Merge pull request #113 from timg236/pieeprom-2022-01-25

Update bootloader to the latest stable release and use full SDRAM init in MSD / RAMDISK mode.

Merge pull request #113 from timg236/pieeprom-2022-01-25
Update bootloader to the latest stable release and use full SDRAM init in MSD / RAMDISK mode.
Tim Gover · GitHub
2 parents 9064cd86 dffe1b0f
Showing 16 changed files with 19 additions and 5 deletions
eeprom-erase/README.md
eeprom-erase/bootcode4.bin
eeprom-erase/config.txt
msd/bootcode4.bin
recovery/bootcode4.bin
recovery/pieeprom-2021-02-16.bin
recovery/pieeprom-2021-06-14.bin
recovery/pieeprom-2021-07-06.bin
recovery/pieeprom-2021-11-22.bin
recovery/pieeprom.bin
recovery/pieeprom.original.bin
recovery/pieeprom.sig
secure-boot-msd/bootcode4.bin
secure-boot-recovery/README.md
secure-boot-recovery/bootcode4.bin
secure-boot-recovery/pieeprom.original.bin
+The `erase_eeprom` `config.txt` option causes `recovery.bin` to execute a chip-erase operation on the bootloader SPI EEPROM.
+This is a test/debug option and there is no need to manually erase an EEPROM before flashing it.
+
+If the SPI EEPROM is erased then the Raspberry Pi will not boot until a new EEPROM image has been written via `RPIBOOT`
+or the Raspberry Pi Imager (Pi4 and Pi400 only).
+
+```bash
+cd erase-eeprom
+../rpiboot -d .
+```
+erase_eeprom=1
+uart_2ndstage=1
-5ecc63242cd1250e70d9e630cd4e3a7c98af78b788168e34f2aa3333e44eb2dc
-ts: 1639478069
+b9cbf81208306d241687e657067efd3afdd537fc8a39f7567eba87e69f4fcf57
+ts: 1643189590
@@ -51,7 +51,7 @@ cd secure-boot-recovery
 ../tools/update-pieeprom.sh -k "${KEY_FILE}"
 ```
  
-`pieeprom.bin` can then be flashed to the bootloader EEPROM via rpiboot.
+`pieeprom.bin` can then be flashed to the bootloader EEPROM via `rpiboot`.
  
 ## Program the EEPROM image using rpiboot
 * Power off CM4
@@ -72,9 +72,11 @@ onwards:
 * The EEPROM configuration file must be signed with the customer private key.
 * It is not possible to install an old version of the bootloader that does
   support secure boot.
-* **It is NOT possible to use a different private key to signed the OS images**
+* This option requires EEPROM version 2022-01-06 or newer.
+* BETA bootloader releases are not signed with the ROM secure boot key and will
+  not boot on a system where `revoke_devkey` has been set.
  
-**WARNING: THESE OPTIONS PERMANENTLY THE BCM2711 CHIP AND ARE IRREVERSIBLE.**
+**WARNING: Modifications to OTP are irreversible. Once `revoke_devkey` has been set it is not possible to unlock secure-boot mode or use a different private key.**
  
 To enable this edit the `config.txt` file in this directory and set
 `program_pubkey=1`