Progress with booting from RPi5 loader packaged like RPi5 expects a linux kernel.

Problems booting FreeBSD on RPi5 without ACPI emulation using only DeviceTree seem solved. Remaining problems are hardware support in this loader for things like USB HID and block devices, NVMe, graphics console. These are all things that EDK2 had been helping with, but need some more low level initialization before loader can use them.

After this weekend's Claude babysitting sessions, I can boot my 16GB RPi5 without EDK2 or UBoot to FreeBSD 16 single user via serial console mounting root from a SDCard UFS partition. Support for a UFS image embedded in the bootable loader.bin to provide MFS root (and /stand for installer and recovery and embedded systems support) is also working but not illustrated here. Next weekend I will work some more, and will try to get a testable branch pushed in case anyone else wants to get their hands dirty. I'm especially concerned about the firmware bootloader version differences (for another thread).

Claude annotated and abridged the boot log for the curious...

===============================================================================
FreeBSD on a Raspberry Pi 5 with no EDK2, no EFI, no ACPI and no PCIe
Serial console capture, 2026-09-21, dunn
===============================================================================

Boot chain:

VPU firmware -> rpiboot.bin -> RPI5-FDT-NORP1 kernel -> root shell
(stand/arm64/rpiboot)

Selected by a jumper from GPIO4 (header pin 7) to ground (pin 9), which picks
the [gpio4=0] section of config.txt:

[gpio4=0]
device_tree_address=0x4000000
device_tree_end=0x4100000
kernel=rpiboot.bin
os_check=0
force_turbo=0

Software under test:
loader stand/arm64/rpiboot @ b0dc6dd98221 (FreeBSD aphor/RPi5_FDT_loader)
kernel RPI5-FDT-NORP1 @ 382fdc6d68b4, stripped, 12,448,080 bytes,
carried inside the loader binary as a 14 MiB UFS memory disk
image rpiboot.bin, 14,904,608 bytes on the firmware FAT partition

-------------------------------------------------------------------------------
WHAT WAS EDITED OUT OF THIS CAPTURE
-------------------------------------------------------------------------------

This is a real capture, not a reconstruction. The following were removed or
collapsed for readability, and nothing else was changed:

* ANSI escape sequences and the loader's spinner (the |/-\ backspace
animation), which are unreadable in a text file.
* Doubled carriage returns from the console being in CR line-ending mode.
* 72 identical pairs of

clk_fixed8: Cannot FDT parameters.
device_attach: clk_fixed8 attach returned 6

(12 pairs) and the clk_fixed10 equivalent (60 pairs), 144 lines in all.
Marked below as [... N pairs elided ...].
* 5 identical 4-line gpioregulator0 failures, 20 lines, likewise marked.
* One of the two identical 17-line WITNESS stack backtraces from the two
sdhci attaches; the first is kept in full, the second noted.
* USB-PD power-delivery negotiation and HDMI EDID hex dumps from the
firmware stage, which say nothing about this boot path.

The elided clock and regulator failures are explained at the end; they are
failed attaches rather than faults.

===============================================================================
STAGE 1 -- VPU firmware
===============================================================================

0.95 RPi: BOOTSYS release VERSION:5855b10b DATE: 2025/06/13 TIME: 10:39:26
0.96 AON_RESET: 00000003 PM_RSTS 00001000
0.96 POWER_OFF_ON_HALT: 0 WAIT_FOR_POWER_BUTTON 0 power-on-reset 1
0.97 RP1_BOOT chip ID: 0x20001927
1.00 Initialising SDRAM rank 2 total-size: 128 Gbit 4267 (0x1b 0x1b)
2.81 OTP boardrev e04171 bootrom a a
3.48 RP1_BOOT: fw size 46888
4.12 PCI2 init
4.12 PCI2 reset
4.16 PCIe scan 00001de4:00000001
4.17 RPi: BOOTLOADER release VERSION:5855b10b DATE: 2025/06/13 TIME: 10:39:26
4.23 Boot mode: SD (01) order f46
[... USB-PD negotiation and xHCI probe elided ...]
9.34 SD HOST: 200000000 CTL0: 0x00800000 BUS: 400000 Hz actual: 390625 HZ div: 512 (256)
9.52 OCR c0ff8000 [247]
CID: 00035344534433324785d410bb46019b
CSD: 400e00325b590000edc87f800a404000
9.53 SD: bus-width: 4 spec: 2 SCR: 0x02358043 0x00000000
9.54 SD HOST: 200000000 CTL0: 0x00800f04 BUS: 50000000 Hz actual: 50000000 HZ div: 4 (2)
9.55 MBR: 0x00000800, 102400 type: 0x0c
9.55 MBR: 0x00019800,62228480 type: 0xa5
9.75 Read config.txt bytes 2750 hnd 0x1b34
10.16 gpio4 0=0 <-- jumper grounded: Model K section taken
10.16 gpio4 1=0 <-- so the EDK2 section is skipped
10.37 MESS: Initial voltage 800000 temp 26838
10.78 MESS: dtb_file 'bcm2712-rpi-5-b.dtb'
10.78 Loading 'bcm2712-rpi-5-b.dtb' to 0x00000000 offset 0x4000000
10.96 Read bcm2712-rpi-5-b.dtb bytes 78377 hnd 0x1c89
11.01 MESS: Loaded overlay 'bcm2712d0' <-- firmware merges overlays itself
11.68 MESS: RPM 6612, max RPM 6612
11.90 BMD "armstub8-2712.bin" not found <-- no armstub=, so the built-in one
11.91 Loading 'rpiboot.bin' to 0x00000000 offset 0x200000
12.02 Read rpiboot.bin bytes 14904608 hnd 0x19dd
12.70 MESS: Device tree loaded to 0x4000000 (size 0x13834)
12.71 PCI1 reset <-- PCIe left un-enumerated on handoff
12.72 PCI2 reset
13.00 MESS: Starting OS 13003 ms

NOTICE: BL31: v2.6(release):v2.6-240-gfc45bc492
NOTICE: BL31: Built : 12:55:13, Dec 4 2024

Note: this BL31 is the VPU firmware's own. The EDK2 lane gets v2.10.0 from
inside RPI_EFI.fd instead.

===============================================================================
STAGE 2 -- FreeBSD loader (stand/arm64/rpiboot)
===============================================================================

Consoles: PL011 serial port

FreeBSD/aarch64 Raspberry Pi 5 loader, Revision 0.1
(Sun Sep 20 20:35:23 CDT 2026 root@beastie)

Entered from the Raspberry Pi VPU firmware, no EFI.
Exception level: EL2
Load address: 0x200000
Device tree: 0x4000000 (from x0)
Loader end: 0x10487c0
Heap: 0x8000000 + 48 MiB
PSCI: v1.1 via smc (reboot available)
Found device: md

/boot/loader.rc, read out of the embedded memory disk, echoed as it runs:

> set autoboot_delay=NO
> echo RPI5-FDT-NORP1 kernel is at /boot/kernel/kernel on md0:.
RPI5-FDT-NORP1 kernel is at /boot/kernel/kernel on md0:.
> echo Autoboot is off on purpose: a kernel that panics on this lane cannot
Autoboot is off on purpose: a kernel that panics on this lane cannot
> echo reset the board, because its cpu_reset needs a psci0 that has not
reset the board, because its cpu_reset needs a psci0 that has not
> echo attached yet. Type boot when ready, or reboot to reset cleanly.
attached yet. Type boot when ready, or reboot to reset cleanly.

Type '?' for a list of commands, 'help' for more detailed help.

The next two lines are the only typed input in this capture. The root device
is given by hand because nothing has put it in the memory disk's loader.rc
yet; autoboot is deliberately off so a bad kernel cannot strand the board.

OK set vfs.root.mountfrom=ufs:/dev/sdda0s2a
OK boot
/boot/kernel/kernel text=0x318 text=0x871e80 text=0x22f990 data=0x12c6d0 data=0x0+0x31e000
Using DTB provided by the VPU firmware at 0x4000000.
Jumping to kernel entry 0x10000800 (module 0xffff000000000800), modulep 0xffff000000f11000
Flushing D-cache 0x10000000 + 0xf1b000 and invalidating I-cache.

Reading those three lines:
* the kernel came out of md0: and was staged at 0x10000000;
* entry 0x10000800 is the staging base plus the low bits of the kernel's
e_entry 0xffff000000000800, so the staging translation is right;
* modulep is passed ABOVE KERNBASE and untranslated, which is what
sys/arm64/arm64/locore.S discriminates on.

===============================================================================
STAGE 3 -- kernel
===============================================================================

---<<BOOT>>---
GDB: no debug ports present
KDB: debugger backends: ddb
KDB: current backend: ddb
WARNING: Cannot find freebsd,dts-version property, cannot check DTB compliance
Copyright (c) 1992-2026 The FreeBSD Project.
FreeBSD 16.0-CURRENT #0 aphor/RPi5_FDT_loader-n289176-b0dc6dd98221: Sun Sep 20 22:53:01 CDT 2026
root@beastie:/usr/obj/usr/src/arm64.aarch64/sys/RPI5-FDT-NORP1 arm64
WARNING: WITNESS option enabled, expect reduced performance.
VT: init without driver.
real memory = 17167282176 (16371 MB)
avail memory = 16779100160 (16001 MB)
Starting CPU 1 (100)
Starting CPU 2 (200)
Starting CPU 3 (300)
FreeBSD/SMP: Multiprocessor System Detected: 4 CPUs

real memory 17,167,282,176 against the 17,167,286,272 that probe-k measured
as the sum of /memory@0 -- one page apart. There is no EFI memory map
anywhere in this system; initarm() took memory from the device tree.

random: entropy device external interface
kbd0 at kbdmux0
ofwbus0: <Open Firmware Device Tree> <-- FDT enumeration, not ACPI
ofw_clkbus0: <OFW clocks bus> on ofwbus0
[... 12 clk_fixed8 pairs elided ...]
simplebus0: <Flattened device tree simple bus> on ofwbus0
regfix0: <Fixed Regulator> on simplebus0
regfix1: <Fixed Regulator> on simplebus0
simplebus1: <Flattened device tree simple bus> on ofwbus0
regfix2..regfix7: <Fixed Regulator> on ofwbus0
[... 6 clk_fixed10 pairs elided ...]
simple_mfd0: <Simple MFD (Multi-Functions Device)> mem 0x7d542000-0x7d542eff on simplebus0
simple_mfd1: <Simple MFD (Multi-Functions Device)> on simplebus0
ofw_clkbus1: <OFW clocks bus> on simple_mfd1
simple_mfd2: <Simple MFD (Multi-Functions Device)> mem 0x1000400018-0x100040002f on simplebus1
simple_mfd3: <Simple MFD (Multi-Functions Device)> on ofwbus0
[... 6 clk_fixed10 pairs elided ...]
psci0: <ARM Power State Co-ordination Interface Driver> on ofwbus0
smccc0: <ARM SMCCC v1.2> on psci0
[... 6 clk_fixed10 pairs elided ...]
cpulist0: <Open Firmware CPU Group> on ofwbus0
cpu0: <Open Firmware CPU> on cpulist0
[... 6 clk_fixed10 pairs elided ...]
gic0: <ARM Generic Interrupt Controller> mem 0x7fff9000-0x7fff9fff,0x7fffa000-0x7fffbfff,0x7fffc000-0x7fffdfff,0x7fffe000-0x7fffffff irq 21 on simplebus0
gic0: pn 0x2, arch 0x2, rev 0x1, implementer 0x43b irqs 320
[... 12 clk_fixed10 pairs and 1 gpioregulator0 failure elided ...]
generic_timer0: <ARMv8 Generic Timer> irq 0,1,2,3,4 on ofwbus0
Timecounter "ARM MPCore Timecounter" frequency 54000000 Hz quality 1000
Event timer "ARM MPCore Eventtimer" frequency 54000000 Hz quality 1000
[... 18 clk_fixed10 pairs and 3 gpioregulator0 failures elided ...]
usb_nop_xceiv0: <USB NOP PHY> on ofwbus0
[... 6 clk_fixed10 pairs and 1 gpioregulator0 failure elided ...]
sdhci_bcm27120: <BCM2712 SD/SDIO controller> mem 0xfff000-0xfff25f,0xfff400-0xfff5ff irq 13 on simplebus0
uma_zalloc_debug: zone "malloc-2048" with the following non-sleepable locks held:
exclusive sleep mutex SD slot mtx (sdhci) r = 0 locked @ /usr/src/sys/dev/sdhci/sdhci.c:688
stack backtrace:
#0 witness_checkorder+0x1028
#1 witness_warn+0x494
#2 uma_zfree_arg+0x2fc
#3 uma_zalloc_arg+0x30
#4 malloc+0xa4
#5 xpt_alloc_ccb+0x1c
#6 mmccam_start_discovery+0x1c
#7 sdhci_generic_switch_vccq+0x44c
#8 generic_xhci_detach+0x580
#9 device_attach+0x4cc
#10..#13 bus_generic_new_pass
#14 root_bus_configure+0x44
#15 mi_startup+0x1ec
#16 _start+0x9c

A WITNESS complaint, not a failure: sdhci_card_task() calls
mmccam_start_discovery() with the slot mutex held and that allocates. It
appears identically on the ACPI lane, so it is pre-existing and unrelated to
this boot path. The symbol names above #7 look wrong because this kernel is
stripped and the addresses resolve to the nearest exported symbol.

uart0: <PrimeCell UART (PL011)> mem 0x7d001000-0x7d0011ff irq 19 on simplebus0
uart0: console (115200,n,8,1)
sdhci_bcm27121: <BCM2712 SD/SDIO controller> mem 0x1001100000-0x100110025f,0x1001100400-0x10011005ff irq 69 on simplebus1
[... second identical WITNESS backtrace elided ...]
pmu0: <Performance Monitoring Unit> irq 8,9,10,11 on ofwbus0
gpioled0: <GPIO LEDs> on ofwbus0
gpioled0: <PWR> failed to map pin
gpioled0: <ACT> failed to map pin
[... 1 gpioregulator0 failure elided ...]
armv8crypto0: <AES-CBC,AES-XTS,AES-GCM>
Timecounters tick every 1.000 msec
usb_needs_explore_all: no devclass
CPU 0: ARM Cortex-A76 r4p1 affinity: 0 0
[... CPU feature dump elided ...]
CPU 1: ARM Cortex-A76 r4p1 affinity: 1 0
CPU 2: ARM Cortex-A76 r4p1 affinity: 2 0
CPU 3: ARM Cortex-A76 r4p1 affinity: 3 0
gic0: using for IPIs
Release APs...done

===============================================================================
STAGE 4 -- root filesystem and userland
===============================================================================

Trying to mount root from ufs:/dev/sdda0s2a []...
mountroot: waiting for device /dev/sdda0s2a...
sdda0 at sdhci_slot0 bus 0 scbus0 target 0 lun 0
sdda0: Relative addr: 0000aaaa
Card features: <Memory High-Capacity SD2.0-Conditions 1.8-Signaling>
Card memory OCR: 40ff8000
sdda0: Serial Number D410BB46
sdda0: SDHC SD32G 8.5 SN D410BB46 MFG 11/2025 by 3 SD
Warning: no time-of-day clock registered, system time will not be set accurately
Setting hostuuid: 2ecb2d2b-6c27-43ee-a133-647c89439fe0.
Starting file system checks:
/dev/sdda0s2a: FILE SYSTEM CLEAN; SKIPPING CHECKS
/dev/sdda0s2a: clean, 6458591 free (559 frags, 807254 blocks, 0.0% fragmentation)
Mounting local filesystems:.
random: unblocking device.
ELF ldconfig path: /lib /usr/lib /usr/lib/compat
Setting hostname: dunn.
Starting autounmountd.
Feeding entropy: .
ifconfig: SIOCIFCREATE2 (wlan0): Device not configured
lo0: link state changed to UP
Starting Network: lo0.
Starting devd.
Creating and/or trimming log files.
Starting syslogd.
Starting automountd.
Mounting late filesystems:.
Performing sanity check on sshd configuration.
Starting sshd.
Starting cron.
Starting background file system checks in 60 seconds.

FreeBSD/arm64 (dunn) (ttyu0)

FreeBSD 16.0-CURRENT (RPI5-FDT-NORP1) #0 aphor/RPi5_FDT_loader-n289176-b0dc6dd98221

*** dunn -- SD /stand lane ***

root@dunn:~ #

The SD card's serial number, D410BB46, is the same one the ACPI lane reports
and the same one the loader's own SDHCI driver decoded out of the CID. Three
independent implementations, one card.

===============================================================================
VERIFICATION FROM THE RUNNING SYSTEM
===============================================================================

# uname -i
RPI5-FDT-NORP1
# sysctl -n machdep.acpi_root
sysctl: unknown oid 'machdep.acpi_root' <-- ACPI genuinely absent
# sysctl -n kern.vm_guest hw.ncpu hw.physmem
none
4
17148604416
# mount
/dev/sdda0s2a on / (ufs, local, soft-updates, journaled soft-updates)
devfs on /dev (devfs)
# sysctl -n dev.sdhci_bcm2712.0.%desc
BCM2712 SD/SDIO controller

machdep.acpi_root returning "unknown oid" is the decisive check: the sysctl
exists only when bus_probe() in sys/arm64/arm64/machdep.c selects
ARM64_BUS_ACPI. Its absence means FDT enumeration, not a preference for it.

===============================================================================
WHAT IS NOT WORKING, AND WHY
===============================================================================

Everything below traces to one fact visible in stage 1: the firmware issues
PCI1 reset and PCI2 reset immediately before handing over, leaving the PCIe
host bridge un-enumerated with no outbound windows. RP1 sits behind PCIe. On
the EDK2 lane, EDK2 programs the bridge before the kernel runs.

no Ethernet rp1_eth is an RP1 device
no USB both xHCI controllers are behind PCIe
no NVMe behind PCIe
no GPIO or PWM RP1
no fan control and no temperature reading
the AVS sensor at 0x107d542000 IS native and works, but
it is reached through the bcm2712 driver, which had to
be removed along with the RP1 drivers
no real-time clock the ACPI lane gets efirtc0 from EFI runtime services;
there are none here, hence the time-of-day warning and
the clock reading Sep 20 12:10 on an actual Sep 21
no wlan0 cyw is in the configuration and its SDIO controller
attached as sdhci_bcm27121, but no cyw0 appeared. That
controller is native, so this one is worth a look.

The elided clk_fixed and gpioregulator failures are the same story: the vendor
device tree describes clocks, regulators and LEDs whose provider is RP1 GPIO,
which is absent, so they fail to attach. Failed attaches, not faults -- but
144 lines of them bury the useful output, and they should go quiet once a PCIe
host driver exists.

An RPI5-FDT kernel WITH the RP1 drivers panics on this lane:

rp1_pcie2_recon: PCIe2 mapped at phys 0x1000120000
esr: 0x00000000be000011
panic: Unhandled System Error

preceded by every RP1 register read returning 0xdeaddead. RPI5-FDT-NORP1
exists to take those drivers out of the way so the rest could be measured.===============================================================================

---
JTM