Interesting changes since the last release:
2025-11-05: arm_loader: Add iommu_dma_numa_policy=interleave when needed (latest)
- arm_loader: Add iommu_dma_numa_policy=interleave when needed
This applies a similar numa interleave for iommu dma kernel allocations.
This includes buffers allocated for hevc and v3d.
See: https://forums.raspberrypi.com/viewtopic.php?t=392666 - Rebuild RP1 firmware to reduce size.
2025-10-17: Enable background refresh on 2712d0 for all SDRAM sizes (latest)
- 2712d0: Enable background refresh on 2712d0 for all SDRAM sizes
This provides a minor performance benefit. - Update GPT to support 4K native sectors
Bootloader logic updated to correctly interpret the GPT layout format specific to 4K native sector drives. - recovery: Use ROM boot-mode flag to detect rpiboot mode
In recovery-mode use the bootrom register flag to detect the
original boot-mode rather than looking at whether the rpiboot
usb-device boot driver is initialised.
2025-10-08: Fix accidental set of PM_RSTS bit 5 when stopping watchdog (latest)
- Fix accidental set of PM_RSTS bit 5 when stopping watchdog
Fix an issue in the watchdog code where the raw PM_RSTS value
was used as partition number. If HADWRF (bit 5) was set (on reboot)
this could cause bit 10 to be set. If an OS didn't clear the partition
flags on reboot then this could end up being treated as request to
boot from partition 32. - pi5: Preliminary support for 4K native sectors with NVMe drives
Pi5 now supports 4K native sector NVMe drives.
This allows booting from drives with logical block size 4096,
while 512B drives remain compatible. With 4K sectors, storage density
increases along with improved reliability and efficiency.
N.B. USB boot still requires a 512 byte sector size and there are
no RPi OS disk images with a 4K sector format.
See: #577 - arm_dt: Report OTP SDRAM size via device-tree
Report the SDRAM in gigabits via device-tree as
/proc/device-tree/chosen/rpi-sdram-size-gbit. Scripts reporting the
device-capabilities should use this value (if defined) instead of the
memory-size field in the boardrev row.
2025-09-25: Apply UART_BAUD in early bootsys UART init (latest)
- Apply UART_BAUD in early bootsys UART init
Update bootsys and fatal error handlers to use the user
defined UART_BAUD rate. - rpifwcrypto: Add support for ECDSA P-256 key generation
2025-09-23: Fix TFTP to allow larger files (latest)
- Fix TFTP to allow larger files
Allow TFTP block counter to rollover to 0.
See: #720
2025-09-22: Add LZ4 decompressor (latest)
- Add LZ4 decompressor
LZ4 gives a better compression ratio than the previously used CK compress. The bootloader can now decompress both LZ4 compressed files and CK compressed files. - rpifwcrypto: Add GET_CRYPTO_PRIVATE_KEY mailbox API
For provisioning, add a new mailbox API which returns the private key
in DER format. The API will return an error if the key-status for
the specified key is LOCKED. - config: Add support for board_attributes in conditional expressions
Add support for the board-attributes row in config.txt conditional
expressions. This can be used to change boot behavior for
Compute Module Lite / No-WiFi etc. - board_info: Log the OTP board revision at startup
Log the board revision plus the raw OTP value at startup.
2025-08-27: Fix PARTITION property to allow default (0) partition to be overridden (latest)
- Fix PARTITION property to allow default (0) partition to be overridden
Fix the partition selection to allow the bootloader PARTITION
property to override the reboot partition number if the reboot
argument is 0 or > 31. Previously, it was only allowing
partition numbers > 31 to be overridden.
See: #743 - Enable RPIBOOT in BOOT_ORDER / set-reboot-order
Previously, rpiboot required the bootrom to have initialised
rpiboot before running the firmware. Update the rpiboot
initialisation so that rpiboot to be enabled after booting from
SPI flash.
This could be selectively enabled by setting BOOT_ORDER property
(0x3) behind a GPIO conditional in the EEPROM config. On Pi5, the
set_reboot_order config.txt option or mailbox property can be
used to set a one-time boot-order on
N.B. There is no timeout for RPIBOOT so this should only be set
as the last boot mode OR used with a boot_watchdog.
2025-08-20: force_eeprom_read=0 disables HAT I2C (latest)
- force_eeprom_read=0 disables HAT I2C
Although setting force_eeprom_read=0 has always prevented the HAT EEPROM
from being read, with the recent changes to support Power HAT+s it does
not prevent an early scan to see if such an EEPROM exists. This can be
problematic for applications where the I2C0 pins have been repurposed.
Change the inhibit logic to cut all HAT I2C probing off at the knees,
including any automatic settings of usb_max_current_enable, as it should
always have done.
See: raspberrypi/firmware#1985 - rpifwcrypto: Preliminary firmware support for rpifwcrypto API
- Add config.txt to block GET_CUSTOMER_PRIVATE_KEY mailbox API lock_device_private_key=1
2025-08-13: Enable the PARTITION_WALK property by default (latest)
- Enable the PARTITION_WALK property by default
Previously, the new PARTITION_WALK which searches for bootable
partitions after a failure had to be explicitly enabled. Change
the default to be enabled by default. It can be switched off by
setting PARTITION_WALK=0 in the EEPROM config. - pi5: Fix read for cached copy of PMIC sequencer status
Previously, this was overwritten by the RTC event status.
2025-07-17: Fix config key search which could cause camera_autodetect to fail (latest)
- Fix config key search which could cause camera_autodetect to fail
The bootvar0 config property was added in the wrong section which
could cause the config property search for some other properties
to fail.
2025-07-17: arm_loader: Also require the early-watchdog property (latest)
- arm_loader: Also require the early-watchdog property
The change correcting the implementation of dtoverlay_is_enabled had the
unintended consequence of causing the firmware to enable the watchdog
even though the user had not explicitly requested it. This is harmless
on Linux because the watchdog driver takes over and disarms it, but on
other operating systems this can lead to a reboot. Avoid this problem
by also requiring the presence of a new property, "early-watchdog".
See: raspberrypi/firmware#1980 - helpers/config_loader: Add bootvar0 eeprom config that can be used in config.txt section expressions
This allows an eeprom config setting (e.g. BOOTVAR0=0x10) to be set on a board
which config.txt can use as a conditional expression (e.g. [bootvar0&0x10]). - arm_loader: Fix boot-watchdog stop on Pi4
Fix a problem where the boot_watchdog heartbeat timer was not
stopped correctly which could cause it to clash with the kernel
watchdog driver.
2025-07-03: Enable firmware UART output on the 40-pin header (latest)
- rp1_uart: Allow rp1_uart to be started earlier
If enabled (with enable_rp1_uart) then the existing boot uart
messages are redirected to the rp1 uart.
2025-06-29: Check for SD card overcurrent on Pi5 and Pi500 (latest)
- board_info: Use the Ethernet PHY address probed by the bootloader
Use the Ethernet PHY address supplied by the bootloader in
preference to the static configurations defined in start4.elf - pi5: Fix overwrite of cache EEPROM config in secure-boot mode
See: #719 - Check for SD card overcurrent on Pi5, Pi500 and Pi4
Before booting, the bootloader now checks the SD power switch
overcurrent signal. The overcurrent signal occurs if the SD
card is damaged and has a short circuit which will cause it to
get hot.
If an over-current condition is detected the bootloader
switches off power to the SD card and waits five seconds before
probing the SD card again. This error is displayed on the
diagnostic screen, the UART and the activity LED (1 long, 2 short)
flashes.
The check can be switched to a non-blocking warning by setting
SD_OVERCURRENT_CHECK=0 in the bootloader config. - Add a new error code pattern for SD overcurrent
Add a new error pattern (1 long, 2 short) to signal SD card
overcurrent. - Enable RTC wakeup from POWER_OFF_ON_HALT=0
- Improve HAT+ current handling
In shipping firmware, the current_supply value is only being used in the
case of a normal (non-stacked) HAT+, but that is unnecessarily
restrictive. Also, the presence of MODE0 and MODE1 power HATs is not
reflected in the value of max_current.
See: raspberrypi/linux#6678
2025-06-20: Add support for a bootloader watchdog (latest)
- Add support for a bootloader watchdog
Add support for a boot watchdog (using PM_RSTC hw wdog) which will
trigger if the OS is not started within the specified amount of time. The
watchdog is enabled by setting the BOOT_WATCHDOG_TIMEOUT=N (seconds)
property in the bootlaoder config.
The BOOT_WATCHDOG_PARTITION=P property can be set to pass a different
partition number to the bootloader on reset if the watchdog
is triggered.
The boot watchdog is automatically cleared just before starting
the OS and (optionally) enabling the kernel watchdog. - pi5: Add a temperature monitor
In early releases of the bootloader the fan would always be on
during boot which can be distracting. Later releases switch off the
fan until the OS has booted.
This change adds some basic fan control from the bootloader to
enable the fan if the temperature is above 85C.
This may be useful if the Pi was shutdown by the OS because the
temperature limit was exceeded.
Since the Linux hwmon is not active at this stage the bootloader
now implements the same logic to power off the Pi if the chips
is more than 110C.
The PMIC hardware automatically cuts power if the temperature
is more than 125C. - Skip first SD boot if no card detected
On platforms with an SD Card detect signal, skip the first attempt to
boot from SD if the card appears to be absent. This can save over a
second on a cold boot, and a little under a second for a reboot.
2025-06-13: Update to include production test changes (latest)
- Update to include production test changes.
2025-06-09: NVMe: Fix loading of files > 32MB (latest)
- NVMe: Fix loading of files > 32MB
Fix an NVMe boot bug which caused large contiguous reads >= 32MB to fail. - Update setting alpha for 2712D0
D0 moved the alpha blend mode from CTL2 to CTL0.
Update the bootloader code to follow suit for those using
the simple framebuffer - dtoverlay: Fix node_is_enabled for implicit status
The absence of a status property implies that a node is enabled. Update
dtoverlay_node_is_enabled to match that behaviour.
See: raspberrypi/firmware#1970 - arm_loader: GET_CLOCKS: Set useful response length
The kernel's firmware mailbox API does not make the actual length of the
response available to clients, but other implementations may care.
Continue to pad the GET_CLOCKS buffer with zeroes, but set the response
length to minimally contain the useful content.
See: raspberrypi/firmware#1969