# Source: cm-bootloader.adoc

*Note: This file could not be automatically converted from AsciiDoc.*

== Compute Module EEPROM bootloader

Since Compute Module 4, Compute Modules use an EEPROM bootloader. This bootloader lives in a small segment of on-board storage instead of the boot partition. As a result, it requires different procedures to update. Before using a Compute Module with an EEPROM bootloader in production, always follow these best practices:

* Select a specific bootloader release. Verify that every Compute Module you use has that release. The version in the `usbboot` repo is always a recent stable release.
* Configure the boot device by xref:raspberry-pi.adoc#raspberry-pi-bootloader-configuration[setting the `BOOT_ORDER` ].
* Enable hardware write-protection on the bootloader EEPROM to ensure that the bootloader can't be modified on inaccessible products (such as remote or embedded devices).

=== Flash Compute Module bootloader EEPROM

To flash the bootloader EEPROM:

. Set up the hardware as you would when xref:../computers/compute-module.adoc#flash-compute-module-emmc[flashing the eMMC], but ensure `EEPROM_nWP` is _not_ pulled low.
. Run the following command to write `recovery/pieeprom.bin` to the bootloader EEPROM:
+
[source,console]
----
$ ./rpiboot -d recovery
----
. Once complete, `EEPROM_nWP` may be pulled low again.

=== Flash storage devices other than SD cards

The Linux-based https://github.com/raspberrypi/usbboot/blob/master/mass-storage-gadget/README.md[`mass-storage-gadget`] supports flashing of NVMe, eMMC and USB block devices. `mass-storage-gadget` writes devices faster than the firmware-based `rpiboot` mechanism, and also provides a UART console to the device for debugging.

`usbboot` also includes a number of https://github.com/raspberrypi/usbboot/blob/master/Readme.md#compute-module-4-extensions[extensions] that enable you to interact with the EEPROM bootloader on a Compute Module.

=== Update the Compute Module bootloader

On Compute Modules with an EEPROM bootloader, ROM never runs `recovery.bin` from SD/eMMC. These Compute Modules disable the `rpi-eeprom-update` service by default, because eMMC is not removable and an invalid `recovery.bin` file could prevent the system from booting.

You can override this behaviour with `self-update` mode. In `self-update` mode, you can update the bootloader from USB MSD or network boot.

WARNING: `self-update` mode does not update the bootloader atomically. If a power failure occurs during an EEPROM update, you could corrupt the EEPROM.

=== Modify the bootloader configuration

To modify the Compute Module EEPROM bootloader configuration:

. Navigate to the `usbboot/recovery` directory.
. If you require a specific bootloader release, replace `pieeprom.original.bin` with the equivalent from your bootloader release.
. Edit the default `boot.conf` bootloader configuration file to define a xref:../computers/raspberry-pi.adoc#BOOT_ORDER[`BOOT_ORDER`]:
 * For network boot, use `BOOT_ORDER=0xf2`.
 * For SD/eMMC boot, use `BOOT_ORDER=0xf1`.
 * For USB boot failing over to eMMC, use `BOOT_ORDER=0xf15`.
 * For NVMe boot, use `BOOT_ORDER=0xf6`.
. Run `./update-pieeprom.sh` to generate a new EEPROM image `pieeprom.bin` image file.
. If you require EEPROM write-protection, add `eeprom_write_protect=1` to  `/boot/firmware/config.txt`.
 * Once enabled in software, you can lock hardware write-protection by pulling the `EEPROM_nWP` pin low.
. Run the following command to write the updated `pieeprom.bin` image to EEPROM:
+
[source,console]
----
$ ../rpiboot -d .
----