rpi-eeprom-update: Firmware downgrades now require the '-y' flag or an interactive response - #875
Merged
timg236 merged 6 commits intoSep 7, 2026
Conversation
pelwell
reviewed
Sep 7, 2026
timg236
force-pushed
the
bootloader-strict-version-checks
branch
from
September 7, 2026 12:07
4799ad1 to
bf9e459
Compare
pelwell
reviewed
Sep 7, 2026
timg236
force-pushed
the
bootloader-strict-version-checks
branch
from
September 7, 2026 12:26
bf9e459 to
03f367f
Compare
popcornmix
reviewed
Sep 7, 2026
popcornmix
reviewed
Sep 7, 2026
timg236
force-pushed
the
bootloader-strict-version-checks
branch
from
September 7, 2026 12:28
03f367f to
f12ae3f
Compare
…unknown Add some defensive code to ensure that missing / invalid device tree nodes cannot trigger an automatic firmware update. Guard readDtInt against an empty property and do not pass an empty string to date, which would otherwise be interpreted as today. Remove dead code for the original 'launch' version of the Pi4 bootloader.
…ader Installing an older bootloader only printed a warning. This is easy to hit because rpi-eeprom-config applies config changes to the newest image in the package, which may be older than the factory bootloader on new board revisions. Prompt on the tty, or fail if there is none, unless -y or RPI_EEPROM_ALLOW_DOWNGRADE=1 is given. Check MFG_VER first so a rejected image is not offered for confirmation. Automatic updates never select an older image and are unaffected.
Refuse images with an MFG_VER older than the board manufacture version. Set STRICT_MIN_VER_CHECK=0 to restore the previous warning-only behaviour.
Otherwise the update continues in the background after the timeout error has been reported.
timg236
force-pushed
the
bootloader-strict-version-checks
branch
from
September 7, 2026 12:45
f12ae3f to
779c5d3
Compare
popcornmix
approved these changes
Sep 7, 2026
pelwell
approved these changes
Sep 7, 2026
Show stderr as it arrives instead of dumping the captured output after a failure so a cancelled downgrade reads as a single message.
Collaborator
Author
|
Sorry, I added two more comments. I thought the ctrl-C behaviour from 'rpi-eeprom-config --edit' in the 'do you want to proceed prompt' was a bi t ugly because you got a Python exception backtrace. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In addition to the version check change the default behaviour to never downgrade the bootloader to an older version without prompting the user unless the '-y' flag is passed.
Also, add defensive code to verify that the update timestamp specified in device-tree is valid and that the node is present e.g. if u-boot is used and device-tree does not match RPI OS expected layout for the bootloader.