# Raspberry Pi Bootloader changelog

> Boot EEPROM firmware for the Raspberry Pi 4 and Raspberry Pi 5.

- Vendor: Raspberry Pi
- Category: Firmware
- Official site: https://github.com/raspberrypi/rpi-eeprom
- Tracked by: What's New (https://whatsnew.fyi/product/rpi-eeprom)
- Harvested from: GitHub (raspberrypi/rpi-eeprom)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### v2026.05.17-2711-0138c0 — rpi-boot-eeprom-recovery-2026-05-17

- Date: 2026-05-27
- Version: v2026.05.17-2711-0138c0
- Original notes: https://github.com/raspberrypi/rpi-eeprom/releases/tag/v2026.05.17-2711-0138c0
- Permalink: https://whatsnew.fyi/product/rpi-eeprom/releases/v2026.05.17-2711-0138c0

- **changed** — Update Broadcom DDR firmware to 2.35
- **changed** — Increase manufacturing version to 1 for 2711 to reflect Broadcom SDRAM DDR init firmware update
- **changed** — Perform preliminary clock driver refactoring in arm_loader_dvfs
- **added** — Record hardware board information in OTP on Pi4, reporting minimal bootloader version via device-tree as /proc/device-tree/chosen/rpi-min-boot-ver
- **changed** — Update Broadcom SDRAM firmware to v2.34 to support wider variety of SDRAM chips
- **added** — Add error code for bootloader memory test, displaying 5 short flashes if DDR init firmware succeeds but memory test fails
- **added** — Allow configuration of DPI clock from dt-blob in vcfw/plat_conf
- **changed** — Automatically reboot after displaying a fatal error three times in a row instead of waiting forever, with REBOOT_ON_FATAL_ERROR=0 option to disable
- **fixed** — Fix partition walk for boot_ramdisk and secure-boot to allow retries when boot.img is not found
- **added** — Support conditional filter for eight customer OTP rows in config.txt from Pi 1 onwards
- **fixed** — Improve argument validation in rpi-fw-crypto to prevent lock-up from bad key-id or invalid private key during HMAC operations
- **changed** — Assume eMMC for CM4/CM5 non-lite modules by skipping SD interface condition command timeout and enabling eMMC mode directly, saving approximately 250ms of boot time

Interesting changes since the last release:- 

##### 2026-05-17: Update Broadcom DDR firware to 2.35 (latest)

* 2711: Increase the manufacturing version to 1
  Increase the manufacturing version to 1 to reflect the update
  to the Broadcom SDRAM DDR init firmware.
* 2711: Update SDRAM FW to 2.35
* arm_loader_dvfs: Preliminary clock driver refactoring
* pi4: Record hardware board information in OTP
  On Pi4 report the minimal bootloader version (manufacturing release)
  in OTP and make it available via device-tree as
  /proc/device-tree/chosen/rpi-min-boot-ver

##### 2026-04-14: Update Broadcom SDRAM firmware to v2.34 (latest)

* Update the Broadcom SDRAM firmware to v2.34 to support
  a wider variety of SDRAM chips.
* Add an error code for the bootloader memory test.
  The bootloader contains simple memory test to validate
  that the DDR init firmware has completed successfully.
  If the DDR init firmware reports an error code then continue to
  display 8 short flashes. However, if the DDR init firmware is
  successful but the memory test fails then display 5 short flashes.
  This is very unlikely to fail in practise but is useful debug
  mechanism when stress testing boards e.g. different temperatures.
* vcfw/plat_conf: Allow configuration of DPI clock from dt-blob
* Automatically reboot after a displaying a fatal error
  Change the fatal error handler to perform a hard reset after
  displaying the fatal error three times in a row instead of waiting
  forever. This change can mitigate intermittent hardware issues due
  e.g. power supplies, HATs or board temperature.
  Displaying the error pattern three times first rate
  limits reboots. If a faster reboot is required then the
  BOOT_WATCHDOG setting should be used instead.
  To disable this feature set REBOOT_ON_FATAL_ERROR=0 in
  the bootloader config.

##### 2026-02-23: Fix partition walk for boot_ramdisk / secure-boot (latest)

* Fix partition walk for boot_ramdisk / secure-boot
  If secure-boot / boot_ramdisk was enabled and boot.img was not found
  then the bootloader would immediately exit the boot mode instead
  allowing the partition walk to run. Change the logic to allow
  retries if partition walk was enabled.

##### 2026-02-06: config: Add support for customer OTP rows in conditional expressions (latest)

* config: Add support for customer OTP rows in conditional expressions
  Support conditional filter for eight customer OTP rows to be used by config.txt from Pi 1 onwards.
  (Requires updated start4.elf)
* rpi-fw-crypto: Fix bad hmac arguments lock-up
  Improve argument validation so that a bad key-id or invalid private key
  can no longer cause a lock-up during HMAC operations.
* Assume eMMC for CM4/CM5 non-lite
  Attempt the fast path by skipping the SD interface condition command timeout on CM4/CM5 (non-lite) modules and enable eMMC mode directly. This saves ~250ms of the boot time.

### v2026.05.11-2712 — rpi-boot-eeprom-recovery-2026-05-11-2712

- Date: 2026-05-11
- Version: v2026.05.11-2712
- Original notes: https://github.com/raspberrypi/rpi-eeprom/releases/tag/v2026.05.11-2712
- Permalink: https://whatsnew.fyi/product/rpi-eeprom/releases/v2026.05.11-2712

- **changed** — Set bootloader mfg version id to 1 to indicate support for new SDRAM variants
- **added** — Add MFG_VER string for rpi-eeprom-update minver check to validate minimum recommended bootloader version against hardware
- **added** — Record hardware board information in OTP on Pi5 and report minimal bootloader version via device-tree under /proc/device-tree/chosen/rpi-min-boot-ver
- **fixed** — Correct logging message for hdmi_pixel_freq_limit in arm_display
- **changed** — Increase default v3d frequency on 2712d0
- **changed** — Enable turbo clocks before loading the kernel on Pi5 to reduce boot time by approximately 1 second on NVMe boot
- **changed** — Update Broadcom SDRAM firmware to 4.72 to support additional memory variants
- **changed** — Update the slow non-tuned DDR init used by recovery.bin to support more SDRAM variants
- **added** — Add an error code for the bootloader memory test to display 5 short flashes if DDR init succeeds but memory test fails
- **changed** — Automatically reboot after displaying a fatal error three times instead of waiting forever, with option to disable via REBOOT_ON_FATAL_ERROR=0
- **fixed** — Fix partition walk for boot_ramdisk and secure-boot to allow retries if partition walk was enabled
- **added** — Add support for customer OTP rows in conditional expressions in config.txt from Pi 1 onwards
- **added** — Copy early bootloader UART logs into vcos logging accessible via sudo vclog -m on Pi5
- **fixed** — Fix bad hmac arguments lock-up in rpi-fw-crypto by improving argument validation for key-id and private key
- **changed** — Assume eMMC for CM4/CM5 non-lite modules by skipping SD interface condition command timeout to save approximately 250ms of boot time
- **fixed** — Preserve the RTC alarm state so it can be queried by the rpi-rtc driver
- **changed** — Apply rpifwcrypto lock permissions to GET/SET USER OTP mailboxes to prevent access to device unique private key when locked
- **added** — Add support for 8-bit bus width eMMC on CM5

Interesting changes since the last release:

##### 2026-05-11: 2712: Set bootloader mfg verison id to 1 (latest)

* 2712: Set bootloader mfg verison id to 1
  Advance the minimum version id to 1 to indicate support for new SDRAM
  variants.
* Add MFG_VER string for rpi-eeprom-update minver check
  On new boards, the minimum recommended version will be written
  to OTP. This will allow rpi-eeprom-update to check the minimum
  recommended version required by the hardware against the version
  field embedded in EEPROM image binary.
  strings pieeeprom.bin | grep 'MFG_VER:'
* pi5: Record hardware board information in OTP
  On Pi5 report minimal bootloader version via device-tree under
  /proc/device-tree/chosen/rpi-min-boot-ver.

##### 2026-04-30: 2712: arm_boot: Enable turbo clocks before loading the kernel (latest)

* arm_display: Correct logging message hdmi_pixel_freq_limit
  Noticed in a raspinfo log file.
* Increase default v3d frqeuency on 2712d0
* pi5: arm_boot: Enable turbo clocks before loading the kernel
  Originally, for the entire boot ran at the idle-operating
  point. Subsequently, the default for intial_turbo was changed so
  that the kernel is started with turbo-clocks unless disabled
  via config.txt.
  This change enables the turbo-clocks as soon as it is safe as soon
  as the turbo voltage has been calibrated to speedup kernel loading
  and device-tree processing.
  This reduces boot time by approximately 1 second on a Pi5 booting
  from NVMe.

##### 2026-04-27: Broadcom SDRAM firmware update to 4.72 (latest)

Broadcom SDRAM firmware update to 4.72

Update the Broadcom SDRAM firmware to 4.72 to support additional memory variants.

##### 2026-04-14: Update recovery.bin to support more SDRAM variants (latest)

* Update the slow (non tuned) DDR init used by recovery.bin to support
  more SDRAM variants.
* Add an error code for the bootloader memory test.
  The bootloader contains simple memory test to validate
  that the DDR init firmware has completed successfully.
  If the DDR init firmware reports an error code then continue to
  display 8 short flashes. However, if the DDR init firmware is
  successful but the memory test fails then display 5 short flashes.
  This is very unlikely to fail in practise but is useful debug
  mechanism when stress testing boards e.g. different temperatures.
* Automatically reboot after a displaying a fatal error
  Change the fatal error handler to perform a hard reset after
  displaying the fatal error three times in a row instead of waiting
  forever. This change can mitigate intermittent hardware issues due
  e.g. power supplies, HATs or board temperature.
  Displaying the error pattern three times first rate
  limits reboots. If a faster reboot is required then the
  BOOT_WATCHDOG setting should be used instead.
  To disable this feature set REBOOT_ON_FATAL_ERROR=0 in
  the bootloader config.

##### 2026-02-23: Fix partition walk for boot_ramdisk / secure-boot (latest)

* Fix partition walk for boot_ramdisk / secure-boot
  If secure-boot / boot_ramdisk was enabled and boot.img was not found
  then the bootloader would immediately exit the boot mode instead
  allowing the partition walk to run. Change the logic to allow
  retries if partition walk was enabled.

##### 2026-02-06: config: Add support for customer OTP rows in conditional expressions (latest)

* config: Add support for customer OTP rows in conditional expressions
  Support conditional filter for eight customer OTP rows to be used by config.txt from Pi 1 onwards.
* pi5: Copy early bootloader UART logs into vcos logging
  Early bootloader loggings in bootmain are now available via 'sudo vclog -m'

##### 2026-01-21: rpi-fw-crypto: Fix bad hmac arguments lock-up (latest)

* rpi-fw-crypto: Fix bad hmac arguments lock-up
  Improve argument validation so that a bad key-id or invalid private key
  can no longer cause a lock-up during HMAC opera

_[Truncated at 4000 characters — full notes: https://github.com/raspberrypi/rpi-eeprom/releases/tag/v2026.05.11-2712]_

### v2026.01.09-2711 — rpi-boot-eeprom-recovery-2026-01-09

- Date: 2026-01-16
- Version: v2026.01.09-2711
- Original notes: https://github.com/raspberrypi/rpi-eeprom/releases/tag/v2026.01.09-2711
- Permalink: https://whatsnew.fyi/product/rpi-eeprom/releases/v2026.01.09-2711

- **fixed** — Apply rpifwcrypto lock permissions to GET/SET USER OTP mailboxes to prevent access to the device unique private key when locked via lock_device_private_key=1 in config.txt or associated mailbox call
- **changed** — Query all sdram devices for temperature when adjusting refresh
- **added** — Add support for more SDRAM die configurations

Interesting changes since the last release:-

##### 2026-01-09: arm_loader: Apply rpifwcrypto lock permissions GET/SET USER OTP (latest)

* arm_loader: Apply rpifwcrypto lock permissions GET/SET USER OTP
  Previously, the GET/SET user OTP mailboxes would provide access to the
  device unique private key. Update the mailbox API to fail if the
  key has been locked via lock_device_private_key=1 in config.txt or
  the associated mailbox call.
  GET/SET user OTP fails by setting the result tag to the standard
  error code (0x80000000). The dedicate GET/SET private key continue
  to fail the entire mailbox operation to force vcmailbox to exit
  with a non-zero error code.
* Query all sdram devices for temperature when adjusting refresh
* Add support for more SDRAM die configurations.

### v2025.12.08-2711-138c0 — rpi-boot-eeprom-recovery-2025-12-08-2711

- Date: 2025-12-09
- Version: v2025.12.08-2711-138c0
- Original notes: https://github.com/raspberrypi/rpi-eeprom/releases/tag/v2025.12.08-2711-138c0
- Permalink: https://whatsnew.fyi/product/rpi-eeprom/releases/v2025.12.08-2711-138c0

- **added** — arm_loader: Add machine ID derived from OTP values, exposed in device tree as rpi-machine-id
- **fixed** — arm_ldconfig: Avoid double os_prefix on initramfs when using auto_initramfs
- **changed** — recovery: Use OTP rpiboot GPIO if non-zero as default when C(program_rpiboot_gpio) is not specified on config.txt
- **added** — helpers/config_loader: Support bootvar0 eeprom config on Pi4 for conditional expressions in config.txt
- **added** — pi5: Write over-voltage config to the UART log for diagnostic purposes
- **fixed** — Stop partition-walk after boot-mode timeout/retries limit to fix fatal assert with USB boot
- **added** — rpiboot: Extend metadata to report status of recovery operations based on config.txt settings
- **added** — recovery: Restore recovery_wait config.txt option to prevent rename/reboot and flash activity LED on completion

Interesting changes since the last release:- 

##### 2025-12-08: arm_loader: Add machine ID derived from OTP values (latest)

* arm_loader: Add machine ID derived from OTP values
  Machine ID is generated and exposed in device tree as rpi-machine-id
* arm_ldconfig: Avoid double os_prefix on initramfs
  When using auto_initramfs we were picking up prefix from the kernel,
  but also adding os_prefix later:
  fname = prefixed_path(initramfs_file, os_prefix, temp_path, sizeof(temp_path));
  See: https://forums.raspberrypi.com/viewtopic.php?t=394238
* recovery: Use OTP rpiboot GPIO if non-zero
  If an rpiboot GPIO has already been written to OTP then default to
  that value if C(program_rpiboot_gpio) is not specified on config.txt.
* Manufacture test updates for SDRAM.

##### 2025-11-27: helpers/config_loader: Also support bootvar0 eeprom config on Pi4 (latest)

* helpers/config_loader: Also support bootvar0 eeprom config on Pi4
  This allows an eeprom config setting (e.g. BOOTARG0=0x10) to be set on a board
  which config.txt can use as a conditional expression (e.g. [bootarg0&0x10]).
* pi5: Write over-voltage config to the UART log
  Write the high level over-voltage configuration to the UART log for
  diagnostic purposes.
* Stop partition-walk after boot-mode timeout/retries limit
  Fix a fatal assert with USB boot where the partition walk could be
  retried after the USB timeout/retry limit had been reached.
  See: https://github.com/raspberrypi/rpi-eeprom/issues/776
* rpiboot: Extend metadata to report status of operations
  Report success/fail status of recovery operations based on config.txt settings

##### 2025-11-21: recovery: Restore recovery_wait option (latest)

* recovery: Restore recovery_wait option
  Restore the recovery_wait config.txt option. If this option is set
  then recovery.bin will not rename itself or reboot. Instead flash
  the activity LED on completion.
  This option can be useful when creating an SD card to erase the
  EEPROM or program the RPIBOOT gpio on multiple devices.
  If recovery_wait=1 and recovery.bin is run from the SD card then
  indicate success of erase_eeprom=1 or program_rpiboot_gpio=N was
  set instead of requiring the EEPROM to be updated.
* Manufacture test updates for SDRAM.

### v2025.12.08-2712 — rpi-boot-eeprom-recovery-2025-12-08-2712

- Date: 2025-12-09
- Version: v2025.12.08-2712
- Original notes: https://github.com/raspberrypi/rpi-eeprom/releases/tag/v2025.12.08-2712
- Permalink: https://whatsnew.fyi/product/rpi-eeprom/releases/v2025.12.08-2712

- **added** — Add machine ID derived from OTP values and expose it in device tree as rpi-machine-id
- **fixed** — Avoid double os_prefix on initramfs when using auto_initramfs
- **added** — Write over-voltage config to the UART log for diagnostic purposes on pi5
- **fixed** — Stop partition-walk after boot-mode timeout/retries limit to fix fatal assert with USB boot
- **added** — Extend rpiboot metadata to report status of recovery operations based on config.txt settings
- **added** — Restore recovery_wait option to prevent recovery.bin from renaming itself or rebooting and instead flash the activity LED on completion
- **added** — Load RP1 firmware whilst DDR is initialising
- **fixed** — Allow longer overlay file paths by using LDFILEPATH_MAX instead of LDFILENAME_MAX for load_dtoverlay filename variable

Interesting changes since the last release:-

##### 2025-12-08: arm_loader: Add machine ID derived from OTP values (latest)

* arm_loader: Add machine ID derived from OTP values
  Machine ID is generated and exposed in device tree as rpi-machine-id
* arm_ldconfig: Avoid double os_prefix on initramfs
  When using auto_initramfs we were picking up prefix from the kernel,
  but also adding os_prefix later:
  fname = prefixed_path(initramfs_file, os_prefix, temp_path, sizeof(temp_path));
  See: https://forums.raspberrypi.com/viewtopic.php?t=394238

##### 2025-11-27: Stop partition-walk after boot-mode timeout/retries limit (latest)

* pi5: Write over-voltage config to the UART log
  Write the high level over-voltage configuration to the UART log for
  diagnostic purposes.
* Stop partition-walk after boot-mode timeout/retries limit
  Fix a fatal assert with USB boot where the partition walk could be
  retried after the USB timeout/retry limit had been reached.
  See: https://github.com/raspberrypi/rpi-eeprom/issues/776
* rpiboot: Extend metadata to report status of operations
  Report success/fail status of recovery operations based on config.txt settings

##### 2025-11-21: Allow longer overlay file paths (latest)

* recovery: Restore recovery_wait option
  Restore the recovery_wait config.txt option. If this option is set
  then recovery.bin will not rename itself or reboot. Instead flash
  the activity LED on completion.
  This option can be useful when creating an SD card to erase the
  EEPROM or program the RPIBOOT gpio on multiple devices.
  If recovery_wait=1 and recovery.bin is run from the SD card then
  indicate success of erase_eeprom=1 or program_rpiboot_gpio=N was
  set instead of requiring the EEPROM to be updated.
* Load RP1 firmware whilst DDR is initialising
* Allow longer overlay file paths
  load_dtoverlay uses the variable "filename" to hold the full path to an
  overlay. As such it should be declared using LDFILEPATH_MAX, not
  LDFILENAME_MAX.
  See: https://github.com/raspberrypi/firmware/issues/2004

### v2025.11.05-2711-138c0 — rpi-boot-eeprom-recovery-2025-11-05-2711

- Date: 2025-11-10
- Version: v2025.11.05-2711-138c0
- Original notes: https://github.com/raspberrypi/rpi-eeprom/releases/tag/v2025.11.05-2711-138c0
- Permalink: https://whatsnew.fyi/product/rpi-eeprom/releases/v2025.11.05-2711-138c0

- **added** — Add iommu_dma_numa_policy=interleave when needed for iommu dma kernel allocations including buffers allocated for hevc and v3d
- **changed** — Recovery mode now uses ROM boot-mode flag to detect rpiboot mode instead of checking whether the rpiboot usb-device boot driver is initialised
- **fixed** — Fix accidental set of PM_RSTS bit 5 when stopping watchdog that could cause bit 10 to be set and be treated as a request to boot from partition 32
- **added** — Report OTP SDRAM size in gigabits via device-tree as /proc/device-tree/chosen/rpi-sdram-size-gbit
- **changed** — Apply UART_BAUD in early bootsys UART init and update bootsys and fatal error handlers to use the user defined UART_BAUD rate
- **added** — Add support for ECDSA P-256 key generation in rpifwcrypto
- **fixed** — Fix network install regression on Pi4 caused by an issue with ECDSA signature code
- **fixed** — Fix TFTP to allow larger files by allowing TFTP block counter to rollover to 0
- **added** — Add LZ4 decompressor for better compression ratio than CK compress, supporting decompression of both LZ4 and CK compressed files
- **added** — Add GET_CRYPTO_PRIVATE_KEY mailbox API in rpifwcrypto for provisioning that returns the private key in DER format
- **added** — Add support for board_attributes in conditional expressions in config.txt
- **added** — Log the OTP board revision and raw OTP value at startup in board_info
- **fixed** — Fix PARTITION property to allow default (0) partition to be overridden by the bootloader PARTITION property
- **changed** — Enable RPIBOOT in BOOT_ORDER and set-reboot-order to allow rpiboot to be enabled after booting from SPI flash
- **fixed** — Fix PARTITION_WALK for missing start.elf files by adding missing call to bootloader_reset_state
- **changed** — Change force_eeprom_read=0 to disable all HAT I2C probing including any automatic settings of usb_max_current_enable
- **added** — Add support for boot.img ramdisk on Pi3 and earlier by enabling with boot_ramdisk=1 in config.txt
- **added** — Add preliminary firmware support for rpifwcrypto API
- **added** — Add config.txt option lock_device_private_key=1 to block GET_CUSTOMER_PRIVATE_KEY mailbox API
- **changed** — Enable PARTITION_WALK property by default with option to disable by setting PARTITION_WALK=0 in EEPROM config

Interesting changes since the last release:

##### 2025-11-05: Add iommu_dma_numa_policy=interleave when needed (latest)

* arm_loader: Add iommu_dma_numa_policy=interleave when needed
  This applies a similar numa interleave for iommu dma kernel allocations.
  This includes buffers allocated for hevc and v3d.
  See: https://forums.raspberrypi.com/viewtopic.php?t=392666

##### 2025-10-14: recovery: Use ROM boot-mode to detect rpiboot (latest)

* recovery: Use ROM boot-mode flag to detect rpiboot mode
  In recovery-mode use the bootrom register flag to detect the
  original boot-mode rather than looking at whether the rpiboot
  usb-device boot driver is initialised.
* Manufacturing test updates.

##### 2025-10-08: Fix accidental set of PM_RSTS bit 5 when stopping watchdog (latest)

* Fix accidental set of PM_RSTS bit 5 when stopping watchdog
  Fix an issue in the watchdog code where the raw PM_RSTS value
  was used as partition number. If HADWRF (bit 5) was set (on reboot)
  this could cause bit 10 to be set. If an OS didn't clear the partition
  flags on reboot then this could end up being treated as request to
  boot from partition 32.

##### 2025-10-03: arm_dt: Report OTP SDRAM size via device-tree (latest)

* arm_dt: Report OTP SDRAM size via device-tree
  Report the SDRAM in gigabits via device-tree as
  /proc/device-tree/chosen/rpi-sdram-size-gbit. Scripts reporting the
  device-capabilities should use this value (if defined) instead of the
  memory-size field in the boardrev row.
* Apply UART_BAUD in early bootsys UART init
  Update bootsys and fatal error handlers to use the user
  defined UART_BAUD rate.
* rpifwcrypto: Add support for ECDSA P-256 key generation
  Also, slightly improve the entropy by passing the system
  timer value as the personality string.

##### 2025-09-23: Fix network install regression on Pi4 (latest)

* Fix network install regression on Pi4
  Fix an issue with the ECDSA signature code which caused network
  install to fail to load on Pi4.
* Fix TFTP to allow larger files
  Allow TFTP block counter to rollover to 0.
  See: https://github.com/raspberrypi/rpi-eeprom/issues/720

##### 2025-09-22: Add LZ4 decompressor (latest)

* Add LZ4 decompressor
  LZ4 gives a better compression ratio than the previously used CK compress. The bootloader can now decompress both LZ4 compressed files and CK compressed files.
* rpifwcrypto: Add GET_CRYPTO_PRIVATE_KEY mailbox API
  For provisioning, add a new mailbox API which returns the private key
  in DER format. The API will return an error if the key-status for
  the specified key is LOCKED.
* config: Add support for board_attributes in conditional expressions
  Add support for the board-attributes row in config.txt conditional
  expressions. This can be used to change boot behavior for
  Compute Module Lite / No-WiFi etc.
* board_info: Log the OTP board revision at startup
  Log the board revision plus the raw OTP value at startup.

##### 2025-08-27: Fix PARTITION property to allow default (0) partition to be overridden (latest)

* Fix PARTITION property to allow default (0) partition to be overridden
  Fix the partition selection to allow the bootloader PARTITION
  property to override the reboot partition number if the reboot
  argument is 0 or > 31. Previously, it was only allowing
  partition numbers > 31 to be overridden.
  See: https://github.com/raspberrypi/rpi-eeprom/issues/743
* Enable RPIBOOT in BOOT_ORDER / set-reboot-order
  Previously, rpiboot required the bootrom to have initialised
  rpiboot before running the firmware. Update the rpiboot
  initialisation so that rpiboot to be enabled after booting from
  SPI flash.
  This could be selectively enabled by setting BOOT_ORDER property
  (0x3) behind a GPIO conditional in the EEPROM config. On Pi5, the
  set_reboot_order config.txt option or mailbox property can be
  used to set a one-time boot-order on
  N.B. There is n

_[Truncated at 4000 characters — full notes: https://github.com/raspberrypi/rpi-eeprom/releases/tag/v2025.11.05-2711-138c0]_

### v2025.11.05-2712 — rpi-boot-eeprom-recovery-2025-11-05-2712

- Date: 2025-11-10
- Version: v2025.11.05-2712
- Original notes: https://github.com/raspberrypi/rpi-eeprom/releases/tag/v2025.11.05-2712
- Permalink: https://whatsnew.fyi/product/rpi-eeprom/releases/v2025.11.05-2712

- **added** — Add iommu_dma_numa_policy=interleave when needed for iommu dma kernel allocations including hevc and v3d buffers
- **changed** — Rebuild RP1 firmware to reduce size
- **changed** — Enable background refresh on 2712d0 for all SDRAM sizes for minor performance benefit
- **changed** — Update GPT to support 4K native sectors with bootloader logic updated to correctly interpret the GPT layout format
- **changed** — Use ROM boot-mode flag to detect rpiboot mode in recovery mode instead of checking usb-device boot driver initialization
- **fixed** — Fix accidental set of PM_RSTS bit 5 when stopping watchdog that could cause incorrect partition selection
- **added** — Add preliminary support for 4K native sectors with NVMe drives on Pi5
- **added** — Report OTP SDRAM size via device-tree as /proc/device-tree/chosen/rpi-sdram-size-gbit
- **changed** — Apply UART_BAUD in early bootsys UART init and fatal error handlers
- **added** — Add support for ECDSA P-256 key generation in rpifwcrypto
- **fixed** — Fix TFTP to allow larger files by allowing block counter to rollover to 0
- **added** — Add LZ4 decompressor with support for both LZ4 and CK compressed files
- **added** — Add GET_CRYPTO_PRIVATE_KEY mailbox API for provisioning to return private key in DER format
- **added** — Add support for board_attributes in conditional expressions in config.txt
- **changed** — Log the OTP board revision and raw OTP value at startup
- **fixed** — Fix PARTITION property to allow default partition 0 to be overridden by bootloader PARTITION property
- **added** — Enable RPIBOOT in BOOT_ORDER and set-reboot-order for booting from SPI flash
- **changed** — Change force_eeprom_read=0 to disable all HAT I2C probing including automatic usb_max_current_enable settings
- **added** — Add config.txt option lock_device_private_key=1 to block GET_CUSTOMER_PRIVATE_KEY mailbox API
- **changed** — Enable PARTITION_WALK property by default to search for bootable partitions after failure

Interesting changes since the last release:

##### 2025-11-05: arm_loader: Add iommu_dma_numa_policy=interleave when needed (latest)

* arm_loader: Add iommu_dma_numa_policy=interleave when needed
  This applies a similar numa interleave for iommu dma kernel allocations.
  This includes buffers allocated for hevc and v3d.
  See: https://forums.raspberrypi.com/viewtopic.php?t=392666
* Rebuild RP1 firmware to reduce size.

##### 2025-10-17: Enable background refresh on 2712d0 for all SDRAM sizes (latest)

* 2712d0: Enable background refresh on 2712d0 for all SDRAM sizes
  This provides a minor performance benefit.
* Update GPT to support 4K native sectors
  Bootloader logic updated to correctly interpret the GPT layout format specific to 4K native sector drives.
* recovery: Use ROM boot-mode flag to detect rpiboot mode
  In recovery-mode use the bootrom register flag to detect the
  original boot-mode rather than looking at whether the rpiboot
  usb-device boot driver is initialised.

##### 2025-10-08: Fix accidental set of PM_RSTS bit 5 when stopping watchdog (latest)

* Fix accidental set of PM_RSTS bit 5 when stopping watchdog
  Fix an issue in the watchdog code where the raw PM_RSTS value
  was used as partition number. If HADWRF (bit 5) was set (on reboot)
  this could cause bit 10 to be set. If an OS didn't clear the partition
  flags on reboot then this could end up being treated as request to
  boot from partition 32.
* pi5: Preliminary support for 4K native sectors with NVMe drives
  Pi5 now supports 4K native sector NVMe drives. 
  This allows booting from drives with logical block size 4096, 
  while 512B drives remain compatible. With 4K sectors, storage density 
  increases along with improved reliability and efficiency.
  N.B. USB boot still requires a 512 byte sector size and there are
  no RPi OS disk images with a 4K sector format.
  See: https://github.com/raspberrypi/rpi-eeprom/issues/577
* arm_dt: Report OTP SDRAM size via device-tree
  Report the SDRAM in gigabits via device-tree as
  /proc/device-tree/chosen/rpi-sdram-size-gbit. Scripts reporting the
  device-capabilities should use this value (if defined) instead of the
  memory-size field in the boardrev row.

##### 2025-09-25: Apply UART_BAUD in early bootsys UART init (latest)

* Apply UART_BAUD in early bootsys UART init
  Update bootsys and fatal error handlers to use the user
  defined UART_BAUD rate.
* rpifwcrypto: Add support for ECDSA P-256 key generation

##### 2025-09-23: Fix TFTP to allow larger files (latest)

* Fix TFTP to allow larger files
  Allow TFTP block counter to rollover to 0.
  See: https://github.com/raspberrypi/rpi-eeprom/issues/720

##### 2025-09-22: Add LZ4 decompressor (latest)

* Add LZ4 decompressor
  LZ4 gives a better compression ratio than the previously used CK compress. The bootloader can now decompress both LZ4 compressed files and CK compressed files.
* rpifwcrypto: Add GET_CRYPTO_PRIVATE_KEY mailbox API
  For provisioning, add a new mailbox API which returns the private key
  in DER format. The API will return an error if the key-status for
  the specified key is LOCKED.
* config: Add support for board_attributes in conditional expressions
  Add support for the board-attributes row in config.txt conditional
  expressions. This can be used to change boot behavior for
  Compute Module Lite / No-WiFi etc.
* board_info: Log the OTP board revision at startup
  Log the board revision plus the raw OTP value at startup.

##### 2025-08-27: Fix PARTITION property to allow default (0) partition to be overridden (latest)

* Fix PARTITION property to allow default (0) partition to be overridden
  Fix the partition selection to allow the bootloader PARTITION
  property to override the reboot partition number if the reboot
  argument is 0 or > 31. Previously, it was only allowing
  partition numbers > 31 to be overridden.
  See: https://github.com/raspberr

_[Truncated at 4000 characters — full notes: https://github.com/raspberrypi/rpi-eeprom/releases/tag/v2025.11.05-2712]_

### v2025.05.08-2711-138c0 — rpi-boot-eeprom-recovery-2025-05-08-vl805-000138c0

- Date: 2025-05-14
- Version: v2025.05.08-2711-138c0
- Original notes: https://github.com/raspberrypi/rpi-eeprom/releases/tag/v2025.05.08-2711-138c0
- Permalink: https://whatsnew.fyi/product/rpi-eeprom/releases/v2025.05.08-2711-138c0

- **fixed** — HTTP boot mode is now only disabled if signed boot is enabled and using the default HOST, allowing custom CA certificates to work with signed boot
- **added** — Implement TCP window for net boot to cache out-of-order packets and improve performance when packet loss occurs
- **fixed** — Correct the TCP MSS for netboot
- **fixed** — Correct fractional seconds display in UART debug timestamps to show tenths and hundredths instead of hundredths and thousandths

Interesting changes since the last release:

* Signed boot and HTTP boot mode
  HTTP boot mode is supposed to be disabled if signed boot is enabled and
  a host is not specified. The code is checking the http_secure flag to
  enforce this. But this is valid now we support custom CA certs.
  Only disable HTTP mode if we're using the default HOST.
* Implement TCP window for net boot
  The minimal IP stack used for https booting lacks the ability to cache
  packets received out of order, which can lead to severe slowdown when
  it happens. The problem seems to affect some ISPs more than others.
  The receive window implemented here copes with packet losses of 10%.
* netboot: Correct the TCP MSS
* Correct msecs in debug timestamps
  The fractional part of timestamps in UART debug output was showing the
  100ths and 1000ths of a second, rather than 10ths and 100ths, causing
  strange sequences that appear to jump backwards.

### v2025.05.08-2712 — rpi-boot-eeprom-recovery-2025-05-08-2712

- Date: 2025-05-14
- Version: v2025.05.08-2712
- Original notes: https://github.com/raspberrypi/rpi-eeprom/releases/tag/v2025.05.08-2712
- Permalink: https://whatsnew.fyi/product/rpi-eeprom/releases/v2025.05.08-2712

Interesting changes since the last release:

* arm_loader: Correct some mailbox response lengths
  The GET_GENCMD_RESULT mailbox handler was setting the wrong response
  length, and GET_FIRMWARE_COMMIT_HASH and GET_FIRMWARE_VARIANT were not
  setting any length.
  See: https://github.com/raspberrypi/firmware/issues/1968
* Signed boot and HTTP boot mode
  HTTP boot mode is supposed to be disabled if signed boot is enabled and
  a host is not specified. The code is checking the http_secure flag to
  enforce this. But this is valid now we support custom CA certs.
  Only disable HTTP mode if we're using the default HOST.
* Implement TCP window for net boot
  The minimal IP stack used for https booting lacks the ability to cache
  packets received out of order, which can lead to severe slowdown when
  it happens. The problem seems to affect some ISPs more than others.
  The receive window implemented here copes with packet losses of 10%.
* netboot: Correct the TCP MSS
* rp1_net: Overwrite the length field
  Although concise, ORing in the packet length runs the risk of leaving
  some unwanted bits set. Ensure the length field is cleared before
  ORing in the required value.
* Correct msecs in debug timestamps
  The fractional part of timestamps in UART debug output was showing the
  100ths and 1000ths of a second, rather than 10ths and 100ths, causing
  strange sequences that appear to jump backwards.
* Implement GET_BOARD_MAC_ADDRESS on Pi5
  The Pi 5 EEPROM implements a subset of the original mailbox properties.
  Add GET_BOARD_MAC_ADDRESS to the subset.
  See: https://github.com/raspberrypi/rpi-eeprom/issues/698
* Ensure the initramfs matches the kernel
  As far as is possible, both the kernel and initramfs are matched to the
  device. However, where multiple kernel variants can run on a device, the
  initramfs must be matched to the chosen kernel. Make that the sole rule
  for initramfs selection, rather than duplicating the device matching
  logic.
  See: https://github.com/raspberrypi/firmware/issues/1965
* Enable logging messages from OS loader
  Pi 5 EEPROM builds were missing the output from the main OS loading
  function, including some important diagnostics. Enabling the logging
  output from this loader code results in some near-duplicates, but is
  more user friendly and is available via "sudo vclog -m".
* arm_dt: Revert to using the max fan speed
  It has been reported that the presence of a cooling fan at boot time
  can lead to a maximum observed fan speed of ~300 but a current speed
  of 0. The absence of a fan results in 0s for both metrics.
  See: https://github.com/raspberrypi/rpi-eeprom/issues/690
* os_check: cm5: Check for CM5 specific dtbs
  Check for BCM2712 support in bcm2712-rpi-cm5-cm5io.dtb
  or bcm2712-rpi-cm5l-cm5io.dtb on CM5 instead of bcm2712-rpi-5-b.dtb.
  This avoids needing to put os_check=1 or specifying device_tree
  in config.txt in minimal images for CM5.
  See: https://github.com/raspberrypi/rpi-eeprom/issues/682
* Log the fan speed at boot
  Record the fan RPM (and the maximum seen) during boot, so that it is
  accessible using "sudo vclog -m".
  See: https://github.com/raspberrypi/rpi-eeprom/issues/678
* Add current_supply to HAT+ support
  Refactor the HAT library to make it more self-contained, and combine
  the I2C address detection and the reading of the EEPROM contents.
  Use it to allow the earlier boot stages to check for a current_supply
  setting in the EEPROM of a normal (non-stackable) HAT+.

### v2025.03.10-2712 — rpi-boot-eeprom-recovery-2025-03-10-2712

- Date: 2025-03-26
- Version: v2025.03.10-2712
- Original notes: https://github.com/raspberrypi/rpi-eeprom/releases/tag/v2025.03.10-2712
- Permalink: https://whatsnew.fyi/product/rpi-eeprom/releases/v2025.03.10-2712

Interesting changes since the last release:- 

- Log the fan speed at boot
- Add current_supply to HAT+ support
-  Update SDRAM init timings to intermittent 8-flash SDRAM init errors on some boards.
    See: https://github.com/raspberrypi/rpi-eeprom/issues/67
- config_loader: Add support [boot_partition=N] as an expression filter
- Fix missing initialisation of selected_expr to 1 in config.txt
- Fix BCM2712 GPIO pull configuration on 2712D0
- Disable UARTA for CM5s without WiFi
- recovery: Walk partitions to delete recovery.bin