Commit a7d4ec490646970916fbfd0b6dbfa20fe461370e
Committed by
GitHub
GitHub
Merge pull request #108 from timg236/secure-boot-revoke-devkey
bootloader: Enable revoke_devkey in secure-boot recovery.bin
Showing
5 changed files
with
6 additions
and
4 deletions
Readme.md
| ... | ... | @@ -63,8 +63,10 @@ On Compute Module 4 EMMC-DISABLE / nRPIBOOT (GPIO 40) must be fitted to switch t |
| 63 | 63 | Otherwise, the SPI EEPROM bootloader image will be loaded instead. |
| 64 | 64 | |
| 65 | 65 | <a name="secure-boot"></a> |
| 66 | -## Secure Boot - BETA | |
| 67 | -Secure Boot is currently a BETA release feature and the functionality to permanently enable secure-boot via OTP is not enabled in this release. | |
| 66 | +## Secure Boot | |
| 67 | +Secure Boot requires the latest stable bootloader image. | |
| 68 | +WARNING: If the `revoke_devkey` option is used to revoke the ROM development key then it will | |
| 69 | +not be possible to downgrade to a bootloader older than 2022-01-06 OR disable secure-boot mode. | |
| 68 | 70 | |
| 69 | 71 | ### Host setup |
| 70 | 72 | Secure boot require a 2048 bit RSA asymmetric keypair and the Python `pycrytodomex` module to sign the EEPROM config and boot image. | ... | ... |
secure-boot-msd/bootcode4.bin
No preview for this file type
secure-boot-recovery/README.md
| ... | ... | @@ -81,8 +81,8 @@ To enable this edit the `config.txt` file in this directory and set |
| 81 | 81 | |
| 82 | 82 | * `program_pubkey` - If 1, write the hash of the customer's public key to OTP. |
| 83 | 83 | * `revoke_devkey` - If 1, revoke the ROM bootloader development key which |
| 84 | - requires secure-boot mode and prevents downgrades to bootloader versions that | |
| 85 | - don't support secure boot. | |
| 84 | + requires secure-boot mode and prevents downgrades to bootloader versions that | |
| 85 | + don't support secure boot. | |
| 86 | 86 | |
| 87 | 87 | ** DO NOT SET THIS `revoke_devkey` UNTIL THE BOOTLOADER IS SIGNED WITH THE SECURE |
| 88 | 88 | BOOT KEY. IT WILL PREVENT THE PI FROM BOOTING.** | ... | ... |
secure-boot-recovery/bootcode4.bin
No preview for this file type
secure-boot-recovery/pieeprom.original.bin
No preview for this file type