provides the Firmware Support Package blob to handle platform initialization. I think AGESA is somewhat similar to this, though Intel publicly releases the binaries for use in coreboot/etc. Thanks to the FSP, coreboot has support for recent Intel chipsets. However, there is only support for two recent consumer boards: the MSI PRO Z690-A WiFi DDR4 and DDR5.

May I ask why? I'm not talking about the source code, only about the final binaries. Intel already released many for previous platforms here https://github.com/intel/FSP. So I don't understand the security concerns you are referring to.

It's not entirely open source (it still depends on the FSP binaries), but Intel has released UEFI initialization code for older platforms. They also contribute platform support to coreboot (though this also depends on the FSP).

More recent Intel platforms (as of today, Haswell/Baytrail and newer) need some blobs to perform hardware initialization. There are two types of blobs: the non-redistributable MRC.bin and refcode blobs (which can be manually obtained from Chromebook recovery images), and FSP (binaries available in a GitHub repo). coreboot automatically includes FSP if the platform needs it and https://github.com/intel/FSP has the binaries.

Intel publish some version of FSP in this repo. Unlike other blobs interface to FSP is documented and standarized in specification. There is even one related to security, which Qubes OS should probably consider as mendatory for certain hardware certification levels.