Update changelog for 28.7-1~bookworm release

* pitowers/master:
  imager: Move the imager release to 2025-11-05
  2025-11-09: Promote 2025-11-05 to the default release (default)
  pieeprom-2025-11-05: 2712: arm_loader: Add iommu_dma_numa_policy=interleave when needed (latest)
  pieeprom-2025-11-05: 2711: arm_loader: Add iommu_dma_numa_policy=interleave when needed (latest)

.gitignore

@@ -1,3 +1 @@
 *.swp
-images-2711/
-images-2712/

debian/.gitignore

@@ -0,0 +1,9 @@
+.debhelper/
+debhelper-build-stamp
+files
+rpi-eeprom/
+rpi-eeprom-images/
+*.debhelper.log
+*.debhelper
+*.substvars
+*.1

debian/LICENCE.bootloader

@@ -0,0 +1,28 @@
+Copyright (c) 2019, Raspberry Pi (Trading) Ltd.
+All rights reserved.
+
+Redistribution.  Redistribution and use in binary form, without
+modification, are permitted provided that the following conditions are
+met:
+
+* This software may only be used for the purposes of developing for,
+  running or using a Raspberry Pi device.
+* Redistributions must reproduce the above copyright notice and the
+  following disclaimer in the documentation and/or other materials
+  provided with the distribution.
+* Neither the name of the copyright holder nor the names of its
+  contributors may be used to endorse or promote products derived
+  from this software without specific prior written permission.
+
+DISCLAIMER.  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
+CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING,
+BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+DAMAGE. 

debian/control

@@ -0,0 +1,29 @@
+Source: rpi-eeprom
+Section: misc
+Priority: optional
+Maintainer: Tim Gover <tim.gover@raspberrypi.com>
+Build-Depends: debhelper-compat (= 12), help2man, python3-minimal
+Standards-Version: 4.6.2
+Homepage: https://github.com/raspberrypi/rpi-eeprom/
+Vcs-Browser: https://github.com/raspberrypi/rpi-eeprom/
+Vcs-Git: https://github.com/raspberrypi/rpi-eeprom.git
+
+Package: rpi-eeprom
+Architecture: all
+Depends: ${shlibs:Depends}, ${misc:Depends}, raspi-utils, python3,
+ binutils, pciutils, python3-pycryptodome
+Breaks: rpi-eeprom-images (<<7.2)
+Replaces: rpi-eeprom-images (<<7.2)
+Recommends: flashrom
+Provides: rpi-eeprom-images
+Description: Raspberry Pi 4/5 boot EEPROM updater
+ Checks whether the Raspberry Pi bootloader EEPROM is up-to-date and updates
+ the EEPROM.
+
+Package: rpi-eeprom-images
+Architecture: all
+Depends: ${misc:Depends}, rpi-eeprom (>=7.2)
+Priority: optional
+Section: oldlibs
+Description: transitional package
+ This is a transitional package. It can safely be removed.

debian/copyright

@@ -0,0 +1 @@
+../LICENSE

debian/default/rpi-eeprom-update

@@ -0,0 +1 @@
+FIRMWARE_RELEASE_STATUS="default"

debian/gbp.conf

@@ -0,0 +1,3 @@
+[DEFAULT]
+upstream-tree = master
+debian-branch = pios/bookworm

debian/rpi-eeprom.docs

@@ -0,0 +1 @@
+debian/LICENCE.bootloader

debian/rpi-eeprom.install

@@ -0,0 +1,26 @@
+rpi-eeprom-config usr/bin/
+rpi-eeprom-update usr/bin/
+rpi-eeprom-digest usr/bin/
+tools/rpi-bootloader-key-convert usr/bin/
+tools/rpi-otp-private-key usr/bin/
+tools/rpi-sign-bootcode usr/bin/
+
+debian/default/ etc/
+
+firmware-2711/default usr/lib/firmware/raspberrypi/bootloader-2711/
+firmware-2711/latest usr/lib/firmware/raspberrypi/bootloader-2711/
+
+firmware-2711/critical usr/lib/firmware/raspberrypi/bootloader-2711/
+firmware-2711/stable usr/lib/firmware/raspberrypi/bootloader-2711/
+firmware-2711/beta usr/lib/firmware/raspberrypi/bootloader-2711/
+
+firmware-2711/release-notes.md usr/lib/firmware/raspberrypi/bootloader-2711/
+
+firmware-2712/default usr/lib/firmware/raspberrypi/bootloader-2712/
+firmware-2712/latest usr/lib/firmware/raspberrypi/bootloader-2712/
+
+firmware-2712/critical usr/lib/firmware/raspberrypi/bootloader-2712/
+firmware-2712/stable usr/lib/firmware/raspberrypi/bootloader-2712/
+firmware-2712/beta usr/lib/firmware/raspberrypi/bootloader-2712/
+
+firmware-2712/release-notes.md usr/lib/firmware/raspberrypi/bootloader-2712/

debian/rpi-eeprom.maintscript

@@ -0,0 +1,2 @@
+dir_to_symlink /lib/firmware/raspberrypi/bootloader-2711/beta latest 17.0+pi5+1-1
+dir_to_symlink /lib/firmware/raspberrypi/bootloader-2712/beta latest 17.0+pi5+1-1

debian/rpi-eeprom.manpages

@@ -0,0 +1,2 @@
+debian/rpi-eeprom-update.1
+debian/rpi-eeprom-config.1

debian/rpi-eeprom.postinst

@@ -0,0 +1,39 @@
+#!/bin/sh
+# postinst script for rpi-eeprom
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postinst> `configure' <most-recently-configured-version>
+#        * <old-postinst> `abort-upgrade' <new version>
+#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
+#          <new-version>
+#        * <postinst> `abort-remove'
+#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
+#          <failed-install-package> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see https://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+
+
+case "$1" in
+    configure)
+    ;;
+
+    abort-upgrade|abort-remove|abort-deconfigure)
+    ;;
+
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0

debian/rpi-eeprom.postrm

@@ -0,0 +1,40 @@
+#!/bin/sh
+# postrm script for rpi-eeprom
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postrm> `remove'
+#        * <postrm> `purge'
+#        * <old-postrm> `upgrade' <new-version>
+#        * <new-postrm> `failed-upgrade' <old-version>
+#        * <new-postrm> `abort-install'
+#        * <new-postrm> `abort-install' <old-version>
+#        * <new-postrm> `abort-upgrade' <old-version>
+#        * <disappearer's-postrm> `disappear' <overwriter>
+#          <overwriter-version>
+# for details, see https://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+
+
+case "$1" in
+    purge)
+        rm -rf /var/lib/raspberrypi/bootloader/backup/
+    ;;
+    remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
+    ;;
+
+    *)
+        echo "postrm called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0

debian/rpi-eeprom.prerm

@@ -0,0 +1,38 @@
+#!/bin/sh
+# prerm script for rpi-eeprom
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <prerm> `remove'
+#        * <old-prerm> `upgrade' <new-version>
+#        * <new-prerm> `failed-upgrade' <old-version>
+#        * <conflictor's-prerm> `remove' `in-favour' <package> <new-version>
+#        * <deconfigured's-prerm> `deconfigure' `in-favour'
+#          <package-being-installed> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see https://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+
+
+case "$1" in
+    remove|upgrade|deconfigure)
+    ;;
+
+    failed-upgrade)
+    ;;
+
+    *)
+        echo "prerm called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0

debian/rpi-eeprom.rpi-eeprom-update.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=Check for Raspberry Pi EEPROM updates
+After=boot-firmware.mount
+
+[Service]
+Type=oneshot
+RemainAfterExit=true
+ExecStart=/usr/bin/rpi-eeprom-update -s -a
+
+[Install]
+WantedBy=multi-user.target

debian/rules

@@ -0,0 +1,27 @@
+#!/usr/bin/make -f
+#export DH_VERBOSE = 1
+
+include /usr/share/dpkg/pkg-info.mk
+
+%:
+	dh $@
+
+override_dh_installsystemd:
+	dh_installsystemd --name=rpi-eeprom-update
+
+override_dh_auto_build: debian/rpi-eeprom-update.1 debian/rpi-eeprom-config.1
+
+override_dh_install:
+	mkdir -p debian/rpi-eeprom/var/lib/raspberrypi/bootloader/backup/
+	dh_install
+
+debian/rpi-eeprom-update.1:
+	help2man -N --version-string="${DEB_VERSION_UPSTREAM}" --help-option="-h" \
+		--name="Checks whether the Raspberry Pi bootloader EEPROM is \
+up-to-date and updates the EEPROM" \
+		--output=$@ ./rpi-eeprom-update
+
+debian/rpi-eeprom-config.1:
+	help2man -N --version-string="${DEB_VERSION_UPSTREAM}" --help-option="-h" \
+		--name="Bootloader EEPROM configuration tool for the Raspberry Pi 4/5" \
+		--output=$@ ./rpi-eeprom-config

debian/salsa-ci.yml

@@ -0,0 +1,9 @@
+include:
+  - $CI_SERVER_URL/apt/salsa-ci/raw/pios/recipes/pios.yml
+
+extract-source:
+  variables:
+    GIT_DEPTH: 0
+    GIT_STRATEGY: clone
+  before_script:
+    - git fetch origin master:master

debian/source/format

@@ -0,0 +1 @@
+3.0 (quilt)

debian/source/lintian-overrides

@@ -0,0 +1,2 @@
+debian-copyright-is-symlink
+source-is-missing [tools/vl805]

firmware-2711/release-notes.md

@@ -1,48 +1,5 @@
 # Raspberry Pi4 bootloader EEPROM release notes
 
-## 2025-12-09: Promote 2025-12-08 to the default release (default)
-
-## 2025-12-08: arm_loader: Add machine ID derived from OTP values (latest)
-
-* arm_loader: Add machine ID derived from OTP values
-  Machine ID is generated and exposed in device tree as rpi-machine-id
-* arm_ldconfig: Avoid double os_prefix on initramfs
-  When using auto_initramfs we were picking up prefix from the kernel,
-  but also adding os_prefix later:
-  fname = prefixed_path(initramfs_file, os_prefix, temp_path, sizeof(temp_path));
-  See: https://forums.raspberrypi.com/viewtopic.php?t=394238
-* recovery: Use OTP rpiboot GPIO if non-zero
-  If an rpiboot GPIO has already been written to OTP then default to
-  that value if C(program_rpiboot_gpio) is not specified on config.txt.
-
-## 2025-11-27: helpers/config_loader: Also support bootvar0 eeprom config on Pi4 (latest)
-
-* helpers/config_loader: Also support bootvar0 eeprom config on Pi4
-  This allows an eeprom config setting (e.g. BOOTARG0=0x10) to be set on a board
-  which config.txt can use as a conditional expression (e.g. [bootarg0&0x10]).
-* pi5: Write over-voltage config to the UART log
-  Write the high level over-voltage configuration to the UART log for
-  diagnostic purposes.
-* Stop partition-walk after boot-mode timeout/retries limit
-  Fix a fatal assert with USB boot where the partition walk could be
-  retried after the USB timeout/retry limit had been reached.
-  See: https://github.com/raspberrypi/rpi-eeprom/issues/776
-* rpiboot: Extend metadata to report status of operations
-  Report success/fail status of recovery operations based on config.txt settings
-
-## 2025-11-21: recovery: Restore recovery_wait option (latest)
-
-* recovery: Restore recovery_wait option
-  Restore the recovery_wait config.txt option. If this option is set
-  then recovery.bin will not rename itself or reboot. Instead flash
-  the activity LED on completion.
-  This option can be useful when creating an SD card to erase the
-  EEPROM or program the RPIBOOT gpio on multiple devices.
-  If recovery_wait=1 and recovery.bin is run from the SD card then
-  indicate success of erase_eeprom=1 or program_rpiboot_gpio=N was
-  set instead of requiring the EEPROM to be updated.
-* Manufacture test updates for SDRAM.
-
 ## 2025-11-09: Promote 2025-11-05 to the default release (default)
 
 ## 2025-11-05: Add iommu_dma_numa_policy=interleave when needed (latest)

firmware-2712/release-notes.md

@@ -1,47 +1,5 @@
 # Raspberry Pi5 bootloader EEPROM release notes
 
-## 2025-12-09: Promote 2025-12-08 to the default release (default)
-
-## 2025-12-08: arm_loader: Add machine ID derived from OTP values (latest)
-
-* arm_loader: Add machine ID derived from OTP values
-  Machine ID is generated and exposed in device tree as rpi-machine-id
-* arm_ldconfig: Avoid double os_prefix on initramfs
-  When using auto_initramfs we were picking up prefix from the kernel,
-  but also adding os_prefix later:
-  fname = prefixed_path(initramfs_file, os_prefix, temp_path, sizeof(temp_path));
-  See: https://forums.raspberrypi.com/viewtopic.php?t=394238
-
-## 2025-11-27: Stop partition-walk after boot-mode timeout/retries limit (latest)
-
-* pi5: Write over-voltage config to the UART log
-  Write the high level over-voltage configuration to the UART log for
-  diagnostic purposes.
-* Stop partition-walk after boot-mode timeout/retries limit
-  Fix a fatal assert with USB boot where the partition walk could be
-  retried after the USB timeout/retry limit had been reached.
-  See: https://github.com/raspberrypi/rpi-eeprom/issues/776
-* rpiboot: Extend metadata to report status of operations
-  Report success/fail status of recovery operations based on config.txt settings
-
-## 2025-11-21: Allow longer overlay file paths (latest)
-
-* recovery: Restore recovery_wait option
-  Restore the recovery_wait config.txt option. If this option is set
-  then recovery.bin will not rename itself or reboot. Instead flash
-  the activity LED on completion.
-  This option can be useful when creating an SD card to erase the
-  EEPROM or program the RPIBOOT gpio on multiple devices.
-  If recovery_wait=1 and recovery.bin is run from the SD card then
-  indicate success of erase_eeprom=1 or program_rpiboot_gpio=N was
-  set instead of requiring the EEPROM to be updated.
-* Load RP1 firmware whilst DDR is initialising
-* Allow longer overlay file paths
-  load_dtoverlay uses the variable "filename" to hold the full path to an
-  overlay. As such it should be declared using LDFILEPATH_MAX, not
-  LDFILENAME_MAX.
-  See: https://github.com/raspberrypi/firmware/issues/2004
-
 ## 2025-11-09: Promote 2025-11-05 to the default release (default)
 
 ## 2025-11-05: arm_loader: Add iommu_dma_numa_policy=interleave when needed (latest)

imager/make-imager-release

@@ -9,10 +9,3 @@ ${script_dir}/make-release critical 2025-11-05 000138c0 "${script_dir}/2711-conf
 
 # Pi5
 ${script_dir}/make-release critical 2025-11-05 "" "${script_dir}/2712-config" release-2712 rpi-boot-eeprom-recovery 2712
-
-# Convert to disk image for RPi Imager downloads
-sudo ${script_dir}/make-recovery-images
-
-# Delete the plain .zip files. These should not be uploaded as releases.
-rm -rf release-2711
-rm -rf release-2712

imager/make-pi4-rpiboot-gpio-sd

@@ -1,134 +0,0 @@
-#!/bin/sh
-
-set -e
-
-script_dir=$(cd "$(dirname "$0")" && pwd)
-TMP_DIR=""
-
-die() {
-   echo "$@" >&2
-   exit 1
-}
-
-cleanup() {
-   if [ -d "${TMP_DIR}" ]; then
-      rm -rf "${TMP_DIR}"
-   fi
-}
-
-usage() {
-cat <<EOF
-Usage:
-sudo $(basename $0): <gpio_num>
-
-	Creates an SD card image which programs the OTP on a Pi 4B or Pi 400
-	to select a GPIO on the 40-pin header for use as the rpiboot GPIO.
-	Once programmed, if this GPIO is pulled to ground at power on, the
-	SoC bootrom will boot into rpiboot provisioning mode.
-
-	This setting _permanently_ modifies the device configuration - it cannot
-	be undone or changed, ever.
-
-	The SD image will be written to images-2711/pi4-program-rpiboot-gpioN.zip,
-	where N is the number of the chosen GPIO, and can be flashed using
-	Raspberry Pi Imager to a spare SD card. As with programming the bootloader
-	EEPROM, insert the card in the Raspberry Pi, power on and wait for the
-	green LED to flash.
-
-	gpio_num: Select the rpiboot GPIO number from 2,4,5,6,7 or 8.
-EOF
-    exit 1
-}
-
-trap cleanup EXIT
-
-[ "$(id -u)" = "0" ] || die "$(basename $0) must be run as root"
-[ -n "${SUDO_UID}" ] || die "SUDO_UID not defined"
-[ -n "${SUDO_GID}" ] || die "SUDO_GID not defined"
-
-build_image()
-{
-   chip="${1}"
-   gpio="${2}"
-   img="pi4-program-rpiboot-gpio${gpio}"
-   zip="${img}.zip"
-   img="${img}.img"
-
-   TMP_DIR="$(mktemp -d)"
-   (
-      mkdir "${TMP_DIR}/files"
-      cd "${TMP_DIR}/files"
-      cp "${script_dir}/../firmware-${chip}/latest/recovery.bin" .
-   cat <<EOF > config.txt
-uart_2ndstage=1
-recovery_wait=1
-program_rpiboot_gpio=${gpio}
-EOF
-      echo "Generated config.txt file"
-      cat config.txt
-      cd "${TMP_DIR}"
-      dd if=/dev/zero bs=1M count=258 of=temp.img > /dev/null 2>&1
-      /sbin/sfdisk temp.img <<EOF
-label: dos
-label-id: 0x0a7b5ac5
-device: temp.img
-unit: sectors
-
-./test.img1 : start=        2048, size=       524288, type=c
-EOF
-      file temp.img
-      LOOP="/dev/mapper/$(kpartx -lv temp.img | head -n1 | awk '{print $1}')"
-      kpartx -a temp.img
-      /sbin/mkfs.fat -F 32 -s 1 "${LOOP}" > /dev/null
-      mkdir fs
-      mount "${LOOP}" fs
-      cp -v files/* fs
-      sync
-      sleep 5
-      umount fs
-      # Delay before calling kpartx otherwise it's sometimes possible to get orphaned loopback devices
-      sleep 5
-      kpartx -d temp.img
-   )
-   image_dir="images-${chip}"
-   mkdir -p "${image_dir}"
-   chown "${SUDO_UID}:${SUDO_GID}" "${image_dir}"
-   mv "${TMP_DIR}/temp.img" "${image_dir}/${img}"
-   file "${image_dir}/${img}"
-   cd "${image_dir}"
-   zip "${zip}" "${img}"
-   cd ..
-   rm "${image_dir}/${img}"
-   chown "${SUDO_UID}:${SUDO_GID}" "${image_dir}/${zip}"
-   echo "Wrote $(pwd)/${image_dir}/${zip}"
-}
-
-
-if ! command -v kpartx > /dev/null; then
-   die "kpartx not found: Try installing the kpartx package"
-fi
-
-[ -n "${1}" ] || usage
-gpio_num="$1"
-
-case "${gpio_num}" in
-   	2)
-		;;
-	4)
-		;;
-	5)
-		;;
-	6)
-		;;
-	7)
-		;;
-	8)
-		;;
-        *)
-		echo "GPIO ${gpio_num} is not supported"
-		echo
-  	  usage
-	  	;;
-esac
-
-build_image 2711 "${gpio_num}"

rpi-eeprom-config

@@ -260,8 +260,8 @@ class BootloaderImage(object):
 
         self._image_size = len(self._bytes)
         if self._image_size not in VALID_IMAGE_SIZES:
-            exit_error("%s: Expected sizes %s bytes, got actual size %d bytes" %
-                       (filename, VALID_IMAGE_SIZES, self._image_size))
+            exit_error("%s: Expected size %d bytes actual size %d bytes" %
+                       (filename, self._image_size, len(self._bytes)))
         self.parse()
 
     def parse(self):