OpenSystemsDevelopment / usbboot

Fix some minor shellcheck warnings

Delete the target file before attempting to replace it, sync before
unmount and set the ownership to be that of the sudo user and not
just root.

secure-boot: Add more documentation about the RSA signatures and add an optional public key argument

Add some more detail about the RSA signatures.

Tweak update-pieeprom.sh so add a separate argument for the public key in
order to make it easier to customize the script for hardware security modules.

I missed correcting the description in https://github.com/raspberrypi/usbboot/pull/96/commits/14e28be2280212b07d3d64ea20609d76da8145fe

Corrected the prune the files to those required for the given board  flag

Update udev rules to use uaccess tag

This has fewer dependencies and avoids problems where the temporary
disk image is automounted.

Add an example boot.img file signed with tools/example-private.pem.

Initial BETA release for secure-boot.

secure-boot adds two new sub-directory to usbboot:

* secure-boot-recovery is used to create an EEPROM signed with
  the customer's RSA private key and configures the 2711 OTP
  settings permenantely require signed boot images.
  See secure-boot-recovery/README.md
* Once secure-boot is enabled the CM4 MSD mode firmware must
  also be signed with the customer's RSA private key.
  See secure-boot-msd/README.md

N.B The revoke_devkey and program_jtag_lock are NOT enabled in
this initial BETA release.

Update to the latest bootcode.bin built from top-of-tree source repo.

Update bootcode4.bin

Update this binary to the latest.
Also rebuilt the windows installer

bootloader: Remove NVMe beta files

The latest bootloader now supports NVMe

Fix `install` and `uninstall` targets in Makefile.

Add `install` target for  executable and default
`bootcode.bin`/`bootcode4.bin` and
`start.elf`/`start4.elf` files.

Update `uninstall` target.

Update Raspberry Pi 4 EEPROM to pieeprom-2021-07-06

Select the latest, stable bootloader EEPROM release which supports NVMe.

Update start4.elf (USB MSD firmware) to top-of-tree.

readme: add macOS build step

Adds instructions for macOS users.
It will mainly help with the perception that this only works on ubuntu.
You can also use this on macOS without a problem.

Update bootcode4.bin to avoid some blocking operations which can cause
USB errors.

Fixes issue with PCIe bridges in Linux
Last commit 05552182f98adadd27ba1aa9e3ca671c9dd5123f

The recommended way of granting users access to USB devices is not using GROUP="plugdev", but TAG+="uaccess":

    https://wiki.debian.org/USB/GadgetSetup

The manufacuring image now enables SELF_UDPATE and NETWORK boot by
default in order to make the initial setup for CM4 based products
easier. For embedded or physically inaccessible products the bootloader
should be updated to disable self-update. Hardware write-protection
should also be configured.

The symlink from pieeprom-2021-02-16 to pieeprom.original.bin has
been replaced with a simple copy of the file because the Windows
installer doesn't seem to support symlinks.

* Update the EEPROM image to the latest/stable release.
* Change the default boot-order to 0xf541 so that USB MSD will boot
  from the type-A sockets on the CM4 IO board.
* Add simple update-pieeprom.sh utility with latest rpi-eeprom-config
  to make it easier to refresh the EEPROM image with a new configuration.

Also add extra logging to indicate where the file was loaded
from to make it more obvious where a file is loaded from.

Update Windows installer

* Add 2711 bootcode and FW binaries with the 4 suffix.
* Use the device descriptor to select the correct bootcode and
  hack it so that bootcode.bin translates to bootcode4.bin on a
  Pi4 allowing the files to remain in the same directory.
* Add the latest best for recovery.bin and pieeprom.bin for CM4
* Update the installer.

Move the second stage preparation until after the device descriptor
has been retrieved because BCM2711 needs a different bootcode.bin.

If the '-d' argument specified then check for bootcode.bin in the
specified directory and don't fail over to the embedded fmem files.

Remove the default 'msd' directory and the references to /usr/share
because the behaviour conflicts with the original change to use
the fmem files.