imager: Move the imager release to 2025-11-05

* arm_loader: Add iommu_dma_numa_policy=interleave when needed
  This applies a similar numa interleave for iommu dma kernel allocations.
  This includes buffers allocated for hevc and v3d.
  See: https://forums.raspberrypi.com/viewtopic.php?t=392666
* Rebuild RP1 firmware to reduce size.

.github/workflows/test.yml

@@ -0,0 +1,31 @@
+name: Test EEPROM Config
+
+on:
+  pull_request:
+    branches: [ 'master' ]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.x'
+          
+      - name: Create and activate virtual environment
+        run: |
+          python -m venv venv
+          source venv/bin/activate
+          
+      - name: Install dependencies
+        run: |
+          pip install pycryptodomex
+      
+      - name: Run EEPROM Config Tests
+        run: |
+          cd test
+          chmod +x test-rpi-eeprom-config
+          ./test-rpi-eeprom-config 

firmware-2711/release-notes.md

@@ -1,5 +1,213 @@
 # Raspberry Pi4 bootloader EEPROM release notes
 
+## 2025-11-09: Promote 2025-11-05 to the default release (default)
+
+## 2025-11-05: Add iommu_dma_numa_policy=interleave when needed (latest)
+
+* arm_loader: Add iommu_dma_numa_policy=interleave when needed
+  This applies a similar numa interleave for iommu dma kernel allocations.
+  This includes buffers allocated for hevc and v3d.
+  See: https://forums.raspberrypi.com/viewtopic.php?t=392666
+
+## 2025-10-14: recovery: Use ROM boot-mode to detect rpiboot (latest)
+
+* recovery: Use ROM boot-mode flag to detect rpiboot mode
+  In recovery-mode use the bootrom register flag to detect the
+  original boot-mode rather than looking at whether the rpiboot
+  usb-device boot driver is initialised.
+* Manufacturing test updates.
+
+## 2025-10-08: Fix accidental set of PM_RSTS bit 5 when stopping watchdog (latest)
+
+* Fix accidental set of PM_RSTS bit 5 when stopping watchdog
+  Fix an issue in the watchdog code where the raw PM_RSTS value
+  was used as partition number. If HADWRF (bit 5) was set (on reboot)
+  this could cause bit 10 to be set. If an OS didn't clear the partition
+  flags on reboot then this could end up being treated as request to
+  boot from partition 32.
+
+## 2025-10-03: arm_dt: Report OTP SDRAM size via device-tree (latest)
+
+* arm_dt: Report OTP SDRAM size via device-tree
+  Report the SDRAM in gigabits via device-tree as
+  /proc/device-tree/chosen/rpi-sdram-size-gbit. Scripts reporting the
+  device-capabilities should use this value (if defined) instead of the
+  memory-size field in the boardrev row.
+* Apply UART_BAUD in early bootsys UART init
+  Update bootsys and fatal error handlers to use the user
+  defined UART_BAUD rate.
+* rpifwcrypto: Add support for ECDSA P-256 key generation
+  Also, slightly improve the entropy by passing the system
+  timer value as the personality string.
+
+## 2025-09-23: Fix network install regression on Pi4 (latest)
+
+* Fix network install regression on Pi4
+  Fix an issue with the ECDSA signature code which caused network
+  install to fail to load on Pi4.
+* Fix TFTP to allow larger files
+  Allow TFTP block counter to rollover to 0.
+  See: https://github.com/raspberrypi/rpi-eeprom/issues/720
+
+## 2025-09-22: Add LZ4 decompressor (latest)
+
+* Add LZ4 decompressor
+  LZ4 gives a better compression ratio than the previously used CK compress. The bootloader can now decompress both LZ4 compressed files and CK compressed files.
+* rpifwcrypto: Add GET_CRYPTO_PRIVATE_KEY mailbox API
+  For provisioning, add a new mailbox API which returns the private key
+  in DER format. The API will return an error if the key-status for
+  the specified key is LOCKED.
+* config: Add support for board_attributes in conditional expressions
+  Add support for the board-attributes row in config.txt conditional
+  expressions. This can be used to change boot behavior for
+  Compute Module Lite / No-WiFi etc.
+* board_info: Log the OTP board revision at startup
+  Log the board revision plus the raw OTP value at startup.
+
+## 2025-08-27: Fix PARTITION property to allow default (0) partition to be overridden (latest)
+
+* Fix PARTITION property to allow default (0) partition to be overridden
+  Fix the partition selection to allow the bootloader PARTITION
+  property to override the reboot partition number if the reboot
+  argument is 0 or > 31. Previously, it was only allowing
+  partition numbers > 31 to be overridden.
+  See: https://github.com/raspberrypi/rpi-eeprom/issues/743
+* Enable RPIBOOT in BOOT_ORDER / set-reboot-order
+  Previously, rpiboot required the bootrom to have initialised
+  rpiboot before running the firmware. Update the rpiboot
+  initialisation so that rpiboot to be enabled after booting from
+  SPI flash.
+  This could be selectively enabled by setting BOOT_ORDER property
+  (0x3) behind a GPIO conditional in the EEPROM config. On Pi5, the
+  set_reboot_order config.txt option or mailbox property can be
+  used to set a one-time boot-order on
+  N.B. There is no timeout for RPIBOOT so this should only be set
+  as the last boot mode OR used with a boot_watchdog.
+
+## 2025-08-20: Fix PARTITION_WALK for missing start.elf files (latest)
+
+* Fix PARTITION_WALK for missing start.elf files
+  Fix a missing call to bootloader_reset_state so that PARTITION_WALK
+  will work if the boot-partition is FAT, contains config.txt etc
+  but does not have valid firmware.
+  See: https://github.com/raspberrypi/rpi-eeprom/issues/738
+* force_eeprom_read=0 disables HAT I2C
+  Although setting force_eeprom_read=0 has always prevented the HAT EEPROM
+  from being read, with the recent changes to support Power HAT+s it does
+  not prevent an early scan to see if such an EEPROM exists. This can be
+  problematic for applications where the I2C0 pins have been repurposed.
+  Change the inhibit logic to cut all HAT I2C probing off at the knees,
+  including any automatic settings of usb_max_current_enable, as it should
+  always have done.
+  See: https://github.com/raspberrypi/firmware/issues/1985
+* bootcode.bin: Add support for boot.img ramdisk on Pi3 and earlier
+  Add support for boot.img ramdisk support, enable by adding boot_ramdisk=1
+  in config.txt
+* rpifwcrypto: Preliminary firmware support for rpifwcrypto API
+* Add config.txt to block GET_CUSTOMER_PRIVATE_KEY mailbox API
+  lock_device_private_key=1
+
+## 2025-08-13: Enable PARTITION_WALK property by default (latest)
+
+* Enable the PARTITION_WALK property by default
+  Previously, the new PARTITION_WALK which searches for bootable
+  partitions after a failure had to be explicitly enabled. Change
+  the default to be enabled by default. It can be switched off by
+  setting PARTITION_WALK=0 in the EEPROM config.
+* Optimise bootmain for size on Pi4
+  Pi4 only has a 512KB SPI flash EEPROM and the addition of features
+  plus fixes is now causing contention for space between the code and
+  the EEPROM config. Since bootmain is only responsible for loading
+  start.elf revert to the original configuration which is optimised
+  for size rather than speed. Pi5 continues to be optimised for speed.
+
+## 2025-07-17: arm_loader: Also require the early-watchdog property (latest)
+
+* arm_loader: Also require the early-watchdog property
+  The change correcting the implementation of dtoverlay_is_enabled had the
+  unintended consequence of causing the firmware to enable the watchdog
+  even though the user had not explicitly requested it. This is harmless
+  on Linux because the watchdog driver takes over and disarms it, but on
+  other operating systems this can lead to a reboot. Avoid this problem
+  by also requiring the presence of a new property, "early-watchdog".
+  See: https://github.com/raspberrypi/firmware/issues/1980
+* helpers/config_loader: Add bootvar0 eeprom config that can be used in config.txt section expressions
+  This allows an eeprom config setting (e.g. BOOTVAR0=0x10) to be set on a board
+  which config.txt can use as a conditional expression (e.g. [bootvar0&0x10]).
+* arm_loader: Fix boot-watchdog stop on Pi4
+  Fix a problem where the boot_watchdog heartbeat timer was not
+  stopped correctly which could cause it to clash with the kernel
+  watchdog driver.
+
+## 2025-07-03: Check for SD card overcurrent (latest)
+
+* board_info: Use the Ethernet PHY address probed by the bootloader
+  Use the Ethernet PHY address supplied by the bootloader in
+  preference to the static configurations defined in start4.elf
+* Check for SD card overcurrent on Pi5, Pi500 and Pi4
+  Before booting, the bootloader now checks the SD power switch
+  overcurrent signal. The overcurrent signal occurs if the SD
+  card is damaged and has a short circuit which will cause it to
+  get hot.
+  If an over-current condition is detected the bootloader switches
+  switches off power to the SD card and waits five seconds before
+  probing the SD card again. This error is displayed on the
+  diagnostic screen, the UART and the activity LED (1 long, 2 short)
+  flashes.
+  The check can be switched to a non-blocking warning  by setting
+  SD_OVERCURRENT_CHECK=0 in the bootloader config.
+* Add a new error code pattern for SD overcurrent
+  Add a new error pattern (1 long, 2 short) to signal SD card
+  overcurrent.
+* Add support for a bootloader watchdog
+  Add support for a boot watchdog (using PM_RSTC hw wdog) which will
+  trigger if the OS is not started within the specified amount of time. The
+  watchdog is enabled by setting the BOOT_WATCHDOG_TIMEOUT=N (seconds)
+  property in the bootlaoder config.
+  The BOOT_WATCHDOG_PARTITION=P property can be set to pass a different
+  partition number to the bootloader on reset if the watchdog
+  is triggered.
+  The boot watchdog is automatically cleared just before starting
+  the OS and (optionally) enabling the kernel watchdog.
+* Skip first SD boot if no card detected
+  On platforms with an SD Card detect signal, skip the first attempt to
+  boot from SD if the card appears to be absent. This can save over a
+  second on a cold boot, and a little under a second for a reboot.
+
+## 2025-05-16: 2711: Automatically set revoke_devkey if program_pubkey=1 (latest)
+
+* 2711: (recovery) Automatically set revoke_devkey if program_pubkey=1
+  Previously, on BCM2711 products it was possible to program the key
+  hash without revoking the development key. This can be useful for
+  testing but should never be used in production because it is possible
+  to an install an older version of the bootloader which doesn't
+  support secure-boot.  Since the secure-boot tools are stable and
+  have improved usability (RPi secure-boot provisioner) this test
+  feature not necessary and is just a security risk so the behaviour
+  is changed to always revoke the development key if program_pubkey=1.
+  This change is not relevant on BCM2712 because secure-boot requires
+  that the second stage bootloader is counter-signed with the customer's
+  private key.
+
+## 2025-05-13: Promote 2025-05-08 to the default release (default) (automatic)
+
+## 2025-05-08: Implement TCP window for net boot (latest)
+* Signed boot and HTTP boot mode
+  HTTP boot mode is supposed to be disabled if signed boot is enabled and
+  a host is not specified. The code is checking the http_secure flag to
+  enforce this. But this is valid now we support custom CA certs.
+  Only disable HTTP mode if we're using the default HOST.
+* Implement TCP window for net boot
+  The minimal IP stack used for https booting lacks the ability to cache
+  packets received out of order, which can lead to severe slowdown when
+  it happens. The problem seems to affect some ISPs more than others.
+  The receive window implemented here copes with packet losses of 10%.
+* netboot: Correct the TCP MSS
+* Correct msecs in debug timestamps
+  The fractional part of timestamps in UART debug output was showing the
+  100ths and 1000ths of a second, rather than 10ths and 100ths, causing
+  strange sequences that appear to jump backwards.
+
 ## 2025-02-17: Promote 2025-02-11 to default release (default)
 
 ## 2025-02-11: recovery: Walk partitions to delete recovery.bin (latest)

firmware-2712/release-notes.md

@@ -1,5 +1,295 @@
 # Raspberry Pi5 bootloader EEPROM release notes
 
+## 2025-11-09: Promote 2025-11-05 to the default release (default)
+
+## 2025-11-05: arm_loader: Add iommu_dma_numa_policy=interleave when needed (latest)
+
+* arm_loader: Add iommu_dma_numa_policy=interleave when needed
+  This applies a similar numa interleave for iommu dma kernel allocations.
+  This includes buffers allocated for hevc and v3d.
+  See: https://forums.raspberrypi.com/viewtopic.php?t=392666
+* Rebuild RP1 firmware to reduce size.
+
+## 2025-10-17: Enable background refresh on 2712d0 for all SDRAM sizes (latest)
+
+* 2712d0: Enable background refresh on 2712d0 for all SDRAM sizes
+  This provides a minor performance benefit.
+* Update GPT to support 4K native sectors
+  Bootloader logic updated to correctly interpret the GPT layout format specific to 4K native sector drives.
+* recovery: Use ROM boot-mode flag to detect rpiboot mode
+  In recovery-mode use the bootrom register flag to detect the
+  original boot-mode rather than looking at whether the rpiboot
+  usb-device boot driver is initialised.
+
+## 2025-10-08: Fix accidental set of PM_RSTS bit 5 when stopping watchdog (latest)
+
+* Fix accidental set of PM_RSTS bit 5 when stopping watchdog
+  Fix an issue in the watchdog code where the raw PM_RSTS value
+  was used as partition number. If HADWRF (bit 5) was set (on reboot)
+  this could cause bit 10 to be set. If an OS didn't clear the partition
+  flags on reboot then this could end up being treated as request to
+  boot from partition 32.
+* pi5: Preliminary support for 4K native sectors with NVMe drives
+  Pi5 now supports 4K native sector NVMe drives. 
+  This allows booting from drives with logical block size 4096, 
+  while 512B drives remain compatible. With 4K sectors, storage density 
+  increases along with improved reliability and efficiency.
+  N.B. USB boot still requires a 512 byte sector size and there are
+  no RPi OS disk images with a 4K sector format.
+  See: https://github.com/raspberrypi/rpi-eeprom/issues/577
+* arm_dt: Report OTP SDRAM size via device-tree
+  Report the SDRAM in gigabits via device-tree as
+  /proc/device-tree/chosen/rpi-sdram-size-gbit. Scripts reporting the
+  device-capabilities should use this value (if defined) instead of the
+  memory-size field in the boardrev row.
+
+## 2025-09-25: Apply UART_BAUD in early bootsys UART init (latest)
+
+* Apply UART_BAUD in early bootsys UART init
+  Update bootsys and fatal error handlers to use the user
+  defined UART_BAUD rate.
+* rpifwcrypto: Add support for ECDSA P-256 key generation
+
+## 2025-09-23: Fix TFTP to allow larger files (latest)
+
+* Fix TFTP to allow larger files
+  Allow TFTP block counter to rollover to 0.
+  See: https://github.com/raspberrypi/rpi-eeprom/issues/720
+
+## 2025-09-22: Add LZ4 decompressor (latest)
+
+* Add LZ4 decompressor
+  LZ4 gives a better compression ratio than the previously used CK compress. The bootloader can now decompress both LZ4 compressed files and CK compressed files.
+* rpifwcrypto: Add GET_CRYPTO_PRIVATE_KEY mailbox API
+  For provisioning, add a new mailbox API which returns the private key
+  in DER format. The API will return an error if the key-status for
+  the specified key is LOCKED.
+* config: Add support for board_attributes in conditional expressions
+  Add support for the board-attributes row in config.txt conditional
+  expressions. This can be used to change boot behavior for
+  Compute Module Lite / No-WiFi etc.
+* board_info: Log the OTP board revision at startup
+  Log the board revision plus the raw OTP value at startup.
+
+## 2025-08-27: Fix PARTITION property to allow default (0) partition to be overridden (latest)
+
+* Fix PARTITION property to allow default (0) partition to be overridden
+  Fix the partition selection to allow the bootloader PARTITION
+  property to override the reboot partition number if the reboot
+  argument is 0 or > 31. Previously, it was only allowing
+  partition numbers > 31 to be overridden.
+  See: https://github.com/raspberrypi/rpi-eeprom/issues/743
+* Enable RPIBOOT in BOOT_ORDER / set-reboot-order
+  Previously, rpiboot required the bootrom to have initialised
+  rpiboot before running the firmware. Update the rpiboot
+  initialisation so that rpiboot to be enabled after booting from
+  SPI flash.
+  This could be selectively enabled by setting BOOT_ORDER property
+  (0x3) behind a GPIO conditional in the EEPROM config. On Pi5, the
+  set_reboot_order config.txt option or mailbox property can be
+  used to set a one-time boot-order on
+  N.B. There is no timeout for RPIBOOT so this should only be set
+  as the last boot mode OR used with a boot_watchdog.
+
+## 2025-08-20: force_eeprom_read=0 disables HAT I2C (latest)
+
+* force_eeprom_read=0 disables HAT I2C
+  Although setting force_eeprom_read=0 has always prevented the HAT EEPROM
+  from being read, with the recent changes to support Power HAT+s it does
+  not prevent an early scan to see if such an EEPROM exists. This can be
+  problematic for applications where the I2C0 pins have been repurposed.
+  Change the inhibit logic to cut all HAT I2C probing off at the knees,
+  including any automatic settings of usb_max_current_enable, as it should
+  always have done.
+  See: https://github.com/raspberrypi/firmware/issues/1985
+* rpifwcrypto: Preliminary firmware support for rpifwcrypto API
+* Add config.txt to block GET_CUSTOMER_PRIVATE_KEY mailbox API lock_device_private_key=1
+
+## 2025-08-13: Enable the PARTITION_WALK property by default (latest)
+
+* Enable the PARTITION_WALK property by default
+  Previously, the new PARTITION_WALK which searches for bootable
+  partitions after a failure had to be explicitly enabled. Change
+  the default to be enabled by default. It can be switched off by
+  setting PARTITION_WALK=0 in the EEPROM config.
+* pi5: Fix read for cached copy of PMIC sequencer status
+  Previously, this was overwritten by the RTC event status.
+
+## 2025-07-17: Fix config key search which could cause camera_autodetect to fail (latest)
+
+* Fix config key search which could cause camera_autodetect to fail
+  The bootvar0 config property was added in the wrong section which
+  could cause the config property search for some other properties
+  to fail.
+
+## 2025-07-17: arm_loader: Also require the early-watchdog property (latest)
+
+* arm_loader: Also require the early-watchdog property
+  The change correcting the implementation of dtoverlay_is_enabled had the
+  unintended consequence of causing the firmware to enable the watchdog
+  even though the user had not explicitly requested it. This is harmless
+  on Linux because the watchdog driver takes over and disarms it, but on
+  other operating systems this can lead to a reboot. Avoid this problem
+  by also requiring the presence of a new property, "early-watchdog".
+  See: https://github.com/raspberrypi/firmware/issues/1980
+* helpers/config_loader: Add bootvar0 eeprom config that can be used in config.txt section expressions
+  This allows an eeprom config setting (e.g. BOOTVAR0=0x10) to be set on a board
+  which config.txt can use as a conditional expression (e.g. [bootvar0&0x10]).
+* arm_loader: Fix boot-watchdog stop on Pi4
+  Fix a problem where the boot_watchdog heartbeat timer was not
+  stopped correctly which could cause it to clash with the kernel
+  watchdog driver.
+
+## 2025-07-03: Enable firmware UART output on the 40-pin header (latest)
+
+* rp1_uart: Allow rp1_uart to be started earlier
+  If enabled (with enable_rp1_uart) then the existing boot uart
+  messages are redirected to the rp1 uart.
+
+## 2025-06-29: Check for SD card overcurrent on Pi5 and Pi500 (latest)
+
+* board_info: Use the Ethernet PHY address probed by the bootloader
+  Use the Ethernet PHY address supplied by the bootloader in
+  preference to the static configurations defined in start4.elf
+* pi5: Fix overwrite of cache EEPROM config in secure-boot mode
+  See: https://github.com/raspberrypi/rpi-eeprom/issues/719
+* Check for SD card overcurrent on Pi5, Pi500 and Pi4
+  Before booting, the bootloader now checks the SD power switch
+  overcurrent signal. The overcurrent signal occurs if the SD
+  card is damaged and has a short circuit which will cause it to
+  get hot.
+  If an over-current condition is detected the bootloader 
+  switches off power to the SD card and waits five seconds before
+  probing the SD card again. This error is displayed on the
+  diagnostic screen, the UART and the activity LED (1 long, 2 short)
+  flashes.
+  The check can be switched to a non-blocking warning  by setting
+  SD_OVERCURRENT_CHECK=0 in the bootloader config.
+* Add a new error code pattern for SD overcurrent
+  Add a new error pattern (1 long, 2 short) to signal SD card
+  overcurrent.
+* Enable RTC wakeup from POWER_OFF_ON_HALT=0
+* Improve HAT+ current handling
+  In shipping firmware, the current_supply value is only being used in the
+  case of a normal (non-stacked) HAT+, but that is unnecessarily
+  restrictive. Also, the presence of MODE0 and MODE1 power HATs is not
+  reflected in the value of max_current.
+  See: https://github.com/raspberrypi/linux/pull/6678
+
+## 2025-06-20: Add support for a bootloader watchdog (latest)
+
+* Add support for a bootloader watchdog
+  Add support for a boot watchdog (using PM_RSTC hw wdog) which will
+  trigger if the OS is not started within the specified amount of time. The
+  watchdog is enabled by setting the BOOT_WATCHDOG_TIMEOUT=N (seconds)
+  property in the bootlaoder config.
+  The BOOT_WATCHDOG_PARTITION=P property can be set to pass a different
+  partition number to the bootloader on reset if the watchdog
+  is triggered.
+  The boot watchdog is automatically cleared just before starting
+  the OS and (optionally) enabling the kernel watchdog.
+* pi5: Add a temperature monitor
+  In early releases of the bootloader the fan would always be on
+  during boot which can be distracting. Later releases switch off the
+  fan until the OS has booted.
+  This change adds some basic fan control from the bootloader to
+  enable the fan if the temperature is above 85C.
+  This may be useful if the Pi was shutdown by the OS because the
+  temperature limit was exceeded.
+  Since the Linux hwmon is not active at this stage the bootloader
+  now implements the same logic to power off the Pi if the chips
+  is more than 110C.
+  The PMIC hardware automatically cuts power if the temperature
+  is more than 125C.
+* Skip first SD boot if no card detected
+  On platforms with an SD Card detect signal, skip the first attempt to
+  boot from SD if the card appears to be absent. This can save over a
+  second on a cold boot, and a little under a second for a reboot.
+
+## 2025-06-13: Update to include production test changes (latest)
+* Update to include production test changes.
+
+## 2025-06-09: NVMe: Fix loading of files > 32MB (latest)
+
+* NVMe: Fix loading of files > 32MB
+  Fix an NVMe boot bug which caused large contiguous reads >= 32MB to fail.
+* Update setting alpha for 2712D0
+  D0 moved the alpha blend mode from CTL2 to CTL0.
+  Update the bootloader code to follow suit for those using
+  the simple framebuffer
+* dtoverlay: Fix node_is_enabled for implicit status
+  The absence of a status property implies that a node is enabled. Update
+  dtoverlay_node_is_enabled to match that behaviour.
+  See: https://github.com/raspberrypi/firmware/issues/1970
+* arm_loader: GET_CLOCKS: Set useful response length
+  The kernel's firmware mailbox API does not make the actual length of the
+  response available to clients, but other implementations may care.
+  Continue to pad the GET_CLOCKS buffer with zeroes, but set the response
+  length to minimally contain the useful content.
+  See: https://github.com/raspberrypi/firmware/issues/1969
+
+## 2025-05-13: Promote 2025-05-08 to the default release (default)
+
+## 2025-05-08: Implement TCP window for net boot (latest)
+
+* arm_loader: Correct some mailbox response lengths
+  The GET_GENCMD_RESULT mailbox handler was setting the wrong response
+  length, and GET_FIRMWARE_COMMIT_HASH and GET_FIRMWARE_VARIANT were not
+  setting any length.
+  See: https://github.com/raspberrypi/firmware/issues/1968
+* Signed boot and HTTP boot mode
+  HTTP boot mode is supposed to be disabled if signed boot is enabled and
+  a host is not specified. The code is checking the http_secure flag to
+  enforce this. But this is valid now we support custom CA certs.
+  Only disable HTTP mode if we're using the default HOST.
+* Implement TCP window for net boot
+  The minimal IP stack used for https booting lacks the ability to cache
+  packets received out of order, which can lead to severe slowdown when
+  it happens. The problem seems to affect some ISPs more than others.
+  The receive window implemented here copes with packet losses of 10%.
+* netboot: Correct the TCP MSS
+* rp1_net: Overwrite the length field
+  Although concise, ORing in the packet length runs the risk of leaving
+  some unwanted bits set. Ensure the length field is cleared before
+  ORing in the required value.
+* Correct msecs in debug timestamps
+  The fractional part of timestamps in UART debug output was showing the
+  100ths and 1000ths of a second, rather than 10ths and 100ths, causing
+  strange sequences that appear to jump backwards.
+* Implement GET_BOARD_MAC_ADDRESS on Pi5
+  The Pi 5 EEPROM implements a subset of the original mailbox properties.
+  Add GET_BOARD_MAC_ADDRESS to the subset.
+  See: https://github.com/raspberrypi/rpi-eeprom/issues/698
+* Ensure the initramfs matches the kernel
+  As far as is possible, both the kernel and initramfs are matched to the
+  device. However, where multiple kernel variants can run on a device, the
+  initramfs must be matched to the chosen kernel. Make that the sole rule
+  for initramfs selection, rather than duplicating the device matching
+  logic.
+  See: https://github.com/raspberrypi/firmware/issues/1965
+* Enable logging messages from OS loader
+  Pi 5 EEPROM builds were missing the output from the main OS loading
+  function, including some important diagnostics. Enabling the logging
+  output from this loader code results in some near-duplicates, but is
+  more user friendly and is available via "sudo vclog -m".
+
+## 2025-04-07: arm_dt: Revert to using the max fan speed (latest)
+
+* arm_dt: Revert to using the max fan speed
+  It has been reported that the presence of a cooling fan at boot time
+  can lead to a maximum observed fan speed of ~300 but a current speed
+  of 0. The absence of a fan results in 0s for both metrics.
+  See: https://github.com/raspberrypi/rpi-eeprom/issues/690
+
+## 2025-03-27: os_check: cm5: Check for CM5 specific dtbs (latest)
+
+* os_check: cm5: Check for CM5 specific dtbs
+  Check for BCM2712 support in bcm2712-rpi-cm5-cm5io.dtb
+  or bcm2712-rpi-cm5l-cm5io.dtb on CM5 instead of bcm2712-rpi-5-b.dtb.
+  This avoids needing to put os_check=1 or specifying device_tree
+  in config.txt in minimal images for CM5.
+  See: https://github.com/raspberrypi/rpi-eeprom/issues/682
+
 ## 2025-03-19: Log the fan speed at boot (latest)
 
 * Log the fan speed at boot

imager/make-imager-release

@@ -5,7 +5,7 @@ set -e
 script_dir=$(cd "$(dirname "$0")" && pwd)
 
 # Pi4, Pi400, CM4, CM4-S
-${script_dir}/make-release critical 2025-02-11 000138c0 "${script_dir}/2711-config" release-2711 rpi-boot-eeprom-recovery 2711
+${script_dir}/make-release critical 2025-11-05 000138c0 "${script_dir}/2711-config" release-2711 rpi-boot-eeprom-recovery 2711
 
 # Pi5
-${script_dir}/make-release critical 2025-02-12 "" "${script_dir}/2712-config" release-2712 rpi-boot-eeprom-recovery 2712
+${script_dir}/make-release critical 2025-11-05 "" "${script_dir}/2712-config" release-2712 rpi-boot-eeprom-recovery 2712

imager/net_install_pubkey.pem

@@ -0,0 +1,9 @@
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAno9f6RGBaf2yaWTwf8+y
+MO4snzEgLOr8L3S28PZBdyx2qqNrzZ+xUOfLNYI5CwvBgOyKtm5L+wJIR8NUqgBl
+tvtBMAy2Auh0Qe679vN6UnsWE/o3pCgFPdmH+EcKfPqNBYODgfL+eumGM9Lo2dnl
+6P3JBR4Uy2E171k4D9Pj5rhO2K4jySYwbTuFR/drB2nDBrrsUW+SArnkTLvEGLY1
+nONW+AIBaqBxb+wjD/TMvVdsCWNXabcRqYM9DDgVzGePKuQdX5aBdgDnlbtDodyq
+FnLcRjqGE7nSQBQILwmGl5EvHMGa8d3/aLE6eXmMCakXyF1HPRv2lOecxNMO3xTF
+zwIDAQAB
+-----END PUBLIC KEY-----

releases.md

@@ -14,5 +14,6 @@ For support or hardware interoperability discussions please use the Raspberry Pi
 ## Old EEPROM images
 Old bootloader images are periodically removed from the APT package to reduce the disk space but are still available via Github 
 * Old [BCM2711 releases](https://github.com/raspberrypi/rpi-eeprom/tree/master/firmware-2711/old).
+* Old [BCM2712 releases](https://github.com/raspberrypi/rpi-eeprom/tree/master/firmware-2712/old).
 
 **Old releases may fail to boot on newer hardware revisions.**

rpi-eeprom-config

@@ -346,7 +346,7 @@ class BootloaderImage(object):
             update_len = len(src_bytes) + FILE_HDR_LEN
 
             if hdr_offset + update_len > self._image_size - ERASE_ALIGN_SIZE:
-                raise Exception('No space available - image past EOF.')
+                raise Exception('No space available. %s size %d available space %d' % (dst_filename, update_len, self._image_size - ERASE_ALIGN_SIZE - hdr_offset))
 
             if hdr_offset < 0:
                 raise Exception('Update target %s not found' % dst_filename)

rpi-eeprom-digest

@@ -6,8 +6,12 @@
 # a hard dependency on OpenSSL.
 
 set -e
+set -u
 
 OPENSSL=${OPENSSL:-openssl}
+KEY=""
+SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH:-""}
+HSM_WRAPPER=""
 
 die() {
    echo "$@" >&2
@@ -46,29 +50,30 @@ RSA signature. Typically this tool is used by rpi-eeprom-update to
 generate a hash to guard against file-system corruption for EEPROM updates
 OR for signing OS images (boot.img) for secure-boot.
 
-This tool CANNOT be used directly to sign an bootloader EEPROM image
-for secure-boot because the signed data is bootloader configuration file
+This tool CANNOT be used directly to sign a bootloader EEPROM image
+for secure-boot because the signed data is the bootloader configuration file
 rather than the entire flash image.
-To create signed bootloader images please see
+To create signed bootloader images, please see
 https://github.com/raspberrypi/usbboot/tree/master/secure-boot-recovery/README.md
 
 
 Options:
-   -i The source image e.g. boot.img
-   -o The name of the digest/signature file.
-   -k Optional RSA private key.
+   -i The source image, e.g., boot.img
+   -o The name of the digest/signature file
+   -k Optional RSA private key
+   -H The name of the HSM wrapper script to invoke - default ""
 
-RSA signing
-If a private key in PEM format or a pkcs#11 URI is supplied then the
-RSA signature of the sha256 digest is included in the .sig
-file. Currently, the bootloader only supports sha256 digests signed
-with a 2048bit RSA key.  The bootloader only verifies RSA signatures
+RSA signing:
+If a private key in PEM format or a PKCS#11 URI is supplied, then the
+RSA signature of the SHA256 digest is included in the .sig
+file. Currently, the bootloader only supports SHA256 digests signed
+with a 2048-bit RSA key. The bootloader only verifies RSA signatures
 in signed boot mode and only for the EEPROM config file and the signed
 image.
 
 Examples:
 
-# Generate the normal sha256 hash to guard against file-system corruption
+# Generate the normal SHA256 hash to guard against file-system corruption
 rpi-eeprom-digest -i pieeprom.bin -o pieeprom.sig
 rpi-eeprom-digest -i vl805.bin -o vl805.sig
 
@@ -77,9 +82,14 @@ rpi-eeprom-digest -k private.pem -i boot.img -o boot.sig
 
 # Generate RSA signature for the EEPROM config file
 # As used by update-pieeprom.sh in usbboot/secure-boot-recovery
-rpi-eeprom-digest -k private.pem -i bootconf.txt  -o bootconf.sig
+rpi-eeprom-digest -k private.pem -i bootconf.txt -o bootconf.sig
+
+# Generate RSA signature for the EEPROM config file and delegate 
+# the signing process to a HSM wrapper script instead of using the private key directly.
+rpi-eeprom-digest -H hsm-wrapper -i bootconf.txt -o bootconf.sig
 
 # Similarly, but specifying the key with a PKCS#11 URI
+# (Deprecated - use HSM wrapper instead)
 rpi-eeprom-digest -k pkcs11:token=deadbeef;object=bl-key;type=private;pin-value=1234 -i bootconf.txt  -o bootconf.sig
 
 # To verify the signature of an existing .sig file using the public key.
@@ -102,7 +112,9 @@ writeSig() {
        echo "ts: $(date -u +%s)" >> "${OUTPUT}"
    fi
 
-   if [ -n "${KEY}" ]; then
+   if [ -n "${HSM_WRAPPER}" ]; then
+      echo "rsa2048: $("${HSM_WRAPPER}" -a rsa2048-sha256 "${IMAGE}")" >> "${OUTPUT}"
+   elif [ -n "${KEY}" ]; then
       "${OPENSSL}" dgst ${ENGINE_OPTS} -sign "${KEY}" -sha256 -out "${SIG_TMP}" "${IMAGE}"
       echo "rsa2048: $(xxd -c 4096 -p < "${SIG_TMP}")" >> "${OUTPUT}"
    fi
@@ -115,18 +127,20 @@ verifySig() {
    sig_hex="$(grep rsa2048 "${sig_file}" | cut -f 2 -d ' ')"
    [ -n "${sig_hex}" ] || die "No RSA signature in ${sig_file}"
 
-   echo ${sig_hex} | xxd -c 4096 -p -r > "${TMP_DIR}/sig.bin"
+   echo "${sig_hex}" | xxd -c 4096 -p -r > "${TMP_DIR}/sig.bin"
    "${OPENSSL}" dgst ${ENGINE_OPTS} -verify "${KEY}" -signature "${TMP_DIR}/sig.bin" "${IMAGE}" || die "${IMAGE} not verified"
 }
 
 OUTPUT=""
 VERIFY=0
-while getopts i:k:ho:v: option; do
+while getopts i:H:k:ho:v: option; do
    case "${option}" in
    i) IMAGE="${OPTARG}"
       ;;
    k) KEY="${OPTARG}"
       ;;
+   H) HSM_WRAPPER="${OPTARG}"
+      ;;
    o) OUTPUT="${OPTARG}"
       ;;
    v) SIGNATURE="${OPTARG}"

rpi-eeprom-update

@@ -424,13 +424,13 @@ checkDependencies() {
    if [ $(((0x$BOARD_INFO >> 12) & 15)) = 3 ]; then
       BCM_CHIP=2711
       EEPROM_SIZE=524288
-      BOOTLOADER_AUTO_UPDATE_MIN_VERSION="${BOOTLOADER_AUTO_UPDATE_MIN_VERSION:-1599135103}"
+      BOOTLOADER_AUTO_UPDATE_MIN_VERSION="${BOOTLOADER_AUTO_UPDATE_MIN_VERSION:-1746717695}"
 
       SPIDEV=/dev/spidev0.0
    elif [ $(((0x$BOARD_INFO >> 12) & 15)) = 4 ]; then
       BCM_CHIP=2712
       EEPROM_SIZE=2097152
-      BOOTLOADER_AUTO_UPDATE_MIN_VERSION="${BOOTLOADER_AUTO_UPDATE_MIN_VERSION:-1725975630}"
+      BOOTLOADER_AUTO_UPDATE_MIN_VERSION="${BOOTLOADER_AUTO_UPDATE_MIN_VERSION:-1746713597}"
       SPIDEV=/dev/spidev10.0
       # Default is to use flashrom if availableon BCM2712
       RPI_EEPROM_USE_FLASHROM=${RPI_EEPROM_USE_FLASHROM:-1}

test/README.md

@@ -0,0 +1,14 @@
+# rpi-eeprom - unit tests
+
+## test-rpi-eeprom-config
+Unit test for rpi-eeprom-config which verifies:
+
+* rpi-eeprom-config is compatible with all EEPROM binaries
+* unit tests for modifying the boot.conf file
+* simple code signing test
+
+To run on Linux:
+```
+cd test
+./test-rpi-eeprom-config
+```

tools/rpi-otp-private-key

@@ -18,7 +18,8 @@ usage() {
     cat <<EOF
    $(basename "$0") [-cfwy] <key>
 
-   No args - reads the current private key from OTP. These values are NOT visible via 'vcgencmd otp_dump'.
+   No args - reads the current device unique private key from OTP.
+   *These values are NOT visible via 'vcgencmd otp_dump'*
 
    -b Output the key in binary format.
    -c Reads key and exits with 1 if it is all zeros i.e. not set.
@@ -30,11 +31,31 @@ usage() {
    -l Specify key length in words. Defaults to 8 words (32 bytes). Pi 5 supports up to 16 words (64 bytes).
    -o word Offset into the keystore to use, e.g. 0-7 for Pi 4, 0-15 for Pi 5. Defaults to zero.
 
-   <key> is usually a 64 digit hex number (256 bit) e.g. to generate a 256 random number run 'openssl rand -hex 32'
+   <key> is usually a 64 digit hex number (256 bit)
 
-   IMPORTANT: Raspberry Pi 5 and earlier revisions do not have a hardware secure key store. These OTP rows are visible
-   to any user in the 'video' group via vcmailbox. Therefore this functionality is only suitable for key
-   storage if the OS has already been restricted using the signed boot functionality.
+   Key generation:
+   The Raspberry Pi firmware cryptography services requires that the device unique private key is
+   a valid ECDSA with P-256 curve key. Due to limited OTP space only the raw private key component (d)
+   is stored in OTP.
+
+   Example key generation and provisioning:
+
+   # Generate the new private-key - remember to save this to a secure, off-device location!
+   openssl ecparam -name prime256v1 -genkey -noout -out private_key.pem
+
+   # Extract raw the private key component
+   openssl ec -in private_key.pem -text -noout | awk '/priv:/{flag=1; next} /pub:/{flag=0} flag' | tr -d ' \n:' | head -n1 > d.hex
+
+   # Write the key to OTP
+   rpi-otp-private-key -w \$(cat d.hex)
+
+   IMPORTANT: Raspberry Pi 5 and earlier revisions do not have a hardware secure key store
+   so the raw OTP values are potentially readable by processes with root-privileges.
+
+   In newer firmware releases, the mailbox APIs used by this script to read the OTP can
+   be disabled by setting lock_device_private_key=1 in config.txt.
+   On Pi4 or newer, if secure-boot is enabled, then this parameter cannot be
+   tampered with because config.txt is stored within the signed boot.img.
 
    WARNING: Changes to OTP memory are permanent and cannot be undone.
 EOF
@@ -134,7 +155,8 @@ if [ $(((0x$BOARD_INFO >> 12) & 15)) = 3 ]; then
 elif [ $(((0x$BOARD_INFO >> 12) & 15)) = 4 ]; then
     MAX_ROW_COUNT=16
 else
-    die "Chip not supported"
+    echo "WARNING: Secure-boot is only supported on Pi4 and newer models"
+    MAX_ROW_COUNT=8
 fi
 if [ -z "$ROW_COUNT" ] || [ "$ROW_COUNT" -ne "$ROW_COUNT" ] 2>/dev/null; then
     die "Key length not a number"

tools/rpi-sign-bootcode

@@ -2,8 +2,11 @@
 
 import argparse
 import base64
+import os
 import struct
+import subprocess
 import sys
+import tempfile
 
 # python3 -m pip install pycryptodomex
 from Cryptodome.Hash import HMAC, SHA1, SHA256
@@ -105,6 +108,30 @@ class ImageFile:
         debug("%08x %20s: [%6d] %s" % (self.pos(), 'RSA', len(arr), pem_file))
         self.append(arr)
 
+        h = SHA256.new()
+        h.update(key.n.to_bytes(256, byteorder='little'))
+        h.update(key.e.to_bytes(8, byteorder='little'))
+        d = h.hexdigest()
+        pub_str = ""
+        for i in range(int(len(d)/8)):
+           pub_str += "0x%s%s%s%s, " % (d[i*8+6:i*8+8], d[i*8+4:i*8+6], d[i*8+2:i*8+4], d[i*8+0:i*8+2])
+        debug("Public key SHA256(N,e) = %s" % pub_str)
+
+    def append_rsa_signature_pkcs11(self, hsm_wrapper):
+        temp = tempfile.NamedTemporaryFile(delete=False)
+        temp.write(self._bytes)
+        temp.close() # close and flush before spawning PKCS#11 wrapper
+
+        res = subprocess.run([hsm_wrapper, "-a", "rsa2048-sha256", temp.name], capture_output=True)
+        debug(res.stderr)
+        if res.returncode != 0:
+            os.unlink(temp.name)
+            raise Exception(f"HSM wrapper failed with exit code {res.returncode}: {res.stderr.decode()}")
+        signature = res.stdout.decode()
+        os.unlink(temp.name)
+        self.append(bytearray.fromhex(signature))
+        debug("PKCS11 %08x %20s: [%6d] signature %s" % (self.pos(), 'RSA2048 - SHA256', len(signature), signature))
+
     def append_rsa_signature(self, digest_alg, private_pem):
         """
         Append a RSA 2048 signature of the SHA256 of the data so far
@@ -132,19 +159,13 @@ class ImageFile:
             if len(hmac_key) != expected_keylen:
                 raise Exception("Bad key length %d expected %d" % (len(hmac_key), expected_keylen))
 
-        if digest_alg == 'hmac-sha256':
-            digest = HMAC.new(base64.b16decode(hmac_key, True), self._bytes, digestmod=SHA256)
-        elif digest_alg == 'hmac-sha1':
-            digest = HMAC.new(base64.b16decode(hmac_key, True), self._bytes, digestmod=SHA1)
-        elif digest_alg == 'sha256':
-            digest = SHA256.new(self._bytes)
-        elif digest_alg == 'sha1':
-            digest = SHA1.new(self._bytes)
+        if digest_alg == 'hmac-sha1':
+            h = HMAC.new(base64.b16decode(hmac_key, True), self._bytes, digestmod=SHA1)
         else:
             raise Exception("Digest not supported %s" % (digest_alg))
 
-        debug("%08x %20s: [%6d] %s" % (self.pos(), digest_alg, len(digest.digest()), digest.hexdigest()))
-        self.append(digest.digest())
+        debug("%08x %20s: [%6d] %s" % (self.pos(), digest_alg, len(h.digest()), h.hexdigest()))
+        self.append(h.digest())
 
     def pos(self):
         return len(self._bytes)
@@ -161,7 +182,7 @@ class ImageFile:
     def close(self):
         self._of.close()
 
-def create_2711_image(output, bootcode, private_key, private_keynum, hmac):
+def create_2711_image(output, bootcode, private_key=None, private_keynum=0, hmac=None, hsm_wrapper=None):
     """
     Create a 2711 C0 secure-boot compatible seconds stage signed binary.
     """
@@ -169,22 +190,31 @@ def create_2711_image(output, bootcode, private_key, private_keynum, hmac):
     image.append_file(bootcode)
     image.append_length()
     image.append_keynum(private_keynum)
-    image.append_rsa_signature('sha1', private_key)
+    if hsm_wrapper:
+        image.append_rsa_signature_pkcs11(hsm_wrapper)
+    else:
+        image.append_rsa_signature('sha1', private_key)
     image.append_digest('hmac-sha1', hmac)
     image.write()
     image.close()
 
-def create_2712_image(output, bootcode, private_key, private_keynum, private_version):
+def create_2712_image(output, bootcode, private_version=0, public_key=None, private_key=None, private_keynum=0, hsm_wrapper=None):
     """
-    Create 2712 signed bootloader. The HMAC is removed and the full public key is appended.
+    Create a prototype 2712 signed bootloader. The HMAC is removed and the
+    full public key is appended.
     """
     image = ImageFile(output, MAX_BIN_SIZE)
     image.append_file(bootcode)
     image.append_length()
     image.append_keynum(private_keynum)
     image.append_version(private_version)
-    image.append_rsa_signature('sha256', private_key)
-    image.append_public_key(private_key)
+    if hsm_wrapper is not None:
+        debug(f"Call HSM wrapper {hsm_wrapper}")
+        image.append_rsa_signature_pkcs11(hsm_wrapper)
+        image.append_public_key(public_key)
+    else:
+        image.append_rsa_signature('sha256', private_key)
+        image.append_public_key(private_key)
     image.write()
     image.close()
 
@@ -193,37 +223,43 @@ def main():
     Signs a second stage bootloader image.
 
     Examples:
-        2711 mode:
-        rpi-sign-bootcode --debug -c 2711 -i bootcode.bin.clr -o bootcode.bin -k 2711_rsa_priv_0.pem -n 0 -m bootcode-production.key
-
-        2712 C1 and D0 mode:
-          * HMAC not included on 2712
-          * RSA public key included - ROM just contains the hashes of the RPi public keys.
-
-        Customer counter-signed signed:
+    
+        Customer counter-signed:
           * Exactly the same as Raspberry Pi signing but the input is the Raspberry Pi signed bootcode.bin
           * The key number will probably always be 16 to indicate a customer signing
 
         rpi-sign-bootcode --debug -c 2712 -i bootcode.bin.sign2 -o bootcode.bin -k customer.pem
+
+        PKCS#1 v1.5 - HSM wrapper:
+          * hsm-wrapper takes a single argument which is a temporary filename containing the data to sign
+          * hsm-wrapper outputs the PKCS#1 v1.5 signature in hex format
+          * hsm-wrapper must return a non-zero exit code if signing fails
+          * hsm-wrapper requires the -a rsa2048-sha256 parameter to specify the algorithm
+          * There is no facility to pass the private key or custom HSM arguments - the caller should generate a dedicated wrapper script
+          * The public key in PEM format MUST be specified with the -p option
+
+        rpi-sign-bootcode --debug -c 2712 -i bootcode.bin.sign2 -o bootcode.bin -p public.pem -H hsm-wrapper
     """
     parser = argparse.ArgumentParser(help_text)
-    parser.add_argument('-o', '--output', required=False, help='Output filename . If not specified the signed images is written to stdout in base64 format')
+    parser.add_argument('-o', '--output', required=False, help='Output filename. If not specified, the signed image is written to stdout in base64 format')
     parser.add_argument('-c', '--chip', required=True, type=int, help='Chip number')
-    parser.add_argument('-i', '--input', required=False, help='Path of the unsigned bootcode.bin file OR RPi signed bootcode file sign with the customer key. If NULLL the binary is read from stdin in base64 format')
+    parser.add_argument('-i', '--input', required=False, help='Path of the unsigned bootcode.bin file OR RPi signed bootcode file to be signed with the customer key. If NULL, the binary is read from stdin in base64 format')
     parser.add_argument('-m', '--hmac', required=False, help='Path of the HMAC key file')
-    parser.add_argument('-k', '--private-key', dest='private_key', required=True, help='Path of RSA private key (PEM format)')
+    parser.add_argument('-k', '--private-key', dest='private_key', required=False, default=None, help='Path of RSA private key (PEM format)')
+    parser.add_argument('-p', '--public-key', dest='public_key', required=False, default=None, help='Path of RSA public key (PEM format)')
     parser.add_argument('-n', '--private-keynum', dest='private_keynum', required=False, default=0, type=int, help='ROM key index for RPi signing stage')
+    parser.add_argument('-H', '--hsm-wrapper', default=None, required=False, help='Filename of HSM wrapper script which generates a PKCSv1.1 signature as hex')
     parser.add_argument('-d', '--debug', action='store_true')
-    parser.add_argument('-v', '--private-version', dest='private_version', required=True, type=int, help='Version of firmware, stops firmware rollback, only valid 0-31')
+    parser.add_argument('-v', '--private-version', dest='private_version', required=False, default=0, type=int, help='Version of firmware, stops firmware rollback, only valid 0-31')
 
     args = parser.parse_args()
     _CONFIG['DEBUG'] = args.debug
     if args.chip == 2711:
         if args.hmac is None:
             raise Exception("HMAC key requried for 2711")
-        create_2711_image(args.output, args.input, args.private_key, args.private_keynum, args.hmac)
+        create_2711_image(args.output, args.input, private_key=args.private_key, private_keynum=args.private_keynum, hmac=args.hmac, hsm_wrapper=args.hsm_wrapper)
     elif args.chip == 2712:
-        create_2712_image(args.output, args.input, args.private_key, args.private_keynum, args.private_version)
+        create_2712_image(args.output, args.input, private_version=args.private_version, public_key=args.public_key, private_key=args.private_key, private_keynum=args.private_keynum, hsm_wrapper=args.hsm_wrapper)
 
 if __name__ == '__main__':
     main()