Merge pull request #306 from timg236/make-release

make-release: Add a script for generating Raspberry Pi Imager releases

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,15 +1,21 @@
 ---
 name: Bug report
-about: Create a report to help us improve
-title: ''
-labels: ''
-assignees: ''
+about: Create a bug report for the bootloader EEPROM or rpi-eeprom-update scripts. Please use the Raspberry Pi General Discussion forum for general questions about the bootloader.
 
 ---
 
-For general boot questions please check the read the [Boot Problems](https://www.raspberrypi.org/forums/viewtopic.php?t=58151) sticky post on the forums.  
+This repository tracks bugs for the Raspberry Pi 4 bootloader EEPROM and Linux update scripts.
 
-N.B The bootloader does not persist in memory and if the rainbow splash screen has been displayed the issue is likely to be in the firmware or Linux. If so, it's better to target the bug in the [Firmware](https://github.com/raspberrypi/firmware/) or [Linux](https://github.com/raspberrypi/linux/) repositories first e.g. NFS, USB or dmesg logs would be Linux issues.
+* If you suspect a hardware problem then please read the [Boot Problems](https://www.raspberrypi.org/forums/viewtopic.php?p=437084) post first before contacting the reseller.
+* Support questions or should be posted on the Raspberry Pi [General Discussion](https://www.raspberrypi.org/forums/viewforum.php?f=63)**
+
+
+**Mandatory information**
+* Raspberry Pi model
+* Board revision (cat /proc/cpuinfo | grep Revision)
+* Operating system version .
+* Details of any hardware attached e.g. links to USB 
+* Photo of the HDMI diagnostics screen, UART trace.
 
 **Describe the bug**
 A clear and concise description of what the bug is.
@@ -20,27 +26,25 @@ Steps to reproduce the behavior:
 **Expected behaviour**
 A clear and concise description of what you expected to happen.
 
-**Screenshots**
-If applicable, add a photograph of the bootloader HDMI diagnostics screen.
-
 **Bootloader version and configuration**
-If you have modified the default bootloader release or configuration then please attach the bootloader configuration (vcgencmd bootloader_config) and version (vcgencmd bootloader_version)
+If you have modified the default bootloader release or configuration then please attach the bootloader configuration vcgencmd bootloader_config and version (vcgencmd bootloader_version)
 
 **SD card boot (please complete the following information):**
- - OS e.g. Raspbian
  - SD card type
- - Partition information (fdisk -l) if you are able to obtain this from another computer.
+ - Partition information (sudo fdisk -l) if you are able to obtain this from another computer.
 
 **Network boot (please complete the following information):**
-Network boot configuration can get very complicated. To get started we recommend using [PiServer](https://github.com/raspberrypi/piserver) and this is the official test/reference configuration. For other configurations, packet capture or a UART log is nearly always required because setting up custom network configurations to investigate bugs is extremely time-consuming and error-prone.
+Network boot bug normally require one or more of the following log types. [PiServer](https://github.com/raspberrypi/piserver) is the officially supported network boot server.
 
  - DHCP server configuration files e.g. dnsmasq.conf
  - Wireshark binary packet capture
  - UART logs
 
 **USB boot (please complete the following information):**
-For issues booting with specific USB devices please verify that the system boots from an SD-card with the same devices connected and attach the results of 'lsusb -vvv'. This helps to rule out USB HUB power issues.
-In the beta release it's likely that a UART or NetConsole boot trace will be required.
+Verify that the the USB device works correctly when hot-plugged under Linux and attache the output of 'lsusb -vvv'
 
 **Additional context**
-Add any other context about the problem here.
+Add any other context about the problem here. 
+
+The [Bootloader configuration](https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2711_bootloader_config.md) page describes how to enable UART or NETCONSOLE logs. For complex USB boot issues NETCONSOLE logs are recommended.
+

README.md

@@ -1,11 +1,11 @@
 # rpi-eeprom
-This repository contains the scripts and pre-compiled binaries used to create the `rpi-eeprom` package which is used to update the Raspberry Pi 4 bootloader and VLI EEPROMs.
+This repository contains the scripts and pre-compiled binaries used to create the `rpi-eeprom` package which is used to update the Raspberry Pi 4 bootloader and VLI USB xHCI controller EEPROMs.
 
 # Support
 Please check the Raspberry Pi [general discussion forum](https://www.raspberrypi.org/forums/viewforum.php?f=63) if you have a support question. 
 
 # Reset to factory defaults
-The [Raspberry Pi Imager](https://www.raspberrypi.org/downloads/) provides an EEPROM recovery image which may be used to reset the bootloader and VLI EEPROMs to factory defaults.
+The [Raspberry Pi Imager](https://www.raspberrypi.org/downloads/) provides an EEPROM recovery image which may be used to reset the bootloader and USB xHCI EEPROMs to factory defaults.
 
 # Bootloader documentation
 * [The boot folder](https://www.raspberrypi.org/documentation/configuration/boot_folder.md)

firmware/default

@@ -0,0 +1 @@
+critical

firmware/latest

@@ -0,0 +1 @@
+stable

firmware/release-notes.md

@@ -3,6 +3,137 @@
 USB MSD boot also requires the firmware from Raspberry Pi OS 2020-08-20 or newer.
 https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2711_bootloader_config.md
 
+## 2021-02-22 - Promote 2021-02-16 to stable - STABLE (LATEST)
+   * Freezing for default/critical update.
+
+## 2021-02-16 - Change VC version info & TFTP fix - BETA
+   * Display the VC_BUILD strings instead of the sha256 of the .elf file so that
+     the information is the same as "vcgencmd version"
+   * Change TFTP to ACK data blocks which it has already ACK'd instead of ignoring them.
+   * Change network boot to use the same "RXID" configuration as the 5.10 kernel.
+
+## 2021-01-16 - Fix 1V8 SD voltage reset for Pi 4B R1.1 - LATEST + BETA
+   * Fix regression for GPIO expander reset change which caused PMIC reset
+     to get card out of 1V8 mode to be missed.
+
+## 2021-01-14 - Promote pieeprom-2021-01-11 to STABLE (LATEST)
+
+## 2021-01-11 - Timeout stalled USB MSD devices - BETA
+   * Timeout USB MSD commands and move to the next boot mode if a device stops responding.
+   * Reset the GPIO expander at power on.
+   * Use the bootloader build timestamp instead of zero for the update-timestamp
+     if it is not defined in the .sig file.
+
+## 2021-01-05 - USB MSD interop improvements for Pi 4B < R1.4 - BETA
+   * Revert the USB port power delay on R1.1 boards to be more like the Sep 2020
+     production release. Verified with Geekworm X835, Orico NVME M.2 USB adapter
+     and Microsoft Wireless keyboard.
+   * Increase the HDMI delay to 8 seconds.
+
+## 2020-12-14 - Promote pieeprom-2020-12-11.bin to stable - STABLE
+   * Feature freeze to support stable release of BCM2711 XHCI boot, tryboot,
+     HDMI_DELAY, USB MSD improvements.
+
+## 2020-12-11 - CM4/PI400 conditional filters - BETA
+   * Add support for [cm4] and [pi400] config conditionals filters.
+   * Tidyup RPIBOOT USB descriptors.
+   * Add a gap before displaying LED error pattern and change the default state
+     to off after displaying the first error pattern.
+   * Generate 0xffff instead of 0x0 if the checksum of the UDP packet to be
+     transmitted is 0x0.
+   * Rename USB-DEV to RPIBOOT in boot-mode strings. Bootmode was renamed to
+     avoid confusion with USB MSD boot.
+
+## 2020-11-24 BCM2711 xHC boot support - BETA
+   * Add support for booting from the BCM2711 XHCI controller which is the
+     USB-C socket on Pi 4B / Pi 400 and the type A sockets on Compute Module 4
+     IO board. The controller only supports USB 2.0 and the primary usage is
+     for USB-MSD support on CM 4 boards without requiring a PCIe XHCI controller.
+
+     To use this add '5' to the BOOT_ORDER in the EEPROM config for BCM_USB_MSD boot.
+
+     This requires the latest rpi-update firmware.
+     
+     If start.elf is loaded via the BCM2711 XHCI (BOOT_ORDER 5) then the config.txt
+     otg_mode setting will be set to 1 so that the OS can continue booting
+     using the BCM2711 XHCI. This means that the device/gadget mode is not available
+     when booted in this mode and there is no support for switching back to 
+     the DWC2 controller from the BCM2711 XHCI controller.
+
+   * Update halt behavior on Pi 400 to re-enable 'power on' button if the OS
+     did a reset rather than using the standard mailbox shutdown commands. This
+     overrides WAKE_ON_GPIO / POWER_OFF_ON_HALT settings on Pi 400 because
+     it has a dedicated power button.
+     If a button on GPIO3 really is requried then it can be re-enabled by setting
+     WAKE_ON_GPIO=2 but that will consume more power.
+   * Fix short blink before one-shot error pattern - #251
+   * Validate SDRAM in recovery mode.
+   * XHCI protocol layer fixes for non-VLI controllers.
+   * Updated 'tryboot' for new version which also supports Pi3 and earlier.
+
+## 2020-10-28 Defer HDMI diagnostics display, update-timestamps, tryboot support - BETA
+   * Skip rendering of the diagnostics screen for HDMI_DELAY seconds (default 5).
+     This means that for SD-card and USB MSD flash boot devices the diagnostics
+     screen will not be visible.
+   * On Pi 4B 1.4 (8GB) initialise SDRAM whilst waiting for the USB port power
+     off time. This makes booting slightly faster.
+   * Remove HDMI console messages where the information is duplicated elsewhere
+     on the display.
+   * Improve compatibility with external USB 3.0 disk enclosures by enumerating
+     the downstream hubs before executing the USB port power off.
+     N.B. Pi4 8GB automatically powers off the USB ports during chip-reset and
+     does not need this change.
+   * Don't timeout a USB MSD device after USB_MSD_LUN_TIMEOUT if there are no other
+     MSD devices or LUNs to try. This avoids unnecessary timeouts on very slow
+     to initialise disk drives e.g. USB HDDs designed for backups.
+   * Fix failover to partition zero if the partition number is invalid. For USB
+     MSD boot a start.elf update is also required.
+   * SD-Card - Change default retries from 0 to 1 to improve reliability with
+     some old SD v1 cards.
+   * Fix issue where boot would stop if partition type 0x83 was encountered
+     before the first FAT partition.
+   * SELF_UPDATE mode (Network, USB MSD boot) now reads the timestamp information
+     in pieeprom.sig created by rpi-eeprom-update to see if the updated is
+     newer than the current 'update-timestamp'. If not, the update is skipped
+     to avoid stale updates on network or USB disks being installed by accident.
+
+     recovery.bin updates (from the SD card) do not check the timestamp because
+     recovery.bin renames itself once the update is completed. However, it still
+     writes the update-timestamp to the EEPROM.
+
+     The update-timestamp is the timestamp when the update is created is
+     independent of the build-timestamp for the bootloader executable. See
+     rpi-eeprom-update -h
+   * Add support for the 'tryboot' feature that enables operating systems to
+     implement a fallback mechanism if an OS upgrade fails. This works with all
+     bootable media types but requires updated firmware and OS software.
+
+     This feature should be viewed as EXPERIMENTAL and may change depending upon
+     feedback from other OS/distro maintainers.
+     https://github.com/raspberrypi/linux/commit/757666748ebf69dc161a262faa3717a14d68e5aa
+
+
+## 2020-10-02 Include CM4 manufacturing bootloader image.
+   * Include the release image for reference. This contains some minor changes
+     to support manufacture test.
+
+## 2020-09-14 Promote the 2020-09-03 release to be the default EEPROM images.
+   * Promote the 2020-09-03 bootloader EEPROM and VLI 0138A1 as the default
+     release (critical folder).
+    
+   Interesting changes since 2020-04-16:-
+
+   * Add support for booting from USB mass storage devices.
+   * Add support for bootloader updates for USB MSD or network boot (self-update)
+   * Improve compatibility for USB devices which require the USB port power
+     to be switched off for a period of time during a reboot.
+   * Add support GPT and Hybrid MBR partition tables.
+   * Add support for EEPROM write-protect.
+   * Add the ability to loop between different boot-modes until a bootable
+     image is found. The default is to loop between SD and USB-MSD.
+   * VLI 0138A1 - Improve full-speed isochronous endpoint support.
+
+
 ## 2020-09-07 Promote 2020-09-03 to release to STABLE
 
 ## 2020-09-03 Only use green LED for error status in bootloader - BETA
@@ -10,29 +141,29 @@ https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2711_bootloade
      Previously, SD activity was displayed but that plus muxing with the
      SPI CS made the LED activity confusing.
      The HDMI diagnostics screen now provides much better information
-     for determing if the bootloader is running or frozen.
+     for determining if the bootloader is running or frozen.
    * CM4 enable GPIO for SD power.
    * Filename should be 2020-09-03
 
 ## 2020-08-31 Disable self-update from SD card - BETA
-   * Since the ROM will load recovery.bin from the SD card self update is not
+   * Since the ROM will load recovery.bin from the SD card self-update is not
      required. Although it functions correctly there is a small risk stale
      pieeprom.upd files would be installed automatically e.g. if the
      rpi-eeprom-update service has been disabled.
 
 ## 2020-08-10 Promote 2020-07-31 release to STABLE
    * The USB port power management change from the last BETA improves
-     compatiblity for devices which during reset with no regressions reported.
+     compatibility for devices which during reset with no regressions reported.
      Make this the latest stable release.
 
-## 2020-07-31 Standardize USB port power control accross board revisions - BETA
+## 2020-07-31 Standardize USB port power control across board revisions - BETA
    * Turn off USB port power for 1-second regardless of boot-mode. This appears
      to resolve an issue on R1.3 and older board revisions where some USB
      devices would fail upon reboot. On R1.4 USB port power is turned off
      automatically by the PMIC so this is just held in reset for longer. For
      earlier board revisions the USB port power is explicitly turned off via
      XHCI.
-     This can be overriden via USB_MSD_PWR_OFF_TIME in the EEPROM config.
+     This can be overridden via USB_MSD_PWR_OFF_TIME in the EEPROM config.
    * Update to the latest Broadcom memsys FW - no significant functional change.
 
 ## 2020-07-20 Promote 2020-07-16 bootloader and VL805 0138A1 FW to stable - STABLE
@@ -112,7 +243,7 @@ https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2711_bootloade
    * Increase USB MSD timeout from 10 to 20 seconds.
    * Max retries now default to zero because the default BOOT_ORDER includes
      restart (0xf). Therefore, each boot-mode is now tried once before moving
-     to the next mode. The retries mechanism is largely redudant now that
+     to the next mode. The retries mechanism is largely redundant now that
      the loop/restart mode exists.
    * If TFTP fails and network boot retries > 0 then wait 5 seconds before
      retrying to avoid overloading a misconfigured TFTP server.
@@ -144,7 +275,7 @@ https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2711_bootloade
 ## 2020-05-15 Add pieeprom-2020-05-15 beta with USB boot
     * USB mass storage boot will NOT work without the updated firmware
       start.elf binaries. These will probably be released via rpi-update
-      in a few days time.
+      in a few days’ time.
       This release simply helps to validate if there are regressions in
       the current SD and Network boot modes.
 
@@ -174,7 +305,7 @@ https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2711_bootloade
       Fix recovery.bin to reboot in this case. The current 'critical'
       release does not have this problem.
     * Fix uart_2ndstage logging in beta/stable recovery image.
-    * Change recovery.bin to reboot instead of displaying an error patern
+    * Change recovery.bin to reboot instead of displaying an error pattern
       if there are no EEPROM images. The Raspberry Pi Image makes it very
       difficult to create a broken rescue image but a stray recovery.bin
       could stop Raspbian from booting.
@@ -218,7 +349,7 @@ https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2711_bootloade
       is enabled by setting DHCP_OPTION97=0 which simply repeats the serial
       number 4 times.
     * SELF_UPDATE. If SELF_UPDATE is set to 1 in the EEPROM configuration AND
-      config.txt contains bootloader_update=1 then the bootloader will looking
+      config.txt contains bootloader_update=1 then the bootloader will be looking
       for pieeprom.upd and vl805.bin and apply these firmware files if
       they are different to the current image, before doing a watchdog reset.
       This should make it easier to update the bootloader for network
@@ -263,7 +394,7 @@ https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2711_bootloade
 
     * Avoid resetting TFTP prefix after retries or if start4.elf is not found.
     * Add MAC_ADDRESS option which allows the OTP Ethernet MAC address to be
-      overriden. An VideoCore firmware update will propagate this forced
+      overridden. A VideoCore firmware update will propagate this forced
       mac address to device-tree/cmdline in the near future.
     * Various internal refactorings to prepare for USB MSD storage boot in
       the next beta-series.

imager/README.txt

@@ -0,0 +1,28 @@
+Raspberry Pi 4 EEPROM bootloader rescue image
+*********************************************
+
+The Raspberry Pi4 has a small EEPROM used to store the bootloader.
+
+This rescue image reverts the bootloader EEPROM to factory default settings.
+
+This rescue image also updates the USB 3.0 (VL805) firmware to the latest
+version (138a1) with better full-speed Isochronous endpoint support.
+
+To re-flash the EEPROM(s)
+
+1. Unzip the contents of this zip file to a blank FAT formatted SD-SDCARD.
+2. Power off the Raspberry Pi
+3. Insert the sd-card.
+4. Power on Raspberry Pi
+5. Wait at least 10 seconds.
+
+This easiest method for creating and formatting the SD-CARD is to use the
+Raspberry Pi Imager from https://raspberrypi.org/downloads
+
+If successful, the green LED light will blink rapidly (forever), otherwise
+an error pattern will be displayed.
+
+If a HDMI display is attached then screen will display green for success
+or red if failure a failure occurs.
+
+N.B. This image is not a bootloader it simply replaces the on-board bootloader.

imager/boot-conf-default.txt

@@ -0,0 +1,6 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+ENABLE_SELF_UPDATE=1
+BOOT_ORDER=0xf41
+

imager/boot-conf-network.txt

@@ -0,0 +1,6 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+ENABLE_SELF_UPDATE=1
+BOOT_ORDER=0xf21
+

imager/boot-conf-sd.txt

@@ -0,0 +1,6 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+ENABLE_SELF_UPDATE=1
+BOOT_ORDER=0xf41
+

imager/boot-conf-usb.txt

@@ -0,0 +1,6 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+ENABLE_SELF_UPDATE=1
+BOOT_ORDER=0xf14
+

imager/make-release

@@ -0,0 +1,65 @@
+#!/bin/sh
+
+# Generates three variants of the rpi-eeprom-recovery.zip file for
+# SD, USB and NETWORK priority matching the raspi-config options.
+
+set -e
+
+script_dir=$(cd "$(dirname "$0")" && pwd)
+tmp_dir=""
+
+die() {
+   echo "$@" >&2
+   exit 1
+}
+
+cleanup() {
+   if [ -d "${tmp_dir}" ]; then
+      rm -rf "${tmp_dir}"
+   fi
+   tmp_dir=""
+}
+
+gen_release() {
+   config="${1}"
+   out="${2}"
+
+   [ -f "${config}" ] || die "File not found \"${config}\""
+
+   (
+      tmp_dir="$(mktemp -d)"
+      cd "${tmp_dir}"
+      cp "${script_dir}/vl805.bin" .
+      cp "${script_dir}/README.txt" .
+      sha256sum vl805.bin | awk '{print $1}' > vl805.sig
+
+      "${script_dir}/../rpi-eeprom-config" \
+         --config "${script_dir}/${config}" --out pieeprom.bin \
+         "${script_dir}/pieeprom.bin" || die "Failed to create update EEPROM config with  \"${config}\""
+      sha256sum pieeprom.bin | awk '{print $1}' > pieeprom.sig
+      echo "Creating ${out}"
+      zip "${out}" *
+   )
+}
+
+usage() {
+cat <<EOF
+   make-release <tag>
+
+   Example tag "2020-09-03-vl805-000138a1"
+EOF
+exit
+}
+
+trap cleanup EXIT
+tag="${1}"
+[ -n "${tag}" ] || usage
+release_dir="${script_dir}/release"
+rm -rf "${release_dir}"
+mkdir "${release_dir}"
+
+# Build the different boot priority flavours
+gen_release boot-conf-default.txt "${release_dir}/rpi-boot-eeprom-recovery-${tag}.zip"
+gen_release boot-conf-sd.txt "${release_dir}/rpi-boot-eeprom-recovery-${tag}-sd.zip"
+gen_release boot-conf-usb.txt "${release_dir}/rpi-boot-eeprom-recovery-${tag}-usb.zip"
+gen_release boot-conf-network.txt "${release_dir}/rpi-boot-eeprom-recovery-${tag}-network.zip"

imager/pieeprom.bin

@@ -0,0 +1 @@
+../firmware/critical/pieeprom-2020-09-03.bin

imager/recovery.bin

@@ -0,0 +1 @@
+../firmware/critical/recovery.bin

imager/vl805.bin

@@ -0,0 +1 @@
+../firmware/critical/vl805-000138a1.bin

releases.md

@@ -7,21 +7,14 @@ utility. However, it's sometimes more convenient to use a recovery image to prog
 Release notes are available [here](https://github.com/raspberrypi/rpi-eeprom/blob/master/firmware/release-notes.md).
 
 ## Recovery image
-The latest production recovery image is [2020-04-16](https://github.com/raspberrypi/rpi-eeprom/releases/tag/v2020.04.16-137ad). This
-is the version selected by the [Raspberry Pi Imager](https://www.raspberrypi.org/downloads/).
+The latest production EEPROM recovery image release is [2020-09-03](https://github.com/raspberrypi/rpi-eeprom/releases/tag/v2020.09.03-138a1) and can be installed via the [Raspberry Pi Imager](https://www.raspberrypi.org/downloads/).
 
 ## USB MSD boot
-The latest USB mass storage boot recovery image is [2020-07-31](https://github.com/raspberrypi/rpi-eeprom/releases/tag/v2020.07.31-138a1).
+USB mass storage boot requires the 2020-09-03 EEPROM images and Raspberry Pi OS 2020-08-20 or newer.
 
-For support please see this [forum thread](https://www.raspberrypi.org/forums/viewtopic.php?f=63&t=277007)
-
-N.B. Although the bootloader has now been promoted to a stable / feature-freeze release USB MSD should still be considered BETA software because this requires updates to the GPU firmware. 
-
-## Previous releases
-All [previous releases](https://github.com/raspberrypi/rpi-eeprom/releases) are available here.
+For support please see use the Raspberry Pi [general discussion](https://www.raspberrypi.org/forums/viewforum.php?f=63) forum.
 
 ## Old EEPROM images
-Recovery images are only created for production images or for major test releases e.g. USB MSD boot. Old bootloader images are periodically
-removed from the APT package to reduce the disk space. The binaries can still be downloaded from Github [here](https://github.com/raspberrypi/rpi-eeprom/tree/master/firmware/old)
-but are not supported and may fail to boot on newer revisions of the hardware.
-For example, the Pi 4 8GB requires bootloader version 2020-04-16 or newer.
+Old bootloader images are periodically removed from the APT package to reduce the disk space but are still available via Github [here](https://github.com/raspberrypi/rpi-eeprom/tree/master/firmware/old)
+
+**N.B. These are not supported and may fail to boot on newer hardware revisions.**

rpi-eeprom-config

@@ -1,12 +1,17 @@
 #!/usr/bin/env python
 
-# rpi-eeprom-config
-# Utility for reading and writing the configuration file in the
-# Raspberry Pi 4 bootloader EEPROM image.
+"""
+rpi-eeprom-config
+"""
 
 import argparse
+import atexit
+import os
+import subprocess
 import struct
 import sys
+import tempfile
+import time
 
 IMAGE_SIZE = 512 * 1024
 
@@ -17,23 +22,182 @@ MAX_BOOTCONF_SIZE = 2024
 # The number, order and size of the sections depends on the bootloader version
 # but the following mask can be used to test for section headers and skip
 # unknown data.
+#
+# The last 4KB of the EEPROM image is reserved for internal use by the
+# bootloader and may be overwritten during the update process.
 MAGIC = 0x55aaf00f
 MAGIC_MASK = 0xfffff00f
 FILE_MAGIC = 0x55aaf11f # id for modifiable file, currently only bootconf.txt
 FILE_HDR_LEN = 20
 FILENAME_LEN = 12
+TEMP_DIR = None
+
+def rpi4():
+    compatible_path = "/sys/firmware/devicetree/base/compatible"
+    if os.path.exists(compatible_path):
+        with open(compatible_path, "rb") as f:
+            compatible = f.read().decode('utf-8')
+            if "bcm2711" in compatible:
+                return True
+    return False
+
+def exit_handler():
+    """
+    Delete any temporary files.
+    """
+    if TEMP_DIR is not None and os.path.exists(TEMP_DIR):
+        tmp_image = os.path.join(TEMP_DIR, 'pieeprom.upd')
+        if os.path.exists(tmp_image):
+            os.remove(tmp_image)
+        tmp_conf = os.path.join(TEMP_DIR, 'boot.conf')
+        if os.path.exists(tmp_conf):
+            os.remove(tmp_conf)
+        os.rmdir(TEMP_DIR)
+
+def create_tempdir():
+    global TEMP_DIR
+    if TEMP_DIR is None:
+        TEMP_DIR = tempfile.mkdtemp()
+
+def exit_error(msg):
+    """
+    Trapped a fatal error, output message to stderr and exit with non-zero
+    return code.
+    """
+    sys.stderr.write("ERROR: %s\n" % msg)
+    sys.exit(1)
+
+def shell_cmd(args):
+    """
+    Executes a shell command waits for completion returning STDOUT. If an
+    error occurs then exit and output the subprocess stdout, stderr messages
+    for debug.
+    """
+    start = time.time()
+    arg_str = ' '.join(args)
+    result = subprocess.Popen(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+
+    while time.time() - start < 5:
+        if result.poll() is not None:
+            break
+
+    if result.poll() is None:
+        exit_error("%s timeout" % arg_str)
+
+    if result.returncode != 0:
+        exit_error("%s failed: %d\n %s\n %s\n" %
+                   (arg_str, result.returncode, result.stdout.read(), result.stderr.read()))
+    else:
+        return result.stdout.read().decode('utf-8')
+
+def get_latest_eeprom():
+    """
+    Returns the path of the latest EEPROM image file if it exists.
+    """
+    latest = shell_cmd(['rpi-eeprom-update', '-l']).rstrip()
+    if not os.path.exists(latest):
+        exit_error("EEPROM image '%s' not found" % latest)
+    return latest
+
+def apply_update(config, eeprom=None, config_src=None):
+    """
+    Applies the config file to the latest available EEPROM image and spawns
+    rpi-eeprom-update to schedule the update at the next reboot.
+    """
+    if eeprom is not None:
+        eeprom_image = eeprom
+    else:
+        eeprom_image = get_latest_eeprom()
+    create_tempdir()
+    tmp_update = os.path.join(TEMP_DIR, 'pieeprom.upd')
+    image = BootloaderImage(eeprom_image, tmp_update)
+    image.write(config)
+    config_str = open(config).read()
+    if config_src is None:
+        config_src = ''
+    sys.stdout.write("Updating bootloader EEPROM\n image: %s\nconfig_src: %s\nconfig: %s\n%s\n%s\n%s\n" %
+                     (eeprom_image, config_src, config, '#' * 80, config_str, '#' * 80))
+
+    sys.stdout.write("\n*** To cancel this update run 'sudo rpi-eeprom-update -r' ***\n\n")
+
+    # Ignore APT package checksums so that this doesn't fail when used
+    # with EEPROMs with configs delivered outside of APT.
+    # The checksums are really just a safety check for automatic updates.
+    args = ['rpi-eeprom-update', '-d', '-i', '-f', tmp_update]
+    resp = shell_cmd(args)
+    sys.stdout.write(resp)
+
+def edit_config(eeprom=None):
+    """
+    Implements something like 'git commit' for editing EEPROM configs.
+    """
+    # Default to nano if $EDITOR is not defined.
+    editor = 'nano'
+    if 'EDITOR' in os.environ:
+        editor = os.environ['EDITOR']
+
+    config_src = ''
+    # If there is a pending update then use the configuration from
+    # that in order to support incremental updates. Otherwise,
+    # use the current EEPROM configuration.
+    bootfs = shell_cmd(['rpi-eeprom-update', '-b']).rstrip()
+    pending = os.path.join(bootfs, 'pieeprom.upd')
+    if os.path.exists(pending):
+        config_src = pending
+        image = BootloaderImage(pending)
+        current_config = image.get_config().decode('utf-8')
+    else:
+        current_config, config_src = read_current_config()
+
+    create_tempdir()
+    tmp_conf = os.path.join(TEMP_DIR, 'boot.conf')
+    out = open(tmp_conf, 'w')
+    out.write(current_config)
+    out.close()
+    cmd = "\'%s\' \'%s\'" % (editor, tmp_conf)
+    result = os.system(cmd)
+    if result != 0:
+        exit_error("Aborting update because \'%s\' exited with code %d." % (cmd, result))
+
+    new_config = open(tmp_conf, 'r').read()
+    if len(new_config.splitlines()) < 2:
+        exit_error("Aborting update because \'%s\' appears to be empty." % tmp_conf)
+    apply_update(tmp_conf, eeprom, config_src)
+
+def read_current_config():
+    """
+    Reads the configuration used by the current bootloader.
+    """
+    fw_base = "/sys/firmware/devicetree/base/"
+    nvmem_base = "/sys/bus/nvmem/devices/"
+
+    if os.path.exists(fw_base + "/aliases/blconfig"):
+        with open(fw_base + "/aliases/blconfig", "rb") as f:
+            nvmem_ofnode_path = fw_base + f.read().decode('utf-8')
+            for d in os.listdir(nvmem_base):
+                if os.path.realpath(nvmem_base + d + "/of_node") in os.path.normpath(nvmem_ofnode_path):
+                    return (open(nvmem_base + d + "/nvmem", "rb").read().decode('utf-8'), "blconfig device")
+
+    return (shell_cmd(['vcgencmd', 'bootloader_config']), "vcgencmd bootloader_config")
 
 class BootloaderImage(object):
-    def __init__(self, filename, output):
+    def __init__(self, filename, output=None):
+        """
+        Instantiates a Bootloader image writer with a source eeprom (filename)
+        and optionally an output filename.
+        """
         self._filename = filename
-        self._bytes = bytearray(open(filename, 'rb').read())
+        try:
+            self._bytes = bytearray(open(filename, 'rb').read())
+        except IOError as err:
+            exit_error("Failed to read \'%s\'\n%s\n" % (filename, str(err)))
         self._out = None
         if output is not None:
             self._out = open(output, 'wb')
 
         if len(self._bytes) != IMAGE_SIZE:
-            raise Exception("%s: Expected size %d bytes actual size %d bytes" %
-                            (filename, IMAGE_SIZE, len(self._bytes)))
+            exit_error("%s: Expected size %d bytes actual size %d bytes" %
+                       (filename, IMAGE_SIZE, len(self._bytes)))
 
     def find_config(self):
         offset = 0
@@ -51,7 +215,7 @@ class BootloaderImage(object):
             offset += 8 + length # length + type
             offset = (offset + 7) & ~7
 
-        raise Exception('Bootloader config not found')
+        raise Exception('EEPROM parse error: Bootloader config not found')
 
     def write(self, new_config):
         hdr_offset, length = self.find_config()
@@ -59,12 +223,13 @@ class BootloaderImage(object):
         new_len = len(new_config_bytes) + FILENAME_LEN + 4
         if len(new_config_bytes) > MAX_BOOTCONF_SIZE:
             raise Exception("Config is too large (%d bytes). The maximum size is %d bytes."
-                    % (len(new_config_bytes), MAX_BOOTCONF_SIZE))
+                            % (len(new_config_bytes), MAX_BOOTCONF_SIZE))
         if hdr_offset + len(new_config_bytes) + FILE_HDR_LEN > IMAGE_SIZE:
             raise Exception('EEPROM image size exceeded')
 
         struct.pack_into('>L', self._bytes, hdr_offset + 4, new_len)
-        struct.pack_into(("%ds" % len(new_config_bytes)), self._bytes, hdr_offset + 4 + FILE_HDR_LEN, new_config_bytes)
+        struct.pack_into(("%ds" % len(new_config_bytes)), self._bytes,
+                         hdr_offset + 4 + FILE_HDR_LEN, new_config_bytes)
 
         # If the new config is smaller than the old config then set any old
         # data which is now unused to all ones (erase value)
@@ -83,10 +248,14 @@ class BootloaderImage(object):
             else:
                 sys.stdout.write(self._bytes)
 
-    def read(self):
+    def get_config(self):
         hdr_offset, length = self.find_config()
         offset = hdr_offset + 4 + FILE_HDR_LEN
         config_bytes = self._bytes[offset:offset+length-FILENAME_LEN-4]
+        return config_bytes
+
+    def read(self):
+        config_bytes = self.get_config()
         if self._out is not None:
             self._out.write(config_bytes)
             self._out.close()
@@ -97,34 +266,103 @@ class BootloaderImage(object):
                 sys.stdout.write(config_bytes)
 
 def main():
-    parser = argparse.ArgumentParser(formatter_class=argparse.RawDescriptionHelpFormatter, \
-    description='Bootloader EEPROM configuration tool for the Raspberry Pi 4. \
-\n\nThere are 3 operating modes: \
-\n\n1. Output the bootloader configuration stored in an EEPROM image file to \
-the screen (STDOUT): specify only the name of an EEPROM image file using the \
-\'eeprom\' option. \
-\n\n2. Output the bootloader configuration stored in an EEPROM image file to a \
-file: specify the EEPROM image file using the \'eeprom\' option, and the output \
-file using the \'--out\' option.\
-\n\n3. Insert a new bootloader configuration into an EEPROM image file: specify \
-the source EEPROM image file using the \'eeprom\' option and the bootloader \
-configuration file using the \'--config\' option. A new file which is a \
-combination of the EEPROM image file, together with the new bootloader \
-configuration file will be created - specify its name using the \'--out\' option. \
-The new bootloader configuration will replace any configuration present in the \
-source EEPROM image.\
-\n\nBootloader EEPROM images are contained in the \'rpi-eeprom-images\' package,\
- which installs them to the /lib/firmware/raspberrypi/bootloader directory.')
-    parser.add_argument('--config', help='Name of bootloader configuration file')
-    parser.add_argument('--out', help='Name of output file')
-    parser.add_argument('eeprom', help='Name of EEPROM file to use as input')
+    """
+    Utility for reading and writing the configuration file in the
+    Raspberry Pi 4 bootloader EEPROM image.
+    """
+    description = """\
+Bootloader EEPROM configuration tool for the Raspberry Pi 4.
+Operating modes:
+
+1. Outputs the current bootloader configuration to STDOUT if no arguments are
+   specified OR the given output file if --out is specified.
+
+   rpi-eeprom-config [--out boot.conf]
+
+2. Extracts the configuration file from the given 'eeprom' file and outputs
+   the result to STDOUT or the output file if --output is specified.
+
+   rpi-eeprom-config pieeprom.bin [--out boot.conf]
+
+3. Writes a new EEPROM image replacing the configuration file with the contents
+   of the file specified by --config.
+
+   rpi-eeprom-config --config boot.conf --out newimage.bin pieeprom.bin
+
+   The new image file can be installed via rpi-eeprom-update
+   rpi-eeprom-update -d -f newimage.bin
+
+4. Applies a given config file to an EEPROM image and invokes rpi-eeprom-update
+   to schedule an update of the bootloader when the system is rebooted.
+
+   Since this command launches rpi-eeprom-update to schedule the EEPROM update
+   it must be run as root.
+
+   sudo rpi-eeprom-config --apply boot.conf [pieeprom.bin]
+
+   If the 'eeprom' argument is not specified then the latest available image
+   is selected by calling 'rpi-eeprom-update -l'.
+
+5. The '--edit' parameter behaves the same as '--apply' except that instead of
+   applying a predefined configuration file a text editor is launched with the
+   contents of the current EEPROM configuration.
+
+   Since this command launches rpi-eeprom-update to schedule the EEPROM update
+   it must be run as root.
+
+   The configuration file will be taken from:
+       * The blconfig reserved memory nvmem device
+       * The cached bootloader configuration 'vcgencmd bootloader_config'
+       * The current pending update - typically /boot/pieeprom.upd
+
+   sudo -E rpi-eeprom-config --edit [pieeprom.bin]
+
+   To cancel the pending update run 'sudo rpi-eeprom-update -r'
+
+   The default text editor is nano and may be overridden by setting the 'EDITOR'
+   environment variable and passing '-E' to 'sudo' to preserve the environment.
+
+See 'rpi-eeprom-update -h' for more information about the available EEPROM
+images.
+"""
+    parser = argparse.ArgumentParser(formatter_class=argparse.RawDescriptionHelpFormatter,
+                                     description=description)
+
+    parser.add_argument('-a', '--apply', required=False,
+                        help='Updates the bootloader to the given config plus latest available EEPROM release.')
+    parser.add_argument('-c', '--config', help='Name of bootloader configuration file', required=False)
+    parser.add_argument('-e', '--edit', action='store_true', default=False, help='Edit the current EEPROM config')
+    parser.add_argument('-o', '--out', help='Name of output file', required=False)
+    parser.add_argument('eeprom', nargs='?', help='Name of EEPROM file to use as input')
     args = parser.parse_args()
 
-    image = BootloaderImage(args.eeprom, args.out)
-    if args.config is not None:
-        image.write(args.config)
-    else:
-        image.read()
+    if (args.edit or args.apply is not None) and os.getuid() != 0:
+        exit_error("--edit/--apply must be run as root")
+
+    if (args.edit or args.apply is not None) and not rpi4():
+        exit_error("--edit/--apply must run on a Raspberry Pi 4")
+
+    if args.edit:
+        edit_config(args.eeprom)
+    elif args.apply is not None:
+        if not os.path.exists(args.apply):
+            exit_error("config file '%s' not found" % args.apply)
+        apply_update(args.apply, args.eeprom, args.apply)
+    elif args.eeprom is not None:
+        image = BootloaderImage(args.eeprom, args.out)
+        if args.config is not None:
+            if not os.path.exists(args.config):
+                exit_error("config file '%s' not found" % args.config)
+            image.write(args.config)
+        else:
+            image.read()
+    elif args.config is None and args.eeprom is None:
+        current_config, config_src = read_current_config()
+        if args.out is not None:
+            open(args.out, 'w').write(current_config)
+        else:
+            sys.stdout.write(current_config)
 
 if __name__ == '__main__':
+    atexit.register(exit_handler)
     main()

rpi-eeprom-update

@@ -23,16 +23,18 @@ else
    FIRMWARE_ROOT="${script_dir}/firmware"
 fi
 
-# May be used to select beta or stable releases instead of the default critical updates.
-FIRMWARE_RELEASE_STATUS=${FIRMWARE_RELEASE_STATUS:-critical}
+# Selects the release sub-directory
+FIRMWARE_RELEASE_STATUS=${FIRMWARE_RELEASE_STATUS:-default}
 FIRMWARE_IMAGE_DIR=${FIRMWARE_IMAGE_DIR:-${FIRMWARE_ROOT}/${FIRMWARE_RELEASE_STATUS}}
 FIRMWARE_BACKUP_DIR=${FIRMWARE_BACKUP_DIR:-/var/lib/raspberrypi/bootloader/backup}
 ENABLE_VL805_UPDATES=${ENABLE_VL805_UPDATES:-1}
-USE_FLASHROM=${USE_FLASHROM:-0}
 RECOVERY_BIN=${RECOVERY_BIN:-${FIRMWARE_ROOT}/${FIRMWARE_RELEASE_STATUS}/recovery.bin}
 BOOTFS=${BOOTFS:-/boot}
 VCMAILBOX=${VCMAILBOX:-/opt/vc/bin/vcmailbox}
 CM4_ENABLE_RPI_EEPROM_UPDATE=${CM4_ENABLE_RPI_EEPROM_UPDATE:-0}
+RPI_EEPROM_UPDATE_CONFIG_TOOL="${RPI_EEPROM_UPDATE_CONFIG_TOOL:-raspi-config}"
+
+DT_BOOTLOADER_TS=${DT_BOOTLOADER_TS:-/proc/device-tree/chosen/bootloader/build-timestamp}
 
 EXIT_SUCCESS=0
 EXIT_UPDATE_REQUIRED=1
@@ -42,8 +44,6 @@ EXIT_EEPROM_FROZEN=3
 # EXIT_PREVIOUS_UPDATE_FAILED=4
 
 OVERWRITE_CONFIG=0
-# Maximum safe SPI speed for EEPROM access 16000, slower is ok.
-SPI_SPEED=16000
 # Timestamp for first release which doesn't have a timestamp field
 BOOTLOADER_FIRST_VERSION=1557513636
 EEPROM_SIZE=524288
@@ -58,10 +58,6 @@ BOARD_TYPE=
 # without a dedicate VL805 EEPROM.
 HAVE_VL805_EEPROM=0
 
-# Simple bootloader which is able to load start.elf in the event of a power
-# cut. This runs SDRAM at low speed and may have reduced functionality but
-# should be enough to run flashrom again.
-
 TMP_EEPROM_IMAGE=""
 TMP_BOOTFS_MNT=""
 
@@ -71,8 +67,12 @@ VL805_UPDATE_VERSION=
 # The update actions selected by the version check
 ACTION_UPDATE_BOOTLOADER=0
 ACTION_UPDATE_VL805=0
+CHECKSUMS=''
 
 cleanup() {
+   if [ -f "${CHECKSUMS}" ]; then
+      rm -f "${CHECKSUMS}"
+   fi
    if [ -f "${TMP_EEPROM_IMAGE}" ]; then
       rm -f "${TMP_EEPROM_IMAGE}"
    fi
@@ -98,9 +98,37 @@ die() {
    exit ${EXIT_FAILED}
 }
 
+getBootloaderConfig() {
+   # Prefer extracting bootloader's config from DT.
+   #
+   # In order to find the right nvmem device, we build the sysfs path of the
+   # bootloader reserved memory DT node to then match that path against all
+   # nvmem device's ofnode path.
+   #
+   # If the path isn't there, default to using vcgencmd.
+
+   local blconfig_alias="/sys/firmware/devicetree/base/aliases/blconfig"
+   local blconfig_nvmem_path=""
+
+   if [ -f "${blconfig_alias}" ]; then
+      local blconfig_ofnode_path="/sys/firmware/devicetree/base"$(strings "${blconfig_alias}")""
+      local blconfig_ofnode_link=$(find -L /sys/bus/nvmem -samefile "${blconfig_ofnode_path}" 2>/dev/null)
+
+      if [ -e "${blconfig_ofnode_link}" ]; then
+         blconfig_nvmem_path=$(dirname "${blconfig_ofnode_link}")
+      fi
+   fi
+
+   if [ -n "${blconfig_nvmem_path}" ]; then
+      cat "${blconfig_nvmem_path}"/nvmem
+   else
+      vcgencmd bootloader_config
+   fi
+}
+
 prepareImage()
 {
-   [ -f "${BOOTLOADER_UPDATE_IMAGE}" ] || die "EEPROM image \'${BOOTLOADER_UPDATE_IMAGE}\' not found"
+   [ -f "${BOOTLOADER_UPDATE_IMAGE}" ] || die "EEPROM image '${BOOTLOADER_UPDATE_IMAGE}' not found"
    TMP_EEPROM_IMAGE="$(mktemp)"
    TMP_EEPROM_CONFIG="$(mktemp)"
    NEW_EEPROM_CONFIG="$(mktemp)"
@@ -108,7 +136,7 @@ prepareImage()
    mkdir -p "${FIRMWARE_BACKUP_DIR}"
 
    # Backup the configuration of the currently loaded bootloader
-   vcgencmd bootloader_config > "${TMP_EEPROM_CONFIG}"
+   getBootloaderConfig > "${TMP_EEPROM_CONFIG}"
    backup="${FIRMWARE_BACKUP_DIR}/pieeprom-backup-$(date +%Y%m%d-%H%M%S).conf"
    cp -f "${TMP_EEPROM_CONFIG}" "${backup}"
 
@@ -143,12 +171,19 @@ applyRecoveryUpdate()
    [ -n "${BOOTLOADER_UPDATE_IMAGE}" ] || [ -n "${VL805_UPDATE_IMAGE}" ] || die "No update images specified"
 
    findBootFS
+   echo "BOOTFS ${BOOTFS}"
 
    # A '.sig' file is created so that recovery.bin can check that the
-   # EEPROM image has not been created (e.g. SD card corruption).
-   # The .sig file format is currently just a SHA256 in ASCII hex. In future,
-   # if an actual public key signature is required then that plus any other
-   # data would be appended after the SHA256 signature.
+   # EEPROM image has not been corrupted (e.g. SD card corruption).
+   # Format of the .sig file.
+   # --
+   # SHA256\n
+   # ts: UPDATE-TIMESTAMP\n
+   # --
+   # SHA256 is a 64 character hex string
+   # UPDATE-TIMESTAMP is an unsigned decimal.
+   #
+   # The 'filename' output from sha256 MUST be omitted.
    if [ -n "${BOOTLOADER_UPDATE_IMAGE}" ]; then
         [ -f "${BOOTLOADER_UPDATE_IMAGE}" ] || die "${BOOTLOADER_UPDATE_IMAGE} not found"
 
@@ -162,20 +197,33 @@ applyRecoveryUpdate()
         sha256sum "${TMP_EEPROM_IMAGE}" | awk '{print $1}' > "${BOOTFS}/pieeprom.sig" \
                 || die "Failed to create ${BOOTFS}/pieeprom.sig"
 
+        # Appends the update creation timestamp on a newline in pieeprom.sig
+        # During a self-update mode the bootloader examines the update-timestamp
+        # and will only update itself if it is newer than the current update
+        # timestamp.
+        #
+        # The update-timestamp is independent of the bootloader version and
+        # does not have to be timestamp.
+        echo "ts: $(date -u +%s)" >> "${BOOTFS}/pieeprom.sig"
+
         cp -f "${TMP_EEPROM_IMAGE}" "${BOOTFS}/pieeprom.upd" \
                 || die "Failed to copy ${TMP_EEPROM_IMAGE} to ${BOOTFS}"
 
         # For NFS mounts ensure that the files are readable to the TFTP user
-        chmod -f go+r "${BOOTFS}/pieeprom.upd" "${BOOTFS}/pieeprom.sig"
+        chmod -f go+r "${BOOTFS}/pieeprom.upd" "${BOOTFS}/pieeprom.sig" \
+                || die "Failed to set permissions on eeprom update files"
    fi
 
    if [ -n "${VL805_UPDATE_IMAGE}" ]; then
         sha256sum "${VL805_UPDATE_IMAGE}" | awk '{print $1}' > "${BOOTFS}/vl805.sig" \
                 || die "Failed to create ${BOOTFS}/vl805.sig"
-        cp -f "${VL805_UPDATE_IMAGE}" "${BOOTFS}/vl805.bin"
+
+        cp -f "${VL805_UPDATE_IMAGE}" "${BOOTFS}/vl805.bin" \
+                || die "Failed to copy ${VL805_UPDATE_IMAGE} to ${BOOTFS}/vl805.bin"
 
         # For NFS mounts ensure that the files are readable to the TFTP user
-        chmod -f go+r "${BOOTFS}/vl805.bin" "${BOOTFS}/vl805.sig"
+        chmod -f go+r "${BOOTFS}/vl805.bin" "${BOOTFS}/vl805.sig" \
+                || die "Failed to set permissions on eeprom update files"
    fi
 
    cp -f "${RECOVERY_BIN}" "${BOOTFS}/recovery.bin" \
@@ -183,60 +231,36 @@ applyRecoveryUpdate()
 }
 
 applyUpdate() {
-   checksums_file="/var/lib/dpkg/info/rpi-eeprom.md5sums"
-
    [ "$(id -u)" = "0" ] || die "* Must be run as root - try 'sudo rpi-eeprom-update'"
 
-   if [ "${IGNORE_DPKG_CHECKSUMS}" = 0 ] && [ -f "${checksums_file}" ]; then
+   if [ "${IGNORE_DPKG_CHECKSUMS}" = 0 ]; then
       (
+         package_checksums_file="${PACKAGE_INFO_DIR}/rpi-eeprom.md5sums"
+
+         if ! grep -qE '\.bin$' "${PACKAGE_INFO_DIR}/rpi-eeprom.md5sums"; then
+            # Try the old rpi-eeprom-images package
+            package_checksums_file="${PACKAGE_INFO_DIR}/rpi-eeprom-images.md5sums"
+         fi
+
+         CHECKSUMS=$(mktemp)
+         grep -E '\.bin$' "${package_checksums_file}" > "${CHECKSUMS}"
          cd /
-         if ! md5sum -c "${checksums_file}" > /dev/null 2>&1; then
-            md5sum -c "${checksums_file}"
+         if ! md5sum -c "${CHECKSUMS}" > /dev/null 2>&1; then
+            md5sum -c "${CHECKSUMS}"
             die "rpi-eeprom checksums failed - try reinstalling this package"
          fi
-      )
+      ) || die "Unable to validate EEPROM image package checksums"
    fi
 
-   if [ "${USE_FLASHROM}" = 0 ]; then
-      applyRecoveryUpdate
-      return
-   fi
-
-   if [ -f "${BOOTLOADER_UPDATE_IMAGE}" ]; then
-      echo "WARNING: USE_FLASHROM is deprecated."
-      # Bootloader EEPROM chip-select is muxed with audio pin so disable audio
-      # LDO first to avoid sending noise to analog audio.
-      "${VCMAILBOX}" 0x00030056 4 4 0 > /dev/null || true
-      dtparam audio=off
-
-      # Switch the SPI pins to boot EEPROM
-      dtoverlay spi-gpio40-45
-      modprobe spidev
-      modprobe spi-bcm2835
-
-      prepareImage "${BOOTLOADER_UPDATE_IMAGE}"
-
-      echo "Applying bootloader update ${BOOTLOADER_UPDATE_IMAGE}"
-      flashrom -p "linux_spi:dev=/dev/spidev0.0,spispeed=${SPI_SPEED}" -w "${TMP_EEPROM_IMAGE}" || die "flashrom EEPROM update failed"
-
-      dtparam -R spi-gpio40-45
-      dtparam audio=on
-      ${VCMAILBOX} 0x00030056 4 4 1 > /dev/null || true
-   fi
-
-   if [ -f "${VL805_UPDATE_IMAGE}" ]; then
-      echo "Applying VL805 image ${VL805_UPDATE_IMAGE}"
-      vl805 -w "${VL805_UPDATE_IMAGE}"
-   fi
-
-   echo "Applying bootloader update ${BOOTLOADER_UPDATE_IMAGE}"
+   applyRecoveryUpdate
 }
 
-# Use the version reported by the loaded EEPROM instead of attempting to retrieve
-# this via flashrom to avoid unnecessary audio glitches.
 BOOTLOADER_CURRENT_VERSION=
 getBootloaderCurrentVersion() {
-   if vcgencmd bootloader_version | grep -q timestamp; then
+   if [ -f "${DT_BOOTLOADER_TS}" ]; then
+      # Prefer device-tree to vcgencmd
+      BOOTLOADER_CURRENT_VERSION=$(printf "%d" "0x$(od "${DT_BOOTLOADER_TS}" -v -An -t x1 | tr -d ' ' )")
+   elif vcgencmd bootloader_version | grep -q timestamp; then
       BOOTLOADER_CURRENT_VERSION=$(vcgencmd bootloader_version | grep timestamp | awk '{print $2}')
       if [ "${BOOTLOADER_CURRENT_VERSION}" = "0" ]; then
          # If a timestamp of zero is returned then it's new firmware but an
@@ -260,7 +284,7 @@ BOOTLOADER_UPDATE_VERSION=0
 getBootloaderUpdateVersion() {
    BOOTLOADER_UPDATE_VERSION=0
    match=".*/pieeprom-[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9].bin"
-   latest="$(find "${FIRMWARE_IMAGE_DIR}" -maxdepth 1 -type f -size "${EEPROM_SIZE}c" -regex "${match}" | sort -r | head -n1)"
+   latest="$(find "${FIRMWARE_IMAGE_DIR}/" -maxdepth 1 -type f -size "${EEPROM_SIZE}c" -regex "${match}" | sort -r | head -n1)"
    if [ -f "${latest}" ]; then
       BOOTLOADER_UPDATE_VERSION=$(strings "${latest}" | grep BUILD_TIMESTAMP | sed 's/.*=//g')
       BOOTLOADER_UPDATE_IMAGE="${latest}"
@@ -268,20 +292,29 @@ getBootloaderUpdateVersion() {
 }
 
 checkDependencies() {
-   BOARD_INFO="$(od -v -An -t x1 /sys/firmware/devicetree/base/system/linux,revision | tr -d ' \n')"
+
+   if [ -f "/sys/firmware/devicetree/base/system/linux,revision" ]; then
+      BOARD_INFO="$(od -v -An -t x1 /sys/firmware/devicetree/base/system/linux,revision | tr -d ' \n')"
+   elif grep -q Revision /proc/cpuinfo; then
+      BOARD_INFO="$(sed -n '/^Revision/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo)"
+   else
+      BOARD_INFO="$(vcgencmd otp_dump | grep '30:' | sed 's/.*://')"
+   fi
+
    if [ $(((0x$BOARD_INFO >> 23) & 1)) -ne 0 ] && [ $(((0x$BOARD_INFO >> 12) & 15)) -eq 3 ]; then
       echo "BCM2711 detected"
    else
       # Not a BCM2711, no EEPROMs to update.
+      echo "This tool only works with a Raspberry Pi 4"
       exit ${EXIT_SUCCESS}
    fi
 
    BOARD_TYPE=$(((0x$BOARD_INFO >> 4) & 0xff))
    BOARD_REVISION=$((0x$BOARD_INFO & 0xf))
 
-   if [ ${BOARD_TYPE} -eq 20 ] && [ ${CM4_ENABLE_RPI_EEPROM_UPDATE} != '1' ]; then
+   if [ ${BOARD_TYPE} -eq 20 ] && [ "${CM4_ENABLE_RPI_EEPROM_UPDATE}" != '1' ]; then
       # For CM4, USB device boot is the recommended method for EEPROM updates.
-      echo "rpi-eeprom-update is not enabled by default on CM4"
+      echo "rpi-eeprom-update is not enabled by default on CM4. Run with -h for more information."
       exit ${EXIT_SUCCESS}
    fi
 
@@ -293,45 +326,37 @@ checkDependencies() {
       HAVE_VL805_EEPROM=0
    fi
 
-   if ! command -v vcgencmd  > /dev/null; then
-      die "vcgencmd not found. On Debian, try installing the libraspberrypi-bin package."
+   if ! command -v lspci > /dev/null; then
+      die "lspci not found. Try installing the pciutils package."
    fi
 
-   if [ ! -d "${FIRMWARE_IMAGE_DIR}" ]; then
+   # vcgencmd bootloader_version is deprecated. Use device-tree if available to
+   # reduce the number of dependencies on VCHI.
+   if ! [ -f "${DT_BOOTLOADER_TS}" ]; then
+      if ! command -v vcgencmd > /dev/null; then
+         die "vcgencmd not found. Try installing the libraspberrypi-bin package."
+      fi
+   fi
+
+   if [ ! -e "${FIRMWARE_IMAGE_DIR}" ]; then
       die "EEPROM updates directory ${FIRMWARE_IMAGE_DIR} not found."
    fi
 
    # If a board revision specific firmware directory is defined then use that
    # in preference to the generic directory.
-   if [ -d "${FIRMWARE_IMAGE_DIR}-${BOARD_INFO}" ]; then
+   if [ -e "${FIRMWARE_IMAGE_DIR}-${BOARD_INFO}" ]; then
       FIRMWARE_IMAGE_DIR="${FIRMWARE_IMAGE_DIR}-${BOARD_INFO}"
    fi
 
-   if vcgencmd bootloader_config | grep -qi "Command not registered"; then
-      die "vcgencmd: 'bootloader_config' command not supported. Please update VC firmware and reboot."
+   if ! getBootloaderConfig > /dev/null; then
+      die "Unable to get bootloader config, please update VC firmware and reboot."
    fi
 
    if ! command -v sha256sum > /dev/null; then
-      die "sha256sum not found. On Debian, try installing the coreutilities package"
+      die "sha256sum not found. Try installing the coreutilities package."
    fi
 
-   if ! command -v flashrom  > /dev/null && [ "${USE_FLASHROM}" = 1 ]; then
-      die "flashrom not found. On Debian, try installing the flashrom package."
-   fi
-
-   if [ ! -x "${VCMAILBOX}" ] && [ "${USE_FLASHROM}" = 1 ]; then
-      die "vcmailbox not found. On Debian, try installing the libraspberrypi-bin package."
-   fi
-
-   if ! command -v dtparam > /dev/null && [ "${USE_FLASHROM}" = 1 ]; then
-      die "dtparam not found. On Debian, try installing the libraspberrypi-bin package."
-   fi
-
-   if ! command -v dtoverlay > /dev/null && [ "${USE_FLASHROM}" = 1 ]; then
-      die "dtoverlay not found. On Debian, try installing the libraspberrypi-bin package."
-   fi
-
-   if [ "${USE_FLASHROM}" = 0 ] && [ ! -f "${RECOVERY_BIN}" ]; then
+   if [ ! -f "${RECOVERY_BIN}" ]; then
       die "${RECOVERY_BIN} not found."
    fi
 }
@@ -370,6 +395,7 @@ retained.
 Options:
    -a Automatically install bootloader and USB (VLI) EEPROM updates.
    -A Specify which type of EEPROM to automatically update (vl805 or bootloader)
+   -b Outputs the path that pending EEPROM updates will be written to.
    -d Use the default bootloader config, or if a file is specified using the -f
       flag use the config in that file. This option only applies when a
       bootloader EEPROM update is needed; if the bootloader EEPROM is up-to-date
@@ -380,6 +406,8 @@ Options:
    -h Display help text and exit
    -i Ignore package checksums - for rpi-eeprom developers.
    -j Write status information using JSON notation
+   -l Returns the full path to the latest available EEPROM image file according
+      to the FIRMWARE_RELEASE_STATUS and FIRMWARE_IMAGE_DIR settings.
    -m Write status information to the given file when run without -a or -f
    -r Removes temporary EEPROM update files from the boot partition.
    -u Install the specified VL805 (USB EEPROM) image file.
@@ -394,44 +422,42 @@ configuration file before it is applied to the new image. The modified
 output must contain at least 3 lines and should contain WAKE_ON_GPIO
 and POWER_OFF_ON_HALT settings.
 
-USE_FLASHROM
-
-USE_FLASHROM is deprecated and there is no support for this. The muxing
-of the SPI pins causes too many issues for this to ever be reliable.
-
-The flashrom update mechanism may be enabled by setting USE_FLASHROM=1. This
-also selects the vl805 tool instead of using recovery.bin to perform the
-update. This may be desirable if an immediate update is required or if an
-SD card is not present.
-However, this not recommended because the SPI pins are muxed with audio and other
-device drivers may be using SPI (e.g. HATs). This is also not safe in the
-event of a power failure during the update of the EEPROM.
-Changing the VL805 firmware whilst USB devices are attached may also cause
-those devices to stop working until after the system is reboot.
-
 FIRMWARE_RELEASE_STATUS
 
-Specifies the release status of the firmware to apply. The default is 'critical'.
+Specifies the release status of the firmware to apply.
 
 Before selecting a firmware release directory this script checks whether there
-is a board revision specific variant e.g. critical-c03111. If present then the
+is a board revision specific variant e.g. default-c03111. If present then the
 board-revision specific version is used in preference.
 
 Release status:
+Bootloader releases follow a pipeline where images are released to the 'beta'
+directory first. The binaries are then promoted to 'latest' and finally 'default'
+so the 'default' binary is always the most tested release.
 
-critical: The latest production release plus important security or hardware compatibility bug fixes.
+default:
+The default bootloader image which is updated once new features in
+'latest' are stable or for critical hardware or security updates.
 
-stable: Contains new features that have already undergone some beta testing.
-These are candidates for new production releases.
+Raspberry Pi OS automatically updates the bootloader when a newer 'default' image
+is available following an APT update to the rpi-eeprom package.
 
-beta: New features, bug fixes for development/test purposes. Use at your own
-risk!
+latest:
+Contains the latest features which have undergone testing via the 'beta'
+release. The configuration parameters are stable.
+
+beta:
+Contains experimental features and bug fixes. Configuration parameters may
+change in subsequent 'beta' releases.
 
 As far as rpi-eeprom-update is concerned FIRMWARE_RELEASE_STATUS is just
 the subdirectory mapping under ${FIRMWARE_ROOT}. Therefore, custom release
 directories are supported by creating the relevant directory and changing
 the FIRMWARE_RELEASE_STATUS environment variable.
 
+The 'default' and 'latest' release names are symlinks to the old directory
+names of 'critical' / 'stable'.
+
 Examples:
 To extract the configuration file from an EEPROM image:
    rpi-eeprom-config pieeprom.bin --out bootconf.txt
@@ -447,12 +473,40 @@ The syntax is the same as config.txt See online documentation for the list of pa
 The official documentation for the Raspberry Pi bootloader EEPROM is available at
 https://www.raspberrypi.org/documentation/hardware/raspberrypi/booteeprom.md
 
+Compute Module 4 (CM4):
+
+CM4 is designed to support embedded applications where physical access to the CM4
+may be limited.  An invalid bootloader configuration or software bug could
+cause the system to fail to boot so automatic updates are disabled. We also
+recommend write-protecting the SPI EPPROM after flashing it using usbboot.
+
+CM4 bootloader and EEPROM update instructions:
+   https://www.raspberrypi.org/documentation/hardware/computemodule/cm-emmc-flashing.md
+
+usbboot instructions for flashing CM4 EMMC and bootloader EEPROM:
+   https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2711_bootloader_config.md
+
+The CM4 ROM does not support running recovery.bin from the EMMC on CM4 so this service
+is disabled by default. SELF_UPDATE from USB or Network boot is supported but this
+must first be enabled by removing ENABLE_SELF_UPDATE=0 from the EEPROM config
+via usbboot.
+
+After enabling self-update set the CM4_ENABLE_RPI_EEPROM_UPDATE=1 environment
+variable or define it in /etc/default/rpi-eeprom-update.
+
+N.B. If there is a power failure during SELF_UPDATE the EEPROM write may fail and
+usbboot must be used to flash the bootloader EEPROM. SELF_UPDATE is not recommended
+for updating the bootloader on remote systems.
+
 EOF
   exit ${EXIT_SUCCESS}
 }
 
 printVersions()
 {
+   echo "Checking for updates in ${FIRMWARE_IMAGE_DIR}"
+   echo "Use ${RPI_EEPROM_UPDATE_CONFIG_TOOL} to select either the default-production release or latest update."
+
    if [ "${ACTION_UPDATE_BOOTLOADER}" = 1 ]; then
       echo "BOOTLOADER: update available"
    else
@@ -461,7 +515,7 @@ printVersions()
 
    echo "CURRENT: $(date -u "-d@${BOOTLOADER_CURRENT_VERSION}") (${BOOTLOADER_CURRENT_VERSION})"
    echo " LATEST: $(date -u "-d@${BOOTLOADER_UPDATE_VERSION}") (${BOOTLOADER_UPDATE_VERSION})"
-   echo " FW DIR: ${FIRMWARE_IMAGE_DIR}"
+   echo "RELEASE: ${FIRMWARE_RELEASE_STATUS}"
 
    if [ "${ACTION_UPDATE_VL805}" = 1 ]; then
       echo "VL805: update available"
@@ -493,9 +547,7 @@ findBootFS()
    # If BOOTFS is not a directory or doesn't contain any .elf files then
    # it's probably not the boot partition.
    [ -d "${BOOTFS}" ] || die "BOOTFS: \"${BOOTFS}\" is not a directory"
-   if [ "$(find "${BOOTFS}/" -name "*.elf" | wc -l)" -gt 0 ]; then
-      echo "BOOTFS ${BOOTFS}"
-   else
+   if [ "$(find "${BOOTFS}/" -name "*.elf" | wc -l)" = 0 ]; then
       echo "WARNING: BOOTFS: \"${BOOTFS}\" contains no .elf files. Please check boot directory"
    fi
 }
@@ -507,11 +559,7 @@ getVL805CurrentVersion()
    # root then treat the version as unknown and skip VLI updates.
    VL805_CURRENT_VERSION=""
    if [ "$(id -u)" = "0" ]; then
-      if command -v lspci >/dev/null; then
          vlver="$(lspci -d 1106:3483 -xxx | awk '/^50:/ { print "VL805 FW version: " $5 $4 $3 $2 }')"
-      else
-         vlver="$(vl805 | grep "VL805 FW version")"
-      fi
       if [ -n "${vlver}" ]; then
          VL805_CURRENT_VERSION="${vlver#*: }"
       fi
@@ -611,14 +659,16 @@ removePreviousUpdates()
    if [ "$(id -u)" = "0" ]; then
       findBootFS
 
-      # Remove any stale recovery.bin files or EEPROM images
-      # N.B. recovery.bin is normally ignored by the ROM if is not a valid
-      # executable but it's best to not have the file at all.
-      rm -f "${BOOTFS}/recovery.bin"
-      rm -f "${BOOTFS}/pieeprom.bin" "${BOOTFS}/pieeprom.upd" "${BOOTFS}/pieeprom.sig"
-      rm -f "${BOOTFS}/vl805.bin" "${BOOTFS}/vl805.sig"
-      # Case insensitive for FAT bootfs
-      find "${BOOTFS}" -maxdepth 1 -type f -follow -iname "recovery.*" -regex '.*\.[0-9][0-9][0-9]$' -exec rm -f {} \;
+      (
+         # Remove any stale recovery.bin files or EEPROM images
+         # N.B. recovery.bin is normally ignored by the ROM if is not a valid
+         # executable but it's best to not have the file at all.
+         rm -f "${BOOTFS}/recovery.bin"
+         rm -f "${BOOTFS}/pieeprom.bin" "${BOOTFS}/pieeprom.upd" "${BOOTFS}/pieeprom.sig"
+         rm -f "${BOOTFS}/vl805.bin" "${BOOTFS}/vl805.sig"
+         # Case insensitive for FAT bootfs
+         find "${BOOTFS}" -maxdepth 1 -type f -follow -iname "recovery.*" -regex '.*\.[0-9][0-9][0-9]$' -exec rm -f {} \;
+      ) || die "Failed to remove previous update files"
    fi
 }
 
@@ -678,9 +728,14 @@ AUTO_UPDATE_BOOTLOADER=0
 AUTO_UPDATE_VL805=0
 MACHINE_OUTPUT=""
 JSON_OUTPUT="no"
-IGNORE_DPKG_CHECKSUMS=$LOCAL_MODE
+IGNORE_DPKG_CHECKSUMS=${LOCAL_MODE}
+PACKAGE_INFO_DIR="/var/lib/dpkg/info/"
+if [ ! -d "${PACKAGE_INFO_DIR}" ]; then
+   IGNORE_DPKG_CHECKSUMS=1
+fi
 
-while getopts A:adhif:m:ju:r option; do
+
+while getopts A:abdhilf:m:ju:r option; do
    case "${option}" in
    A)
       if [ "${OPTARG}" = "bootloader" ]; then
@@ -694,6 +749,11 @@ while getopts A:adhif:m:ju:r option; do
    a) AUTO_UPDATE_BOOTLOADER=1
       AUTO_UPDATE_VL805=1
       ;;
+   b)
+      findBootFS
+      echo "${BOOTFS}"
+      exit 0
+      ;;
    d) OVERWRITE_CONFIG=1
       ;;
    f) BOOTLOADER_UPDATE_IMAGE="${OPTARG}"
@@ -702,6 +762,11 @@ while getopts A:adhif:m:ju:r option; do
       ;;
    j) JSON_OUTPUT="yes"
       ;;
+   l)
+      getBootloaderUpdateVersion
+      echo "${BOOTLOADER_UPDATE_IMAGE}"
+      exit 0
+      ;;
    m) MACHINE_OUTPUT="${OPTARG}"
       ;;
    h) usage
@@ -721,7 +786,7 @@ done
 
 checkDependencies
 if [ "${AUTO_UPDATE_BOOTLOADER}" = 1 ] || [ "${AUTO_UPDATE_VL805}" = 1 ]; then
-   if vcgencmd bootloader_config | grep FREEZE_VERSION=1; then
+   if getBootloaderConfig | grep FREEZE_VERSION=1; then
       echo "EEPROM version is frozen. Skipping update"
       exit ${EXIT_EEPROM_FROZEN}
    else

test/install

@@ -22,7 +22,7 @@ CONFIG="/etc/default/rpi-eeprom-update"
 cp -rfv "${FIRMWARE_DIR}"/* /lib/firmware/raspberrypi/bootloader
 cp -fv "${script_dir}/../rpi-eeprom-config" /usr/bin
 cp -fv "${script_dir}/../rpi-eeprom-update" /usr/bin
-cp -fv "${script_dir}/../firmware/vl805" /usr/bin
+rm -f /usr/bin/vl805
 
 cp -fv "${script_dir}/../rpi-eeprom-update-default" /etc/default/rpi-eeprom-update