* Enable the PARTITION_WALK property by default
Previously, the new PARTITION_WALK which searches for bootable
partitions after a failure had to be explicitly enabled. Change
the default to be enabled by default. It can be switched off by
setting PARTITION_WALK=0 in the EEPROM config.
* Optimise bootmain for size on Pi4
Pi4 only has a 512KB SPI flash EEPROM and the addition of features
plus fixes is now causing contention for space between the code and
the EEPROM config. Since bootmain is only responsible for loading
start.elf revert to the original configuration which is optimised
for size rather than speed. Pi5 continues to be optimised for speed.
* arm_loader: Also require the early-watchdog property
The change correcting the implementation of dtoverlay_is_enabled had the
unintended consequence of causing the firmware to enable the watchdog
even though the user had not explicitly requested it. This is harmless
on Linux because the watchdog driver takes over and disarms it, but on
other operating systems this can lead to a reboot. Avoid this problem
by also requiring the presence of a new property, "early-watchdog".
See: https://github.com/raspberrypi/firmware/issues/1980
* helpers/config_loader: Add bootvar0 eeprom config that can be used in config.txt section expressions
This allows an eeprom config setting (e.g. BOOTARG0=0x10) to be set on a board
which config.txt can use as a conditional expression (e.g. [bootarg0&0x10]).
* arm_loader: Fix boot-watchdog stop on Pi4
Fix a problem where the boot_watchdog heartbeat timer was not
stopped correctly which could cause it to clash with the kernel
watchdog driver.
* board_info: Use the Ethernet PHY address probed by the bootloader
Use the Ethernet PHY address supplied by the bootloader in
preference to the static configurations defined in start4.elf
* Check for SD card overcurrent on Pi5, Pi500 and Pi4
Before booting, the bootloader now checks the SD power switch
overcurrent signal. The overcurrent signal occurs if the SD
card is damaged and has a short circuit which will cause it to
get hot.
If an over-current condition is detected the bootloader switches
switches off power to the SD card and waits five seconds before
probing the SD card again. This error is displayed on the
diagnostic screen, the UART and the activity LED (1 long, 2 short)
flashes.
The check can be switched to a non-blocking warning by setting
SD_OVERCURRENT_CHECK=0 in the bootloader config.
* Add a new error code pattern for SD overcurrent
Add a new error pattern (1 long, 2 short) to signal SD card
overcurrent.
* Add support for a bootloader watchdog
Add support for a boot watchdog (using PM_RSTC hw wdog) which will
trigger if the OS is not started within the specified amount of time. The
watchdog is enabled by setting the BOOT_WATCHDOG_TIMEOUT=N (seconds)
property in the bootlaoder config.
The BOOT_WATCHDOG_PARTITION=P property can be set to pass a different
partition number to the bootloader on reset if the watchdog
is triggered.
The boot watchdog is automatically cleared just before starting
the OS and (optionally) enabling the kernel watchdog.
* Skip first SD boot if no card detected
On platforms with an SD Card detect signal, skip the first attempt to
boot from SD if the card appears to be absent. This can save over a
second on a cold boot, and a little under a second for a reboot.
* 2711: (recovery) Automatically set revoke_devkey if program_pubkey=1
Previously, on BCM2711 products it was possible to program the key
hash without revoking the development key. This can be useful for
testing but should never be used in production because it is possible
to an install an older version of the bootloader which doesn't
support secure-boot. Since the secure-boot tools are stable and
have improved usability (RPi secure-boot provisioner) this test
feature not necessary and is just a security risk so the behaviour
is changed to always revoke the development key if program_pubkey=1.
This change is not relevant on BCM2712 because secure-boot requires
that the second stage bootloader is counter-signed with the customer's
private key.
* Signed boot and HTTP boot mode
HTTP boot mode is supposed to be disabled if signed boot is enabled and
a host is not specified. The code is checking the http_secure flag to
enforce this. But this is valid now we support custom CA certs.
Only disable HTTP mode if we're using the default HOST.
* Implement TCP window for net boot
The minimal IP stack used for https booting lacks the ability to cache
packets received out of order, which can lead to severe slowdown when
it happens. The problem seems to affect some ISPs more than others.
The receive window implemented here copes with packet losses of 10%.
* netboot: Correct the TCP MSS
* Correct msecs in debug timestamps
The fractional part of timestamps in UART debug output was showing the
100ths and 1000ths of a second, rather than 10ths and 100ths, causing
strange sequences that appear to jump backwards.
* recovery: Walk partitions to delete recovery.bin
Previously, recovery.bin would fail to delete itself
if the bootrom loaded recovery.bin where there are multiple FAT
partitions and the first partition does not contain recovery.bin
Update the rename code to walk the partition table to find
the recovery.bin file to delete.
* Enable overriding of high partition numbers
Previously, the PARTITION=N bootloader config setting would only
be used at power on reset or if the partition number passed to
reboot was zero.
Change the behaviour so that the bootloader config PARTITION
property can override the reboot partition number if the reboot
parameter is > 31.
* Walk the partition table if the requested partition is not bootable
Previously, if the specified boot partition was not bootable the
bootloader would stop and advance to the next BOOT_ORDER. If the
new PARTITION_WALK option is set to 1 the bootloader will now
check each partition in turn starting from the specified partition
before advancing the BOOT_ORDER.
This feature is intended for use with A/B systems to handle the case
where autoboot.txt is missing / corrupted. This change enables
the system to failover to the next available bootable partition.
The autoboot.txt file is not scanned during the partition-walk
phase i.e. there is no recursive processing of autoboot.txt files.
This option is only supported on physical block devices
(SD, NVMe, USB) and not RAMDISK. USB assumes a single high speed
device, partition walks on multiple USB devices is not recommended
and may cause timeouts.
* Improve keyboard handling in boot menu
Try and make it more likely that we have enough time to perform key
detection.
Ignore mice, which were being enumerated and slowing things down.
* Enable banklow (and so NUMA) by default
banklow=1 (2712) and banklow=3 (2711) give the best performance.
* enable_uart=1 now enables a Linix UART console on the 40-pin header
unless a cable is detected on the dedicated boot-uart.
* Recreate internal bl31 stub from clean git tree to fix dirty commit
message.
* Fix PCIe BAR setup issue which prevented NVMe boot from working with some PCIe switches
See: https://github.com/raspberrypi/firmware/issues/1833
* Boot-menu improvements
Remain in the forced boot mode until the menu is used to select a different
boot-mode or reset to the original boot-order.
SD card high-speed/low-voltage mode can only be exited by powercycling.
Pi 4s before rev 1.4 lack the power switch required to do this, so
must resort to a global reset that turns off many things, including
SDRAM.
To ensure correct operation, the bootloader checks that the SD I/O
voltage is the expected 3.3V, forcing a power cycle if it isn't.
However, this doesn't take advantage of presence of the dedicated
SD power switch, always forcing a global reset, a consequence of which
can be the loss of SDRAM content - including any ramoops dump of the
crash logs.
Make the bootloader more SD_PWR_ON aware, only triggering a global
reset if one isn't found.
See: https://github.com/raspberrypi/linux/issues/5298
* arm_dt: Consult the hat_map for all HATs
* USB boot - ignore RP2 / RP3 MSD device in BOOTSEL mode.
* recovery.bin - Fix erase_eeprom to not block reboot_recovery
* Fix self-update to continue to boot instead of retrying forever
if the EEPROM is write protected.
https://github.com/raspberrypi/rpi-eeprom/issues/597
* Enable the usage of program_rpiboot_gpio in config.txt for recovery.bin
without requiring secure-boot to be enabled.
This may be useful CI systems provisioning images on Pi4B / Pi400 via RPIBOOT.
This is an OTP setting and cannot be reverted after programming.
See https://www.raspberrypi.com/documentation/computers/config_txt.html#program_rpiboot_gpio
* Add timestamps to UART log messages.
* Add support for [tryboot] conditional the bootloader EEPROM
config file.
See: https://github.com/raspberrypi/rpi-eeprom/issues/454
* Fix MAX_RESTARTS parameter
See: https://github.com/raspberrypi/rpi-eeprom/issues/576
* Add recovery_reboot option to config.txt for rpiboot which causes
the system to reboot after updating the bootloader.
* Improve secure-boot OTP provisioning logging.
* Fix setting to enable secure-boot mode on Pi4B
* Switch to building the Pi4 firmware from the common Pi4/Pi5
mainline release. This doesn't change the Pi4 features
but should make it quicker to release bug fixes in common code.
* Fix issue that caused the TRYBOOT flag to be lost in secure-boot mode.
* dtoverlay: Use %u when converting u32s to strings
See: https://github.com/raspberrypi/linux/issues/6039
* Improved debug messages for secure-boot.
* Generate the bootloader diagnostics qrcode at run time.
