Commit a7d4ec490646970916fbfd0b6dbfa20fe461370e
Committed by
GitHub
GitHub
Merge pull request #108 from timg236/secure-boot-revoke-devkey
bootloader: Enable revoke_devkey in secure-boot recovery.bin
Showing
5 changed files
with
6 additions
and
4 deletions
Readme.md
| @@ -63,8 +63,10 @@ On Compute Module 4 EMMC-DISABLE / nRPIBOOT (GPIO 40) must be fitted to switch t | @@ -63,8 +63,10 @@ On Compute Module 4 EMMC-DISABLE / nRPIBOOT (GPIO 40) must be fitted to switch t | ||
| 63 | Otherwise, the SPI EEPROM bootloader image will be loaded instead. | 63 | Otherwise, the SPI EEPROM bootloader image will be loaded instead. |
| 64 | 64 | ||
| 65 | <a name="secure-boot"></a> | 65 | <a name="secure-boot"></a> |
| 66 | -## Secure Boot - BETA | ||
| 67 | -Secure Boot is currently a BETA release feature and the functionality to permanently enable secure-boot via OTP is not enabled in this release. | 66 | +## Secure Boot |
| 67 | +Secure Boot requires the latest stable bootloader image. | ||
| 68 | +WARNING: If the `revoke_devkey` option is used to revoke the ROM development key then it will | ||
| 69 | +not be possible to downgrade to a bootloader older than 2022-01-06 OR disable secure-boot mode. | ||
| 68 | 70 | ||
| 69 | ### Host setup | 71 | ### Host setup |
| 70 | Secure boot require a 2048 bit RSA asymmetric keypair and the Python `pycrytodomex` module to sign the EEPROM config and boot image. | 72 | Secure boot require a 2048 bit RSA asymmetric keypair and the Python `pycrytodomex` module to sign the EEPROM config and boot image. |
secure-boot-msd/bootcode4.bin
No preview for this file type
secure-boot-recovery/README.md
| @@ -81,8 +81,8 @@ To enable this edit the `config.txt` file in this directory and set | @@ -81,8 +81,8 @@ To enable this edit the `config.txt` file in this directory and set | ||
| 81 | 81 | ||
| 82 | * `program_pubkey` - If 1, write the hash of the customer's public key to OTP. | 82 | * `program_pubkey` - If 1, write the hash of the customer's public key to OTP. |
| 83 | * `revoke_devkey` - If 1, revoke the ROM bootloader development key which | 83 | * `revoke_devkey` - If 1, revoke the ROM bootloader development key which |
| 84 | - requires secure-boot mode and prevents downgrades to bootloader versions that | ||
| 85 | - don't support secure boot. | 84 | + requires secure-boot mode and prevents downgrades to bootloader versions that |
| 85 | + don't support secure boot. | ||
| 86 | 86 | ||
| 87 | ** DO NOT SET THIS `revoke_devkey` UNTIL THE BOOTLOADER IS SIGNED WITH THE SECURE | 87 | ** DO NOT SET THIS `revoke_devkey` UNTIL THE BOOTLOADER IS SIGNED WITH THE SECURE |
| 88 | BOOT KEY. IT WILL PREVENT THE PI FROM BOOTING.** | 88 | BOOT KEY. IT WILL PREVENT THE PI FROM BOOTING.** |
secure-boot-recovery/bootcode4.bin
No preview for this file type
secure-boot-recovery/pieeprom.original.bin
No preview for this file type