Fix GPIO offset in BT/WL fixup script and EEPROM update and other SB related changes

layers/meta-balena-raspberrypi/recipes-bsp/bootfiles/rpi-config_git.bbappend

@@ -45,6 +45,8 @@ do_deploy:append:revpi-connect-4() {
 
 do_deploy:append:raspberrypicm4-ioboard-sb() {
     echo "dtoverlay=dwc2,dr_mode=host" >> ${DEPLOYDIR}/bootfiles/config.txt
+    # Remap audio pins to free GPIOs 40/41 for SPI0 EEPROM programming
+    echo "dtoverlay=audremap" >> ${DEPLOYDIR}/bootfiles/config.txt
 }
 
 do_deploy:append:raspberrypi3-unipi-neuron() {

layers/meta-balena-raspberrypi/recipes-core/images/balena-image-initramfs.bbappend

@@ -1,7 +1,7 @@
 PACKAGE_INSTALL:remove:revpi = "initramfs-module-migrate"
 
 PACKAGE_INSTALL:append:raspberrypicm4-ioboard-sb = " initramfs-module-kexec-pi4-fwgpio"
-IMAGE_ROOTFS_MAXSIZE:raspberrypicm4-ioboard-sb = "51200"
+IMAGE_ROOTFS_MAXSIZE:raspberrypicm4-ioboard-sb = "65536"
 
 # increase initramfs maxsize to 40 MiB
 IMAGE_ROOTFS_MAXSIZE:raspberrypi5 = "40960"

layers/meta-balena-raspberrypi/recipes-core/images/balena-image.inc

@@ -20,7 +20,7 @@ IMAGE_ROOTFS_SIZE:raspberrypi5="655360"
 BALENA_BOOT_SIZE:raspberrypi5="81920"
 
 # Increase boot partition size
-BALENA_BOOT_SIZE:raspberrypicm4-ioboard-sb = "131072"
+BALENA_BOOT_SIZE:raspberrypicm4-ioboard-sb = "174080"
 
 # Increase Root File system size
 IMAGE_ROOTFS_SIZE:revpi-connect-s ?= "319488"
@@ -124,7 +124,7 @@ RPI_KERNEL_DEVICETREE:remove:revpi = "bcm2708-rpi-zero-w.dtb bcm2710-rpi-3-b-plu
 
 # this being a pi4 based board, increase to 400 MiB (up from 320 MiB) to make sure we have enough space in the rootfs
 IMAGE_ROOTFS_SIZE:raspberrypi4-superhub="409600"
-IMAGE_ROOTFS_SIZE:raspberrypicm4-ioboard-sb="409600"
+IMAGE_ROOTFS_SIZE:raspberrypicm4-ioboard-sb="655360"
 
 IMAGE_INSTALL:append:raspberrypi4-superhub = " \
     phoenix-peripheral \

layers/meta-balena-raspberrypi/recipes-core/initrdscripts/files/cryptsetup-rpi

@@ -16,16 +16,23 @@ wait4file "/dev/disk/by-state" "50"
 BALENA_NONENC_BOOT_DEV=""
 
 cryptsetup_enabled() {
+    if ! is_secured; then
+      info "Won't attempt to decrypt drives because secure boot is not enabled"
+      return 1
+    fi
+
     # Flasher should not try to unlock the partitions
     if [ "$bootparam_flasher" = "true" ]; then
+        # Booting flasher on a locked and encrypted device
+        # Erase GPT for extra security
+        if [ -L /dev/disk/by-label/${BALENA_NONENC_BOOT_LABEL} ]; then
+            info "Flasher requested on locked device"
+            _internal_dev=$(lsblk -nlo pkname,label | grep "${BALENA_NONENC_BOOT_LABEL}" | awk '{print $1}')
+            erase_disk "${_internal_dev}"
+        fi
         return 1
     fi
 
-    # Ensure that secure boot is enabled and device is locked
-    if ! is_secured; then
-      fail "Device not locked - boot aborted"
-    fi
-
     BALENA_NONENC_BOOT_DEV=$(get_state_path_from_label @@BALENA_NONENC_BOOT_LABEL@@)
     # Only run if the boot partition is split
     if [ ! -e "$BALENA_NONENC_BOOT_DEV" ]; then
@@ -42,6 +49,9 @@ cryptsetup_enabled() {
 
 cryptsetup_run() {
     TMP_MOUNT_DIR=$(mktemp -d)
+
+    boot_part_assert
+
     mount "$BALENA_NONENC_BOOT_DEV" "$TMP_MOUNT_DIR"
 
     PASSPHRASE_FILE=$(mktemp -u)
@@ -50,6 +60,8 @@ cryptsetup_run() {
         fail "Failed to decrypt LUKS passphrase"
     fi
 
+    luks_parts_premount_assert
+
     BOOT_DEVICE=$(lsblk -nlo pkname "${BALENA_NONENC_BOOT_DEV}")
 
     # Unlock all the partitions - cryptsetup luksOpen does not wait for udev processing
@@ -67,6 +79,8 @@ cryptsetup_run() {
         wait4udev "/dev/mapper/${DM_NAME}"
     done
 
+    luks_parts_postmount_assert
+
     rm -f "$PASSPHRASE_FILE"
     umount "$TMP_MOUNT_DIR"
     rmdir "$TMP_MOUNT_DIR"

layers/meta-balena-raspberrypi/recipes-core/initrdscripts/files/kexec_pi4_fwgpio

@@ -32,7 +32,7 @@ kexec_pi4_fwgpio_run() {
 
     GPIO_SYSFS_DIR="/sys/class/gpio"
 
-    FW_GPIO_BASE="504"
+    FW_GPIO_BASE="570"
     BT_ON="0"
     WL_ON="1"