tools VS usbboot

curl -L https://github.com/raspberrypi/tools/archive/648a6eeb1e3c2b40af4eb34d88941ee0edeb3e9a.tar.gz | tar xz --strip-components 1 -C /pi-tools

- Clone the following repo: https://github.com/raspberrypi/tools.git- Copy everything from arm-bcm2708/arm-linux-gnueabihf/bin/ to a place of your choice, e.g /usr/local/armv6/bin/- Alter your ~/.cargo/config with

https://github.com/raspberrypi/usbboot/blob/master/secure-bo...

Note that the Raspberry Pi does not have a full TrustZone implementation to protect secure mode memory, etc. But it is a widely available device with good documentation and allows developers to experiment with and learn about the basics of TrustZone architecture.

The Pi4 has true hardware support for secure boot. If set up correctly, you won't be able to boot anything not properly signed. An incomplete overview of how this works is:

* Instead of having all boot related files (start4.elf, kernel.img, ...) on the first partition of the SD card, you instead have a single boot.img FAT image containing those files instead.

* You sign that file with your own RSA 2048 key and place a boot.sig containing the signature next to the boot.img file.

* You flash the Pi4 EEPROM and include your public key and some additional EEPROM settings.

* You instruct the EEPROM to burn the hash of your public key into the Pi's OTP memory. Once that's done, the key cannot be changed and the Pi will not boot into anything not signed with your key.

* Optionally you can also place keys for disk encryption into the OTP memory and use that to encrypt everything except the boot files. That way it should be pretty hard to access them as you cannot run a rogue OS to read the OTP memory due to secure boot.

References:

* https://github.com/raspberrypi/usbboot/blob/master/secure-bo...

That may be something you could do with this tool? I haven’t tried it myself yet, but I’ve been meaning to. https://github.com/raspberrypi/usbboot

I used a CM4 with 2GB, 8 GB eMMC, and has wifi/bt. To flash the eMMC memory, you need rpiboot. Some instructions link to old versions, it might not connect the CM4. Click current release on Raspberry Pi's usbboot github. I tried different carrier boards, different cables, different computers before figuring this out...

This is exactly what I just discovered! I was having a hard time getting the CM4 in my GPi 2 Case to get recognized by my PC. You need to download usbboot from Raspberry Pi’s GitHub page https://github.com/raspberrypi/usbboot

I went further and tried this: https://github.com/raspberrypi/usbboot

On the Pi Zero and Pi CM (maybe also others) you don't even need an SD card to boot it. You can boot it via rpi-boot https://github.com/raspberrypi/usbboot

apt update apt install build-essential libusb-1.0-0-dev git -y git clone --depth=1 https://github.com/raspberrypi/usbboot cd usbboot make ./rpiboot