Merge pull request #400 from timg236/pieeprom-2022-01-25

pieeprom-2022-01-25: Create stable release from pieeprom-2022-01-20

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,15 +1,20 @@
 ---
 name: Bug report
-about: Create a report to help us improve
-title: ''
-labels: ''
-assignees: ''
+about: Create a bug report for the bootloader EEPROM or rpi-eeprom-update scripts. Please use the Raspberry Pi General Discussion forum for general questions about the bootloader.
 
 ---
 
-For general boot questions please check the read the [Boot Problems](https://www.raspberrypi.org/forums/viewtopic.php?t=58151) sticky post on the forums.  
+This repository tracks bugs for the Raspberry Pi 4 bootloader EEPROM and Linux update scripts.
 
-N.B The bootloader does not persist in memory and if the rainbow splash screen has been displayed the issue is likely to be in the firmware or Linux. If so, it's better to target the bug in the [Firmware](https://github.com/raspberrypi/firmware/) or [Linux](https://github.com/raspberrypi/linux/) repositories first e.g. NFS, USB or dmesg logs would be Linux issues.
+* If you suspect a hardware problem then please read the [Boot Problems](https://www.raspberrypi.org/forums/viewtopic.php?p=437084) post first before contacting the reseller.
+* Support questions or should be posted on the Raspberry Pi [General Discussion](https://www.raspberrypi.org/forums/viewforum.php?f=63) forum
+
+**Mandatory information**
+* Raspberry Pi model
+* Board revision (`cat /proc/cpuinfo | grep Revision`)
+* Operating system version
+* Details of any hardware attached e.g. links to USB 
+* Photo of the HDMI diagnostics screen, UART trace.
 
 **Describe the bug**
 A clear and concise description of what the bug is.
@@ -20,27 +25,39 @@ Steps to reproduce the behavior:
 **Expected behaviour**
 A clear and concise description of what you expected to happen.
 
-**Screenshots**
-If applicable, add a photograph of the bootloader HDMI diagnostics screen.
-
 **Bootloader version and configuration**
-If you have modified the default bootloader release or configuration then please attach the bootloader configuration (vcgencmd bootloader_config) and version (vcgencmd bootloader_version)
+Please include the bootloader version and config.
+```bash
+vcgencmd bootloader_version
+vcgencmd bootloader_config
+```
 
-**SD card boot (please complete the following information):**
- - OS e.g. Raspbian
+**SD card boot (please complete the following information):**  
  - SD card type
- - Partition information (fdisk -l) if you are able to obtain this from another computer.
+ - Partition information (`sudo fdisk -l`) if you are able to obtain this from another computer
 
-**Network boot (please complete the following information):**
-Network boot configuration can get very complicated. To get started we recommend using [PiServer](https://github.com/raspberrypi/piserver) and this is the official test/reference configuration. For other configurations, packet capture or a UART log is nearly always required because setting up custom network configurations to investigate bugs is extremely time-consuming and error-prone.
+**USB boot (please complete the following information):**  
+Verify that the the USB device works correctly when hot-plugged under Linux and attach the output of 'lsusb -vvv'.
 
- - DHCP server configuration files e.g. dnsmasq.conf
+**Network boot (please complete the following information):**  
+Network boot bug normally requires one or more of the following log types. [PiServer](https://github.com/raspberrypi/piserver) is the officially supported network boot server.
+
+ - DHCP server configuration files e.g. `dnsmasq.conf`
  - Wireshark binary packet capture
- - UART logs
+ - UART logs with `uart_2ndstage=1` set in `config.txt`
 
-**USB boot (please complete the following information):**
-For issues booting with specific USB devices please verify that the system boots from an SD-card with the same devices connected and attach the results of 'lsusb -vvv'. This helps to rule out USB HUB power issues.
-In the beta release it's likely that a UART or NetConsole boot trace will be required.
+**NVMe boot (please complete the following information):**
+
+```bash
+sudo apt-get install nvme-cli
+sudo nvme list
+sudo nvme id-ctrl -H /dev/nvme0
+sudo nvme list-ns /dev/nvme0
+sudo nvme id-ns -H /dev/nvme0 --namespace-id=1
+```
 
 **Additional context**
-Add any other context about the problem here.
+Add any other context about the problem here. 
+
+The [Bootloader configuration](https://www.raspberrypi.org/documentation/computers/raspberry-pi.html#raspberry-pi-4-bootloader-configuration) page describes how to enable UART or NETCONSOLE logs. For complex USB boot issues NETCONSOLE logs are recommended.
+

README.md

@@ -1,16 +1,16 @@
 # rpi-eeprom
-This repository contains the scripts and pre-compiled binaries used to create the `rpi-eeprom` package which is used to update the Raspberry Pi 4 bootloader and VLI EEPROMs.
+This repository contains the scripts and pre-compiled binaries used to create the `rpi-eeprom` package which is used to update the Raspberry Pi 4 bootloader and VLI USB controller EEPROMs.
 
 # Support
-Please check the Raspberry Pi [general discussion forum](https://www.raspberrypi.org/forums/viewforum.php?f=63) if you have a support question. 
+Please check the Raspberry Pi [general discussion forum](https://forums.raspberrypi.com/viewforum.php?f=63) if you have a support question.
 
 # Reset to factory defaults
-The [Raspberry Pi Imager](https://www.raspberrypi.org/downloads/) provides an EEPROM recovery image which may be used to reset the bootloader and VLI EEPROMs to factory defaults.
+To reset the bootloader back to factory defaults use [Raspberry Pi Imager](https://www.raspberrypi.com/software/) to write an EEPROM update image to a spare SD card. Select `Misc utility images` under the `Operating System` tab.
 
 # Bootloader documentation
-* [The boot folder](https://www.raspberrypi.org/documentation/configuration/boot_folder.md)
-* [Config.txt boot options](https://www.raspberrypi.org/documentation/configuration/config-txt/boot.md)
-* [Bootloader EEPROM](https://www.raspberrypi.org/documentation/hardware/raspberrypi/booteeprom.md)
-* [Bootloader configuration](https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2711_bootloader_config.md)
+* [Config.txt boot options](https://www.raspberrypi.com/documentation/computers/config_txt.html#boot-options)
+* [Bootloader EEPROM](https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#raspberry-pi-4-boot-eeprom)
+* [Bootloader configuration](https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#raspberry-pi-4-bootloader-configuration)
+* [Updating the Compute Module 4 bootloader](https://www.raspberrypi.com/documentation/computers/compute-module.html#cm4bootloader)
 * [Release notes](firmware/release-notes.md)
 * [Releases](releases.md)

firmware/default

@@ -0,0 +1 @@
+critical

firmware/latest

@@ -0,0 +1 @@
+stable

firmware/release-notes.md

@@ -1,7 +1,294 @@
 # Raspberry Pi4 bootloader EEPROM release notes
 
 USB MSD boot also requires the firmware from Raspberry Pi OS 2020-08-20 or newer.
-https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2711_bootloader_config.md
+https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#raspberry-pi-4-bootloader-configuration
+
+## 2022-01-25 - Create new release from 2022-01-20 - LATEST/STABLE
+   * Rebuild 2022-01-20 for new stable release
+
+## 2022-01-20 - Some NVMe boot fixes - BETA
+   * PCIe retry on error
+   * NVMe logging changes
+   * NVMe attempts to boot twice
+   * Increase the maximum GPU memory size from 256MB to 512MB so long as
+     boot_ramdisk=0. This should only be used with the legacy camera
+     application and FKMS for very memory intensive camera operations.
+     N.B. The new libcamera and KMS driver use CMA instead of GPU memory.
+
+## 2021-12-02 - Promote the 2021-12-02 beta release to LATEST/STABLE
+   * Just fixes a regression with MTB detection affecting factory testing
+
+## 2021-12-02 - Fix MTB detection for factory test - BETA
+   * Just fixes a regression with MTB detection affecting factory testing
+
+## 2021-12-09 - Update default recovery.bin
+   * Promote the recovery.bin from stable to default. This avoids an issue
+     where recovery.bin fails to load on large FAT32 boot partions with 32K
+     clusters.
+
+## 2021-11-29 - Promote the 2021-11-22 beta release to LATEST/STABLE
+Interesting changes since the last stable release:-
+   * NVMe / PCIe reset fixes
+   * GPT / FAT enhancements
+   * FAT performance improvements
+   * Secure-boot for industrial customers (see usbboot repo)
+
+## 2021-11-22 - Fix for Sabrent rocket Nano NVMe reboot issue - BETA
+  * Fixes issue with Sabrent rocket Nano NVMe disk after a reboot.
+    Run pcie initialisation again if there's an error.
+
+## 2021-10-27 - Secure boot improvements - BETA
+  * Improve the error logging if a file is too large and truncated.
+  * Increase the maximum size of the ramdisk to 96MB.
+  * Preliminary changes to expose the boot-mode used to load the ramdisk via device-tree.
+
+  N.B. Secure boot is only recommended for industrial customers and is currently
+  a beta release. This can only be enabled via RPIBOOT
+  https://github.com/raspberrypi/usbboot/blob/master/Readme.md
+
+## 2021-10-05 - Update for latest Broadcom SDRAM settings - BETA
+  * Minor update for latest SDRAM tuning settings.
+
+## 2021-10-04 - Add support for GPT FAT16 and increase USB timeouts - BETA
+  * Update the FAT detection to support FAT16 for EFI/ESD paritions with
+    GPT instead of assuming FAT32. The latest firmware is also required
+    for a similar update.
+  * Increase the timeouts for MSD SCSI commands to reduce the risk of
+    timeouts when probing the capacity of slow to start devices
+    e.g. USB RAID with spinning disks.
+
+## 2021-09-27 - Fix recovery.bin rename issue and EEPROM netconsole - BETA
+  * Fix recovery.bin rename issue
+  * Update pieeprom-2021-09-27.bin to fix netconsole
+
+## 2021-09-23 - Temporarily revert recovery.bin 2021-09-22 BETA/STABLE
+  * Revert until fix for can be verified https://github.com/raspberrypi/rpi-eeprom/issues/367
+
+## 2021-09-23 - Bootloader file-system updates - BETA
+This release makes major changes to the bootloader file-system code in order
+to support new features and should be treated as a bleeding edge BETA release!
+  * Improve file-system performance to reduce boot time.
+  * Preliminary support for IPV6 TFTP. Requires an updated start4.elf.
+    Details to follow.
+  * Fix VL805=1 option for CM4 IO boards that follow the same XHCI
+    design as Pi4B. Start.elf will be updated in the next rpi-update release
+    and the latest CM4 DTBs are required for the 'XHCI reset controller'
+  * Preliminary support for loading signed boot image files.
+    Requires updated GPU firmware.
+
+## 2021-09-22 - Update recovery.bin to fix issue with large FAT partitions - STABLE
+  * Bump the latest recovery.bin under beta to stable.
+
+## 2021-09-22 - Update recovery.bin to fix issue with large FAT partitions - BETA
+  * Fix an issue where the ROM fails to load larger recovery.bin files
+    on FAT partitions with large cluster sizes.
+
+## 2021-07-07 - Promote pieeprom-2021-07-06 to stable - STABLE
+  * Promote the latest beta to stable. For CM4 users this adds NVMe
+    boot support to the stable release.
+
+## 2021-07-06 - Tidyup PXE debug strings - BETA
+   * Remove redundant debug string - hexdump is more useful for debug.
+   * Minor internal changes for manufacturing test.
+
+## 2021-06-25 - Support 256MB gpu_mem with boot ramdisk - BETA
+   * Tweak the address map so that boot ramdisks (e.g. rpiboot -d imager)
+     work with large amounts of GPU memory.
+
+## 2021-06-17 - Avoid unnecessary PCIe probe on CM4 - BETA
+   * Avoid default PCIe / XHCI probe on CM4 unless required for the current boot
+     mode (USB_MSD or NVME).
+   * Leave PCIe RC in reset state when loading start.elf except for USB-MSD mode.
+
+## 2021-06-11 - Add USB_MSD_STARTUP_DELAY option - BETA
+   * Minor update to BRCM SDRAM settings.
+   * Add USB_MSD_STARTUP_DELAY option (default 0 option). This adds a configurable
+     delay (in milliseconds) the first time the USB host controller is initialised
+     before device enumeration.
+     Normally, this should not be required. However, some HDD enclosures may
+     require an extended startup delay in order to spinup drives. Without this
+     the get-capacity command may stall and timeout.
+
+## 2021-05-19 - Use the latest BRCM SDRAM settings - BETA
+   * Use the latest BRCM SDRAM settings.
+   * FAT12 support for small bootloader ramdisk images.
+   * Minor file-system performance optimisations.
+   * Added recovery.bin config.txt option (erase_eeprom=1) to perform an
+     SPI chip-erase operation instead of programming the bootloader image.
+
+## 2021-04-30 - Update default version to 2021-04-29
+   * The manufacturing release has been updated to pieeprom-2021-04-29 so update the default release to match this.
+
+## 2021-04-29 - Pi400 - Reduce MII clock freq when probing ethernet PHY - STABLE
+   * Pi400 - Reduce MII clock freq when probing ethernet PHY - STABLE
+
+## 2021-04-19 - Promote 2021-03-18 from LATEST to DEFAULT - DEFAULT
+   * Display VC_BUILD_ID strings instead of the SHA256 hash
+   * Add support for [cm4] and [pi400] config conditionals filters.
+   * Change network boot to use the same "RXID" Ethernet PHY configuration as the 5.10 kernel
+   * TFTP - reply to duplicate ACKS
+   * Skip rendering of HDMI diagnostics display for the first 8 seconds unless an error occurs.
+   * UDP checksum fixes
+   * Add support for the BCM2711 XHCI controller - BOOT_ORDER 0x5
+   * XHCI protocol layer fixes for non-VLI controllers
+   * Avoid USB MSD timeout if there is only one device
+   * Implement tryboot for OS upgrade fallback
+   * Check the update-timestamp before applying an update in SELF-UPDATE mode
+
+## 2021-04-13 - Fix error pattern for HDMI and SDRAM failures - BETA/STABLE
+   * Fix recovery.bin error handler so that the LED error pattern is still
+     displayed even if HDMI or SDRAM fail.
+
+## 2021-03-18 - Fix occasional reboot fail on Pi4B pre 1.4 - STABLE
+   * Fix GPIO expander reset issue on some Pi4B 1.1 to 1.3 boards
+
+## 2021-03-17 - Fix issue with PCIe bridges in Linux - BETA
+   * NVMe BETA boot support broke PCIe bridges in Linux. This should fix the problem
+
+## 2021-03-04 - NVMe boot support - BETA
+   * Adds support for NVMe to the bootloader with a new NVMe boot mode "6"
+     NVMe currently only works for controller 0 on namespace 1 with a page size of 4096 bytes
+     and block size of 512 bytes
+   * The default boot order has been updated to F641 for cm4 ONLY, so NVMe boot is
+     attempted after SD and USB
+
+     To use the new NVMe add "6" to the BOOT_ORDER.
+
+     This requires the latest rpi-update firmware to work or else you will see a compatibility
+     error on boot. You also need the latest kernel from rpi-update to load rootfs from NVMe
+     see https://github.com/Hexxeh/rpi-firmware/commit/48570ba954a318feee348d4e642ebd2b58d9dd97
+     and https://github.com/Hexxeh/rpi-firmware/commit/e150906874ff8b9fb6271971fa4238997369f790
+
+## 2021-02-22 - Promote 2021-02-16 to stable - STABLE (LATEST)
+   * Freezing for default/critical update.
+
+## 2021-02-16 - Change VC version info & TFTP fix - BETA
+   * Display the VC_BUILD strings instead of the sha256 of the .elf file so that
+     the information is the same as "vcgencmd version"
+   * Change TFTP to ACK data blocks which it has already ACK'd instead of ignoring them.
+   * Change network boot to use the same "RXID" configuration as the 5.10 kernel.
+
+## 2021-01-16 - Fix 1V8 SD voltage reset for Pi 4B R1.1 - LATEST + BETA
+   * Fix regression for GPIO expander reset change which caused PMIC reset
+     to get card out of 1V8 mode to be missed.
+
+## 2021-01-14 - Promote pieeprom-2021-01-11 to STABLE (LATEST)
+
+## 2021-01-11 - Timeout stalled USB MSD devices - BETA
+   * Timeout USB MSD commands and move to the next boot mode if a device stops responding.
+   * Reset the GPIO expander at power on.
+   * Use the bootloader build timestamp instead of zero for the update-timestamp
+     if it is not defined in the .sig file.
+
+## 2021-01-05 - USB MSD interop improvements for Pi 4B < R1.4 - BETA
+   * Revert the USB port power delay on R1.1 boards to be more like the Sep 2020
+     production release. Verified with Geekworm X835, Orico NVME M.2 USB adapter
+     and Microsoft Wireless keyboard.
+   * Increase the HDMI delay to 8 seconds.
+
+## 2020-12-14 - Promote pieeprom-2020-12-11.bin to stable - STABLE
+   * Feature freeze to support stable release of BCM2711 XHCI boot, tryboot,
+     HDMI_DELAY, USB MSD improvements.
+
+## 2020-12-11 - CM4/PI400 conditional filters - BETA
+   * Add support for [cm4] and [pi400] config conditionals filters.
+   * Tidyup RPIBOOT USB descriptors.
+   * Add a gap before displaying LED error pattern and change the default state
+     to off after displaying the first error pattern.
+   * Generate 0xffff instead of 0x0 if the checksum of the UDP packet to be
+     transmitted is 0x0.
+   * Rename USB-DEV to RPIBOOT in boot-mode strings. Bootmode was renamed to
+     avoid confusion with USB MSD boot.
+
+## 2020-11-24 BCM2711 xHC boot support - BETA
+   * Add support for booting from the BCM2711 XHCI controller which is the
+     USB-C socket on Pi 4B / Pi 400 and the type A sockets on Compute Module 4
+     IO board. The controller only supports USB 2.0 and the primary usage is
+     for USB-MSD support on CM 4 boards without requiring a PCIe XHCI controller.
+
+     To use this add '5' to the BOOT_ORDER in the EEPROM config for BCM_USB_MSD boot.
+
+     This requires the latest rpi-update firmware.
+     
+     If start.elf is loaded via the BCM2711 XHCI (BOOT_ORDER 5) then the config.txt
+     otg_mode setting will be set to 1 so that the OS can continue booting
+     using the BCM2711 XHCI. This means that the device/gadget mode is not available
+     when booted in this mode and there is no support for switching back to 
+     the DWC2 controller from the BCM2711 XHCI controller.
+
+   * Update halt behavior on Pi 400 to re-enable 'power on' button if the OS
+     did a reset rather than using the standard mailbox shutdown commands. This
+     overrides WAKE_ON_GPIO / POWER_OFF_ON_HALT settings on Pi 400 because
+     it has a dedicated power button.
+     If a button on GPIO3 really is requried then it can be re-enabled by setting
+     WAKE_ON_GPIO=2 but that will consume more power.
+   * Fix short blink before one-shot error pattern - #251
+   * Validate SDRAM in recovery mode.
+   * XHCI protocol layer fixes for non-VLI controllers.
+   * Updated 'tryboot' for new version which also supports Pi3 and earlier.
+
+## 2020-10-28 Defer HDMI diagnostics display, update-timestamps, tryboot support - BETA
+   * Skip rendering of the diagnostics screen for HDMI_DELAY seconds (default 5).
+     This means that for SD-card and USB MSD flash boot devices the diagnostics
+     screen will not be visible.
+   * On Pi 4B 1.4 (8GB) initialise SDRAM whilst waiting for the USB port power
+     off time. This makes booting slightly faster.
+   * Remove HDMI console messages where the information is duplicated elsewhere
+     on the display.
+   * Improve compatibility with external USB 3.0 disk enclosures by enumerating
+     the downstream hubs before executing the USB port power off.
+     N.B. Pi4 8GB automatically powers off the USB ports during chip-reset and
+     does not need this change.
+   * Don't timeout a USB MSD device after USB_MSD_LUN_TIMEOUT if there are no other
+     MSD devices or LUNs to try. This avoids unnecessary timeouts on very slow
+     to initialise disk drives e.g. USB HDDs designed for backups.
+   * Fix failover to partition zero if the partition number is invalid. For USB
+     MSD boot a start.elf update is also required.
+   * SD-Card - Change default retries from 0 to 1 to improve reliability with
+     some old SD v1 cards.
+   * Fix issue where boot would stop if partition type 0x83 was encountered
+     before the first FAT partition.
+   * SELF_UPDATE mode (Network, USB MSD boot) now reads the timestamp information
+     in pieeprom.sig created by rpi-eeprom-update to see if the updated is
+     newer than the current 'update-timestamp'. If not, the update is skipped
+     to avoid stale updates on network or USB disks being installed by accident.
+
+     recovery.bin updates (from the SD card) do not check the timestamp because
+     recovery.bin renames itself once the update is completed. However, it still
+     writes the update-timestamp to the EEPROM.
+
+     The update-timestamp is the timestamp when the update is created is
+     independent of the build-timestamp for the bootloader executable. See
+     rpi-eeprom-update -h
+   * Add support for the 'tryboot' feature that enables operating systems to
+     implement a fallback mechanism if an OS upgrade fails. This works with all
+     bootable media types but requires updated firmware and OS software.
+
+     This feature should be viewed as EXPERIMENTAL and may change depending upon
+     feedback from other OS/distro maintainers.
+     https://github.com/raspberrypi/linux/commit/757666748ebf69dc161a262faa3717a14d68e5aa
+
+
+## 2020-10-02 Include CM4 manufacturing bootloader image.
+   * Include the release image for reference. This contains some minor changes
+     to support manufacture test.
+
+## 2020-09-14 Promote the 2020-09-03 release to be the default EEPROM images.
+   * Promote the 2020-09-03 bootloader EEPROM and VLI 0138A1 as the default
+     release (critical folder).
+    
+   Interesting changes since 2020-04-16:-
+
+   * Add support for booting from USB mass storage devices.
+   * Add support for bootloader updates for USB MSD or network boot (self-update)
+   * Improve compatibility for USB devices which require the USB port power
+     to be switched off for a period of time during a reboot.
+   * Add support GPT and Hybrid MBR partition tables.
+   * Add support for EEPROM write-protect.
+   * Add the ability to loop between different boot-modes until a bootable
+     image is found. The default is to loop between SD and USB-MSD.
+   * VLI 0138A1 - Improve full-speed isochronous endpoint support.
+
 
 ## 2020-09-07 Promote 2020-09-03 to release to STABLE
 
@@ -10,29 +297,29 @@ https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2711_bootloade
      Previously, SD activity was displayed but that plus muxing with the
      SPI CS made the LED activity confusing.
      The HDMI diagnostics screen now provides much better information
-     for determing if the bootloader is running or frozen.
+     for determining if the bootloader is running or frozen.
    * CM4 enable GPIO for SD power.
    * Filename should be 2020-09-03
 
 ## 2020-08-31 Disable self-update from SD card - BETA
-   * Since the ROM will load recovery.bin from the SD card self update is not
+   * Since the ROM will load recovery.bin from the SD card self-update is not
      required. Although it functions correctly there is a small risk stale
      pieeprom.upd files would be installed automatically e.g. if the
      rpi-eeprom-update service has been disabled.
 
 ## 2020-08-10 Promote 2020-07-31 release to STABLE
    * The USB port power management change from the last BETA improves
-     compatiblity for devices which during reset with no regressions reported.
+     compatibility for devices which during reset with no regressions reported.
      Make this the latest stable release.
 
-## 2020-07-31 Standardize USB port power control accross board revisions - BETA
+## 2020-07-31 Standardize USB port power control across board revisions - BETA
    * Turn off USB port power for 1-second regardless of boot-mode. This appears
      to resolve an issue on R1.3 and older board revisions where some USB
      devices would fail upon reboot. On R1.4 USB port power is turned off
      automatically by the PMIC so this is just held in reset for longer. For
      earlier board revisions the USB port power is explicitly turned off via
      XHCI.
-     This can be overriden via USB_MSD_PWR_OFF_TIME in the EEPROM config.
+     This can be overridden via USB_MSD_PWR_OFF_TIME in the EEPROM config.
    * Update to the latest Broadcom memsys FW - no significant functional change.
 
 ## 2020-07-20 Promote 2020-07-16 bootloader and VL805 0138A1 FW to stable - STABLE
@@ -112,7 +399,7 @@ https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2711_bootloade
    * Increase USB MSD timeout from 10 to 20 seconds.
    * Max retries now default to zero because the default BOOT_ORDER includes
      restart (0xf). Therefore, each boot-mode is now tried once before moving
-     to the next mode. The retries mechanism is largely redudant now that
+     to the next mode. The retries mechanism is largely redundant now that
      the loop/restart mode exists.
    * If TFTP fails and network boot retries > 0 then wait 5 seconds before
      retrying to avoid overloading a misconfigured TFTP server.
@@ -144,7 +431,7 @@ https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2711_bootloade
 ## 2020-05-15 Add pieeprom-2020-05-15 beta with USB boot
     * USB mass storage boot will NOT work without the updated firmware
       start.elf binaries. These will probably be released via rpi-update
-      in a few days time.
+      in a few days’ time.
       This release simply helps to validate if there are regressions in
       the current SD and Network boot modes.
 
@@ -174,7 +461,7 @@ https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2711_bootloade
       Fix recovery.bin to reboot in this case. The current 'critical'
       release does not have this problem.
     * Fix uart_2ndstage logging in beta/stable recovery image.
-    * Change recovery.bin to reboot instead of displaying an error patern
+    * Change recovery.bin to reboot instead of displaying an error pattern
       if there are no EEPROM images. The Raspberry Pi Image makes it very
       difficult to create a broken rescue image but a stray recovery.bin
       could stop Raspbian from booting.
@@ -218,7 +505,7 @@ https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2711_bootloade
       is enabled by setting DHCP_OPTION97=0 which simply repeats the serial
       number 4 times.
     * SELF_UPDATE. If SELF_UPDATE is set to 1 in the EEPROM configuration AND
-      config.txt contains bootloader_update=1 then the bootloader will looking
+      config.txt contains bootloader_update=1 then the bootloader will be looking
       for pieeprom.upd and vl805.bin and apply these firmware files if
       they are different to the current image, before doing a watchdog reset.
       This should make it easier to update the bootloader for network
@@ -263,7 +550,7 @@ https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2711_bootloade
 
     * Avoid resetting TFTP prefix after retries or if start4.elf is not found.
     * Add MAC_ADDRESS option which allows the OTP Ethernet MAC address to be
-      overriden. An VideoCore firmware update will propagate this forced
+      overridden. A VideoCore firmware update will propagate this forced
       mac address to device-tree/cmdline in the near future.
     * Various internal refactorings to prepare for USB MSD storage boot in
       the next beta-series.

imager/README.txt

@@ -0,0 +1,42 @@
+Raspberry Pi 4 EEPROM bootloader rescue image
+*********************************************
+
+The Raspberry Pi 4 contains a small EEPROM used to store the bootloader.
+
+This rescue image reverts the bootloader EEPROM to factory default settings.
+
+This rescue image also updates the USB 3 controller (VL805) firmware to the
+latest version, 138a1, which has better full-speed isochronous endpoint 
+support.
+
+Raspberry Pi 4 board revisions 1.1 and 1.2 contain a separate EEPROM 
+which contains firmware for the USB 3 controller (VL805): on newer revisions 
+the USB controller firmware is stored in the bootloader EEPROM along with 
+the bootloader.
+
+The easiest method for creating EEPROM rescue images, and formatting SD 
+cards, is to use Raspberry Pi Imager from https://raspberrypi.com/software.
+Raspberry Pi Imager provides a GUI for downloading the latest version of 
+this rescue image and flashing it to a spare SD card.
+
+Alternatively, copy the contents of this zip file to a blank
+FAT formatted SD card. The FAT partition must be < 32 GB.
+
+To update the EEPROM:
+
+1. Power off the Raspberry Pi
+2. Insert the bootloader update SD card
+3. Power on the Raspberry Pi
+4. Wait at least 10 seconds
+
+If successful, the green LED on the Raspberry Pi will blink rapidly forever.
+An unsuccessful update of the EEPROM is indicated by a different blinking 
+pattern corresponding to the specific error.
+
+If an HDMI display is attached, then the screen will display green for
+success or red if a failure occurs.
+
+Once the EEPROM is updated, the SD card can be removed. In order to make
+the entire capacity of the SD card available again, you must then reformat
+the SD card using Raspberry Pi Imager by selecting the 'format card as 
+FAT32' option.

imager/boot-conf-default.txt

@@ -0,0 +1,6 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+ENABLE_SELF_UPDATE=1
+BOOT_ORDER=0xf41
+

imager/boot-conf-network.txt

@@ -0,0 +1,6 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+ENABLE_SELF_UPDATE=1
+BOOT_ORDER=0xf21
+

imager/boot-conf-sd.txt

@@ -0,0 +1,6 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+ENABLE_SELF_UPDATE=1
+BOOT_ORDER=0xf41
+

imager/boot-conf-usb.txt

@@ -0,0 +1,6 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+ENABLE_SELF_UPDATE=1
+BOOT_ORDER=0xf14
+

imager/make-beta-release

@@ -0,0 +1,13 @@
+#!/bin/sh
+
+set -e
+
+script_dir=$(cd "$(dirname "$0")" && pwd)
+
+firmware_status=${firmware_status:-"beta"}
+firmware_dir=${script_dir}/../firmware/${firmware_status}
+pieeprom_version=$(basename $(ls ${firmware_dir}/pieeprom-*.bin | sort -V | tail -1) .bin | cut -d- -f2-5)
+vl805_version=$(basename $(ls ${firmware_dir}/vl805-*.bin | sort -V | tail -1) .bin | cut -d- -f2)
+
+${script_dir}/make-release ${firmware_status} ${pieeprom_version} ${vl805_version} "${script_dir}" ${firmware_status}_release rpi-boot-eeprom-recovery-${firmware_status}
+

imager/make-imager-release

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+set -e
+
+script_dir=$(cd "$(dirname "$0")" && pwd)
+
+${script_dir}/make-release critical 2021-04-29 000138a1 "${script_dir}" release rpi-boot-eeprom-recovery

imager/make-recovery-images

@@ -0,0 +1,62 @@
+#!/bin/sh
+
+set -e
+
+die() {
+   echo "$@" >&2
+   exit 1
+}
+
+cleanup() {
+   if [ -d "${TMP_DIR}" ]; then
+      rm -rf "${TMP_DIR}"
+   fi
+}
+
+trap cleanup EXIT
+
+[ "$(id -u)" = "0" ] || die "$(basename $0) must be run as root"
+[ -n "${SUDO_UID}" ] || die "SUDO_UID not defined"
+[ -n "${SUDO_GID}" ] || die "SUDO_GID not defined"
+
+for src in release/*.zip; do
+   src=$(basename "${src}")
+   img=$(echo "${src}" | sed 's/\.zip/.img/')
+   TMP_DIR=$(mktemp -d)
+   (
+      cp "release/${src}" "${TMP_DIR}"
+      mkdir "${TMP_DIR}/files"
+      cd "${TMP_DIR}/files"
+      unzip "../${src}"
+      cd "${TMP_DIR}"
+      dd if=/dev/zero bs=1M count=258 of=temp.img
+      /sbin/sfdisk temp.img <<EOF
+label: dos
+label-id: 0x0a7b5ac5
+device: temp.img
+unit: sectors
+
+./test.img1 : start=        2048, size=       524288, type=c
+EOF
+      file temp.img
+      kpartx -lv temp.img | head -n1 | awk '{print $1}'
+      LOOP="/dev/mapper/$(kpartx -lv temp.img | head -n1 | awk '{print $1}')"
+      kpartx -av temp.img
+      /sbin/mkfs.fat -F 32 -s 1 "${LOOP}"
+      mkdir fs
+      mount "${LOOP}" fs
+      cp -v files/* fs
+      sync
+      umount fs
+      kpartx -dv temp.img
+   )
+   mkdir -p images
+   chown "${SUDO_UID}:${SUDO_GID}" images
+   mv "${TMP_DIR}/temp.img" "images/${img}"
+   file "images/${img}"
+   cd images
+   zip "${src}" "${img}"
+   cd ..
+   rm "images/${img}"
+   chown "${SUDO_UID}:${SUDO_GID}" "images/${src}"
+done

imager/make-release

@@ -0,0 +1,88 @@
+#!/bin/sh
+
+# Generates three variants of the rpi-eeprom-recovery.zip file for
+# SD, USB and NETWORK priority matching the raspi-config options,
+# plus a default (same as SD)
+
+set -e
+
+script_dir=$(cd "$(dirname "$0")" && pwd)
+tmp_dir=""
+
+die() {
+   echo "$@" >&2
+   exit 1
+}
+
+cleanup() {
+   if [ -d "${tmp_dir}" ]; then
+      rm -rf "${tmp_dir}"
+   fi
+   tmp_dir=""
+}
+
+gen_release() {
+   config="${1}"
+   out="${2}"
+
+   [ -f "${config}" ] || die "File not found \"${config}\""
+
+   (
+      tmp_dir="$(mktemp -d --tmpdir tmp.rpi-eeprom.XXXXXXXXXX)"
+      cd "${tmp_dir}"
+      cp "${script_dir}/README.txt" .
+      cp "${firmware_dir}/recovery.bin" .
+      cp "${firmware_dir}/vl805-${vl805_version}.bin" vl805.bin
+      sha256sum vl805.bin | awk '{print $1}' > vl805.sig
+
+      "${script_dir}/../rpi-eeprom-config" \
+         --config "${config}" --out pieeprom.bin \
+         "${firmware_dir}/pieeprom-${pieeprom_version}.bin" || die "Failed to create updated EEPROM config with \"${config}\""
+      sha256sum pieeprom.bin | awk '{print $1}' > pieeprom.sig
+      echo "Creating ${out}"
+      zip "${out}" *
+      cleanup
+   )
+}
+
+usage() {
+cat <<EOF
+   make-release <firmware_status> <pieeprom_version> <vl805_version> <config_dir> <output_dir> <output_basename>
+
+   Example: make-release critical 2020-09-03 000138a1 . release rpi-boot-eeprom-recovery
+EOF
+exit
+}
+
+trap cleanup EXIT
+firmware_status="${1}"
+pieeprom_version="${2}"
+vl805_version="${3}"
+config_dir="${4}"
+output_dir="${5}"
+output_basename="${6}"
+
+[ -n "${firmware_status}" ] || usage
+[ -n "${pieeprom_version}" ] || usage
+[ -n "${vl805_version}" ] || usage
+[ -n "${config_dir}" ] || usage
+[ -n "${output_dir}" ] || usage
+[ -n "${output_basename}" ] || usage
+
+firmware_dir=${script_dir}/../firmware/${firmware_status}
+[ -d "${firmware_dir}" ] || (echo "${firmware_dir} doesn't exist" && exit 1)
+[ -f "${firmware_dir}/pieeprom-${pieeprom_version}.bin" ] || (echo "${firmware_status}/pieeprom-${pieeprom_version}.bin doesn't exist" && exit 1)
+[ -f "${firmware_dir}/vl805-${vl805_version}.bin" ] || (echo "${firmware_status}/vl805-${vl805_version}.bin doesn't exist" && exit 1)
+[ -d "${config_dir}" ] || (echo "${config_dir} doesn't exist" && exit 1)
+tag="${pieeprom_version}-vl805-${vl805_version}"
+# use realpath to ensure paths are absolute
+config_dir=$(realpath "${config_dir}")
+output_dir=$(realpath "${output_dir}")
+rm -rf "${output_dir}"
+mkdir "${output_dir}"
+
+# Build the different boot priority flavours
+gen_release "${config_dir}/boot-conf-default.txt" "${output_dir}/${output_basename}-${tag}.zip"
+for variant in sd usb network; do
+   gen_release "${config_dir}/boot-conf-${variant}.txt" "${output_dir}/${output_basename}-${tag}-${variant}.zip"
+done

releases.md

@@ -1,27 +1,18 @@
-# rpi-eeprom releases
-This page provides links to the production and development release images for the Raspberry Pi 4 bootloader EEPROM. Normally, the 
-bootloader is automatically updated after an APT update via the [rpi-eeprom-update](https://www.raspberrypi.org/documentation/hardware/raspberrypi/booteeprom.md)
-utility. However, it's sometimes more convenient to use a recovery image to program the EEPROM with default settings for a given release, rather than updating via Linux.
+# Raspberry Pi 4B, 400 and CM4 bootloader EEPROM releases
+This page provides links to the production and development release images for the bootloader EEPROM on BCM2711-based Raspberry Pi computers. Normally, the 
+bootloader is automatically updated after an APT update via the [rpi-eeprom-update](https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#automatic-updates) utility.
 
 ## Release notes
 Release notes are available [here](https://github.com/raspberrypi/rpi-eeprom/blob/master/firmware/release-notes.md).
 
-## Recovery image
-The latest production recovery image is [2020-04-16](https://github.com/raspberrypi/rpi-eeprom/releases/tag/v2020.04.16-137ad). This
-is the version selected by the [Raspberry Pi Imager](https://www.raspberrypi.org/downloads/).
+## Default release
+The default production EEPROM image release is [2020-09-03](https://github.com/raspberrypi/rpi-eeprom/releases/tag/v2020.09.03-138a1) and can be installed via the [Raspberry Pi Imager](https://www.raspberrypi.org/downloads/).
 
 ## USB MSD boot
-The latest USB mass storage boot recovery image is [2020-07-31](https://github.com/raspberrypi/rpi-eeprom/releases/tag/v2020.07.31-138a1).
-
-For support please see this [forum thread](https://www.raspberrypi.org/forums/viewtopic.php?f=63&t=277007)
-
-N.B. Although the bootloader has now been promoted to a stable / feature-freeze release USB MSD should still be considered BETA software because this requires updates to the GPU firmware. 
-
-## Previous releases
-All [previous releases](https://github.com/raspberrypi/rpi-eeprom/releases) are available here.
+Please see the [USB mass storage boot](https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#usb-mass-storage-boot) guide.
+For support or hardware interoperability discussions please use the Raspberry Pi [general discussion](https://forums.raspberrypi.com/viewforum.php?f=63) forum.
 
 ## Old EEPROM images
-Recovery images are only created for production images or for major test releases e.g. USB MSD boot. Old bootloader images are periodically
-removed from the APT package to reduce the disk space. The binaries can still be downloaded from Github [here](https://github.com/raspberrypi/rpi-eeprom/tree/master/firmware/old)
-but are not supported and may fail to boot on newer revisions of the hardware.
-For example, the Pi 4 8GB requires bootloader version 2020-04-16 or newer.
+Old bootloader images are periodically removed from the APT package to reduce the disk space, but are still available via Github [here](https://github.com/raspberrypi/rpi-eeprom/tree/master/firmware/old).
+
+**Old releases may fail to boot on newer hardware revisions.**

rpi-eeprom-config

@@ -1,79 +1,353 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 
-# rpi-eeprom-config
-# Utility for reading and writing the configuration file in the
-# Raspberry Pi 4 bootloader EEPROM image.
+"""
+rpi-eeprom-config
+"""
 
 import argparse
+import atexit
+import os
+import subprocess
+import string
 import struct
 import sys
+import tempfile
+import time
 
 IMAGE_SIZE = 512 * 1024
 
-MAX_BOOTCONF_SIZE = 2024
+# Larger files won't with with "vcgencmd bootloader_config"
+MAX_FILE_SIZE = 2024
+ALIGN_SIZE = 4096
+BOOTCONF_TXT = 'bootconf.txt'
+BOOTCONF_SIG = 'bootconf.sig'
+PUBKEY_BIN = 'pubkey.bin'
 
 # Each section starts with a magic number followed by a 32 bit offset to the
 # next section (big-endian).
 # The number, order and size of the sections depends on the bootloader version
 # but the following mask can be used to test for section headers and skip
 # unknown data.
+#
+# The last 4KB of the EEPROM image is reserved for internal use by the
+# bootloader and may be overwritten during the update process.
 MAGIC = 0x55aaf00f
+PAD_MAGIC = 0x55aafeef
 MAGIC_MASK = 0xfffff00f
-FILE_MAGIC = 0x55aaf11f # id for modifiable file, currently only bootconf.txt
+FILE_MAGIC = 0x55aaf11f # id for modifiable files
 FILE_HDR_LEN = 20
 FILENAME_LEN = 12
+TEMP_DIR = None
+
+DEBUG = False
+def debug(s):
+    if DEBUG:
+        sys.stderr.write(s + '\n')
+
+def rpi4():
+    compatible_path = "/sys/firmware/devicetree/base/compatible"
+    if os.path.exists(compatible_path):
+        with open(compatible_path, "rb") as f:
+            compatible = f.read().decode('utf-8')
+            if "bcm2711" in compatible:
+                return True
+    return False
+
+def exit_handler():
+    """
+    Delete any temporary files.
+    """
+    if TEMP_DIR is not None and os.path.exists(TEMP_DIR):
+        tmp_image = os.path.join(TEMP_DIR, 'pieeprom.upd')
+        if os.path.exists(tmp_image):
+            os.remove(tmp_image)
+        tmp_conf = os.path.join(TEMP_DIR, 'boot.conf')
+        if os.path.exists(tmp_conf):
+            os.remove(tmp_conf)
+        os.rmdir(TEMP_DIR)
+
+def create_tempdir():
+    global TEMP_DIR
+    if TEMP_DIR is None:
+        TEMP_DIR = tempfile.mkdtemp()
+
+def pemtobin(infile):
+    """
+    Converts an RSA public key into the format expected by the bootloader.
+    """
+    # Import the package here to make this a weak dependency.
+    from Cryptodome.PublicKey import RSA
+
+    arr = bytearray()
+    f = open(infile,'r')
+    key = RSA.importKey(f.read())
+
+    if key.size_in_bits() != 2048:
+        raise Exception("RSA key size must be 2048")
+
+    # Export N and E in little endian format
+    arr.extend(key.n.to_bytes(256, byteorder='little'))
+    arr.extend(key.e.to_bytes(8, byteorder='little'))
+    return arr
+
+def exit_error(msg):
+    """
+    Trapped a fatal error, output message to stderr and exit with non-zero
+    return code.
+    """
+    sys.stderr.write("ERROR: %s\n" % msg)
+    sys.exit(1)
+
+def shell_cmd(args):
+    """
+    Executes a shell command waits for completion returning STDOUT. If an
+    error occurs then exit and output the subprocess stdout, stderr messages
+    for debug.
+    """
+    start = time.time()
+    arg_str = ' '.join(args)
+    result = subprocess.Popen(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+
+    while time.time() - start < 5:
+        if result.poll() is not None:
+            break
+
+    if result.poll() is None:
+        exit_error("%s timeout" % arg_str)
+
+    if result.returncode != 0:
+        exit_error("%s failed: %d\n %s\n %s\n" %
+                   (arg_str, result.returncode, result.stdout.read(), result.stderr.read()))
+    else:
+        return result.stdout.read().decode('utf-8')
+
+def get_latest_eeprom():
+    """
+    Returns the path of the latest EEPROM image file if it exists.
+    """
+    latest = shell_cmd(['rpi-eeprom-update', '-l']).rstrip()
+    if not os.path.exists(latest):
+        exit_error("EEPROM image '%s' not found" % latest)
+    return latest
+
+def apply_update(config, eeprom=None, config_src=None):
+    """
+    Applies the config file to the latest available EEPROM image and spawns
+    rpi-eeprom-update to schedule the update at the next reboot.
+    """
+    if eeprom is not None:
+        eeprom_image = eeprom
+    else:
+        eeprom_image = get_latest_eeprom()
+    create_tempdir()
+
+    # Replace the contents of bootconf.txt with the contents of the config file
+    tmp_update = os.path.join(TEMP_DIR, 'pieeprom.upd')
+    image = BootloaderImage(eeprom_image, tmp_update)
+    image.update_file(config, BOOTCONF_TXT)
+    image.write()
+
+    config_str = open(config).read()
+    if config_src is None:
+        config_src = ''
+    sys.stdout.write("Updating bootloader EEPROM\n image: %s\nconfig_src: %s\nconfig: %s\n%s\n%s\n%s\n" %
+                     (eeprom_image, config_src, config, '#' * 80, config_str, '#' * 80))
+
+    sys.stdout.write("\n*** To cancel this update run 'sudo rpi-eeprom-update -r' ***\n\n")
+
+    # Ignore APT package checksums so that this doesn't fail when used
+    # with EEPROMs with configs delivered outside of APT.
+    # The checksums are really just a safety check for automatic updates.
+    args = ['rpi-eeprom-update', '-d', '-i', '-f', tmp_update]
+    resp = shell_cmd(args)
+    sys.stdout.write(resp)
+
+def edit_config(eeprom=None):
+    """
+    Implements something like 'git commit' for editing EEPROM configs.
+    """
+    # Default to nano if $EDITOR is not defined.
+    editor = 'nano'
+    if 'EDITOR' in os.environ:
+        editor = os.environ['EDITOR']
+
+    config_src = ''
+    # If there is a pending update then use the configuration from
+    # that in order to support incremental updates. Otherwise,
+    # use the current EEPROM configuration.
+    bootfs = shell_cmd(['rpi-eeprom-update', '-b']).rstrip()
+    pending = os.path.join(bootfs, 'pieeprom.upd')
+    if os.path.exists(pending):
+        config_src = pending
+        image = BootloaderImage(pending)
+        current_config = image.get_file(BOOTCONF_TXT).decode('utf-8')
+    else:
+        current_config, config_src = read_current_config()
+
+    create_tempdir()
+    tmp_conf = os.path.join(TEMP_DIR, 'boot.conf')
+    out = open(tmp_conf, 'w')
+    out.write(current_config)
+    out.close()
+    cmd = "\'%s\' \'%s\'" % (editor, tmp_conf)
+    result = os.system(cmd)
+    if result != 0:
+        exit_error("Aborting update because \'%s\' exited with code %d." % (cmd, result))
+
+    new_config = open(tmp_conf, 'r').read()
+    if len(new_config.splitlines()) < 2:
+        exit_error("Aborting update because \'%s\' appears to be empty." % tmp_conf)
+    apply_update(tmp_conf, eeprom, config_src)
+
+def read_current_config():
+    """
+    Reads the configuration used by the current bootloader.
+    """
+    fw_base = "/sys/firmware/devicetree/base/"
+    nvmem_base = "/sys/bus/nvmem/devices/"
+
+    if os.path.exists(fw_base + "/aliases/blconfig"):
+        with open(fw_base + "/aliases/blconfig", "rb") as f:
+            nvmem_ofnode_path = fw_base + f.read().decode('utf-8')
+            for d in os.listdir(nvmem_base):
+                if os.path.realpath(nvmem_base + d + "/of_node") in os.path.normpath(nvmem_ofnode_path):
+                    return (open(nvmem_base + d + "/nvmem", "rb").read().decode('utf-8'), "blconfig device")
+
+    return (shell_cmd(['vcgencmd', 'bootloader_config']), "vcgencmd bootloader_config")
+
+class ImageSection:
+    def __init__(self, magic, offset, length, filename=''):
+        self.magic = magic
+        self.offset = offset
+        self.length = length
+        self.filename = filename
+        debug("ImageSection %x %x %x %s" % (magic, offset, length, filename))
 
 class BootloaderImage(object):
-    def __init__(self, filename, output):
+    def __init__(self, filename, output=None):
+        """
+        Instantiates a Bootloader image writer with a source eeprom (filename)
+        and optionally an output filename.
+        """
         self._filename = filename
-        self._bytes = bytearray(open(filename, 'rb').read())
+        self._sections = []
+        try:
+            self._bytes = bytearray(open(filename, 'rb').read())
+        except IOError as err:
+            exit_error("Failed to read \'%s\'\n%s\n" % (filename, str(err)))
         self._out = None
         if output is not None:
             self._out = open(output, 'wb')
 
         if len(self._bytes) != IMAGE_SIZE:
-            raise Exception("%s: Expected size %d bytes actual size %d bytes" %
-                            (filename, IMAGE_SIZE, len(self._bytes)))
+            exit_error("%s: Expected size %d bytes actual size %d bytes" %
+                       (filename, IMAGE_SIZE, len(self._bytes)))
+        self.parse()
 
-    def find_config(self):
+    def parse(self):
+        """
+        Builds a table of offsets to the different sections in the EEPROM.
+        """
         offset = 0
         magic = 0
+        found = False
         while offset < IMAGE_SIZE:
             magic, length = struct.unpack_from('>LL', self._bytes, offset)
-            if (magic & MAGIC_MASK) != MAGIC:
-                raise Exception('EEPROM is corrupted')
+            if magic == 0x0 or magic == 0xffffffff:
+                break # EOF
+            elif (magic & MAGIC_MASK) != MAGIC:
+                raise Exception('EEPROM is corrupted %x %x %x' % (magic, magic & MAGIC_MASK, MAGIC))
 
+            filename = ''
             if magic == FILE_MAGIC: # Found a file
-                name = self._bytes[offset + 8: offset + FILE_HDR_LEN]
-                if name.decode('utf-8') == 'bootconf.txt':
-                    return (offset, length)
+                # Discard trailing null characters used to pad filename
+                filename = self._bytes[offset + 8: offset + FILE_HDR_LEN].decode('utf-8').replace('\0', '')
+            self._sections.append(ImageSection(magic, offset, length, filename))
 
             offset += 8 + length # length + type
             offset = (offset + 7) & ~7
 
-        raise Exception('Bootloader config not found')
+    def find_file(self, filename):
+        """
+        Returns the offset, length and whether this is the last section in the
+        EEPROM for a modifiable file within the image.
+        """
+        ret = (-1, -1, False)
+        for i in range(0, len(self._sections)):
+            s = self._sections[i]
+            if s.magic == FILE_MAGIC and s.filename == filename:
+                is_last = (i == len(self._sections) - 1)
+                ret = (s.offset, s.length, is_last)
+                break
+        debug('%s offset %d length %d last %s' % (filename, ret[0], ret[1], ret[2]))
+        return ret
 
-    def write(self, new_config):
-        hdr_offset, length = self.find_config()
-        new_config_bytes = open(new_config, 'rb').read()
-        new_len = len(new_config_bytes) + FILENAME_LEN + 4
-        if len(new_config_bytes) > MAX_BOOTCONF_SIZE:
-            raise Exception("Config is too large (%d bytes). The maximum size is %d bytes."
-                    % (len(new_config_bytes), MAX_BOOTCONF_SIZE))
-        if hdr_offset + len(new_config_bytes) + FILE_HDR_LEN > IMAGE_SIZE:
+    def update(self, src_bytes, dst_filename):
+        """
+        Replaces a modifiable file with specified byte array.
+        """
+        hdr_offset, length, is_last = self.find_file(dst_filename)
+        if hdr_offset < 0:
+            raise Exception('Update target %s not found' % dst_filename)
+
+        if hdr_offset + len(src_bytes) + FILE_HDR_LEN > IMAGE_SIZE:
             raise Exception('EEPROM image size exceeded')
 
+        new_len = len(src_bytes) + FILENAME_LEN + 4
         struct.pack_into('>L', self._bytes, hdr_offset + 4, new_len)
-        struct.pack_into(("%ds" % len(new_config_bytes)), self._bytes, hdr_offset + 4 + FILE_HDR_LEN, new_config_bytes)
+        struct.pack_into(("%ds" % len(src_bytes)), self._bytes,
+                         hdr_offset + 4 + FILE_HDR_LEN, src_bytes)
 
-        # If the new config is smaller than the old config then set any old
+        # If the new file is smaller than the old file then set any old
         # data which is now unused to all ones (erase value)
-        pad_start = hdr_offset + 4 + FILE_HDR_LEN + len(new_config_bytes)
+        pad_start = hdr_offset + 4 + FILE_HDR_LEN + len(src_bytes)
+
+        # Add padding up to 8-byte boundary
+        while pad_start % 8 != 0:
+            struct.pack_into('B', self._bytes, pad_start, 0xff)
+            pad_start += 1
+
+        # Create a padding section unless the padding size is smaller than the
+        # size of a section head. Padding is allowed in the last section but
+        # by convention bootconf.txt is the last section and there's no need to
+        # pad to the end of the sector. This also ensures that the loopback
+        # config read/write tests produce identical binaries.
+        pad_bytes = ALIGN_SIZE - (pad_start % ALIGN_SIZE)
+        if pad_bytes > 8 and not is_last:
+            pad_bytes -= 8
+            struct.pack_into('>i', self._bytes, pad_start, PAD_MAGIC)
+            pad_start += 4
+            struct.pack_into('>i', self._bytes, pad_start, pad_bytes)
+            pad_start += 4
+
+        debug("pad %d" % pad_bytes)
         pad = 0
-        while pad < (length - len(new_config_bytes)):
+        while pad < pad_bytes:
             struct.pack_into('B', self._bytes, pad_start + pad, 0xff)
             pad = pad + 1
 
+    def update_key(self, src_pem, dst_filename):
+        """
+        Replaces the specified public key entry with the public key values extracted
+        from the source PEM file.
+        """
+        pubkey_bytes = pemtobin(src_pem)
+        self.update(pubkey_bytes, dst_filename)
+
+    def update_file(self, src_filename, dst_filename):
+        """
+        Replaces the contents of dst_filename in the EEPROM with the contents of src_file.
+        """
+        src_bytes = open(src_filename, 'rb').read()
+        if len(src_bytes) > MAX_FILE_SIZE:
+            raise Exception("src file %s is too large (%d bytes). The maximum size is %d bytes."
+                            % (src_filename, len(src_bytes), MAX_FILE_SIZE))
+        self.update(src_bytes, dst_filename)
+
+    def write(self):
+        """
+        Writes the updated EEPROM image to stdout or the specified output file.
+        """
         if self._out is not None:
             self._out.write(self._bytes)
             self._out.close()
@@ -83,10 +357,14 @@ class BootloaderImage(object):
             else:
                 sys.stdout.write(self._bytes)
 
-    def read(self):
-        hdr_offset, length = self.find_config()
+    def get_file(self, filename):
+        hdr_offset, length, is_last = self.find_file(filename)
         offset = hdr_offset + 4 + FILE_HDR_LEN
         config_bytes = self._bytes[offset:offset+length-FILENAME_LEN-4]
+        return config_bytes
+
+    def read(self):
+        config_bytes = self.get_file('bootconf.txt')
         if self._out is not None:
             self._out.write(config_bytes)
             self._out.close()
@@ -97,34 +375,123 @@ class BootloaderImage(object):
                 sys.stdout.write(config_bytes)
 
 def main():
-    parser = argparse.ArgumentParser(formatter_class=argparse.RawDescriptionHelpFormatter, \
-    description='Bootloader EEPROM configuration tool for the Raspberry Pi 4. \
-\n\nThere are 3 operating modes: \
-\n\n1. Output the bootloader configuration stored in an EEPROM image file to \
-the screen (STDOUT): specify only the name of an EEPROM image file using the \
-\'eeprom\' option. \
-\n\n2. Output the bootloader configuration stored in an EEPROM image file to a \
-file: specify the EEPROM image file using the \'eeprom\' option, and the output \
-file using the \'--out\' option.\
-\n\n3. Insert a new bootloader configuration into an EEPROM image file: specify \
-the source EEPROM image file using the \'eeprom\' option and the bootloader \
-configuration file using the \'--config\' option. A new file which is a \
-combination of the EEPROM image file, together with the new bootloader \
-configuration file will be created - specify its name using the \'--out\' option. \
-The new bootloader configuration will replace any configuration present in the \
-source EEPROM image.\
-\n\nBootloader EEPROM images are contained in the \'rpi-eeprom-images\' package,\
- which installs them to the /lib/firmware/raspberrypi/bootloader directory.')
-    parser.add_argument('--config', help='Name of bootloader configuration file')
-    parser.add_argument('--out', help='Name of output file')
-    parser.add_argument('eeprom', help='Name of EEPROM file to use as input')
+    """
+    Utility for reading and writing the configuration file in the
+    Raspberry Pi 4 bootloader EEPROM image.
+    """
+    description = """\
+Bootloader EEPROM configuration tool for the Raspberry Pi 4.
+Operating modes:
+
+1. Outputs the current bootloader configuration to STDOUT if no arguments are
+   specified OR the given output file if --out is specified.
+
+   rpi-eeprom-config [--out boot.conf]
+
+2. Extracts the configuration file from the given 'eeprom' file and outputs
+   the result to STDOUT or the output file if --output is specified.
+
+   rpi-eeprom-config pieeprom.bin [--out boot.conf]
+
+3. Writes a new EEPROM image replacing the configuration file with the contents
+   of the file specified by --config.
+
+   rpi-eeprom-config --config boot.conf --out newimage.bin pieeprom.bin
+
+   The new image file can be installed via rpi-eeprom-update
+   rpi-eeprom-update -d -f newimage.bin
+
+4. Applies a given config file to an EEPROM image and invokes rpi-eeprom-update
+   to schedule an update of the bootloader when the system is rebooted.
+
+   Since this command launches rpi-eeprom-update to schedule the EEPROM update
+   it must be run as root.
+
+   sudo rpi-eeprom-config --apply boot.conf [pieeprom.bin]
+
+   If the 'eeprom' argument is not specified then the latest available image
+   is selected by calling 'rpi-eeprom-update -l'.
+
+5. The '--edit' parameter behaves the same as '--apply' except that instead of
+   applying a predefined configuration file a text editor is launched with the
+   contents of the current EEPROM configuration.
+
+   Since this command launches rpi-eeprom-update to schedule the EEPROM update
+   it must be run as root.
+
+   The configuration file will be taken from:
+       * The blconfig reserved memory nvmem device
+       * The cached bootloader configuration 'vcgencmd bootloader_config'
+       * The current pending update - typically /boot/pieeprom.upd
+
+   sudo -E rpi-eeprom-config --edit [pieeprom.bin]
+
+   To cancel the pending update run 'sudo rpi-eeprom-update -r'
+
+   The default text editor is nano and may be overridden by setting the 'EDITOR'
+   environment variable and passing '-E' to 'sudo' to preserve the environment.
+
+6. Signing the bootloader config file.
+   Updates an EEPROM binary with a signed config file (created by rpi-eeprom-digest) plus
+   the corresponding RSA public key.
+
+   Requires Python Cryptodomex libraries and OpenSSL. To install on Raspberry Pi OS run:-
+   sudo apt install openssl python-pip
+   sudo python3 -m pip install cryptodomex
+
+   rpi-eeprom-digest -k private.pem -i bootconf.txt -o bootconf.sig
+   rpi-eeprom-config --config bootconf.txt --digest bootconf.sig --pubkey public.pem --out pieeprom-signed.bin pieeprom.bin
+
+   Currently, the signing process is a separate step so can't be used with the --edit or --apply modes.
+
+
+See 'rpi-eeprom-update -h' for more information about the available EEPROM images.
+"""
+    parser = argparse.ArgumentParser(formatter_class=argparse.RawDescriptionHelpFormatter,
+                                     description=description)
+
+    parser.add_argument('-a', '--apply', required=False,
+                        help='Updates the bootloader to the given config plus latest available EEPROM release.')
+    parser.add_argument('-c', '--config', help='Name of bootloader configuration file', required=False)
+    parser.add_argument('-e', '--edit', action='store_true', default=False, help='Edit the current EEPROM config')
+    parser.add_argument('-o', '--out', help='Name of output file', required=False)
+    parser.add_argument('-d', '--digest', help='Signed boot only. The name of the .sig file generated by rpi-eeprom-dgst for config.txt ', required=False)
+    parser.add_argument('-p', '--pubkey', help='Signed boot only. The name of the RSA public key file to store in the EEPROM', required=False)
+    parser.add_argument('eeprom', nargs='?', help='Name of EEPROM file to use as input')
     args = parser.parse_args()
 
-    image = BootloaderImage(args.eeprom, args.out)
-    if args.config is not None:
-        image.write(args.config)
-    else:
-        image.read()
+    if (args.edit or args.apply is not None) and os.getuid() != 0:
+        exit_error("--edit/--apply must be run as root")
+
+    if (args.edit or args.apply is not None) and not rpi4():
+        exit_error("--edit/--apply must run on a Raspberry Pi 4")
+
+    if args.edit:
+        edit_config(args.eeprom)
+    elif args.apply is not None:
+        if not os.path.exists(args.apply):
+            exit_error("config file '%s' not found" % args.apply)
+        apply_update(args.apply, args.eeprom, args.apply)
+    elif args.eeprom is not None:
+        image = BootloaderImage(args.eeprom, args.out)
+        if args.config is not None:
+            if not os.path.exists(args.config):
+                exit_error("config file '%s' not found" % args.config)
+            image.update_file(args.config, BOOTCONF_TXT)
+            if args.digest is not None:
+                image.update_file(args.digest, BOOTCONF_SIG)
+            if args.pubkey is not None:
+                image.update_key(args.pubkey, PUBKEY_BIN)
+            image.write()
+        else:
+            image.read()
+    elif args.config is None and args.eeprom is None:
+        current_config, config_src = read_current_config()
+        if args.out is not None:
+            open(args.out, 'w').write(current_config)
+        else:
+            sys.stdout.write(current_config)
 
 if __name__ == '__main__':
+    atexit.register(exit_handler)
     main()

rpi-eeprom-digest

@@ -0,0 +1,110 @@
+#!/bin/sh
+
+# Helper script to generate .sig files for use with the Raspberry Pi bootloader.
+
+# This has been implemented in a separate script in order to have avoid having
+# a hard dependency on OpenSSL.
+
+set -e
+
+OPENSSL=${OPENSSL:-openssl}
+
+die() {
+   echo "$@" >&2
+   exit 1
+}
+
+TMP_DIR=""
+cleanup() {
+   if [ -f "${TMP_DIR}" ]; then
+      rm -rf "${TMP_DIR}"
+   fi
+}
+
+checkDependencies() {
+   if ! command -v sha256sum > /dev/null; then
+      die "sha256sum not found. Try installing the coreutilities package."
+   fi
+
+   if [ -n "${KEY}" ]; then
+      if ! command -v ${OPENSSL} > /dev/null; then
+         die "${OPENSSL} not found. Try installing the openssl package."
+      fi
+
+      if ! command -v xxd > /dev/null; then
+         die "xxd not found. Try installing the xxd package."
+      fi
+   fi
+}
+
+usage() {
+cat <<EOF
+rpi-eeprom-digest [-k RSA_KEY] -i IMAGE -o OUTPUT
+
+Creates a .sig file containing the sha256 digest of the IMAGE and an optional
+RSA signature of that hash.
+
+Options:
+   -i The source image.
+   -o The name of the digest/signature file.
+   -k Optional RSA private key.
+
+RSA signing
+If a private key in PEM format is supplied then the RSA signature of the
+sha256 digest is included in the .sig file. Currently, the bootloader only
+supports sha256 digests signed with a 2048bit RSA key.
+The bootloader only verifies RSA signatures in signed boot mode
+(not available yet) and only for the EEPROM config file and the signed image.
+
+Examples:
+
+# Generate RSA signature for the EEPROM config file.
+rpi-eeprom-digest -k key.pem -i bootconf.txt  -o bootconf.sig
+
+# Generate the normal sha256 hash to guard against file-system corruption
+rpi-eeprom-digest -i pieeprom.bin -o pieeprom.sig
+rpi-eeprom-digest -i vl805.bin -o vl805.sig
+
+EOF
+exit 0
+}
+
+OUTPUT=""
+while getopts i:k:ho: option; do
+   case "${option}" in
+   i) IMAGE="${OPTARG}"
+      ;;
+   k) KEY="${OPTARG}"
+      ;;
+   o) OUTPUT="${OPTARG}"
+      ;;
+   h) usage
+      ;;
+   *) echo "Unknown argument \"${option}\""
+      usage
+      ;;
+   esac
+done
+
+[ -n "${IMAGE}" ] || usage
+[ -n "${OUTPUT}" ] || usage
+
+trap cleanup EXIT
+
+checkDependencies
+
+[ -f "${IMAGE}" ] || die "Source image \"${IMAGE}\" not found"
+
+TMP_DIR=$(mktemp -d)
+SIG_TMP="${TMP_DIR}/tmp.sig"
+sha256sum "${IMAGE}" | awk '{print $1}' > "${OUTPUT}"
+
+# Include the update-timestamp
+echo "ts: $(date -u +%s)" >> "${OUTPUT}"
+
+if [ -n "${KEY}" ]; then
+   [ -f "${KEY}" ] || die "RSA private \"${KEY}\" not found"
+
+   "${OPENSSL}" dgst -sign "${KEY}" -keyform PEM -sha256 -out "${SIG_TMP}" "${IMAGE}"
+   echo "rsa2048: $(xxd -c 4096 -p < "${SIG_TMP}")" >> "${OUTPUT}"
+fi

rpi-eeprom-update

@@ -23,16 +23,21 @@ else
    FIRMWARE_ROOT="${script_dir}/firmware"
 fi
 
-# May be used to select beta or stable releases instead of the default critical updates.
-FIRMWARE_RELEASE_STATUS=${FIRMWARE_RELEASE_STATUS:-critical}
+# Selects the release sub-directory
+FIRMWARE_RELEASE_STATUS=${FIRMWARE_RELEASE_STATUS:-default}
 FIRMWARE_IMAGE_DIR=${FIRMWARE_IMAGE_DIR:-${FIRMWARE_ROOT}/${FIRMWARE_RELEASE_STATUS}}
 FIRMWARE_BACKUP_DIR=${FIRMWARE_BACKUP_DIR:-/var/lib/raspberrypi/bootloader/backup}
 ENABLE_VL805_UPDATES=${ENABLE_VL805_UPDATES:-1}
-USE_FLASHROM=${USE_FLASHROM:-0}
 RECOVERY_BIN=${RECOVERY_BIN:-${FIRMWARE_ROOT}/${FIRMWARE_RELEASE_STATUS}/recovery.bin}
 BOOTFS=${BOOTFS:-/boot}
-VCMAILBOX=${VCMAILBOX:-/opt/vc/bin/vcmailbox}
 CM4_ENABLE_RPI_EEPROM_UPDATE=${CM4_ENABLE_RPI_EEPROM_UPDATE:-0}
+RPI_EEPROM_UPDATE_CONFIG_TOOL="${RPI_EEPROM_UPDATE_CONFIG_TOOL:-raspi-config}"
+
+# Automatic, critical updates are not applied unless the current bootloader version
+# is older than pieeprom-2020-09-03
+BOOTLOADER_AUTO_UPDATE_MIN_VERSION="${BOOTLOADER_AUTO_UPDATE_MIN_VERSION:-1599135103}"
+
+DT_BOOTLOADER_TS=${DT_BOOTLOADER_TS:-/proc/device-tree/chosen/bootloader/build-timestamp}
 
 EXIT_SUCCESS=0
 EXIT_UPDATE_REQUIRED=1
@@ -42,8 +47,6 @@ EXIT_EEPROM_FROZEN=3
 # EXIT_PREVIOUS_UPDATE_FAILED=4
 
 OVERWRITE_CONFIG=0
-# Maximum safe SPI speed for EEPROM access 16000, slower is ok.
-SPI_SPEED=16000
 # Timestamp for first release which doesn't have a timestamp field
 BOOTLOADER_FIRST_VERSION=1557513636
 EEPROM_SIZE=524288
@@ -54,14 +57,10 @@ BOARD_TYPE=
 # Newer board revisions embed the VLI firmware in the bootloader EEPROM and
 # there is no way to separately update the VLI firmware. Consequently,
 # standalone vl805 update files do not trigger automatic updates.
-# Recovery.bin and the the SPI bootloader ignore vl805.bin files on boards
-# without a dedicate VL805 EEPROM.
+# recovery.bin and the SPI bootloader ignore vl805.bin files on boards
+# without a dedicated VL805 EEPROM.
 HAVE_VL805_EEPROM=0
 
-# Simple bootloader which is able to load start.elf in the event of a power
-# cut. This runs SDRAM at low speed and may have reduced functionality but
-# should be enough to run flashrom again.
-
 TMP_EEPROM_IMAGE=""
 TMP_BOOTFS_MNT=""
 
@@ -71,8 +70,12 @@ VL805_UPDATE_VERSION=
 # The update actions selected by the version check
 ACTION_UPDATE_BOOTLOADER=0
 ACTION_UPDATE_VL805=0
+CHECKSUMS=''
 
 cleanup() {
+   if [ -f "${CHECKSUMS}" ]; then
+      rm -f "${CHECKSUMS}"
+   fi
    if [ -f "${TMP_EEPROM_IMAGE}" ]; then
       rm -f "${TMP_EEPROM_IMAGE}"
    fi
@@ -98,9 +101,37 @@ die() {
    exit ${EXIT_FAILED}
 }
 
+getBootloaderConfig() {
+   # Prefer extracting bootloader's config from DT.
+   #
+   # In order to find the right nvmem device, we build the sysfs path of the
+   # bootloader reserved memory DT node to then match that path against all
+   # nvmem device's ofnode path.
+   #
+   # If the path isn't there, default to using vcgencmd.
+
+   local blconfig_alias="/sys/firmware/devicetree/base/aliases/blconfig"
+   local blconfig_nvmem_path=""
+
+   if [ -f "${blconfig_alias}" ]; then
+      local blconfig_ofnode_path="/sys/firmware/devicetree/base"$(strings "${blconfig_alias}")""
+      local blconfig_ofnode_link=$(find -L /sys/bus/nvmem -samefile "${blconfig_ofnode_path}" 2>/dev/null)
+
+      if [ -e "${blconfig_ofnode_link}" ]; then
+         blconfig_nvmem_path=$(dirname "${blconfig_ofnode_link}")
+      fi
+   fi
+
+   if [ -n "${blconfig_nvmem_path}" ]; then
+      cat "${blconfig_nvmem_path}"/nvmem
+   else
+      vcgencmd bootloader_config
+   fi
+}
+
 prepareImage()
 {
-   [ -f "${BOOTLOADER_UPDATE_IMAGE}" ] || die "EEPROM image \'${BOOTLOADER_UPDATE_IMAGE}\' not found"
+   [ -f "${BOOTLOADER_UPDATE_IMAGE}" ] || die "EEPROM image '${BOOTLOADER_UPDATE_IMAGE}' not found"
    TMP_EEPROM_IMAGE="$(mktemp)"
    TMP_EEPROM_CONFIG="$(mktemp)"
    NEW_EEPROM_CONFIG="$(mktemp)"
@@ -108,7 +139,7 @@ prepareImage()
    mkdir -p "${FIRMWARE_BACKUP_DIR}"
 
    # Backup the configuration of the currently loaded bootloader
-   vcgencmd bootloader_config > "${TMP_EEPROM_CONFIG}"
+   getBootloaderConfig > "${TMP_EEPROM_CONFIG}"
    backup="${FIRMWARE_BACKUP_DIR}/pieeprom-backup-$(date +%Y%m%d-%H%M%S).conf"
    cp -f "${TMP_EEPROM_CONFIG}" "${backup}"
 
@@ -142,101 +173,87 @@ applyRecoveryUpdate()
 {
    [ -n "${BOOTLOADER_UPDATE_IMAGE}" ] || [ -n "${VL805_UPDATE_IMAGE}" ] || die "No update images specified"
 
-   findBootFS
+   getBootloaderCurrentVersion
+   BOOTLOADER_UPDATE_VERSION=$(strings "${BOOTLOADER_UPDATE_IMAGE}" | grep BUILD_TIMESTAMP | sed 's/.*=//g')
+   if [ "${BOOTLOADER_CURRENT_VERSION}" -gt "${BOOTLOADER_UPDATE_VERSION}" ]; then
+      echo "   WARNING: Installing an older bootloader version."
+      echo "            Update the rpi-eeprom package to fetch the latest bootloader images."
+      echo
+   fi
+   echo "   CURRENT: $(date -u "-d@${BOOTLOADER_CURRENT_VERSION}") (${BOOTLOADER_CURRENT_VERSION})"
+   echo "    UPDATE: $(date -u "-d@${BOOTLOADER_UPDATE_VERSION}") (${BOOTLOADER_UPDATE_VERSION})"
+
+   findBootFS
+   echo "    BOOTFS: ${BOOTFS}"
 
-   # A '.sig' file is created so that recovery.bin can check that the
-   # EEPROM image has not been created (e.g. SD card corruption).
-   # The .sig file format is currently just a SHA256 in ASCII hex. In future,
-   # if an actual public key signature is required then that plus any other
-   # data would be appended after the SHA256 signature.
    if [ -n "${BOOTLOADER_UPDATE_IMAGE}" ]; then
         [ -f "${BOOTLOADER_UPDATE_IMAGE}" ] || die "${BOOTLOADER_UPDATE_IMAGE} not found"
 
         TMP_EEPROM_IMAGE="$(mktemp)"
         prepareImage
-        # If recovery.bin encounters pieeprom.upd then it will select it in
-        # preference to pieeprom.bin. The .upd file also causes recovery.bin
-        # to rename itself to recovery.000 and reboot if the update is successful.
-        # The rename causes the ROM to ignore this file and use the newly flashed
-        # EEPROM image instead.
-        sha256sum "${TMP_EEPROM_IMAGE}" | awk '{print $1}' > "${BOOTFS}/pieeprom.sig" \
-                || die "Failed to create ${BOOTFS}/pieeprom.sig"
+
+        # Generate a .sig file containing the sha256 hash of the EEPROM image
+        # and the current timestamp.
+        rpi-eeprom-digest -i "${TMP_EEPROM_IMAGE}" -o "${BOOTFS}/pieeprom.sig"
 
         cp -f "${TMP_EEPROM_IMAGE}" "${BOOTFS}/pieeprom.upd" \
                 || die "Failed to copy ${TMP_EEPROM_IMAGE} to ${BOOTFS}"
 
         # For NFS mounts ensure that the files are readable to the TFTP user
-        chmod -f go+r "${BOOTFS}/pieeprom.upd" "${BOOTFS}/pieeprom.sig"
+        chmod -f go+r "${BOOTFS}/pieeprom.upd" "${BOOTFS}/pieeprom.sig" \
+                || die "Failed to set permissions on eeprom update files"
    fi
 
    if [ -n "${VL805_UPDATE_IMAGE}" ]; then
-        sha256sum "${VL805_UPDATE_IMAGE}" | awk '{print $1}' > "${BOOTFS}/vl805.sig" \
-                || die "Failed to create ${BOOTFS}/vl805.sig"
-        cp -f "${VL805_UPDATE_IMAGE}" "${BOOTFS}/vl805.bin"
+        rpi-eeprom-digest -i "${VL805_UPDATE_IMAGE}" -o "${BOOTFS}/vl805.sig"
+
+        cp -f "${VL805_UPDATE_IMAGE}" "${BOOTFS}/vl805.bin" \
+                || die "Failed to copy ${VL805_UPDATE_IMAGE} to ${BOOTFS}/vl805.bin"
 
         # For NFS mounts ensure that the files are readable to the TFTP user
-        chmod -f go+r "${BOOTFS}/vl805.bin" "${BOOTFS}/vl805.sig"
+        chmod -f go+r "${BOOTFS}/vl805.bin" "${BOOTFS}/vl805.sig" \
+                || die "Failed to set permissions on eeprom update files"
    fi
 
    cp -f "${RECOVERY_BIN}" "${BOOTFS}/recovery.bin" \
       || die "Failed to copy ${RECOVERY_BIN} to ${BOOTFS}"
+
+   echo ""
+   echo "EEPROM updates pending. Please reboot to apply the update."
+   echo "To cancel a pending update run \"sudo rpi-eeprom-update -r\"."
 }
 
 applyUpdate() {
-   checksums_file="/var/lib/dpkg/info/rpi-eeprom.md5sums"
-
    [ "$(id -u)" = "0" ] || die "* Must be run as root - try 'sudo rpi-eeprom-update'"
 
-   if [ "${IGNORE_DPKG_CHECKSUMS}" = 0 ] && [ -f "${checksums_file}" ]; then
+   if [ "${IGNORE_DPKG_CHECKSUMS}" = 0 ]; then
       (
+         package_checksums_file="${PACKAGE_INFO_DIR}/rpi-eeprom.md5sums"
+
+         if ! grep -qE '\.bin$' "${PACKAGE_INFO_DIR}/rpi-eeprom.md5sums"; then
+            # Try the old rpi-eeprom-images package
+            package_checksums_file="${PACKAGE_INFO_DIR}/rpi-eeprom-images.md5sums"
+         fi
+
+         CHECKSUMS=$(mktemp)
+         grep -E '\.bin$' "${package_checksums_file}" > "${CHECKSUMS}"
          cd /
-         if ! md5sum -c "${checksums_file}" > /dev/null 2>&1; then
-            md5sum -c "${checksums_file}"
+         if ! md5sum -c "${CHECKSUMS}" > /dev/null 2>&1; then
+            md5sum -c "${CHECKSUMS}"
             die "rpi-eeprom checksums failed - try reinstalling this package"
          fi
-      )
+      ) || die "Unable to validate EEPROM image package checksums"
    fi
 
-   if [ "${USE_FLASHROM}" = 0 ]; then
-      applyRecoveryUpdate
-      return
-   fi
-
-   if [ -f "${BOOTLOADER_UPDATE_IMAGE}" ]; then
-      echo "WARNING: USE_FLASHROM is deprecated."
-      # Bootloader EEPROM chip-select is muxed with audio pin so disable audio
-      # LDO first to avoid sending noise to analog audio.
-      "${VCMAILBOX}" 0x00030056 4 4 0 > /dev/null || true
-      dtparam audio=off
-
-      # Switch the SPI pins to boot EEPROM
-      dtoverlay spi-gpio40-45
-      modprobe spidev
-      modprobe spi-bcm2835
-
-      prepareImage "${BOOTLOADER_UPDATE_IMAGE}"
-
-      echo "Applying bootloader update ${BOOTLOADER_UPDATE_IMAGE}"
-      flashrom -p "linux_spi:dev=/dev/spidev0.0,spispeed=${SPI_SPEED}" -w "${TMP_EEPROM_IMAGE}" || die "flashrom EEPROM update failed"
-
-      dtparam -R spi-gpio40-45
-      dtparam audio=on
-      ${VCMAILBOX} 0x00030056 4 4 1 > /dev/null || true
-   fi
-
-   if [ -f "${VL805_UPDATE_IMAGE}" ]; then
-      echo "Applying VL805 image ${VL805_UPDATE_IMAGE}"
-      vl805 -w "${VL805_UPDATE_IMAGE}"
-   fi
-
-   echo "Applying bootloader update ${BOOTLOADER_UPDATE_IMAGE}"
+   applyRecoveryUpdate
 }
 
-# Use the version reported by the loaded EEPROM instead of attempting to retrieve
-# this via flashrom to avoid unnecessary audio glitches.
 BOOTLOADER_CURRENT_VERSION=
 getBootloaderCurrentVersion() {
-   if vcgencmd bootloader_version | grep -q timestamp; then
+   if [ -f "${DT_BOOTLOADER_TS}" ]; then
+      # Prefer device-tree to vcgencmd
+      BOOTLOADER_CURRENT_VERSION=$(printf "%d" "0x$(od "${DT_BOOTLOADER_TS}" -v -An -t x1 | tr -d ' ' )")
+   elif vcgencmd bootloader_version | grep -q timestamp; then
       BOOTLOADER_CURRENT_VERSION=$(vcgencmd bootloader_version | grep timestamp | awk '{print $2}')
       if [ "${BOOTLOADER_CURRENT_VERSION}" = "0" ]; then
          # If a timestamp of zero is returned then it's new firmware but an
@@ -260,7 +277,7 @@ BOOTLOADER_UPDATE_VERSION=0
 getBootloaderUpdateVersion() {
    BOOTLOADER_UPDATE_VERSION=0
    match=".*/pieeprom-[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9].bin"
-   latest="$(find "${FIRMWARE_IMAGE_DIR}" -maxdepth 1 -type f -size "${EEPROM_SIZE}c" -regex "${match}" | sort -r | head -n1)"
+   latest="$(find "${FIRMWARE_IMAGE_DIR}/" -maxdepth 1 -type f -size "${EEPROM_SIZE}c" -regex "${match}" | sort -r | head -n1)"
    if [ -f "${latest}" ]; then
       BOOTLOADER_UPDATE_VERSION=$(strings "${latest}" | grep BUILD_TIMESTAMP | sed 's/.*=//g')
       BOOTLOADER_UPDATE_IMAGE="${latest}"
@@ -268,70 +285,74 @@ getBootloaderUpdateVersion() {
 }
 
 checkDependencies() {
-   BOARD_INFO="$(od -v -An -t x1 /sys/firmware/devicetree/base/system/linux,revision | tr -d ' \n')"
-   if [ $(((0x$BOARD_INFO >> 23) & 1)) -ne 0 ] && [ $(((0x$BOARD_INFO >> 12) & 15)) -eq 3 ]; then
-      echo "BCM2711 detected"
+
+   if [ -f "/sys/firmware/devicetree/base/system/linux,revision" ]; then
+      BOARD_INFO="$(od -v -An -t x1 /sys/firmware/devicetree/base/system/linux,revision | tr -d ' \n')"
+   elif grep -q Revision /proc/cpuinfo; then
+      BOARD_INFO="$(sed -n '/^Revision/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo)"
+   elif command -v vcgencmd > /dev/null; then
+      BOARD_INFO="$(vcgencmd otp_dump | grep '30:' | sed 's/.*://')"
    else
+      echo "No Raspberry Pi board info found"
+      exit ${EXIT_SUCCESS}
+   fi
+
+   if [ $(((0x$BOARD_INFO >> 23) & 1)) -eq 0 ] || [ $(((0x$BOARD_INFO >> 12) & 15)) -ne 3 ]; then
       # Not a BCM2711, no EEPROMs to update.
+      echo "This tool only works with a Raspberry Pi 4"
       exit ${EXIT_SUCCESS}
    fi
 
    BOARD_TYPE=$(((0x$BOARD_INFO >> 4) & 0xff))
    BOARD_REVISION=$((0x$BOARD_INFO & 0xf))
 
-   if [ ${BOARD_TYPE} -eq 20 ] && [ ${CM4_ENABLE_RPI_EEPROM_UPDATE} != '1' ]; then
+   if [ ${BOARD_TYPE} -eq 20 ] && [ "${CM4_ENABLE_RPI_EEPROM_UPDATE}" != '1' ]; then
       # For CM4, USB device boot is the recommended method for EEPROM updates.
-      echo "rpi-eeprom-update is not enabled by default on CM4"
+      echo "rpi-eeprom-update is not enabled by default on CM4. Run with -h for more information."
       exit ${EXIT_SUCCESS}
    fi
 
    if [ ${BOARD_TYPE} -eq 17 ] && [ ${BOARD_REVISION} -lt 4 ]; then
-      echo "Dedicated VL805 EEPROM detected"
       HAVE_VL805_EEPROM=1
    else
-      echo "VL805 firmware in bootloader EEPROM"
       HAVE_VL805_EEPROM=0
    fi
 
-   if ! command -v vcgencmd  > /dev/null; then
-      die "vcgencmd not found. On Debian, try installing the libraspberrypi-bin package."
+   if ! command -v rpi-eeprom-digest > /dev/null; then
+      die "rpi-eeprom-digest not found. Try re-installing the rpi-eeprom package"
    fi
 
-   if [ ! -d "${FIRMWARE_IMAGE_DIR}" ]; then
+   if ! command -v lspci > /dev/null; then
+      die "lspci not found. Try installing the pciutils package."
+   fi
+
+   # vcgencmd bootloader_version is deprecated. Use device-tree if available to
+   # reduce the number of dependencies on VCHI.
+   if ! [ -f "${DT_BOOTLOADER_TS}" ]; then
+      if ! command -v vcgencmd > /dev/null; then
+         die "vcgencmd not found. Try installing the libraspberrypi-bin package."
+      fi
+   fi
+
+   if [ ! -e "${FIRMWARE_IMAGE_DIR}" ]; then
       die "EEPROM updates directory ${FIRMWARE_IMAGE_DIR} not found."
    fi
 
    # If a board revision specific firmware directory is defined then use that
    # in preference to the generic directory.
-   if [ -d "${FIRMWARE_IMAGE_DIR}-${BOARD_INFO}" ]; then
+   if [ -e "${FIRMWARE_IMAGE_DIR}-${BOARD_INFO}" ]; then
       FIRMWARE_IMAGE_DIR="${FIRMWARE_IMAGE_DIR}-${BOARD_INFO}"
    fi
 
-   if vcgencmd bootloader_config | grep -qi "Command not registered"; then
-      die "vcgencmd: 'bootloader_config' command not supported. Please update VC firmware and reboot."
+   if ! getBootloaderConfig > /dev/null; then
+      die "Unable to get bootloader config, please update VC firmware and reboot."
    fi
 
    if ! command -v sha256sum > /dev/null; then
-      die "sha256sum not found. On Debian, try installing the coreutilities package"
+      die "sha256sum not found. Try installing the coreutilities package."
    fi
 
-   if ! command -v flashrom  > /dev/null && [ "${USE_FLASHROM}" = 1 ]; then
-      die "flashrom not found. On Debian, try installing the flashrom package."
-   fi
-
-   if [ ! -x "${VCMAILBOX}" ] && [ "${USE_FLASHROM}" = 1 ]; then
-      die "vcmailbox not found. On Debian, try installing the libraspberrypi-bin package."
-   fi
-
-   if ! command -v dtparam > /dev/null && [ "${USE_FLASHROM}" = 1 ]; then
-      die "dtparam not found. On Debian, try installing the libraspberrypi-bin package."
-   fi
-
-   if ! command -v dtoverlay > /dev/null && [ "${USE_FLASHROM}" = 1 ]; then
-      die "dtoverlay not found. On Debian, try installing the libraspberrypi-bin package."
-   fi
-
-   if [ "${USE_FLASHROM}" = 0 ] && [ ! -f "${RECOVERY_BIN}" ]; then
+   if [ ! -f "${RECOVERY_BIN}" ]; then
       die "${RECOVERY_BIN} not found."
    fi
 }
@@ -343,7 +364,7 @@ rpi-eeprom-update [options]... [FILE]
 Bootloader EEPROM update tool for the Raspberry Pi 4.
 
 Checks whether the Raspberry Pi 4 bootloader and the VL805 USB controller
-EEPROMs are up-to-date and optionally updates the EEPROMs at the next reboot.
+EEPROMs are up to date and optionally updates the EEPROMs at the next reboot.
 
 The default update mechanism writes recovery.bin and the EEPROM update
 image(s) (pieeprom.upd and vl805.bin) to the boot partition.
@@ -370,18 +391,25 @@ retained.
 Options:
    -a Automatically install bootloader and USB (VLI) EEPROM updates.
    -A Specify which type of EEPROM to automatically update (vl805 or bootloader)
+   -b Outputs the path that pending EEPROM updates will be written to.
    -d Use the default bootloader config, or if a file is specified using the -f
       flag use the config in that file. This option only applies when a
-      bootloader EEPROM update is needed; if the bootloader EEPROM is up-to-date
+      bootloader EEPROM update is needed; if the bootloader EEPROM is up to date
       then its config will not be changed.
    -f Install the given file instead of the latest applicable update
       Ignores the FREEZE_VERSION flag in bootloader and is intended for manual
       firmware updates.
    -h Display help text and exit
    -i Ignore package checksums - for rpi-eeprom developers.
-   -j Write status information using JSON notation
+   -j Write status information using JSON notation (requires -m option)
+   -l Returns the full path to the latest available EEPROM image file according
+      to the FIRMWARE_RELEASE_STATUS and FIRMWARE_IMAGE_DIR settings.
    -m Write status information to the given file when run without -a or -f
-   -r Removes temporary EEPROM update files from the boot partition.
+   -r Removes temporary EEPROM update files from the boot partition. This also
+      cancels a pending update.
+   -s Skips silent, automatic upgrades for default releases if the current
+      bootloader release is newer than the version specified by
+      BOOTLOADER_AUTO_UPDATE_MIN_VERSION ${BOOTLOADER_AUTO_UPDATE_MIN_VERSION}
    -u Install the specified VL805 (USB EEPROM) image file.
 
 Environment:
@@ -394,44 +422,41 @@ configuration file before it is applied to the new image. The modified
 output must contain at least 3 lines and should contain WAKE_ON_GPIO
 and POWER_OFF_ON_HALT settings.
 
-USE_FLASHROM
-
-USE_FLASHROM is deprecated and there is no support for this. The muxing
-of the SPI pins causes too many issues for this to ever be reliable.
-
-The flashrom update mechanism may be enabled by setting USE_FLASHROM=1. This
-also selects the vl805 tool instead of using recovery.bin to perform the
-update. This may be desirable if an immediate update is required or if an
-SD card is not present.
-However, this not recommended because the SPI pins are muxed with audio and other
-device drivers may be using SPI (e.g. HATs). This is also not safe in the
-event of a power failure during the update of the EEPROM.
-Changing the VL805 firmware whilst USB devices are attached may also cause
-those devices to stop working until after the system is reboot.
-
 FIRMWARE_RELEASE_STATUS
 
-Specifies the release status of the firmware to apply. The default is 'critical'.
+Specifies the release status of the firmware to apply.
 
 Before selecting a firmware release directory this script checks whether there
-is a board revision specific variant e.g. critical-c03111. If present then the
+is a board revision specific variant e.g. default-c03111. If present then the
 board-revision specific version is used in preference.
 
 Release status:
+Bootloader releases follow a pipeline where images are released to the 'beta'
+directory first. The binaries are then promoted to 'latest' and finally 'default'
+so the 'default' binary is always the most tested release.
 
-critical: The latest production release plus important security or hardware compatibility bug fixes.
+default:
+The default bootloader image which supports all current models and hardware
+revisions.
+If a critical bug fix is required then the minimum default version number
+(BOOTLOADER_AUTO_UPDATE_MIN_VERSION) in the rpi-eeprom package is updated
+causing the bootloader to be automatically updated.
 
-stable: Contains new features that have already undergone some beta testing.
-These are candidates for new production releases.
-
-beta: New features, bug fixes for development/test purposes. Use at your own
-risk!
+latest:
+Contains the latest features which have undergone testing via the 'beta'
+release. Backwards compatiblity for configuration parameters is maintained
+once a feature is in the latest release directory.
+If the 'latest' release is selected then bootloader is automatically upgraded
+when the rpi-eeprom package is updated.
 
 As far as rpi-eeprom-update is concerned FIRMWARE_RELEASE_STATUS is just
 the subdirectory mapping under ${FIRMWARE_ROOT}. Therefore, custom release
 directories are supported by creating the relevant directory and changing
 the FIRMWARE_RELEASE_STATUS environment variable.
 
+The 'default' and 'latest' release names are symlinks to the old directory
+names of 'critical' / 'stable'.
+
 Examples:
 To extract the configuration file from an EEPROM image:
    rpi-eeprom-config pieeprom.bin --out bootconf.txt
@@ -445,7 +470,29 @@ To flash the new image:
 The syntax is the same as config.txt See online documentation for the list of parameters.
 
 The official documentation for the Raspberry Pi bootloader EEPROM is available at
-https://www.raspberrypi.org/documentation/hardware/raspberrypi/booteeprom.md
+   https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#raspberry-pi-4-boot-eeprom
+
+Compute Module 4 (CM4):
+
+CM4 is designed to support embedded applications where physical access to the CM4
+may be limited.  An invalid bootloader configuration or software bug could
+cause the system to fail to boot so automatic updates are disabled. We also
+recommend write-protecting the SPI EPPROM after flashing it using usbboot.
+
+CM4 bootloader and EEPROM update instructions:
+   https://www.raspberrypi.com/documentation/computers/compute-module.html#compute-module-4-bootloader
+
+The CM4 ROM does not support running recovery.bin from the EMMC on CM4 so this service
+is disabled by default. SELF_UPDATE from USB or Network boot is supported but this
+must first be enabled by removing ENABLE_SELF_UPDATE=0 from the EEPROM config
+via usbboot.
+
+After enabling self-update set the CM4_ENABLE_RPI_EEPROM_UPDATE=1 environment
+variable or define it in /etc/default/rpi-eeprom-update.
+
+N.B. If there is a power failure during SELF_UPDATE the EEPROM write may fail and
+usbboot must be used to flash the bootloader EEPROM. SELF_UPDATE is not recommended
+for updating the bootloader on remote systems.
 
 EOF
   exit ${EXIT_SUCCESS}
@@ -456,25 +503,32 @@ printVersions()
    if [ "${ACTION_UPDATE_BOOTLOADER}" = 1 ]; then
       echo "BOOTLOADER: update available"
    else
-      echo "BOOTLOADER: up-to-date"
+      echo "BOOTLOADER: up to date"
    fi
 
-   echo "CURRENT: $(date -u "-d@${BOOTLOADER_CURRENT_VERSION}") (${BOOTLOADER_CURRENT_VERSION})"
-   echo " LATEST: $(date -u "-d@${BOOTLOADER_UPDATE_VERSION}") (${BOOTLOADER_UPDATE_VERSION})"
-   echo " FW DIR: ${FIRMWARE_IMAGE_DIR}"
+   echo "   CURRENT: $(date -u "-d@${BOOTLOADER_CURRENT_VERSION}") (${BOOTLOADER_CURRENT_VERSION})"
+   echo "    LATEST: $(date -u "-d@${BOOTLOADER_UPDATE_VERSION}") (${BOOTLOADER_UPDATE_VERSION})"
+   echo "   RELEASE: ${FIRMWARE_RELEASE_STATUS} (${FIRMWARE_IMAGE_DIR})"
+   echo "            Use ${RPI_EEPROM_UPDATE_CONFIG_TOOL} to change the release."
 
+   echo ""
+   if [ "${HAVE_VL805_EEPROM}" = 1 ]; then
+      echo "  VL805_FW: Dedicated VL805 EEPROM"
+   else
+      echo "  VL805_FW: Using bootloader EEPROM"
+   fi
    if [ "${ACTION_UPDATE_VL805}" = 1 ]; then
-      echo "VL805: update available"
+      echo "   VL805: update available"
    else
       if [ "$(id -u)" = "0" ]; then
-         echo "VL805: up-to-date"
+         echo "     VL805: up to date"
       else
-         echo "VL805: version unknown. Try sudo rpi-eeprom-update"
+         echo "     VL805: version unknown. Try sudo rpi-eeprom-update"
       fi
    fi
 
-   echo "CURRENT: ${VL805_CURRENT_VERSION}"
-   echo " LATEST: ${VL805_UPDATE_VERSION}"
+   echo "   CURRENT: ${VL805_CURRENT_VERSION}"
+   echo "    LATEST: ${VL805_UPDATE_VERSION}"
 }
 
 findBootFS()
@@ -493,9 +547,7 @@ findBootFS()
    # If BOOTFS is not a directory or doesn't contain any .elf files then
    # it's probably not the boot partition.
    [ -d "${BOOTFS}" ] || die "BOOTFS: \"${BOOTFS}\" is not a directory"
-   if [ "$(find "${BOOTFS}/" -name "*.elf" | wc -l)" -gt 0 ]; then
-      echo "BOOTFS ${BOOTFS}"
-   else
+   if [ "$(find "${BOOTFS}/" -name "*.elf" | wc -l)" = 0 ]; then
       echo "WARNING: BOOTFS: \"${BOOTFS}\" contains no .elf files. Please check boot directory"
    fi
 }
@@ -507,11 +559,7 @@ getVL805CurrentVersion()
    # root then treat the version as unknown and skip VLI updates.
    VL805_CURRENT_VERSION=""
    if [ "$(id -u)" = "0" ]; then
-      if command -v lspci >/dev/null; then
          vlver="$(lspci -d 1106:3483 -xxx | awk '/^50:/ { print "VL805 FW version: " $5 $4 $3 $2 }')"
-      else
-         vlver="$(vl805 | grep "VL805 FW version")"
-      fi
       if [ -n "${vlver}" ]; then
          VL805_CURRENT_VERSION="${vlver#*: }"
       fi
@@ -543,12 +591,30 @@ lookupVersionInfo()
 
    getVL805CurrentVersion
 
+   ACTION_UPDATE_BOOTLOADER=0
+   ACTION_UPDATE_VL805=0
+
    if [ "${BOOTLOADER_UPDATE_VERSION}" -gt "${BOOTLOADER_CURRENT_VERSION}" ]; then
       ACTION_UPDATE_BOOTLOADER=1
    else
       BOOTLOADER_UPDATE_IMAGE=""
    fi
 
+   # If the '-s' flag for silent updates is specified then only update the
+   # bootloader if the current version is older than the minimum version.
+   if [ "${SILENT_UPDATE}" = 1 ] && [ -n "${BOOTLOADER_AUTO_UPDATE_MIN_VERSION}" ] && [ "${ACTION_UPDATE_BOOTLOADER}" = 1 ]; then
+      if [ "${FIRMWARE_RELEASE_STATUS}" = "critical" ] || [ "${FIRMWARE_RELEASE_STATUS}" = "default" ]; then
+         if [ "${BOOTLOADER_CURRENT_VERSION}" -ge "${BOOTLOADER_AUTO_UPDATE_MIN_VERSION}" ]; then
+            echo "Skipping automatic bootloader upgrade. current ${BOOTLOADER_CURRENT_VERSION} >= min ${BOOTLOADER_AUTO_UPDATE_MIN_VERSION}"
+            echo ""
+
+            # Clear the update requried flag
+            ACTION_UPDATE_BOOTLOADER=0
+            BOOTLOADER_UPDATE_IMAGE=""
+         fi
+      fi
+   fi
+
    if [ "${HAVE_VL805_EEPROM}" = 1 ]; then
       getVL805UpdateVersion
       if [ -n "${VL805_CURRENT_VERSION}" ] && [ -n "${VL805_UPDATE_VERSION}" ]; then
@@ -581,9 +647,10 @@ checkAndApply()
 
    if [ "${ACTION_UPDATE_BOOTLOADER}" = 1 ] || [ "${ACTION_UPDATE_VL805}" = 1 ]; then
       echo "*** INSTALLING EEPROM UPDATES ***"
+      echo ""
+
       printVersions
       applyUpdate
-      echo "EEPROM updates pending. Please reboot to apply the update."
    else
       printVersions
    fi
@@ -593,6 +660,7 @@ fileUpdate()
 {
    removePreviousUpdates
    echo "*** INSTALLING ${BOOTLOADER_UPDATE_IMAGE} ${VL805_UPDATE_IMAGE} ***"
+   echo
 
    if [ -n "${BOOTLOADER_UPDATE_IMAGE}" ]; then
       [ -f "${BOOTLOADER_UPDATE_IMAGE}" ] || die "Bootloader image \"${BOOTLOADER_UPDATE_IMAGE}\" not found"
@@ -603,7 +671,6 @@ fileUpdate()
    fi
 
    applyUpdate
-   echo "EEPROM update pending. Please reboot to apply the update."
 }
 
 removePreviousUpdates()
@@ -611,14 +678,16 @@ removePreviousUpdates()
    if [ "$(id -u)" = "0" ]; then
       findBootFS
 
-      # Remove any stale recovery.bin files or EEPROM images
-      # N.B. recovery.bin is normally ignored by the ROM if is not a valid
-      # executable but it's best to not have the file at all.
-      rm -f "${BOOTFS}/recovery.bin"
-      rm -f "${BOOTFS}/pieeprom.bin" "${BOOTFS}/pieeprom.upd" "${BOOTFS}/pieeprom.sig"
-      rm -f "${BOOTFS}/vl805.bin" "${BOOTFS}/vl805.sig"
-      # Case insensitive for FAT bootfs
-      find "${BOOTFS}" -maxdepth 1 -type f -follow -iname "recovery.*" -regex '.*\.[0-9][0-9][0-9]$' -exec rm -f {} \;
+      (
+         # Remove any stale recovery.bin files or EEPROM images
+         # N.B. recovery.bin is normally ignored by the ROM if is not a valid
+         # executable but it's best to not have the file at all.
+         rm -f "${BOOTFS}/recovery.bin"
+         rm -f "${BOOTFS}/pieeprom.bin" "${BOOTFS}/pieeprom.upd" "${BOOTFS}/pieeprom.sig"
+         rm -f "${BOOTFS}/vl805.bin" "${BOOTFS}/vl805.sig"
+         # Case insensitive for FAT bootfs
+         find "${BOOTFS}" -maxdepth 1 -type f -follow -iname "recovery.*" -regex '.*\.[0-9][0-9][0-9]$' -exec rm -f {} \;
+      ) || die "Failed to remove previous update files"
    fi
 }
 
@@ -626,7 +695,7 @@ checkVersion()
 {
    lookupVersionInfo
 
-   if [ "${BOOTLOADER_UPDATE_VERSION}" -gt "${BOOTLOADER_CURRENT_VERSION}" ]; then
+   if [ "${ACTION_UPDATE_BOOTLOADER}" = 1 ] || [ "${ACTION_UPDATE_VL805}" = 1 ]; then
       echo "*** UPDATE AVAILABLE ***"
       printVersions
       write_status_info "EXIT_UPDATE_REQUIRED"
@@ -647,11 +716,13 @@ write_status_info()
    bootloader_new="${BOOTLOADER_UPDATE_VERSION:-0}"
    vl805_cur="${VL805_CURRENT_VERSION}"
    vl805_new="${VL805_UPDATE_VERSION}"
+   min_ver=${BOOTLOADER_AUTO_UPDATE_MIN_VERSION:-0}
 
     if [ "${JSON_OUTPUT}" = "no" ]; then
       [ "${HAVE_VL805_EEPROM}" = "0" ] && vl805_eeprom="no" || vl805_eeprom="yes"
       cat > "${MACHINE_OUTPUT}" <<EOF
 EXITCODE="${exit_code}"
+BOOTLOADER_AUTO_UPDATE_MIN_VERSION=${min_ver}
 BOOTLOADER_CURRENT=${bootloader_cur}
 BOOTLOADER_LATEST=${bootloader_new}
 VL805_CURRENT="${vl805_cur}"
@@ -663,6 +734,7 @@ EOF
       cat > "${MACHINE_OUTPUT}" <<EOF
 {
   "EXITCODE": "${exit_code}",
+  "BOOTLOADER_AUTO_UPDATE_MIN_VERSION": ${min_ver},
   "BOOTLOADER_CURRENT": ${bootloader_cur},
   "BOOTLOADER_LATEST": ${bootloader_new},
   "VL805_CURRENT": "${vl805_cur}",
@@ -676,11 +748,17 @@ EOF
 
 AUTO_UPDATE_BOOTLOADER=0
 AUTO_UPDATE_VL805=0
+SILENT_UPDATE=0
 MACHINE_OUTPUT=""
 JSON_OUTPUT="no"
-IGNORE_DPKG_CHECKSUMS=$LOCAL_MODE
+IGNORE_DPKG_CHECKSUMS=${LOCAL_MODE}
+PACKAGE_INFO_DIR="/var/lib/dpkg/info/"
+if [ ! -d "${PACKAGE_INFO_DIR}" ]; then
+   IGNORE_DPKG_CHECKSUMS=1
+fi
 
-while getopts A:adhif:m:ju:r option; do
+
+while getopts A:abdhilf:m:ju:rs option; do
    case "${option}" in
    A)
       if [ "${OPTARG}" = "bootloader" ]; then
@@ -694,6 +772,11 @@ while getopts A:adhif:m:ju:r option; do
    a) AUTO_UPDATE_BOOTLOADER=1
       AUTO_UPDATE_VL805=1
       ;;
+   b)
+      findBootFS
+      echo "${BOOTFS}"
+      exit 0
+      ;;
    d) OVERWRITE_CONFIG=1
       ;;
    f) BOOTLOADER_UPDATE_IMAGE="${OPTARG}"
@@ -702,6 +785,11 @@ while getopts A:adhif:m:ju:r option; do
       ;;
    j) JSON_OUTPUT="yes"
       ;;
+   l)
+      getBootloaderUpdateVersion
+      echo "${BOOTLOADER_UPDATE_IMAGE}"
+      exit 0
+      ;;
    m) MACHINE_OUTPUT="${OPTARG}"
       ;;
    h) usage
@@ -711,6 +799,8 @@ while getopts A:adhif:m:ju:r option; do
       removePreviousUpdates
       exit 0
       ;;
+   s) SILENT_UPDATE=1
+      ;;
    u) VL805_UPDATE_IMAGE="${OPTARG}"
       ;;
    *) echo "Unknown argument \"${option}\""
@@ -721,8 +811,8 @@ done
 
 checkDependencies
 if [ "${AUTO_UPDATE_BOOTLOADER}" = 1 ] || [ "${AUTO_UPDATE_VL805}" = 1 ]; then
-   if vcgencmd bootloader_config | grep FREEZE_VERSION=1; then
-      echo "EEPROM version is frozen. Skipping update"
+   if getBootloaderConfig | grep FREEZE_VERSION=1; then
+      echo "EEPROM version is frozen. Skipping automatic update"
       exit ${EXIT_EEPROM_FROZEN}
    else
       checkAndApply

test/bootconf.sig

@@ -0,0 +1,3 @@
+b5b917dc53a59c23035a89d4c58606211a07d4fb6e16bd00d74457a93ea5a264
+ts: 1614092425
+rsa2048: 284d3ef8b960ef9dd0bf5f320eacccb527623890b11136801fcfaf950ef3fb32c9b86ee48337d2cd21e00665a62215ff4d811b15d89867fb55d71b6372a4fa4b79af60cdda84c8a7d9b52d5f2b3026d3b088345d9424842cc2eb73e23f4577e12c74bc3bc1890bfbb6509fc8702cd3a202929bb6f9e5162ea53ec6e8503e08dda7b0c86a90bc21d33bd49535554383fe88e7d1d8e46e27c2bce60cf15b69c56ee27ccdd81ff8f47a616a2796cc2d943e17c6c01ac191f9b7dcda440238062e6c49df01f4bb8b97ce380a46aa29a03bf3fcbede3d76c13d862fc8b60b472a4d1017d5535f5188858a6e1103db2666aa63264e7c1f752b917405527094ed0da737

test/bootconf.txt

@@ -0,0 +1,8 @@
+[all]
+BOOT_UART=1
+WAKE_ON_GPIO=1
+POWER_OFF_ON_HALT=0
+HDMI_DELAY=0
+# Load firmware and kernel from signed boot.img file
+SIGNED_BOOT=1
+

test/configs/bootconf-2019-07-15.txt

@@ -0,0 +1,16 @@
+BOOT_UART=0
+WAKE_ON_GPIO=1
+POWER_OFF_ON_HALT=0
+                                                                              
+                                                                              
+                                                                              
+                                                                              
+                                                                              
+                                                                              
+                                                                              
+                                                                              
+                                                                              
+                                                                              
+                                                                             
+                                                                              
+             

test/configs/bootconf-2019-09-06.txt

@@ -0,0 +1,16 @@
+BOOT_UART=0
+WAKE_ON_GPIO=1
+POWER_OFF_ON_HALT=0
+FREEZE_VERSION=0                                                                 
+                                                                              
+                                                                              
+                                                                              
+                                                                              
+                                                                              
+                                                                              
+                                                                              
+                                                                              
+                                                                              
+                                                                             
+                                                                              
+      

test/configs/bootconf-2019-09-10.txt

@@ -0,0 +1,16 @@
+BOOT_UART=0
+WAKE_ON_GPIO=1
+POWER_OFF_ON_HALT=0
+FREEZE_VERSION=0                                                                 
+                                                                              
+                                                                              
+                                                                              
+                                                                              
+                                                                              
+                                                                              
+                                                                              
+                                                                              
+                                                                              
+                                                                             
+                                                                              
+      

test/configs/bootconf-2019-09-23.txt

@@ -0,0 +1,23 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+POWER_OFF_ON_HALT=0
+DHCP_TIMEOUT=45000
+DHCP_REQ_TIMEOUT=4000
+TFTP_FILE_TIMEOUT=15000
+TFTP_IP=
+BOOT_ORDER=0x1
+SD_BOOT_MAX_RETRIES=3
+NET_BOOT_MAX_RETRIES=5
+[none]
+FREEZE_VERSION=0
+                                                                             
+                                                                             
+                                                                             
+                                                                             
+                                                                             
+                                                                             
+                                                                             
+                                                                             
+                                                                             
+                                                                                          

test/configs/bootconf-2019-09-25.txt

@@ -0,0 +1,14 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+POWER_OFF_ON_HALT=0
+DHCP_TIMEOUT=45000
+DHCP_REQ_TIMEOUT=4000
+TFTP_FILE_TIMEOUT=30000
+TFTP_IP=
+BOOT_ORDER=0x1
+SD_BOOT_MAX_RETRIES=3
+NET_BOOT_MAX_RETRIES=5
+[none]
+FREEZE_VERSION=0
+

test/configs/bootconf-2019-10-08.txt

@@ -0,0 +1,14 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+POWER_OFF_ON_HALT=0
+DHCP_TIMEOUT=45000
+DHCP_REQ_TIMEOUT=4000
+TFTP_FILE_TIMEOUT=30000
+TFTP_IP=
+BOOT_ORDER=0x1
+SD_BOOT_MAX_RETRIES=3
+NET_BOOT_MAX_RETRIES=5
+[none]
+FREEZE_VERSION=0
+

test/configs/bootconf-2019-10-16.txt

@@ -0,0 +1,14 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+POWER_OFF_ON_HALT=0
+DHCP_TIMEOUT=45000
+DHCP_REQ_TIMEOUT=4000
+TFTP_FILE_TIMEOUT=30000
+TFTP_IP=
+BOOT_ORDER=0x1
+SD_BOOT_MAX_RETRIES=3
+NET_BOOT_MAX_RETRIES=5
+[none]
+FREEZE_VERSION=0
+

test/configs/bootconf-2019-11-18.txt

@@ -0,0 +1,15 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+POWER_OFF_ON_HALT=0
+DHCP_TIMEOUT=45000
+DHCP_REQ_TIMEOUT=4000
+TFTP_FILE_TIMEOUT=30000
+TFTP_IP=
+TFTP_PREFIX=0
+BOOT_ORDER=0x1
+SD_BOOT_MAX_RETRIES=3
+NET_BOOT_MAX_RETRIES=5
+[none]
+FREEZE_VERSION=0
+

test/configs/bootconf-2019-12-03.txt

@@ -0,0 +1,15 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+POWER_OFF_ON_HALT=0
+DHCP_TIMEOUT=45000
+DHCP_REQ_TIMEOUT=4000
+TFTP_FILE_TIMEOUT=30000
+TFTP_IP=
+TFTP_PREFIX=0
+BOOT_ORDER=0x1
+SD_BOOT_MAX_RETRIES=3
+NET_BOOT_MAX_RETRIES=5
+[none]
+FREEZE_VERSION=0
+

test/configs/bootconf-2020-01-09.txt

@@ -0,0 +1,15 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+POWER_OFF_ON_HALT=0
+DHCP_TIMEOUT=45000
+DHCP_REQ_TIMEOUT=4000
+TFTP_FILE_TIMEOUT=30000
+TFTP_IP=
+TFTP_PREFIX=0
+BOOT_ORDER=0x1
+SD_BOOT_MAX_RETRIES=3
+NET_BOOT_MAX_RETRIES=5
+[none]
+FREEZE_VERSION=0
+

test/configs/bootconf-2020-01-17.txt

@@ -0,0 +1,15 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+POWER_OFF_ON_HALT=0
+DHCP_TIMEOUT=45000
+DHCP_REQ_TIMEOUT=4000
+TFTP_FILE_TIMEOUT=30000
+TFTP_IP=
+TFTP_PREFIX=0
+BOOT_ORDER=0x1
+SD_BOOT_MAX_RETRIES=3
+NET_BOOT_MAX_RETRIES=5
+[none]
+FREEZE_VERSION=0
+

test/configs/bootconf-2020-03-04.txt

@@ -0,0 +1,15 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+POWER_OFF_ON_HALT=0
+DHCP_TIMEOUT=45000
+DHCP_REQ_TIMEOUT=4000
+TFTP_FILE_TIMEOUT=30000
+TFTP_IP=
+TFTP_PREFIX=0
+BOOT_ORDER=0x1
+SD_BOOT_MAX_RETRIES=3
+NET_BOOT_MAX_RETRIES=5
+[none]
+FREEZE_VERSION=0
+

test/configs/bootconf-2020-03-16.txt

@@ -0,0 +1,15 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+POWER_OFF_ON_HALT=0
+DHCP_TIMEOUT=45000
+DHCP_REQ_TIMEOUT=4000
+TFTP_FILE_TIMEOUT=30000
+TFTP_IP=
+TFTP_PREFIX=0
+BOOT_ORDER=0x1
+SD_BOOT_MAX_RETRIES=3
+NET_BOOT_MAX_RETRIES=5
+[none]
+FREEZE_VERSION=0
+

test/configs/bootconf-2020-03-19.txt

@@ -0,0 +1,15 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+POWER_OFF_ON_HALT=0
+DHCP_TIMEOUT=45000
+DHCP_REQ_TIMEOUT=4000
+TFTP_FILE_TIMEOUT=30000
+TFTP_IP=
+TFTP_PREFIX=0
+BOOT_ORDER=0x1
+SD_BOOT_MAX_RETRIES=3
+NET_BOOT_MAX_RETRIES=5
+[none]
+FREEZE_VERSION=0
+

test/configs/bootconf-2020-04-09.txt

@@ -0,0 +1,15 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+POWER_OFF_ON_HALT=0
+DHCP_TIMEOUT=45000
+DHCP_REQ_TIMEOUT=4000
+TFTP_FILE_TIMEOUT=30000
+TFTP_IP=
+TFTP_PREFIX=0
+BOOT_ORDER=0x1
+SD_BOOT_MAX_RETRIES=3
+NET_BOOT_MAX_RETRIES=5
+[none]
+FREEZE_VERSION=0
+

test/configs/bootconf-2020-04-16.txt

@@ -0,0 +1,15 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+POWER_OFF_ON_HALT=0
+DHCP_TIMEOUT=45000
+DHCP_REQ_TIMEOUT=4000
+TFTP_FILE_TIMEOUT=30000
+TFTP_IP=
+TFTP_PREFIX=0
+BOOT_ORDER=0x1
+SD_BOOT_MAX_RETRIES=3
+NET_BOOT_MAX_RETRIES=5
+[none]
+FREEZE_VERSION=0
+

test/configs/bootconf-2020-05-15.txt

@@ -0,0 +1,13 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+POWER_OFF_ON_HALT=0
+DHCP_TIMEOUT=45000
+DHCP_REQ_TIMEOUT=4000
+TFTP_FILE_TIMEOUT=30000
+ENABLE_SELF_UPDATE=1
+DISABLE_HDMI=0
+SD_BOOT_MAX_RETRIES=1
+USB_MSD_BOOT_MAX_RETRIES=1
+BOOT_ORDER=0xf41
+

test/configs/bootconf-2020-05-26.txt

@@ -0,0 +1,13 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+POWER_OFF_ON_HALT=0
+DHCP_TIMEOUT=45000
+DHCP_REQ_TIMEOUT=4000
+TFTP_FILE_TIMEOUT=30000
+ENABLE_SELF_UPDATE=1
+DISABLE_HDMI=0
+SD_BOOT_MAX_RETRIES=1
+USB_MSD_BOOT_MAX_RETRIES=1
+BOOT_ORDER=0xf41
+

test/configs/bootconf-2020-05-27.txt

@@ -0,0 +1,13 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+POWER_OFF_ON_HALT=0
+DHCP_TIMEOUT=45000
+DHCP_REQ_TIMEOUT=4000
+TFTP_FILE_TIMEOUT=30000
+ENABLE_SELF_UPDATE=1
+DISABLE_HDMI=0
+SD_BOOT_MAX_RETRIES=1
+USB_MSD_BOOT_MAX_RETRIES=1
+BOOT_ORDER=0xf41
+

test/configs/bootconf-2020-05-28.txt

@@ -0,0 +1,13 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+POWER_OFF_ON_HALT=0
+DHCP_TIMEOUT=45000
+DHCP_REQ_TIMEOUT=4000
+TFTP_FILE_TIMEOUT=30000
+ENABLE_SELF_UPDATE=1
+DISABLE_HDMI=0
+SD_BOOT_MAX_RETRIES=1
+USB_MSD_BOOT_MAX_RETRIES=1
+BOOT_ORDER=0xf41
+

test/configs/bootconf-2020-06-03.txt

@@ -0,0 +1,11 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+POWER_OFF_ON_HALT=0
+DHCP_TIMEOUT=45000
+DHCP_REQ_TIMEOUT=4000
+TFTP_FILE_TIMEOUT=30000
+ENABLE_SELF_UPDATE=1
+DISABLE_HDMI=0
+BOOT_ORDER=0xf41
+

test/configs/bootconf-2020-06-12.txt

@@ -0,0 +1,11 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+POWER_OFF_ON_HALT=0
+DHCP_TIMEOUT=45000
+DHCP_REQ_TIMEOUT=4000
+TFTP_FILE_TIMEOUT=30000
+ENABLE_SELF_UPDATE=1
+DISABLE_HDMI=0
+BOOT_ORDER=0xf41
+

test/configs/bootconf-2020-06-15.txt

@@ -0,0 +1,11 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+POWER_OFF_ON_HALT=0
+DHCP_TIMEOUT=45000
+DHCP_REQ_TIMEOUT=4000
+TFTP_FILE_TIMEOUT=30000
+ENABLE_SELF_UPDATE=1
+DISABLE_HDMI=0
+BOOT_ORDER=0xf41
+

test/configs/bootconf-2020-07-06.txt

@@ -0,0 +1,11 @@
+[all]
+BOOT_UART=0
+WAKE_ON_GPIO=1
+POWER_OFF_ON_HALT=0
+DHCP_TIMEOUT=45000
+DHCP_REQ_TIMEOUT=4000
+TFTP_FILE_TIMEOUT=30000
+ENABLE_SELF_UPDATE=1
+DISABLE_HDMI=0
+BOOT_ORDER=0xf41
+