Merge pull request #306 from timg236/make-release

make-release: Add a script for generating Raspberry Pi Imager releases

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,50 @@
+---
+name: Bug report
+about: Create a bug report for the bootloader EEPROM or rpi-eeprom-update scripts. Please use the Raspberry Pi General Discussion forum for general questions about the bootloader.
+
+---
+
+This repository tracks bugs for the Raspberry Pi 4 bootloader EEPROM and Linux update scripts.
+
+* If you suspect a hardware problem then please read the [Boot Problems](https://www.raspberrypi.org/forums/viewtopic.php?p=437084) post first before contacting the reseller.
+* Support questions or should be posted on the Raspberry Pi [General Discussion](https://www.raspberrypi.org/forums/viewforum.php?f=63)**
+
+
+**Mandatory information**
+* Raspberry Pi model
+* Board revision (cat /proc/cpuinfo | grep Revision)
+* Operating system version .
+* Details of any hardware attached e.g. links to USB 
+* Photo of the HDMI diagnostics screen, UART trace.
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+
+**Expected behaviour**
+A clear and concise description of what you expected to happen.
+
+**Bootloader version and configuration**
+If you have modified the default bootloader release or configuration then please attach the bootloader configuration vcgencmd bootloader_config and version (vcgencmd bootloader_version)
+
+**SD card boot (please complete the following information):**
+ - SD card type
+ - Partition information (sudo fdisk -l) if you are able to obtain this from another computer.
+
+**Network boot (please complete the following information):**
+Network boot bug normally require one or more of the following log types. [PiServer](https://github.com/raspberrypi/piserver) is the officially supported network boot server.
+
+ - DHCP server configuration files e.g. dnsmasq.conf
+ - Wireshark binary packet capture
+ - UART logs
+
+**USB boot (please complete the following information):**
+Verify that the the USB device works correctly when hot-plugged under Linux and attache the output of 'lsusb -vvv'
+
+**Additional context**
+Add any other context about the problem here. 
+
+The [Bootloader configuration](https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2711_bootloader_config.md) page describes how to enable UART or NETCONSOLE logs. For complex USB boot issues NETCONSOLE logs are recommended.
+

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,2 @@
+blank_issues_enabled: false
+

README.md

@@ -1,29 +1,16 @@
 # rpi-eeprom
-This repository contains the scripts and pre-compiled binaries used to create the rpi-eeprom package which is used to update the Raspberry Pi4 bootloader EEPROM.
+This repository contains the scripts and pre-compiled binaries used to create the `rpi-eeprom` package which is used to update the Raspberry Pi 4 bootloader and VLI USB xHCI controller EEPROMs.
 
 # Support
-For bootloader support the best place to start is the Raspberry Pi [General Users forum](https://www.raspberrypi.org/forums/viewforum.php?f=63) or for discussion of beta releases try the [Advanced Users forum](https://www.raspberrypi.org/forums/viewforum.php?f=29&sid=9bbc277968ad953e77749b255d0ce3a2)
+Please check the Raspberry Pi [general discussion forum](https://www.raspberrypi.org/forums/viewforum.php?f=63) if you have a support question. 
 
-N.B. Direct e-mail support questions will be ignored.
-
-# Rescue image
-If the Raspberry Pi4 is not booting, then it's very unlikely that the EEPROM is corrupted. The first thing that you should check is that the OS image was correctly installed using the Raspberry Pi Imager which is available on the [downloads page](https://www.raspberrypi.org/downloads/). If that doesn't work or you wish to revert EEPROM configuration changes to factory defaults then you can also create an EEPROM recovery SD card image using the Raspberry Pi Imager.
+# Reset to factory defaults
+The [Raspberry Pi Imager](https://www.raspberrypi.org/downloads/) provides an EEPROM recovery image which may be used to reset the bootloader and USB xHCI EEPROMs to factory defaults.
 
 # Bootloader documentation
 * [The boot folder](https://www.raspberrypi.org/documentation/configuration/boot_folder.md)
 * [Config.txt boot options](https://www.raspberrypi.org/documentation/configuration/config-txt/boot.md)
 * [Bootloader EEPROM](https://www.raspberrypi.org/documentation/hardware/raspberrypi/booteeprom.md)
 * [Bootloader configuration](https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2711_bootloader_config.md)
-
-# Bug reports
-Bootloader bugs are especially difficult to describe because there's no display. Where possible please include the following information in order to help identify the problem.
-* EEPROM version (vcgencmd bootloader_version or the pieeprom filename)
-* EEPROM config (from rpi-eeprom-config)
-* UART trace using USB serial cable
-* Wireshark trace for network boot. Filtering for DHCP and TFTP protocols or by mac-address for the Pi4 is fine.
-
-# BETA versions of the bootloader
-If you want to try the BETA version of the bootloader then we recommend that you always try this with a spare sd-card and are comfortable with using the rescue image. For debugging you may find a USB serial cable useful.
-
-Beta features are always documented [here](https://github.com/raspberrypi/rpi-eeprom/blob/master/firmware/release-notes.md) first. Once the configuration has stabalised then the [Bootloader configuration](https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2711_bootloader_config.md) will be updated, however, there's normally a bit of a delay in order to allow official documentation to be reviewed.
-
+* [Release notes](firmware/release-notes.md)
+* [Releases](releases.md)

firmware/default

@@ -0,0 +1 @@
+critical

firmware/latest

@@ -0,0 +1 @@
+stable

firmware/old/critical/pieeprom-2019-07-15.bin

@@ -0,0 +1 @@
+../beta/pieeprom-2019-07-15.bin

firmware/old/critical/pieeprom-2019-09-10.bin

@@ -0,0 +1 @@
+../beta/pieeprom-2019-09-10.bin

firmware/old/critical/pieeprom-2020-04-16.bin

@@ -0,0 +1 @@
+../beta/pieeprom-2020-04-16.bin

firmware/old/critical/recovery.bin

@@ -0,0 +1 @@
+../beta/recovery.bin

firmware/old/critical/vl805-00013701.bin

@@ -0,0 +1 @@
+../beta/vl805-00013701.bin

firmware/old/critical/vl805-000137ab.bin

@@ -0,0 +1 @@
+../beta/vl805-000137ab.bin

firmware/old/critical/vl805-000137ad.bin

@@ -0,0 +1 @@
+../beta/vl805-000137ad.bin

firmware/old/stable/pieeprom-2020-01-17.bin

@@ -0,0 +1 @@
+../beta/pieeprom-2020-01-17.bin

firmware/old/stable/pieeprom-2020-03-19.bin

@@ -0,0 +1 @@
+../beta/pieeprom-2020-03-19.bin

firmware/old/stable/pieeprom-2020-04-16.bin

@@ -0,0 +1 @@
+../beta/pieeprom-2020-04-16.bin

firmware/old/stable/recovery.bin

@@ -0,0 +1 @@
+../beta/recovery.bin

firmware/old/stable/vl805-000137ad.bin

@@ -0,0 +1 @@
+../beta/vl805-000137ad.bin

firmware/release-notes.md

@@ -1,5 +1,295 @@
 # Raspberry Pi4 bootloader EEPROM release notes
 
+USB MSD boot also requires the firmware from Raspberry Pi OS 2020-08-20 or newer.
+https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2711_bootloader_config.md
+
+## 2021-02-22 - Promote 2021-02-16 to stable - STABLE (LATEST)
+   * Freezing for default/critical update.
+
+## 2021-02-16 - Change VC version info & TFTP fix - BETA
+   * Display the VC_BUILD strings instead of the sha256 of the .elf file so that
+     the information is the same as "vcgencmd version"
+   * Change TFTP to ACK data blocks which it has already ACK'd instead of ignoring them.
+   * Change network boot to use the same "RXID" configuration as the 5.10 kernel.
+
+## 2021-01-16 - Fix 1V8 SD voltage reset for Pi 4B R1.1 - LATEST + BETA
+   * Fix regression for GPIO expander reset change which caused PMIC reset
+     to get card out of 1V8 mode to be missed.
+
+## 2021-01-14 - Promote pieeprom-2021-01-11 to STABLE (LATEST)
+
+## 2021-01-11 - Timeout stalled USB MSD devices - BETA
+   * Timeout USB MSD commands and move to the next boot mode if a device stops responding.
+   * Reset the GPIO expander at power on.
+   * Use the bootloader build timestamp instead of zero for the update-timestamp
+     if it is not defined in the .sig file.
+
+## 2021-01-05 - USB MSD interop improvements for Pi 4B < R1.4 - BETA
+   * Revert the USB port power delay on R1.1 boards to be more like the Sep 2020
+     production release. Verified with Geekworm X835, Orico NVME M.2 USB adapter
+     and Microsoft Wireless keyboard.
+   * Increase the HDMI delay to 8 seconds.
+
+## 2020-12-14 - Promote pieeprom-2020-12-11.bin to stable - STABLE
+   * Feature freeze to support stable release of BCM2711 XHCI boot, tryboot,
+     HDMI_DELAY, USB MSD improvements.
+
+## 2020-12-11 - CM4/PI400 conditional filters - BETA
+   * Add support for [cm4] and [pi400] config conditionals filters.
+   * Tidyup RPIBOOT USB descriptors.
+   * Add a gap before displaying LED error pattern and change the default state
+     to off after displaying the first error pattern.
+   * Generate 0xffff instead of 0x0 if the checksum of the UDP packet to be
+     transmitted is 0x0.
+   * Rename USB-DEV to RPIBOOT in boot-mode strings. Bootmode was renamed to
+     avoid confusion with USB MSD boot.
+
+## 2020-11-24 BCM2711 xHC boot support - BETA
+   * Add support for booting from the BCM2711 XHCI controller which is the
+     USB-C socket on Pi 4B / Pi 400 and the type A sockets on Compute Module 4
+     IO board. The controller only supports USB 2.0 and the primary usage is
+     for USB-MSD support on CM 4 boards without requiring a PCIe XHCI controller.
+
+     To use this add '5' to the BOOT_ORDER in the EEPROM config for BCM_USB_MSD boot.
+
+     This requires the latest rpi-update firmware.
+     
+     If start.elf is loaded via the BCM2711 XHCI (BOOT_ORDER 5) then the config.txt
+     otg_mode setting will be set to 1 so that the OS can continue booting
+     using the BCM2711 XHCI. This means that the device/gadget mode is not available
+     when booted in this mode and there is no support for switching back to 
+     the DWC2 controller from the BCM2711 XHCI controller.
+
+   * Update halt behavior on Pi 400 to re-enable 'power on' button if the OS
+     did a reset rather than using the standard mailbox shutdown commands. This
+     overrides WAKE_ON_GPIO / POWER_OFF_ON_HALT settings on Pi 400 because
+     it has a dedicated power button.
+     If a button on GPIO3 really is requried then it can be re-enabled by setting
+     WAKE_ON_GPIO=2 but that will consume more power.
+   * Fix short blink before one-shot error pattern - #251
+   * Validate SDRAM in recovery mode.
+   * XHCI protocol layer fixes for non-VLI controllers.
+   * Updated 'tryboot' for new version which also supports Pi3 and earlier.
+
+## 2020-10-28 Defer HDMI diagnostics display, update-timestamps, tryboot support - BETA
+   * Skip rendering of the diagnostics screen for HDMI_DELAY seconds (default 5).
+     This means that for SD-card and USB MSD flash boot devices the diagnostics
+     screen will not be visible.
+   * On Pi 4B 1.4 (8GB) initialise SDRAM whilst waiting for the USB port power
+     off time. This makes booting slightly faster.
+   * Remove HDMI console messages where the information is duplicated elsewhere
+     on the display.
+   * Improve compatibility with external USB 3.0 disk enclosures by enumerating
+     the downstream hubs before executing the USB port power off.
+     N.B. Pi4 8GB automatically powers off the USB ports during chip-reset and
+     does not need this change.
+   * Don't timeout a USB MSD device after USB_MSD_LUN_TIMEOUT if there are no other
+     MSD devices or LUNs to try. This avoids unnecessary timeouts on very slow
+     to initialise disk drives e.g. USB HDDs designed for backups.
+   * Fix failover to partition zero if the partition number is invalid. For USB
+     MSD boot a start.elf update is also required.
+   * SD-Card - Change default retries from 0 to 1 to improve reliability with
+     some old SD v1 cards.
+   * Fix issue where boot would stop if partition type 0x83 was encountered
+     before the first FAT partition.
+   * SELF_UPDATE mode (Network, USB MSD boot) now reads the timestamp information
+     in pieeprom.sig created by rpi-eeprom-update to see if the updated is
+     newer than the current 'update-timestamp'. If not, the update is skipped
+     to avoid stale updates on network or USB disks being installed by accident.
+
+     recovery.bin updates (from the SD card) do not check the timestamp because
+     recovery.bin renames itself once the update is completed. However, it still
+     writes the update-timestamp to the EEPROM.
+
+     The update-timestamp is the timestamp when the update is created is
+     independent of the build-timestamp for the bootloader executable. See
+     rpi-eeprom-update -h
+   * Add support for the 'tryboot' feature that enables operating systems to
+     implement a fallback mechanism if an OS upgrade fails. This works with all
+     bootable media types but requires updated firmware and OS software.
+
+     This feature should be viewed as EXPERIMENTAL and may change depending upon
+     feedback from other OS/distro maintainers.
+     https://github.com/raspberrypi/linux/commit/757666748ebf69dc161a262faa3717a14d68e5aa
+
+
+## 2020-10-02 Include CM4 manufacturing bootloader image.
+   * Include the release image for reference. This contains some minor changes
+     to support manufacture test.
+
+## 2020-09-14 Promote the 2020-09-03 release to be the default EEPROM images.
+   * Promote the 2020-09-03 bootloader EEPROM and VLI 0138A1 as the default
+     release (critical folder).
+    
+   Interesting changes since 2020-04-16:-
+
+   * Add support for booting from USB mass storage devices.
+   * Add support for bootloader updates for USB MSD or network boot (self-update)
+   * Improve compatibility for USB devices which require the USB port power
+     to be switched off for a period of time during a reboot.
+   * Add support GPT and Hybrid MBR partition tables.
+   * Add support for EEPROM write-protect.
+   * Add the ability to loop between different boot-modes until a bootable
+     image is found. The default is to loop between SD and USB-MSD.
+   * VLI 0138A1 - Improve full-speed isochronous endpoint support.
+
+
+## 2020-09-07 Promote 2020-09-03 to release to STABLE
+
+## 2020-09-03 Only use green LED for error status in bootloader - BETA
+   * Turn the green LED on and leave it on unless an error code occurs.
+     Previously, SD activity was displayed but that plus muxing with the
+     SPI CS made the LED activity confusing.
+     The HDMI diagnostics screen now provides much better information
+     for determining if the bootloader is running or frozen.
+   * CM4 enable GPIO for SD power.
+   * Filename should be 2020-09-03
+
+## 2020-08-31 Disable self-update from SD card - BETA
+   * Since the ROM will load recovery.bin from the SD card self-update is not
+     required. Although it functions correctly there is a small risk stale
+     pieeprom.upd files would be installed automatically e.g. if the
+     rpi-eeprom-update service has been disabled.
+
+## 2020-08-10 Promote 2020-07-31 release to STABLE
+   * The USB port power management change from the last BETA improves
+     compatibility for devices which during reset with no regressions reported.
+     Make this the latest stable release.
+
+## 2020-07-31 Standardize USB port power control across board revisions - BETA
+   * Turn off USB port power for 1-second regardless of boot-mode. This appears
+     to resolve an issue on R1.3 and older board revisions where some USB
+     devices would fail upon reboot. On R1.4 USB port power is turned off
+     automatically by the PMIC so this is just held in reset for longer. For
+     earlier board revisions the USB port power is explicitly turned off via
+     XHCI.
+     This can be overridden via USB_MSD_PWR_OFF_TIME in the EEPROM config.
+   * Update to the latest Broadcom memsys FW - no significant functional change.
+
+## 2020-07-20 Promote 2020-07-16 bootloader and VL805 0138A1 FW to stable - STABLE
+   * Promote the latest beta to stable as the next production firmware release
+     candidate.
+     The main difference between this and the previous stable version is
+     the VL805 FW update. 
+
+## 2020-07-16 Update VL805 FW to 0138A1 and add optional EEPROM write-protect - BETA
+   * Patch previous 2020-07-16 from c44ee87f -> 45291ce6 to fix a CM4 specific
+     issue which does not impact Model B
+   * Update the VL805 embedded / standalone FW version to 0138A1
+      *  User settings of the ASPM bits in the PCI configuration space
+         link control register are now maintained
+      * Better full-speed Isochronous endpoint support
+   * Add eeprom_write_protect config.txt variable which if set configures
+     the non-volatile status register bits to define the write protect
+     regions.
+      * If 1 then configure the write protect regions for both the
+        bootloader and VLI EEPROMs to cover the entire EEPROM.
+      * If zero then clear all write protect bits.
+      * If missing or -1 then don't change the current state.
+   * The write protect is only effective if the /WP pin is pulled low
+     e.g. by shorting TP5 to ground.
+   * WARNING: Previous versions of the bootloader, recovery.bin and vl805
+     tool do NOT clear the non-volatile status bits for the VL805 SPI EEPROM.
+     Consequently, installing an older version will fail/hang if the write
+     protect bits have not been cleared first (eeprom_write_protect=0)
+   * Update the vl805 user-space tool to clear the WP bits.
+   * Add recovery_wait config.txt option which if set to 1 forces the EEPROM
+     rescue image and flashes the activity LED forever. This is intended for
+     use with an SD card image which just contains recovery.bin + config.txt
+     and is used to set/clear WP on multiple boards.
+   * The write protect functionality works with self-update mode, however,
+     the bootloader must have already been updated to the version supporting
+     write protect first i.e. at least two reboots are required.
+   * Update the HDMI diagnostics screen to display 'RO' after the EEPROM version
+     if the write status register for the bootloader SPI EEPROM has write protect
+     bits defined. This does NOT attempt to verify if /WP is low.
+
+## 2020-07-06 Tweak USB port power and clear ACT LED after SPI - BETA
+   * Increase port power off limit to 5 seconds.
+   * Increase the port power off default to 1 second. This seems to cover most
+     commonly seen USB MSD devices which require the USB port power to be disabled
+     after the USB HC chip is reset.
+   * Reset activity LED after SPI access to reduce the number of spurious LED flashes.
+   * Add SPI error diagnostic error code (3 long 1 short) if SPI commands timeout.
+     (So far this failure has not been observed on failed boards)
+
+## 2020-06-17 Promote 2020-06-15 to STABLE
+   * Promote the latest beta EEPROM and recovery.bin to stable and
+     feature freeze USB MSD support until a production release is ready.
+
+## 2020-06-15 Increase default USB port power delay - BETA
+   * Increase the default power off delay to 500ms following more
+     interop testing.
+   * Make the USB port power off time configurable via the USB_MSD_PWR_OFF_TIME
+     config. The range may be set between 250 and 1000ms. Zero means no port
+     power off.
+   * Fix some issues in XHCI endpoint configuration where the code was wrong
+     but does not fail with the current VL805 FW.
+
+## 2020-06-12 Improve support for powered USB SATA devices - BETA
+   * Reset Ethernet MAC + PHY if final boot mode is not network boot
+     See: Kernel warning and network failure when attempting to use the network after bootloader times out. #144
+   * Improve handling of multiple bootable USB devices and remove USB_MSD_BOOT_MAX_RETRIES
+   * Resolve: No DHCPACK with DHCP relay agent #58
+   * Toggle USB root hub port power for 200ms on the first USB MSD boot attempt
+     See: Bootloader can't boot via USB-HDD after system reboot #151
+   * Update bootloader handover to support uart_2ndstage - requires
+     a newer start.elf firmware which will be via rpi-update.
+   * Assert PCIe fundamental reset if the final bootmode was not USB-MSD because
+     the OS might not do this before starting XHCI.
+
+## 2020-06-03 Bootmode tweaks and fix issue with > 4TB drives - BETA
+   * Resolve: Unable to boot from USB MSD - Seagate 5Tb HDD backup drive #139
+   * Increase USB MSD timeout from 10 to 20 seconds.
+   * Max retries now default to zero because the default BOOT_ORDER includes
+     restart (0xf). Therefore, each boot-mode is now tried once before moving
+     to the next mode. The retries mechanism is largely redundant now that
+     the loop/restart mode exists.
+   * If TFTP fails and network boot retries > 0 then wait 5 seconds before
+     retrying to avoid overloading a misconfigured TFTP server.
+   * Map undefined boot-modes in BOOT_ORDER to SD (0x1) instead of stopping.
+   * Add missing pieeprom-2020-05-28
+
+## 2020-05-28 Secondary fix for VL805 readback issue - BETA
+    * Re-upload 2020-05-28 after Git issue
+    * rpi-eeprom-update for new board revisions
+
+## 2020-05-27 Fix DPI issue - BETA
+    * Resolve: DPI failure after HDMI diagnostics screen in beta bootloader #133
+    * Resolve: VL805 readback failure in the bootloader #134
+
+## 2020-05-26 USB MSD updates - BETA
+    * Resolve: USB boot fails if the GPT contains no basic data or EFI partitions #130
+    * Resolve: Fix default BOOT_ORDER in mass storage beta #129
+    * Resolve: Add support for booting from a "superfloppy" disk #120
+    * Resolve: USB MSD timeout message - incorrect units #131
+    * Resolve: Recognize efi partition (0xef) as a valid boot #126
+    * The HDMI diagnostics screen now displays the most significant bytes
+      of the SHA-256 of the config.txt file.
+
+## 2020-05-26 rpi-eeprom-update
+    * Mark USE_FLASHROM as deprecated.
+    * Resolve: Unnecessary check for '*.elf' in BOOTFS #92
+    * Update help for FIRMWARE_RELEASE_STATUS.
+
+## 2020-05-15 Add pieeprom-2020-05-15 beta with USB boot
+    * USB mass storage boot will NOT work without the updated firmware
+      start.elf binaries. These will probably be released via rpi-update
+      in a few days’ time.
+      This release simply helps to validate if there are regressions in
+      the current SD and Network boot modes.
+
+      * SELF_UPDATE and bootloader_update are now enabled by default.
+
+## 2020-05-11 Garbage collect old binaries
+    * Now that 2020-04-16 is has been released as the default production
+      release move the old binaries to an old (deprecated) directory.
+      These can be removed for the APT package to reduce disk space.
+
+## Promote 2020-04-16 EEPROM release critical
+    * Make this the default release for all users. This supports network
+      boot, configurable boot order and HDMI diagnostics screen.
+
 ## 2020-04-16 Promote to stable
     * The PLL analog changes in the beta release never made it to stable.
       Skip straight 2020-04-16 to synchronize releases.
@@ -15,7 +305,7 @@
       Fix recovery.bin to reboot in this case. The current 'critical'
       release does not have this problem.
     * Fix uart_2ndstage logging in beta/stable recovery image.
-    * Change recovery.bin to reboot instead of displaying an error patern
+    * Change recovery.bin to reboot instead of displaying an error pattern
       if there are no EEPROM images. The Raspberry Pi Image makes it very
       difficult to create a broken rescue image but a stray recovery.bin
       could stop Raspbian from booting.
@@ -47,20 +337,20 @@
        * SUBNET
        * GATEWAY
        * TFTP_IP
-    * If a fatal bootloader error occurs then an HDMI diagnostics screen is 
-      displayed at VGA/DVI resolution on both outputs for two minutes. 
-      This may be disabled by setting DISABLE_HDMI=1 in the EEPROM 
+    * If a fatal bootloader error occurs then an HDMI diagnostics screen is
+      displayed at VGA/DVI resolution on both outputs for two minutes.
+      This may be disabled by setting DISABLE_HDMI=1 in the EEPROM
       configuration OR setting display_splash=1 in config.txt.
     * Allow the PXE menu option to match a custom string specified by
       PXE_OPTION43. The default is still "Raspberry Pi Boot"
-    * DHCP_OPTION97 - The default GUID has now changed to 
+    * DHCP_OPTION97 - The default GUID has now changed to
       RPI4+BOARD_ID+ETH_MAC_LSB+SERIAL in order to make it easier to
       automatically identify Raspberry Pi computers. The old behaviour
       is enabled by setting DHCP_OPTION97=0 which simply repeats the serial
       number 4 times.
     * SELF_UPDATE. If SELF_UPDATE is set to 1 in the EEPROM configuration AND
-      config.txt contains bootloader_update=1 then the bootloader will looking
-      for pieeprom.upd and vl805.bin and apply these firmware files if 
+      config.txt contains bootloader_update=1 then the bootloader will be looking
+      for pieeprom.upd and vl805.bin and apply these firmware files if
       they are different to the current image, before doing a watchdog reset.
       This should make it easier to update the bootloader for network
       booted setups because an SD card is not required for recovery.bin.
@@ -81,7 +371,7 @@
       beta folder.
 
 ## 2020-01-22 - vl805 00137ad
-    * Set the default/critical vl805 version to be 00137ad. This has the 
+    * Set the default/critical vl805 version to be 00137ad. This has the
       same power savings as 0137ab but with fixes for USB webcams.
 
 ## 2020-01-17 - Git 5e86aac5f (BETA) RC4
@@ -104,7 +394,7 @@
 
     * Avoid resetting TFTP prefix after retries or if start4.elf is not found.
     * Add MAC_ADDRESS option which allows the OTP Ethernet MAC address to be
-      overriden. An VideoCore firmware update will propagate this forced
+      overridden. A VideoCore firmware update will propagate this forced
       mac address to device-tree/cmdline in the near future.
     * Various internal refactorings to prepare for USB MSD storage boot in
       the next beta-series.
@@ -149,7 +439,7 @@
 ## 2019-07-15 - Git 514670a2
    * Turn green LED activity off on halt.
    * Pad embedded config file with spaces for easier editing by end users.
-   * Halt now behaves the same as earlier Pi models to improve power behavior at halt for HATs. 
+   * Halt now behaves the same as earlier Pi models to improve power behavior at halt for HATs.
    * WAKE_ON_GPIO now defaults to 1 in the EEPROM config file.
    * POWER_OFF_ON_HALT setting added defaulting to zero. Set this to 1 to restore the behavior where 'sudo halt' powers off all PMIC output.
    * If WAKE_ON_GPIO=1 then POWER_OFF_ON_HALT is ignored.

imager/README.txt

@@ -0,0 +1,28 @@
+Raspberry Pi 4 EEPROM bootloader rescue image
+*********************************************
+
+The Raspberry Pi4 has a small EEPROM used to store the bootloader.
+
+This rescue image reverts the bootloader EEPROM to factory default settings.
+
+This rescue image also updates the USB 3.0 (VL805) firmware to the latest
+version (138a1) with better full-speed Isochronous endpoint support.
+
+To re-flash the EEPROM(s)
+
+1. Unzip the contents of this zip file to a blank FAT formatted SD-SDCARD.
+2. Power off the Raspberry Pi
+3. Insert the sd-card.
+4. Power on Raspberry Pi
+5. Wait at least 10 seconds.
+
+This easiest method for creating and formatting the SD-CARD is to use the
+Raspberry Pi Imager from https://raspberrypi.org/downloads
+
+If successful, the green LED light will blink rapidly (forever), otherwise
+an error pattern will be displayed.
+
+If a HDMI display is attached then screen will display green for success
+or red if failure a failure occurs.
+
+N.B. This image is not a bootloader it simply replaces the on-board bootloader.

imager/boot-conf-default.txt

@@ -0,0 +1,6 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+ENABLE_SELF_UPDATE=1
+BOOT_ORDER=0xf41
+

imager/boot-conf-network.txt

@@ -0,0 +1,6 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+ENABLE_SELF_UPDATE=1
+BOOT_ORDER=0xf21
+

imager/boot-conf-sd.txt

@@ -0,0 +1,6 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+ENABLE_SELF_UPDATE=1
+BOOT_ORDER=0xf41
+

imager/boot-conf-usb.txt

@@ -0,0 +1,6 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+ENABLE_SELF_UPDATE=1
+BOOT_ORDER=0xf14
+

imager/make-release

@@ -0,0 +1,65 @@
+#!/bin/sh
+
+# Generates three variants of the rpi-eeprom-recovery.zip file for
+# SD, USB and NETWORK priority matching the raspi-config options.
+
+set -e
+
+script_dir=$(cd "$(dirname "$0")" && pwd)
+tmp_dir=""
+
+die() {
+   echo "$@" >&2
+   exit 1
+}
+
+cleanup() {
+   if [ -d "${tmp_dir}" ]; then
+      rm -rf "${tmp_dir}"
+   fi
+   tmp_dir=""
+}
+
+gen_release() {
+   config="${1}"
+   out="${2}"
+
+   [ -f "${config}" ] || die "File not found \"${config}\""
+
+   (
+      tmp_dir="$(mktemp -d)"
+      cd "${tmp_dir}"
+      cp "${script_dir}/vl805.bin" .
+      cp "${script_dir}/README.txt" .
+      sha256sum vl805.bin | awk '{print $1}' > vl805.sig
+
+      "${script_dir}/../rpi-eeprom-config" \
+         --config "${script_dir}/${config}" --out pieeprom.bin \
+         "${script_dir}/pieeprom.bin" || die "Failed to create update EEPROM config with  \"${config}\""
+      sha256sum pieeprom.bin | awk '{print $1}' > pieeprom.sig
+      echo "Creating ${out}"
+      zip "${out}" *
+   )
+}
+
+usage() {
+cat <<EOF
+   make-release <tag>
+
+   Example tag "2020-09-03-vl805-000138a1"
+EOF
+exit
+}
+
+trap cleanup EXIT
+tag="${1}"
+[ -n "${tag}" ] || usage
+release_dir="${script_dir}/release"
+rm -rf "${release_dir}"
+mkdir "${release_dir}"
+
+# Build the different boot priority flavours
+gen_release boot-conf-default.txt "${release_dir}/rpi-boot-eeprom-recovery-${tag}.zip"
+gen_release boot-conf-sd.txt "${release_dir}/rpi-boot-eeprom-recovery-${tag}-sd.zip"
+gen_release boot-conf-usb.txt "${release_dir}/rpi-boot-eeprom-recovery-${tag}-usb.zip"
+gen_release boot-conf-network.txt "${release_dir}/rpi-boot-eeprom-recovery-${tag}-network.zip"

imager/pieeprom.bin

@@ -0,0 +1 @@
+../firmware/critical/pieeprom-2020-09-03.bin

imager/recovery.bin

@@ -0,0 +1 @@
+../firmware/critical/recovery.bin

imager/vl805.bin

@@ -0,0 +1 @@
+../firmware/critical/vl805-000138a1.bin

releases.md

@@ -0,0 +1,20 @@
+# rpi-eeprom releases
+This page provides links to the production and development release images for the Raspberry Pi 4 bootloader EEPROM. Normally, the 
+bootloader is automatically updated after an APT update via the [rpi-eeprom-update](https://www.raspberrypi.org/documentation/hardware/raspberrypi/booteeprom.md)
+utility. However, it's sometimes more convenient to use a recovery image to program the EEPROM with default settings for a given release, rather than updating via Linux.
+
+## Release notes
+Release notes are available [here](https://github.com/raspberrypi/rpi-eeprom/blob/master/firmware/release-notes.md).
+
+## Recovery image
+The latest production EEPROM recovery image release is [2020-09-03](https://github.com/raspberrypi/rpi-eeprom/releases/tag/v2020.09.03-138a1) and can be installed via the [Raspberry Pi Imager](https://www.raspberrypi.org/downloads/).
+
+## USB MSD boot
+USB mass storage boot requires the 2020-09-03 EEPROM images and Raspberry Pi OS 2020-08-20 or newer.
+
+For support please see use the Raspberry Pi [general discussion](https://www.raspberrypi.org/forums/viewforum.php?f=63) forum.
+
+## Old EEPROM images
+Old bootloader images are periodically removed from the APT package to reduce the disk space but are still available via Github [here](https://github.com/raspberrypi/rpi-eeprom/tree/master/firmware/old)
+
+**N.B. These are not supported and may fail to boot on newer hardware revisions.**

rpi-eeprom-config

@@ -1,12 +1,17 @@
-#!/usr/bin/python
+#!/usr/bin/env python
 
-# rpi-eeprom-config
-# Utility for reading and writing the configuration file in the
-# Raspberry Pi4 bootloader EEPROM image.
+"""
+rpi-eeprom-config
+"""
 
 import argparse
+import atexit
+import os
+import subprocess
 import struct
 import sys
+import tempfile
+import time
 
 IMAGE_SIZE = 512 * 1024
 
@@ -17,23 +22,182 @@ MAX_BOOTCONF_SIZE = 2024
 # The number, order and size of the sections depends on the bootloader version
 # but the following mask can be used to test for section headers and skip
 # unknown data.
+#
+# The last 4KB of the EEPROM image is reserved for internal use by the
+# bootloader and may be overwritten during the update process.
 MAGIC = 0x55aaf00f
 MAGIC_MASK = 0xfffff00f
 FILE_MAGIC = 0x55aaf11f # id for modifiable file, currently only bootconf.txt
 FILE_HDR_LEN = 20
 FILENAME_LEN = 12
+TEMP_DIR = None
+
+def rpi4():
+    compatible_path = "/sys/firmware/devicetree/base/compatible"
+    if os.path.exists(compatible_path):
+        with open(compatible_path, "rb") as f:
+            compatible = f.read().decode('utf-8')
+            if "bcm2711" in compatible:
+                return True
+    return False
+
+def exit_handler():
+    """
+    Delete any temporary files.
+    """
+    if TEMP_DIR is not None and os.path.exists(TEMP_DIR):
+        tmp_image = os.path.join(TEMP_DIR, 'pieeprom.upd')
+        if os.path.exists(tmp_image):
+            os.remove(tmp_image)
+        tmp_conf = os.path.join(TEMP_DIR, 'boot.conf')
+        if os.path.exists(tmp_conf):
+            os.remove(tmp_conf)
+        os.rmdir(TEMP_DIR)
+
+def create_tempdir():
+    global TEMP_DIR
+    if TEMP_DIR is None:
+        TEMP_DIR = tempfile.mkdtemp()
+
+def exit_error(msg):
+    """
+    Trapped a fatal error, output message to stderr and exit with non-zero
+    return code.
+    """
+    sys.stderr.write("ERROR: %s\n" % msg)
+    sys.exit(1)
+
+def shell_cmd(args):
+    """
+    Executes a shell command waits for completion returning STDOUT. If an
+    error occurs then exit and output the subprocess stdout, stderr messages
+    for debug.
+    """
+    start = time.time()
+    arg_str = ' '.join(args)
+    result = subprocess.Popen(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+
+    while time.time() - start < 5:
+        if result.poll() is not None:
+            break
+
+    if result.poll() is None:
+        exit_error("%s timeout" % arg_str)
+
+    if result.returncode != 0:
+        exit_error("%s failed: %d\n %s\n %s\n" %
+                   (arg_str, result.returncode, result.stdout.read(), result.stderr.read()))
+    else:
+        return result.stdout.read().decode('utf-8')
+
+def get_latest_eeprom():
+    """
+    Returns the path of the latest EEPROM image file if it exists.
+    """
+    latest = shell_cmd(['rpi-eeprom-update', '-l']).rstrip()
+    if not os.path.exists(latest):
+        exit_error("EEPROM image '%s' not found" % latest)
+    return latest
+
+def apply_update(config, eeprom=None, config_src=None):
+    """
+    Applies the config file to the latest available EEPROM image and spawns
+    rpi-eeprom-update to schedule the update at the next reboot.
+    """
+    if eeprom is not None:
+        eeprom_image = eeprom
+    else:
+        eeprom_image = get_latest_eeprom()
+    create_tempdir()
+    tmp_update = os.path.join(TEMP_DIR, 'pieeprom.upd')
+    image = BootloaderImage(eeprom_image, tmp_update)
+    image.write(config)
+    config_str = open(config).read()
+    if config_src is None:
+        config_src = ''
+    sys.stdout.write("Updating bootloader EEPROM\n image: %s\nconfig_src: %s\nconfig: %s\n%s\n%s\n%s\n" %
+                     (eeprom_image, config_src, config, '#' * 80, config_str, '#' * 80))
+
+    sys.stdout.write("\n*** To cancel this update run 'sudo rpi-eeprom-update -r' ***\n\n")
+
+    # Ignore APT package checksums so that this doesn't fail when used
+    # with EEPROMs with configs delivered outside of APT.
+    # The checksums are really just a safety check for automatic updates.
+    args = ['rpi-eeprom-update', '-d', '-i', '-f', tmp_update]
+    resp = shell_cmd(args)
+    sys.stdout.write(resp)
+
+def edit_config(eeprom=None):
+    """
+    Implements something like 'git commit' for editing EEPROM configs.
+    """
+    # Default to nano if $EDITOR is not defined.
+    editor = 'nano'
+    if 'EDITOR' in os.environ:
+        editor = os.environ['EDITOR']
+
+    config_src = ''
+    # If there is a pending update then use the configuration from
+    # that in order to support incremental updates. Otherwise,
+    # use the current EEPROM configuration.
+    bootfs = shell_cmd(['rpi-eeprom-update', '-b']).rstrip()
+    pending = os.path.join(bootfs, 'pieeprom.upd')
+    if os.path.exists(pending):
+        config_src = pending
+        image = BootloaderImage(pending)
+        current_config = image.get_config().decode('utf-8')
+    else:
+        current_config, config_src = read_current_config()
+
+    create_tempdir()
+    tmp_conf = os.path.join(TEMP_DIR, 'boot.conf')
+    out = open(tmp_conf, 'w')
+    out.write(current_config)
+    out.close()
+    cmd = "\'%s\' \'%s\'" % (editor, tmp_conf)
+    result = os.system(cmd)
+    if result != 0:
+        exit_error("Aborting update because \'%s\' exited with code %d." % (cmd, result))
+
+    new_config = open(tmp_conf, 'r').read()
+    if len(new_config.splitlines()) < 2:
+        exit_error("Aborting update because \'%s\' appears to be empty." % tmp_conf)
+    apply_update(tmp_conf, eeprom, config_src)
+
+def read_current_config():
+    """
+    Reads the configuration used by the current bootloader.
+    """
+    fw_base = "/sys/firmware/devicetree/base/"
+    nvmem_base = "/sys/bus/nvmem/devices/"
+
+    if os.path.exists(fw_base + "/aliases/blconfig"):
+        with open(fw_base + "/aliases/blconfig", "rb") as f:
+            nvmem_ofnode_path = fw_base + f.read().decode('utf-8')
+            for d in os.listdir(nvmem_base):
+                if os.path.realpath(nvmem_base + d + "/of_node") in os.path.normpath(nvmem_ofnode_path):
+                    return (open(nvmem_base + d + "/nvmem", "rb").read().decode('utf-8'), "blconfig device")
+
+    return (shell_cmd(['vcgencmd', 'bootloader_config']), "vcgencmd bootloader_config")
 
 class BootloaderImage(object):
-    def __init__(self, filename, output):
+    def __init__(self, filename, output=None):
+        """
+        Instantiates a Bootloader image writer with a source eeprom (filename)
+        and optionally an output filename.
+        """
         self._filename = filename
-        self._bytes = bytearray(open(filename, 'rb').read())
+        try:
+            self._bytes = bytearray(open(filename, 'rb').read())
+        except IOError as err:
+            exit_error("Failed to read \'%s\'\n%s\n" % (filename, str(err)))
         self._out = None
         if output is not None:
             self._out = open(output, 'wb')
 
         if len(self._bytes) != IMAGE_SIZE:
-            raise Exception("%s: Expected size %d bytes actual size %d bytes" %
-                            (filename, IMAGE_SIZE, len(self._bytes)))
+            exit_error("%s: Expected size %d bytes actual size %d bytes" %
+                       (filename, IMAGE_SIZE, len(self._bytes)))
 
     def find_config(self):
         offset = 0
@@ -51,7 +215,7 @@ class BootloaderImage(object):
             offset += 8 + length # length + type
             offset = (offset + 7) & ~7
 
-        raise Exception('Bootloader config not found')
+        raise Exception('EEPROM parse error: Bootloader config not found')
 
     def write(self, new_config):
         hdr_offset, length = self.find_config()
@@ -59,12 +223,13 @@ class BootloaderImage(object):
         new_len = len(new_config_bytes) + FILENAME_LEN + 4
         if len(new_config_bytes) > MAX_BOOTCONF_SIZE:
             raise Exception("Config is too large (%d bytes). The maximum size is %d bytes."
-                    % (len(new_config_bytes), MAX_BOOTCONF_SIZE))
+                            % (len(new_config_bytes), MAX_BOOTCONF_SIZE))
         if hdr_offset + len(new_config_bytes) + FILE_HDR_LEN > IMAGE_SIZE:
             raise Exception('EEPROM image size exceeded')
 
         struct.pack_into('>L', self._bytes, hdr_offset + 4, new_len)
-        struct.pack_into(("%ds" % len(new_config_bytes)), self._bytes, hdr_offset + 4 + FILE_HDR_LEN, new_config_bytes)
+        struct.pack_into(("%ds" % len(new_config_bytes)), self._bytes,
+                         hdr_offset + 4 + FILE_HDR_LEN, new_config_bytes)
 
         # If the new config is smaller than the old config then set any old
         # data which is now unused to all ones (erase value)
@@ -83,10 +248,14 @@ class BootloaderImage(object):
             else:
                 sys.stdout.write(self._bytes)
 
-    def read(self):
+    def get_config(self):
         hdr_offset, length = self.find_config()
         offset = hdr_offset + 4 + FILE_HDR_LEN
         config_bytes = self._bytes[offset:offset+length-FILENAME_LEN-4]
+        return config_bytes
+
+    def read(self):
+        config_bytes = self.get_config()
         if self._out is not None:
             self._out.write(config_bytes)
             self._out.close()
@@ -97,34 +266,103 @@ class BootloaderImage(object):
                 sys.stdout.write(config_bytes)
 
 def main():
-    parser = argparse.ArgumentParser(formatter_class=argparse.RawDescriptionHelpFormatter, \
-    description='Bootloader EEPROM configuration tool for the Raspberry Pi 4B. \
-\n\nThere are 3 operating modes: \
-\n\n1. Output the bootloader configuration stored in an EEPROM image file to \
-the screen (STDOUT): specify only the name of an EEPROM image file using the \
-\'eeprom\' option. \
-\n\n2. Output the bootloader configuration stored in an EEPROM image file to a \
-file: specify the EEPROM image file using the \'eeprom\' option, and the output \
-file using the \'--out\' option.\
-\n\n3. Insert a new bootloader configuration into an EEPROM image file: specify \
-the source EEPROM image file using the \'eeprom\' option and the bootloader \
-configuration file using the \'--config\' option. A new file which is a \
-combination of the EEPROM image file, together with the new bootloader \
-configuration file will be created - specify its name using the \'--out\' option. \
-The new bootloader configuration will replace any configuration present in the \
-source EEPROM image.\
-\n\nBootloader EEPROM images are contained in the \'rpi-eeprom-images\' package,\
- which installs them to the /lib/firmware/raspberrypi/bootloader directory.')
-    parser.add_argument('--config', help='Name of bootloader configuration file')
-    parser.add_argument('--out', help='Name of output file')
-    parser.add_argument('eeprom', help='Name of EEPROM file to use as input')
+    """
+    Utility for reading and writing the configuration file in the
+    Raspberry Pi 4 bootloader EEPROM image.
+    """
+    description = """\
+Bootloader EEPROM configuration tool for the Raspberry Pi 4.
+Operating modes:
+
+1. Outputs the current bootloader configuration to STDOUT if no arguments are
+   specified OR the given output file if --out is specified.
+
+   rpi-eeprom-config [--out boot.conf]
+
+2. Extracts the configuration file from the given 'eeprom' file and outputs
+   the result to STDOUT or the output file if --output is specified.
+
+   rpi-eeprom-config pieeprom.bin [--out boot.conf]
+
+3. Writes a new EEPROM image replacing the configuration file with the contents
+   of the file specified by --config.
+
+   rpi-eeprom-config --config boot.conf --out newimage.bin pieeprom.bin
+
+   The new image file can be installed via rpi-eeprom-update
+   rpi-eeprom-update -d -f newimage.bin
+
+4. Applies a given config file to an EEPROM image and invokes rpi-eeprom-update
+   to schedule an update of the bootloader when the system is rebooted.
+
+   Since this command launches rpi-eeprom-update to schedule the EEPROM update
+   it must be run as root.
+
+   sudo rpi-eeprom-config --apply boot.conf [pieeprom.bin]
+
+   If the 'eeprom' argument is not specified then the latest available image
+   is selected by calling 'rpi-eeprom-update -l'.
+
+5. The '--edit' parameter behaves the same as '--apply' except that instead of
+   applying a predefined configuration file a text editor is launched with the
+   contents of the current EEPROM configuration.
+
+   Since this command launches rpi-eeprom-update to schedule the EEPROM update
+   it must be run as root.
+
+   The configuration file will be taken from:
+       * The blconfig reserved memory nvmem device
+       * The cached bootloader configuration 'vcgencmd bootloader_config'
+       * The current pending update - typically /boot/pieeprom.upd
+
+   sudo -E rpi-eeprom-config --edit [pieeprom.bin]
+
+   To cancel the pending update run 'sudo rpi-eeprom-update -r'
+
+   The default text editor is nano and may be overridden by setting the 'EDITOR'
+   environment variable and passing '-E' to 'sudo' to preserve the environment.
+
+See 'rpi-eeprom-update -h' for more information about the available EEPROM
+images.
+"""
+    parser = argparse.ArgumentParser(formatter_class=argparse.RawDescriptionHelpFormatter,
+                                     description=description)
+
+    parser.add_argument('-a', '--apply', required=False,
+                        help='Updates the bootloader to the given config plus latest available EEPROM release.')
+    parser.add_argument('-c', '--config', help='Name of bootloader configuration file', required=False)
+    parser.add_argument('-e', '--edit', action='store_true', default=False, help='Edit the current EEPROM config')
+    parser.add_argument('-o', '--out', help='Name of output file', required=False)
+    parser.add_argument('eeprom', nargs='?', help='Name of EEPROM file to use as input')
     args = parser.parse_args()
 
-    image = BootloaderImage(args.eeprom, args.out)
-    if args.config is not None:
-        image.write(args.config)
-    else:
-        image.read()
+    if (args.edit or args.apply is not None) and os.getuid() != 0:
+        exit_error("--edit/--apply must be run as root")
+
+    if (args.edit or args.apply is not None) and not rpi4():
+        exit_error("--edit/--apply must run on a Raspberry Pi 4")
+
+    if args.edit:
+        edit_config(args.eeprom)
+    elif args.apply is not None:
+        if not os.path.exists(args.apply):
+            exit_error("config file '%s' not found" % args.apply)
+        apply_update(args.apply, args.eeprom, args.apply)
+    elif args.eeprom is not None:
+        image = BootloaderImage(args.eeprom, args.out)
+        if args.config is not None:
+            if not os.path.exists(args.config):
+                exit_error("config file '%s' not found" % args.config)
+            image.write(args.config)
+        else:
+            image.read()
+    elif args.config is None and args.eeprom is None:
+        current_config, config_src = read_current_config()
+        if args.out is not None:
+            open(args.out, 'w').write(current_config)
+        else:
+            sys.stdout.write(current_config)
 
 if __name__ == '__main__':
+    atexit.register(exit_handler)
     main()

rpi-eeprom-update

@@ -23,15 +23,18 @@ else
    FIRMWARE_ROOT="${script_dir}/firmware"
 fi
 
-# May be used to select beta or stable releases instead of the default critical updates.
-FIRMWARE_RELEASE_STATUS=${FIRMWARE_RELEASE_STATUS:-critical}
+# Selects the release sub-directory
+FIRMWARE_RELEASE_STATUS=${FIRMWARE_RELEASE_STATUS:-default}
 FIRMWARE_IMAGE_DIR=${FIRMWARE_IMAGE_DIR:-${FIRMWARE_ROOT}/${FIRMWARE_RELEASE_STATUS}}
 FIRMWARE_BACKUP_DIR=${FIRMWARE_BACKUP_DIR:-/var/lib/raspberrypi/bootloader/backup}
 ENABLE_VL805_UPDATES=${ENABLE_VL805_UPDATES:-1}
-USE_FLASHROM=${USE_FLASHROM:-0}
 RECOVERY_BIN=${RECOVERY_BIN:-${FIRMWARE_ROOT}/${FIRMWARE_RELEASE_STATUS}/recovery.bin}
 BOOTFS=${BOOTFS:-/boot}
 VCMAILBOX=${VCMAILBOX:-/opt/vc/bin/vcmailbox}
+CM4_ENABLE_RPI_EEPROM_UPDATE=${CM4_ENABLE_RPI_EEPROM_UPDATE:-0}
+RPI_EEPROM_UPDATE_CONFIG_TOOL="${RPI_EEPROM_UPDATE_CONFIG_TOOL:-raspi-config}"
+
+DT_BOOTLOADER_TS=${DT_BOOTLOADER_TS:-/proc/device-tree/chosen/bootloader/build-timestamp}
 
 EXIT_SUCCESS=0
 EXIT_UPDATE_REQUIRED=1
@@ -41,16 +44,19 @@ EXIT_EEPROM_FROZEN=3
 # EXIT_PREVIOUS_UPDATE_FAILED=4
 
 OVERWRITE_CONFIG=0
-# Maximum safe SPI speed for EEPROM access 16000, slower is ok.
-SPI_SPEED=16000
 # Timestamp for first release which doesn't have a timestamp field
 BOOTLOADER_FIRST_VERSION=1557513636
 EEPROM_SIZE=524288
+BOARD_INFO=
 BOARD_REVISION=
+BOARD_TYPE=
 
-# Simple bootloader which is able to load start.elf in the event of a power
-# cut. This runs SDRAM at low speed and may have reduced functionality but
-# should be enough to run flashrom again.
+# Newer board revisions embed the VLI firmware in the bootloader EEPROM and
+# there is no way to separately update the VLI firmware. Consequently,
+# standalone vl805 update files do not trigger automatic updates.
+# Recovery.bin and the the SPI bootloader ignore vl805.bin files on boards
+# without a dedicate VL805 EEPROM.
+HAVE_VL805_EEPROM=0
 
 TMP_EEPROM_IMAGE=""
 TMP_BOOTFS_MNT=""
@@ -61,8 +67,12 @@ VL805_UPDATE_VERSION=
 # The update actions selected by the version check
 ACTION_UPDATE_BOOTLOADER=0
 ACTION_UPDATE_VL805=0
+CHECKSUMS=''
 
 cleanup() {
+   if [ -f "${CHECKSUMS}" ]; then
+      rm -f "${CHECKSUMS}"
+   fi
    if [ -f "${TMP_EEPROM_IMAGE}" ]; then
       rm -f "${TMP_EEPROM_IMAGE}"
    fi
@@ -88,9 +98,37 @@ die() {
    exit ${EXIT_FAILED}
 }
 
+getBootloaderConfig() {
+   # Prefer extracting bootloader's config from DT.
+   #
+   # In order to find the right nvmem device, we build the sysfs path of the
+   # bootloader reserved memory DT node to then match that path against all
+   # nvmem device's ofnode path.
+   #
+   # If the path isn't there, default to using vcgencmd.
+
+   local blconfig_alias="/sys/firmware/devicetree/base/aliases/blconfig"
+   local blconfig_nvmem_path=""
+
+   if [ -f "${blconfig_alias}" ]; then
+      local blconfig_ofnode_path="/sys/firmware/devicetree/base"$(strings "${blconfig_alias}")""
+      local blconfig_ofnode_link=$(find -L /sys/bus/nvmem -samefile "${blconfig_ofnode_path}" 2>/dev/null)
+
+      if [ -e "${blconfig_ofnode_link}" ]; then
+         blconfig_nvmem_path=$(dirname "${blconfig_ofnode_link}")
+      fi
+   fi
+
+   if [ -n "${blconfig_nvmem_path}" ]; then
+      cat "${blconfig_nvmem_path}"/nvmem
+   else
+      vcgencmd bootloader_config
+   fi
+}
+
 prepareImage()
 {
-   [ -f "${BOOTLOADER_UPDATE_IMAGE}" ] || die "EEPROM image \'${BOOTLOADER_UPDATE_IMAGE}\' not found"
+   [ -f "${BOOTLOADER_UPDATE_IMAGE}" ] || die "EEPROM image '${BOOTLOADER_UPDATE_IMAGE}' not found"
    TMP_EEPROM_IMAGE="$(mktemp)"
    TMP_EEPROM_CONFIG="$(mktemp)"
    NEW_EEPROM_CONFIG="$(mktemp)"
@@ -98,7 +136,7 @@ prepareImage()
    mkdir -p "${FIRMWARE_BACKUP_DIR}"
 
    # Backup the configuration of the currently loaded bootloader
-   vcgencmd bootloader_config > "${TMP_EEPROM_CONFIG}"
+   getBootloaderConfig > "${TMP_EEPROM_CONFIG}"
    backup="${FIRMWARE_BACKUP_DIR}/pieeprom-backup-$(date +%Y%m%d-%H%M%S).conf"
    cp -f "${TMP_EEPROM_CONFIG}" "${backup}"
 
@@ -133,12 +171,19 @@ applyRecoveryUpdate()
    [ -n "${BOOTLOADER_UPDATE_IMAGE}" ] || [ -n "${VL805_UPDATE_IMAGE}" ] || die "No update images specified"
 
    findBootFS
+   echo "BOOTFS ${BOOTFS}"
 
    # A '.sig' file is created so that recovery.bin can check that the
-   # EEPROM image has not been created (e.g. SD card corruption).
-   # The .sig file format is currently just a SHA256 in ASCII hex. In future,
-   # if an actual public key signature is required then that plus any other
-   # data would be appended after the SHA256 signature.
+   # EEPROM image has not been corrupted (e.g. SD card corruption).
+   # Format of the .sig file.
+   # --
+   # SHA256\n
+   # ts: UPDATE-TIMESTAMP\n
+   # --
+   # SHA256 is a 64 character hex string
+   # UPDATE-TIMESTAMP is an unsigned decimal.
+   #
+   # The 'filename' output from sha256 MUST be omitted.
    if [ -n "${BOOTLOADER_UPDATE_IMAGE}" ]; then
         [ -f "${BOOTLOADER_UPDATE_IMAGE}" ] || die "${BOOTLOADER_UPDATE_IMAGE} not found"
 
@@ -152,14 +197,33 @@ applyRecoveryUpdate()
         sha256sum "${TMP_EEPROM_IMAGE}" | awk '{print $1}' > "${BOOTFS}/pieeprom.sig" \
                 || die "Failed to create ${BOOTFS}/pieeprom.sig"
 
+        # Appends the update creation timestamp on a newline in pieeprom.sig
+        # During a self-update mode the bootloader examines the update-timestamp
+        # and will only update itself if it is newer than the current update
+        # timestamp.
+        #
+        # The update-timestamp is independent of the bootloader version and
+        # does not have to be timestamp.
+        echo "ts: $(date -u +%s)" >> "${BOOTFS}/pieeprom.sig"
+
         cp -f "${TMP_EEPROM_IMAGE}" "${BOOTFS}/pieeprom.upd" \
                 || die "Failed to copy ${TMP_EEPROM_IMAGE} to ${BOOTFS}"
+
+        # For NFS mounts ensure that the files are readable to the TFTP user
+        chmod -f go+r "${BOOTFS}/pieeprom.upd" "${BOOTFS}/pieeprom.sig" \
+                || die "Failed to set permissions on eeprom update files"
    fi
 
    if [ -n "${VL805_UPDATE_IMAGE}" ]; then
         sha256sum "${VL805_UPDATE_IMAGE}" | awk '{print $1}' > "${BOOTFS}/vl805.sig" \
                 || die "Failed to create ${BOOTFS}/vl805.sig"
-        cp -f "${VL805_UPDATE_IMAGE}" "${BOOTFS}/vl805.bin"
+
+        cp -f "${VL805_UPDATE_IMAGE}" "${BOOTFS}/vl805.bin" \
+                || die "Failed to copy ${VL805_UPDATE_IMAGE} to ${BOOTFS}/vl805.bin"
+
+        # For NFS mounts ensure that the files are readable to the TFTP user
+        chmod -f go+r "${BOOTFS}/vl805.bin" "${BOOTFS}/vl805.sig" \
+                || die "Failed to set permissions on eeprom update files"
    fi
 
    cp -f "${RECOVERY_BIN}" "${BOOTFS}/recovery.bin" \
@@ -167,59 +231,36 @@ applyRecoveryUpdate()
 }
 
 applyUpdate() {
-   checksums_file="/var/lib/dpkg/info/rpi-eeprom-images.md5sums"
-
    [ "$(id -u)" = "0" ] || die "* Must be run as root - try 'sudo rpi-eeprom-update'"
 
-   if [ "${IGNORE_DPKG_CHECKSUMS}" = 0 ] && [ -f "${checksums_file}" ]; then
+   if [ "${IGNORE_DPKG_CHECKSUMS}" = 0 ]; then
       (
-         cd /
-         if ! md5sum -c "${checksums_file}" > /dev/null 2>&1; then
-            md5sum -c "${checksums_file}"
-            die "rpi-eeprom-images checksums failed - try reinstalling this package"
+         package_checksums_file="${PACKAGE_INFO_DIR}/rpi-eeprom.md5sums"
+
+         if ! grep -qE '\.bin$' "${PACKAGE_INFO_DIR}/rpi-eeprom.md5sums"; then
+            # Try the old rpi-eeprom-images package
+            package_checksums_file="${PACKAGE_INFO_DIR}/rpi-eeprom-images.md5sums"
          fi
-      )
+
+         CHECKSUMS=$(mktemp)
+         grep -E '\.bin$' "${package_checksums_file}" > "${CHECKSUMS}"
+         cd /
+         if ! md5sum -c "${CHECKSUMS}" > /dev/null 2>&1; then
+            md5sum -c "${CHECKSUMS}"
+            die "rpi-eeprom checksums failed - try reinstalling this package"
+         fi
+      ) || die "Unable to validate EEPROM image package checksums"
    fi
 
-   if [ "${USE_FLASHROM}" = 0 ]; then
-      applyRecoveryUpdate
-      return
-   fi
-
-   if [ -f "${BOOTLOADER_UPDATE_IMAGE}" ]; then
-      # Bootloader EEPROM chip-select is muxed with audio pin so disable audio
-      # LDO first to avoid sending noise to analog audio.
-      "${VCMAILBOX}" 0x00030056 4 4 0 > /dev/null || true
-      dtparam audio=off
-
-      # Switch the SPI pins to boot EEPROM
-      dtoverlay spi-gpio40-45
-      modprobe spidev
-      modprobe spi-bcm2835
-
-      prepareImage "${BOOTLOADER_UPDATE_IMAGE}"
-
-      echo "Applying bootloader update ${BOOTLOADER_UPDATE_IMAGE}"
-      flashrom -p "linux_spi:dev=/dev/spidev0.0,spispeed=${SPI_SPEED}" -w "${TMP_EEPROM_IMAGE}" || die "flashrom EEPROM update failed"
-
-      dtparam -R spi-gpio40-45
-      dtparam audio=on
-      ${VCMAILBOX} 0x00030056 4 4 1 > /dev/null || true
-   fi
-
-   if [ -f "${VL805_UPDATE_IMAGE}" ]; then
-      echo "Applying VL805 image ${VL805_UPDATE_IMAGE}"
-      vl805 -w "${VL805_UPDATE_IMAGE}"
-   fi
-
-   echo "Applying bootloader update ${BOOTLOADER_UPDATE_IMAGE}"
+   applyRecoveryUpdate
 }
 
-# Use the version reported by the loaded EEPROM instead of attempting to retrieve
-# this via flashrom to avoid unnecessary audio glitches.
 BOOTLOADER_CURRENT_VERSION=
 getBootloaderCurrentVersion() {
-   if vcgencmd bootloader_version | grep -q timestamp; then
+   if [ -f "${DT_BOOTLOADER_TS}" ]; then
+      # Prefer device-tree to vcgencmd
+      BOOTLOADER_CURRENT_VERSION=$(printf "%d" "0x$(od "${DT_BOOTLOADER_TS}" -v -An -t x1 | tr -d ' ' )")
+   elif vcgencmd bootloader_version | grep -q timestamp; then
       BOOTLOADER_CURRENT_VERSION=$(vcgencmd bootloader_version | grep timestamp | awk '{print $2}')
       if [ "${BOOTLOADER_CURRENT_VERSION}" = "0" ]; then
          # If a timestamp of zero is returned then it's new firmware but an
@@ -243,7 +284,7 @@ BOOTLOADER_UPDATE_VERSION=0
 getBootloaderUpdateVersion() {
    BOOTLOADER_UPDATE_VERSION=0
    match=".*/pieeprom-[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9].bin"
-   latest="$(find "${FIRMWARE_IMAGE_DIR}" -maxdepth 1 -type f -size "${EEPROM_SIZE}c" -regex "${match}" | sort -r | head -n1)"
+   latest="$(find "${FIRMWARE_IMAGE_DIR}/" -maxdepth 1 -type f -size "${EEPROM_SIZE}c" -regex "${match}" | sort -r | head -n1)"
    if [ -f "${latest}" ]; then
       BOOTLOADER_UPDATE_VERSION=$(strings "${latest}" | grep BUILD_TIMESTAMP | sed 's/.*=//g')
       BOOTLOADER_UPDATE_IMAGE="${latest}"
@@ -251,53 +292,71 @@ getBootloaderUpdateVersion() {
 }
 
 checkDependencies() {
-   BOARD_REVISION="$(sed -n '/^Revision/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo)"
-   if [ $(((0x$BOARD_REVISION >> 23) & 1)) -ne 0 ] && [ $(((0x$BOARD_REVISION >> 12) & 15)) -eq 3 ]; then
+
+   if [ -f "/sys/firmware/devicetree/base/system/linux,revision" ]; then
+      BOARD_INFO="$(od -v -An -t x1 /sys/firmware/devicetree/base/system/linux,revision | tr -d ' \n')"
+   elif grep -q Revision /proc/cpuinfo; then
+      BOARD_INFO="$(sed -n '/^Revision/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo)"
+   else
+      BOARD_INFO="$(vcgencmd otp_dump | grep '30:' | sed 's/.*://')"
+   fi
+
+   if [ $(((0x$BOARD_INFO >> 23) & 1)) -ne 0 ] && [ $(((0x$BOARD_INFO >> 12) & 15)) -eq 3 ]; then
       echo "BCM2711 detected"
    else
       # Not a BCM2711, no EEPROMs to update.
+      echo "This tool only works with a Raspberry Pi 4"
       exit ${EXIT_SUCCESS}
    fi
 
-   if ! command -v vcgencmd  > /dev/null; then
-      die "vcgencmd not found. On Debian, try installing the libraspberrypi-bin package."
+   BOARD_TYPE=$(((0x$BOARD_INFO >> 4) & 0xff))
+   BOARD_REVISION=$((0x$BOARD_INFO & 0xf))
+
+   if [ ${BOARD_TYPE} -eq 20 ] && [ "${CM4_ENABLE_RPI_EEPROM_UPDATE}" != '1' ]; then
+      # For CM4, USB device boot is the recommended method for EEPROM updates.
+      echo "rpi-eeprom-update is not enabled by default on CM4. Run with -h for more information."
+      exit ${EXIT_SUCCESS}
    fi
 
-   if [ ! -d "${FIRMWARE_IMAGE_DIR}" ]; then
+   if [ ${BOARD_TYPE} -eq 17 ] && [ ${BOARD_REVISION} -lt 4 ]; then
+      echo "Dedicated VL805 EEPROM detected"
+      HAVE_VL805_EEPROM=1
+   else
+      echo "VL805 firmware in bootloader EEPROM"
+      HAVE_VL805_EEPROM=0
+   fi
+
+   if ! command -v lspci > /dev/null; then
+      die "lspci not found. Try installing the pciutils package."
+   fi
+
+   # vcgencmd bootloader_version is deprecated. Use device-tree if available to
+   # reduce the number of dependencies on VCHI.
+   if ! [ -f "${DT_BOOTLOADER_TS}" ]; then
+      if ! command -v vcgencmd > /dev/null; then
+         die "vcgencmd not found. Try installing the libraspberrypi-bin package."
+      fi
+   fi
+
+   if [ ! -e "${FIRMWARE_IMAGE_DIR}" ]; then
       die "EEPROM updates directory ${FIRMWARE_IMAGE_DIR} not found."
    fi
 
    # If a board revision specific firmware directory is defined then use that
    # in preference to the generic directory.
-   if [ -d "${FIRMWARE_IMAGE_DIR}-${BOARD_REVISION}" ]; then
-      FIRMWARE_IMAGE_DIR="${FIRMWARE_IMAGE_DIR}-${BOARD_REVISION}"
+   if [ -e "${FIRMWARE_IMAGE_DIR}-${BOARD_INFO}" ]; then
+      FIRMWARE_IMAGE_DIR="${FIRMWARE_IMAGE_DIR}-${BOARD_INFO}"
    fi
 
-   if vcgencmd bootloader_config | grep -qi "Command not registered"; then
-      die "vcgencmd: 'bootloader_config' command not supported. Please update VC firmware and reboot."
+   if ! getBootloaderConfig > /dev/null; then
+      die "Unable to get bootloader config, please update VC firmware and reboot."
    fi
 
    if ! command -v sha256sum > /dev/null; then
-      die "sha256sum not found. On Debian, try installing the coreutilities package"
+      die "sha256sum not found. Try installing the coreutilities package."
    fi
 
-   if ! command -v flashrom  > /dev/null && [ "${USE_FLASHROM}" = 1 ]; then
-      die "flashrom not found. On Debian, try installing the flashrom package."
-   fi
-
-   if [ ! -x "${VCMAILBOX}" ] && [ "${USE_FLASHROM}" = 1 ]; then
-      die "vcmailbox not found. On Debian, try installing the libraspberrypi-bin package."
-   fi
-
-   if ! command -v dtparam > /dev/null && [ "${USE_FLASHROM}" = 1 ]; then
-      die "dtparam not found. On Debian, try installing the libraspberrypi-bin package."
-   fi
-
-   if ! command -v dtoverlay > /dev/null && [ "${USE_FLASHROM}" = 1 ]; then
-      die "dtoverlay not found. On Debian, try installing the libraspberrypi-bin package."
-   fi
-
-   if [ "${USE_FLASHROM}" = 0 ] && [ ! -f "${RECOVERY_BIN}" ]; then
+   if [ ! -f "${RECOVERY_BIN}" ]; then
       die "${RECOVERY_BIN} not found."
    fi
 }
@@ -306,11 +365,13 @@ usage() {
 cat <<EOF
 rpi-eeprom-update [options]... [FILE]
 
-Checks whether the Raspberry Pi bootloader and the VL805 USB controller
+Bootloader EEPROM update tool for the Raspberry Pi 4.
+
+Checks whether the Raspberry Pi 4 bootloader and the VL805 USB controller
 EEPROMs are up-to-date and optionally updates the EEPROMs at the next reboot.
 
 The default update mechanism writes recovery.bin and the EEPROM update
-image(s) (pieeprom.upd and vl805.bin) to the boot partition on the sd-card.
+image(s) (pieeprom.upd and vl805.bin) to the boot partition.
 The SHA256 hash of the corresponding images are written to pieeprom.sig
 and/or vl805.sig. This guards against file system corruption which could
 cause the EEPROM to be flashed with an invalid image. This is not a
@@ -321,25 +382,32 @@ If the update was successful recovery.bin renames itself to recovery.000
 to prevent it from running a second time then resets the system.
 The system should then boot normally.
 
-If /boot does not correspond to the boot partition on the sd-card and this
-is not a NOOBS system then the mount point for BOOTFS should be defined
+If /boot does not correspond to the boot partition and this
+is not a NOOBS system, then the mount point for BOOTFS should be defined
 in /etc/default/rpi-eeprom-update by defining the BOOTFS variable.
 
 A backup of the current EEPROM config file is written to ${FIRMWARE_BACKUP_DIR}
 before applying the update.
 
+Unless the -d flag is specified, the current bootloader configuration is
+retained.
+
 Options:
    -a Automatically install bootloader and USB (VLI) EEPROM updates.
    -A Specify which type of EEPROM to automatically update (vl805 or bootloader)
-   -d Use the default bootloader config instead of migrating the current settings
+   -b Outputs the path that pending EEPROM updates will be written to.
+   -d Use the default bootloader config, or if a file is specified using the -f
+      flag use the config in that file. This option only applies when a
+      bootloader EEPROM update is needed; if the bootloader EEPROM is up-to-date
+      then its config will not be changed.
    -f Install the given file instead of the latest applicable update
       Ignores the FREEZE_VERSION flag in bootloader and is intended for manual
       firmware updates.
-      WARNING: This command should only be run from console mode in order to
-      avoid conflicts/deadlock with dtoverlay/dtparam settings.
    -h Display help text and exit
    -i Ignore package checksums - for rpi-eeprom developers.
    -j Write status information using JSON notation
+   -l Returns the full path to the latest available EEPROM image file according
+      to the FIRMWARE_RELEASE_STATUS and FIRMWARE_IMAGE_DIR settings.
    -m Write status information to the given file when run without -a or -f
    -r Removes temporary EEPROM update files from the boot partition.
    -u Install the specified VL805 (USB EEPROM) image file.
@@ -354,29 +422,42 @@ configuration file before it is applied to the new image. The modified
 output must contain at least 3 lines and should contain WAKE_ON_GPIO
 and POWER_OFF_ON_HALT settings.
 
-USE_FLASHROM
-
-The flashrom update mechanism may be enabled by setting USE_FLASHROM=1. This
-also selects the vl805 tool instead of using recovery.bin to perform the
-update. This may be desirable if an immediate update is required or if an
-sd-card is not present.
-However, this not recommended because the SPI pins are muxed with audio and other
-device drivers may be using SPI (e.g. HATs). This is also not safe in the
-event of a power failure during the update of the EEPROM.
-Changing the VL805 firmware whilst USB devices are attached may also cause
-those devices to stop working until after the system is reboot.
-
 FIRMWARE_RELEASE_STATUS
 
-Specifies the release status of the firmware to apply. The default is 'critical'
-which is the most stable production version. Alternatively, 'stable' or
-'beta' may be selected for development releases.
-A 'critical' update is the latest stable production version and is normally
-only updated after it has been tested via the 'beta' and then a 'stable' release.
+Specifies the release status of the firmware to apply.
+
 Before selecting a firmware release directory this script checks whether there
-is a board revision specific variant e.g. critical-c03111. If present then the
+is a board revision specific variant e.g. default-c03111. If present then the
 board-revision specific version is used in preference.
 
+Release status:
+Bootloader releases follow a pipeline where images are released to the 'beta'
+directory first. The binaries are then promoted to 'latest' and finally 'default'
+so the 'default' binary is always the most tested release.
+
+default:
+The default bootloader image which is updated once new features in
+'latest' are stable or for critical hardware or security updates.
+
+Raspberry Pi OS automatically updates the bootloader when a newer 'default' image
+is available following an APT update to the rpi-eeprom package.
+
+latest:
+Contains the latest features which have undergone testing via the 'beta'
+release. The configuration parameters are stable.
+
+beta:
+Contains experimental features and bug fixes. Configuration parameters may
+change in subsequent 'beta' releases.
+
+As far as rpi-eeprom-update is concerned FIRMWARE_RELEASE_STATUS is just
+the subdirectory mapping under ${FIRMWARE_ROOT}. Therefore, custom release
+directories are supported by creating the relevant directory and changing
+the FIRMWARE_RELEASE_STATUS environment variable.
+
+The 'default' and 'latest' release names are symlinks to the old directory
+names of 'critical' / 'stable'.
+
 Examples:
 To extract the configuration file from an EEPROM image:
    rpi-eeprom-config pieeprom.bin --out bootconf.txt
@@ -392,24 +473,52 @@ The syntax is the same as config.txt See online documentation for the list of pa
 The official documentation for the Raspberry Pi bootloader EEPROM is available at
 https://www.raspberrypi.org/documentation/hardware/raspberrypi/booteeprom.md
 
+Compute Module 4 (CM4):
+
+CM4 is designed to support embedded applications where physical access to the CM4
+may be limited.  An invalid bootloader configuration or software bug could
+cause the system to fail to boot so automatic updates are disabled. We also
+recommend write-protecting the SPI EPPROM after flashing it using usbboot.
+
+CM4 bootloader and EEPROM update instructions:
+   https://www.raspberrypi.org/documentation/hardware/computemodule/cm-emmc-flashing.md
+
+usbboot instructions for flashing CM4 EMMC and bootloader EEPROM:
+   https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2711_bootloader_config.md
+
+The CM4 ROM does not support running recovery.bin from the EMMC on CM4 so this service
+is disabled by default. SELF_UPDATE from USB or Network boot is supported but this
+must first be enabled by removing ENABLE_SELF_UPDATE=0 from the EEPROM config
+via usbboot.
+
+After enabling self-update set the CM4_ENABLE_RPI_EEPROM_UPDATE=1 environment
+variable or define it in /etc/default/rpi-eeprom-update.
+
+N.B. If there is a power failure during SELF_UPDATE the EEPROM write may fail and
+usbboot must be used to flash the bootloader EEPROM. SELF_UPDATE is not recommended
+for updating the bootloader on remote systems.
+
 EOF
   exit ${EXIT_SUCCESS}
 }
 
 printVersions()
 {
+   echo "Checking for updates in ${FIRMWARE_IMAGE_DIR}"
+   echo "Use ${RPI_EEPROM_UPDATE_CONFIG_TOOL} to select either the default-production release or latest update."
+
    if [ "${ACTION_UPDATE_BOOTLOADER}" = 1 ]; then
-      echo "BOOTLOADER: update required"
+      echo "BOOTLOADER: update available"
    else
       echo "BOOTLOADER: up-to-date"
    fi
 
    echo "CURRENT: $(date -u "-d@${BOOTLOADER_CURRENT_VERSION}") (${BOOTLOADER_CURRENT_VERSION})"
    echo " LATEST: $(date -u "-d@${BOOTLOADER_UPDATE_VERSION}") (${BOOTLOADER_UPDATE_VERSION})"
-   echo " FW DIR: ${FIRMWARE_IMAGE_DIR}"
+   echo "RELEASE: ${FIRMWARE_RELEASE_STATUS}"
 
    if [ "${ACTION_UPDATE_VL805}" = 1 ]; then
-      echo "VL805: update required"
+      echo "VL805: update available"
    else
       if [ "$(id -u)" = "0" ]; then
          echo "VL805: up-to-date"
@@ -438,7 +547,9 @@ findBootFS()
    # If BOOTFS is not a directory or doesn't contain any .elf files then
    # it's probably not the boot partition.
    [ -d "${BOOTFS}" ] || die "BOOTFS: \"${BOOTFS}\" is not a directory"
-   [ "$(find "${BOOTFS}/" -name "*.elf" | wc -l)" -gt 0 ] || die "BOOTFS: \"${BOOTFS}\" contains no .elf files"
+   if [ "$(find "${BOOTFS}/" -name "*.elf" | wc -l)" = 0 ]; then
+      echo "WARNING: BOOTFS: \"${BOOTFS}\" contains no .elf files. Please check boot directory"
+   fi
 }
 
 getVL805CurrentVersion()
@@ -448,11 +559,7 @@ getVL805CurrentVersion()
    # root then treat the version as unknown and skip VLI updates.
    VL805_CURRENT_VERSION=""
    if [ "$(id -u)" = "0" ]; then
-      if command -v lspci >/dev/null; then
          vlver="$(lspci -d 1106:3483 -xxx | awk '/^50:/ { print "VL805 FW version: " $5 $4 $3 $2 }')"
-      else
-         vlver="$(vl805 | grep "VL805 FW version")"
-      fi
       if [ -n "${vlver}" ]; then
          VL805_CURRENT_VERSION="${vlver#*: }"
       fi
@@ -483,7 +590,6 @@ lookupVersionInfo()
    getBootloaderUpdateVersion
 
    getVL805CurrentVersion
-   getVL805UpdateVersion
 
    if [ "${BOOTLOADER_UPDATE_VERSION}" -gt "${BOOTLOADER_CURRENT_VERSION}" ]; then
       ACTION_UPDATE_BOOTLOADER=1
@@ -491,12 +597,18 @@ lookupVersionInfo()
       BOOTLOADER_UPDATE_IMAGE=""
    fi
 
-   if [ -n "${VL805_CURRENT_VERSION}" ] && [ -n "${VL805_UPDATE_VERSION}" ]; then
-      if [ "${VL805_CURRENT_VERSION}" \< "${VL805_UPDATE_VERSION}" ];  then
-         ACTION_UPDATE_VL805=1
-      else
-         VL805_UPDATE_IMAGE=""
+   if [ "${HAVE_VL805_EEPROM}" = 1 ]; then
+      getVL805UpdateVersion
+      if [ -n "${VL805_CURRENT_VERSION}" ] && [ -n "${VL805_UPDATE_VERSION}" ]; then
+         if [ "$((0x${VL805_CURRENT_VERSION}))" -lt "$((0x${VL805_UPDATE_VERSION}))" ];  then
+            ACTION_UPDATE_VL805=1
+         else
+            VL805_UPDATE_IMAGE=""
+         fi
       fi
+   else
+      VL805_UPDATE_VERSION="${VL805_CURRENT_VERSION}"
+      ACTION_UPDATE_VL805=0
    fi
 }
 
@@ -547,14 +659,16 @@ removePreviousUpdates()
    if [ "$(id -u)" = "0" ]; then
       findBootFS
 
-      # Remove any stale recovery.bin files or EEPROM images
-      # N.B. recovery.bin is normally ignored by the ROM if is not a valid
-      # executable but it's best to not have the file at all.
-      rm -f "${BOOTFS}/recovery.bin"
-      rm -f "${BOOTFS}/pieeprom.bin" "${BOOTFS}/pieeprom.upd" "${BOOTFS}/pieeprom.sig"
-      rm -f "${BOOTFS}/vl805.bin" "${BOOTFS}/vl805.sig"
-      # Case insensitive for FAT bootfs
-      find "${BOOTFS}" -maxdepth 1 -type f -follow -iname "recovery.*" -regex '.*\.[0-9][0-9][0-9]$' -exec rm -f {} \;
+      (
+         # Remove any stale recovery.bin files or EEPROM images
+         # N.B. recovery.bin is normally ignored by the ROM if is not a valid
+         # executable but it's best to not have the file at all.
+         rm -f "${BOOTFS}/recovery.bin"
+         rm -f "${BOOTFS}/pieeprom.bin" "${BOOTFS}/pieeprom.upd" "${BOOTFS}/pieeprom.sig"
+         rm -f "${BOOTFS}/vl805.bin" "${BOOTFS}/vl805.sig"
+         # Case insensitive for FAT bootfs
+         find "${BOOTFS}" -maxdepth 1 -type f -follow -iname "recovery.*" -regex '.*\.[0-9][0-9][0-9]$' -exec rm -f {} \;
+      ) || die "Failed to remove previous update files"
    fi
 }
 
@@ -563,7 +677,7 @@ checkVersion()
    lookupVersionInfo
 
    if [ "${BOOTLOADER_UPDATE_VERSION}" -gt "${BOOTLOADER_CURRENT_VERSION}" ]; then
-      echo "*** UPDATE REQUIRED ***"
+      echo "*** UPDATE AVAILABLE ***"
       printVersions
       write_status_info "EXIT_UPDATE_REQUIRED"
       exit ${EXIT_UPDATE_REQUIRED}
@@ -585,21 +699,25 @@ write_status_info()
    vl805_new="${VL805_UPDATE_VERSION}"
 
     if [ "${JSON_OUTPUT}" = "no" ]; then
+      [ "${HAVE_VL805_EEPROM}" = "0" ] && vl805_eeprom="no" || vl805_eeprom="yes"
       cat > "${MACHINE_OUTPUT}" <<EOF
 EXITCODE="${exit_code}"
 BOOTLOADER_CURRENT=${bootloader_cur}
 BOOTLOADER_LATEST=${bootloader_new}
 VL805_CURRENT="${vl805_cur}"
 VL805_LATEST="${vl805_new}"
+VL805_EEPROM="${vl805_eeprom}"
 EOF
    else
+      [ "${HAVE_VL805_EEPROM}" = "0" ] && vl805_eeprom="false" || vl805_eeprom="true"
       cat > "${MACHINE_OUTPUT}" <<EOF
 {
   "EXITCODE": "${exit_code}",
   "BOOTLOADER_CURRENT": ${bootloader_cur},
   "BOOTLOADER_LATEST": ${bootloader_new},
   "VL805_CURRENT": "${vl805_cur}",
-  "VL805_LATEST": "${vl805_new}"
+  "VL805_LATEST": "${vl805_new}",
+  "VL805_EEPROM": ${vl805_eeprom}
 }
 EOF
    fi
@@ -610,9 +728,14 @@ AUTO_UPDATE_BOOTLOADER=0
 AUTO_UPDATE_VL805=0
 MACHINE_OUTPUT=""
 JSON_OUTPUT="no"
-IGNORE_DPKG_CHECKSUMS=$LOCAL_MODE
+IGNORE_DPKG_CHECKSUMS=${LOCAL_MODE}
+PACKAGE_INFO_DIR="/var/lib/dpkg/info/"
+if [ ! -d "${PACKAGE_INFO_DIR}" ]; then
+   IGNORE_DPKG_CHECKSUMS=1
+fi
 
-while getopts A:adhif:m:ju:r option; do
+
+while getopts A:abdhilf:m:ju:r option; do
    case "${option}" in
    A)
       if [ "${OPTARG}" = "bootloader" ]; then
@@ -626,6 +749,11 @@ while getopts A:adhif:m:ju:r option; do
    a) AUTO_UPDATE_BOOTLOADER=1
       AUTO_UPDATE_VL805=1
       ;;
+   b)
+      findBootFS
+      echo "${BOOTFS}"
+      exit 0
+      ;;
    d) OVERWRITE_CONFIG=1
       ;;
    f) BOOTLOADER_UPDATE_IMAGE="${OPTARG}"
@@ -634,6 +762,11 @@ while getopts A:adhif:m:ju:r option; do
       ;;
    j) JSON_OUTPUT="yes"
       ;;
+   l)
+      getBootloaderUpdateVersion
+      echo "${BOOTLOADER_UPDATE_IMAGE}"
+      exit 0
+      ;;
    m) MACHINE_OUTPUT="${OPTARG}"
       ;;
    h) usage
@@ -653,7 +786,7 @@ done
 
 checkDependencies
 if [ "${AUTO_UPDATE_BOOTLOADER}" = 1 ] || [ "${AUTO_UPDATE_VL805}" = 1 ]; then
-   if vcgencmd bootloader_config | grep FREEZE_VERSION=1; then
+   if getBootloaderConfig | grep FREEZE_VERSION=1; then
       echo "EEPROM version is frozen. Skipping update"
       exit ${EXIT_EEPROM_FROZEN}
    else

test/install

@@ -22,7 +22,7 @@ CONFIG="/etc/default/rpi-eeprom-update"
 cp -rfv "${FIRMWARE_DIR}"/* /lib/firmware/raspberrypi/bootloader
 cp -fv "${script_dir}/../rpi-eeprom-config" /usr/bin
 cp -fv "${script_dir}/../rpi-eeprom-update" /usr/bin
-cp -fv "${script_dir}/../firmware/vl805" /usr/bin
+rm -f /usr/bin/vl805
 
 cp -fv "${script_dir}/../rpi-eeprom-update-default" /etc/default/rpi-eeprom-update
 

test/test-rpi-eeprom-config

@@ -141,17 +141,17 @@ check_conf_size_too_large()
    fi
 }
 
-check_loopback "../firmware/critical/pieeprom-2019-07-15.bin" "bootconf-2019-07-15.txt"
+check_loopback "../firmware/old/beta/pieeprom-2019-07-15.bin" "bootconf-2019-07-15.txt"
 cleanup
 
-check_update "../firmware/critical/pieeprom-2019-07-15.bin" "pieeprom-2019-07-15-freeze.bin" "bootconf-2019-07-15-freeze.txt"
+check_update "../firmware/old/beta/pieeprom-2019-07-15.bin" "pieeprom-2019-07-15-freeze.bin" "bootconf-2019-07-15-freeze.txt"
 cleanup
 
-check_reduce_size "../firmware/critical/pieeprom-2019-07-15.bin" "bootconf-2019-07-15.txt"
+check_reduce_size "../firmware/old/beta/pieeprom-2019-07-15.bin" "bootconf-2019-07-15.txt"
 cleanup
 
-check_conf_size_large "../firmware/critical/pieeprom-2019-07-15.bin"
+check_conf_size_large "../firmware/old/beta/pieeprom-2019-07-15.bin"
 cleanup
 
-check_conf_size_too_large "../firmware/critical/pieeprom-2019-07-15.bin"
+check_conf_size_too_large "../firmware/old/beta/pieeprom-2019-07-15.bin"
 cleanup